joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140070626
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
and al, 0x60
mov dword [rsp + 0x80], 0x3e945a35
not word [rsp + 0x80]
and al, 0x80
add byte [rax], al
add byte [0x1a6459a74], dh
not dword [rsp + 0x80]
call fcn.1400afad3
mov r12, qword [rsp + 0x10]
mov word [rsp + r12 - 0x7f3fefef], r12w
setb byte [rsp + r12 - 0x7f3fefcf]
call fcn.14001b358
jl 0x1400705cb
jo 0x140070651
fist dword [rbx - 0x11]
jb 0x140070610
pop rbx
add eax, 0x2bcaaa1e
add al, 0x2a
out 0x6e, al
jp 0x14007065c
push 0x3ccc04ff
xlatb
rol dword [rsi], 1
mul byte [rbx]
pop rbx
jrcxz 0x1400706b3
test byte [0x112454c71], 0x37
test al, 0xd3
add ebp, edi
jg 0x14007060c
add eax, 0x669f14c2
invalid
sbb eax, ebx
scasb al, byte [rdi]
int1
invalid
out 5, al
jno 0x140070678
add al, 0xf4
and byte [rax - 0x1e68b48], 0xe5
xchg ebp, eax
sal qword [r11 + rbx*2 + 0x7cdc6008], 0xf5
pop rsi
insd dword [rdi], dx
and eax, 0x1b8461e5
in eax, dx
add eax, 0x6f041d9c
mov bl, 0x6e
mov dword [rdx], edx
add eax, 0x707f331
sbb eax, ebx
scasb al, byte [rdi]
int1
invalid

Function at 0x14007105d
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
sets r10b
add qword [rsp], 0x3f22d
neg r10
push rdx
push r10
je 0x1400b90ff
pop rdx
push r15
movabs rax, 0x14bbcc385d907486
push rdi
mov rax, qword [rsp + 0x18]
call fcn.1400aadc9
pushfq
movabs rdx, 0x21b70ea8992d7faf
push rbp
shr edx, 0xa1
cmp rdx, 0x24b68cbf
mov rdx, qword [rsp + rdx - 0x4c96bfbf]
mov qword [rsp + 0x18], 0x2459dbd
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.1400eb236

Function at 0x140072711
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
and cl, byte [rcx - 0x36]
cmpsb byte [rsi], byte [rdi]
iretd
sub rcx, rcx
leave
ja 0x1400dab07
and cl, 0x93
jl fcn.1400dcb41
mov qword [rsp + rcx + 0x28], rcx
lea rax, [rax + rcx*8 + 0x38bf0301]
push rbx
call fcn.14000f799
cmp eax, 0x9e438584
xchg dword [rcx + 0x27597bec], ecx
push r14
jp 0x140072713
and eax, 0xb031850c
add edi, dword [rax]
sub al, dh
jl 0x1400726fc
and dword es:[rbp - 0x33], esi
invalid

Function at 0x140072b45
Capabilities:
Authenticate hmac
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
jo 0x1400c33da
add dword [rsp + 0x50], 0x589c4af
js fcn.14004e28e
shl qword [rsp + 0x50], cl
xchg qword [rsp + 0x70], rbx
mov rdi, qword [rsp + 0x30]
cmp cl, 7
not ecx
call fcn.1400681f6
push rsi
pushfq
movabs rsi, 0x8c0a5638220b3e20
and rsi, 0x701c850a
call fcn.14008ffb8

Function at 0x1400737f4
Capabilities:
Connect pipe
Encode data using base64

Disassembly:
pushfq
add qword [rsp + 8], 0xffffffffbff469b2
xchg qword [rsp + 0x10], rdi
mov qword [rsp + 8], rdi
push r14
movabs r14, 0xb99a751a84018729
sub r14w, 0xf597
test r14b, 0x90
call fcn.14001e384
mov bh, 0x8d
cmp eax, 0x6241229
cmp ecx, dword [rdi]
invalid
xchg ebx, ecx
invalid
Function at 0x14007389b
Capabilities:
Execute shellcode via indirect call

