joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006a0aa
Capabilities:
Enumerate process modules

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, 0x9c40
xor edx, edx
mov rcx, rax
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edi, edi
lea r8, [rbp + 0x380]
mov rcx, rax
mov dword [rbp + 0x380], edi
mov edx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140002c00
mov ecx, dword [rbp + 0x380]
shr ecx, 2
mov dword [rbp + 0x380], ecx
test ecx, ecx
je 0x140002c00
mov eax, edi
mov r9d, 1
mov ecx, dword [rbx + rax*4]
call fcn.1400010c0
inc edi
cmp edi, dword [rbp + 0x380]
jb 0x14000289f
jmp 0x140002c00
mov rbx, qword [rsp + 0x488]
add rsp, 0x450
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
fild word [rax + rax]
js 0x14000284a
mov r11, qword [rsp + rsi*2 - 0x7d4eb90e]
je 0x14006a0a7
mov cl, 0x82
shl qword [rsp + rsi*2 - 0x7d4eb8ee], 0x3c
xor si, word [rsp + rsi - 0x3ea75c53]
call fcn.1400cde6e
pop rdi
sub byte [rax + rdx*4 + 0x438e4eed], cl
loop 0x14006a0b3
pop rdx
test rax, 0x3dcf0cd
invalid

Function at 0x14006aab4
Capabilities:
Enumerate process modules

Disassembly:
mov r13, qword [rsp + r12 - 0x5dabffc0]
call fcn.14005ba29
test r8w, r8w
jbe 0x14008bb3b
call fcn.140080d17
stosd dword [rdi], eax
cdq
out dx, eax
test al, 0x4c
cmpsd dword [rsi], dword [rdi]
test dword [rcx + 0xcb2ac6e], esi
invalid
je 0x1400c40ed
push r9
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + rcx*2 + 0x1d8c6]
call fcn.140016891
mov cx, word [rsp + rcx*4 - 0xdb4]
call fcn.140020f08
setl byte [rsp + 0x90]
call fcn.1400d7dcc
je 0x14005061c
jne 0x1400cbf29
or r15d, 0xc0a45010
mov qword [rsp + r14 + 0x20], r15
lea rax, [rax + 0x5cacf01d]
je 0x1400a1c99
push r15
jle 0x1400a5f93
and r13d, r13d
shr r12w, 0x1b
jns 0x14001e230
add word [rsp], 0x732b
jne 0x1400bbf26
push 0xffffffff8c8cc4a2
neg r11b
add r11b, 0x39
bswap r11
call fcn.14005c742
call fcn.1400a1b87
xchg qword [rsp + r14 + 0x40], rax
mov r14, qword [rsp + 0x20]
call fcn.1400a0a6b

Function at 0x140070ef5
Capabilities:
Encode data using base64

Disassembly:
je fcn.140057ec7
test r13, r13
jne 0x140058f6e
Function at 0x1400796d2
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
sub r13w, 0x7528
xchg qword [rsp + 0x50], rcx
mov r11, qword [rsp + 0x40]
sub r13w, 0x90b1
jle 0x1400800b4
and r13w, 0x9b26
jno 0x140098f67
neg r11w
and r13d, 0x4c0dd78a
movsx r13d, r11b
shl r13w, 0xe1
add qword [rsp + 0x40], 0x18b7d
movabs rcx, 0x8e92c7b9611fa329
shr cl, cl
and cx, r13w
shl r13d, 0xa5
push r14
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
not r11b
cmp r11b, r13b
mov r13w, 0xbdad
mov r14, r11
cmovge r13w, r11w
or r11w, 0x1ea5
lea rcx, [rcx - 0x18f9d0c1]
movsxd r11, r13d
mov r14w, 0x6a16
neg r11
jb 0x14004ccf5
call fcn.14008e712
movabs r15, 0x5a3320a60420951e
mov rbp, qword [rsp + 0x28]
mov rbp, qword [rbp + riz]
js 0x1400bc397
neg r13d
sub r13w, 0x112e
lea rbp, [rbp + 0x478e9c86]
xor r13b, r13b
mov qword [rsp + r13 - 0x1edd8], r15
and r13d, 0x9a84e336
movsxd r15, dword [rsp + 0x28]
add qword [rsp + r13 - 0xe1f0], 0xffffffffbffef261
xchg qword [rsp + r15*8 - 0x2104a8b8], rbp
mov r13, qword [rsp + r13 - 0xe1e0]
or r15d, 0xef2dc29b
add qword [rsp + 0x30], 0xffffffffbffd0844
xor byte [rsp + 0x28], 0x20
call fcn.14000fc9b
not r15
je 0x140092b72
push r15
call fcn.140058b2a
mov r13, qword [rsp + 0x18]
pop r14
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x48]
ret

