joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140154240
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, Ordinal_27
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140154295
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
add rsp, 0x38
ret

Function at 0x1401542b0
Capabilities:
Hash data via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
add rsp, 0x28
ret

Function at 0x140155e10
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140155e7e
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
add rsp, 0x38
ret

Function at 0x140155e90
Capabilities:
Hash data via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
add rsp, 0x28
ret

Function at 0x140155f90
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140156014
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140156014
dec r8
sub rdx, 1
jne 0x140155ffa
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1401567a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1401560a4
mov ebx, eax
test eax, eax
jne 0x1401567d8
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x14015683b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140156832
test al, 0x10
je 0x140156832
bt eax, 0xa
jae 0x14015682b
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, pe_nt_image_headers64
mov rdx, rdi
call fcn.14015684c
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140156827
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140156827
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
test edi, edi
jne 0x140156832
and dword [rsp + 0x3c], 0
jmp 0x140156837
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140157eec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140157f36
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140157f36
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140157f36
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140157f36
cmp dword [rcx + 0x84], 0xe
jbe 0x140157f36
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140157f38
xor al, al
add rsp, 0x28
ret
Function at 0x1402066e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14020670d
xor al, al
jmp 0x14020686f
mov rax, qword [0x1402276c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1402276c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1402276d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1402276d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1402276e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1402276e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1402276f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1402276f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x140227700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x140206861
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1402067b9
mov r11d, 2
jmp 0x1402067dd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1402067d3
mov r11d, 1
jmp 0x1402067dd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140206885
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x140206822
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14020683a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14020684a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x140206858
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1402067a0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14020686a
Function at 0x140001000
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Auto_Clicker_is_enabled._Press_q_to_quit._n
call fcn.140001270
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400011d9
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x50], r14
xor r14d, r14d
nop word [rax + rax]
xor ecx, ecx
mov ebp, r14d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jle 0x1400011ac
nop dword [rax]
nop word [rax + rax]
mov ecx, 1
mov esi, r14d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jle 0x14000119a
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov r8d, esi
mov edx, ebp
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetPixel]
mov rdx, rdi
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_ReleaseDC]
cmp bl, 0xbf
jne 0x1400010d8
movzx eax, bx
shr ax, 8
cmp al, 0x55
jne 0x1400010d8
shr ebx, 0x10
cmp bl, 0x86
jne 0x1400010d8
mov al, 1
jmp 0x1400010da
xor al, al
test al, al
je 0x140001185
mov r8d, 0x28
mov dword [rsp + 0x20], r14d
xorps xmm0, xmm0
mov dword [rsp + 0x34], 2
xorps xmm1, xmm1
lea rdx, [rsp + 0x20]
movdqu xmmword [rsp + 0x24], xmm0
lea ecx, [r8 - 0x27]
movdqu xmmword [rsp + 0x38], xmm1
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x28
mov dword [rsp + 0x34], 4
lea rdx, [rsp + 0x20]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Clicked_at__
call fcn.140001270
mov rcx, rax
mov edx, ebp
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140003340]
call fcn.140001270
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x14000333c]
call fcn.140001270
mov ecx, 1
inc esi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp esi, eax
jl 0x140001096
xor ecx, ecx
inc ebp
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp ebp, eax
jl 0x140001080
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140001060
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Auto_Clicker_is_disabled._n
call fcn.140001270
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001450
add rsp, 0x58
ret
Function at 0x140001000
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
lea rbp, [rsp - 0x710]
sub rsp, 0x810
lea rax, [rbp + 0x728]
mov r9d, 0xf013f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREdialerconfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
invalid
test eax, eax
jne 0x140001099
jmp 0x14000104b
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and qword [rsp + 0x38], 0
lea r9, [rbp + 0x720]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x40]
and qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rbp + 0x728]
and qword [rsp + 0x20], 0
mov dword [rbp + 0x720], 0x3e8
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rcx, qword [rbp + 0x728]
test eax, eax
je 0x140001040
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
lea rdx, str.SOFTWAREdialerconfig
mov r8d, 0xf013f
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
add rsp, 0x810
pop rbp
ret

