joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400017f8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14d, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x3e80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], 0x3e8
mov rcx, rax
mov rbp, rax
call fcn.1400014e4
test eax, eax
je 0x140001891
mov ecx, dword [rsp + 0x48]
test ecx, ecx
je 0x140001891
mov rbx, rbp
mov edi, ecx
mov eax, 0x7273
cmp word [rbx + 4], ax
jne 0x140001887
cmp dword [rbx], r14d
je 0x140001887
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140001887
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 0x10
sub rdi, 1
jne 0x14000184d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]

Function at 0x140001a44
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp + 0x18], r8d
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov r14, rdx
mov edi, ebx
mov rbp, rcx
mov rsi, rdx
mov eax, edi
lea r9, [rsp + 0x60]
mov r8d, 2
mov qword [rsp + 0x20], rbx
mov rcx, rbp
lea rdx, [r14 + rax*2]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001aac
cmp dword [rsp + 0x60], 2
jne 0x140001aac
cmp word [rsi], bx
je 0x140001aa7
inc edi
add rsi, 2
cmp edi, 0x105
jb 0x140001a68
jmp 0x140001aac
mov ebx, 1
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140001c64
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
xor esi, esi
mov word [rbp + 0x73], 0x100
lea rax, [rbp + 0x7f]
mov dword [rbp + 0x6f], esi
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov dword [rsp + 0x48], esi
lea rcx, [rbp + 0x6f]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], esi
xor r8d, r8d
mov dword [rsp + 0x30], esi
mov dl, 1
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140001d9c
lea rax, [rbp + 0x17]
mov qword [rbp + 0x77], rax
lea ecx, [rsi + 0x30]
mov rax, qword [rbp + 0x77]
mov byte [rax], sil
mov rax, qword [rbp + 0x77]
inc rax
mov qword [rbp + 0x77], rax
sub rcx, 1
jne 0x140001ccc
mov rax, qword [rbp + 0x7f]
lea r9, [rbp - 9]
xor r8d, r8d
mov dword [rbp + 0x17], 0x1f01ff
lea rdx, [rbp + 0x17]
mov qword [rbp + 0x1b], 2
mov dword [rbp + 0x33], esi
mov dword [rbp + 0x37], 5
lea ecx, [r8 + 1]
mov qword [rbp + 0x3f], rax
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x140001d9c
lea edx, [rax + 0x28]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140001d9c
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x140001d9c
mov r8, qword [rbp - 9]
xor r9d, r9d
mov rcx, rbx
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x140001d9c
lea rax, [rbp - 1]
mov dword [rbp - 1], 0x18
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov eax, 0x400
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
mov r9d, 0xff
mov rcx, rdi
mov dword [rsp + 0x20], eax
lea edx, [r8 + 3]
mov qword [rbp + 7], rbx
mov dword [rbp + 0xf], esi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
jmp 0x140001da0
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002078
Capabilities:
Read file via mapping

Disassembly:
test rcx, rcx
je 0x14000228a
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rbx, rcx
lea rdx, [0x140003470]
lea rcx, [rsp + 0x60]
xor r13d, r13d
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
test rax, rax
je 0x140002270
lea edi, [r13 + 0x18]
lea rax, [rsp + 0x40]
mov edx, edi
mov qword [rsp + 0x2b8], rax
lea ebx, [rdi - 0x17]
mov rcx, qword [rsp + 0x2b8]
mov byte [rcx], r13b
mov rcx, qword [rsp + 0x2b8]
add rcx, rbx
mov qword [rsp + 0x2b8], rcx
sub rdx, rbx
jne 0x1400020e9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, edi
lea r8, [rsp + 0x40]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140002267
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov r8d, ebx
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002267
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r13d
mov r8d, 0x1000002
mov rcx, rax

Function at 0x140002328
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x90]
sub rsp, 0x190
lea rcx, str.ntdll.dll
call fcn.140002078
mov edx, 0x11c
lea rax, [rsp + 0x70]
mov ecx, edx
mov qword [rbp + 0xc0], rax
xor edi, edi
mov rax, qword [rbp + 0xc0]
mov byte [rax], dil
mov rax, qword [rbp + 0xc0]
inc rax
mov qword [rbp + 0xc0], rax
sub rcx, 1
jne 0x14000235c
mov dword [rsp + 0x70], edx
mov r8b, 3
lea edx, [rcx + 2]
mov qword [rsp + 0x74], 0xa
mov word [rbp + 0x84], di
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 0x20
mov rcx, rax

