joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c844
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
jg 0x14005babc
cmp byte [rsp + 0x38], ch
seto cl
mov rcx, qword [rsp + 0x40]
call fcn.14005d668

Function at 0x14001d290
Capabilities:
Enumerate process modules

Disassembly:
add qword [rsp], 0xfffffffffffc98fa
push r14
mov r14, qword [rsp + 0x20]
mov rsi, r14
or dword [rsp + rsi + 0x20], 0x6f09ec16
call fcn.1400bb954

Function at 0x14001d2b3
Capabilities:
Enumerate process modules

Disassembly:
test dword [rsp + r14 + 0x38], r13d
mov rbp, qword [rsp + r13 + 0x3312d126]
not r8
jl 0x140001563
not r14b
mov r13, qword [rsp + r14*8 - 0x730]
jle 0x1400dadf1
mov r14, qword [rsp + 0x48]
lea rsp, [rsp + 0x50]
ret 8

Function at 0x14004be3b
Capabilities:
Packed with generic packer

Disassembly:
lea r12, [r12*4 - 0x304449e8]
not r12b
mov r12, qword [rsp + 0x18]
mov qword [rsp + 0x18], rsi
add qword [rsp + 8], 0xffffffffbff7f056
call fcn.140068a81

Function at 0x14005624b
Capabilities:
Encode data using xor

Disassembly:
sbb bh, byte [rcx - 1]
inc dword [rcx + 0xf]
bswap r13d
invalid
invalid
bswap r13d
call fcn.1400720df
xor dh, byte [rsi]
adc eax, 0xf766dd02
out dx, al
sbb byte [rcx + rax*4], bh
sub al, 0x31
ror dword [rsi + 0x4d], 1
sahf
cmp eax, 0x9f8b1da4
xor dh, bh
rcr dword [rdx], cl
out 0x21, eax
jge 0x140056247
int 0x16
adc esp, esi
push rbp
jmp 0x1400562c3
invalid

Function at 0x14005a03c
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
sub qword [rsp + 0x40], 0x5a0a7794
xor byte [rsp + 0x40], 0x20
jns 0x140002dd9
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x48]
ret

Function at 0x14005ba51
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov rdi, qword [rsp + 0x20]
pushfq
add qword [rsp + 8], 0xfffffffffff5e676
push r14
call fcn.1400d545e

Function at 0x14005ba67
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
movabs rbx, 0x8e2ad9a40f9f9397
not bx
mov rbp, qword [rsp + 0x30]
add bl, 0x94
lea rbx, [rbx*8 + 0x43adb03b]
or bl, 0xad
shl bx, 0xa3
lea rbp, [rbp + 1]
push rdx
movabs rdx, 0xc12f4d3f218b0f39
bswap rbx
lea rbx, [rdx + riz - 0x7fe6b1c6]
mov qword [rsp + 0x38], rbp
call fcn.14007527c

Function at 0x14005baaf
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
lea rcx, [rcx + rcx + 0x2509b412]
cmp cx, 0xc40c
js 0x1400960ef
push rcx
invalid
jns 0x1400dd830
adc byte [rsp + rax], al
int 0x8d
pop rdx
out 0xca, eax
fmulp st(5)
invalid
jo 0x1400708b4
sub rcx, 0x33b0e610
mov rax, qword [rsp + 0x20]
call fcn.1400b957c
ja 0x1400e0b2e
call fcn.1400a8ce3

Function at 0x14005bcba
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
lea rdx, [rcx + rcx*4 + 0x34298a04]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx]
test byte [rsp + 8], dh
call fcn.1400df7d6