Function at 0x1400010c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4b0
mov eax, dword [0x140005010]
lea rdx, [rbp + 0x400]
mov rdi, qword [0x140005008]
mov r14d, ecx
mov dword [rsp + 0x60], eax
xor ebx, ebx
call fcn.1400019ac
test eax, eax
je 0x1400014c5
cmp dword [rbp + 0x400], ebx
je 0x1400014c5
mov r8d, r14d
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400014c5
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
mov r15d, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r13d, [rbx + 1]
mov r14, rax
test rax, rax
je 0x140001208
mov r9d, 0x104
lea r8, [rbp - 0x70]
xor edx, edx
mov rcx, rax
Function at 0x140002328
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x90]
sub rsp, 0x190
lea rcx, str.ntdll.dll
call fcn.140002078
mov edx, 0x11c
lea rax, [rsp + 0x70]
mov ecx, edx
mov qword [rbp + 0xc0], rax
xor edi, edi
mov rax, qword [rbp + 0xc0]
mov byte [rax], dil
mov rax, qword [rbp + 0xc0]
inc rax
mov qword [rbp + 0xc0], rax
sub rcx, 1
jne 0x14000235c
mov dword [rsp + 0x70], edx
mov r8b, 3
lea edx, [rcx + 2]
mov qword [rsp + 0x74], 0xa
mov word [rbp + 0x84], di
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 0x20
mov rcx, rax

Function at 0x140002c18
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 8], ecx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
lea rcx, str..pipedialercontrol_redirect64
and dword [rax - 0x20], 0
mov edi, r8d
mov rsi, rdx
mov dword [rax - 0x28], 3
xor r8d, r8d
mov edx, 0xc0000000
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002cad
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
je 0x140002ca4
test edi, edi
je 0x140002ca4
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14001c59c
Capabilities:
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
jg 0x140097c85
push r14
shl word [rsp + 0x20], 0xb9
push r8
jne fcn.14001c465

Function at 0x14001d540
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
test word [rsp + 8], 0x7bf
je 0x1400b6c05
neg qword [rsp + 8]
je 0x1400e0a71
add byte [rsp + 8], 0xbb
mov qword [rsp + 0x18], rax
je 0x1400d28af
add qword [rsp + 0x10], 0xffffffffffff0b71
not byte [rsp + 8]
call fcn.1400b4b2c
movabs r11, 0x1125608b8864013
mov rbx, qword [rsp + 0x18]
and bp, 0x8139
and word [rsp + rbp - 0x5a8d80e8], 0x1a87
call fcn.14001d683
and qword [rsp + 0x58], 0xffffffffb00fb130
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x70]
ret
jno 0x1400ab231
add dword [rsp + 0x70], 0xa82a2e93
mov byte [rsp + 0x70], 6
test dword [rsp + 0x70], 0xcc3eee11
push qword [rsp + 0x90]
popfq
lea rsp, [rsp + 0x98]
ret

Function at 0x14001da15
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
test cl, 0xd
jle 0x140007f36
test cx, cx
xchg qword [rsp + 0x20], rbp
push qword [rsp + 0x10]
popfq
mov rcx, qword [rsp + 8]
lea rsp, [rsp + 0x18]
ret

