joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004ce51
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
jns 0x14004ef6f
mov r8, qword [rsp + 0x40]
xor byte [rsp + 0x48], 0xb9
cmp qword [rsp + 0x48], 0xffffffffd2bb4237
jb 0x140062187
movabs rsi, 0x491399993028570c
bswap edx
push r10
neg dl
xor byte [rsp + 0x10], 0x8a
push rdi
mov rsi, qword [rsp + 0x10]
mov rsi, qword [rsi + rdx*4 - 0x7d045eb4]
movabs rdi, 0x7a9c781b490c5e1d

Function at 0x14004dc2a
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], 0xffffffff882be6a3
jo 0x14001c858

Function at 0x14004dc47
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
jb fcn.140073e82
jb fcn.1400646a6
call fcn.140012870

Function at 0x14004e200
Capabilities:
Authenticate hmac
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
movabs rbp, 0xb696ab1c5202baaf
shr rbp, 1
test qword [rsp + 0x10], rdi
mov rbp, qword [rsp + rdi - 0x2d9e209a]
mov rbp, qword [rbp + rdi*2 - 0x5b3c4144]
mov qword [rsp + rdi - 0x2d9e209a], rdi
call fcn.1400a5bc1
xor qword [rsp + rdi - 0x15f8], rdi
lea rbp, [rbp + rdi - 0x15ff]
shr word [rsp + rdi*2 - 0x2bf8], 0xca
and byte [rsp + rdi - 0x15f8], 0x9b
sub qword [rsp + rdi - 0x15f8], 0xab63faf
mov qword [rsp + rdi - 0x15d8], rbp
cmp dword [rsp + rdi - 0x15f8], edi
mov byte [rsp + rdi*8 - 0xaff8], 0x9a
setb dil
lea rdi, [rdi + rdi*4 + 0x2d9db2a2]
push r14
or dword [rsp + rdi - 0x2d9e2092], 0xf934e29a
jne 0x140061eb8
add qword [rsp + 0x10], 0xffffffffbff1922c
sub dword [rsp + 0x18], 0xd01dc780
test r9b, r9b
bswap r9d
not rbp
mov r10, qword [rsp + r10*8 - 0x78c28]
movzx r9, r9b
call fcn.14004c33a
add qword [rsp + 8], 0x26a25
mov word [rsp + rdi*2 - 0x5b3c4134], di
or qword [rsp + rdi - 0x2d9e2092], 0x258a30a9
js 0x140020ecc

Function at 0x14004e28e
Capabilities:
Authenticate hmac
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
jae 0x1400dee6c
sete r13b
jne 0x140099105
call fcn.1400d500d

Function at 0x14005208a
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
cmovns edx, dword [rsp + rdx*8 + 0x31]
and qword [rsp + rdx + 0x30], 0xfffffffffa0cf0a5
and dl, dh
mov rdx, qword [rsp + rdx*2 + 0x28]
jb 0x1400d4fa5
jo 0x1400b7c90
call fcn.1400cd259

Function at 0x140053045
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
neg qword [rsp + 0x20]
seta byte [rsp + 0x30]
sub qword [rsp + 0x20], 0xfffffffff505a505
neg qword [rsp + 0x20]
call fcn.14000cd8e
Function at 0x140053062
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0x1d3f
xchg qword [rsp + 0x10], rax
call fcn.1400cc67b

Function at 0x140054c3c
Capabilities:
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], 0xffffffffcd70a1bd
lea rsp, [rsp + 0x10]
call fcn.1400eb236