Disassembly:
pop rcx
push r10
movabs r10, 0xa79e46169315baba
pushfq
shl r10w, 0xf9
add r10d, 0xd6b192aa
or r10w, 0x4baa
xor r10, 0x350a7bb4
lea r10, [r10 + r10*4 + 0x34849caa]
or r10, 0xffffffff9006439d
xchg qword [rsp + r10 + 0x6b780033], rcx
call fcn.140063968
shr qword [rsp + 0x20], 0x52
jb 0x1400db9cb
bswap r12d
not r14b
mov r14, qword [rsp + 0x60]
call fcn.14008632b
push qword [rsp]
popfq
mov qword [rsp], rbx
call fcn.1400b3086
jge 0x1400600d4
shr r8d, 0x21
cmp r8d, 0xb735b68b
jo 0x14001a397
and r8d, r8d
call fcn.14005cace
and r15d, 0x42019214
lea rax, [rax + r15 - 0x42008203]
call fcn.1400a69b8

Function at 0x1400738ba
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov r14, qword [rsp + r14*2 + 0x8c2a]
js 0x1400837e0

Function at 0x140075cab
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
shr r10b, 0xb7
call 0x1400625da

Function at 0x140075cb4
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov rbp, qword [rsp + 0x28]
mov rbp, qword [rbp + riz]
jne 0x140058e10

Function at 0x1400765be
Capabilities:
Enumerate process modules

Disassembly:
xchg qword [rsp + rbp - 0x13e07f98], rdi
mov rbp, qword [rsp + r14 - 0x13e07ff8]
movabs r14, 0x4d35851c9906279a
shl r14w, 0x74
shl r14w, 0xcc
js 0x1400e424f
mov dword [rsp + 0x20], 0x73282e0f
not dword [rsp + 0x20]
mov r14, qword [rsp + 0x48]
and byte [rsp + 0x20], 0x39
or dword [rsp + 0x20], 0x36348429
or qword [rsp + 0x20], 0xffffffffcebb053a
and byte [rsp + 0x20], 0x3f
sets byte [rsp + 0x20]
neg qword [rsp + 0x20]
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x68]
ret
mov rax, qword [rax + rsi - 8]
lea rsi, [r14 + rbp - 0x4698aa4e]
call fcn.14007df48

Function at 0x14007ae7c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rdi
not r13b
lea r13, [r13 + r13*2 - 0x36eaabfb]
bswap r13d
js 0x140054c6b
call fcn.1400a07cb
xchg qword [rsp + 8], rbp
push r13
movabs r13, 0x4c8d86a0aba4cd12
pushfq
neg r13
push r14
mov qword [rsp + 0x18], rbp
cmp r13d, 0x4d95a300
push r10
js fcn.1400bc3a6
mov r14, r13
call fcn.1400cd427

Function at 0x14007c8ac
Capabilities:
Authenticate hmac
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
pushfq
test r13w, 0x394
xchg qword [rsp + 0x20], rcx
setb r13b
lea r13, [r13*4 + 0x1997b3bd]
push rdi
jno 0x14006ba0d

Function at 0x14007dbc6
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push r10
xchg qword [rsp + 0x10], rcx
pushfq
movabs r10, 0x7aa273154eb6c180
xor r10, r10
bswap r10d
ja fcn.14001c880
not r10b
neg r10b
mov qword [rsp + 0x10], rcx
sub r10b, 0xb7
setne r10b
jne 0x1400128c1
Function at 0x14007df48
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
movzx rbp, bpl
jne 0x140007bae
movsx rsi, r14b
lea rax, [rax + rbp + 0x61093da1]
shl si, 0x5f
add rbp, 0xffffffffb93548aa
call fcn.1400d83e0