Function at 0x14001e510
Capabilities:
Read file on windows

Disassembly:
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002c00
cmp dword [rbp + 0x390], 4
jne 0x140002c00
mov ecx, dword [rbp + 0x380]
lea rdx, [rbp + 0x398]
call fcn.1400019ac
test eax, eax
je 0x140002c00
cmp dword [rbp + 0x398], edi
je 0x1400027bc
mov ecx, dword [rbp + 0x380]
lea r9d, [rdi + 1]
call fcn.1400010c0
jmp 0x140002c00
lea rdx, [rbp + 0x380]
jmp 0x140002bf2
mov r8d, 4
mov ecx, r14d
call fcn.140002c18
mov r14, qword [rsp + 0x50]
cmp cl, dh
lea r11, [rcx + rcx - 0x71f02f80]
sets r11b
test byte [rsp + 0x3d], r11b
setbe cl
mov r11, qword [rsp + rdx + 0x154df319]
sub word [rsp + 0x38], 0xd02f
cmp rdx, rcx
jg 0x140061d30
not r9
lea rsi, [rsi + 0xa8d9800]
je 0x14000276b
not r15
jb 0x140091d77
not r9w
xor r15d, r15d
xchg qword [rsp + r9 + 0x7fff0069], rsi
mov r15, qword [rsp + r9 + 0x7fff0051]
setns r9b
shl r9, 0xfe
jne 0x1400691f3
int3
mov qword [rsp + r9 - 0x7fffffcf], r15
test r9w, r9w
jl 0x14001e510
jae 0x14009625d
pushfq
add qword [rsp + 8], 0xffffffffbff15a6f
push r10
movabs r10, 0x5987a33c4b0a7889
shl r10, 0xd0
mov qword [rsp + 0x10], 0xffffffffb4f7db9f
mov r10, qword [rsp]
jae 0x14006922b
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.1400e69a8
call fcn.140080bc6
xchg ecx, eax
std
out dx, eax
and cl, byte [rbx - 0x2ed2f5c2]
sub dword [rsi], ebx
mov bh, 0x90
lea esp, [rbx]
mov dh, 0xea
invalid
sub dx, 0x9d86
setne dl
movsx r11d, byte [rsp + 0x3b]
or esi, r11d
sub ecx, esi
mov rsi, qword [rsp + r14*4 - 0x4e821ffc]
jae 0x140077556
not r14d
not ecx
xor dl, 0x35
je fcn.1400d479f
movsxd rdx, dword [rsp + 0x38]
neg cx
jle 0x14001b500
push 0x842cd3a
stosb byte [rdi], al
invalid
shr byte [rsp + r9*4 + 0x30], 0x64
shl word [rsp + r9*8 + 0x30], 0xc5
shr r9d, 0xbf
shr byte [rsp + r9*2 + 0x30], 0xf2
and qword [rsp + r9*2 + 0x30], r9
Function at 0x1400215b9
Capabilities:
Connect pipe
Packed with generic packer
Read file on windows

Disassembly:
mov qword [rsp + 0x28], rax
and r14b, 0x38
push rsi
xor r14d, 0x12198184
shr r14, 0x65
add qword [rsp + 0x28], 0x40163
movabs rax, 0x968c1714d93cc8bd
xor eax, 0x2016778d

Function at 0x14004a635
Capabilities:
Encode data using xor

Disassembly:
lea r8, [r8 + r8*4 - 0x33eac7fb]
xor r8d, r8d
xor r8b, 0x8d
mov qword [rsp + r8*8 - 0x440], r8
or r8, qword [rsp + r8 - 0x65]
lea rcx, [rcx + r8 - 0x55dcaae6]
movzx r8w, r8b
xor byte [rsp + r8 - 0x65], r8b
xor dword [rsp + r8*2 - 0xf2], 0x9bb629
test r8b, 0x1e
not byte [rsp + r8 - 0x65]
add byte [rcx - 0xa], al
rcr byte [rsi], 0x42
not byte [rsp + rax - 0x65]
jge 0x140007507
xor byte [rdi - 0x2bc6bba6], dh
push rax
pop rsp
div edx
jl 0x14004a674
enter 0x76bf, 0
in al, 0x3a
out 0xdb, eax
retf

Function at 0x14005050f
Capabilities:
Packed with generic packer
Set registry value

Disassembly:
fisub dword [rsi - 0x7f]
and al, 0x18
adc dword [rax + rbp*8], ebx
add byte [rax + 1], 0
xor r10, rcx
cmp rcx, 0xffffffffaabb04b9
jo 0x14005f679
xchg qword [rsp + 0x48], rsi
mov rcx, qword [rsp + 0x30]
call fcn.14008f9af
mov ecx, 0x6da81ffe
xchg ebx, eax
jle 0x1400504e8
xchg dword [rdx - 0x14d9b348], edi
sti
invalid