Function at 0x140002c18
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 8], ecx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
lea rcx, str..pipedialercontrol_redirect64
and dword [rax - 0x20], 0
mov edi, r8d
mov rsi, rdx
mov dword [rax - 0x28], 3
xor r8d, r8d
mov edx, 0xc0000000
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002cad
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
je 0x140002ca4
test edi, edi
je 0x140002ca4
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140008409
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
push rbx
add qword [rsp + 0x18], 0xffffffffbffec5bc
mov rcx, qword [rsp + 0x30]
movabs rbx, 0x26ad4202079dca27
xor rbx, 0x7a13be06
shl ebx, 0x2a
Function at 0x140011b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub bx, 0x2d96
jo 0x14008ed7b
mov rbx, qword [rsp + 0x18]
mov rbx, qword [rbx]
js 0x14006c0b1
mov qword [rsp + 0x18], 0x4ba11ab3
xor word [rsp + 0x18], 0x579b
call fcn.1400d20e1
ja 0x1400b2bfb
shl bx, 0xb9
xor qword [rsp + 0x48], 0x37331509
lea rbx, [r9 + rbx*8 + 0x62bdd9ac]
not byte [rsp + 0x48]
xor dword [rsp + 0x48], 0xbab9b081
call fcn.14004da77
shl bx, 0xbc
jns 0x140011b20

Function at 0x140011b39
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and rdx, 0x279fd8ab
and r9d, edx
add qword [rsp + rdx - 0x98], 0xfffffffffffdd553
add qword [rsp], 0xfffffffffff9b3be
movabs rax, 0xa08ea8063d96072e
shl r9, cl
jns 0x140073d49
jne 0x14004d4ac

Function at 0x140011b6b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg r12b
mov qword [rsp + 0x48], rsi
cmp r12d, 0xdf8d8b31
jb 0x1400a5e73

Function at 0x14001ad48
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg esi
ja 0x1400b48f5
xor r8, 0xffffffffc105dc88
call fcn.14005f4b3

Function at 0x14001ad5c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rbp, qword [rsp + rbp - 0x498eea56]
add dword [rsp + 0x30], 0x8605372d
jae 0x140066562

Function at 0x14001ad72
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rsi, [rsi + r14*8 - 0x6f57e06c]
or rcx, qword [rsp + r14*2 - 0x4878d3a0]
mov rsi, qword [rsp + rcx*4 + 0x1100424]
bswap r14d
xor dword [rsp + rcx*2 + 0x880232], ecx
setge r14b
jle fcn.1400125a0
movabs r11, 0xf807cd1506bd5fa7
test qword [rsp + rcx*2 + 0x880232], r14
not byte [rsp + rcx*2 + 0x880232]
mov r14, qword [rsp + r14 - 0x6a3ba9]
jge 0x1400d5f9d
xchg qword [rsp + 0x20], rax
call fcn.14007dab3
test qword [rsp + rcx*2 + 0x880232], r11
not r11
Function at 0x14001b3c0
Capabilities:
Set registry value