Function at 0x140056034
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
sub rdi, rdi
push rbx
mov rdi, qword [rsp + 0x28]
mov rdi, qword [rdi]
mov qword [rsp + 0x28], r11
movabs r12, 0x16a29bb9c216f538
neg r12
movsx r12w, r11b
push r14
shl r12, 0xfa
lea rdi, [rdi + 0x11354429]
movzx r11w, byte [rsp + 0x32]
shr r11, 0xd1
mov r14, qword [rsp + 0x30]
xor word [rsp + 0x30], r11w
ja 0x1400c7b1e
push rdx
push r11
xchg qword [rsp + r12*8 + 0x50], rdi
mov r11, qword [rsp + 0x38]
xor r12b, 0x35
add qword [rsp + r12 + 0x13], 0xfffffffffffba1e2
mov rbx, qword [rsp + r12 + 0xb]
call fcn.1400bdc40

Function at 0x140058448
Capabilities:
Connect pipe
Encode data using base64

Disassembly:
push r12
movabs r12, 0xc03a629d9fb335ba
call fcn.1400928da

Function at 0x140058459
Capabilities:
Connect pipe

Disassembly:
call fcn.1400a7350
jae 0x140074904
mov rdi, qword [rsp + 0x28]
mov dword [rsp + 0x50], 0x1f9cf687
add word [rsp + 0x50], 0xba1c
not byte [rsp + 0x50]
shr dword [rsp + 0x50], 0x8b
jns 0x140007b55

Function at 0x14005a823
Capabilities:
Connect pipe
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
jo 0x14009a4d9
call fcn.14008a5b0
jl 0x14006e673
lea r15, [r15*2 + 0x70e92a0]
xchg qword [rsp + r15 - 0x70ec6be], rbp
mov r13, qword [rsp + 0x30]
bswap r15
jbe 0x14007b42e
lea r15, [r15 + r15*4 - 0x785e5dfd]
jge 0x140064186
invalid
xor r15, 0xffffffff8d3415ac
sub byte [rsp + 0x10], r15b
setge byte [rsp + 0x10]
jns 0x140079dfc
add qword [rsp + 0x10], 0xffffffffbffb103f
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x48]
ret
test dword [rsp + 0x50], 0x719b8425
setno byte [rsp + 0x50]
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x60]
ret
mov r11, qword [rsp + 0x18]
add dword [rsp + 0x10], 0xf1a6da80
jae 0x14001b5e2
jno 0x140082781

Function at 0x14005c5d3
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
jne 0x1400e43ae
sub word [rsp + 0x10], 0xd029
add qword [rsp + 0x10], 0xffffffffebbec69b
jae fcn.14009739f
call fcn.140099f44
xchg qword [rsp + 0x18], rsi
shl byte [rsp + 0x10], 0xb5
jns 0x1400640bb

Function at 0x14005ca3e
Capabilities:
Encrypt data using speck
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
cmp cl, 0x21
setne cl
and cl, cl
cmp cl, 0x9b
mov rcx, qword [rsp + rcx*2 + 0xe]
mov qword [rsp + 0x10], rax
je 0x1400621a0
jae 0x14007d6c5
je 0x14001c85f
Function at 0x14005cb27
Capabilities:
Encode data using xor

Disassembly:
mov rsi, qword [rsp + 0x40]
js 0x1400e0242
sub dword [rsp + 8], 0xc099ae8f
seta byte [rsp + 8]
sub dword [rsp + 8], 0x8c86daab
test byte [rsp + 0x10], 0x87
call fcn.14006398b
invalid
xchg qword [rsp + rbx*8 - 0x1c003fb8], rcx
mov rbx, qword [rsp + rbx - 0x38007c9]
call fcn.140094d0a