Function at 0x14005bcd3
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
neg r11b
not r11
movsx r11w, r11b
call fcn.14005811c
Function at 0x14005bce3
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
test byte [rsp + r15 - 0x70aad7b7], r15b
xchg qword [rsp + 0x38], rax
mov r15, qword [rsp + r15 - 0x70aad7b1]
not dl
seta byte [rsp + 0x18]
jne 0x140064c14
jns 0x1400a8c50
shr byte [rsp + 0x18], 8
not qword [rsp + 0x18]
shr qword [rsp + 0x18], 0xc2
mov dword [rsp + 0x18], 0x6cb56096
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
ret
shl byte [rsp + 0x18], 0x75
neg word [rsp + 0x18]
mov rdx, qword [rsp + 0x30]
jbe 0x140061d45

Function at 0x14005cb42
Capabilities:
Encode data using base64

Disassembly:
or r14w, 0x71b
bswap rsi
jbe 0x1400c6fe1
neg rcx
jl 0x1400689ce

Function at 0x14005cb6a
Capabilities:
Encode data using base64

Disassembly:
mov rbx, qword [rsp + rbx - 0x40028eff]
mov qword [rsp + 0x18], rdi
push rdx
movabs rdx, 0xe8aa7f94cbab7c9b
push rbp
jg 0x1400cf543
movabs rbp, 0xd59e5ba19b170a9e
add qword [rsp + 0x20], 0xba09c
lea rbp, [rdx + rdx*8 - 0x7f6ce26f]
xor bp, 0xb096
cmp rdx, 0x7f80773d
not dl
jns fcn.140060499
xor bp, 0x59e
mov rdi, qword [rsp + 0x20]
mov rdi, qword [rdi]
movzx rdx, dl
or dx, 0xf225
js 0x1400b11d8
jle 0x14005cbf4
lahf
not byte [rdi - 0x7984f6d]
lahf
pop rdx
push rbx
pop rdi
cmpsb byte [rsi], byte [rdi]
outsb dx, byte [rsi]
or dh, byte [rdi - 0x42]
mov edi, 0x30b76893
jae 0x14005cc38
jmp [rbp + 0x15]
invalid
xchg ebx, eax
push rbx
or byte [rsi], dh
sub dh, byte [rbx]
mov eax, 0x942d30f3
invalid
call fcn.14000af05
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
ret
test rdi, 0x343259aa
movabs rcx, 0x50ac40047120b78d
movabs rdi, 0x2a313e299da3f506
mov rdi, qword [rsp + 0x68]
call fcn.1400c8a68

Function at 0x14006048d
Capabilities:
Encode data using base64

Disassembly:
sub r12w, 0x3c8c
jae 0x14000a0b4

Function at 0x140060499
Capabilities:
Encode data using base64

Disassembly:
lea rbx, [r9*2 + 0x3201dc04]
shl r14w, 0x89
movabs r11, 0x239d7380f70007b3
xchg qword [rsp + r9*4 - 0x6076774], rdi
mov r14, qword [rsp + r9 - 0x181d9ed]
add r11, r11
setle bl
sub ebx, 0xca2bbeb1
jb 0x1400d2158

Function at 0x14006096b
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
jl 0x1400de6af
shr byte [rsp + 0x38], cl
call fcn.1400917ae
mov rax, rcx
jmp 0x140001131
Function at 0x1400682f8
Capabilities:
Encode data using base64

Disassembly:
mov r10, qword [rsp + r10 - 0x3b7703]
setns bl
add bx, 0x7011
jno 0x1400d123f
test bx, dx
sets bl
mov rdx, qword [rsp + 0x30]
call fcn.1400102e1

Function at 0x140068e4d
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
and bx, 0x52b0
xchg qword [rsp + 0x18], rdi
xor ebx, ebx
xor bl, bl
lea rbx, [rbx*8 + 0x40028f17]
call fcn.14005cb6a
test r10d, 0x79994f2e
jl 0x140060950
movabs rdi, 0x24bc3382a5b2ea15
test dil, dil

Function at 0x14006cdaa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + 0x10], 0xffffffffbff44033
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x48]
ret
jge 0x14007b0c7
jae 0x14001ec12
or ah, byte [rbp + rcx*4 + 0x8a1af4b]
cwde