Disassembly:
adc eax, 0x2462e0
neg r12
call fcn.1400a09be
mov esp, 0x48ccccff
xchg qword [rsp + 0x60], rcx
mov rbp, qword [rsp + 0x40]
jl 0x1400024d7
sub qword [rsp + 0x38], 0xffffffffd8b25e3b
neg dword [rsp + 0x38]
add word [rsp + 0x38], 0xca23
call fcn.1400d7245
mov r9, qword [rsp + r9 - 0x4b1bfff8]
jno 0x140053496
int3
mov ebx, 0x9a8bed0
and eax, 0x5cb38dac
add ebp, esi
sub eax, dword [rcx]
add byte [rax], al
add byte [rdx + rbp*8 - 0x75849d6d], al
sbb ebp, dword [rdx + 0x3b]
wait
invalid
shl r10d, 0x33
jne 0x1400bf89d
cmp eax, 0x2f4f880d
movabs dword [0x661bb27f2cbeb61c], eax
mov esi, 0x1bb27f2c
or si, r9w
jg 0x14007865c
sbb esp, dword [rsi + 0x41]
or esi, ecx
neg r9d
lea rbp, [rbp - 0x4641b3eb]
mov qword [rsp + rsi - 0x1bb27f77], r9
push r15
sub esi, 0x96689e
lea r9, [r9 + riz + 0x792a62c]
cmovl r9, rsi
jo 0x140066152
movabs r15, 0x923bd9b73c8cf512
push rdi
cmp r9b, byte [rsp + 0x4d]
xchg qword [rsp + 0x50], rbp
mov r15, qword [rsp + rsi - 0x1b1c1709]
cmovbe r9w, word [rsp + 0x4a]
jns 0x14001b3b4
jne 0x1400d0d42
invalid
fucomi st(0)
add dword [rdi], esp
sahf
movsd dword [rdi], dword [rsi]
in eax, 0x54
js 0x140078707
ror dh, 1
mov dl, 0x53
jne 0x1400786a8
test dword [rcx + 0x53fa96d0], 0x96f1402
sbb byte [rsi], ch
invalid
mov rdi, qword [rsp + 0x20]
mov r10, r11
not r10b
neg byte [rsp + r11 - 0x2158cd4]
not r11
mov r10, qword [rsp + r10 - 0x2158bf3]
call fcn.1400db981
jge 0x140078694
Function at 0x14002143d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0x14005c46f
movsx r10d, r14w
lea rcx, [rcx + r10*2 - 0xbe23]
not dword [rsp + 8]
js 0x1400d869f
cmp dword [rsp + 8], r14d
call fcn.1400c7292
jne 0x1400b1502
mov eax, r8d
add r8d, dword [r10 - 0xc]
cmc
cmp dh, 0xc
cmp rdx, rdx
sub r11, 1
jmp 0x140021463
mov ecx, r8d
bsf ax, dx
mov eax, r8d
xchg dh, dl
sub dx, 0x7a6
xor rdx, rbp
add r10, 0x28
shr dl, 0xaa
sar edx, cl
xor eax, r9d
rol eax, cl
add eax, dword [r10 - 0x30]
xor r8d, eax
btc dx, 0xa8
mov ecx, eax
cwd
jmp 0x1400badad
rol r8d, cl
and cx, sp
add r8d, dword [r10 - 0x2c]
sbb ecx, r13d
bts rcx, r11
neg dx
mov ecx, r8d
movsx r9d, r15w
xchg dl, r9b
add r9b, dil
mov edx, r8d
bsf r9w, r15w
cmp ax, sp
xor edx, eax
rcr r9b, cl
btc ax, r12w
rol edx, cl
xchg rcx, rax
clc
add edx, dword [r10 - 0x28]
shld rcx, rbp, 0xba
movsx eax, si
xor r8d, edx
setle cl
rcr r9w, 0xb7
btr cx, r10w
mov ecx, edx
rcl r9w, 0x85
movzx ax, ah
rol r8d, cl
sub rax, r11
movsxd r9, r14d
ror r9b, 0x90
add r8d, dword [r10 - 0x24]
cmc
clc
rcr r9w, 0x9c
mov ecx, r8d
test ebx, 0xfe3a033e
mov eax, 0xdb37fd9b
movzx r9d, si
mov eax, r8d
rol r9b, 0x17
and r9b, 0x89
xor eax, edx
ror dh, 0xb6
bts r9, rdx
rol dl, 0xf
rol eax, cl
cmc
sar ch, cl
xor dh, 7
add eax, dword [r10 - 0x20]
cmove rcx, rsp
stc
xor r8d, eax
mov ecx, eax
rol r8d, cl
rcl cl, cl
shr dx, 0xf
add r8d, dword [r10 - 0x1c]
mov ecx, r8d
mov edx, r8d
sbb r9w, 0xc196
shr r9, cl
xor edx, eax
bts r9d, r11d
rol edx, cl
sub r9b, 0x39
test sil, 0x34
add edx, dword [r10 - 0x18]
clc
xor r9b, al
xor r8d, edx
ror cl, cl
mov ecx, edx
ror r9b, cl
rol r8d, cl
bsr r9w, r13w
add r8d, dword [r10 - 0x14]
sal cx, cl
and ch, dl
mov ecx, r8d
mov r9d, r8d
xor r9d, edx
rol r9d, cl
xadd cl, cl
add r9d, dword [r10 - 0x10]
sub ch, 0x3d
stc
xor r8d, r9d
rcl ecx, 0xa8
ror ecx, 0xa7
mov ecx, r9d
stc
clc
rol r8d, cl
jmp 0x140053fcd

