joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002078
Capabilities:
Read file via mapping

Disassembly:
test rcx, rcx
je 0x14000228a
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rbx, rcx
lea rdx, [0x140003470]
lea rcx, [rsp + 0x60]
xor r13d, r13d
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, rbx
lea rcx, [rsp + 0x60]

Function at 0x140002328
Capabilities:
Acquire debug privileges
Extract resource via kernel32 functions
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x90]
sub rsp, 0x190
lea rcx, str.ntdll.dll
call fcn.140002078
mov edx, 0x11c
lea rax, [rsp + 0x70]
mov ecx, edx
mov qword [rbp + 0xc0], rax
xor edi, edi
mov rax, qword [rbp + 0xc0]
mov byte [rax], dil
mov rax, qword [rbp + 0xc0]
inc rax
mov qword [rbp + 0xc0], rax
sub rcx, 1
jne 0x14000235c
mov dword [rsp + 0x70], edx
mov r8b, 3
lea edx, [rcx + 2]
mov qword [rsp + 0x74], 0xa
mov word [rbp + 0x84], di
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov edx, 0x23
lea rcx, [rsp + 0x70]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea rcx, str.kernel32.dll
call fcn.140002078
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140002486
lea r8, [rbp + 0xc8]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000247d
lea r8, [rbp + 0xb0]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14000247d
mov rax, qword [rbp + 0xb0]
lea r8, [rsp + 0x60]
mov rcx, qword [rbp + 0xc8]
mov r9d, 0x10
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x64], rax
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x6c], 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14000247d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx

Function at 0x140002c18
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 8], ecx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
lea rcx, str..pipedialercontrol_redirect64
and dword [rax - 0x20], 0
mov edi, r8d
mov rsi, rdx
mov dword [rax - 0x28], 3
xor r8d, r8d
mov edx, 0xc0000000
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002cad
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
je 0x140002ca4
test edi, edi
je 0x140002ca4
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]

Function at 0x1400071a0
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
push rdi
push r10
pushfq
movabs r10, 0xca380608af31ba3d
bswap r10
Function at 0x140007585
Capabilities:
Terminate process

Disassembly:
movzx di, dil
cmp rdi, 0xffffffffe1b49511
call fcn.140084e14

Function at 0x1400075f7
Capabilities:
Terminate process

Disassembly:
push rdi
movzx r9d, dil
setbe r9b
lea rsi, [rsi + 0x119ac3a5]
jle fcn.1400cba79
bswap rdi
call fcn.1400c6325

Function at 0x14000a0b7
Capabilities:
Terminate process

Disassembly:
test rcx, rcx
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
movabs r8, 0xe32d0b375d3d3127
bswap r10d
mov r10w, 0xf482
not r8b
setg bl
mov r8d, 0x323a5a34
lea rcx, [rcx + r8 - 0x148bef86]
or ebx, 0x7e0eaebb
mov qword [rsp + r10*2 - 0x5f4be8c4], r10
neg r8d
add qword [rsp + 0x20], 0xffffffffbffb54bc
sub word [rsp + r10*2 - 0x5f4be8c4], r8w
xchg qword [rsp + r10 - 0x2fa5f432], rcx
mov r8, qword [rsp + r10*2 - 0x5f4be8fc]
xor r10, r10
xor ebx, dword [rsp + 0x42]
add qword [rsp + r10*8], 0xffffffffbff96eed
xor r10, qword [rsp + r10 + 0x40]
jl 0x1400a1df5
js 0x14004f683
mov r10, qword [rsp + r10 - 0x2fa54e86]
neg bl
cmp word [rsp + 0x40], 0xc0bf
jg 0x1400dd76f
mov rdi, qword [rsp + 0x18]
mov rdi, qword [rdi]
mov qword [rsp + 0x18], r10
movsx rsi, word [rsp + 0x18]
push r8
mov r10, rsi
mov r8, r10
lea rdi, [rdi + r10 + 0x5cad4cb5]
bswap r10
xor r8b, byte [rsp + 0x20]
not word [rsp + 8]
jae 0x14001b72f
add qword [rsp], 0xfffffffffffe189c
movzx r15, byte [rsp + 0x20]
mov rdi, qword [rsp + 0x10]
mov rdi, qword [rdi]
neg qword [rsp + 0x20]
jo fcn.1400d9c9f
movsx r15w, cl
xor r12b, byte [rsp + 0x20]
mov qword [rsp + 0x10], rcx
neg r12d
setno r12b
lea rdi, [rdi - 0x8ce454c]
xor word [rsp + 0x10], 0x7317
call fcn.140099ec1

