joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005cfd5
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
xchg qword [rsp + 8], rdi
push rcx
pushfq
movabs rcx, 0x923fd59b50117092
or rcx, 0x2c87d908
bswap ecx
mov qword [rsp + 0x10], rdi
jl 0x14009bc08
mov r11, qword [rsp + 0x38]
cmp rcx, 0xffffffffbb30c09a
jae 0x14006ab30
not r12w
test byte [rsp + 0x40], 0x3d
call fcn.140091670
mov fs, ebp
mov al, 0x21
and al, 0xf9
sub al, 0xbc
pop rcx
int3
neg cx
jae 0x1400722a0
fcomi st(6)
xor eax, dword [rbx + 0x67f0a47]
xchg esi, eax
push rbx
pop rcx
int3
jbe 0x1400ddc88
xchg dword [rbp + 0x489f5629], ebp
je 0x140072315
invalid
test r15d, r15d
mov al, 0xc7
outsb dx, byte [rsi]
nop
mov edx, 0x2a7e5695
sahf
pop rdx
fsubrp st(4)
adc ecx, ebx
insd dword [rdi], dx
cmp ebp, edi
std
clc
sbb eax, 0xc73e7bd9
xchg edx, eax
jle 0x14007237b
invalid
call 0xda7be0a3
fsubr dword [rbp + 0x18]
lea ebp, [rcx]
adc esi, 0x77
push rdx
dec dword [rdx - 0x1e]
invalid

Function at 0x1400621ab
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
not r15w
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rcx]
setne r15b
neg r15
and r15b, 0x1b
mov edx, r15d
not dx
setge r15b
cmp edx, 0x681b4923
mov qword [rsp + 0x10], r15
jns fcn.14001689d
lea rcx, [rcx - 0x525760d9]
not r15b
setns r15b
shr r15, 0x7c

Function at 0x14006319c
Capabilities:
Authenticate hmac

Disassembly:
mov r12, qword [rsp + rdx - 0x4c11ffd0]
call fcn.14009c36c
jno 0x14005cf85

Function at 0x1400631f1
Capabilities:
Authenticate hmac
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
pop rax
push r10
pushfq
movabs r10, 0x5b870da6aa237d89
sub r10d, r10d
add r10d, 0x3611bf36
push r15
mov r15, r10
sub r15w, 0xb203
js 0x14009b030
xchg qword [rsp + r10*2 - 0x6c237e54], rax

Function at 0x140065d07
Capabilities:
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
movabs r10, 0x7e9ad31e20006224
neg r10
jb 0x1400d2232
push rbp
call fcn.14004fe5e
jle 0x14009245a
fcom st(4)
ror byte [rcx], 1
invalid
xchg qword [rsp + 0x18], rbx
push rbx
not r10w
mov rbx, r10
jo 0x1400b89b6
cmp bl, 0x8a
mov r10d, 0x90ed827
jbe 0x14008c7ca
xor bx, bx
mov rbx, qword [rsp]
mov r10, qword [rsp + r10 - 0x90ed80f]
mov qword [rsp + 0x18], rbx
call fcn.1400c5eed
setae r10b
jne 0x14008cd87

Function at 0x14006a547
Capabilities:
Authenticate hmac

Disassembly:
jb 0x1400bd118
or r8d, 0x9abd3ea3
not r8
add qword [rsp], 0xfffffffffff6ea21
test r8b, r8b
jle 0x14005a18e

Function at 0x14006b45b
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
and bpl, bpl
mov rbp, qword [rsp + 0x38]
shr dword [rsp + 0x28], 0x86
call fcn.140074d95

Function at 0x14006c21b
Capabilities:
Authenticate hmac

Disassembly:
pushfq
movabs r10, 0xc92ae82f200f271a
mov qword [rsp + 0x30], rbx
or r10w, 0x7b39
lea r10, [r10 + r10*8 - 0x6ccbcec8]
jg 0x140068778
Function at 0x14006ec75
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
ja 0x140096ef8
shr byte [rsp + r14*8 + 0x30], 0x6f
call fcn.14001e20f
mov rbx, qword [rsp + r14*8 + 0x20]
mov rbx, qword [rbx + r14]
mov qword [rsp + r14*2 + 0x20], r14
jae 0x140063183