Function at 0x1400515b0
Capabilities:
Connect pipe
Packed with generic packer
Read file on windows

Disassembly:
jg 0x140069d2e
test byte [rsp + 0x30], 0xbc
setae r11b
test qword [rsp + 0x30], 0x4a23d83e
mov r11, qword [rsp + 0x38]
jne 0x140055be1
loop 0x140020f00
int3
invalid
or bpl, bpl
xor r11b, 9
mov rsi, qword [rsp + 0x30]
mov rsi, qword [rsi]
mov ebp, 0xf697c41a
jg 0x1400b5634
add word [rsp + 0x30], 0x5f86
call fcn.14006b73a
mov r14, qword [rsp + r14 - 0x5d39ff42]
jno 0x1400aed6e
add qword [rsp], 0x134c6
mov rsi, r14
neg r14
not esi
push rbp
mov rsi, qword [rsp + 8]
mov rsi, qword [rsi]
movabs rbp, 0x94a95ca5788e07a1
shr bp, 0xff
movabs rbp, 0x4f22e334d29ae4ae
lea r14, [r14 + r14 - 0x16eba352]
lea rsi, [rsi - 0xccb75e6]
shr r14b, 0xf9
shl r14, 0xa2
mov qword [rsp + 8], r14
call fcn.14005fa22
ja 0x14000d928
mov qword [rsp + 0x38], 0x707c5a5
sub qword [rsp + 0x38], 0xffffffff82ba2bb2
push qword [rsp + 0x68]
popfq
lea rsp, [rsp + 0x78]
ret
or r11w, bp
or r11w, 0x361a
lea rsi, [rsi + rbp - 0x7eeb92fd]
mov qword [rsp + 0x30], r11
or bpl, byte [rsp + 0x32]
add bp, word [rsp + 0x31]
sub qword [rsp + 0x30], 0x19dd687
add qword [rsp + 0x40], 0xffffffffbffd0255
xchg qword [rsp + 0x48], rsi
mov rbp, qword [rsp + 0x20]
mov word [rsp + 0x30], r11w
or byte [rsp + 0x30], r11b
and word [rsp + 0x30], r11w
jle 0x140020e6c

Function at 0x1400515ca
Capabilities:
Connect pipe
Packed with generic packer
Read file on windows

Disassembly:
xor dword [rsp + 0x18], 0xd4b4dc35
push r15
movabs r15, 0xe2332784073b3d15
neg ecx
call fcn.1400dca6e
add qword [rsp + rdi - 0x7dcaffe0], 0xfffffffffff86ebb
test rdx, 0xffffffff99967bb0
call fcn.1400796f4
lea eax, [rdi + 0x4c8b4838]
and al, 0x60
call fcn.1400c9d1c
cmp byte [rax - 0x3ffffffb], bh
jmp 0x14000815d
xor dl, r8b
mov r14d, r8d
call fcn.140058b2f
and r14b, 0xf
je 0x1400080de
mov r14, qword [rsp + r14 - 0x51aef5c3]
call fcn.140077160
Function at 0x140052c53
Capabilities:
Set registry value

Disassembly:
xchg qword [rsp + rbp + 0x60], rax
mov rbp, qword [rsp + rbp + 0x18]
jbe 0x1400552d0