Function at 0x14000b04e
Capabilities:
Terminate process

Disassembly:
or esi, dword [rsp + rcx - 0xbffffdd]
jge 0x140007ad3
in al, dx
xor al, 0x60
int3
Function at 0x14000d2c5
Capabilities:
Terminate process

Disassembly:
push r10
movabs r10, 0x98ad96c093c994
lea r10, [r10*2 - 0x5d8cccc]
push r10
mov rax, qword [rsp + 0x20]
push 0x7701dcb8
pushfq
xor byte [rsp + 8], 0x37
jge 0x14008b574
push rdi
lea rsp, [rsp + 0x48]
ret 8
Function at 0x14000f7f5
Capabilities:
Encode data using base64

Disassembly:
sub r9b, 0x1f
not sil
mov rsi, qword [rsp + 0x10]
mov rsi, qword [rsi + rcx*4 - 0x37a6800]
shl rcx, 0x4a
mov qword [rsp + r9 - 0xde9ad1], r9
lea rcx, [r9 + rcx - 0x4ccc5777]
sub word [rsp + 0x10], 0x9b5
lea rcx, [r9 + r9 + 0x43bb991f]
lea rsi, [rsi + rcx + 0xb442ca2]
xor dword [rsp + rcx - 0x4578ced1], ecx
jns 0x1400967e5

Function at 0x140010c39
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 0x10], 0xffffffffd7aa33a8
neg qword [rsp + 0x10]
call fcn.14008ff94

Function at 0x140010c4c
Capabilities:
Create pipe

Disassembly:
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x140001d9c
lea edx, [rax + 0x28]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140001d9c
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x140001d9c
mov r8, qword [rbp - 9]
xor r9d, r9d
mov rcx, rbx
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x140001d9c
lea rax, [rbp - 1]
mov dword [rbp - 1], 0x18
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov eax, 0x400
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
mov r9d, 0xff
mov rcx, rdi
mov dword [rsp + 0x20], eax
lea edx, [r8 + 3]
mov qword [rbp + 7], rbx
mov dword [rbp + 0xf], esi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
jmp 0x140001da0
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
mov rdx, qword [rsp + 0x18]
mov rdx, qword [rdx]
js 0x140001d14
mov qword [rsp + 0x18], r15
mov r12d, 0x5c219c1f
call fcn.140052029

Function at 0x14001154e
Capabilities:
Enumerate process modules

Disassembly:
mov edx, 0x4f99978b
jbe 0x1400a5a8d

Function at 0x14001157e
Capabilities:
Enumerate process modules

Disassembly:
add qword [rsp], 0xfffffffffffb0df4
add r13b, 0xab
mov r13w, dx
js 0x140052386
mov rdx, rdi
mov rcx, rbp
call fcn.14002b8ec
mov rbx, rax
test rax, rax
jne 0x140027caf
test rdi, rdi
je 0x140027caf
cmp dword [0x14003e9a4], eax
jbe 0x140027caf
mov ecx, esi
call fcn.1400d2c82
sub eax, 0xe89e8d44
add eax, dword [rax]
add byte [rbx + rdi + 0x1d], al
add dword [rbp + 1], ebp
add byte [rcx - 0x75], al
cmova esi, r12d
cmp esi, r12d
jne 0x140027c6d
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
movabs rsi, 0xce1a8e1658ad03a9
jbe 0x140027c8f
bswap r13d
test r13b, dl
call fcn.1400e155e
or cx, word [rsp + 0x49]
shr rcx, 0x4e
mov rbx, r11
jae 0x14006a0a0
and ebx, dword [rsp + 0x4c]
test ecx, r11d
mov rcx, qword [rsp + 0x40]
ja 0x14008ceef
jne 0x1400a3c7e
Function at 0x140011595
Capabilities:
Enumerate process modules