Function at 0x140071898
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx]
movzx r15, byte [rsp + r15 + 0xe45490f]
mov rbx, r10
mov qword [rsp + 0x60], rbp
lea rcx, [rcx - 0x20d746ef]
jle 0x14006b468
call fcn.1400d49b8

Function at 0x140072274
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
push rdi
push r10
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
shl r10w, 0xe1
bswap edx
add qword [rsp + 0x10], 0x542c
cmp rdx, 0x520df834
call fcn.140084b0f

Function at 0x140074702
Capabilities:
Authenticate hmac

Disassembly:
push rdx
push rsi
pushfq
movabs rsi, 0xd9afec18f3152727
push r14
mov r14, rsi
shr rsi, 0x5c

Function at 0x140074a22
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
mov r11, qword [rsp + rdx*8 - 0x1140]
mov r11, qword [rsp + 0x28]
not byte [rsp + rdx*8 - 0x1140]
mov qword [rsp + rdx*2 - 0x426], r8
or qword [rsp + 0x40], 0xfffffffffcabf09a
mov r14, qword [rsp + 0x40]
xor dword [rsp + 0x18], 0x67bc752a
xor dx, word [rsp + rdx - 0x211]
add r14d, dword [rsp + rdx - 0xfd98]
mov rdx, qword [rsp + 0x58]
neg dword [rsp + r14 - 0x5423f762]
jle 0x140065d20

Function at 0x1400770b9
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov r8, r11
mov rdx, qword [rsp + r11 - 0x4afd8fdb]
xor dword [rsp + r8 - 0x4afd8fdb], 0x568999b9
or qword [rsp + rdx - 0x4afd8fdb], 0xfffffffff984ad11
cmp rdx, qword [rsp + r11 - 0x4afd8fdb]
mov rsi, qword [rsp + r11 - 0x4afd8fc3]
mov rsi, qword [rsi + r8 - 0x4afd8fe3]
mov qword [rsp + r11 - 0x4afd8fc3], rdx
not dword [rsp + r8 - 0x4afd8fc3]
push rbx
lea rsi, [rsi + rdx - 0x6157c13c]
push r15
call fcn.1400a1292

Function at 0x140078893
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r14
shr si, 0x4a
jae 0x1400c0e8e

Function at 0x14007a153
Capabilities:
Encode data using base64

Disassembly:
xchg qword [rsp + 0x30], rbx
mov r12, qword [rsp + 0x18]
jg 0x14007a244
test qword [rsp + 0x28], 0xffffffffd635a801
not byte [rsp + 0x28]
Function at 0x1400849a6
Capabilities:
Authenticate hmac

Disassembly:
jns 0x1400c3735
xor bl, byte [rdx]
int3
mov r8d, 0x2503bc3d
or r8, 0xffffffffb3b9d11e
movsx r8, r8w
setbe r8b
jge 0x1400b57b6
call fcn.1400c48fa
int 0x88
or eax, 0x26a27226
retf 0x6fe
neg rbx
je 0x14009d4a7
jg 0x14004d87d
lea rcx, [rcx + r13*2 - 0x2cb23ee1]
test r13, 0xffffffffd0803824
jge 0x140015550
stc
cmpsb byte [rsi], byte [rdi]
add eax, 0x16e82912
cmp eax, 0x95f4e893
call 0x14008e504
mov rbx, r8
push r11
shr r8b, 0x5e
xor rbx, r15
movabs r11, 0x77b4c71ee618a22d
shr bx, 0xb0
mov rbx, qword [rsp + 8]
mov rbx, qword [rbx]
call fcn.14004e498
loope 0x140084f02
sub ebx, esi
invalid
lea r14, [r14 + r9 - 0x1b6eb371]
call fcn.14008d331
imul eax, dword [0x1a599100b], 0x8e69b0b5
push rax
invalid
call fcn.14001b426
add bpl, 0xa
test bpl, bpl
mov rcx, qword [rsp + 0x28]
je fcn.1400ab65c
ja 0x1400ddc63
or r13b, r13b
mov qword [rsp + r13 - 0x47a35471], r9
shl r9w, 0x17
jne 0x1400d9885
xchg qword [rsp + 0x30], rcx
mov r13, qword [rsp + r13 - 0x47a35479]
jne 0x14009c3b3
and dword [rsp + 0x18], 0xac04078c
shr r9, 0x48
neg word [rsp + 0x18]
jns fcn.140089f6f
mov r9, qword [rsp + 0x28]
cmp dword [rsp + 0x18], 0x4ba8f7a2
jge 0x140084f3d
shr byte [rsp + 0x18], 0x91
call fcn.140057101
xor al, 0xd9
mov word [rdi - 0x45], ds
pop rbx
invalid
mov rcx, qword [rsp + 0x28]
jle 0x14004fbb0
not r9b
add r9w, r9w
sub dword [rsp + 0x20], 0x49118333
add qword [rsp + 8], 0xffffffffffffcdcb
mov r9, qword [rsp + 0x40]
test qword [rsp + 0x20], 0xfffffffff1058306
lea rsp, [rsp + 8]
ret 0x10
not ebp
call 0x1400b23b3