Function at 0x14007ed61
Capabilities:
Authenticate hmac
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
jae 0x1400d4818
mov rcx, rbx
neg bl
xchg qword [rsp + rcx*2 + 0x2c927238], rsi
mov rcx, qword [rsp + rbx + 0x16493918]
and bl, 0x3d
add rbx, qword [rsp + rbx*2 + 0x2c927230]
cmovbe bx, word [rsp + rbx*2 + 0x5924e433]
neg bx
mov rbx, qword [rsp + rbx*2 + 0x5925fff2]
shl word [rsp + 0x30], 0x85
jbe 0x1400990b8
jne 0x14001c9f0
shl r11d, 9
or r11, r11
call fcn.14004b852
add eax, 0x838e360
sub al, 0xe4
invalid
call fcn.1400caf7a
mov rsi, qword [rsp + 0x48]
not word [rsp + r14 - 0x522bd189]
not byte [rsp + r14 - 0x522bd149]
setl r9b
mov rdi, r9
jne 0x14005e5cc
jl 0x140021c2f
mov rcx, qword [rcx]
js 0x140068361
push r10
lea rcx, [rcx - 0x79eff8c8]
jg 0x1400cc61d
call fcn.1400babd5
push r9
push rdi
movabs rdi, 0x1b50633cdaa2c1e
add r13b, 0xa7
shr di, 0xc
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
mov r9, r13
lea r13, [r13 + r13*4 + 0x3147fb7]
mov qword [rsp + 0x10], r9
movzx rdi, r13b
shr word [rsp + 0x30], 0x85
add qword [rsp], 0xffffffffbff6ac39
xor qword [rsp + 0x30], 0x4f87a431
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
ret

Function at 0x140082821
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
neg word [rsp + 0x10]
push r12
and dword [rsp + 0x18], 0xc1312eb9
xchg qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x38]
sub dword [rsp + 0x18], 0x9027d5b4
mov r12, qword [rsp + 0x18]
jl 0x140077497

Function at 0x140083d5e
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
movabs rsi, 0x7415fb0fb016f9b1
jae 0x14006ba32
shl sil, 0x2b
mov esi, 0x2e2dacb5
lea rcx, [rcx + rsi - 0x2e2dacb4]
jns 0x14009aa27
jbe 0x14001ebb0

Function at 0x14008651a
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
test dword [rsp + 0x28], 0x6200ac31
not byte [rsp + 0x60]
ja 0x1400b813e

Function at 0x140088b9e
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
lea rax, [rax + rbp - 0x140fd86f]
call fcn.1400972c6
jrcxz 0x140088b41

Function at 0x14008a942
Capabilities:
Connect pipe
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
movabs r13, 0x973802367cb40e94
push rdi
mov qword [rsp + r8*8 - 0x32cf69f8], rcx
call fcn.1400d51bb
Function at 0x14008e01a
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
pop rbp
call fcn.1400aae1a
mov r10, qword [rsp + 0x30]
jo 0x140095f30
mov qword [rsp + 0x28], 0xffffffffcd14a020
not dword [rsp + 0x38]
jae 0x140088b82

Function at 0x140090fa2
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov rbp, qword [rsp + 0x28]
mov rbp, qword [rbp + riz]
sub r13d, 0x78243d86
mov qword [rsp + r13*2 - 0x20e4ad00], r14
movabs rsi, 0x9a82003f13196b03
movsx r14d, r13w
setb byte [rsp + r13*2 - 0x20e4ad00]
call fcn.14008888b

Function at 0x140090fd7
Capabilities:
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
cmovg r15, r11
jl 0x1400a705d
movabs r14, 0xa114e62536a5f7b1
call fcn.140064a69
pop rcx
push rdx
push rdi
pushfq
movabs rdx, 0x4c923a37d995e78c
not edx
movabs rdi, 0x1400512ab40233a6
call fcn.1400e2879
and dil, 0x22
jbe 0x14005bb24