Function at 0x140079782
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
not rsi
ja 0x1400152b2

Function at 0x140079854
Capabilities:
Enumerate process modules

Disassembly:
mov r12b, byte [rsp + 0x46]
mov r14, qword [rsp + 0x20]
jge 0x1400e1519
movsd dword [rdi], dword [rsi]
mov cs, word [0x158f23d64]
cmp eax, 0x2444c748
mov qword [rsp + 0x18], 0x5de6cd54
mov rbp, qword [rsp + 0x10]
call fcn.1400a934d
push rbp
call fcn.1400700b0

Function at 0x14007cffc
Capabilities:
Encode data using base64

Disassembly:
or dword [rsp + 0x10], 0xea210bbd
push r11
lea rdi, [rdi - 0x1d785ff0]
sub r14b, 0x91
push rdx
jno 0x1400bd490
and dword [rsp + 0x20], ecx
bswap r13
movabs rdx, 0x118448035308d21d
xchg qword [rsp + 0x60], rdi
mov r13, qword [rsp + 0x50]
add r14d, dword [rsp + 0x20]
js 0x1400711e8
movzx r14d, byte [rsp + 0x20]
or dl, 0x88
cmp dx, 0xca8a
mov r14d, dword [rsp + 0x22]
setno byte [rsp + 0x20]
mov r10d, ecx
mov r10, qword [rsp + 0x30]
mov r11, rdx
pop rdx
je 0x1400e1f7f
and cx, 0x39a0
call fcn.140052ea0
cmp dword [rsp + r8 - 0x14d1], 0x7c939bb8
not r8d
lea r8, [r8 + r8 + 0x4f10a53c]
mov r8, qword [rsp + 0x20]
call fcn.1400092b5
invalid
jle 0x140021600
call fcn.14009f779
movabs rbx, 0xad957ea7ba3d4e97
call fcn.1400df5d4
and al, 0xef
lea edi, [rcx + 0x34923c66]
mov edx, 0x582571d5
mov ebp, 0x6a203be1
invalid
jae 0x1400cd939
cmp byte [rsp + 0x38], 0x10
jne 0x1400b3272
add dword [rcx + 0x60eb2972], ecx
invalid
Function at 0x14007d419
Capabilities:
Enumerate process modules

Disassembly:
push r15
cmovo ecx, r14d
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + rcx - 0xda0e]
shl dl, 0x6d
je 0x1400c40fb
not r15w
mov r14, qword [rsp + r15 + 0x56759fbf]
sub r14, r14
jo fcn.140095ed4
push rcx
mov rcx, r14
mov qword [rsp + 0x28], rax
add cx, 0x2eb2
push rdx
shr r14w, cl
mov cx, 0xda0e
movabs rdx, 0x56a316b2c69a8b21
shr r14w, 0xcb
add qword [rsp + 0x18], 0xfffffffffff43d2a
not r15
neg r14w
jno 0x14001c851
lea rbx, [rbx + r8 - 0x533de6aa]
push qword [rsp + r8 - 0x533de69b]
popfq
lea rsp, [rsp + r8 - 0x533de693]
ret
mov r15, qword [rsp + 0x18]
push r14
xchg qword [rsp + r15 + 0x5675608a], rax
jl 0x14006b882

Function at 0x14007dbec
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], 0x6787ae34
lea rsp, [rsp + 0x20]
call fcn.1400e65a8
neg rbx
mov qword [rsp + 0x30], rax
add qword [rsp + r8*2 - 0x7c74222a], 0xffffffffacaee51c
add bx, 0x978d
shr qword [rsp], 3
setne bl
call int.1400070b0
push rdx
mov rdi, qword [rsp + 0x20]
movabs rdx, 0x171caf050539783e
pushfq
sub rdx, 0x689d2f86
push r15
lea rdi, [rdi + 1]
mov r15, rdx
sub rdx, 0x72b66180
lea rdx, [rdx + rdx*8 + 0x5db1261b]
je 0x14000f83b
xor r15d, r15d
call fcn.1400bd828
pop rdx
call fcn.140020e68
invalid