Function at 0x140085895
Capabilities:
Authenticate hmac

Disassembly:
movabs rbp, 0x4e9752047405f913
and qword [rsp + 0x40], 0xffffffffbf231187
xchg qword [rsp + 0x50], rdi
mov r14, qword [rsp + 0x18]
mov byte [rsp + 0x40], sil
call fcn.1400bdd4b

Function at 0x1400858bc
Capabilities:
Authenticate hmac

Disassembly:
popfq
lea rsp, [rsp + 0x48]
ret
bswap esp
movabs r10, 0xd38277ac5db38b26
not r10b
lea r10, [r10 + riz - 0x165e6071]
mov r10w, 0x90b0
movzx r10d, r10b
add qword [rsp + 0x18], 0xfffffffffff58c3d
movabs rsi, 0x73822f0b35b85028
push rdx
push rbx
call fcn.1400115e4
mov bl, 0xb6
test byte [rbx - 0x4411bbc0], al
xchg byte [rbp - 0xe3a7f41], al
jne 0x14004f8f9
ror byte [rcx + rdi*2 - 0x4dd90185], 1
invalid
bswap r9
and r9d, 0x490a320e
neg r9w
shl dword [rsp + rbp - 0x280e0000], 0xcc
mov rbp, qword [rsp + rbp*2 - 0x501bffe0]
mov qword [rsp + 0x20], rsi
je 0x14001d5ae
sub byte [rsp + r9], 0x14
or r9w, 0x9ba8
push r8
add qword [rsp + 0x10], 0x360ed
add qword [rsp + r9*4 - 0x26e98], r9
push rcx
jle 0x140011bd7
movabs rcx, 0x4a9ccbbdf43a3586
mov rsi, qword [rsp + r9*2 - 0x13738]
mov rsi, qword [rsi + r9*4 - 0x26ea0]
mov r8, qword [rsp + 0x10]
call fcn.140072b53
xchg qword [rsp + r9 - 0xb8c0], rbp
mov r9, qword [rsp + 0x28]
and qword [rsp + 0x38], 0x71a6cc23
jno 0x1400c9d38
and r8, 0x2220a08a
add cx, word [rsp + 0x3e]
mov r8, qword [rsp + r8*2 - 0x40403ffc]
shl cx, cl
neg word [rsp + 0x38]
call fcn.140084071
shl r10b, 0x36
jne 0x140059058
mov r10, qword [rsp + r10*2 - 0x65e0]
mov qword [rsp + 0x20], rsi
push r10
je 0x14004f91d
jne 0x140073eeb
Function at 0x140089f6f
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
test dil, 2
jne 0x14006b737