Function at 0x140090fe1
Capabilities:
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
xchg qword [rsp + 0x70], rdi
mov r15, qword [rsp + r14 - 0x590215dd]
jl 0x1400d1b4f
neg r9b
movabs rdx, 0x450a141d2832d7a3
neg r14b

Function at 0x140093275
Capabilities:
Authenticate hmac
Execute shellcode via indirect call
Get http document via iwebbrowser2
Packed with generic packer
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
mov rsi, qword [rsp + r9 - 0x6a5bb6f6]
add r9b, 0x18
not byte [rsp + 0x20]

Function at 0x140093ab4
Capabilities:
Authenticate hmac
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
neg r14
shr dword [rsp + r15 + 0x58], 0x3a
xor word [rsp + 0x58], 0x793e
jo 0x1400c5590
and r15b, byte [rsp + 0x59]
mov r15, qword [rsp + 0x28]
or qword [rsp + 0x18], 0xffffffff878ce33f
ja 0x14006efe0
invalid

Function at 0x140093dcd
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x28], rbx
xor dx, 0x68bc
movzx r15d, r15b
add qword [rsp + r15*4 - 0x24], 0x1d8ca
push r10
movabs r10, 0xd63d9f218ebd401a
test dx, 0xcab7
lea r15, [r15 + r10*4 - 0x14fe945b]
mov r10w, dx
nop
jns 0x140059c3a
sbb eax, dword [rcx]
sbb dword [rax], ecx
add byte [rcx], bl
or byte fs:[rax], al
sbb dword [rdi + rax], edx
sbb dword [rsi + rax], esi
add byte [rcx], bl
xor dl, byte [0x1118d0b9b]
add qword [rsp + 0x18], 0xfffffffffffbc98f
test r15d, edi
not r10b
pushfq
shr rdx, 0xf2
jne 0x14007bed5
Function at 0x140096415
Capabilities:
Connect pipe

Disassembly:
js fcn.1400b943c
mov r8, qword [rsp + rdx - 0x1dbc6a58]
js 0x1400da75d
mov r14, qword [rsp + rsi*2 - 0x7a297f88]
cmp dx, 0x6534
mov dword [rsp + 0x88], 0xe5bf8e12
jl 0x1400e7415
add qword [rsp + rsi*2 - 0x7a297fc0], 0xffffffffbff324e2
add qword [rsp + rsi - 0x3d14bfe0], 0xffffffffbff43bf1
or r9d, 0x24a5ba39
shr r9d, 0xd0
ror byte [rbx + rcx*4 - 0x7c], 1
xor al, 8
jmp 0x140096434
seta dl
and byte [rsp + rsi - 0x3d14bfc8], 0x84
sub byte [rsp + rdx - 0x1dbc69b0], 6
not qword [rsp + r9*8 - 0x5a4a0]
call fcn.14007c9e1
mov rdx, r15
movzx r15, r12b
movzx r8w, r15b
mov r15, qword [rsp + r12*8 - 0x7f7b0]
call fcn.140074927
sub qword [rsp + r9*4 + 0x2c], r9
cmp dword [rsp + r9*8 + 0x30], 0xeb1a9f2c
jg 0x14006e04b
neg r9b
mov r9, qword [rsp + r9 + 0x137]
setb byte [rsp + 0x40]
sets byte [rsp + 0x40]
jne 0x14007e8bb

Function at 0x1400970ed
Capabilities:
Connect pipe
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
sub rbx, 0x5ea22da4
movabs r8, 0xc89ee794a80ac53e
setae cl
mov rcx, qword [rsp]
mov rcx, qword [rcx]
jo 0x14008e3a6
lea rbx, [r12*2 + 0x1b6eb97]
jns 0x14001eae3
shr r10d, 0x66
sub r10, r10
mov r10, qword [rsp + r10*2 + 0x28]
test qword [rsp + 0x20], 0x4a82432
jl 0x14004b6f3
or qword [rsp + 0x20], 0xfffffffffe2726a2
xor word [rsp + 0x20], 0xcf2d
jl 0x14001285d

