joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d3fd3
Capabilities:
Connect pipe
Encode data using xor
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
and bpl, 0x30
and r10w, di
add qword [rsp + 0x10], 0xffffffffbffac98f
lea rdi, [rbp + rbp - 0x41e71a48]
mov rdi, qword [rsp + 0x20]
call fcn.1400a4d54
sub ebp, dword [rsp + rdi + 0x70123470]
mov edi, dword [rbp + 0x35]
jle 0x140063613
xchg rsi, rax
sbb ah, bl
fmul dword [rbx + 0x4ec773e3]
in eax, 0x86
invalid
mov byte [rcx - 0x3dc8fd77], al
pop rdi
push 0x60650333
sbb eax, 0x7ca0b6a1
test byte fs:[rdx - 0x61], al
jb 0x140063618
ret 0x685f
invalid
movzx r10w, r10b
xchg qword [rsp + 0x60], rax
mov rsi, qword [rsp + rsi*2 - 0x5dc15f14]
jge 0x14001e420
mov r14, qword [rsp + r14 - 0x679250f8]
and qword [rsp + 0x10], 0x148927a0
xor word [rsp + 0x10], 0x9fb4
or byte [rsp + 0x10], 0xbc
add qword [rsp + 0x10], 0x3aa456b5
shl word [rsp + 0x10], 0xf8
jns 0x1400635d4

Function at 0x1400d4907
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
or sil, r8b
jle 0x1400c5587

Function at 0x1400d4f0f
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
or byte [rsp + r9 - 0x605b50bb], r9b
or r9d, dword [rsp + r9 - 0x605b50b9]
push rsi
mov rsi, qword [rsp + r9 - 0x605b70b3]
push rdx
js 0x14006205f
push r9
lea rax, [rax + rsi - 0x62aafcbc]
cmp rsi, r9
movzx rsi, word [rsp + r9 - 0x605b70a3]
push r14
mov r14, rsi
movzx r9d, sil
xchg qword [rsp + r9*2 - 0x15e], rax
mov r9, qword [rsp + r14 - 0x5093]
movabs rdx, 0x287f095d69c6985
js 0x14006f0a7
or qword [rsp + 0x90], r9
jae 0x140078c43
stosb byte [rdi], al
jae 0x14009fb29
invalid
mov r11, qword [rsp + 0x90]
mov r11, qword [rsp + r11*2 + 0x50]
jno 0x14009fb88

Function at 0x1400d4f25
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
lea rdi, [rdi + 1]
movabs rbp, 0x108c9607f43284b9
push rdx
push r13
push rcx
setbe bpl
je fcn.14005a85d
neg ebp
mov qword [rsp + rbp - 0xbcd7bb8], rdi
cmp qword [rsp + rbp*2 - 0x179af7e0], 0x46154e24
jle 0x1400b4bb4
call fcn.1400d5a61
add qword [rsp + 0x38], 0xffffffffbff79801
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x68]
ret 8
jns 0x14008a864
and word [rsp + 0x28], cx
mov qword [rsp + 0x20], r9
xor qword [rsp + 0x28], r9
lea r9, [r9 + riz - 0x6b5fd65b]
lea rdi, [rdi - 0xd9cbdd]
test qword [rsp + 0x10], 0xffffffffcb358ebc
mov byte [rsp + 0x28], 0xbc
xchg qword [rsp + 0x48], rdi
mov r9, qword [rsp + 0x40]
setg bpl
setns bpl
movabs r11, 0xdf1848255018a407
jl fcn.1400a2e7f
sub qword [rsp + 0x10], 0xffffffff9c0857ae
mov rbp, qword [rsp + 0x18]
shl byte [rsp + 0x10], cl
call fcn.1400bdd16
js 0x1400b9355
add qword [rsp + r8*2 + 0x28], 0xffffffffbfff663e
sub word [rsp + r8 + 0x48], 0x28a2
movzx r8w, r8b
xchg qword [rsp + r8*8 + 0x60], rsi
mov r8, qword [rsp + r8 + 0x38]
add word [rsp + 0x48], 0x7f8b
call fcn.140082488
Function at 0x1400d506c
Capabilities:
Authenticate hmac

