joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
lea rbp, [rsp - 0x710]
sub rsp, 0x810
lea rax, [rbp + 0x728]
mov r9d, 0xf013f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREdialerconfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001099
jmp 0x14000104b
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and qword [rsp + 0x38], 0
lea r9, [rbp + 0x720]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x40]
and qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rbp + 0x728]
and qword [rsp + 0x20], 0
mov dword [rbp + 0x720], 0x3e8
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rcx, qword [rbp + 0x728]
test eax, eax
je 0x140001040
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
lea rdx, str.SOFTWAREdialerconfig
mov r8d, 0xf013f
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
add rsp, 0x810
pop rbp
ret

Function at 0x1400010c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4b0
mov eax, dword [0x140005010]
lea rdx, [rbp + 0x400]
mov rdi, qword [0x140005008]
mov r14d, ecx
mov dword [rsp + 0x60], eax
xor ebx, ebx
call fcn.1400019ac
test eax, eax
je 0x1400014c5
cmp dword [rbp + 0x400], ebx
je 0x1400014c5
mov r8d, r14d
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400014c5
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
mov r15d, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r13d, [rbx + 1]
mov r14, rax
test rax, rax
je 0x140001208
mov r9d, 0x104
lea r8, [rbp - 0x70]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x1400011aa
lea rcx, [rbp - 0x70]
Function at 0x140002328
Capabilities:
Acquire debug privileges
Extract resource via kernel32 functions
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x90]
sub rsp, 0x190
lea rcx, str.ntdll.dll
call fcn.140002078
mov edx, 0x11c
lea rax, [rsp + 0x70]
mov ecx, edx
mov qword [rbp + 0xc0], rax
xor edi, edi
mov rax, qword [rbp + 0xc0]
mov byte [rax], dil
mov rax, qword [rbp + 0xc0]
inc rax
mov qword [rbp + 0xc0], rax
sub rcx, 1
jne 0x14000235c
mov dword [rsp + 0x70], edx
mov r8b, 3
lea edx, [rcx + 2]
mov qword [rsp + 0x74], 0xa
mov word [rbp + 0x84], di
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov edx, 0x23
lea rcx, [rsp + 0x70]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea rcx, str.kernel32.dll
call fcn.140002078
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140002486
lea r8, [rbp + 0xc8]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000247d
lea r8, [rbp + 0xb0]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege

Function at 0x140002c18
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 8], ecx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
lea rcx, str..pipedialercontrol_redirect64
and dword [rax - 0x20], 0
mov edi, r8d
mov rsi, rdx
mov dword [rax - 0x28], 3
xor r8d, r8d
mov edx, 0xc0000000
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002cad
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
je 0x140002ca4
test edi, edi
je 0x140002ca4
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140007060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [0x14003f7c8]
sub dh, 0xb0
sal dx, 0xb7
shr dh, 0xc
mov rdx, rcx
add cl, 0xb
rcl cl, cl
mov rcx, qword [rax]
cmp r8w, di
test dl, r8b
stc
test rcx, rcx
jmp 0x1400cae2b
movsxd r11, r11d
jae 0x1400b2b50
cdq
jnp 0x14004e640
out 0xe9, eax
rcr dword [0x10017fa2e], cl
pop rbx
mov ebp, 0xe0fea997
fild word [rbx + rcx*4]
xchg ecx, eax
retf
in al, 0xe3
shl cl, 1
invalid
frstor dword [rdi]
sbb ebx, edi
mov edi, 0xfffffffe
pushfq
mov ebp, 0x9675deeb
and ch, dl
sahf
insd dword [rdi], dx
jrcxz 0x14004e621
xor eax, 0x76e5e0d6
cmc
xchg ebx, eax
xchg esi, eax
xchg ebp, eax
jbe 0x14004e626
cmc
invalid
mov esi, 0xfa4f74c
test dword [rbx + 0x49fffe70], edx
neg edx
mov r10, qword [rsp + rbp*8 + 0x50]
shr rcx, 0xba
mov r11b, cl
sub word [rsp + rbp + 0x30], 0xf68b
jb 0x1400a49a3
call fcn.140081d6c
xchg ecx, eax
pop rbx
jge 0x14007530f
and dword [rsi], edx
sub byte [rdi + 0x6c], ah
xchg dword [rcx - 0x6b415a65], esi
xchg ebx, eax
mov ebx, dword [rbp + 0x73]
adc spl, r8b
sar esp, cl
pop rbx
jns 0x140075333
jne 0x140075300
or al, 0x47
ror ebp, cl
invalid
int 0xc7
sbb dword [rsi], ecx
sal byte [rdi - 0x60a24cbc], 1
mov bl, 0x5d
lahf
invalid
insd dword [rdi], dx
jbe 0x1400752a7
jrcxz 0x1400752fa
test dword [rsi - 0x18], esi
in eax, dx
scasb al, byte [rdi]
pop rbp
xor eax, esi
lea ecx, [rsi]
call 0xfb455210
scasb al, byte [rdi]
adc eax, 0x36dde8e6
invalid
invalid
movsx r11, r11w
jb 0x14005c822
not r11w
sub al, al
jmp 0x140001131
push rdx
push r11
pushfq
movabs r11, 0x38a7d123003b2195
lea r11, [r11 + riz + 0x7fb65718]
bswap r11d
add r11w, 0xa0ba
xor r11, 0x40057db9
mov rdx, qword [rsp + 0x18]
js fcn.140090035
xor r11, 0x33033e3b
lea rdx, [rdx + 1]
seta r11b
jg 0x14004e5f0
jmp 0x140007060
je 0x1400c67c2
jmp 0x1400752d3