Disassembly:
jl 0x1400c4c3e
je 0x1400ce08b
jge 0x140057aca
shl r10, 0xd6
not r10
or r10d, r15d
mov r10, qword [rsp + 0x18]
ja 0x140008235
ret
ret
ja 0x14007b0e7
push r8
lea rsi, [rsi + 1]
js 0x1400a5697
lea r8, [rdi*4 + 0x1037da19]
push r9
push rdx
push r8
jo 0x14007e1dd
shl qword [rsp + rbx - 0x5380fd13], 0x79
mov qword [rsp + rbx - 0x5380fcc3], rsi
mov r9, qword [rsp + 0x18]
push r13
mov rdx, r9
call fcn.140081e3f
lea rbx, [rbx + 0x6cbabb23]
lea rbp, [rdx*2 - 0x60661ad2]
and dl, 0x24
or bpl, dl
push r15
xchg qword [rsp + rdx + 0x70], rbx
mov rbp, qword [rsp + rbp + 0x60661b3a]
add qword [rsp + rdx + 8], 0xffffffffbfff31a2
mov r15, qword [rsp + rdx*4 + 0x60]
call fcn.1400d9419
test byte [rsp + r14*4 + 0x11157653], bl
call fcn.14004d9e3
jmp 0x172d5e29c

Function at 0x140011c50
Capabilities:
Enumerate process modules

Disassembly:
lea r12, [r12*4 + 0x6fb856a3]
test word [rsp + 0x38], 0xfc98

Function at 0x14001254c
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
xor rdi, qword [rsp + 8]
mov qword [rsp + rdi + 0x6cf34445], rdi
lea rbx, [rbx - 0x464363c1]
movabs r13, 0xeb20079b798ce70c
jb fcn.1400a6443
call fcn.1400ae3ce

Function at 0x140014e96
Capabilities:
Encode data using base64

Disassembly:
test rbx, 0xffffffffd03a5788
not ebx
mov qword [rsp + 0x38], rsi
xchg qword [rsp + r8 - 0x42430e54], rax
mov r8, qword [rsp + r8 - 0x42430e84]
not byte [rsp + 0x38]
lea rsi, [rsi*4 + 0xf14648b]
mov si, word [rsp + 0x3b]
mov rsi, qword [rsp + 0x18]
mov bl, byte [rsp + 0x38]
jg 0x14001fec2
jo fcn.1400d0087
js 0x1400d5730

Function at 0x14001936f
Capabilities:
Terminate process

Disassembly:
add qword [rsp], 0xfffffffffff6953a
push rbp
movabs rdi, 0x5f98c828a9a0978e
shl r11b, 0x25
xor rdi, rdi
je 0x1400b340d
and di, word [rsp + rdi*2 + 0x15]
mov rbp, rdi
mov rdi, qword [rsp + r11 - 0x680c038]
mov rdi, qword [rdi + rbp]
or ebp, r11d
cmp bpl, 0xa2
mov qword [rsp + rbp*4 - 0x1a0300f8], rbp
not r11d
call fcn.1400af6fe

Function at 0x140019390
Capabilities:
Terminate process

Disassembly:
mov rdx, qword [rsp + 8]
mov rdx, qword [rdx]
not dword [rsp + r10 + 0xc8938ba]
call fcn.1400ded4c

Function at 0x1400193a5
Capabilities:
Terminate process

Disassembly:
lea rax, [rax + rsi - 0x32118c6c]
je 0x14004c0b4
mov qword [rsp + rsi - 0x4e9805a8], rdi
add sil, r13b
call fcn.1400d840e
call fcn.140087635