Function at 0x14005d545
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov r9, qword [rsp + 0x40]
lea rbx, [r15 + rbx*8 - 0x6bf39fe0]
add qword [rsp + r15 + 0x6cc151b2], 0xffffffffbff37524
test bx, r15w
jae 0x140068141
lea r15, [rbx*8 - 0x7457c262]
jae 0x14008377c
mov rbx, qword [rsp + r15 + 0x6cc151d2]
add r15b, byte [rsp + r15 + 0x6cc151bb]
jl 0x14008aad1
or word [rsp + r15 + 0x6cc151ef], 0x16a7
add qword [rsp + r15 + 0x6cc151ef], 0x13b61f9b
call fcn.14001c40c
mov qword [rsp + rbx*2 - 0x1e59c18], rcx
setl bl
setae byte [rsp + r15 + 0x6cc151ba]
xchg qword [rsp + rbx*2 - 0x1e59bb8], rdi
mov rcx, qword [rsp + 0x20]
jb 0x1400b8793
add qword [rsp + rbx - 0xf2cdf8], 0x4b492
sub r9, qword [rsp + r9 - 0x4549ffcd]
ja 0x1400cbd3e
test word [rsp + 0x1c], r15w
jne 0x1400117a8
call int.14007270a
setno bl
add bx, 0xb8b
push r13
movzx r10d, r10w
nop
and rbx, rbx
mov r13, rbx
movabs rdi, 0x2f14f2aee02aa39e
shl dil, 0x2e
mov rdi, qword [rsp + r10 - 0x2ad0]
mov rdi, qword [rdi]
shl r13b, 0xb6
bswap r10d
call fcn.1400641f9
lodsd eax, dword [rsi]
jbe 0x1400b87f2
invalid
xchg di, ax
mov ebp, 0x2a6d613
add byte [rdx + 0x43], dl
lodsd eax, dword [rsi]
jmp 0x1400b8864
cmc
int3
call fcn.1400e55b7
cmovg r11w, word [rsp + rbp - 0x142bffba]
call fcn.1400b45de
adc al, 0xaa
cmpsb byte [rsi], byte [rdi]
pop rbx
pushfq
invalid

Function at 0x14005d553
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, qword [rsp + 0x10]
push rdi
lea rbp, [rbp + r9*2 - 0x78748a58]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsp + 0x18]
mov rcx, rbp
lea rcx, [rcx + rbp*2 + 0x36833f04]
jbe fcn.14006aa08
jb 0x1400db61f
add qword [rsp + 0x10], 0x310b8
mov qword [rsp], r9
push r11
call fcn.1400d7446

Function at 0x14005d59e
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rsp + 0x18]
pushfq
lea rcx, [rcx + 1]
push r8
movabs r8, 0x8629ef0f3606110d
call fcn.140097187
Function at 0x14005d5b9
Capabilities:
Authenticate hmac
Execute shellcode via indirect call
Get http document via iwebbrowser2
Packed with generic packer
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
lea rsi, [rsi + 1]
xor r9d, 0x5a02daf
jg 0x1400b0428
cmovne r9w, r8w
shr r9d, 0x46
bswap r9d
or r9d, 0x3d8a75a1
jae 0x1400dd72b
pop rdi
call fcn.140083399
or al, 0xbb
cmp ebp, dword [rdi]
xor dword [rbx + 0x33d9df5c], ebx
out dx, al
xor dword [rbx + 0x57], r8d
push rdi
cmpsd dword [rsi], dword [rdi]
xor eax, dword [rsi - 0x5c5b1d7]
jle 0x1400b04bb
test byte [rbx], dl
invalid
mov ebx, 0x2544829
sahf
ror dword [rcx - 0x80], 0x3f
retf 0xc28b
add qword [rsp], 0x93db9
mov rcx, qword [rsp + 0x10]
cmp qword [rsp + 0x10], rcx
not ecx
bswap ecx
mov ecx, dword [rsp + rcx - 0x25f371ff]
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp]
mov rcx, qword [rcx]
mov qword [rsp], 0xffffffffaa25c5ae
sete byte [rsp + 0x10]
lea rcx, [rcx + 0x629ef407]
sub byte [rsp], 0xb0
not word [rsp + 0x10]
neg qword [rsp + 0x10]
add word [rsp], 0xd621
neg word [rsp + 0x10]
test qword [rsp], 0x13aec5a7
xchg qword [rsp + 0x20], rcx
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
ret
jbe fcn.14009bd99
mov qword [rsp + r9 - 0x7daefd69], rsi
mov r9d, 0x4caf0e25
js 0x1400cf45a
add qword [rsp + r8*2 - 0x10521e8], 0xfffffffffff964de
add qword [rsp + r8*4 - 0x20a4400], 0xffffffffbff2b18c
push r12
push rsp
nop
movabs rsi, 0x9c889fba38a2f401
push r13
movabs r13, 0xe3bedf24c98bdf22
test r9b, sil
push rdx
call fcn.140060de3
pop rdx
mov ah, dl
fiadd dword [rax + 0x58]
test al, 0x3c
jo 0x1400dd75e
movabs dword [0x6205b22f97e3db78], eax
invalid