Function at 0x140078ba4
Capabilities:
Encode data using base64

Disassembly:
not dword [rsp + 0x30]
call fcn.140092e2c
seto byte [rsp + rdx*2 - 0x3d664]
xor byte [rsp + rdx*8 - 0xf5a20], 3
mov rdx, qword [rsp + rdx - 0x1eb0a]
cmp qword [rsp + 0x28], 0x6a37bda4
jl 0x140072042
push r9
movabs r9, 0xd7a87b1136bde9bf
pushfq
or r9, 0xffffffff878e6e31
not r9
ja 0x14005a2cc

Function at 0x140078be8
Capabilities:
Encode data using base64

Disassembly:
test rbx, rdx
jle 0x14007c0f0
push r14
add qword [rsp + 0x10], 0x80f94
not edx
movzx r9, r12w
mov r12, qword [rsp + 0x30]
not dword [rsp + r9*2 - 0x8814]
mov dword [rsp + r9 - 0x4406], 0x4d0e4c23
jbe 0x14000cdc4
mov r9, qword [rsp + r9 - 0x43de]
neg word [rsp + 0x28]
xor word [rsp + 0x28], 0x4f31
add qword [rsp + 0x20], 0xffffffffbff50be1
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x50]
ret
push r11
pushfq
add r14, 0xbb2192
movabs r11, 0x473a0b231b896227
shl r11w, 0xd7
shl r14b, 0xac
push r15
push rcx
call fcn.140089e70

Function at 0x14007bcf2
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
push qword [rsp + 0x98]
popfq
lea rsp, [rsp + 0xb8]
ret
shr byte [rsp + 0x88], 0x14
je 0x140070d43

Function at 0x14007c132
Capabilities:
Encode data using base64

Disassembly:
jb 0x140059584
mov rbp, qword [rsp + rdi - 0x4ecff99]
mov r15, qword [rsp + rdi*2 - 0x9d9ffd2]
mov rbx, qword [rsp + r15 - 0x878c6]
jne 0x1400cde8e
and rax, 0x10401
add al, 0x62
add byte [rax], al

Function at 0x14007f429
Capabilities:
Encode data using base64

Disassembly:
xchg qword [rsp + 8], rdi
push rbx
pushfq
movabs rbx, 0x4087b09aef01a5af
cmp bl, bh

Function at 0x14007feae
Capabilities:
Encode data using base64

Disassembly:
call 0x1400bb98e
xor eax, 0x88c28d6
mov byte [rbx - 0x7047b629], ah
movabs r8, 0xe61a1f8de8a4be8f

Function at 0x14007fecb
Capabilities:
Encode data using base64

Disassembly:
movzx rdx, dx
mov rdx, qword [rsp + rdx*2 - 0xc176]
mov qword [rsp + 0x18], rcx
add qword [rsp], 0xfffffffffffdd52b
movabs rcx, 0x6104e786ab9a5035
and rcx, rcx
shr cl, cl
je 0x1400da041
jne 0x14008b5a9
Function at 0x140082663
Capabilities:
Encode data using base64