Function at 0x1400193c3
Capabilities:
Terminate process

Disassembly:
movabs rdx, 0xc2781804d01c417
push r10
neg qword [rsp]
push r10
neg byte [rsp]
jno 0x1400cd905
add qword [rsp + 8], 0xffffffffbff5828e
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x40]
ret
add qword [rsp + 0x18], 0x24ca8
or cx, r10w
shr r8, 0xd2
call fcn.140096b94
test dword [rsp + r8 + 0x38], r8d
xchg qword [rsp + r8*2 + 0x40], rbx
mov r8, qword [rsp + r8*2 + 0x10]
jle 0x14008183a
not word [rsp + rcx - 0x67ce2f77]
xor word [rsp + r10*2 - 0x1d230], 0x3910
mov qword [rsp + rcx - 0x67ce2f47], rax
call fcn.1400c5604
Function at 0x1400193e0
Capabilities:
Terminate process

Disassembly:
add qword [rsp + 0x28], 0xfffffffffff85c0a
mov rdi, r14
mov r14b, 0xe
not di
xor r14, 0x318d4dae
or r14b, 0x9d
movzx r14, dil
push r14
mov rdi, qword [rsp + r14 - 0xcf]
mov rdi, qword [rdi + r14*2 - 0x1fe]
mov qword [rsp + r14 - 0xcf], r14
shr dword [rsp + r14*4 - 0x3fc], 0xf
cmp byte [rsp + r14 - 0xcf], r14b
call fcn.140097127
jl 0x14001c540
jbe 0x140001878
mov r10, qword [rsp + r10 - 0x3b35244f]
or qword [rsp + r15*4 + 0x10], r15
call fcn.14008386d
invalid
xor r10b, sil
mov rax, r10
sub r10, rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + r10*8]
not qword [rsp + 0x10]
mov rbx, qword [rsp + 0x10]
mov qword [rsp + 0x48], rbx
push rdx
jo 0x140099f0c
lea rax, [rax - 0x1b67a4f8]
push r11
add qword [rsp + r10*2 + 0x60], 0x4b80
movabs rdx, 0x94a5fe1c7484b1a3
movsx esi, byte [rsp + 0x22]
movabs r14, 0x361eac12a2b74cb9
xchg qword [rsp + r10*2 + 0x90], rax
mov r10, qword [rsp + 0x68]
and qword [rsp + rsi*8 - 0x2c8], 0xffffffff8722a424
jbe fcn.14008d169
movabs r11, 0xf62d249ef50dee8e
not dword [rsp + rsi*8 - 0x2c8]
and edx, dword [rsp + 0x5b]
test si, 0x4107
mov r11, qword [rsp]
call fcn.14001bba9
xor r12, r12
movabs r12, 0x10995f9f920fdd10
seto r12b
cmp r12d, 0x760cc0ac
mov r12, qword [rsp + 0x38]
lea rsp, [rsp + 0x40]
ret 8

Function at 0x140019a38
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x38], r13
call fcn.14000aee6

Function at 0x140019a42
Capabilities:
Check http status code
Encode data using base64
Enumerate process modules

Disassembly:
cmp dword [rsp + 0x28], r10d
add qword [rsp + 0x10], 0x40bb5
or qword [rsp + 0x28], 0x24804094
bswap r10d
neg r10d
cmp r10d, 0xc26d1a1
mov rbp, r10
push rbx
mov rbp, qword [rsp + 0x18]
mov rbp, qword [rbp + riz]
mov qword [rsp + 0x30], 0xe877800
jns 0x1400cba17
or word [rsp + 0x30], r10w
add r10w, word [rsp + 0x31]
jne 0x1400c4c32
popfq
scasd eax, dword [rdi]
insb byte [rdi], dx
in al, dx
xchg byte [rax - 0xa], ch
cmp byte [rdi - 0x15], cl
invalid
mov qword [rsp + 0x18], r10
lea rbp, [rbp - 0x6a78f474]
not r8d
and qword [rsp + r8*4 + 0x28], r8
sub qword [rsp + r8*8 + 0x30], r8
push r15
xchg qword [rsp + r8 + 0x50], rcx
mov r8, qword [rsp + r8 + 0x28]
xor word [rsp + 0x30], 0x9d9d
call fcn.1400ca2bc

