joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d0c30
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor ebx, ebx
mov qword [rax - 0x18], rbx
mov r14, qword [0x1402461b8]
and qword [rax + 8], rbx
xor esi, esi
mov eax, dword [0x14023f210]
test eax, eax
je 0x1400d0c7c
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023f210]
test eax, eax
jne 0x1400d0c85
call fcn.1400101a0
test eax, eax
je 0x1400d0ca1
lea rdx, [rsp + 0x40]
mov rcx, qword [0x140237178]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400d0cac
xor eax, eax
jmp 0x1400d0d30
test r14, r14
jne 0x1400d0cc9
lea rcx, str.CreatePropertySheetPageW
call fcn.1400d0f2c
test rax, rax
je 0x1400d0cfb
mov qword [0x1402461b8], rax
mov eax, dword [rdi + 4]
mov ecx, 0x4000
test ecx, eax
jne 0x1400d0cea
cmp dword [rdi], 0x60
jb 0x1400d0cea
or eax, ecx
mov dword [rdi + 4], eax
mov rax, qword [0x140237178]
mov qword [rdi + 0x58], rax
mov rcx, rdi
call qword [0x1402461b8]
mov rbx, rax
mov qword [rsp + 0x20], rax
xor edi, edi
test rbx, rbx
sete dil
test edi, edi
je 0x1400d0d12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400d0d14
xor esi, esi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x1400d0d2d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400d0d48
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1402461c0]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14023f210]
test eax, eax
je 0x1400d0d93
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023f210]
test eax, eax
jne 0x1400d0d9c
call fcn.1400101a0
test eax, eax
je 0x1400d0db8
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140237178]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400d0dc0
xor eax, eax
jmp 0x1400d0e1d
test rbx, rbx
jne 0x1400d0de0
lea rcx, str.DestroyPropertySheetPage
call fcn.1400d0f2c
mov rbx, rax
test rax, rax
je 0x1400d0deb
mov qword [0x1402461c0], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400d0e00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400d0e02
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400d0e1b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400d0e34
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
or rdi, 0xffffffffffffffff
mov qword [rax - 0x18], rdi
mov rbx, qword [0x1402461c8]
and qword [rax + 0x10], 0
xor esi, esi
mov eax, dword [0x14023f210]
test eax, eax
je 0x1400d0e83
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023f210]
test eax, eax
jne 0x1400d0e8c
call fcn.1400101a0
test eax, eax
je 0x1400d0ea8
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140237178]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400d0eb2
or rax, 0xffffffffffffffff
jmp 0x1400d0f14
test rbx, rbx
jne 0x1400d0ed2
lea rcx, str.PropertySheetW
call fcn.1400d0f2c
mov rbx, rax
test rax, rax
je 0x1400d0edf
mov qword [0x1402461c8], rax
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
cmp rdi, 0xffffffffffffffff
sete bl
test ebx, ebx
je 0x1400d0ef6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400d0ef8
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400d0f11
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400e3558
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1400e3688
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
lea r9, [r11 + 0x20]
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x1400e36ca
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret
Function at 0x1400e3ad8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1400e3baa
test rbx, rbx
je 0x1400e3bb0
test r9, r9
je 0x1400e3bb6
and qword [r8], 0
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
and qword [rax - 0x18], 0
lea r9, [rax + 0x10]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e3b93
cmp dword [rsp + 0x48], 3
jne 0x1400e3b93
test eax, eax
jne 0x1400e3b93
cmp dword [rdi], eax
je 0x1400e3b93
mov ecx, dword [rdi]
call fcn.140002504
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rbx], rax
mov rcx, qword [rbp + 8]
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e3b87
cmp dword [rsp + 0x48], 3
jne 0x1400e3b87
test eax, eax
jne 0x1400e3b87
mov eax, 1
jmp 0x1400e3b95
mov rcx, qword [rbx]
call fcn.140002548
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.14001483c
int3
call fcn.14001483c
int3
call fcn.14001483c
int3