Disassembly:
shr qword [rsp + 0x28], 0xae
setae cl
test word [rsp + 0x28], cx
call fcn.140055b3c
shr r14b, 0xaa
push 0xffffffffd48f0316
xor r14, 0x5787d98a
mov rdx, qword [rsp + 0x18]
mov rdx, qword [rdx]
jbe 0x1400b41a2
add r14d, 0xa5bc1dbd
neg byte [rsp]
test qword [rsp + 0x30], 0x400a3638
mov qword [rsp + 0x18], r14
lea rdx, [rdx + 0x2c7091]
setg r14b
not dword [rsp]
push rcx
mov rcx, qword [rsp + 0x38]
xchg qword [rsp + 0x58], rdx
mov r14, qword [rsp + 0x30]
shr qword [rsp + 0x38], 0x44
or cx, 0xa0aa
sets r8b
shl word [rsp + 8], cl
shr dword [rsp + 0x38], cl
xor r8b, cl
mov rcx, qword [rsp]
not word [rsp + 0x20]
and byte [rsp + 0x20], r8b
call fcn.1400e1013
seta byte [rsp + 0x28]
ja 0x14004eb2f
mov r11, qword [rsp + 0x30]
shr r14b, 0x26
sets r14b
not r15d
mov r12, qword [rsp + 8]
call fcn.1400b6933
jmp 0x106da2572
and dword [rsp + r8 + 0x28], 0x1e17d203
xchg qword [rsp + r8*2 + 0x30], rdi
mov r8, qword [rsp + r8*2 + 0x10]
test byte [rsp + 0x18], 0x3f
call fcn.140012472
scasb al, byte [rdi]
stc
in al, dx
push rbp
ret
cmp qword [rsp + r8*2 + 0x20], 0xffffffff8e98e93f
push r12
jns 0x14008f517
call fcn.14008725e
call fcn.140021147

Function at 0x14008585a
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
or si, 0x162a
push r8
call fcn.14001d273
push 0x22194c32
pushfq
add qword [rsp + 0x10], 0xffffffffbffddbea
test qword [rsp + 8], 0x23019632
xchg qword [rsp + 0x18], rdx
js 0x1400cb685
and word [rsp + 8], 0x8d1d
xor word [rsp + 8], 0xb9a1
push rsi
mov rsi, qword [rsp + 0x10]
not sil
jns 0x14001e475
jge 0x14001268e
mov qword [rsp + 0x18], rdx
sub qword [rsp + rsi - 0x2219b53e], 0x63229e35
jno 0x14005d902
mov qword [rsp + 0x60], rcx
and r14w, r14w
push 0x2b3b3817
push rsi
jbe fcn.14008ba7c
add byte [rsp + r14 + 0x1610049], r14b
movabs rsi, 0x5f005aa1a4a1e193
neg esi
add qword [rsp + 0x40], 0xffffffffffff58c6
mov rcx, rsi
xor cl, 0x20
or r14b, 0x30
push 0xfffffffff938cab0
lea r10, [rsi + rcx + 0x42243532]
or cx, 0xb2b9
mov rcx, qword [rsp + rcx - 0x5b5ebeb5]
mov rcx, qword [rcx + r14 + 0x1610041]
js 0x1400dd8e5
movsxd r10, dword [rsp]
jne 0x1400b39ab

Function at 0x140085e64
Capabilities:
Encode data using base64

Disassembly:
jge fcn.1400682f8
movabs r12, 0x7e2ccba9abbcbe96
cmovns r13, qword [rsp + 0x50]
jo 0x140096e7f
add qword [rsp], 0xb0ca5
movabs rbx, 0xe63287922eabd2b6
lea rbx, [rbx*4 - 0x969af7e]
push rbp
call fcn.140086bca
or bp, 0x4da8
movabs r11, 0xb3a1cfb90fb7ebb5
mov r9, qword [rsp + 0x40]
test qword [rsp + 0x70], rdx
jb 0x140057cc5
shl dword [rsp + 0x70], 0x58
lea rdx, [r11 + rbp*2 - 0x54c2235a]
mov r11, qword [rsp + 0x10]
xor dword [rsp + 0x40], 0x5e0b2e85
neg dl
add r9d, 0x12aa3db7
je 0x14007c18f
add qword [rsp + 0x70], r9
test r9d, 0x513026bf
movzx rbp, byte [rsp + 0x70]
mov r9, qword [rsp + rbp*8 - 0x5b8]
jo 0x14005021f
call fcn.140078f6c
invalid
mov r13, qword [rsp + 0x18]
movsx r12w, byte [rsp + 0x52]
call fcn.1400c50a3
Function at 0x140089ab4
Capabilities:
Encode data using base64