Function at 0x140007160
Capabilities:
Terminate process

Disassembly:
xchg qword [rsp + 0x18], rbx
push r14
pushfq
movabs r14, 0xfb19c0840e2cb303
push r8
mov r8, r14
mov qword [rsp + 0x28], rbx
shr r8w, 0xcb
jae 0x140099b98

Function at 0x1400073b0
Capabilities:
Encode data using base64

Disassembly:
push r8
movabs r8, 0xe992fea4749c3f2f
push rdx
mov rdi, qword [rsp + 0x30]
pushfq
or r8d, 0xa7b6f120
mov rdx, r8
lea rdx, [r8 + rdx*8 + 0x299bf22b]
or dl, 0xaa
mov edx, 0x4498ad24
lea rdi, [rdi + rdx - 0x4498ad23]
xor edx, 0x40b33a13
jns 0x140007cb0
xor r8b, r8b
or r8, rdx
cmp r8b, 0xab
mov qword [rsp + rdx*4 - 0x10ae5ca4], rdi
push r8
call fcn.140095d68

Function at 0x140009640
Capabilities:
Read file on windows

Disassembly:
mov r15, qword [rsp + rdx*2 - 0xfb8]
add qword [rsp + rdx - 0x7e0], 0xffffffffbff95635
movsx edx, byte [rsp + r15*8 - 0x3f84]
shr dl, 0x87
Function at 0x14000c74a
Capabilities:
Encode data using base64

Disassembly:
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
add rbx, 0x3c835994
not r15b
sub di, 0xac15
not bl
cmp r15w, 0xb60f
not r15
mov qword [rsp + 0x38], rdi
jg 0x1400afe4d
insd dword [rdi], dx
invalid
lea rax, [rax - 0x4e53535f]
jno 0x1400db95a
push rdx
movabs rdx, 0x6f34dd9bb3342705
pushfq
xor rdx, 0xffffffff97a92e2b
jne 0x140054524
test al, 0x37
cmp dword [rbx - 0x53], edx
mov dh, 0x9c
imul ebp, dword [rax - 0x7e641291], 0xfffffff2
loopne 0x1400afe66
in eax, dx
wait
xor edx, 0x47dce3e0
movabs eax, dword [0x2d17f80744aef5eb]
jg 0x1400afef9
fadd qword [rdi - 0x5f]
jmp 0x1400afe7d
invalid
rcl byte [rdx - 0x21]
add eax, 0x58586600
lea ecx, [rax]
invalid
call fcn.140087df3
Function at 0x140012670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [rsp + 0x10], 0x11e76
ja 0x1400125c1
lodsb al, byte [rsi]
mov ah, bl
and r11, r13
setle r10b
cmovo r11w, word [rsp + 0x23]
lea rbx, [rbx + 0x2d1038a2]
not r10b
add r11d, dword [rsp + 0x23]
jo 0x140075d76
jrcxz 0x140012616
mov dh, 0x5f
int3