Function at 0x140097187
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
shl r8w, 0xa7
call fcn.140022d51

Function at 0x140097191
Capabilities:
Connect pipe
Encode data using base64
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0x6689
push qword [rsp + 8]
popfq
mov qword [rsp + 8], rbx
push r13
movabs r13, 0x3095e92bcc98f614
push 0x9308c17
not dword [rsp]
call fcn.14004dd37

Function at 0x1400971be
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
nop
jb 0x1400dc0f6
movabs rax, 0x9da6af28f5acca82
sub rdx, 0xfffffffff790be83
shl dx, 0x81
lea rax, [rax + rdx*2 + 0x32117637]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
shr dl, 0xa9
xor rdx, 0xfffffffff30cd739
jno fcn.14001d540
cmp dil, 0xb
js 0x1400990fa
xor dil, 9
push rdx
lea rax, [rax + rdi - 0x172aea1]
xor r8w, 0xca1d
jle 0x14005f6ff

Function at 0x1400990a3
Capabilities:
Authenticate hmac
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
add qword [rsp], 0xfffffffffff7c227
lea r13, [r13 + r13 - 0x65efb477]
neg r13w

Function at 0x14009912a
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
cmp r15d, dword [rsp + 0x49]
jbe 0x1400867ff
int3
jns 0x14002f6f1
Function at 0x14009913e
Capabilities:
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
add qword [rsp + 0x10], 0xffffffffbff65af6
not byte [rsp + 0x20]
and qword [rsp + 0x20], r11
jno 0x140099fb1
mov r11, qword [rsp + 0x30]
mov byte [rsp + 0x20], 0xa9
jl 0x1400c1008
js 0x14008281a
or byte [rsp + 0x20], 0xaf
add qword [rsp], 0xffffffffbff7b450
call fcn.1400dcb94
lea rdx, [rdx + 0x629ef407]
push rbx
call fcn.1400b60e7

Function at 0x140099176
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
shl dx, 0x63
mov rsi, qword [rsp + 0x20]
lea rdx, [rdx + riz - 0x3e45974c]
neg word [rsp + 0x10]
js 0x1400bddf8
mov r14, qword [rsp + r14*4 - 0x20]
shl esi, 8
not dl
and dword [rsp + 0x48], 0x18876a13
jge 0x14002020d

Function at 0x14009a4ca
Capabilities:
Authenticate hmac
Execute shellcode via indirect call
Get http document via iwebbrowser2
Packed with generic packer
Schedule task via itaskservice

Disassembly:
mov rcx, qword [rsp + 0x40]
jg 0x1400a60dc
jne 0x140086e6a

Function at 0x14009de8f
Capabilities:
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
lea rdx, [rdx + rbx + 0x78779455]
setne r10b
sete dil
call fcn.1400e0a64

Function at 0x14009dede
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov r15, qword [rsp + r15*2 - 0x79c200c8]
or qword [rsp + r15*2 - 0x79c200b8], 0x6b31b915
js 0x14001df70
not byte [rsp + r15 - 0x3ce10038]
jae 0x140063174

Function at 0x1400a074d
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add r13w, r13w
mov rbp, qword [rsp + 0x28]
shl r13b, 0xa2
call fcn.1400d8b35
ja 0x14008d09b
jg 0x1400578f0
js 0x14001c7b7
mov r11, qword [rsp + 0x28]
and byte [rsp + 0x20], 0x1c
xor dword [rsp + 0x20], 0xe88da900
js 0x1400ae5d6

