joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140087f10
Capabilities:
Encode data using base64

Disassembly:
movabs rcx, 0x8e0e83996f29a622
and cl, 0x3f
seto bl
call fcn.140081e9b

Function at 0x140088752
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [rsp + rcx*2 - 0x1b7c7], ecx
mov rcx, qword [rsp + rcx - 0xdbbc]
not dword [rsp + 0x40]
lea rsp, [rsp + 0x38]
ret 0x10
mov rdx, qword [rdx]
jo 0x14007d33f
je 0x14000a51d
setle r15b
call fcn.1400db8b5
invalid

Function at 0x14008a4e7
Capabilities:
Authenticate hmac

Disassembly:
sub r15b, 0xab
or r15w, r15w
lea rdi, [rdi + 0x62004eb7]
add qword [rsp], 0xffffffffbff80484
neg r15w
seta r15b
neg r15
mov qword [rsp + 0x30], r15
push r10
xchg qword [rsp + 0x40], rdi
mov r15, qword [rsp + 0x28]
movabs r10, 0x361a5c07dd9d8abe
xor qword [rsp + 0x38], 0x2b18071c
call fcn.140059a90
test rdi, 0xffffffffa6b18220
movsx di, r15b
mov rdi, qword [rsp + r15 - 0x643316d3]
mov rdi, qword [rdi + r15 - 0x64331703]
lea r15, [r15 + r15*2 + 0x2b3102ab]
seto r15b
jae 0x1400c09de
jg 0x14004a684
mov word [rsp + 0x10], 0xde19
or byte [rsp + 0x10], 0x24
jl 0x1400d4c09
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
ret

Function at 0x14008ad0b
Capabilities:
Delete registry value

Disassembly:
cmp byte [rsp + 0x48], r15b
jns 0x1400a3066

Function at 0x14008d748
Capabilities:
Encode data using base64

Disassembly:
movabs rdx, 0x340c1a22db01c920
or bx, 0xaaa0
add qword [rsp], 0xfffffffffff87028
xor edx, 0x38b74b0e
mov rdx, qword [rsp + 0x18]
mov rdx, qword [rdx]
js 0x140091268
Function at 0x14008eb64
Capabilities:
Encode data using base64

Disassembly:
ret
ja 0x14007b779
call fcn.14006f612
push r10
push rbp
xor word [rsp + 0x40], cx
or r8, qword [rsp + 0x30]
jle 0x14004b2dd
movabs rdi, 0xc1320c9107037fad
pushfq
call fcn.14005503c
retf 0xcccc
mov rcx, qword [rsp + 0x20]
ja 0x140010085
mov cl, 0xc4
int3
mov rbp, r14
xchg qword [rsp + 0x60], rdx
mov r8, qword [rsp + 0x48]
movabs r10, 0x912ddd8d5d813c83
neg ecx
pop rbp
xor r10b, byte [rsp + 0x38]
mov r8b, byte [rsp + rbx*4 + 0x30]
setae byte [rsp + 0x30]
lea rdi, [rdi - 0x7dcb3448]
mov r12, qword [rsp + 0x30]
cmovae ebp, dword [rsp + 0x32]
shr bx, 0xb8
js 0x140086ad2
xchg qword [rsp + r12 + 0x47], rdi
mov r8, qword [rsp + 0x40]
test r12, 0xffffffff8512eab7
jbe 0x14001ab2e
shr cx, 0x28
setbe r9b
setae byte [rsp + r12*2 + 0x2e]
jb 0x1400a0c5a
mov r9, qword [rsp + rbx + 0x28]
shr cl, 2
test word [rsp + 0x32], bp
not ebp
jg fcn.1400aa58e
test byte [rsp + r12*2 + 0x2e], 0x8b
ja 0x14002f1cf
xchg qword [rsp + 0x70], rax
mov r9, qword [rsp + r9*2 - 0x7e5f0112]
call fcn.1400c31f6
xchg ebp, eax
push rdi
xchg edi, eax
movabs al, byte [0x244487480518b310]
xchg qword [rsp + 0x30], rax
mov r8, qword [rsp + 8]
sub byte [rsp + 0x18], 0x8b
xor r9b, byte [rsp + 0x1e]
mov r9d, dword [rsp + 0x19]
xor r9d, r9d
xor r9w, word [rsp + r9 + 0x1b]
mov r9b, 0x81
lea r9, [r9 + r9*2 - 0x4aebd258]
mov r9, qword [rsp + r9 + 0x4aebd0fd]
and word [rsp + 0x18], 0x8605
jle 0x1400cac8e
call fcn.140078850
add qword [rsp], 0x1f04d
or rbp, r8
jo 0x14000815b
seto bpl
not r8d
mov rdi, qword [rsp]
mov rdi, qword [rdi]
jo 0x14008ff85
mov rcx, r9
cmp r9b, byte [rsp + rbx + 0x34]
cmovne cx, word [rsp + 0x34]
jg 0x14005c76f
and r10d, r10d
call fcn.14007ee46
jg 0x14001c9bd
call fcn.140068679
mov r13, qword [rsp + r13 - 0xfee8]
add dword [rsp + 0x50], 0xc116f13
sets byte [rsp + 0x50]
not qword [rsp + 0x50]
neg word [rsp + 0x50]
call fcn.14000afd3