Function at 0x14005f34f
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
js 0x140067912
jle fcn.1400cc4e1
call fcn.1400b2022
pop rsp
sub eax, dword [rbx - 0x39]
outsd dx, dword [rsi]
xchg edx, eax
add eax, 0xa2521e66
mov eax, dword [rax - 0x2d]
sti
imul ebx, edi, 0x46
fnstsw word [rdx + 0x47f242ce]
call 0x127153ee4
cwde
adc eax, 0x86df74a7
sahf
scasb al, byte [rdi]
mov dh, 0xf2
jg 0x14005f3a3
ret
xchg r10, rax
movabs eax, dword [0xe04a3ef15c7337a1]
xchg ecx, eax
invalid

Function at 0x14005f6bf
Capabilities:
Authenticate hmac
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
add qword [rsp + 0x48], 0xfffffffffff48d4a
push r10
mov r10, rcx
call fcn.140083db5
Function at 0x14005f6d7
Capabilities:
Encrypt data using speck
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
xor bp, bp
mov r9d, 0xf1246c2c
lea rdi, [rdi - 0x75494cc5]
mov byte [rsp + 0x10], bpl
sub bp, word [rsp + 0x11]
test qword [rsp + rbp - 0x5e0fff0], rdx
jg 0x14008a3c1
cmp r8, 0xffffffffb0a7092c
xchg qword [rsp + r8 - 0x70b896], rax
mov r8, qword [rsp + 8]
mov rdx, rdi
call fcn.14006fa6c
mov bl, bl
scasd eax, dword [rdi]
invalid
neg edx
push rdi
jle fcn.14004c04d
movsx edx, bp
xchg qword [rsp + r10*2 - 0x1e2c6], rdi
mov rdx, qword [rsp + 0x28]
or ebp, 0x5a17bc03
or ebp, dword [rsp + rbp - 0x5ff7bbe7]
ja 0x1400d401d
jno 0x14004e263

Function at 0x14005f8cd
Capabilities:
Execute shellcode via indirect call

Disassembly:
shl r13, 0xd1
jbe 0x1400e2aec

Function at 0x140060a32
Capabilities:
Authenticate hmac
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
cmp esi, 0x3517bd2c
mov rdi, qword [rsp + 0x28]
mov rdi, qword [rdi]
setne sil
neg sil
not si
and esi, 0x4892820a
lea rsi, [rsi + rsi*8 - 0x650a2f1]
jb 0x14007cd26
lea rdi, [rdi + rsi*2 + 0x6da1838b]
movsxd rsi, esi
ja 0x1400da69b
xchg qword [rsp + 0x10], rbx

Function at 0x14006219a
Capabilities:
Connect pipe
Encode data using base64
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rsp + rcx*2 + 0x7efa6610]
mov qword [rsp + 0x10], rax
seto cl
test cl, 0x9e
mov ebx, 0x2fc0929f
fdivr qword [rdx]
enter 0xffffffffffffa10f, 0xffffffffffffffc7
insd dword [rdi], dx
or al, 0xa3
out 0x7d, eax
imul edx, dword [rbx + 0x25], 0x448148a7
and al, 0x30
wait
invalid
Function at 0x1400625da
Capabilities:
Delete registry value