Function at 0x1400a0777
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
js fcn.14001d316
add qword [rsp], 0x479e1
cmp r11w, r8w
ret
Function at 0x1400a1ef4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea r8, [r8 + r8*2 - 0xe4bb86f]
jle 0x1400b709c
push r10
pushfq
movabs r10, 0x6a94a7a93cb339ba
not r10b
mov r10, qword [rsp + 8]
mov qword [rsp + 8], 0xffffffffe5c5a1bd
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1400eb236
mov rax, qword [rsp + 8]
mov rax, qword [rax]
shl byte [rsp + 0x30], 0x2b
mov qword [rsp + 8], rdx
cmp dx, word [rsp + 0x31]
call fcn.1400bdca0
push rsi
push r15
movabs r15, 0x3d1eaa280792a3b1
call fcn.14001d595
sub r8d, 0x6fae4794
movabs rbp, 0x9f88b212f204bb86
mov rbp, qword [rsp + 0x18]
mov rbp, qword [rbp + r8 - 0x6e09ef92]
mov qword [rsp + r8 - 0x6e09ef7a], r8
shr r8b, 0x1c
xor byte [rsp + r8 - 0x6e09eee8], 0xb1
ja 0x1400dd249
push r8
lea rbp, [rbp - 0x4bfd85f7]
not byte [rsp + r8 - 0x6e09ef00]

Function at 0x1400a60e1
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov ecx, r8d
ror ah, 0x2c
cwde
mov eax, r8d
movzx edx, r14w
add r10, 0x28
inc dh
ror dh, cl
xor eax, r9d
bts r9, r8
rol eax, cl
ror cl, 0x9a
rcr cx, cl
jmp 0x1400caabd
jg 0x1400a60dc
jne 0x140020f5e
mov eax, r8d
mov ecx, r9d
shl rax, 0x20
or rax, rcx
jmp fcn.1400011a6
and r15d, 0xc088728c
test word [rsp + r15 - 0x880fd8], r15w
call fcn.1400e598e
jp 0x140086e6e
xor eax, 0x70106c21
iretd
invalid
call fcn.140059ce2
xor byte [rsp + 0x48], 0x8e
mov r13, qword [rsp + 0x68]
or r8b, byte [rsp + 0x4a]
lea r8, [r8*8 - 0x29421a70]
jl 0x1400e2ae0
jne 0x1400a608e
jns 0x1400a6168
cmp dl, dl
invalid
invalid
add eax, dword [r10 - 0x30]
xor r8d, eax
rcr dx, 0xa4
movzx r9, r9w
mov ecx, eax
cmovbe r9w, r8w
rol r8d, cl
add r8d, dword [r10 - 0x2c]
rcr dh, 0x18
test cl, 0xa7
btc rdx, r15
mov ecx, r8d
not dx
mov edx, r8d
mov r9d, 0x4527bf8e
xor edx, eax
movzx r9d, bx
xchg r9, rax
rol edx, cl
add edx, dword [r10 - 0x28]
sal cl, cl
xor r8d, edx
rcl ah, 0x20
bt r9, 6
mov ecx, edx
rol r9, cl
bswap eax
rol r8d, cl
rol r9b, cl
test edi, 0xf883bd02
add r8d, dword [r10 - 0x24]
movzx r9w, spl
mov ecx, r8d
bsr r9w, cx
mov eax, r8d
xor r9b, spl
xor eax, edx
rol r9b, 0x16
btc r9, r11
rol eax, cl
add eax, dword [r10 - 0x20]
cmp r14w, 0xf796
xor r8d, eax
cdq
btc r9d, 9
movsxd r9, r13d
mov ecx, eax
cmova r9, rdi
rol r8d, cl
xor cx, 0xe8ab
neg r9b
add r8d, dword [r10 - 0x1c]
shl edx, 0x3e
mov ecx, r8d
mov dh, 0x9e
and r9w, r8w
mov edx, r8d
xor edx, eax
rcr r9d, cl
clc
rol edx, cl
sbb cx, r14w
add edx, dword [r10 - 0x18]
stc
movsx ecx, r8w
sal r9b, 1
xor r8d, edx
movsx r9d, r10w
mov ecx, edx
bt r9w, 6
btr r9, r13
rol r8d, cl
neg r9
sar cx, 0xa4
add r8d, dword [r10 - 0x14]
xor cl, 0x13
mov ecx, r8d
mov r9d, r8d
cmc
clc
xor r9d, edx
cmc
stc
rol r9d, cl
xor ch, 0x1c
add r9d, dword [r10 - 0x10]
xor r8d, r9d
mov ecx, r9d
rol r8d, cl
test r13, 0xffffffffa8151107
cmp r12b, r9b
add r8d, dword [r10 - 0xc]
cmc
test r12b, bpl
sub r11, 1
jmp 0x140086e75
call fcn.1400cf046
sub r10, 0x7528378e
and r10w, r10w
test r10w, r10w
call fcn.1400e1e84
Function at 0x1400a6c39
Capabilities:
Authenticate hmac
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
movabs rcx, 0xc1bf9d1643b9fe2d
lea rbx, [rbx + 0x20344491]
cmovl rdi, rcx
xor dil, 0x17
mov qword [rsp + 0x48], rcx
call fcn.140072b45