Function at 0x14004db3b
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x38], r10
js 0x14005fc3e
jl 0x1400d6717
mov word [rsp + 0x10], 0x1082
setno r12b
add dword [rsp + 0x10], r12d
movsx r12w, byte [rsp + 0x13]
mov r12, qword [rsp]
add dword [rsp + 0x10], 0xa6910b10
jno 0x140094ac4
sub dword [rsp + 0x38], 0xf38af8a8
shl qword [rsp + 0x38], 0x85
lea rsi, [rsi + r13*4 - 0x4e79df8]
xor r12b, r13b
shr dword [rsp + 0x38], 0x27
push r12
shr r12w, 0x70
and ebx, dword [rsp + 0x40]
mov byte [rsp + r13*4], 0x3f
xchg qword [rsp + r13 + 0x58], rsi
mov r12, qword [rsp + rbx - 0x11d0462]
test qword [rsp + rbx*2 - 0x23a08c4], r10
setg r10b
movzx ebx, byte [rsp + r13*2 + 3]
movsxd r10, ebx
sete r13b
mov rbx, qword [rsp + r10*4 - 0x2c0]
and qword [rsp + r13 + 0x40], 0x761b8384
shl r10, 0x75
xor qword [rsp + 0x40], r13
call fcn.140067f38
cmc
loope 0x14005fcc0
invalid
jmp 0x1747b601e
call fcn.14005265c
invalid
Function at 0x1400546c3
Capabilities:
Connect pipe
Read file on windows

Disassembly:
je 0x1400bb6e4
setne bl
jg 0x140007c79
lea r8, [r13 + rbp*8 + 0x5d92453d]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x40], r8
test byte [rsp + 0x29], r13b
movabs r11, 0x7d14640f299aeb98
mov r11, qword [rsp + 0x10]
mov rbp, qword [rsp + 8]
lea rsp, [rsp + 0x18]
ret

Function at 0x1400546d2
Capabilities:
Connect pipe
Read file on windows

Disassembly:
call fcn.1400526d0
pop rbx
push rdi
pushfq
movabs rdi, 0x1ab4ff129799fb89
push r8
or rdi, 0x6a0b96a9
movabs r8, 0x61343e1603932688
xchg qword [rsp + 0x18], rbx
and r8w, r8w
sets r8b
neg edi
mov r8b, 9
jno 0x14007bdc3

Function at 0x14005470f
Capabilities:
Connect pipe
Read file on windows

Disassembly:
xchg qword [rsp + r12 - 0x63ea978], rsi
mov r12, qword [rsp + r12 - 0x63ea980]
jne 0x14009ea30
add qword [rsp], 0xffffffffbff3f4fa
add dword [rsp + 0x10], 0x5d961f35
add byte [rsp + 0x10], 0xb2
sub byte [rsp + 0x10], 0x8d
call fcn.1400956e8

Function at 0x140054725
Capabilities:
Connect pipe
Read file on windows

Disassembly:
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1400022fd
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002308
cmp dword [rsp + 0x48], 4
jne 0x140002308
mov ecx, dword [rsp + 0x50]
mov rdx, rbx
call rdi
jmp 0x140002308
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x1400022b9
movabs rsi, 0x12ad5302f79af0a0
jns 0x140010429
mov si, cx
shr si, cl
lea rbx, [rbx + r15 + 0x3a9afa9]
sub cx, cx
ja 0x1400022be
xor cx, 0x4e02
lea rcx, [rsi + rsi - 0x42dd8576]
test rcx, rsi
xchg qword [rsp + 0x48], rbx
mov r15, qword [rsp + r15 - 0x90b2bc]
lea rsi, [rsi + rcx*4 - 0x6750d6c4]
mov cx, 0x8eb2
call fcn.1400c715b