Function at 0x140019be4
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + r15 + 0x28], r15
movzx r15, r15b
lea rax, [rax + r15 + 0x478e9c86]
js fcn.14007e69f
and word [rsp + r15*4 + 0x28], 0x83a0
jge 0x14001d9e9

Function at 0x14001b69a
Capabilities:
Enumerate process modules

Disassembly:
and byte [rsp + 0x10], r8b
and byte [rsp + 0x10], r8b
mov r8, qword [rsp + 0x38]
jne fcn.1400bdf93
call fcn.14004c727
int3
Function at 0x14001cc12
Capabilities:
Encode data using base64

Disassembly:
shl r9w, 0xee
add qword [rsp + 0x10], 0xfffffffffffb630e
movabs rcx, 0xf11c86adb2b9fc2e
test r11b, 0x3a
jbe 0x140083548
not r9d
shr ecx, 0x26
cmovb dx, cx
mov rcx, qword [rsp + r11 - 0xef]
mov rcx, qword [rcx]
jae 0x140093a42
ja 0x14001d3d0
add edx, 0xd7337132
not r11w
not edx
not dx
lea rcx, [rcx + r11 + 0x5cabf11d]
mov qword [rsp + r11*2 - 0x1fdf0], r11
jle 0x1400b2146
mov esi, 0x1a07de2
cmp byte [rcx - 0x44b635cf], bh
js 0x140019ca1
pop rbp
mov esp, 0x73f6ea8d
sub bh, byte [rdx + 0x2388ca51]
repe scasq rax, qword [rdi]
pop rcx
xlatb
int3
mov r13, qword [rsp + 0x40]
js 0x140019c34
mov r10, qword [rsp + 0x28]
call fcn.14000c1cd
sub qword [rsp + 0x48], 0xffffffffd9238a31
cmp byte [rsp + 0x50], 0x19
jae 0x1400bd858
shr word [rsp + 0x48], 0x23
shl qword [rsp + 0x50], 0xb9
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x68]
ret

Function at 0x140021094
Capabilities:
Encode data using base64

Disassembly:
jbe 0x140081adf
add qword [rsp + rcx*2 - 0x57e2a080], 0xffffffffbfff356b
call 0x140071cb1
jb 0x1400514e3
jg 0x14005c4f3
cmp dword [rsp + 0x38], 0x629f6b3c
not byte [rsp + 0x38]
ja 0x1400b9942

Function at 0x1400223e7
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword [rsp + 0x30]
seta r11b
movzx r11, r11w
shr r11d, 0xb6
shl r11b, 1
jne 0x140073657
lea rcx, [rcx + r11*2 + 1]

Function at 0x140022b2c
Capabilities:
Terminate process

Disassembly:
push r15
movzx ebx, r9b
mov qword [rsp + rbx*2 - 2], rdi
push rdx
mov rbx, r9
movabs rdx, 0x3911342c040ed933
push r11
mov r15, rdx

Function at 0x14004f66d
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
pop r10
lea rax, [rax + 1]
jbe 0x140012551
xor dword [rsp], r13d
cmp esi, r13d
movsx r10d, byte [rsp + 1]
mov qword [rsp + r10*2 + 4], rax
ja 0x1400ac771
cmp sil, r13b
lea rsi, [rdi*4 - 0x3c5bda46]
jbe 0x140092ab2
push 0xffffffffe626cab0
push rsi
jne 0x1400228a4