Function at 0x140012f3d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov r10, r14
push r15
mov r15, qword [rsp + 0x40]
push rbx
mov qword [rsp + 0x58], rbp
movabs rdx, 0xe681990d9c2f0289
movabs rbx, 0x5a131e8e151bee10
setns byte [rsp + 0x48]

Function at 0x140013705
Capabilities:
Encode data using base64

Disassembly:
jb 0x14001c982
add qword [rsp + 8], 0xfffffffffffc97c8
or r9, r12
add qword [rsp], 0x33950
push r11
call fcn.1400cd589

Function at 0x140015670
Capabilities:
Encode data using base64

Disassembly:
xor r15w, 0x6800
xor ecx, 0xbf3f890b
sub r15w, 0xe08
mov r15, qword [rsp + 0x38]
xor cl, byte [rsp + rcx - 0x7143891c]
ja 0x14001d358
not byte [rsp + rcx - 0x71438951]
and rcx, 0x7cb51430
call fcn.140060a85
pushfq
jl 0x14001d36f
sbb esp, dword [rbp + 0x53d8819f]
movsd dword [rdi], dword [rsi]
lahf
sbb eax, 0x44894853
push rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x20], rax
call int.14009615d
movzx cx, byte [rsp + 0x51]
jae 0x140015670

Function at 0x14001689d
Capabilities:
Connect pipe
Encode data using base64
Extract resource via kernel32 functions
Read file on windows
Set registry value

Disassembly:
ja 0x1400c6001
nop
shr r12d, 0xf4
cmovns ebp, r12d
mov rdx, qword [rsp + r10 - 0x6b20d5f6]
mov rdx, qword [rdx + rbp - 0x1c8]
mov qword [rsp + r12 - 0x1b8], r10
lea r12, [r12*8 + 0x55b5e31b]
sub r12b, byte [rsp + r10 - 0x6b20d615]
call fcn.140012a48

Function at 0x140016960
Capabilities:
Authenticate hmac

Disassembly:
lea rcx, [rcx + r8 - 0x2ee8b2ce]
not r8w
mov rbx, qword [rsp + r8 - 0xffb7]
jo 0x1400cb1e3
ja fcn.14000794c
add qword [rsp + r8*4 - 0x3ffdc], 0xffffffffbff7cd5b
xchg qword [rsp + r8 - 0xffaf], rcx
mov rbx, qword [rsp + r8 - 0xfff7]
cmp byte [rsp + r8 - 0xffb7], 0xb5
sete byte [rsp + r8 - 0xffcf]
test r8d, r8d
mov r8, qword [rsp + r8*8 - 0x7ffc0]
je 0x1400d7ea5
sub qword [rsp + 0x48], 0x23952819
not word [rsp + 0x48]
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x50]
ret
Function at 0x14001aa73
Capabilities:
Connect pipe
Extract resource via kernel32 functions
Read file on windows
Set registry value

Disassembly:
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1400022fd
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002308
cmp dword [rsp + 0x48], 4
jne 0x140002308
mov ecx, dword [rsp + 0x50]
mov rdx, rbx
call rdi
jmp 0x140002308
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x1400022b9
push r15
mov rdx, rbp
push rbp
push rdi
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx]
mov qword [rsp + 0x60], r12
jge 0x140002477
pop r15
jge 0x1400856ac
or bp, di
je 0x140002302
xor r12w, 0x5915
lea rdx, [rdx - 0x1ed088e8]
call fcn.1400cb507
add qword [rsp + rdi*4 + 0x20], 0xbeb34
call fcn.14004da73