Disassembly:
mov dword [rsp + rdx - 0x780fffe0], 0x5599972e
shr byte [rsp + rdx - 0x780fffd0], 0x88
neg qword [rsp + rdx - 0x780fffd0]
shl byte [rsp + rdx - 0x780fffe0], 0x3e
and dword [rsp + rdx - 0x780fffe0], 0x689b0990
mov rdx, qword [rsp + rdx - 0x780ffff0]
mov byte [rsp + 0x30], 0x90
jl fcn.14005daff
call fcn.1400ae2ec
shl edx, 0xf4
mov rbx, qword [rsp + rdx - 0x780fffc8]
cmp rdx, 0x192ade8c
movzx r10w, r10b
js fcn.140084469
mov byte [rsp + rdx - 0x780fffe0], 0x2f
cmp word [rsp + 0x20], dx
mov r10, qword [rsp + rdx - 0x780fffd8]
jno 0x14005cafc

Function at 0x140096106
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
and r12b, r12b
not ebx
shr r12d, 0x3f
sub rbp, 0xffffffffeb2b1820
or r8b, sil
xchg qword [rsp + rbp - 0x14d4e788], rax
mov rsi, qword [rsp + r8*2 - 0x6fb0472c]
setb byte [rsp + r13 - 0x7ffffff8]
add qword [rsp + rbp - 0x14d4e7d0], 0xffffffffbffaf171
sub r13d, 0x6297883b
not rbp
cmovbe bp, word [rsp + 9]
js 0x14001e464
jb 0x14008d958
mov r8, qword [rsp + 0x40]
add qword [rsp + rbp*4 + 0x53539fa4], 0x59cc8
mov qword [rsp + r13*4 - 0x75a1df0c], r13
movzx r15w, byte [rsp + r13 - 0x1d6877ba]
add r13w, word [rsp + 0xd]
test dword [rsp + 8], r13d
setg r15b
test r15, 0xfffffffff8812b2b
call fcn.140097198

Function at 0x1400971cf
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
mov rsi, qword [rsp + rsi*8 - 0x348]
test ebp, ebp
call fcn.14007c5d5

Function at 0x1400971de
Capabilities:
Encode data using base64

Disassembly:
lea r14, [rbp + rsi*4 + 0x1aab4b9f]
jb 0x14008df62
call fcn.1400bbb83
pop rcx
adc eax, 0x691ecdce
pushfq
and dword [rbx - 0x7d385d39], ecx
mov ss, word [rbp + 0x778e8daa]
invalid
lea rsi, [rsi + 1]
and r8d, r8d
shl r8d, 0xbf
js 0x14004fada
neg r8d
mov qword [rsp + r8*4 + 0x20], rsi
call fcn.1400e1e13
movabs rbp, 0xb984569a16a32690
mov qword [rsp + 0x28], rax
add rsi, 0xffffffff90054ea6
cmp bp, 0x1084
not rsi
js 0x1400a0ad5
jbe fcn.14007f429
push r14
movabs r14, 0xea1762b2de8f7731
add qword [rsp + 8], 0x1a708
test rsi, rsi
mov esi, 0xfd3dc1a4
jge 0x140087b25
nop
push r14
mov r14, r8
not dil
mov rbx, qword [rsp + 0x38]
mov rbx, qword [rbx]
call fcn.140007145
push rax
push rbx
or bh, 0xc2
invalid

Function at 0x14009a896
Capabilities:
Encode data using base64

Disassembly:
sets byte [rsp + 0x18]
xor byte [rsp + 0x10], r14b
and qword [rsp + r11 + 0x18304a], r9
mov r13, qword [rsp + r11*8 + 0xc18040]
neg word [rsp + 0x30]
shr r11w, 0xfa
jns 0x1400a1b4d

Function at 0x14009b06f
Capabilities:
Acquire debug privileges
Create thread
Extract resource via kernel32 functions
Set registry value