Function at 0x1400e3f7c
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1400e3f8d
xor eax, eax
jmp 0x1400e3fbb
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1400e3fc4
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1400e3fd5
xor eax, eax
jmp 0x1400e3ff9
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x1401280d4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140247830]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14023f210]
test eax, eax
je 0x14012811f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023f210]
test eax, eax
jne 0x140128128
call fcn.1400101a0
test eax, eax
je 0x140128144
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140237178]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14012814c
xor eax, eax
jmp 0x1401281a9
test rbx, rbx
jne 0x14012816c
lea rcx, str.ChooseColorW
call fcn.1400a6e9c
mov rbx, rax
test rax, rax
je 0x140128177
mov qword [0x140247830], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14012818c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14012818e
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401281a7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14013099c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140247b10]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14023f210]
test eax, eax
je 0x1401309e7
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023f210]
test eax, eax
jne 0x1401309f0
call fcn.1400101a0
test eax, eax
je 0x140130a0c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140237178]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140130a14
xor eax, eax
jmp 0x140130a71
test rbx, rbx
jne 0x140130a34
lea rcx, str.GetOpenFileNameW
call fcn.1400a6e9c
mov rbx, rax
test rax, rax
je 0x140130a3f
mov qword [0x140247b10], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140130a54
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140130a56
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140130a6f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140130a88
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140247b18]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14023f210]
test eax, eax
je 0x140130ad3
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023f210]
test eax, eax
jne 0x140130adc
call fcn.1400101a0
test eax, eax
je 0x140130af8
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140237178]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140130b00
xor eax, eax
jmp 0x140130b5d
test rbx, rbx
jne 0x140130b20
lea rcx, str.GetSaveFileNameW
call fcn.1400a6e9c
mov rbx, rax
test rax, rax
je 0x140130b2b
mov qword [0x140247b18], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140130b40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140130b42
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140130b5b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140179140
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140248e88]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14023f210]
test eax, eax
je 0x14017918b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023f210]
test eax, eax
jne 0x140179194
call fcn.1400101a0
test eax, eax
je 0x1401791b0
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140237178]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401791b8
xor eax, eax
jmp 0x140179215
test rbx, rbx
jne 0x1401791d8
lea rcx, str.PrintDlgW
call fcn.1400a6e9c
mov rbx, rax
test rax, rax
je 0x1401791e3
mov qword [0x140248e88], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1401791f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401791fa
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140179213
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14017a154
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140179fbc
Function at 0x14018dd18
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x14018dd44
call fcn.14017a870
mov dword [rax], 0x16
call fcn.140181560
jmp 0x14018de4a
mov eax, dword [rcx + 0x18]
test al, 0x83
je 0x14018de4a
test al, 0x40
jne 0x14018de4a
test al, 2
je 0x14018dd66
or eax, 0x20
mov dword [rcx + 0x18], eax
jmp 0x14018de4a
or eax, 1
mov dword [rcx + 0x18], eax
test eax, 0x10c
jne 0x14018dd7a
call fcn.14018bcb0
jmp 0x14018dd81
mov rax, qword [rcx + 0x10]
mov qword [rcx], rax
mov rcx, rdi
call fcn.14017f864
mov r8d, dword [rdi + 0x24]
mov rdx, qword [rdi + 0x10]
mov ecx, eax
call fcn.14018aee8
mov dword [rdi + 8], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14018de39
test byte [rdi + 0x18], 0x82
jne 0x14018de07
mov rcx, rdi
call fcn.14017f864
cmp eax, 0xffffffff
je 0x14018ddf2
mov rcx, rdi
call fcn.14017f864
cmp eax, 0xfffffffe
je 0x14018ddf2
mov rcx, rdi
call fcn.14017f864
mov rcx, rdi
lea rsi, [0x140249b10]
movsxd rbx, eax
sar rbx, 5
call fcn.14017f864
and eax, 0x1f
imul rax, rax, 0x58
add rax, qword [rsi + rbx*8]
jmp 0x14018ddf9
lea rax, [0x14023d3f0]
mov al, byte [rax + 8]
and al, 0x82
cmp al, 0x82
jne 0x14018de07
bts dword [rdi + 0x18], 0xd
cmp dword [rdi + 0x24], 0x200
jne 0x14018de26
test byte [rdi + 0x18], 8
je 0x14018de26
test dword [rdi + 0x18], 0x400
jne 0x14018de26
mov dword [rdi + 0x24], 0x1000
mov rcx, qword [rdi]
add dword [rdi + 8], 0xfffffffe
movzx eax, word [rcx]
add rcx, 2
mov qword [rdi], rcx
jmp 0x14018de4f
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [rdi + 0x18], eax
and dword [rdi + 8], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180069ab0
Capabilities:
Inspect section memory permissions