Function at 0x140080f61
Capabilities:
Enumerate process modules

Disassembly:
ja 0x1400995f9
neg r9b
sub r9b, 0x37
mov r9, qword [rsp + 0x50]
call fcn.14005a344

Function at 0x140082216
Capabilities:
Enumerate process modules
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x60], rax
mov r12, qword [rsp + 0x38]
setne r13b
jge 0x1400d6485

Function at 0x14008222a
Capabilities:
Enumerate process modules
Packed with generic packer

Disassembly:
jns 0x14005908b
add byte [rsp + r15 + 0x3f], 0x1b
or qword [rsp + r15 + 0x3f], 0xffffffffa3824538
jb 0x1400aa1ce
lea r15, [r15 + r15 - 0x34e04e69]
jbe 0x14006b85c
mov r15, qword [rsp + r15 + 0x34e04eb7]
shr word [rsp + 0x40], 0x15
or dword [rsp + 0x40], 0x9c8d4621
and dword [rsp + 0x40], 0x8728ab33
jne 0x14008f8ad
shl word [rsp + 8], 0x8b
not byte [rsp + 8]
ja 0x140094f7c
push r15
lea rcx, [rcx - 0x425b19e5]
ja 0x140070240
setbe byte [rsp + 0x10]
mov r15, qword [rsp + 0x10]
bswap r15d
xchg qword [rsp + r15*2 - 0x28071c0], rcx
mov r15, qword [rsp + r15*2 - 0x28071d8]
test byte [rsp + 0x10], 0x9a
call fcn.140083847
call fcn.140010dad
neg bp
jns 0x14000bcbb
jle 0x1400bac25
neg byte [rsp + 0x40]
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
ret
sub word [rsp + 0x20], r13w
invalid
nop
call fcn.140067502
and dword [rax], ecx
add al, byte [rax]
or byte [rcx + rbp], dl
loopne 0x1400aa180
add byte [rax], al
mov bh, 0xa3
add byte [rax], al
cmp byte [rcx - 0x6df0ffff], ch
setb dl
invalid
invalid
mov rbp, qword [rsp + 0x50]
add word [rsp + 0x58], 0xb5a9
xor byte [rsp + 0x58], 0x84
add qword [rsp + 0x60], 0x25c711
xor qword [rsp + 0x58], 0xc389a0b
jg 0x140099559

Function at 0x140082b1a
Capabilities:
Enumerate process modules

Disassembly:
jl 0x14004aa93
lea r14, [r14 + r14 + 0x67ad840f]
jo 0x1400540b7
sub r14, 0xffffffffcb07728b
add r14, 0x6008c6a6
sub r14d, r14d
mov qword [rsp + r14*8 + 0x28], rsi
call fcn.14005c23f
Function at 0x1400838a5
Capabilities:
Encode data using xor

Disassembly:
xor r10, rbx
sub dword [rsp + 0x58], ebp
jbe 0x14008cc22
xchg byte [rax - 0x6d], dh
add byte [rax], al
xor dl, byte [rax - 0x32]
js 0x1400838ad
invalid
add qword [rsp + 0x20], 0x3e84aba6
mov r10, qword [rsp + 0x50]
jge 0x140093386
js fcn.14004bddf
call fcn.14005ba14
invalid

Function at 0x14008b545
Capabilities:
Enumerate process modules

Disassembly:
jbe 0x14007bbee
mov rdx, qword [rsp + 0x10]
setns byte [rsp + 0x38]
jl 0x1400865f3
cmp qword [rsp + 0x38], 0xffffffff8195ff98
jae 0x140078366
not word [rsp + 0x38]
push qword [rsp + 0x40]
popfq

Function at 0x14008d45d
Capabilities:
Terminate process

Disassembly:
cmovs r14, qword [rsp + 0x10]
cmp word [rsp + 0x10], r14w
call fcn.1400d4929