Function at 0x14008f257
Capabilities:
Enumerate process modules

Disassembly:
jl 0x140001538
mov qword [rsp + r8*2 - 0x68], rax
call fcn.140092386
in eax, 0x2b
add bl, dl
or eax, 0xb0bed907
mul esp
add esp, ecx
and eax, 0x48bbdc1a
cmc
mov edi, 0xc380b2a1
cmp al, 0x9f
xchg ecx, eax
invalid

Function at 0x140091bc8
Capabilities:
Connect pipe
Encode data using base64
Extract resource via kernel32 functions
Read file on windows
Set registry value

Disassembly:
push r13
or dword [rsp], r13d
jae 0x140092b08

Function at 0x1400969e1
Capabilities:
Encode data using base64

Disassembly:
mov r11, qword [rsp + 0x38]
add qword [rsp], 0xffffffffbff3b272
add byte [rsp + 0x10], r14b
shl word [rsp + 0x48], 0x84
jbe 0x1400a41a0
neg qword [rsp + 0x18]
mov r14, qword [rsp + 0x58]
cmp word [rsp + 0x18], 0x9205
call fcn.14005d0c5
mov r8, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0xfffffffff339b0cd
mov r10, qword [rsp + 0x10]
jne 0x140096b73
movabs r15, 0x670f71b025b29290
call fcn.140021461
Function at 0x140097a41
Capabilities:
Encode data using base64

Disassembly:
mov r10, rbp
mov qword [rsp + 0x30], rax
push rbp
push r8
pushfq
movabs rbp, 0xf30d47a9c99f7824
add qword [rsp + 0x18], 0x9f56
mov rax, qword [rsp + 0x28]
xor bp, bp
mov r8, rbp
xor r8, 0xffffffffde264fbd
jb 0x1400c4dfe
or bp, 0xe3b1
sub r8d, 0x49aefa1c
lea rax, [rax + 1]
or r8w, 0xcf80
push r10
ja 0x140050158
push rdx
push r10
movabs r10, 0xc0bb825e283f52a
pushfq
cmp r10w, 0x9594

Function at 0x140099c4a
Capabilities:
Terminate process

Disassembly:
sub r11w, 0x258f
sub r11w, 0xccae
test r11, 0xffffffff9b9f031b
setb r11b
xor r11b, 0x9f
nop
push rdx
neg r11d
movabs rdx, 0xb4bae21b9c16bda4
or rbp, r11
call fcn.14007a960
jne 0x14009de6f
mov dh, 0xcc
int3
jle fcn.1400cda88
jg 0x140010a50
mov rdi, r14
push 0x72af46b4
push r13
movabs r13, 0xd69cad89b202650d
push r9
xchg qword [rsp + 0x48], rbp
mov r8, qword [rsp + 0x20]
movsxd rdi, dword [rsp + 0x10]
je 0x140022d67
jo 0x14007233e
mov qword [rsp + 8], rbp
push 0x348e7caa
pushfq
add qword [rsp + 0x10], 0x20c88
shr dword [rsp + 8], 0x67
push r14
and byte [rsp + 0x10], 0xb4
mov rbp, qword [rsp + 0x10]
mov qword [rsp + rbp*4 - 0x1a472b0], 0xffffffffddaa0e01
push r8
movabs r8, 0xd1af91a3dab93484
sub dword [rsp + rbp*2 - 0xd23948], 0x7e29ee1e
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rbp + riz]
not r8b
je 0x14007f46b
mov qword [rsp + 0x20], r8
jne 0x1400c5319
mov qword [rsp + r11*4 - 0xc468], rbx
jno 0x140007be2
push rdi
mov r14, r8
lea rbp, [rbp + 0x41e27b7]
jo 0x1400527f4