Disassembly:
mov r8d, ecx
mov r9d, ecx
xor ecx, ecx
and r8d, 0xe0000000
cmp r8d, 0xe0000000
mov eax, 0x40
cmovne eax, ecx
mov edx, eax
bts edx, 7
cmp r8d, 0xa0000000
cmovne edx, eax
mov eax, edx
or eax, 0x20
cmp r8d, 0x60000000
cmovne eax, edx
mov ecx, eax
or ecx, 0x10
cmp r8d, 0x20000000
cmovne ecx, eax
mov eax, ecx
or eax, 4
cmp r8d, 0xc0000000
cmovne eax, ecx
mov ecx, eax
or ecx, 8
cmp r8d, 0x80000000
cmovne ecx, eax
mov eax, ecx
or eax, 2
cmp r8d, 0x40000000
cmovne eax, ecx
mov ecx, eax
or ecx, 1
test r8d, r8d
cmovne ecx, eax
mov eax, ecx
bts eax, 9
bt r9d, 0x1a
cmovae eax, ecx
ret
Function at 0x140012550
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14001257c
xor al, al
jmp 0x1400126a0
movdqa xmm0, xmmword [0x140032ae0]
movdqa xmm1, xmmword [0x140032af0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x140032b00]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x140032b10]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x140012692
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400125f9
mov r11d, 2
jmp 0x14001261d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140012613
mov r11d, 1
jmp 0x14001261d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x1400126b5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14001265a
mov byte [rcx + 2], 0x3d
jmp 0x14001266a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x14001267c
mov byte [rcx], 0x3d
jmp 0x140012683
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x1400125e0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x14001269b

Function at 0x14055f632
Capabilities:
Encode data using xor

Disassembly:
push r13
pushfq
movabs r13, 0x2c5a1b3706b31db3
or r13d, r13d
xor r13w, 0x6609
mov qword [rsp + 0x10], 0x9a68ea2
mov r13, qword [rsp + r13 - 0x6b37bb2]
js 0x14055f634
call fcn.140014949
lea rdi, [rdi*2 + 0x52774a7f]
add di, 0x6586
cmp dil, 0xec
bswap rdi
mov bp, 0x5c02
seta bpl
or dil, 0xa5
mov rbp, qword [rsp + 0x10]
mov rbp, qword [rbp + riz]
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdi
test byte [rsp + 0x19], dil
push rbp
not dword [rsp + 0x20]
lea rbp, [rbp + 0x50512365]
jbe 0x140204d8c
call fcn.14028ba4c

Function at 0x140590a0f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
pushfq
movabs r14, 0x2a4a5b86589c6bec
push rsi
movabs rsi, 0x5868514a4f967446
push rdi
mov rbx, qword [rsp + 0x30]
bswap r14d
mov r14w, 0x5406
push r9
movabs rdi, 0x7afd7b3127fc079a
add qword [rsp + 0x20], 0xfffffffffff009b8
mov sil, r14b
call fcn.140500b54
pushfq
push rsi
pushfq
movabs rsi, 0x345b4e8521402d54
xor rsi, 0x99b605f
sub sil, sil
call fcn.1405cb8d0
add byte [rax], al
jo 0x140590a4b
xor bh, bh
call qword [rax - 0x3a]
mov eax, dword [rax]
add byte [rax], ah
invalid
Function at 0x14016f5f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [rsp + 9], r14d
bswap r10
mov r11d, dword [rsp + 1]
xchg word [rsp + 9], r10w
mov word [rsp + 6], cx
jmp 0x14016f612
mov ax, 0xe6fe
mov ebp, 0xa8947254
jmp 0x14016f5d3
mov word [rsp + 4], dx
bswap r8d
mov bpl, r12b
mov ecx, dword [rsp + 8]
jmp 0x14016f645
mov dil, byte [rsp + 6]
mov r13w, ax
mov r11d, r9d
xchg word [rsp + 9], di
mov r11b, byte [rsp + 0xa]
pop word [rsp + 4]
jmp 0x14016f5fc
mov bpl, 0x35
mov sil, byte [rsp + 7]
mov r14w, bp
jmp 0x14016f783
lea r8, [rdx*8]
mov word [rsp + 6], r10w
mov r10d, r14d
jmp 0x14016f62f
lea r8, [r13 + riz + 0xcd]
mov sil, 0x29
push qword [rsp + 5]
xchg r10, rbx
rdtsc
lea rsp, [rsp + 2]
jmp 0x14016f670
mov r12w, 0x4c0f
not r10b
pop word [rsp + 3]
push qword [rsp + 7]
bswap r12d
lea r12, [rbx + r8]
jmp 0x14016f686
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403aa3ef