Function at 0x14008d474
Capabilities:
Terminate process

Disassembly:
je 0x140001881
xchg qword [rsp + rdx + 0x30eae982], rdi
mov rdx, qword [rsp + 0x40]
and rbp, qword [rsp + 0x28]
or byte [rsp + 0x28], 0x19
not dword [rsp + 0x28]
mov qword [rsp + 0x28], rbp
call fcn.1400b77c6

Function at 0x14008f8bc
Capabilities:
Encode data using base64

Disassembly:
call fcn.14008c9b0
jbe 0x14004aa77
jne 0x14004acf5
sub eax, 0x21fffbb4
add byte [rax], al
add byte [rsi - 0xe], cl
add byte [rax], al
and dword [rax], eax
add byte [rax], al
add byte [rax], al
js 0x14008f8c4
add byte [rax], al
mov bl, 7
invalid

Function at 0x14009ab3f
Capabilities:
Packed with generic packer

Disassembly:
call fcn.14005f129
xchg qword [rsp + 0x30], rbx
mov r12, qword [rsp + rsi - 0xfbb4]
jae 0x14005db58
add qword [rsp], 0x53b7b
xor sil, 1
add si, word [rsp + rsi - 0x3b65]
movabs rbx, 0xc6b57123420b7323
lea r12, [rsi + rbx*4 + 0xbbd381d]
push 0xffffffffa22e2b9e
test r12w, r12w
mov rbx, qword [rsp + 8]
mov rbx, qword [rbx + rsi - 0x5dc5]
setno r12b
sub si, r12w
mov qword [rsp + 8], rsi
je 0x14004ace5
mov byte [rsp], sil
add qword [rsp + rsi*4 - 0x3eee8], r12
lea rbx, [rbx - 0x4fdf9edf]
xor r12w, 0x539b
sub qword [rsp], 0x7631761c
cmp qword [rsp + rsi - 0xfb9c], r12
mov word [rsp + 0x28], 0xc8a1
jne 0x140060bb4

Function at 0x14009d720
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], r9
shr r13w, 0x2b
js 0x140072562
xor r13w, 0xc8b2
neg r13b
lea rbp, [rbp - 0x18c92b5d]
bswap r13d
xor qword [rsp + r13 - 0x42c8a1e5], r13
and r13b, 0x3a
neg dword [rsp + r13 - 0x42c8a120]
call fcn.14004ad77

Function at 0x14009d75c
Capabilities:
Enumerate process modules

Disassembly:
add qword [rsp + r13*2 - 0x1fae], 0xfffffffffff2f1d8
movabs r11, 0xf50170b7adaf32bc
lea rax, [rax + 1]
xor r11w, 0x6bbb
ja 0x1400c4108
Function at 0x1400a00dd
Capabilities:
Encode data using base64

Disassembly:
add r15, qword [rsp + r9*4 - 0x97e8]
push rbx
shl byte [rsp + r9*4 - 0x97e0], 0x41
lea rsi, [rsi + r9*4 - 0x78447dd1]
mov rbx, qword [rsp + 0x20]
lea rbx, [rbx*8 + 0x17209d25]
push r14
neg rbx
cmovne r9w, word [rsp + r9*2 - 0x4bd5]
jle 0x14005be8b
sub ebx, dword [rsp + rbx + 0x1721cd8e]
movsx r15w, byte [rsp + r9 + 0x28]
xchg qword [rsp + r9 + 0x30], rsi
mov rbx, qword [rsp + 8]
test r15d, r15d
jge 0x1400b096f
sub r15d, 0x49a20e94
or word [rsp + 0x28], 0xeb83
mov r14, qword [rsp + 0x28]
lea r14, [r14 + r15*2 + 0x77a95c05]
and r15b, r15b
test byte [rsp + 0x28], r14b
mov r14, qword [rsp]
call fcn.1400a5fe9
push r9
pushfq
movabs r9, 0x949e1eaeeda62604
cmp r9b, 0x26
add qword [rsp + 0x10], 0xfffffffffffecbb1
push r15
movzx r9d, r9w
movabs r15, 0x2f2ed095410a53aa
mov rsi, qword [rsp + r9*8 - 0x13008]
mov rsi, qword [rsi + r9 - 0x2604]
and r9b, 0x95
mov qword [rsp + r9 - 0x25ec], r9
shr r9b, 0xe9
jns 0x1400223ab
pop rax
call fcn.14007518e
neg rbx
call fcn.140080e46
sets r9b
mov r15d, r9d
seto r15b
mov r9, qword [rsp + r15*8 + 0x20]
jne 0x14006f22d