Function at 0x1400547a3
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
not qword [rsp + r10*2 - 0x5b8418be]
add dl, 0x22
add qword [rsp + 0x10], 0xffffffffbff2b505
sub word [rsp + 0x68], r10w
sub dx, dx
mov rdx, qword [rsp + 0x30]
or r10d, r8d
neg r10b
mov r10, qword [rsp + 0x40]
jg 0x14005881e

Function at 0x1400547e7
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
cmp word [rsp + 8], 0x4226
setbe cl
lea rcx, [rcx*4 - 0x297d76c8]
mov rdi, qword [rsp + 0x38]
call fcn.1400cff12

Function at 0x140054803
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
sbb byte [rdi], cl
xchg byte [rbp + 0x2f], bh
retf 0xd899
call fcn.140087d6d
pop rsi
push rcx
pushfq
movabs rcx, 0x9f9726940a295ba1
lea rcx, [rcx + rcx - 0x41f3a3e9]
test cx, 0x8c8b
movzx cx, cl
lea rcx, [rcx*8 - 0x1f598fe0]
jo 0x14008af6f
xchg qword [rsp + 0x10], rsi
sub rcx, 0xffffffffeda4de0c
shl rcx, cl
shl ecx, 0xa4
test cl, 0xa9
call fcn.1400b8a92
add qword [rsp + r8*2 - 0x42ae5910], 0xffffffffbff45328
not r15
mov qword [rsp + 0x50], r13
xchg qword [rsp + 0x60], rsi
mov r13, qword [rsp + 0x38]
add r15d, 0xe5175c85
test r15w, r15w
jbe 0x14000b04c
jns 0x14005fa23
Function at 0x1400550a5
Capabilities:
Execute shellcode via indirect call
Packed with generic packer
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
ret 8
shl r11w, 0x6e
add r11, r11
add qword [rsp], 0xfffffffffff49542
add r11, r11
lea rbx, [rbx - 0x416bee]
shr r11b, 0xcc
sub r11b, 0xac
jno 0x1400a1e28
add r11b, 0xa3
lea r11, [r11 + r11*8 - 0x495c3ef8]
neg r11d
xchg qword [rsp + r11 - 0x4ea43611], rbx
mov r11, qword [rsp + r11 - 0x4ea43621]
jae 0x1400baced
jb 0x140007053
jno 0x14009f031
setbe byte [rsp + 0x28]
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x60]
ret

Function at 0x14005a22b
Capabilities:
Encode data using base64

Disassembly:
push 0x75088124
xchg qword [rsp + r9*2 - 6], rbp
mov r9, qword [rsp + r9 - 7]
test qword [rsp + r13*2], r13
movzx r13d, word [rsp + r13 + 1]
call fcn.14008e63c
xchg qword [rsp + 0x20], rsi
movabs rdx, 0x1e961b03c39642a1
sub rdx, r12
shl rdx, 0x26
setns dl
call fcn.14007a35f
lea rbp, [rbp + 0x37913407]
add byte [rsp + 0x30], 0xb9
test qword [rsp + 0x30], rcx
not cx
shr r13d, 0xbd
jns 0x14000bc55
cmc
out 0x3f, al
push rsp
cmp bl, byte [rbx]
add eax, 0x8fc18069
mov bl, 0x22
lodsd eax, dword fs:[rsi]
sal dword [rax], 1
and dword [rdi + 0xc], eax
xor ah, byte [rdx*4 - 0x81e4f42]
invalid

Function at 0x14005afa2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.1400c2c11
cmp byte [rsi - 0x6c7ecc30], dh
mov edx, 0x36556bdf
test al, 0xe8
call fcn.14009b2ad
invalid
mov cl, byte [rdi - 0x4c66e04e]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
call fcn.1400d1bab
xor word [rsp + rsi - 0x1103c5b], 0x8c39
jb 0x14000813c
shl qword [rsp + rsi - 0x1103c5b], 0x85
call fcn.14005eac8
int3
mov r12, qword [rsp + 0x58]
sub ebp, 0x2a2b7d0f
jg 0x1400b8cc6
xor r12d, ebp
mov r12, qword [rsp + 0x28]
jo fcn.14004ee97
shl word [rsp + 0x40], 8
and bp, 0x6ab2
add qword [rsp + 0x58], 0xffffffffe8189f83
js 0x140082f8b
add al, 0xba
int3
mov r8, qword [rsp + 0x68]
je 0x14000a53d
movsx bp, bpl
jg 0x1400080d6
xor byte [rsp + 0x40], 0xd
and qword [rsp + 0x40], 0x5a272583
jl 0x1400b88b6
and word [rsp + 0x58], bp
mov rbp, qword [rsp + 0x30]
lea rsp, [rsp + 0x48]
ret