Disassembly:
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call fcn.140001ac4
call fcn.140001768
call entry0
or ecx, 0xffffffff
call fcn.1400017f8
jmp fcn.140002c00
add qword [rsp], 0xfffffffffffe2621
movabs r14, 0x6c9b70973907bc30
movsx r14d, sil
xor r14w, si
jge 0x1400625d1
or r15b, 0x2e
push r13
lea r15, [r12 + r15*2 + 0x212b9832]
xchg qword [rsp + r12*2 - 0x224], rax
mov r15, qword [rsp + r12*8 - 0x938]
jb 0x140094a76
not r10
shr r10d, 0xd6
cmp r12b, 0xb2
call fcn.1400e41d3
mov qword [rsp + 0x38], 0xffffffffb3220b1b
sub byte [rsp + 0x38], 0x14
xor qword [rsp + 0x38], 0xffffffffda00e50f
not byte [rsp + 0x38]
neg qword [rsp + 0x38]
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x50]
ret
test dil, 0x91
call fcn.14000aed8
xchg qword [rsp + 0x70], rdi
mov r10, qword [rsp + 0x20]
add qword [rsp + 0x10], 0xffffffffffff508e
or si, r9w
lea r9, [rdx + riz - 0x5ef795d0]
not sil
js 0x1400c69ed
add qword [rsp + 8], 0xffffffffbff4d8ed
cmp qword [rsp + 0x20], 0xfffffffff316761b
mov r10, qword [rsp + 0x10]
call fcn.1400a2e7f
or dword [rsp + 0x18], 0xee8b1e04
push rdi
mov qword [rsp + 0x20], rdi
push rbp
movabs r10, 0x1fadf485a785b5bc
movabs rdi, 0x1517952111a29422
test rdi, 0x692adb9b
mov di, 0xc090
add qword [rsp + 0x18], 0x28175
call fcn.1400118f3
movzx r14w, byte [rsp + r14 - 0x196b3ff6]
movabs rdi, 0x883829a73d9c05bf
mov r12, qword [rsp + r14 - 0x196b008c]
call fcn.1400d7908
leave
adc dword [rbx], ebp
or eax, 0x1e642b00
add byte [rdi], ah
push rsp
sbb eax, 0x1c342300
add byte [rbx], dl
add dword [rsi], edx
add byte [rax + rsi*8], cl
or ah, al
or al, dl
invalid
jns 0x14000281f
jb 0x1400dee29
cmp sil, r9b
mov rsi, qword [rsp + 0x38]
call fcn.140062a15
lea rdi, [rdi + rcx - 0x77fcd9f9]
and word [rsp + 0x18], cx
push r15
sub ecx, 0x1e8d7bab
mov r15, r10
xor cl, byte [rsp + 0x24]
xchg qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x18]
seto r15b
shl byte [rsp + 0x20], 0x7a
je 0x140083cf5

Function at 0x140064d2d
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
adc eax, 0x25effb
int3
mov qword [rsp + 8], rdi
jbe 0x1400dedf4
add qword [rsp], 0xffffffffbff97ab7
shr byte [rsp + 0x10], 0x36
jne 0x140002844
mov word [rsp + 8], 0x5a84
xchg qword [rsp + 0x28], rcx
mov rdi, qword [rsp + 0x20]
je 0x1400621d3

Function at 0x140065bc5
Capabilities:
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
jl 0x140074748
mov esi, 0xce151f9d
test rsi, rsi
mov qword [rsp + 0x48], rsi
xchg qword [rsp + 0x50], rcx
mov rsi, qword [rsp + 0x40]