Function at 0x14009b598
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
shr r9w, 0xe1
sub qword [rsp + r9 + 0x40], 0xffffffffd48d491a
add qword [rsp], 0x1e2e7
call fcn.14005491b

Function at 0x14009d056
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0xffffffffffffb09d
lea rdi, [rdi + 1]
push r14
movabs r14, 0xb12175bf0a187338
call fcn.14005b0fb
js 0x14007f2cf
jne 0x1400713a9

Function at 0x14009d080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setae bpl
neg dword [rsp + r15*2 + 0x1d8c]
mov r15, qword [rsp + 0x50]
xor dword [rsp + 0x38], 0xb80fdf8c
Function at 0x1400a4158
Capabilities:
Encode data using base64

Disassembly:
js 0x1400d4c0e
call fcn.1400c4567
call fcn.1400da58e
int3
push r15
jge 0x1400dfac3
call fcn.140016174
or rbp, qword [rsp + 0x38]
sub r15d, r15d
lea rcx, [rcx - 0x7dcb3448]
jge 0x14001393b
jno 0x14006f617
push r8
lea rcx, [rcx + 1]
movabs r8, 0xd02ebd8a60888a14
movzx r13w, byte [rsp + 0x22]
test byte [rsp + 0x20], r13b
mov qword [rsp + 0x40], rcx
mov word [rsp + 0x20], 0x923b
not r13b
push r15
mov r15, qword [rsp + 0x28]
add qword [rsp + 0x10], 0xfffffffffffa0992
push rbp
or dword [rsp + 0x30], 0xf9bda41d
neg r15w
and al, 0x30
sbb eax, 0x66f9bda4
neg r15d
movabs rbp, 0xeb8cd617ed058920
test bp, 0x2526
mov rcx, qword [rsp + 0x30]
push rdi
lea rcx, [r8 + r15*4 - 0x225a83ff]
jb 0x14001d660
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
shl r8w, 0x3d
add qword [rsp + 0x40], 0xfffffffffffdbb08
test r13d, r15d
jne 0x14008f597
or edx, ebp
rcr dword [rdx - 0x44], 0xde
fdivr dword [rdi + 0x729daab1]
jle 0x1400a4195
out dx, eax
cmc
xchg esi, eax
mov dword [rsi], esi
cmp al, 0x32
loopne 0x1400a4195
xchg ecx, eax
retf 0xfa3d
call fcn.1400a7605
setg byte [rsp]
shl qword [rsp], 0xd9
or dword [rsp], 0xe402e388
call fcn.14007d3d8
jl 0x14008fd84
lea rdx, [rdx - 0x49ed6acc]
or word [rsp + 0x18], r14w
call fcn.14001c9b9
js 0x1400ac45e
xchg qword [rsp + 0x60], rax
mov r15, qword [rsp + 0x20]
movsx edi, word [rsp + 8]
mov rdi, qword [rsp + 0x48]
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x58]
ret
Function at 0x1400a54f3
Capabilities:
Encode data using base64

Disassembly:
sub dword [rsp + 0x78], 0x141c90a8
jno 0x1400aa2fb
neg dword [rsp]
call fcn.14006ff2b
mov r14, qword [rsp + 0x50]
setne byte [rsp + 0x40]
sub word [rsp + 0x40], 0x4635
mov r13, r15
not r13w
shr r13, 0x7f
call fcn.1400ae271
mov r14, qword [rsp + 0x18]
mov qword [rsp + 0x18], rdi
push r13
movabs r13, 0xf320822147b7481f
add r13b, 0x21
shl r13, 0x3c
push r14
movabs r14, 0x4828149adf3ef29c
add qword [rsp + 0x10], 0x39591
call fcn.140015440
not edx
cmp qword [rsp + 0x78], r9
not r9b
mov r9b, 0x1a
mov dx, word [rsp + 0x79]
mov r9, qword [rsp + 0x58]
not dword [rsp + 0x78]
jns 0x1400b1e24
neg byte [rsp + 0x78]
mov rdx, qword [rsp + 0x90]
jb 0x140014e7e
invalid
jae 0x140022235
invalid
invalid
js 0x14007a313
mov r12, r13
push 0x291aa53d
xchg qword [rsp + 0x48], rbx
mov r13, qword [rsp + 0x38]
shr word [rsp], 0xcc
movsx r15, r15w
xor dword [rsp + 0x28], r12d
neg word [rsp + r15*2 + 0x1da4]
mov r12, qword [rsp + r15*4 + 0x3b00]
movabs rbp, 0xfbbcda2bb2aae8c
jb 0x1400210ad
jle 0x140022159
call fcn.14005aa5e
cli
jge 0x140077c8e
invalid
invalid
inc dword [rax]
add ah, ah
sub al, 0x59
jns 0x140077c55
stc
mov ecx, 0xafab5
add eax, 0x581d7dc8
invalid
invalid
or dword [rsp + 0x20], r15d
cmp r13, qword [rsp + 0x20]
jbe 0x14005bfdd
sbb al, ch
jmp 0x140079e2d
xor r15w, 0x4f2f
lea rbx, [rbx - 0x1670a74b]
push r12
js 0x140079e61
push 0xffffffffffffffdc
and edi, edi
invalid
push r11
push 0x4e3af211
mov r11, rdi
jle 0x140077c0c
add qword [rsp + 0x10], 0xffffffffffff91f9
push 0x5a194aa5
push rbp
mov rbp, r11
not dword [rsp + rbp - 0x68008011]
shl byte [rsp + r11 - 0x68008019], 0x87
bswap ebp
lea rbp, [r11*8 - 0x31c50763]
jb 0x14004cf1d
mov rsi, qword [rsp + rdi - 0x68008001]
mov rsi, qword [rsi + r11 - 0x68008021]
shl ebp, 0x75
mov r11d, 0x48d04a3
mov qword [rsp + rdi - 0x68008001], rbp
setne bpl
lea rsi, [rsi + rbp - 0x3081d84a]
not dil
neg edi
ja fcn.1400cb7cc
and byte [rsp + rbp*2 - 0x693ffffa], 0xf
push rdx
shr qword [rsp + rbp - 0x349ffff1], 0xe2
jb 0x1400221a0
add dword [rsp + 0x10], 0xae97879c
xchg qword [rsp + r11 - 0x48d0463], rsi
mov rbp, qword [rsp + r11*2 - 0x91a093e]
call fcn.140091318
invalid
and qword [rsp + 0x78], 0xffffffffcc18af8c
xor dword [rsp + 0x78], 0xed34d3a1
or word [rsp + 0x78], 0xef8a
push qword [rsp + 0x88]
popfq
lea rsp, [rsp + 0x98]
ret
and qword [rsp + rcx + 0x49], rcx
cmp rcx, 0x28c20a8
call fcn.140073508
sbb al, 0xa
mov rdi, qword [r8 - 0x131df769]
insd dword [rdi], dx
lahf
mov word [rbx - 0x2c], es
push 0x71
pop rbx
or byte [rdi], al
fdiv st(2)
fsub st(6)
int 0xf7
mov esp, 0xea5e6cbb
jb 0x1400b1ea8
invalid
add al, 0x1b
pop rax
or eax, dword [rax]
add byte [rax], al
add byte [rax], al
push rbp
or eax, 0xfff4a76b
invalid
jg 0x1400b1e67
invalid

Function at 0x1400a5d0e
Capabilities:
Authenticate hmac
Encode data using base64
Packed with generic packer

Disassembly:
push rdi
pushfq
movabs rdi, 0xb0b463ab20a81a08
lea rdi, [rdi + rdi*2 + 0x49a85f38]
xor edi, 0xa3a9268f
mov qword [rsp + 0x10], 0x7372d0cd
mov rdi, qword [rsp + rdi - 0x8098bd7]
jne 0x1400a8bf3
and r12w, r12w
Function at 0x1400a6cbe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x30], rcx
movabs rbp, 0xe5012b1a9e943587
lea rbp, [rdx + rdx + 0x21b20390]
push rcx
push r8
movabs rcx, 0x28989e8f6e038701
movabs r8, 0x34ba4896272733b5
add qword [rsp + 0x30], 0x44017
neg dx
movabs rcx, 0x7a50f857faab022
js 0x140097b9b
call fcn.1400d9f36
mov rcx, rax
call fcn.140025568
mov qword [0x14003f798], rax
jmp fcn.14002bf99
shl cl, cl
jb 0x14002bf73
not r8d
call fcn.140089cfd
lahf
add eax, 0xb5eac0db
stc
jmp fcn.140097b36
mov qword [rsp + 0x40], r10
jge 0x14000ae7d
not qword [rsp + 0x40]
test word [rsp + 0x42], r10w
mov r10, qword [rsp + 0x40]
mov r10, qword [rsp + 0x70]
jb 0x1400c68cf
mov byte [rsp + 0x40], 0x96
jl 0x1400b2b5e
setne byte [rsp + 0x40]
or qword [rsp + 0x80], 0xffffffff80ba3010
not byte [rsp + 0x40]
shl byte [rsp + 0x80], 0x36
xor word [rsp + 0x80], 0x4daa
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x88]
ret
mov qword [rsp + r11 + 0xd11a], rdx
mov qword [rsp + 0x38], rax
call fcn.14004f5b1

Function at 0x1400aa568
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
jbe 0x1400b6b12
add qword [rsp + 0x10], 0xffffffffbffa3bd1

Function at 0x1400ae123
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + 0x38], 0xfffffffffffe45ae
push 0xfffffffffe03b894
push r15
lea rbx, [rbp + rbp*4 + 0x33a0817]
xor ebx, ebx
or ebx, dword [rsp + 0xb]
xor bx, word [rsp + 0xb]
movabs rdx, 0xdf311f002a829416
and byte [rsp + 8], 0x1d
mov rdx, qword [rsp + 0x48]
mov rdx, qword [rdx]
jne 0x1400d4de9
and byte [rdx + rsi + 0x1d], 0x81
invalid
movabs rax, 0x1d2ff2ae97ad702e
jb 0x1400c36e4
jb 0x14001d714
and rax, 0xffffffffab2dd738
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
neg r11b
jg 0x1400c4db0
jae 0x140064157

Function at 0x1400b1cdb
Capabilities:
Connect pipe
Encode data using base64
Extract resource via kernel32 functions
Read file on windows
Set registry value

Disassembly:
or qword [rsp + r14 - 0x2a6ac5eb], 0x5ab6a397
lea r14, [r14*2 - 0x54440956]
neg r14
jl 0x14000d61d
mov qword [rsp + r14 - 0x3891ffe4], rax
xor r14, 0x721ddf37
sub r14d, 0x7f972718
xor r14b, 0x2b
push 0xfffffffff9b03111
setns byte [rsp]
xor qword [rsp], r14
jge 0x14004b22c
sub qword [rsp], 0x338049b0
add qword [rsp + 0x10], 0x49c5c
not r14b
movsx r14d, r14b
lea r14, [r14 + r14*8 - 0x70f96e]
mov rax, qword [rsp + r14 + 0x70f7c7]
not r14d
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + r14 - 0x70f7c6]
and r14b, 0x3d
and r14w, 0x4529
or byte [rsp + r14*2 - 0xe08a00], 0x8f
lea rax, [rax + r14*4 + 0xef9020c]
cmp dword [rsp + r14 - 0x704500], 0xeb992e35
lea r14, [r14 + r14 + 0x3e8adf22]
lea r14, [r14 + r14 - 0x546c0c59]
jns 0x14008841e
Function at 0x1400b6b3a
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
lea r15, [rdx*2 - 0x7c72ffca]
mov byte [rsp + rdx - 0x7958c343], 0xb0
neg edx
or byte [rsp + 0x28], 0x3a
mov rax, qword [rsp + r15 - 0x763e86ec]
mov rax, qword [rax + r15 - 0x763e870c]
or dword [rsp + 8], edx
mov qword [rsp + 0x20], r15
jbe 0x1400024ab
call fcn.1400c5f71

Function at 0x1400bfd26
Capabilities:
Resolve function by parsing pe exports

Disassembly:
js 0x1400c4d76
mov dword [rsp + 0x58], 0x318f972f
jge 0x14001521b

Function at 0x1400bfd64
Capabilities:
Authenticate hmac

Disassembly:
mov rbp, r8
bswap rbp
add qword [rsp + 0x10], 0xfffffffffffbc798
call fcn.1400a5a4f
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add r11b, 0xb3
movsxd rbp, dword [rsp + 0x10]
mov r9, rbp
movabs r9, 0xa33f4ead52b2990e
mov r11d, 0xb893449c
mov dword [rsp + 0x10], 0x6882659e
lea rcx, [rcx + 0x7484e3b7]
bswap r9d
lea r11, [r9 + rbp + 0x608f5913]
mov qword [rsp + 0x30], r11
mov bl, r11b
or ebx, ebx
xchg qword [rsp + 0x40], rcx
mov rbx, qword [rsp + rbp - 0x71d424a3]
shr r11w, 0x70
cmp r9b, 0xa2
call fcn.1400bc73b
xchg qword [rsp + 0x20], rcx
push r12
mov r12, qword [rsp + 8]
cmp r12, 0xffffffffff062a94
push r9
mov qword [rsp + 0x28], rcx
jne 0x1400bf1e3
mov r15d, dword [rsp + r12 - 0x790319e2]
or byte [rsp + r15*2 - 0x59189cd4], 0xab
lea r12, [r12 + r12*8 - 0x369a246]
mov r12, qword [rsp + 0x20]
xor qword [rsp + r15 - 0x2c8c4e52], rcx
not r15w
and byte [rsp + 0x30], 0x9a
setne r15b
cmp dword [rsp + 0x30], 0x88b94b05
mov r15, qword [rsp + r15 - 0x2c8cb0d9]
js 0x14008907b
and r8, 0xfffffffffe144b3d
xchg qword [rsp + r14 - 0x7ffae], rbx
mov r8, qword [rsp + r14*8 - 0x3fffc8]
mov rdi, r14
jbe 0x1400d8a1c
xor byte [rsp + r14 - 0x7ffc6], r14b
and r14, 0x1425b403
jle 0x14001b8b2
mov rdi, qword [rsp + r14*2 - 0xb6804]
sub dword [rsp + r14 - 0x5b3ea], r14d
jg 0x1400628fc
add qword [rsp + r14*2 - 0xb67d4], 0xffffffffbffacb5f
mov r14, qword [rsp + r14 - 0x5b3f2]
add qword [rsp + 0x20], 0xffffffffbff804b0
mov qword [rsp + 0x18], 0xffffffff9abcd22a
call fcn.1400aca01
shr di, 0xf
mov rdi, qword [rsp + 0x18]
mov qword [rsp + 8], 0xffffffffc1826708
xor qword [rsp + 8], 0xffffffffb1a9f22a
and word [rsp + 8], 0xf36
neg byte [rsp + 8]
lea rdi, [rdi + 1]
xor qword [rsp + 8], 0xffffffffc9a3f09c
not word [rsp + 8]
cmp dword [rsp + 8], 0xf49a6c11
call fcn.14004e147
call fcn.1400162d2
cmp r12d, 0x53222c95
jg 0x140077e1b
xor qword [rsp + r12*2 + 0x698339da], 0xffffffffe50c22b0
call fcn.1400b4b64
pushfq
shr r15d, 0x90
or r15w, 0xd681
setl r15b
add r15, 0x298242bb
push rbx
xchg qword [rsp + r15 - 0x29832194], rcx
not r15b
push r11
movabs rbx, 0xf1a83d31729ade1e
test r15d, ebx
mov rbx, r15
mov r15, qword [rsp + r15 - 0x2983211b]
mov qword [rsp + 0x28], rcx
push 0xffffffff8e2bdb3c
push r9
jo 0x1400a543d
not dword [rsp + rbx - 0x2983213b]
add qword [rsp + 0x28], 0x15d2a
mov rcx, qword [rsp + rbx*2 - 0x5306427e]
push rbp
mov byte [rsp + 0x10], cl
mov rbp, rcx
movabs r11, 0xff2b0e31db318c24
test dword [rsp + rbx*2 - 0x53064275], ecx
jae 0x140052407
jno 0x14006721f
Function at 0x1400c1ccb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub r12, r12
setne r12b
lea rcx, [rcx + 0x41e27b7]
lea r8, [r12 + r12*4 - 0x3f63774d]
movzx r8d, r12w
shr r8w, 0x50
test r8b, 0x3b
jb 0x1400c4de4
shl r8, 0xe4
xchg qword [rsp + r12 + 0x48], rcx
mov r12, qword [rsp + r8 + 0x20]
shr r8b, 0x96
or r8w, 0xaeb5
jae 0x140014ced