Disassembly:
shr byte [rsp + 0x50], 0x85
je 0x1400a0f50

Function at 0x14009d03b
Capabilities:
Encode data using base64

Disassembly:
or dword [rsp + rdi*2 + 0x17332], 0x7d0d3c39
bswap r11
jo 0x140090fe8
neg qword [rsp + rdi + 0xb9a1]
mov rdx, qword [rsp + rdx + 0x6a6812c5]
jo 0x1400ca188
neg bl
Function at 0x1400a737f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rax, [rax + rcx - 0x10fc4efc]
jns 0x1400d96f6
and rbp, rbp
cmp qword [rsp + rcx*2 - 0x620477ca], 0x7ca753b2
sets byte [rsp + 0x20]
call fcn.1400e23e9
mov ebx, 0x19930522
add dword [rax], eax
add byte [rax], al
rol byte [rdi], 0xe
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rbx], al
add byte [rax], al
add al, cl
invalid

Function at 0x1400ac02d
Capabilities:
Encode data using xor

Disassembly:
push r9
push r10
movabs r13, 0x8c1f8d37eb279fbe
neg r14w
mov qword [rsp + 0x48], rdi
add qword [rsp + 0x20], 0xfffffffffffdad7a
movzx r14d, r14b
cmp r13w, 0x9d39
not rbx
lea r14, [rbx + r14*4 + 0x73313fae]
sub dl, bh
call qword [rbx + 0x48]
mov ebx, 0x4138d690
xchg byte [0x1954cb7ce], dl
jo 0x140008089
call fcn.1400c1071
stosd dword [rdi], eax
clc
int1
fadd qword [rsi]
sbb cl, byte [rdi + 0x40a7ef0a]
mov esp, dword [rax]
outsd dx, dword [rsi]
push rdx
cmp ebx, ebp
jno 0x1400abfff
rcl dword [rax + rcx*8 - 0x277c979d]
in al, 0x68
movabs dword [0x2f9d5d0752474be], eax
cmp eax, 0x64d018db
jns 0x190a77765
test eax, 0xfa0aad02
fcom qword [rbx]
mov dl, 0xf6
mov eax, 0x4f446fc3
invalid

Function at 0x1400bbfcd
Capabilities:
Encode data using base64

Disassembly:
jne 0x1400df602
xchg qword [rsp + 0x80], rdi
mov r14, qword [rsp + 0x58]
mov r12, qword [rsp + 0x30]
sub rdx, 0xffffffffe5bbb193
neg word [rsp + 0x18]
call fcn.14004b0f1

Function at 0x1400bef8e
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
movabs r14, 0xb9906420a38a28a9
mov qword [rsp + 0x38], rbx
sub dl, 0x98
push r12
cmp ecx, 0xbe1b4528
cmovo dx, cx
jns 0x14005a024

Function at 0x1400cf1cd
Capabilities:
Encode data using base64

Disassembly:
jno 0x14009037e
jge 0x1400d9fe0
or dx, r13w
movabs rdx, 0x392ac9914d84109a
mov qword [rsp], rdx
jno 0x1400b6acc
mov qword [rsp + 0x18], rsi
call fcn.14005a05b

Function at 0x1400d1363
Capabilities:
Encode data using xor

Disassembly:
add dword [rsp + r14*4 - 0x25cec], r14d
neg dword [rsp + r14 - 0x972f]
and byte [rsp + r14 - 0x972f], r14b
and r14d, dword [rsp + r14*2 - 0x12e6e]
mov r14, qword [rsp + r14 - 0x4cb]
mov word [rsp + 0x28], 0xb08f
call fcn.14006cdaa