Function at 0x140055cfc
Capabilities:
Read file on windows

Disassembly:
ja 0x1400cd02c
jns 0x14002155f
call fcn.14006e158

Function at 0x140055d0d
Capabilities:
Read file on windows

Disassembly:
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002c00
cmp dword [rbp + 0x390], 4
jne 0x140002c00
mov ecx, dword [rbp + 0x380]
lea rdx, [rbp + 0x398]
call fcn.1400019ac
test eax, eax
je 0x140002c00
cmp dword [rbp + 0x398], edi
je 0x1400027bc
mov ecx, dword [rbp + 0x380]
lea r9d, [rdi + 1]
call fcn.1400010c0
jmp 0x140002c00
lea rdx, [rbp + 0x380]
jmp 0x140002bf2
mov r8d, 4
mov ecx, r14d
call fcn.140002c18
mov r14, qword [rsp + 0x50]
cmp cl, dh
lea r11, [rcx + rcx - 0x71f02f80]
sets r11b
test byte [rsp + 0x3d], r11b
setbe cl
mov r11, qword [rsp + rdx + 0x154df319]
sub word [rsp + 0x38], 0xd02f
cmp rdx, rcx
jg 0x140061d30
not r9
lea rsi, [rsi + 0xa8d9800]
je 0x14000276b
not r15
jb 0x140091d77
not r9w
xor r15d, r15d
xchg qword [rsp + r9 + 0x7fff0069], rsi
mov r15, qword [rsp + r9 + 0x7fff0051]
setns r9b
shl r9, 0xfe
jne 0x1400691f3
int3
mov qword [rsp + r9 - 0x7fffffcf], r15
test r9w, r9w
jl 0x14001e510
jae 0x14009625d
pushfq
add qword [rsp + 8], 0xffffffffbff15a6f
push r10
movabs r10, 0x5987a33c4b0a7889
shl r10, 0xd0
mov qword [rsp + 0x10], 0xffffffffb4f7db9f
mov r10, qword [rsp]
jae 0x14006922b
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.1400e69a8
call fcn.140080bc6
xchg ecx, eax
std
out dx, eax
and cl, byte [rbx - 0x2ed2f5c2]
sub dword [rsi], ebx
mov bh, 0x90
lea esp, [rbx]
mov dh, 0xea
invalid
sub dx, 0x9d86
setne dl
movsx r11d, byte [rsp + 0x3b]
or esi, r11d
sub ecx, esi
mov rsi, qword [rsp + r14*4 - 0x4e821ffc]
jae 0x140077556
not r14d
not ecx
xor dl, 0x35
je fcn.1400d479f
movsxd rdx, dword [rsp + 0x38]
neg cx
jle 0x14001b500
push 0x842cd3a
stosb byte [rdi], al
invalid
shr byte [rsp + r9*4 + 0x30], 0x64
shl word [rsp + r9*8 + 0x30], 0xc5
shr r9d, 0xbf
shr byte [rsp + r9*2 + 0x30], 0xf2
and qword [rsp + r9*2 + 0x30], r9

Function at 0x140055d42
Capabilities:
Extract resource via kernel32 functions
Packed with generic packer
Set registry value

Disassembly:
sub rbp, qword [rsp + 8]
mov rax, qword [rsp]
mov rax, qword [rax]
mov qword [rsp], rbp
and word [rsp + 8], 0x1f29
or dword [rsp + 8], 0x18210f38
jle 0x14005f9d9
add qword [rsp], 0xffffffffffffab8b
mov rax, rbp
test rax, 0xffffffffa384d5bb
jg 0x14007d480
ja 0x1400155cd
mov ah, dh
int3
call fcn.1400dcbdb
clc
xchg ecx, eax
mov byte [rdx + 0x3c0145], cl
invalid
xor dword [rsp], 0x4c10aaac
lea rax, [rax - 0x1c61b659]
or bl, 0x2f
xor bl, 0x93
cmp dword [rsp], ebx
jge 0x140057712
pop r15
mov word [rsp + 0x38], 0x8c3e
call fcn.14001aa04

Function at 0x140057e2d
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
mov r13, rdx
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x30], 0xffffffffb4fc49c4
mov r13, qword [rsp + 0x10]
xor word [rsp + 0x18], 0x94b2
movabs r9, 0x400827bf1aabada2
neg word [rsp + 0x18]
add qword [rsp], 0xffffffffbff9ccd3
call fcn.14006ab78