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encode data using base64
Encode data using xor
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403abf53
Function at 0x140128364
Capabilities:
Enumerate pe sections

Disassembly:
jb 0x1401aca6a
mov ecx, dword [rax + 8]
add ecx, edx
cmp di, 0xfbe
cmp r10, rcx
jmp 0x1401aca64
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
movsxd rax, esp
lea r8, [r8 + rcx]
sar ah, cl
mov r10, rdx
bt eax, ebx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
cmp bpl, sil
add rax, 0x18
test r11, r14
test cx, 0x78ae
lea rax, [rax + r8]
test r11d, r11d
jmp 0x14023f440
jb 0x14025d4b9
inc r9d
cmp ebp, 0x253e0b2b
cmp edx, edx
jmp 0x1401de50e
add rax, 0x28
stc
cmp r9d, r11d
jmp 0x140232c4c
jb 0x14023f446
xor eax, eax
jmp 0x14025d4b9
je 0x140232c52
mov edx, dword [rax + 0xc]
clc
cmp r15b, 0x2b
cmp r10, rdx
jmp 0x1400ec219
ret

Function at 0x14019a565
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
cmp r8, rax
jmp 0x1402174bc
jne 0x1401ed850
sub r8, rdx
test eax, r9d
cmp r11, 0x17ee1c80
test r8, r8
jmp 0x14012862c
je 0x140122e5a
mov word [r10], 0
bt r8, r14
cmc
movzx eax, word [0x1400b8f10]
jmp 0x1401e55a5
je 0x140128637
mov word [rcx], 0
ret
cmovb r8, rdx
test edx, ecx
test ax, ax
jmp 0x1401ed83a
je 0x1401dceeb
xor eax, eax
stc
cmp rax, rbx
nop word [rax + rax]
cmc
jmp 0x1400f8ce3
je 0x140128632
mov word [rcx], ax
shl ax, 3
setnp al
movsx rax, r8w
add rcx, 2
dec eax
movzx eax, di
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x14018275e
inc rdx
clc
stc
cmp r10w, 0x36b7
test ax, ax
jmp 0x1400fe1b0
je 0x14027ab34
cmp rdx, 0x104
movzx r8w, bl
movsxd r8, r10d
movsx r8w, r12b
mov r8d, 0x104
jmp 0x1401c477c
movzx eax, word [0x1400b8f10]
jmp 0x1401ae334
test ax, ax
jmp 0x140183e72
jmp 0x1401ed840
cmovb r8, rdx
jmp 0x1401b9b16
jne 0x1400f8ce3
sub r8, rax
test ebp, 0x780020f
cmc
stc
test r8, r8
jmp 0x140122e49
cmp rdx, 0x104
movzx r8, r15w
bswap r8w
cmovbe r8, rdx
mov r8d, 0x104
jmp 0x140133bba
je 0x1400fe1c3
xor edx, edx
cmp spl, 0xbc
lea r9, [0x1400b8f10]
cmp bl, bpl
cmp r8, rdx
jmp 0x140143a59
add r10, 2
movzx r11d, word [r9 + rax*2 + 2]
inc rax
cmp bp, 0x43b8
test sil, bpl
clc
test r11w, r11w
jmp 0x1401dceda
je 0x140122e4f
mov word [r10], r11w
jmp 0x1401f3f1c
mov rax, qword gs:[0x30]
sal r9d, 0x8d
mov r10d, r10d
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
movsx r11w, sil
sbb r11, 0x4b3f737f
mov rax, qword [rax + 0x10]
not r8b
bts r9, r10
sub r8b, 0xec
movzx r8d, word [rax + 0x58]
rol r9w, 0xcd
inc r11b
movzx r10, r8w
cmp r8, rdx
cmovae r8, rdx
bts r9d, r9d
mov r9, qword [rax + 0x60]
add r11b, spl
movzx r11d, word [r9]
cmovl r10, r13
xor r10b, r8b
lea r10, [0x1400b8f10]
cmc
test r11w, r11w
jmp 0x14013bcac