Function at 0x140089fb8
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
test rdx, 0x31200820
jb 0x140065ca7
add qword [rsp + rdx - 0x7da64676], 0xffffffffbfff0858
xor word [rsp + rdx - 0x7da6464e], dx
mov qword [rsp + rdx - 0x7da64666], rdx
lea rcx, [rcx - 0x25d0ffc6]
not r9
and rdx, rdx
and dl, byte [rsp + rdx - 0x7da64665]
or r9, qword [rsp + rdx - 0x7da64636]
add dword [rsp + rdx - 0x7da6461e], 0x4f366cba
xchg qword [rsp + 0x38], rcx
mov rdx, qword [rsp + 0x18]
lea r9, [r9 + r9*2 + 0x7791373f]
jno 0x1400cbff7
xchg edx, eax
movhps xmm1, qword [rbp - 0x7f7446d0]
or qword [rsp + 0x28], 0xffffffffaebad5aa
setno byte [rsp + 0x28]
mov r9, qword [rsp + 0x30]
je 0x1400aeecb
neg dword [rsp + 0x28]
test qword [rsp + 0x10], 0xffffffffed343323
mov byte [rsp + 0x28], 0x3c
not qword [rsp + 0x10]
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x38]
ret
mov r10w, 0x2400
or r10d, r10d
and r10, 0x2b3c932c
mov rsi, qword [rsp + r10*2 + 0x38]
jo 0x1400cce31
add qword [rsp + 8], 0x17b3
not r15d
mov rsi, qword [rsp]
not r14b
add r15b, 0x9d
jb 0x1400c9c5e
jae 0x14008d6ff

Function at 0x14008cee4
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
sete bpl
lea rax, [rax - 0x617722e8]
not rbp
mov qword [rsp + rbp + 0x678b2511], rbp
sub byte [rsp + rbp + 0x678b2511], bpl
push r11
and qword [rsp + rbp + 0x678b2519], rbp
xchg qword [rsp + rbp + 0x678b2529], rax
mov rbp, qword [rsp + rbp + 0x678b2511]
and word [rsp + 0x18], 0xe717
call fcn.1400a2f7e
push rdi
push r8
movabs r8, 0x3ab657adba06013c
push 0xffffffffe0b0d585
mov byte [rsp], 0x3c
movzx r8d, r8b
pushfq
neg r8
test r8w, r8w
mov rdi, qword [rsp + r8*8 + 0x200]
jbe 0x1400cc019
and byte [rsp + r8 + 0x44], 0x38
push rbp
mov rbp, qword [rsp + r8 + 0x4c]
and word [rsp + r8 + 0x4c], 0xdd1e

Function at 0x14008faef
Capabilities:
Authenticate hmac

Disassembly:
setae r9b
mov r12, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
js 0x140007013
ja fcn.14006fa38
mov r10, qword [rsp + r12*4 + 0x28]
shr r13d, 0x54
shl r13b, 0xae
mov qword [rsp + 0x40], r10
lea rbp, [rbp + r12*8 + 0x2a44025]
add qword [rsp + r10 + 8], 0xffffffffbff24d59
xor qword [rsp + r12 + 0x28], 0x5988ac2f
push rcx
mov r8, r9
xchg qword [rsp + r13*2 + 0x60], rbp
mov r10, qword [rsp + r13*2 + 0x20]
or word [rsp + 0x30], 0xffac
je 0x1400af7d8
add dword [rsp + 0x48], r13d
movsx r9w, byte [rsp + 0x31]
jns 0x14006ab22
push r8
setno byte [rsp + 0x10]
call fcn.14009522d

Function at 0x140090cec
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
pushfq
jge 0x14006b407
test cl, 0x10
movabs rbp, 0x321ef8ab400c99af
ja 0x140075d57
mov rbx, qword [rsp + 8]
mov rbx, qword [rbx]
and ebp, ebp
jne 0x1400a3f2b
and byte [rsp + 0x40], 8
xor word [rsp + 0x40], 0xb600
shl dword [rsp + 0x40], 0x4d
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x50]
ret
Function at 0x140090de6
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + rsi*2 - 0x7d8f07d2], rax
shl si, 0xe
add rsi, 0x3106d300
jne 0x1400918ad
push rcx
call fcn.14005b7f8

Function at 0x14009118d
Capabilities:
Authenticate hmac
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
push r13
pushfq
movabs r13, 0x812913266abf5834
movabs rsi, 0xeb22dcb9cbbe091b
or r13, rsi
setbe sil

Function at 0x140091893
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
jns 0x1400a6aa1
push r8
movabs r8, 0xf521e29f8a02e127
xchg qword [rsp + 0x10], rdx
not r8w
call fcn.14000cb91
xor sil, 0xb2
shl rsi, 0x95
not esi
add qword [rsp], 0x261d1
add esi, esi
xor si, 0x691d
neg sil
jno 0x1400861a6