Function at 0x1400c1f94
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r8
mov qword [rsp + 0x20], rbx
mov r8, rdi
push r8
push r8
call fcn.14006f628
and bpl, 0x83
xchg qword [rsp + 0x60], rdx
mov rbx, qword [rsp + 0x28]
shl dword [rsp + 0x18], 0x9d
mov bp, word [rsp + 0x5b]
movzx bp, r15b
neg bpl
call fcn.140022d11
mov qword [rsp + 0x20], rdi
xor bx, 0x9496
call fcn.14001d6bb
xor r9w, 0xea06
not r9b
jne 0x1400c17d7
jo 0x1400812f8
cmp byte [rsp + 0x58], r13b
lea r13, [rdx*8 - 0x414d7ae1]
mov rdx, qword [rsp + 0x40]
bswap r10d
jns 0x1400a6056
neg r10w
mov r13, qword [rsp + r10*2 - 0x7aaa7d52]
shr byte [rsp + r10*2 - 0x7aaa7d42], 0x23
je fcn.14009409c

Function at 0x1400c4d16
Capabilities:
Encode data using base64
Terminate process

Disassembly:
lea rdi, [rdi + r11*4 - 0x31dfcc49]
mov qword [rsp + r10 + 0x4ae2b647], r11
bswap r10
jb 0x1400c7c40
neg r13b
test r13, r13
call fcn.140099632
shr r9, 0xff
sete r9b
lea rsi, [rsi + r9]
jb 0x14006d8fe
shr r9b, 0xf0
sets r9b
add qword [rsp + r9*8 + 0x30], 0xffffffffbff5f4e6
and r9, r9
shr r9, 0xf9
jne 0x14005b308
jns 0x1400d7695
call 0x140078828

Function at 0x1400c4d71
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not word [rsp + 0x10]
add word [rsp + 0x40], r14w
add word [rsp + 8], 0x5198
and r14w, 0xfe8f
call fcn.1400969e1

Function at 0x1400c67a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea r11, [r11*2 - 0x6ed54f76]
nop
cmovns r11, r8
movabs rcx, 0x6629e83e742df235
call fcn.14008fd8a

Function at 0x1400c8293
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
jbe 0x140099a85
shl r9b, 0x78
js 0x1400bf2d9
mov r9, qword [rsp + r9*2 + 0x48]
js 0x140002429
neg dword [rsp + 0x60]
neg qword [rsp + 0x60]
add qword [rsp + 0x10], 0xffffffffbff7ddb3
or byte [rsp + 0x60], 5
call fcn.1400584d5

Function at 0x1400cca92
Capabilities:
Encode data using xor

Disassembly:
mov r13, qword [rsp + r13*2 - 0x3c0e]
call fcn.14005d805
push rbx
call fcn.140092b37
jl 0x14004ec8e
pushfq
push r10
push r11
pushfq
movabs r10, 0x621731bc51a9b28b
movabs r11, 0xbd190f8d840a01a1
xor r11, 0xfffffffff9340333
bswap r11d
cmp r10, 0xffffffff8b12d424
mov r10, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0xffffffffb30eb4cd
mov r11, qword [rsp + 8]
je 0x14009cba4
call fcn.1400a9e5a
js 0x14009cb7f
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x20], rdx
movabs r13, 0x133527b3c116cda7
and r13b, r13b
call fcn.14007a995