Function at 0x14001b6f0
Capabilities:
Write file on windows

Disassembly:
cmp r8w, 0xd48a
sete bpl
lea rsi, [rsi + 0x229e2b80]
xor bp, 0xbe16
shr bp, 3
lea rbp, [r8 + r8*4 + 0x59f1104]
or bp, r8w
add qword [rsp + r8*2 - 0x737d8000], 0xffffffffbffddc79
call fcn.14006b789
push rsi
push r8
movabs r8, 0x3b814adbe84a79f
mov r8d, 0xc2acc803
pushfq
test r8b, 0x21
lea r8, [r8 + r8 - 0x78132d5b]
mov rsi, qword [rsp + 0x18]
jb 0x140002c9e
sub r8b, 0xae
call fcn.140011588
pop rcx
leave
or al, ah
invalid

Function at 0x14001c930
Capabilities:
Authenticate hmac

Disassembly:
mov r8, rbx
seto byte [rsp + 0x40]
not bl
push rdi
not dword [rsp + 0x48]
xchg qword [rsp + 0x60], rbp
mov rbx, qword [rsp + 0x50]
seto r8b
shr dword [rsp + 0x40], 0xca
xor r8w, word [rsp + 0x4b]
movabs rdi, 0x879e10999788f305
not word [rsp + 0x40]
lea r8, [rdi + rdi*8 - 0x53e44b80]
mov rdi, qword [rsp]
jbe 0x140076040
sub byte [rsp + 0x40], 0xb
mov r15, r8
setbe r15b
mov r15, qword [rsp + 0x28]
setg byte [rsp + 0x48]
call fcn.14006483d

Function at 0x14001d5ee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jno 0x14006003a
lea rdi, [rdi + riz + 0x588d812f]
mov rdi, qword [rsp + rdi + 0x6b3dce01]
mov rdi, qword [rdi]
js 0x14009d099
call fcn.1400d109e
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
ret
call fcn.140015ee3

Function at 0x14001e420
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x140002e0f
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002e1a
mov ecx, dword [rsp + 0x60]
call rdi
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, 1
mov byte [rsp + 0x58], 0x4d
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140002e1a
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x140002db1
push r14
jo 0x140002e1d
js 0x14000fcde
neg dword [rsp + rsi*2 - 0x3a]
Function at 0x140022609
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movabs r10, 0x4bb27cbe9099d485
movabs rdx, 0x1fbb2887eab8121c
mov rsi, rbx
mov rdi, qword [rsp + 0x48]
mov rdi, qword [rdi]
cmp r9, 0x162c8806
movzx r10, word [rsp + 8]
jle 0x14007d366

Function at 0x14004b310
Capabilities:
Encode data using base64

Disassembly:
movabs r12, 0x701900ab80c2c0c
push r14
mov r14, r12
add qword [rsp + 0x10], 0xfffffffffffec2b9
movabs rax, 0xe9bd6a9cfa0d7a32
and r12d, 0xef82bda2

Function at 0x14004cc71
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.140097e96
pop rbp
push r10
call fcn.14008ff58

Function at 0x14004cc7e
Capabilities:
Encode data using base64

Disassembly:
cmp dword [rsp + 0x48], 0xd32a9a1f
setle byte [rsp + 0x48]
or word [rsp + 0x48], 0x2a21
call fcn.1400884b3

Function at 0x14004ecfb
Capabilities:
Encode data using base64

Disassembly:
xor r15w, 0x6800
xor ecx, 0xbf3f890b
sub r15w, 0xe08
mov r15, qword [rsp + 0x38]
xor cl, byte [rsp + rcx - 0x7143891c]
ja 0x14001d358
not byte [rsp + rcx - 0x71438951]
and rcx, 0x7cb51430
call fcn.140060a85
pushfq
jl 0x14001d36f
sbb esp, dword [rbp + 0x53d8819f]
movsd dword [rdi], dword [rsi]
lahf
sbb eax, 0x44894853
push rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x20], rax
call int.14009615d
movzx cx, byte [rsp + 0x51]
jae 0x140015670

Function at 0x14005423a
Capabilities:
Authenticate hmac

Disassembly:
test dword [rsp + 0x3b], r11d
mov dword [rsp + 0x28], r11d
jae 0x1400940f8
xchg ecx, eax
and eax, 0x1cd23102
pop rsi
mov eax, 0x9d92c1c7
rcr dh, 1
or al, 0x47
pop rbp
adc bl, byte [rcx]
rol byte [rdx + rcx*2], cl
pop rax
invalid
mov r11, qword [rsp + 0x18]
movabs r13, 0xef3d173d9184a88f
xor word [rsp + 0x38], r13w
shl byte [rsp + 0x28], 0x73
jns 0x1400c318b