Function at 0x140066b4a
Capabilities:
Packed with generic packer

Disassembly:
bswap r9d
mov rbp, qword [rsp + rsi*4 + 0x10]
mov rbp, qword [rbp + r9]
mov qword [rsp + rsi*4 + 0x10], rsi
cmp byte [rsp + r9 + 0x10], 0x3d
call fcn.140095f3d
pushfq
movabs rsi, 0xe2978c2b150c2829
shr sil, 0x28
mov qword [rsp + 0x20], rbp
movzx rsi, sil
cmp esi, 0x5b45ca2
push r9
mov r9, rsi
add qword [rsp + 0x10], 0xce1b
movabs rbp, 0x5084c2b3b83f9a8c
cmp bp, 0xa033
jle 0x1400608f3
Function at 0x1400678e1
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
sub r9b, 0x91
sub word [rsp + 0x38], r9w
mov r9, qword [rsp + 0x68]
setge byte [rsp + 0x38]
xor qword [rsp + 0x38], 0xa31c00
test byte [rsp + 0x38], 0x9b
je 0x1400a86c8

Function at 0x140067909
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + 0x30], 0xfffffffffffe302c
mov r12w, 0x85ad
movabs r8, 0xa213913a326b813
mov rdi, qword [rsp + 0x38]
mov rdi, qword [rdi]
neg r12w
not r12
jno 0x14009a16e
and cl, ch
ja 0x1400dee1f
mov qword [rsp + 0x18], rcx
mov r10, qword [rsp + 0x18]

Function at 0x1400683f7
Capabilities:
Execute shellcode via indirect call

Disassembly:
pushfq
add qword [rsp + 8], 0x455fb
movabs rax, 0xbb5829cc0000bd
lea rax, [rax + rax - 0x4df2616b]
xor al, 0x1a
bswap eax

Function at 0x140068479
Capabilities:
Execute shellcode via indirect call

Disassembly:
lea rbp, [rbp + r11 - 0x79eff8c8]
or r11, r11
or word [rsp + r11*2 + 0x10], 0xc4b2
not qword [rsp + r11 + 0x10]
or qword [rsp + r11 + 0x10], 0xcb9400c
setle byte [rsp + r11 + 0x10]
jb 0x140079e3c

Function at 0x140068ee5
Capabilities:
Enumerate process modules

Disassembly:
xor byte [rsp + 0x38], 0x85
je 0x140001563
xchg qword [rsp + 0x58], rax
mov r14, qword [rsp + 0x28]
neg esi
call fcn.1400aadc4
lea rcx, [0x140081629]
call fcn.14002f855
push rax
invalid

Function at 0x140069b8a
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
movabs rcx, 0x8d226f81ca9f6a0c
not r12w
jl 0x140088b1e

Function at 0x14006aae2
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
jno 0x140060cbd
push r8
shr rdx, 0xc7
cmp rdx, 0xffffffffb79e0e85
mov r8, rdx
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx + r15*2]
jb 0x140057390