Function at 0x1400a6c5c
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
movabs rbp, 0x821fc415699f42bb
ja fcn.14006b9fc
jb fcn.14007eddd
cmp r11d, 0x60310fab
ja 0x14007c87d
mov r11, qword [rsp + r11*2 + 0x50]
xor dword [rsp + 0x58], 0x21de881
add word [rsp + 0x60], 0xd99e
mov dword [rsp + 0x60], 0x20bf438
add word [rsp + 0x60], 0x5b1f
and byte [rsp + 0x58], 0x80

Function at 0x1400aa8f8
Capabilities:
Encode data using xor

Disassembly:
loopne 0x1400aa964
jo 0x1400aa925
retf
and word [rsp + 0x48], 0x7898
mov rdi, qword [rsp + 0x30]
shr word [rsp + 0x48], 0x10
neg word [rsp + 0x48]
mov byte [rsp + 0x48], 0x2d
jle 0x140084b10
xor al, 0x87
xchg byte [rdx - 0x22f39b9f], bpl
stosd dword [rdi], eax
cwde
jl 0x1400aa8eb
and dword [rsi + 0x21a17d61], edi
test al, 3
std
stosb byte [rdi], al
pushfq
and byte [rax], dl
test eax, 0x891dfbab
push 0xfffffffff0f090fb
xor al, 0xad
invalid
add ecx, edi
invalid

Function at 0x1400aad53
Capabilities:
Authenticate hmac
Encrypt data using speck
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + 0x48], 0x8681
mov qword [rsp + 0x28], 0x73b1a33b

Function at 0x1400aaf17
Capabilities:
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov rbp, qword [rsp + 0x28]
call fcn.1400d9e0e
push rdi
push 0xffffffffd9b3b219
pushfq

Function at 0x1400adb5b
Capabilities:
Connect pipe
Encode data using base64
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
call fcn.14000727e
pop rax
push rdx
pushfq
movabs rdx, 0x3204fd3ef1095da8
add dx, 0x2c81
jl 0x14004ce4c
lea rdx, [rdx + riz - 0x206cf6d1]

Function at 0x1400ae75f
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
xchg qword [rsp + 0x28], rax
movabs r11, 0xfe30e50151905282
shl r11, 0x28
mov r8, r11
push rsi
xor r8b, r8b
call fcn.1400cef98

Function at 0x1400ae7af
Capabilities:
Enumerate process modules
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
test cx, 0x54a9
mov qword [rsp + 0x20], r9
lea rbx, [rbx - 0x427d8a68]
jns 0x140083872

Function at 0x1400ae7c6
Capabilities:
Enumerate process modules
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
js 0x140054ce1
call fcn.1400ac808

Function at 0x1400b0730
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add dil, dil
xchg qword [rsp + 0x20], rcx
movabs rbx, 0xff9c3f9e0c269b18