Function at 0x140055425
Capabilities:
Authenticate hmac

Disassembly:
jbe 0x14006f64b
add qword [rsp], 0xffffffffffffaf36
push r12
sub dword [rsp], r12d
call fcn.1400215f4

Function at 0x140058564
Capabilities:
Authenticate hmac

Disassembly:
neg rcx
or dword [rsp + 0x30], 0x5caa8c34
cmp byte [rsp + 8], cl
lea rbx, [rbx + r11 + 0xf819b69]
ja 0x1400d7ebf

Function at 0x14005b144
Capabilities:
Encode data using base64

Disassembly:
mov rdx, rbx
mov r12d, edx
mov rdx, qword [rsp + r12 - 0x641b804f]
mov rdx, qword [rdx + r12 - 0x641b805f]
mov qword [rsp + r12 - 0x641b804f], r12
call fcn.1400ad52a

Function at 0x14005b167
Capabilities:
Encode data using base64

Disassembly:
xor byte [rsp + rdi - 0x1111ffc0], dil
mov qword [rsp + rdi - 0x1111ffe0], 0xffffffffd72b2f02
shl word [rsp + rdi*4 - 0x4447ffc0], 0xd5
call fcn.14004ecad
ja 0x1400a5d3f

Function at 0x140060a20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test rdx, 0xffffffffc530ed06
lea rbx, [rbx*8 + 0x7f1e9a2b]
bswap rdx
jge 0x140081330

Function at 0x140061004
Capabilities:
Encode data using base64

Disassembly:
push rsi
seta byte [rsp + rbx - 0xbe0]
xchg qword [rsp + rbx - 0xbc8], rdi
mov rbx, qword [rsp + 0x18]
shl rbp, 0x2e
js 0x14008eb6d
shr r9, 0x42
jns 0x140084449
neg bp
call fcn.1400b5395
pop rbx
pop rdi
invalid
Function at 0x1400623e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rdx, rdi
neg dl
call fcn.1400c4a61
setg sil
add rsi, rsi
push r13
mov rsi, qword [rsp + rsi*2 - 0xfca83ec]
mov qword [rsp + 0x18], 0x3315d2cd
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1400e5bdb
invalid
lea rsi, [rsi + rdi - 0x6cdd87dd]
jns 0x14005aee4
Function at 0x140062d05
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jns 0x14000aece
sub rsi, rsi
neg esi
mov qword [rsp + rsi + 0x18], rsi
lea rax, [rax + rsi - 0x7875ec5f]
cmp esi, dword [rsp + rsi + 0x1b]
lea rsi, [rsi + rsi*4 + 0x79221485]
je 0x14007f2cf

Function at 0x140069b7e
Capabilities:
Encode data using base64

Disassembly:
xchg qword [rsp + r9 - 0xc844], rsi
mov rbp, qword [rsp + 0x50]
shr byte [rsp + r9 - 0xc894], 0x2a
jne 0x1400ae3a9
not qword [rsp + r9*4 - 0x32238]
add qword [rsp + r9 - 0xc89c], 0xffffffffbffefd51
test qword [rsp + r9*4 - 0x32248], r9
jge 0x140087f04

Function at 0x14006d8c6
Capabilities:
Terminate process

Disassembly:
or r12w, r12w
mov qword [rsp + rdx - 0x2ec26612], rdx
lea rbx, [rbx + rdx - 0x7fa3d0fc]
or dword [rsp + rdx - 0x2ec26612], 0xa88cb89
push 0x2e0519b9
jl 0x1400960d4
cmp r12, 0x4d8c1199
call fcn.140007c30
je 0x140080ada
or r13d, r13d
shl r13w, 0xb9
lea rsi, [rsi + 1]
neg r13b
and r13, 0xffffffff9127d01b
je 0x14006b2cf
test r13b, 0x2c
setne r13b
and r13w, r13w
mov qword [rsp + 0x40], rsi
shr r13w, 0xeb