Disassembly:
movsx ebp, word [rsp + rbp*2 - 0x1541d]
sub dword [rsp + rbx - 0x708a18c1], 0xed3799b2
shl qword [rsp + rbp*2 + 0x70], 0xfa
mov rbp, qword [rsp + rbx - 0x708a1871]
bswap rbx
xor byte [rsp + 0x10], 0x1e
jg 0x14007ea22
call fcn.14007656f
shl qword [rsp + 0x10], 0xec
sets sil
mov qword [rsp + 0x30], rdx
not qword [rsp + 0x10]
setae byte [rsp + 0x10]
jbe 0x140088a47
ficom word [rdi - 0x34]
mov esp, 0x3145ef36
pop rbp
in al, 0xee
and edx, dword [rbx - 0x11127814]
sub al, bl
push rdi
invalid
call fcn.14007e63e
mov r11b, 0x23
shr rsi, 7
lea rsi, [rsi + r11*4 + 0x7f8d8e2a]
sub r11, 0x16941a3a
push rbp
add qword [rsp + r11 + 0x16941a27], 0xffffffffbff4ab3b
mov rsi, qword [rsp + r11*2 + 0x2d283436]
mov rsi, qword [rsi + r11 + 0x16941a17]
mov rbp, r11
and bpl, 0x3f
test r11d, 0xf1a9ca0d
js 0x14006d463
setns sil
shl si, 0x1f
add qword [rsp], 0x497dd
mov rdx, rsi
push rdx
push r15
add qword [rsp + 0x18], 0xffffffffbff96fe1
not esi
call fcn.1400be5ea
or byte [rsp + rbp - 0x550c], r12b
xchg qword [rsp + r12*2 + 0x20088], rcx
mov r12, qword [rsp + rbp - 0x54f4]
lea r11, [rbx + r11*2 + 0x29919218]
movabs rdi, 0x5280d0afed014833
pop rdi
shl rbp, 0x81
test byte [rsp + rbp - 0xa9d8], 0x38
mov r11, qword [rsp + rbx - 0x708a1891]
jns 0x14001ebd7
je 0x1400aad7f
mov qword [rsp + 0x20], rbx
call fcn.1400dc887

Function at 0x1400d6033
Capabilities:
Encrypt data using speck
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add ebp, 0xab860020
call fcn.1400ac8cf

Function at 0x1400d60d3
Capabilities:
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
add byte [rbx + rcx*4 - 0x13], cl
push r14
neg r13d
mov rbp, qword [rsp + r13 + 0x18]
mov qword [rsp + 0x18], rdx
xor r13w, 0x8124
push r13
mov r14, qword [rsp + r13 - 0x8124]
push r9
call fcn.1400a0bcb
pushfq
push rcx
movabs rcx, 0xfe06cc291017a539
pushfq
or ecx, 0xaa243425
call int.1400c005d
movabs byte [0xbfd2fc52ee6b982], al
movabs eax, dword [0x755b60fdbd3d7eeb]
xor ecx, ecx
pop rbx
add edx, ebx
and ebx, ebx
and dh, cl
ja 0x140007578
leave
mul dword ds:[rcx + 0x5e]
test byte [rbx - 0x72b72ef8], ch
jg 0x1400075ed
call fcn.140062602
adc dword [rax + 0x74ff0005], esi
and al, 8
popfq
lea rsp, [rsp + 0x28]
call fcn.1400eb236
xchg qword [rsp + 0x28], rax
pushfq
add qword [rsp + 0x10], 0xffffffffffffffe7
movabs rbp, 0x3db26687ec8ea89a
shl rdx, 0x8d
je 0x14000759e
neg edx
setbe bpl
movsx bp, bpl

Function at 0x1400d73e6
Capabilities:
Authenticate hmac
Connect pipe
Encode data using base64
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
jge 0x1400d1b8b
pop rax
push r12
movabs r12, 0xbc1bfa01b184b226
pushfq
shl r12d, 0x90
lea r12, [r12*4 - 0x6cc5fcc9]
xchg qword [rsp + 0x10], rax
cmp r12, 0x1403ad97
jo 0x1400e7346
and r12d, r12d
and r12b, 0x83
jno 0x140092ddc
Function at 0x1400d741f
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
not word [rsp + r11*8 + 0x58]
add qword [rsp + r11 + 0x10], 0xffffffffbff327f4
test qword [rsp + 0x50], r11
mov rcx, qword [rsp + r11*2 + 0x30]
call fcn.1400a6c5c

Function at 0x1400d7446
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
xor word [rsp + 0x10], 0xc832
shl byte [rsp + 0x10], 0x9e
mov word [rsp + 0x10], 0x2fa7
not byte [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
mov rdi, qword [rdi]
jns 0x1400b934e
invalid

Function at 0x1400d782b
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
mov r9, qword [rsp + 0x78]
xor dword [rsp + 0x58], 0xd41e18b1
or dword [rsp + 0x58], 0x46234917
call fcn.14000965c