Function at 0x14005348d
Capabilities:
Encode data using base64

Disassembly:
call fcn.14008b25b
add byte [rbp + rdi*4 - 0x2438de1f], 0x20
mov ah, 0xd0
invalid
jbe 0x1400967db
neg cx
and word [rsp + r9 - 0x4578c51c], 0xa023
xchg qword [rsp + rcx + 0x4578314e], rsi
mov r9, qword [rsp + r9 - 0x4578c524]
xor dword [rsp + rcx + 0x4578312e], ecx
jo 0x14004ce36
jle 0x1400b644c
push r10
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
mov r10, r11
push qword [rsp + 0x10]
popfq
mov r11, qword [rsp + 8]
mov r10, qword [rsp]
lea rsp, [rsp + 0x30]
ret
shl rdi, 0x3c
jns 0x1400abbe4
not rcx
xor r9, qword [rsp + rcx + 0x4578cef2]
neg word [rsp + rcx + 0x4578cef2]
jl 0x14005ccac
mov rdi, qword [rsp + rdi*8 + 8]
test dword [rsp + 0x48], 0x95bf3227
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x60]
ret
mov byte [rsp + rcx + 0x4578312e], 0x9c
seta cl
test word [rsp + rcx + 0x4578320f], 0x1906
mov rcx, qword [rsp + rcx + 0x4578321f]
call fcn.1400d86e3
Function at 0x140054105
Capabilities:
Encode data using base64
Enumerate process modules

Disassembly:
mov r10, qword [rsp + r9 + 0x80]
mov r10, qword [rsp + r9*4 + 0x38]
jne 0x14007330c
and byte [rsp + r9 + 0x68], 0x30
mov r14, qword [rsp + r9*4 + 0x80]
movabs r14, 0xbb97eb00c9e6520
setge byte [rsp + r9 + 0x68]
xor word [rsp + r9*4 + 0x50], 0x130d
call fcn.1400bdee8
test word [rsp + 0x58], 0xbb9f
movzx r8, word [rsp + 0x50]
jg fcn.14002f84f
mov word [rsp + 0x48], r8w
mov r10, qword [rsp + r8 - 0x7111]
neg qword [rsp + r8*2 - 0xe21a]
neg dword [rsp + r8 - 0x70f1]
not word [rsp + r8*4 - 0x1c48c]
jl 0x140075b3e
or r8, qword [rsp + r8*2 - 0xe22a]
mov r8, qword [rsp + r8 - 0x458ffdf]
not dword [rsp + 0x50]
cmp byte [rsp + 0x50], 0xbc
setge byte [rsp + 0x50]
cmp dword [rsp + 0x50], 0xe6b05f0c
setne byte [rsp + 0x48]
push qword [rsp + 0x78]
popfq
lea rsp, [rsp + 0x88]
ret
sub dword [rsp + rdi - 0x57c433ef], 0xb41f43a0
cmp dil, byte [rsp + rdi - 0x57c433ef]
call fcn.14008b92f
push rbx
push rbp
pushfq
movabs rbp, 0xda94bb9f8f21161d
not ebp
lea rbp, [rbp*8 - 0x226ca16f]
mov rbx, qword [rsp + 0x18]
call fcn.1400a93a9
add dil, 0x96
test rdi, 0xffffffff89941a90
jb 0x140057056
push 0x4910a186
jg 0x1400c41d2
movabs byte [0x48a8abb31a041d0d], al
mov dword [rsp + 0x48], 0xb829a806
not qword [rsp + 0x48]
jge 0x1400744d8
jne 0x1400cc1e4
test r14, 0x37a98d01
call fcn.1400193e0
loope 0x140074527
invalid
retf
mov qword [rsp + r11 - 0x100ffd6], r11
call fcn.1400c8921
push rbx
pushfq
movabs rbx, 0x8615adaf0318bfa8
lea rdi, [rdi + 1]
xor rbx, 0x43142d94
seto bl
call fcn.14001d680
or rbx, rbx
xchg qword [rsp + rdi - 0x57c433c7], rax
mov rbx, qword [rsp + rdi - 0x57c433d7]
jne 0x140057138
leave
mov ch, 0x6a
push rax
mov esi, 0xfd06ce40
shr dword [rcx - 0x51355143], 1
int1
mov edi, dword [rbp + 0x25]
scasd eax, dword [rdi]
movhps qword [rsi + 0x10e02ea8], xmm5
mov ebx, 0x41816220
lodsb al, byte [rsi]
int3
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x50]
ret