Function at 0x1400918d0
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x60], rcx
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x18]
mov r8, qword [rsp + r8*2 + 0x63a9b99c]
lea rsp, [rsp + 0x38]
ret 8
mov rdi, qword [rsp + r13 + 0x1a]
ja 0x1400b5862
or r12w, r12w
jne 0x1400a1f33
shr r13w, 0x91
not r13b
push rdi
lea rcx, [rcx - 0x4651ebd6]
not r8d
shr r13, 0x41
mov rdi, r13
sub edi, 0x59bb0a2a
call fcn.14009912e
test dword [rsp], 0xa007ce30
jb fcn.1400ae094
call fcn.140059e5a
invalid
test word [rsp + 0x38], 0xaaa1
call fcn.1400d56c2
add ch, 0x50
movabs eax, dword [0xcbae5a1f7fbb9055]
test eax, 0xbcb83d6c
sbb byte [rax], ch
or eax, 0x54b2eca9
mov ebp, eax
insb byte [rdi], dx
or eax, 0x60554da8
and byte [riz*8 - 0x2c57a37f], dh
cmpsd dword [rsi], dword [rdi]
push rsi
adc edi, dword [rdi]
mov ecx, ecx
invalid
add byte [rsp + 0x28], 0xa0
add dword [rsp + 0x28], 0x1c9dfbbb
or dword [rsp + 0x28], 0x9ba1fd13
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x40]
ret
add r13w, 0x871c
jb 0x14009a79b
and r13b, 0x91
xor qword [rsp + r13*2 - 0x10dd8], r13
cmp r13b, byte [rsp + r13 - 0x86d1]
mov r13, qword [rsp + r13*4 - 0x21be8]
js 0x140011bcd
cmp byte [rsp + 0x28], 0x2a
jle 0x1400a24ca
push rdx
invalid

Function at 0x14009432a
Capabilities:
Authenticate hmac

Disassembly:
call fcn.1400919ce
jb 0x140063197

Function at 0x140095fcd
Capabilities:
Authenticate hmac

Disassembly:
jne 0x1400ad2bd
add rbp, 0x6509cd01
add qword [rsp + 0x10], 0xffffffffbffb22e4
mov r11w, 0x1be
lea rax, [rax + 0x770f2f1c]
sub r11b, 0x36
jge 0x140011af7
jae 0x14009bc10
invalid

Function at 0x140096b21
Capabilities:
Authenticate hmac
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
not cx
mov rcx, qword [rsp + 0x18]
mov rcx, qword [rcx]
mov r9d, 0xa8918abd
jno 0x1400b6d0a
or r9w, r8w
mov qword [rsp + 0x18], r8
movzx r9d, r9w
add qword [rsp], 0xfffffffffff2ee6c
mov r9b, byte [rsp + 0x1f]
lea rcx, [rcx - 0x1d786f70]
push r12
movzx r8d, r8w
lea rsp, [rsp + r9 - 0x9fc6]
ret

Function at 0x140097f89
Capabilities:
Authenticate hmac

Disassembly:
mov rbp, qword [rsp + 0x48]
mov rbp, qword [rbp + riz]
cmp ebx, 0x1921ab05
movabs rsi, 0x230fa007e900a186
shr rbx, 0x19
mov rdx, r15
jbe 0x14005d500
Function at 0x14009893e
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
sub byte [rsp + 0x50], 0x1d
jne 0x14007226e
jl 0x1400a5ffb
call fcn.140060a21
mov rbx, qword [rsp + 0x30]
add qword [rsp + 8], 0xffffffffbff68283
xor word [rsp + 0x50], 0x949e
jno 0x14002f120
mov r9, qword [rsp + 0x20]
mov r8, rdx
sub qword [rsp + 0x38], 0x19a89300
bswap edx
test byte [rsp + 0x38], 0x20
mov rdx, qword [rsp + 0x40]
jl 0x1400b56f9
shl byte [rsp + 0x38], 0xd1
add qword [rsp + 0x50], 0x2d0b8f80
or dword [rsp + 0x50], 0xe832fdaa
setns byte [rsp + 0x38]
call fcn.14007ba6f
add word [rsp + r9*8 + 0x38], r9w
mov r9, qword [rsp + r9 + 0x48]
not dword [rsp + 0x38]
call fcn.1400772fc
int3