Function at 0x1400d789b
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
cmp r13w, r11w
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rcx]
mov qword [rsp + 0x10], r13
push rcx
movzx r11w, byte [rsp + 0x19]
push 0xffffffffc4119e1e
setge bpl
lea rcx, [rcx - 0x67c37dcb]
call fcn.1400bfd18

Function at 0x1400d9acf
Capabilities:
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
movzx r10d, al
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + r10*4]
mov qword [rsp + r10*2 + 0x20], r10
push rcx
movabs rcx, 0x6b3eaa0e433c6932
push rsi
lea rax, [rax - 0xd9cbdd]
movabs rsi, 0x328af6038f825e9f
push r11
push rbx
push r14
xchg qword [rsp + 0x50], rax
mov r10, qword [rsp + r10*2 + 0x40]
call fcn.1400aa182

Function at 0x1400d9b85
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
jno 0x14005d768
jae 0x140008045
lea rbp, [rbp + r13 - 0x1b4cd05d]
call fcn.1400ae99f

Function at 0x1400d9e0e
Capabilities:
Delete registry value

Disassembly:
xchg qword [rsp + 0x50], rcx
mov r9, qword [rsp + 0x28]
js 0x14000281f
neg r10d
neg ebp
and rbp, 0xffffffffad07b784
mov rbp, qword [rsp + r10 - 0x6f392a04]
add qword [rsp + r10 - 0x6f392a14], 0xffffffffbffa71f0
call fcn.140050613

Function at 0x1400d9f19
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Extract resource via kernel32 functions
Inject thread
Resolve function by parsing pe exports
Set registry value
Spawn thread to rwx shellcode

Disassembly:
mov r12, qword [rsp + 0x50]
sub qword [rsp + 0x38], 0x298e0631
call fcn.14001bb33
Function at 0x1400da705
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
ret
movabs rdx, 0x6ba81ca9b1a8ae2b
cmp rdx, 0xffffffff862a34aa
lea rbx, [rbx + 1]
lea rdx, [rbp*8 - 0x3d4c4dc4]
jns 0x1400705b4
mov qword [rsp + 0x38], rbx
push rdi
jo fcn.1400783c7
test ebp, edx
je 0x140009cfa
shr dl, 0x94
test bp, 0x8585
jbe 0x1400747b2
jge 0x14009cf6d
add qword [rsp + 0x10], 0xfffffffffffdddfe
movabs rdi, 0xb3ad5d2ffe11d421
push rsi
push r12
push rdi
bswap ebp
mov r12, qword [rsp]
and rdx, 0x531c6dba
js fcn.14008e664
mov rbx, qword [rsp + 0x28]
mov rbx, qword [rbx]
not bp
movabs rsi, 0x77362cbd35b0302f
call fcn.1400c869c
xor bpl, bpl
xchg qword [rsp + rbp*2 - 0x4e39ffe8], rax
lea rbp, [rbp + rbp*2 - 0x2fe958e5]
shr bp, 0x81
mov rbx, qword [rsp + 0x30]
push rdx
movsx bp, bpl
jno 0x140053075
Function at 0x1400da71b
Capabilities:
Connect pipe
Create thread
Set registry value

Disassembly:
adc eax, 0x25f2e0
mov qword [0x140005008], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.1400017f8
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREdialerconfig
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000260d
lea r9, [rbp + 0xb0]
mov qword [rbp + 0xc8], rdi
lea r8, [rbp + 0xc8]
mov dword [rbp + 0xb0], edi
lea edx, [rax + 1]
lea rcx, str.D:_A_OICI_GA___AU__A_OICI_GA___BA_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov ebx, 4
test eax, eax
je 0x140002587
mov r8, qword [rbp + 0xc8]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rdi
lea rdx, [0x140003330]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140002602
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x58]
lea rdx, [0x140003530]
mov dword [rbp + 0xb8], eax
mov r9d, ebx
lea rax, [rbp + 0xb8]
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x28], rdi
lea r9, [0x1400026ac]
lea r8, [0x140002d84]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rcx, [0x1400026c8]
mov qword [rsp + 0x28], rdi
mov ebx, 0x64
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140002cc0]
mov qword [rax + 8], rcx
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, [0x1400026e8]
mov qword [rsp + 0x28], rdi
lea r8, [0x14000228c]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002693
call 0x140081605
jo 0x1400024d7
neg dword [rsp + r10 - 0x6601e197]
cmp byte [rsp + 0x10], 0xbc
xchg qword [rsp + 0x40], rdi
mov r14, qword [rsp + 0x28]
jge 0x1400b39ea