Function at 0x1400a2894
Capabilities:
Enumerate process modules

Disassembly:
lea rdx, [rdx + r15 + 0xdf6bf21]
movabs r10, 0x46b6871167901f0f
neg r10
shr r10w, 0xbd
je 0x14006ea6d

Function at 0x1400a6413
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
movzx r12, r12b
and qword [rsp + r12 + 0x47], 0x3f0ae036
setne byte [rsp + r12*8 + 8]
mov r12, qword [rsp + r12 + 0x4f]
and qword [rsp + 0x10], 0xfffffffff101550c
jns 0x1400b37bc

Function at 0x1400a6443
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
movabs r8, 0x6f8c1307a4286a38
call fcn.14002fd00

Function at 0x1400a80e1
Capabilities:
Encode data using base64

Disassembly:
movabs r10, 0x6c04e9a823148e92
xchg qword [rsp + r15*2 - 0x41f9a506], rcx
mov r10, qword [rsp + r15*2 - 0x41f9a53e]
bswap rdi
je 0x1400e3081
jo 0x14006ff10
bswap r15d
mov r14, qword [rsp + r14 + 0x20fcd2ec]
and qword [rsp + 0x58], 0xfffffffff2049b39
shr byte [rsp + 0x58], 0x49
test edi, 0x182a482f
bswap r15
setns byte [rsp + 0x58]
jge 0x1400cbe94
mov r15, qword [rsp + 0x20]
lea rdi, [rdi + rdi*4 - 0x214dd15b]

Function at 0x1400a925b
Capabilities:
Schedule task via itaskservice

Disassembly:
mov qword [rsp + 0x20], r11
shr r11d, 0x9d
lea rcx, [rcx + r11*2 + 0x312b288b]
push rbx
add byte [rsp + r11 + 0x24], 0x8c
sub r11, r11
lea r11, [r11 + r11 + 0x26919c25]
mov rbx, r11
pushfq
add qword [rsp + 0x18], 0xffffffffffffa3d0
movabs rcx, 0x78ad6f1e193ad9a0
push r11
neg ecx
and rcx, 0xfffffffffca41aa3
setb cl
sub ecx, 0x39974228
movabs r11, 0x45a43489a1064cae
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
bswap r11
jae 0x140007824

Function at 0x1400af76e
Capabilities:
Encode data using base64

Disassembly:
not r12
add rcx, 0x47af1186
cmp rcx, 0x1a9caa07
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x18], rbx
jle 0x14009ecf1
call fcn.14001b7f0
pushfq
cmp ecx, 0xc69e30b3
push r12
xchg qword [rsp + 0x20], rbx
mov r12, rcx
jl 0x140014543
Function at 0x1400b646e
Capabilities:
Encode data using base64

Disassembly:
movzx edi, byte [rsp + r11 - 0x441effb5]
mov rdi, qword [rsp + r11 - 0x441effe0]
and byte [rsp + r11 - 0x441effb8], 0x2b
sub r11b, 0x8a
jl 0x140068540
movabs r11, 0x9bf422ded3c072a
not qword [rsp + 0x48]
or word [rsp + 0x48], 0xc19a
cmp dword [rsp + 0x48], 0x3f2f6d8a
mov r11, qword [rsp + 0x50]
call fcn.1400630a4