Function at 0x14009c9a5
Capabilities:
Authenticate hmac
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
movabs r13, 0xe8b2da2292831e2b
mov rbp, r13
bswap rbp
mov qword [rsp + 0x38], rdx
push rsi
setno r8b
sub bp, 0x9395
jge 0x1400cc010

Function at 0x14009d4ac
Capabilities:
Authenticate hmac

Disassembly:
jns 0x1400c3735
xor bl, byte [rdx]
int3
mov r8d, 0x2503bc3d
or r8, 0xffffffffb3b9d11e
movsx r8, r8w
setbe r8b
jge 0x1400b57b6
call fcn.1400c48fa
int 0x88
or eax, 0x26a27226
retf 0x6fe
neg rbx
je 0x14009d4a7
jg 0x14004d87d
lea rcx, [rcx + r13*2 - 0x2cb23ee1]
test r13, 0xffffffffd0803824
jge 0x140015550
stc
cmpsb byte [rsi], byte [rdi]
add eax, 0x16e82912
cmp eax, 0x95f4e893
call 0x14008e504
mov rbx, r8
push r11
shr r8b, 0x5e
xor rbx, r15
movabs r11, 0x77b4c71ee618a22d
shr bx, 0xb0
mov rbx, qword [rsp + 8]
mov rbx, qword [rbx]
call fcn.14004e498
loope 0x140084f02
sub ebx, esi
invalid
lea r14, [r14 + r9 - 0x1b6eb371]
call fcn.14008d331
imul eax, dword [0x1a599100b], 0x8e69b0b5
push rax
invalid
call fcn.14001b426
add bpl, 0xa
test bpl, bpl
mov rcx, qword [rsp + 0x28]
je fcn.1400ab65c
ja 0x1400ddc63
or r13b, r13b
mov qword [rsp + r13 - 0x47a35471], r9
shl r9w, 0x17
jne 0x1400d9885
xchg qword [rsp + 0x30], rcx
mov r13, qword [rsp + r13 - 0x47a35479]
jne 0x14009c3b3
and dword [rsp + 0x18], 0xac04078c
shr r9, 0x48
neg word [rsp + 0x18]
jns fcn.140089f6f
mov r9, qword [rsp + 0x28]
cmp dword [rsp + 0x18], 0x4ba8f7a2
jge 0x140084f3d
shr byte [rsp + 0x18], 0x91
call fcn.140057101
xor al, 0xd9
mov word [rdi - 0x45], ds
pop rbx
invalid
mov rcx, qword [rsp + 0x28]
jle 0x14004fbb0
not r9b
add r9w, r9w
sub dword [rsp + 0x20], 0x49118333
add qword [rsp + 8], 0xffffffffffffcdcb
mov r9, qword [rsp + 0x40]
test qword [rsp + 0x20], 0xfffffffff1058306
lea rsp, [rsp + 8]
ret 0x10
not ebp
call 0x1400b23b3

Function at 0x14009e0aa
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
mov r13, rcx
push r15
add qword [rsp + 8], 0xffffffffffff7071
movabs rbx, 0x4533adaf24b74632
shl rbx, cl
mov rdi, rcx
js 0x140001f08
sub rcx, 0x2304a0b9
mov rbx, qword [rsp + 8]
mov rbx, qword [rbx]
call fcn.14007a1aa
popfq
mov qword [rsp + 8], 0xffffffff9801c485
lea rsp, [rsp + 0x10]
ret
Function at 0x1400a1292
Capabilities:
Authenticate hmac