Function at 0x1400da73e
Capabilities:
Connect pipe

Disassembly:
call fcn.140053098
movabs r15, 0xd00aa68fe9b56b87
jno 0x1400b304e

Function at 0x1400da74e
Capabilities:
Connect pipe

Disassembly:
mov dword [rsp + 0x28], r12d
movabs r8, 0xf87f7355038aea5
Function at 0x1400dcb99
Capabilities:
Execute shellcode via indirect call

Disassembly:
add qword [rsp], 0xb8ed
mov rbx, r8
cmp bx, r8w
not r8
push rdi
push rcx
mov rbx, qword [rsp + 0x10]
mov rbx, qword [rbx]
jb fcn.14007389b
mov qword [rsp + 0x10], r8
call fcn.14005b251
pushfq
cmpsd dword [rsi], dword [rdi]
mov eax, 0x2518c8e4
bnd jmp 0x1a8eb256d

Function at 0x1400dd490
Capabilities:
Connect pipe
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + rbp - 0xbf47], 0x30
jl 0x14007844e
jns 0x140060c7e

Function at 0x1400dee5e
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
setns r15b
push r10
jge 0x140069bf2
call fcn.140090380
sub dword [rcx], eax
or al, byte [rax + rax]
or dh, byte [rdi + rax]
add byte [rdx], cl
xor al, byte [rsi]
invalid
cmp sil, 0xaf
movabs rsi, 0x9217d51118065b1c
mov rsi, qword [rsp + 0x10]
js 0x140079dce
jle fcn.14005ca3e
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x60]
ret

Function at 0x1400df162
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push rbp
movabs r9, 0x77aec2a27fb70eb2
xor r9b, 0x22
jo 0x14001c86c
test r9w, di
lea rcx, [rcx + 0x61093da9]
call fcn.14006f024
stosd dword [rdi], eax
mov esp, 0xc260136
xchg dword ds:[rsi - 0x18], ebx
fdiv st(5), st(0)
invalid

Function at 0x1400e09ee
Capabilities:
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
movabs rcx, 0x372599300823af85
jne 0x1400d6043
add qword [rsp + rbp - 0x2890], 0xffffffffbffa7f82
sub bp, word [rsp + rbp*4 - 0xa1db]
mov rbp, qword [rsp + rbp*4 - 0x21138]
mov dword [rsp + 0x60], 0xb38b34b5
add qword [rsp + 0x58], 0xfffffffffffe3f4e
lea rsp, [rsp + 0x58]
ret 0x10

Function at 0x1400e153c
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
movabs r12, 0xdd30dfb71eb45990
not r12w
pushfq
shr r12, 0x27
push r9
push rdi
add qword [rsp + 0x18], 0x1a56
movabs r9, 0x8424fc837d940319
not r12
shr r9b, 0x73
mov rdi, r9
sets r9b
mov rdx, qword [rsp + 0x18]
mov rdx, qword [rdx]
or r9b, 0x9d
add di, 0xf335
movzx r9d, r12b

Function at 0x1400e281b
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
and r15b, byte [rsp + r15 + 0x33]
jle 0x1400c05d7
retf 0x3ddd
setg dil
xchg qword [rsp + r15*8 + 0x60], rbp
mov rcx, qword [rsp + rcx*2 + 0x20]
cmovb r15, rdi
lea rdi, [rdi + r15 + 0x7a338a9d]
and dword [rsp + r15 + 0x30], 0x8e16fb1b
call fcn.1400121c0
lea rbp, [rbp + 0x7ea09f86]
jae 0x1400932f8

Function at 0x1400e2e59
Capabilities:
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
or sil, 1
xor r9d, edi
not r9w
add qword [rsp], 0x4e5db
mov edi, 0x871345ad
movabs rax, 0xfb0c80a0fbac3d18
call fcn.1400c8740
jg 0x140008416
Function at 0x1400e3176
Capabilities:
Delete registry value
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add rdx, 0xfffffffff33bbb0d
js 0x1400740b5

Function at 0x1400e4264
Capabilities:
Enumerate process modules

Disassembly:
pushfq
movabs r9, 0x1c8201b87b31f130
push rdi
mov rdi, r9
movsx r9d, di
bswap r9d
xchg qword [rsp + 0x20], rcx
not r9
call fcn.14001c8d1