Function at 0x1400bdf93
Capabilities:
Enumerate process modules

Disassembly:
mov r14w, word [rsp + 0x1c]
mov dword [rsp + 0x18], r14d
push r8
nop
jae 0x1400533ad
movabs r15, 0xf52c3c2daa2f7b84
seta byte [rsp + 0x20]
lea r15, [r15 + r15*2 + 0x7a393805]
ja 0x1400b80be
jg 0x1400b27db
cmp word [rsp + 0x20], r14w
mov rdi, qword [rsp + 0x50]
mov rdi, qword [rdi]
not r15
not qword [rsp + 0x20]
mov qword [rsp + 0x50], r14
sete byte [rsp + 0x20]
sub word [rsp + 0x20], r15w
push rbp
lea rdi, [rdi - 0x14e321e6]
mov rbp, r15
shl r14b, 0xc7
jne 0x1400c0c12
or qword [rsp + 0x28], rbp
call fcn.1400dd406
fisub word [rdi + 0x18c7c8d0]
pop rdi
mov ebx, 0xb929b28f
xor al, 0x95
invalid
push r15
seta r14b
jne 0x14007bbee
mov qword [rsp + 0x28], r11
xchg qword [rsp + 0x30], rbp
mov r11, qword [rsp + 0x20]
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
ret

Function at 0x1400c07bf
Capabilities:
Terminate process

Disassembly:
add qword [rsp + 0x10], 0xffffffffbff4b835
mov qword [rsp + 0x30], r15
xchg qword [rsp + r15*4 + 0x70], rdi
mov rdx, qword [rsp + 0x58]
cmp r10d, 0x41afaf29
movzx r15w, byte [rsp + r15*4 + 0x1e]
lea r10, [r15 + r15 + 0x3b352483]
jns 0x140019431
invalid

Function at 0x1400c100b
Capabilities:
Enumerate process modules

Disassembly:
je 0x1400c412f
not sil
or r8, r8
lea rax, [rax + 0x312b2893]
shr rbx, 0xc4
bswap r8d
movzx rbx, bl
call fcn.140014e96
scasb al, byte [rdi]
movsb byte [rdi], byte [rsi]
adc cl, byte [rsi - 1]
int1
test al, 0xe9
mov dh, 0x52
jmp 0xe574f868

Function at 0x1400c1616
Capabilities:
Encode data using base64

Disassembly:
or r11b, 0x96
neg r13
jle 0x140061bfc

Function at 0x1400c5497
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
lea r8, [r8 + r8*2 - 0x5ace3cda]
js 0x140062a9e
push r13
js 0x14005662d
mov r13, r8
setb r8b
push r8
lea rdx, [rdx + 1]
push rsi
cmp r13, 0xffffffffc40255a7
jle 0x1400c807a
push r13
test qword [rsp], 0xffffffff849dbc93
pop rsi
mov qword [rsp + 0x40], rdx
call fcn.1400a6443
invalid

Function at 0x1400cba79
Capabilities:
Terminate process

Disassembly:
call fcn.140068c41
lea r13, [r13 + riz + 0x2b038a39]
xchg qword [rsp + 0x18], rax
jle 0x1400de937
movabs rcx, 0x3b017cb043358093
and rcx, 0xffffffff9cbdb700
jg 0x1400c8ff9
jle 0x14004d9de
call fcn.14001044b
mov r13, qword [rsp + 0x10]
test word [rsp + 0x30], 0x3185
not byte [rsp + 0x30]
jl 0x1400073ce
mov rdx, r9
lea rdi, [rdi - 0x4462f278]
add dl, 0xa0
jg 0x1400a3c8d
jbe 0x14008e701
pop rax
push r13
pushfq
movabs r13, 0xc3a6aa08640e942f
cmp r13d, 0x5f35f485
push rcx
jns 0x14008d433
call fcn.1400cef44
Function at 0x1400d0087
Capabilities:
Encode data using base64