Disassembly:
push r11
movabs r11, 0x6727f432979b8c93
pushfq
neg r11
shr r11d, 0xdb
sub r11w, 0x1b04
call fcn.1400b8568
jl 0x1400b7930
jle 0x1400b8a18
mov rbx, qword [rsp + r8 - 0x4afd8fc3]
not dword [rsp + r11 - 0x4afd8fab]
xchg qword [rsp + rbx + 0x20b4105], rsi
mov rdx, qword [rsp + rdx - 0x4afd8fbb]
not byte [rsp + rbx + 0x20b40dd]
xor r11d, dword [rsp + rbx + 0x20b40e1]
jl 0x140077e37
add word [rsp + rbx*4 + 0x82d02cc], 0xa83a
cmp bl, byte [rsp + r11 - 0x4afd8fc1]
mov r11, qword [rsp + r8 - 0x4afd8f93]
movabs r15, 0x858cc638e8339733
jno 0x1400a4324
shl qword [rsp + rbx + 0x20b40dd], 0x6a
mov rbx, qword [rsp + rbx*2 + 0x416815a]
js 0x1400a8baa
mov dh, 0x99
sub eax, 0xf91c282d
push rbx
invalid
shr qword [rsp + 0x38], 0x28
or dword [rsp + 0x38], 0x9591a113
test r15w, r8w
setne r15b
neg r15
mov dword [rsp + r8 - 0x4afd8fab], r15d
mov r8, qword [rsp + r8 - 0x4afd8fb3]
movsx r15w, r15b
cmp qword [rsp + 0x38], 0xffffffffee245f14
call fcn.14007982a
cmp byte [rcx], bl
invalid
call fcn.140074a77
jae fcn.140058516
and r9, r9
mov r9, qword [rsp + 0x50]
shl byte [rsp + 0x38], 0xa7
test r10, 0xffffffffdfba693c
push rbx
mov qword [rsp + 0x48], rax
movabs rbx, 0x35bd53a51639bd27
lea r12, [r12 + rbx - 0x4dd6805d]
push rbx
call fcn.140053ce4
setl byte [rsp + 0x58]
call fcn.140009199

Function at 0x1400a1318
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, 0x32157d8c
mov rdi, qword [rsp + rcx - 0x32157d8c]
mov rdi, qword [rdi + rcx*2 - 0x642afb18]
jae 0x14001196f
push r9
movabs r9, 0x993eafa30f04ef29
pushfq
add qword [rsp + 0x10], 0xfffffffffff37899
call fcn.14004fe79
setne cl
xor cl, 0xb9
add qword [rsp], 0xfffffffffffbfbed
cmp cl, 0xb2
lea rcx, [rcx + rcx*8 - 0x156fc5c1]
movabs rdi, 0x66028402e9872d2d
jg 0x14002f2c0
je 0x1400a13ad

Function at 0x1400a24ea
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0xfffffffffffd30d2
call fcn.140073d9c

Function at 0x1400a250b
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
push r8
mov r8, r11
call fcn.140073880
invalid
or r11d, 0x6d99f00f
jae 0x140021476
xchg qword [rsp + 0x18], rax
mov r14, qword [rsp + 0x10]
jae 0x1400b40b6
popfq
lea rsp, [rsp + 0x60]
ret
mov dword [rsp + 0x18], 0x5bb3fe0b
mov word [rsp + 0x38], 0x42a7
call fcn.1400c59a1
mov r10d, 0xe681c5a1
lea r10, [r10*2 - 0x29560456]
jns 0x1400a0ae5
jns 0x1400558fc
lea r10, [r10 + r10 + 0x31c50b8]
test r10b, 0x8f
setne r10b
call fcn.140096993
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
ret

Function at 0x1400a2ff7
Capabilities:
Delete registry value

Disassembly:
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002825
mov rcx, qword [rbp + 0x390]
lea rdx, str.dialerstager
mov rcx, qword [rsp + 0x28]
xor r11d, r11d
lea r11, [r11 + r11*8 - 0x32f528f8]
jl 0x140002807
push r9
mov r9, r11
lea rcx, [rcx + r9 + 0x32f528f9]
push rdi
or r11d, 0xf3b2b29e
call fcn.1400b0223
Function at 0x1400a70a3
Capabilities:
Authenticate hmac