Function at 0x1400d3445
Capabilities:
Encode data using base64

Disassembly:
movabs rsi, 0x522c50bdcb90e916
mov rsi, qword [rsp + r12 - 0x75bedbad]
mov qword [rsp + rbp - 0x6a02], rsi
call fcn.14007536b
pop rdx
pop rsi
add eax, 0x55ea28d2
sbb eax, eax
push rdi
invalid
mov r9, qword [rsp + r9 - 0xee3ca81]
neg rbx
neg r14w
mov r8, qword [rsp + 0x78]
add rdx, 0xffffffffc61eaf2d
or dx, word [rsp + r14 - 0x761edd62]
jge fcn.1400da064
jge 0x1400af95d
Function at 0x1400d89a4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [0x14003f7c8]
neg r8b
mov r8, qword [rax]
cmp ebp, ebp
test r8, r8
je 0x1400de6b8
mov rdx, rcx
movsx rcx, r10w
mov rcx, r8
jmp 0x14007d7fd
jmp 0x1400a501b
call 0x1400a39fa
push rcx
push rbx
movabs rbx, 0xda9c4e87512db8a7
pushfq
neg bl
neg ebx
test ebx, 0x621df295
mov rcx, qword [rsp + 0x18]
jl 0x1400c50bb
push r12
setbe bl
call fcn.1400c64ea
sub rsi, 0xffffffffdd84aeba
cmp rsi, 0xffffffff9d292b99
mov si, 0x9829
push r9
mov qword [rsp + 0x40], rbp
call fcn.140085211
and al, 4
lodsb al, byte [rsi]
mov ecx, 0xad96e3b2
jmp 0x14004f914

Function at 0x1400da04c
Capabilities:
Encode data using base64

Disassembly:
test byte [rsp + r8 + 0x40], sil
call 0x14004b1c3
add dl, byte [rcx + 0x3d]
jnp 0x14005e218
mov ecx, 0xbf49ada3
xchg cl, bl
add edx, dword [0x11a8df88a]
not r15
lea r15, [r15*8 + 0x7606f786]
lea r15, [r15*4 - 0x66797745]
mov rdx, qword [rsp + 0x20]
push rsi
movabs rsi, 0xa72d7409fd09980c
pushfq
or r15b, sil
movzx rsi, si
mov bh, 0xf6
call fcn.14005f9e9
mov gs, word [rdi]
xchg ecx, eax
cmc
mov byte [0x1702dab21], al
out dx, eax
cld
xor eax, 0x1bc6c218
sahf
jnp 0x14005e29e
push rdi
sbb edx, dword [rdi + 0x66db6c67]
sub ch, byte [0x13f957009]
mov qword [rsi], 0x386aa94e
sti
imul ecx, dword [rdi], 0xffffff89
pushfq
cmp eax, 0xb41f838c
fidiv dword [rbx]
xchg ebp, eax
invalid
xor ebp, dword [rax + 0xf]
or dword [rsi - 0x26b76ecb], edi
mov edx, 0xe1f50b67
xchg ecx, eax
fnstcw word [rdx - 0x1e0af499]
ja 0x14005e2a4
mov ah, 0xb8
jg 0x14005e310
shl dword [rdi], 1
invalid
fcmove st(0), st(7)
invalid
xor r14w, 0xe21d
mov r14, qword [rsp + rcx*2 - 0x127c2]
call 0x14004eb9a
movsb byte [rdi], byte [rsi]
xor bh, byte [rax]
cdq
and ecx, edi
and ah, bl
mov r11, qword [rsp + r11 + 0x24ec22b5]
call fcn.140088a8f
mov r8, qword [rsp + rcx*4 - 0x24f9c]
or qword [rsp + 0x18], 0xffffffffc62f1d0b
shl r14b, 0xe5
neg word [rsp + 0x18]
jle 0x140086744
push r8
pushfq
movabs r8, 0xaa833da8f72c1524
cmp r8d, 0x1316fdab
call fcn.1400a8c5b
mov r8d, dword [rsp + r10*8 - 0x5d1fffbc]
add r9b, r9b
lea rdx, [rdx - 0x7b73ecd2]
sub si, 0x4b83
xor r8d, r8d
jae 0x14005e1d0
jl 0x1400abc9b
not r11w
lea r11, [r11 + r11*8 - 0x24f52254]
jle 0x14009ac66
Function at 0x1400de9ea
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov rcx, r10
push 0xffffffffb50b789e
movabs rsi, 0xf133a0030821df26
cmp qword [rsp], rcx
call fcn.1400c8a9c
mov rsi, qword [rsp + 0x28]
mov rsi, qword [rsi]
shl r8w, 0xb9
js 0x1400a7b03
xor qword [rsp + 0x10], r8
not r11d
cmp dword [rsp + 0x10], r8d
lea rsi, [rsi - 0x5a5f8e52]
call fcn.140085812
mov rdi, qword [rsp + 0x80]
shl dword [rsp + 0x58], 0x6d
and ecx, 0x2bb87bb
not dword [rsp + 0x58]
mov r11, qword [rsp + rcx + 0x46]
mov dword [rsp + 0x60], r8d
mov r11, qword [rsp + rcx + 0x2e]
and cl, 0xa0
call fcn.140011c50
add ecx, edi
or dword [rax - 0x59], ebp
js 0x1400906e6
jmp 0x140090701
cli
xchg ecx, eax
fcmovnb st(0), st(7)
mov ebp, 0x835a4ca5
fiadd word [rdx - 0x5144eda5]
jmp 0xfe016d6f
bswap ebx
movsx bx, bl
jl 0x140090633
shr r14d, 0xfd
mov r14, qword [rsp + rbx - 0xff8f]
movsx bx, bl
lea rbx, [rbx + rbx*4 - 0x53692bdd]
call fcn.1400dfe16
fiadd word [rbx - 0x72]
cmpsb byte [rsi], byte [rdi]
invalid