Function at 0x140054190
Capabilities:
Enumerate process modules

Disassembly:
jle 0x1400533ad
jg 0x14007c7c5
or eax, 0xe7c56e0a
sti
pop rsi
mov al, 0xa9
push 0x1a275ba0
invalid
ja 0x140013ad5
xor byte [rsp + 0x50], sil
mov r9, qword [rsp + 0xb8]
add qword [rsp + 0x60], 0xffffffffbffa01cc
cmp word [rsp + 0x78], si
jl fcn.140021170
jb 0x14001195e
or al, 0xa2
sub al, 0xac
invalid

Function at 0x140054b51
Capabilities:
Terminate process

Disassembly:
lea rdx, [rdx + r8 + 0x61a888b3]
movzx r12w, r15b
movzx r8d, r8b
lea r12, [r10*8 + 0x3da4a9a2]
call fcn.1400afbef
jae 0x1400a1e2b

Function at 0x140056b32
Capabilities:
Encode data using base64

Disassembly:
push r12
and r9b, 0x15
mov r8, r9
jge 0x1400d8569
mov qword [rsp + 0x38], rdx
shr r8w, 0xd9
bswap r8
jns 0x1400ac68e
add r9, 0xffffffffd4a69420
call 0x14004c038
jge 0x1400d85b2
mov fs, word [rcx]
add eax, 0x74050002
or eax, dword [rax]
fist dword [0x156098587]
add dword [rax], eax
shl byte [rsp + rcx], 0
invalid
Function at 0x140058f69
Capabilities:
Enumerate process modules

Disassembly:
call fcn.1400cb4f9
mov rbp, qword [rsp + rbp + 0x4145fbb6]
shr ecx, 0x89
jbe 0x1400d56e4
jne 0x14004adfa
push rsi
jno 0x140093e3f
add qword [rsp + 0x18], 0xffffffffbff74d76
bswap r11
add qword [rsp + 0x10], 0xfffffffffff6d254
movabs rsi, 0x28965e3a7b836396
push r10
movabs rdx, 0x473e392855b30998
mov rbp, r11
shl r11, 0x7a
movabs r10, 0x34ae86b877848d34
push rdx
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
cmp r10, r11
not r11d
sets sil
shl r10d, 0x18
lea rdx, [rdx + r10 + 0x28acf01d]
and sil, byte [rsp + 4]
cmp r11, rbp
call fcn.1400e228e
ret

Function at 0x14005ba58
Capabilities:
Enumerate process modules

Disassembly:
jne 0x1400c40fb
mov r10, qword [rsp + 0x60]
call fcn.14009b7d7
jmp 0x1adf24fa3

Function at 0x14005c17a
Capabilities:
Enumerate process modules

Disassembly:
xchg qword [rsp + 0x78], rsi
mov r8, qword [rsp + 0x20]
add qword [rsp + 0x48], 0x1b49cb6
xor rcx, qword [rsp + 0x48]
shr word [rsp + 0x48], 0x5f
js 0x14006b87d
not r10b
mov r10, qword [rsp + 0x70]
and edx, ecx
and bl, ch
test word [rsp + 0x48], cx
jae 0x140063c02

Function at 0x1400603ad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor byte [rsp + r14*2 - 0x65d36912], 0x8f
test byte [rsp + 0x38], 0x2b
not r14
mov r14, qword [rsp + r14*2 + 0x65d36954]
ja 0x1400940af
loope 0x1400603e7
in al, dx
sti
fisubr dword [rbx]
movabs dword [0x4f5eb08a6a99ab58], eax
sahf
loope 0x140060425
jns 0x140060426
xchg dword [rdi], eax
fidivr dword [rbx - 0x53]
jrcxz 0x140060444
add byte [rcx + riz*2], bl
push rbp
mov bh, al
invalid
pop rsi
ret
sbb esp, dword [0x182ef94d5]
or esi, dword [rdi - 0x72]
ret 0xa65f
mov cl, 0xc9
jnp 0x14006042b
add ecx, edx
invalid
lea rcx, [rcx + rcx - 0x13e35bf3]
movzx cx, byte [rsp + 0x3e]
call fcn.1400a028d
Function at 0x140060bc7
Capabilities:
Packed with generic packer