Disassembly:
shr word [rsp + 0x58], 0xaa
add qword [rsp + 0x28], r11
setne byte [rsp + 0x58]
and r11w, 0x1f08
mov r11, qword [rsp + 0x50]
add dword [rsp + 0x58], 0x273f46bb
jl fcn.14004ac9e
cmp byte [rsp + 0x58], 0x3a
call fcn.1400abd24
xor dl, 0xc
mov r12, rdx
test dl, r12b
mov qword [rsp + 0x48], rbx
lea r12, [r12*4 - 0x1a7840ca]
bswap r12
call fcn.1400153f0
setbe r13b
add qword [rsp], 0xffffffffbff6d54e
shr r10b, 0xbf
lea rbp, [rbp + r10*2 - 0x63f59571]
sub r10w, 0x7f10
setne r13b
jg 0x14007f2c3
jns 0x1400c0139
push rdx
ja 0x1400b841e
call fcn.1400565ff
ja 0x140081315
mov r13, qword [rsp + 0x68]
xor ebx, dword [rsp + 0x29]
add r11b, 0xb9
shl bx, 0x70
neg qword [rsp + rbx - 0x6527ffa8]
and r12w, r11w
xor r11b, byte [rsp + 0x5e]
mov rbx, qword [rsp + 0x38]
setg r11b
or r12b, byte [rsp + 0x28]
cmp r12b, byte [rsp + 0x2d]
lea r11, [r11 + riz + 0x283983bc]
mov r12, qword [rsp + 0x10]
jne 0x140019df9
jg 0x1400c551a
mov r13, qword [rsp + 0x20]
add byte [rsp + 0x58], r10b
neg r10b
shl word [rsp + 0x58], 0x8b
and qword [rsp + 0x58], 0x3e98281a
mov r10, qword [rsp + 0x28]
and al, 0x28
call fcn.1400dff5f
out dx, eax
nop
xor al, 0xaf
in eax, dx
cmpsb byte ss:[rsi], byte [rdi]
or ebp, edx
fisttp dword [rdx - 0x36]
movabs eax, dword [0x47868f2eeb3bc0bd]
sub byte [rax + rbp*4 + 0xc66b995], cl
loop 0x140085677
pop rdx
adc eax, 0xc300fdf1
imul r10b
mov ebx, 0x1f9c4c5
add byte [rax], al
add dh, cl
std
mov ebp, es
invalid
seto byte [rsp + 0x18]
shr dword [rsp + 0x18], 0x4c
xchg qword [rsp + 0x40], rbp
mov rdi, qword [rsp + 0x28]
xor word [rsp + 0x18], 0x568e
mov qword [rsp + 0x18], 0xfffffffff8943407
and qword [rsp + 0x18], 0xc9aa5b2
movabs rdx, 0x5fba8886d315c3b6
jae 0x140085604
movsd dword [rdi], dword [rsi]
add ecx, dword [rbp + 0x4275a64d]
pop rdx
imul edi, dword [rcx], 0xa
push 0xfffffffffffffff7
invalid
mov r13, rsi
cmp r10b, sil
mov si, 0xca20
lea r13, [rdx + r13*8 + 0x75a7730d]
xchg qword [rsp + 0x60], rcx
mov r8, qword [rsp + r10 + 0x157]
lea rsp, [rsp + 0x18]
ret
shr r10d, 0x50
mov rbp, qword [rbp + r10*4 - 0x34eb0]
jne 0x140022a7a

Function at 0x1400d3b3d
Capabilities:
Enumerate process modules

Disassembly:
call fcn.140020ecc
mov bh, 0xe8
sub eax, 0x181fab88
invalid
jns 0x14006b567
and al, 0x38
invalid

Function at 0x1400d5753
Capabilities:
Encode data using base64

Disassembly:
neg r8w
call 0x14008ffae
not r8
setge r14b
mov r14, qword [rsp + rbx*2 - 0x8798]
mov byte [rsp + rbx*2 - 0x8768], r8b
js 0x140056b29

Function at 0x1400d5b29
Capabilities:
Encode data using base64

Disassembly:
test dil, dil
lea rdi, [rdi*2 - 0x32760272]
setle dil
mov rsi, qword [rsp + 0x18]
setns dil
seta dil
push r11
mov r11, rdi
or rdi, 0x70b67a17
lea rax, [rax - 0x8ccbe5b]
and rbx, 0x14055f2e
jb 0x140055a4b
lea r8, [rbx + rbx*4 + 0x3e290c9b]
shl word [rsp + rbx - 0x1400461a], 0x91
cmp byte [rsp + rbx - 0x1400461a], 0x8c
xchg qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x28]
jbe 0x14008d526
Function at 0x1400d60c6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jo 0x14005d6de
mov rbx, qword [rsp + r15 - 0x58]
shl r15b, 0xaa
xor r15d, 0xc3bf0c9a
sub byte [rsp + 0x58], r15b
and word [rsp + 0x40], 0x4ebe
call fcn.1400baba2
popfq
call fcn.1400d78f9