Function at 0x14006d909
Capabilities:
Terminate process

Disassembly:
push rsi
lea rdx, [rdx + r8*2 + 0x4ea93f3d]
setge r11b
not qword [rsp + r8 - 0x3fc8]
neg r8d
xchg qword [rsp + r11 - 0x5c861991], rdx
mov rbp, qword [rsp + r11 - 0x5c861999]
not r14w
jle 0x140092a35

Function at 0x14006dd28
Capabilities:
Encode data using base64

Disassembly:
not r13
add r12w, 0x8033
jne 0x1400c030d
add qword [rsp + 0x18], 0x199ef
cmp r13w, 0xa285
push r10
call fcn.14005c3a5
jge 0x1400d5f80
push 0x5c861a26
and r8, 0x48903f9b
mov r11, qword [rsp]
lea rdx, [rdx + 1]
shl rbp, 0x10
sete byte [rsp + r11 - 0x5c861a26]
mov r8w, bp
shr r8d, 0x81
push rdx
mov ebp, dword [rsp + r8*8 - 0x1fffff4]
mov word [rsp + rbp*4 + 8], r8w
movzx ebp, word [rsp + rbp + 8]
mov qword [rsp + rbp + 0x40], rdx
call fcn.1400b37e1
push rax
invalid
call fcn.140085300

Function at 0x14006dfbf
Capabilities:
Encode data using base64

Disassembly:
mov rdx, qword [rsp + 0x38]
not dword [rsp + 0x60]
jne 0x14000bd42
scasd eax, dword [rdi]
out 0x3d, eax
pop rbp
cmp cl, dl
mov dl, 0xb0
push r13
pushfq
movabs r13, 0xcd8bdc15303e9213
shl r13b, 0x82
and r13, r13
add qword [rsp + 0x10], 0xffffffffbff17977
bswap r13
mov qword [rsp + 0x10], 0x7ba9fecd
mov r13, qword [rsp + 8]
popfq
lea rsp, [rsp + 8]
call fcn.1400e5bdb

Function at 0x140070c3a
Capabilities:
Authenticate hmac

Disassembly:
movabs rcx, 0xf596cd34771f773a
pushfq
sub cx, cx
cmp cx, 0x459e
lea rcx, [rcx*2 + 0x5a921f37]
jne 0x140090766
mov rax, qword [rsp + 0x20]
add qword [rsp + 8], 0x1abd6
shr ecx, 0x5c
or ecx, 0x5e20e317
movzx rcx, cl
lea rax, [rax + rcx*2 - 0x2d]
setg cl
push r12
movabs r12, 0x140c010073af2a24
setne cl

Function at 0x14007101a
Capabilities:
Encode data using base64

Disassembly:
mov r9, qword [rsp + r15 + 0xe]
lea r15, [r15*2 - 0x676cfdfc]
not r15b
lea r15, [r15 + r15*8 - 0x7bf7f65f]
call fcn.1400e0486

Function at 0x14007103a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + r11*4 - 0x12c8], rsi
test edi, edi
jl 0x14006a134
Function at 0x140072fca
Capabilities:
Authenticate hmac

Disassembly:
push rcx
movabs rcx, 0x89e2686052204b0
shr cl, cl
cmp rcx, 0x1622eb83
mov qword [rsp + 0x18], rdx
jl 0x1400a8168
shl cx, 0xe
jbe 0x1400bb771
Function at 0x1400791a7
Capabilities:
Terminate process

Disassembly:
push rcx
pushfq
add qword [rsp + 0x10], 0xfffffffffff95702
mov rbx, r10
mov rdi, rbx
call fcn.14007d3e3

Function at 0x1400791bd
Capabilities:
Terminate process

Disassembly:
jb 0x140028cdf
jle 0x1400c75be
call fcn.14004f57e
mov r11, qword [rsp + 0x38]
xor r11, rbx
movabs rax, 0xffffffffffff
and r11, rax
movabs rax, 0x2b992ddfa233
cmp r11, rdi
cmove r11, rax
mov qword [0x14003b960], r11
not r11
mov qword [0x14003b968], r11
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
or r12b, 0x35
jns 0x14000c626