Function at 0x14006b9fc
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
js 0x1400d6101
mov qword [rsp + rdx*8 - 0x117d0], rdx
and dl, 0xa0
jbe 0x14008fbfd
movabs rdi, 0x18a4d13bd38830ab
neg di
mov qword [rsp + 0x20], rcx
xor dil, r13b
neg r13w
jg fcn.1400cb8dc
add edi, 0xdb65710
cmp edi, 0xbdbf5320
jbe 0x14001c86d
call fcn.14005ec77
jge 0x14006ba71
pop rax
int3
xor al, 0x94
pop rdx
jg 0x14006badc
out dx, al
idiv edi
in eax, 0x3c
push rcx
pmullw mm7, mm5
adc dword [rax], ecx
add byte [rdx], bl
ret
or byte [rax], al
sbb al, dl
scasb al, byte [rdi]
invalid
or qword [rsp + rdx - 0x22f0], 0xffffffffe2109d8b
xor qword [rsp + rdx - 0x22f0], 0xffffffffe128e0a0
jbe 0x1400d57fa
not bpl
mov qword [rsp + 0x28], rax
add dx, bp
jns 0x1400d7950
Function at 0x14006ff5e
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov r8, qword [rsp + rbx*4 - 0x754070c]
neg word [rsp + rbx*2 - 0x3aa036a]
call fcn.14005910c
sub si, bp
jge 0x14007a96a
xor r11d, ebx
shr ebx, 0x23
mov qword [rsp + rbx*4 - 0x75587e4], rbx
xchg qword [rsp + 0x50], rsi
mov r11, qword [rsp + r8*2 + 0x30]
setae bl
cmp dword [rsp + rbx*2 - 0x3aac3c2], r8d
mov bx, word [rsp + r8 + 0x42]
jbe 0x1400b0742
cmovb r8w, word [rsp + r8*8 + 0x43]
jg 0x14006b954
call fcn.14008793c
jns 0x1400889c8
mov bpl, 0x95
mov rdx, rbp
add qword [rsp + 0x18], 0xfffffffffffbe085
cmp ebx, 0x8eb84b0e
movabs rcx, 0x353ca82a951095a4
jle 0x14007ad28
sub ebx, 0x22bdf5a8
movabs r15, 0xa0355f941eb8582a
lea r15, [rbp + rdx*4 + 0x4329f89e]
or rcx, r15
mov bp, r15w
mov rcx, qword [rsp + 0x18]
mov rcx, qword [rcx]
shl bp, 0x81
mov qword [rsp + 0x18], r15
ja 0x1400cf3c8
and r15b, r15b
neg rbx
lea rcx, [rcx + 0x7ea09f86]
push r10
setl bpl
push r11
sub r15d, ebx
push r12
shl qword [rsp + 0x30], 0xfb
jne 0x1400162c4
mov qword [rsp + 8], 0x56164395
not dword [rsp + 8]
and word [rsp + 8], 0xb893
mov word [rsp + 8], 0x4506
push rdi
lea rsi, [rsi + 0x19131d8d]
push rcx
jns 0x1400dcb5a
mov qword [rsp + 0x58], rbp
setb r14b
xor r8d, r14d
call fcn.1400c44cd
shl rbx, 0x14
push r15
test edi, 0xa39c740f
push rdx
mov rdi, qword [rsp + 0x28]
mov qword [rsp + 0x28], rcx
je 0x1400af43b
push rbp
mov rbp, rbx
add bpl, bpl
jno 0x1400973ae
test r15w, 0x809a
not r15w
jae 0x14008d062
and byte [rbx - 0x24], dl
invalid
call fcn.14000f277
add qword [rsp + 0x20], 0xfffffffffffe3797
xor r11d, 0x97a28233
jno 0x1400c0ec6
mov qword [rsp + 0x10], r10
cmp qword [rsp + 0x10], 0xffffffff9c3e10a2
push rbp
cmovno r9w, word [rsp + 0x1b]
jle fcn.1400dd11e
neg r10
lea rcx, [rcx + 0x4a9e0c9c]
or r9b, byte [rsp + 0x18]
shr byte [rsp + 0x18], 0x8d
call fcn.140058e0b
call fcn.140072a54

Function at 0x140070023
Capabilities:
Connect pipe
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0x327d7
call fcn.1400813a9

Function at 0x140070031
Capabilities:
Connect pipe
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov r9, qword [rsp + 0x70]
call fcn.14000f865

Function at 0x1400705d6
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
and cx, r15w
cmp r15d, dword [rsp + r14 - 0x1f89cef]
mov rcx, qword [rsp + 0x38]
jne 0x140099191
or dl, byte [rsp + 0x5c]
add qword [rsp + 0x88], 0x1553a
and qword [rsp + 0x58], rdx
jle 0x1400d9b6c
test dword [rsp + 0x58], edx
movzx r14, byte [rsp + r14 - 0x1f89cef]
mov r14, qword [rsp + 0x70]
cmovge dx, word [rsp + 0x59]