Function at 0x1400df5d6
Capabilities:
Encode data using base64

Disassembly:
push r12
push rdi
mov qword [rsp + 0x18], rax
call fcn.140063ca3

Function at 0x1400df5e3
Capabilities:
Encode data using base64

Disassembly:
pushfq
or rdi, 0xffffffffb6ac398f
jns 0x1400b2754
setge dil
mov rcx, qword [rsp + rdi + 0x1520530]
call fcn.14009adc2

Function at 0x1400df625
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
shr qword [rsp + 0x68], 0x4f
not r15
lea r15, [r15 + r15 - 0x106fa670]
jbe 0x14007f6e6
push r11
jne 0x14006830e
Function at 0x1402460ff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
sbb r11, r11
stc
sub edi, edi
xchg r9w, bx
not r9b
movzx ebx, r8b
mov r10b, 0x9b
bswap r9
inc r11b
mov r11, rcx
seta r10b
mov r10b, 0xaf
xchg r10w, r8w
mov r8, rdi
movzx r10, r8w
movsx r9d, r13w
bswap r10
nop
not r10w
setp r9b
movzx r9d, byte [r11]
jmp 0x140246154
movzx r10d, byte [rdx]
jmp 0x14024615d
inc r11
inc rdx
test ch, 0xa9
test bl, bl
je 0x140246198
mov ecx, r8d
btr rax, 0x20
mov eax, 0x7327f991
clc
rol eax, cl
cmp sp, r9w
test r10b, r15b
add al, r8b
jmp 0x14024618d
xor r9b, al
jmp 0x140246195
inc r8
test r9b, r9b
jmp 0x1402461a0
je 0x1402461af
cmp r9b, r10b
je 0x140246148
cmp r9b, r10b
jmp 0x1402461b7
jae 0x1402461dd
or eax, 0xffffffff
movzx bx, bpl
setnp dil
mov rbx, qword [rsp + 8]
movsx rdi, si
mov rdi, qword [rsp + 0x10]
jmp 0x1402461dc
ret
mov rbx, qword [rsp + 8]
seta dil
cbw
movsx ax, sil
cwde
mov eax, edi
movsxd rdi, ebx
xchg dil, dil
movzx edi, cx
mov rdi, qword [rsp + 0x10]
jmp 0x140246203
ret