Function at 0x1400cd0c8
Capabilities:
Encode data using base64

Disassembly:
lea rax, [rax + r12 - 0x59f7f0ec]
neg dword [rsp + r9 + 0x4afbaf17]
add qword [rsp + r9 + 0x4afbaf5f], 0xfffffffffff3ad5c
push rsi
movsx r12w, r9b
call fcn.14004e8ef
bswap ebp
mov rbp, qword [rsp + rbp + 0x58]
add r11b, 0x36
call fcn.14001c490
js 0x1400a497c
Function at 0x1400cd0ce
Capabilities:
Encode data using base64

Disassembly:
movzx rdx, word [rsp + 0x40]
xchg qword [rsp + rdx - 0xc171], rbx

Function at 0x1400cea20
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
call 0x14006e01b
mov rax, qword [0x14003f7c8]
shld r8w, si, 0xa5
mov r8, qword [rax]
test r15b, spl
stc
cmp r13b, r12b
test r8, r8
je 0x1400d3fc4
mov rdx, rcx
xchg ch, cl
mov rcx, r8
jmp 0x140091be8

Function at 0x1400d5f85
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
sub r10w, 0xb06
xchg qword [rsp + 0x58], rsi
mov r12, qword [rsp + r12 - 0x2af8faca]
bswap r10d
lea r10, [r10 + riz - 0x21c6bbc1]
movabs r10, 0xe906f13197a79faf
cmovae edx, ecx
bswap r10
jne 0x1400b83d0
jb 0x14008de65
neg ebp
xchg qword [rsp + 0x40], rdi
mov rbp, qword [rsp + 0x30]
sub word [rsp + 0x10], 0xea15
shr r15b, 0x42
mov qword [rsp + 0x10], r15
jns 0x1400a5454
cmp r12b, 3
setg r10b
mov rsi, qword [rsp + r10 - 0x1eae0100]
mov rsi, qword [rsi]
or r10d, r10d
lea r12, [r10*2 + 0x6eb06f9b]
movabs rdx, 0x760550ae86894da9
movabs rdx, 0x72370f813011ec1c
sub r12d, 0x81137691
neg ecx
test r10b, 0x8a
mov r10w, r12w
lea rsi, [rsi - 0x13d8fb7a]
setno cl
sub r10w, r12w
jge 0x1400c634f
push 0xffffffffffffffc0
add dword es:[rdx], esi
test eax, 0x2413014f
sbb ch, byte [rcx]
invalid
mov rdx, qword [rsp + rdx*2 - 0x6023d830]
xor rcx, rcx
movabs r10, 0x8f9a6c13219a2a2e
call fcn.140013727
test qword [rsp + 0x10], r15
jae 0x14004b666
jge 0x14004b2a9
push r14
movabs r14, 0xb12d9c3e323bc2ad
push rdi
movabs rdi, 0x8f3291a9dc96fc2c
pushfq
sub r14, r14
mov qword [rsp + 0x18], 0x7b9ca5cd
mov rdi, qword [rsp + r14 + 8]
shl r14d, 0x57
je 0x14002f880
mov qword [rsp + 0x58], r15
call fcn.140051eff
add qword [rsp], 0xffffffffffff9dfd
movzx ecx, r10w
xor r10, 0x3217f286
test r12, 0x3db6cab2
movabs rsi, 0xc722a22473b2da21
jg 0x14005b814

Function at 0x1400d9f9d
Capabilities:
Create thread
Extract resource via kernel32 functions
Set registry value

Disassembly:
sets r8b
mov qword [rsp + 8], r8
jne 0x140002494
shl r8w, 0x1a
lea rsi, [rsi - 0x1670a74b]
shr r15, 0xaa
push r8
bswap r15d
push r14
test dword [rsp + r15*2 - 0x77da79f8], r15d
ja 0x14009b603

Function at 0x1400d9fec
Capabilities:
Allocate or change rwx memory
Resolve function by parsing pe exports

Disassembly:
lea r15, [r15 + r15*8 + 0xb1cbd3e]
lea rbp, [rbp + 1]
call fcn.14009c5a9