Function at 0x14007d3a2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
mov r12, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
ja 0x1400011aa
mov rdx, r12
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov r15d, r13d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
je 0x140001208
lea rax, str.MSBuild.exe
mov r14d, ebx
mov qword [rsp + 0x70], rax
lea r15, [rsp + 0x70]
lea rax, str.WmiPrvSE.exe
mov qword [rsp + 0x78], rax
lea rax, str.dialer.exe
mov qword [rbp - 0x80], rax
mov r14, qword [rsp + r8*2 - 0x1ff76]
jb 0x14000117e
cmp r13b, 0xa4
setne r8b
call fcn.140084205
push r9
mov qword [rsp], 0x735efacd
call fcn.1400e5bdb

Function at 0x14007f3df
Capabilities:
Authenticate hmac

Disassembly:
push r8
push rsi
mov r8, r11
movabs rsi, 0x35b3f9be3c25c634
add qword [rsp + 0x48], 0xffffffffffff9a01
not si
mov r8w, 0xeb80
add qword [rsp + 0x10], 0xffffffffbff6956f
add qword [rsp + 0x30], 0xffffffffbff49a31
sub r8, rsi
cmovs r11, r8
add r11d, 0x690993f
mov rdi, qword [rsp + 0x48]
mov rdi, qword [rdi]
shr r11b, 0xfd
mov r8b, 0x1e
mov qword [rsp + 0x48], r11
neg r9d
jns 0x14008bd2b
lea rsi, [r9 + r9*4 + 0x318c712c]
call fcn.14006e9fa
seta r14b
movabs rdi, 0x328a8c26e925e7b9
mov rdi, qword [rsp + 0x28]
mov rdi, qword [rdi + r13*8]
add qword [rsp + 0x30], 0xffffffffbff39774
call fcn.14009f0d0

Function at 0x14008133f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub r12w, r12w
movsxd r12, r12d
lea rcx, [rcx + r12*2 - 0x55b3ffff]
call fcn.1400791bd

Function at 0x140081361
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sets r11b
call fcn.14000b01b

Function at 0x14008136a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r10, qword [rsp + rdi*4 - 0x41fc]
call fcn.14007251b
cmp r11b, r14b

Function at 0x14008137f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rax, [rax - 0x24585ad7]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x18], 0xffffffffc6b8923d
test word [rsp + 0x50], 0xcbbd
push rbp
push r9
pop rbp
setbe byte [rsp + 0x18]
xchg qword [rsp + 0x60], rax
mov r11, qword [rsp + 0x48]
lea r9, [rbp + riz - 0x9edf973]
neg rbp
lea r9, [r13 + rbp + 0x4a87b538]
Function at 0x1400841ca
Capabilities:
Encode data using base64
Read file on windows

Disassembly:
lea rbx, [rbx + riz - 0x5d536044]
neg ebx
xchg qword [rsp + rbx*4 - 0x30dce6f8], rdi
or bl, bl
or ebx, 0xba1db59d
lea rbx, [rbx + rbx - 0xe6e39d8]
add qword [rsp], 0xffffffffbffe9e29
push rdx
push qword [rsp + 0x18]
popfq
mov qword [rsp + 0x18], rdi
call fcn.14001d3ff

Function at 0x140084205
Capabilities:
Encode data using base64

Disassembly:
jle 0x14002f5cb
shl r8d, 0x9f
jne 0x1400dffb1
mov r8, qword [rsp + r8 - 0x7fffffc8]
call fcn.14007db0d

Function at 0x140084215
Capabilities:
Encode data using base64

Disassembly:
mov rbx, qword [rsp + 0x18]
mov rbx, qword [rbx]
lea r14, [rdx*4 + 0x331de330]
or r14, 0xfffffffff01d4c3b
mov qword [rsp + 0x18], r14
not edx
call fcn.140080e30

Function at 0x140085aab
Capabilities:
Encode data using base64

Disassembly:
or r10b, 0x22
jge 0x140012f75
movsx r10d, r10w
xchg qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x10]
movsx edi, word [rsp + 0x40]
jns 0x1400566bd