Function at 0x14005b6a2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
lea rbx, [r13 + rbx*2 + 0x3baaff82]
push rbp

Function at 0x14005b6cf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + r15 + 0x128e222a], 0x172b
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
jl 0x1400ba33f
mov qword [rsp + 0x20], rbx
bswap ebx
lea rbx, [rdi + rbx*4 + 0x5193941d]
not word [rsp + 0x20]
neg bx
jno 0x14008c91d
push rdx
lea rdx, [rdx + 0x27aa8b16]
call fcn.14004c18b

Function at 0x14005b75d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shl r15w, 0xc7
jle 0x14001adcf

Function at 0x14005c03f
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
not dword [rsp + 0x58]
jno 0x14001aa41

Function at 0x14005f4b3
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + r8*4 + 0x6fd21ed8], rsi
xchg qword [rsp + 0x40], rbp
mov rsi, qword [rsp + 0x18]
xor qword [rsp + r8*2 + 0x37e90f80], r8
call fcn.1400a1596
Function at 0x1400602b3
Capabilities:
Encode data using base64

Disassembly:
push r15
push r10
pushfq
add qword [rsp + 0x18], 0x4383
movabs r15, 0xb13b083ff3bbf825
movabs rax, 0x38a3ac89b9bf41bd
mov r10, r15
mov r15w, 0xa7b4
mov ax, 0x12a5
or rax, 0x51a50fb3
bswap rax
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
mov qword [rsp + 0x18], r10
push rsi
add r15, 0xffffffff938712b6
movabs rsi, 0xe1d4a00a8180602
call fcn.140055f57

Function at 0x140061e59
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
shl r11b, 0xe
mov qword [rsp + 0x30], r9
js 0x1400c2bb5
not byte [rsp + 0x30]
push rdx
lea rax, [rax - 0x4be82ad8]
not r10d
shl qword [rsp + 0x38], 0xa7
push r9
ja 0x14005fa09
shl r14d, 0xa4
call fcn.1400d4ae2

Function at 0x1400641c0
Capabilities:
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
mov r11w, 0xb830
push rdx
movabs rdx, 0x898ec01eef2b9ba3
add qword [rsp + 0x10], 0xfffffffffffc9538
mov rbp, r11

Function at 0x140067208
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jbe 0x140099751
cmovl cx, word [rsp + 9]
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rcx]
sub byte [rsp + 8], 9
jl 0x140098ec8
call fcn.140089697

Function at 0x140067227
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea r14, [r14 + r12*4 + 0x6cb88591]
setb r14b
neg r12b
mov r14, qword [rsp + 0x18]
xor r11w, word [rsp + 0x4b]
add r12w, 0x49a8

Function at 0x14006919a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setb byte [rsp + 0x20]
add qword [rsp], 0xffffffffbff72d39
shr byte [rsp + 0x20], 0xc3
call fcn.1400b6457

Function at 0x1400752fc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or byte [rsp + 8], 0xbe
mov bpl, byte [rsp + 0xe]
add qword [rsp], 0xfffffffffffef94c
movabs rbx, 0x538c9d9281b0ce18
push r15
cmp word [rsp + 0x10], 0x5523
jb 0x1400b6ba9
mov rbx, qword [rsp + 8]
mov rbx, qword [rbx]
shr qword [rsp + 0x10], 0x2f
call fcn.1400543f4

Function at 0x140077578
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rbx, r10
movabs rbx, 0x8124a32d4994c82e
call 0x14007ba64

Function at 0x14007a5fa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rbx, qword [rsp + rbx - 0x9b]
mov qword [rsp + 0x18], rcx
push rbp
cmp dword [rsp + 0x18], 0x7e228bb5
push 0x37a06291
call fcn.1400e05ae
call fcn.1400b0900
jns 0x1400c8433