Disassembly:
jns 0x14008dca6
fst dword [0x10870144f]
ja 0x1400722f3
pop rcx
mov word [rax + rbx*4 + 0x63486971], ds
cmpsd dword [rsi], dword [rdi]
invalid
xor ecx, dword [rdx + 0x336235dd]
jg 0x14007236a
mov dl, byte [rsp + rdi*4]
mov esp, eax
fst dword es:[r10 + 0x9c38c44]
invalid
sahf
invalid
mov rcx, qword [rsp + 0x10]
jno 0x1400c098e
setg byte [rsp + r10 - 0x5c5165ca]
xchg qword [rsp + r10 - 0x5c5165b2], rcx
mov r10, qword [rsp + r10 - 0x5c5165d2]
mov r8, qword [rsp + 0x10]
movzx r8, byte [rsp + r8 - 0x5c5165ea]
jle 0x1400ae69e
neg word [rsp + r8 - 0xea]
not qword [rsp + r8*2 - 0x1c4]
shl dword [rsp + r8*2 - 0x1b4], 0xfd
xor byte [rsp + r8 - 0xea], 0xad
mov r8, qword [rsp + r8*8 - 0x7c8]
jg 0x1400776d9
jbe 0x1400722b2
call fcn.1400de7e3

Function at 0x1400aabe8
Capabilities:
Set registry value

Disassembly:
call fcn.1400c6886
jg 0x140002557
mov rcx, rsi
call fcn.140060b19

Function at 0x1400aca57
Capabilities:
Encode data using xor

Disassembly:
lea r14, [r14*2 - 0x6d300cb]
cmovl edx, dword [rsp + rcx - 0xfffffc0]
add dword [rsp + rcx - 0xfffff88], 0x36bce619
add qword [rsp + rcx - 0xfffffd8], 0xffffffffbff2e8b8
lea rbp, [rcx + r14*8 + 0x11251a1b]
mov rbp, qword [rsp + rdx - 0x10eaf87]
shl si, 0x41
or dl, byte [rsp + rcx*8 - 0x7fffff7b]
add byte [rsp + rcx*2 - 0x1fffff80], 0xba
jbe 0x1400e0c2b
add byte [rsp + rdx - 0x10eaf7f], 0x3f
mov si, word [rsp + 0x46]
mov r14, qword [rsp + rcx - 0xfffffc8]
xor dword [rsp + 0x78], 0x8697321a
jl 0x14004f48c

Function at 0x1400acaa7
Capabilities:
Encode data using xor

Disassembly:
call fcn.140082b05
sub eax, 0x1f160951
movsd dword [rdi], dword [rsi]
test eax, 0x24448148
add bh, bl
push rdx
add eax, 0x31b94800
out 0x30, eax
add dl, byte [rax - 0x176f5add]
int 0x2d
cli
dec dword [rax - 0x39]
mov qword [rsp + 0x10], 0x1e848149
lea rsp, [rsp + 0x10]
call fcn.1400e9a9d

Function at 0x1400ae094
Capabilities:
Authenticate hmac

Disassembly:
neg r12b
not r12
mov qword [rsp + 0x30], rsi
shr r12w, 0x45
push rbx
ja 0x1400b85b5
js 0x14007a229
movabs rbx, 0x5194f98f60876e3c
shl bl, 0xad
add r12d, ebx
bswap r14d
add qword [rsp + 0x10], 0xbf06e
cmp r12, r9
push r13
call fcn.14009c396
push r9
bswap r9d
mov rdx, qword [rsp + r9*2 - 0x6c33207e]
mov rdx, qword [rdx + r11 - 0x2cc03691]
mov qword [rsp + r9*2 - 0x6c33207e], rbp
shr r11w, 0xfc
shl r9, 0xcb
setns bpl
jb 0x1400dc315
cmove r9d, dword [rsp + 1]
cmp word [rsp + 0x38], 0xc8a4
seto byte [rsp]
lea rdx, [rdx + rbp - 0x77ecd8cf]
call fcn.14007887d
lea rsi, [rsi + 1]
jge 0x140089f75

Function at 0x1400b42d3
Capabilities:
Set registry value

Disassembly:
lea r13, [r13*4 + 0x29b7e191]
jge fcn.1400cda8c
shl r13d, 0x34
sub r13d, 0xc633c19c

Function at 0x1400b5081
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
shr byte [rsp + 8], 8
neg qword [rsp + 0x30]
call fcn.1400b7e84