Disassembly:
jbe 0x1400807eb
xor dword [0x10cceaeeb], 0xcccccccc
int3
mov qword [rsp + 0x40], rdx
push r13
jbe 0x14001e218
add dword [rcx], ecx
add dword [rax], eax
or dword [rdx], esp
add byte [rdi], cl
jge 0x14009344f
call fcn.140007030
mov rax, rcx
jmp loc.1400010b5
add qword [rsp + 0x10], 0x2bc3f
add qword [rsp + 8], 0x9164b
movabs r13, 0xa384b78b05902c28
nop
test r13, r13
push r15
call fcn.1400a560b
mov r15, qword [rsp + r14*2 - 0x1ee04]
setns cl
push r13
xchg qword [rsp + 0x70], rsi
mov r9, qword [rsp + r14*2 - 0x1ee04]
movabs r13, 0x3baf82b3be0e9885
lea r13, [r15 + r11*8 - 0x407bea75]
shr cx, 0x8c
js 0x1400dfc57
cmp cl, 0xd
movsx r13w, r14b
jns 0x1400ae1da
neg r15b
mov rcx, qword [rsp + 0x28]
pop r13
call fcn.14005eca3
mov rax, qword [0x14003f7c8]
rol r8w, cl
mov r8w, r11w
mov r8, qword [rax]
test sil, 0x10
test r8, r8
jmp 0x1400ca85f
jmp 0x14009f72f
push r12
movabs r12, 0x2c83bf83a6a72e17
pushfq
xor r12b, r12b
test r12w, r12w
lea r12, [r12*8 + 0x32be6d99]
lea r12, [r12 + r12*8 + 0x241a7532]
mov r12, qword [rsp + 8]
mov qword [rsp + 8], 0x4f75ce34
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1400e65a8
call fcn.140048b42
jmp 0x1400863f4
je 0x140063292
mov rdx, rcx
mov rcx, r8
jmp 0x14008d1a4
lea rdi, [rdi + rdi*4 + 0xb800088]
mov rbx, qword [rsp + rdi - 0xb800050]
mov rbx, qword [rbx + rdi - 0xb800088]
mov rcx, rdi
cmovl cx, word [rsp + rcx*2 - 0x170000ef]
add rcx, 0x3e2fef8e
call fcn.1400ac79e

Function at 0x1400623f6
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + 0x70], rdi
mov rcx, qword [rsp + 0x48]
mov r9, rbp
mov rbx, qword [rsp + r15 - 0x2805b460]
add dword [rsp + 0x20], 0xf62c9381
setne byte [rsp + 0x20]
shr word [rsp + 0x20], 0xee
mov rbx, qword [rsp + 8]
add qword [rsp], 0xffffffffbffa1fd8
shl r8b, 0xfb
sete byte [rsp + 0x40]
mov r8, qword [rsp + 0x50]
test ebp, r9d
jne 0x14006d794
mov ebp, 0x967235f4
xor eax, 0xf964a407
fsub dword [rsi]
test al, 0xdf
jnp 0x140062443
xchg edx, eax
adc dword [rcx + 0x75b4adb3], edx
cmc
sahf
cli
invalid

Function at 0x140062a80
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
test r10w, r10w
lea rbp, [rbp + r10*2 - 0x1ff99]
setae r10b
setge r10b
shr r10, 0xe2
and r10w, 0xee3f
bswap r10
bswap r10
and r10, 0xffffffffaf21a5ab
je 0x1400a6452
mov qword [rsp + r10 + 0x28], rbp
setns r10b
ja 0x1400d64b8
call fcn.14007c006
and r15, qword [rsp]
and word [rsp], 0x6489
sete byte [rsp + r15 - 0x60288838]
not r12b
lea rdx, [rdx - 0x7ceb5ac8]
shr r15w, 0x91
cmovs r15w, r12w
lea r15, [r15 + r15 - 0x78d15d78]
shr r15w, 0x2a
call fcn.140051180
xor al, al
jmp loc.140001131