Function at 0x1400d648d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0x26c23
mov rdx, r12
movzx edx, dx
push r12
xor r15w, 0x43ad
neg r12b
not r15w
mov rdx, qword [rsp + 8]
mov rdx, qword [rdx]
sub r15b, byte [rsp + 7]

Function at 0x1400d8682
Capabilities:
Encode data using base64

Disassembly:
or r9b, r9b
test r9b, 0x13
call fcn.140009dd8
and dl, 0x8b
lea rcx, [rcx + r12 + 0x5da2123d]
lea r12, [r12*8 - 0x1640005d]
jb 0x14000d105
jne 0x1400540bc
pop rax
push r14
pushfq
movabs r14, 0xcca611be32b2f325
sub r14b, 0x94
push r8
shr r14b, 0x4b
je 0x1400db0f0
sete r15b
call fcn.14005965d
lea rax, [rax + 0x7c0b1e3d]
not dword [rsp + 0x30]
jbe 0x1400c7c9d
call fcn.1400593ee
push rcx
push r15
pushfq
movabs r15, 0x1a97a4857818b88c
movabs r15, 0x1c3eab1ba497b9a5
call fcn.1400a4058
popfq
cmp dword [rax + 0x24], 0x40c7e593
push rsp
xchg edx, eax
jmp qword [rcx]
js 0x140095bb3
ja 0x140056b41
movabs r11, 0xc630fb0c911f5b95
call fcn.1400967fe
pushfq
add qword [rsp + 8], 0xfffffffffffaba61
movabs rsi, 0xfe0d951a262db7b0
shl esi, 0x1e
xor sil, 0xbe
call fcn.14008a301
jo 0x1400d86c3
add qword [rsp + 8], 0xffffffffbff9ae6c
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.1400e65a8
add dword [rcx], 0xffffffb4
fldenv [0x188fa3f9b]
not qword [rsp + 0x18]
call fcn.14005dcbd

Function at 0x1400d8eef
Capabilities:
Encode data using base64
Terminate process

Disassembly:
mov bx, 0xd087
mov rcx, qword [rsp + rbx - 0x3da1d057]
test bx, bx
movsx bx, bl
lea rbx, [rbx + rbx*4 + 0x379323a8]
call fcn.1400ca343

Function at 0x1400d8f25
Capabilities:
Terminate process

Disassembly:
sub byte [rsp + rcx - 0xffc7], 0x26
neg byte [rsp + rbp - 0xffcf]
setle byte [rsp + rbp*4 - 0x3ffc4]
xor word [rsp + rbp*2 - 0x1ffc6], cx
mov rcx, qword [rsp + rbp*8 - 0x7ffe0]
add qword [rsp + rbp*2 - 0x1ffce], 0xffffffff8f1d4903
movzx ebp, bp
movabs rbp, 0x6605e58c9da165b8
neg word [rsp + 0x30]
mov rbp, qword [rsp + 8]
jne 0x1400bace9

Function at 0x1400d8f75
Capabilities:
Terminate process

Disassembly:
push r9
mov qword [rsp + rcx - 0xbffffb0], rbp
sub ecx, esi
jae 0x140019332
jb 0x1400ca885
shl edx, 0xec
push rsi
movabs rsi, 0x5181b48e671f91a6
push rcx
add rdx, rsi
shr esi, 0x5d
movzx r10w, dl
test r10w, 0x983d
mov rsi, qword [rsp + rsi + 5]
lea rsi, [rsi + 1]
mov qword [rsp + 8], rdx
mov word [rsp + 8], 0x3db2
call fcn.14004d058
movabs r10, 0xba3e492e0724dd88
js 0x140007ada
sub word [rsp + 0x50], 0x8503
and word [rsp + rcx*2 + 0x18014cf2], 0x83aa
mov r10, qword [rsp + r13*4 + 0x300167ac]
cmp r13b, byte [rsp + rcx*2 + 0x18014cf8]
movsx r13d, byte [rsp + rdi*2 + 0x7893a3dd]
bswap edi
lea rcx, [r13 + r13*2 + 0x526a9b0]
lea rdi, [rcx*8 - 0x604cc362]
call fcn.1400bc861
in al, 0x27
cmpsd dword [rsi], dword [rdi]
or ch, bl
ret 0xab43