Function at 0x1400e4371
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push r11
movabs r11, 0x5eb2ad267b09f115
lea rbp, [rbp + 1]
pushfq
shr r11w, 0x65
ja 0x1400e4356
jne 0x1400e2aa2
call fcn.140068316
xor r11w, 0x7d2c
shl r11b, 0xa2
shl r11d, 0x32
shl r11, 0xa4
mov qword [rsp + 0x30], rbp
call fcn.1400b2ea7
lea r9, [r9 + r9 - 0x41728cf8]
call fcn.140070031
nop
add al, 0x36
nop
sub byte [rdi - 0x45], dl
adc eax, 0xe156e855
std
dec dword [rcx - 9]
invalid
invalid
invalid

Function at 0x1400e5746
Capabilities:
Encode data using xor

Disassembly:
and word [rsp + 0x28], 0x1335
jbe 0x14004c30d
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x60]
ret

Function at 0x1400e59b5
Capabilities:
Execute shellcode via indirect call

Disassembly:
and word [rsp + 0x50], 0xbf0a
add qword [rsp + 8], 0xffffffffbff76e1a
neg dword [rsp + 0x48]
add qword [rsp + 0x20], 0xffffffffbff46c40
test word [rsp + 0x38], 0x6b2b
call fcn.1400db9df

Function at 0x1400e5f89
Capabilities:
Create thread
Set registry value

Disassembly:
jge 0x140002574
mov r15, qword [rsp + r15*4 - 0x5ffe1054]
mov qword [rsp + 0x20], rbx
movabs rdi, 0x5e0a5186fda69f94
call fcn.1400bfe14
invalid

Function at 0x1400e61ce
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
pushfq
movabs r8, 0xc3869f31d39d7097
push r11
not r8w
mov rsi, qword [rsp + 0x28]
mov r11, r8
shl r8w, 0xd8
shr r11, 0x43
jb 0x1400c7bb0

Function at 0x1400e715d
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
call fcn.1400091f0
sahf
mov eax, 0xc0000005
jmp 0x140009dd0
push r10
seta sil
je 0x140009b14
lea rdx, [rdx + 0x64085b1e]
jb 0x14001bc5e
not byte [rsp]
shr sil, 0xd8
add qword [rsp + 8], 0xffffffffbffad437
sub r10w, r10w
xchg qword [rsp + 0x30], rdx
mov rsi, qword [rsp + 0x10]
xor word [rsp], 0x2aa
shl word [rsp + 0x18], 0xf1
and dword [rsp], 0xa9038532
cmovge r10w, word [rsp + 4]
jo 0x14000725b
mov r10, qword [rsp + 0x28]
shl qword [rsp + 0x18], 0x28
or dword [rsp + 0x18], 0x98090c2d
call fcn.14005ea0a

Function at 0x1400e71ff
Capabilities:
Allocate or change rwx memory
Encode data using xor
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov rdi, qword [rsp + 8]
mov rdi, qword [rdi]
neg r14
mov r14d, 0x21ac7f09
call fcn.1400102ed
mov r15, qword [rsp + r15 + 0x6cc15153]
jl 0x14006efcf
Function at 0x140254b9e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
sub edi, edi
movzx ebx, r8b
mov r11, rcx
jmp 0x140254bbd
mov r8, rdi
movsx r10d, r10w
movzx r9w, spl
nop
movsx r9w, r14b
jmp 0x140254bd7
movzx r9d, byte [r11]
not r10w
setl r10b
movzx r10d, byte [rdx]
inc r11
jmp 0x140254bef
inc rdx
stc
cmp r8, r14
cmp r14b, 0xac
test bl, bl
jmp 0x140254c01
je 0x140254c25
mov ecx, r8d
mov eax, 0x3b823839
cmc
stc
rol eax, cl
stc
test r14b, bpl
add al, r8b
xor r9b, al
jmp 0x140254c22
inc r8
test r9b, r9b
jmp 0x140254c2d
je 0x140254c41
cmp r9b, r10b
jmp 0x140254c3b
je 0x140254bd7
cmp r9b, r10b
jae 0x140254c61
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
seto dil
mov rdi, qword [rsp + 0x10]
jmp 0x140254c60
ret
mov rbx, qword [rsp + 8]
seta dil
bswap eax
xchg al, ah
cwde
mov eax, edi
not dil
mov rdi, qword [rsp + 0x10]
jmp 0x140254c7e
ret
Function at 0x140033160
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140033180
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x1400331c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400331e0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x140033220
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140033243
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x1400332a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400332c3
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x140033320
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140033349
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret