joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c56c4
Capabilities:
Encode data using base64
Execute command

Disassembly:
mov byte [rsp + 8], bpl
mov rbx, qword [rsp + r14*2]
js 0x1400de5ab
xor byte [rsp + r14*2 + 8], 0x3f
not r14w
neg r14
not bp
test bpl, bpl
call fcn.1400c326b
je 0x1401d65de
push rsi
xchg qword [rsp + 0x70], rbp
mov r15, qword [rsp + rbx*2 - 0x290007b8]
and rbx, rbx
test qword [rsp + rbx*4 - 0x52000fb0], rbx
mov rbx, qword [rsp + rbx*4 - 0x52000f98]
movabs rsi, 0xa217399bb4b7b3a0
jbe 0x1401db0c6
cmp byte [rsp + 0x60], 0x1b
mov rsi, qword [rsp]
call fcn.1400289fe
movsx r12d, r12b
call fcn.14014c471
mov r12w, 0x863f
xor r12w, 0x8186
call fcn.14017de80
lea r10, [r10*8 - 0x16dc7cd]
mov rcx, qword [rsp + 0x18]
push r15
movabs r15, 0x58a6d407c79485bb
movabs r15, 0x919fcdadc11c9928
or r10b, 0x33
call fcn.1400b63a8
add word [rsp + 8], 0x5998
xchg qword [rsp + r15*2 - 0x314408d0], rdi
mov rbx, qword [rsp]
xor r15w, r15w
xor r15d, dword [rsp + r15 - 0x18a1fff5]
test qword [rsp + r15 - 0x18a20010], 0x2a95f612
jo 0x14011799e
ja 0x1401d9992
neg r10d
sub cx, 0x793
movzx r10w, r10b
push r11
add ebp, 0x24913188
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rbp + riz]
movabs r11, 0xf307e0c790b6d29
mov qword [rsp + r10 - 0x71120042], r14
neg r10
and r10b, 0x80
call fcn.14019039a
add qword [rsp + 8], 0xffffffffffee9571
mov rcx, r15
xor cx, 0xcf9b
call fcn.14019ea72
jne 0x14001e628
movabs r9, 0x3ba42519772cf2a5
push r12
pushfq
mov r12, r9
xor r12, 0xffffffffa236db0d
add r9, 0xffffffffd7b45e9e
shr r9d, 0x4b
push rbx
lea r9, [r9 + r9*8 + 0x1926de29]
mov rdi, qword [rsp + r9 - 0x197f9b7b]
lea r9, [r12*2 + 0x5c35ab93]
or r9d, r9d
lea rdi, [rdi + 1]
push r15
mov r15, r12
je 0x140188cf8
mov r15w, 0xecb5
shl r9w, 0xa1
shr r12w, 0xc8
mov qword [rsp + 0x30], rdi
movsx r12d, r15w
movabs rbx, 0x9c8ab6ac343acb8c
and r12d, 0x17b7e921
push rbp
cmp r15b, 0xb9
jno 0x1401e736e
pop rbp
push rdi
pushfq
movabs rdi, 0x97af8583dc969483
shl di, 0x65
not edi
xchg qword [rsp + rdi*2 - 0x46d2df2e], rbp
setae dil
neg rdi
mov rdi, qword [rsp + rdi*2 + 0x46d2de0a]
mov qword [rsp + 8], rbp
jge 0x14012f35a
push rdi
movabs rdi, 0xe0bf7d9dd70b2835
bswap edi
call fcn.1400d879d
call fcn.14011985a
mov r14, qword [rsp + 0x20]
sub qword [rsp + 0x28], 0xffffffffee27a1b1
call fcn.140027abe
setne dil
sub byte [rsp + 0x30], dil
shr dil, 0x92
xor rdi, qword [rsp + 0x30]
xor word [rsp + 0x30], 0x9689
call fcn.1401794ba
cmp r15w, word [rsp + r13 - 0x7e0253f8]
setno r15b
lea rax, [rax - 0x757369fb]
call fcn.140027750
not qword [rsp + 8]
jns 0x140191f14
mov rbp, r12
xor bpl, 1
call fcn.1401a409c

Function at 0x1400cfeab
Capabilities:
Hide thread from debugger

Disassembly:
or byte [rsp + 0x38], sil
jo 0x140003cdb
xchg qword [rsp + 0x40], rbp
mov rsi, qword [rsp + 0x18]
neg byte [rsp + rdx - 0x4f31b8dc]
movabs r10, 0xbb6d224cf338e0d
not edx
cmp qword [rsp + 0x38], 0xffffffffa42746bd
mov r10, qword [rsp + 8]
not dl

Function at 0x1400d4ceb
Capabilities:
Terminate process

Disassembly:
setbe bpl
mov rbp, qword [rsp + 0x50]
jb 0x14011cf09
call fcn.1400332f0
Function at 0x1400d4cfa
Capabilities:
Terminate process

Disassembly:
mov byte [rsp + 0x18], 0x18
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
ret
pushfq
movabs r15, 0xd12a9d0e55b4ea88
call fcn.14014ec79
call fcn.1401bed00
xchg qword [rsp + 0x20], rax
mov rdx, qword [rsp + 8]
jns 0x1400dc55d
jae 0x14001d413
movsb byte [rdi], byte [rsi]
cdq
add esi, dword [rdx]
mov cl, 0xbe
adc byte [rdx + 0x24748166], 0x30
mov dword [rsi + riz*2 - 0x39], esp
and al, 0x30
invalid
or dword [rsp + r10 + 0x20], 0x17991790
neg r13w
mov r10, qword [rsp + r13*2 + 0x6045fe2a]
shr qword [rsp + r13 + 0x3022ff21], 0xa4
not word [rsp + r13*2 + 0x6045fe22]
jns 0x1400e63cd
sub rbx, qword [rsp + r13*2 + 0x60440246]
xchg qword [rsp + r10 + 0x50], rdi
mov rbx, qword [rsp + r10 + 0x30]
cmp qword [rsp + r10*8 + 0x20], r10
jae 0x140026b44
shr dword [rsp + 0x18], 0x18
mov qword [rsp + 0x18], 0xffffffff93b2da2d
je 0x140022b5d
or word [rsp + 0x18], 0xb73d
xor r13d, r13d
mov r13, qword [rsp + r13 + 0x40]
test word [rsp + 0x48], 0x7612
je 0x14001f299
add byte [rsp + 0x48], 0x2f
jae 0x1401b385a
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x50]
ret
mov qword [rsp + 0x48], 0x3719568f
jne 0x1401232b5

Function at 0x1400d6ec6
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov r14, qword [rsp + 0x38]
ja 0x140131609
jo fcn.140152f2d
and dword [rsp + 0x40], 0x8c0878b9
and byte [rsp + 0x28], 0x94
ja 0x1400acde0

Function at 0x1400df2c9
Capabilities:
Encode data using xor

Disassembly:
movabs rsi, 0x33185925f50528a6
shr sil, 0xdb
nop
lea rsi, [rsi + rsi*4 + 0x73b30295]
movabs rbp, 0x33884391b699a7bc
call fcn.140192c2f
loopne 0x1400df350
popfq
mov ch, 0x1a
jle 0x1400df2d3
fsubp st(5)
invalid
jae 0x1400df39b
mov esp, 0xd63ea11b
mov cl, 0x67
mov al, 0xb8
cmp al, 0x7c
imul esp, dword [rbx + 0x46], 0xffffff81
imul esp, dword [rsi + rcx], 0x808cc1fd
invalid
movabs al, byte [0x479de6ee39b1d63e]
cmp eax, 0x625e993f
xchg ecx, eax
outsd dx, dword [rsi]
add ch, byte [rbp + 0x3ea0d4bb]
invalid

Function at 0x1400df64a
Capabilities:
Encode data using xor

Disassembly:
idiv dword [rdi + 0x26]
add ebp, dword [rcx - 0x4c]
invalid
out 0x4e, eax
add dword [rbx], ebp
jb 0x1400df5c6
cmp eax, 0x4473221b
invalid
jb 0x1400df5f7
invalid
cmovle r8, qword [rsp + r8 + 0x3db1df97]
sub dword [rsp + r8*2 + 0x7b63beee], 0xf53347af
jnp 0x1400df60b
xor r14d, r13d
shl qword [rsp + r8*2 + 0x7b63beee], 0x57
mov r8, qword [rsp + r8 + 0x3db1df7f]
or word [rsp + 0x40], 0xbb2
add qword [rsp + 0x20], 0xffffffffbffcce53
xor byte [rsp + 0x40], 0x8c
call fcn.1400b0c98
je 0x1400df65a
jmp 0x11c185c62

Function at 0x1400fb4b0
Capabilities:
Encode data using base64
Execute shellcode via indirect call

Disassembly:
movabs rcx, 0xcd209935f9ad0ba0
mov qword [rsp + 0x50], rcx
setg byte [rsp + 0x50]

Function at 0x1401278df
Capabilities:
Check for debugger via api

Disassembly:
shr dword [rsp + 0x58], 0xd1
mov rdx, qword [rsp + 0x28]
add qword [rsp + 0x30], 0xffffffffbfeb1cee
cmp word [rsp + 0x58], 0x5b08
jae 0x140003939
sub byte [rsp + 0x58], 0x1e
call fcn.14014659f
mov ecx, 0xaf0b7205
iretd
Function at 0x14012e6fa
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + r15 + 0x65a40da], 0x47fb
mov rdi, qword [rsp + r15*2 + 0xcb481d4]
push r11
push r12
mov r11, r15
push r15
or r11b, 1
call fcn.140132e82
stc
std
invalid

Function at 0x14012fa9d
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
neg r9w
push r9
shr dword [rsp], 0xbd
shr ax, 0xc7
mov rax, qword [rsp + rax*4 + 0x20]
mov rax, qword [rax]
mov r9d, 0x18195939
and r9b, r9b
ja 0x1400ec51c

Function at 0x1401315ba
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + r8*4 - 0x680057d0], r9
push r8
mov r12d, 0x3f037f08
setge byte [rsp + r8*2 - 0x34002c00]
lea rdi, [rdi - 0x4663e368]
setge byte [rsp + r9 - 0x1a0015c8]
bswap r9d
mov r9b, byte [rsp + r9*8 - 0xb00093]
jle 0x1401334fe
shl r12b, 0x7f
call fcn.14019bedc
movsx r13, r13b
cmp r13b, 0x2c
movabs rcx, 0x5f9c7f31f01e8709
call fcn.1401d12e1

Function at 0x140138e4b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.1400c2ec6
invalid
push rbx
mov qword [rsp + 0x48], rdi
jb 0x140125b54
or r12d, dword [rsp + 0x14]
and r12w, word [rsp + 0x15]
neg qword [rsp + r12*2 - 0x5577fff0]
add qword [rsp + 8], 0x52040

Function at 0x140139ea4
Capabilities:
Check for software breakpoints

Disassembly:
cmp r14b, 0x19
lea rbp, [rbp + 1]
setbe r14b
push r15
jl fcn.1401d798c
movabs r15, 0x4b3e1abf1e99b412
movsx r14w, r14b
push r9
add r14w, 0x683
mov qword [rsp + 0x48], rbp
mov r9, r15
movabs r15, 0xb9bb629f23827301
xor r14b, r14b
jb 0x14001d663
seta r14b
add qword [rsp + 0x10], 0xfffffffffff4d64a
add r15, r15
or r15, 0x5c046a23
or r14, 0x6a26dfb2
nop
call fcn.14018f335

Function at 0x140147dd5
Capabilities:
Execute command

Disassembly:
add qword [rsp + rbx + 0x42ee002d], rbx
sub ebx, 0x30178098
and rbx, rbx
bswap rbx
jno 0x140147f82
neg dword [rsp + 0x38]
mov rbx, qword [rsp + 0x58]
shr byte [rsp + 0x38], 0xe
cmp dword [rsp + 0x38], 0x1a047f1b
jbe 0x140128b5c

Function at 0x140147fab
Capabilities:
Execute command

Disassembly:
jne 0x140160913
call fcn.140104fad

Function at 0x1401507b8
Capabilities:
Execute shellcode via indirect call

Disassembly:
add qword [rsp], 0xfffffffffff8f202
movzx r8d, r15w
mov rcx, r8
add r8, r15
sete r8b
push rbp
mov rcx, qword [rsp + rcx*2 - 0x1ae22]
mov rcx, qword [rcx]
mov qword [rsp + 8], r8
bswap r8d
shr r8d, 0xe6
movzx r15w, byte [rsp + r8 - 0x2ba2b]
xor r15b, 0x12
neg r8

Function at 0x140160918
Capabilities:
Execute command

Disassembly:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
jne 0x1401c3d06
cmp esi, 0xde02c6ad
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
jle 0x1400076fd
lea rsi, [rdi*2 - 0x387fbb6d]
call fcn.1401559cd
Function at 0x14016fd90
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov bp, word [rsp + r9 + 0x29]
mov rbp, qword [rsp + 0x58]
not word [rsp + r9 + 0x26]
mov dword [rsp + r9*4 - 0x40], 0xafac63a2

Function at 0x140190d21
Capabilities:
Execute shellcode via indirect call

Disassembly:
popfq
lea rsp, [rsp + 0xb0]
ret
mov word [rsp + 0x10], 0xe92e
movabs rbp, 0xd31a06356a83358a
mov rbp, qword [rsp]
mov rbp, qword [rbp + riz]
and word [rsp + 8], 0x6e86
add word [rsp + 8], 0xe49c
js 0x1400aa516
and byte [rsp + 0x10], 0x11
jle 0x14001cd55
add qword [rsp], 0xffffffffbfe8be10
sub byte [rsp + 0x48], 0x33
and word [rsp + 0x48], r9w
mov qword [rsp + 0x18], r9
push 0xffffffffa8ad768c
shl qword [rsp + 0x50], 0xb6
lea rdi, [rdi - 0x4663e368]
push rcx
cmp dword [rsp + 8], 0xc71d8203
push r13
mov r13, r9
xchg qword [rsp + 0x68], rdi
mov r13, qword [rsp]
mov rcx, qword [rsp + 0x60]
call fcn.140152177
not r13
setno byte [rsp + 0x30]
not qword [rsp + 0x30]
mov r13, qword [rsp + 0x20]
call fcn.1400bee33
mov qword [rsp + 0x58], 0x3993bea5
call fcn.140159fbb
lea rbx, [r9 + r9*2 - 0x7b7f1200]
mov qword [rsp + 0x18], rcx
neg bp
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
shr word [rsp + 0x18], 0x42
setne bl
shl bx, 0x4e
or r9d, 0x1a93e89d
call fcn.14018cc30
mov r15, r13
and r15d, dword [rsp + 0x31]
neg r15b
ja 0x14012370d
mov r15, qword [rsp + r15 - 0x12083068]
xor byte [rsp + 0x30], r13b
add word [rsp + 0x30], r13w
test r13, r13
jg 0x1400c91f7
call fcn.140044630
bswap edx
call fcn.1400ccf83
mov qword [rsp + 0x30], r9
call fcn.1400271f0
sbb dword [rcx], ebx
or eax, 0xebbb3ef5
sti
fistp word [rbx + 4]
jne 0x14013a71f
int 0xc5
imul ebp, dword [rsi + 3], 0xfb7a78b
add al, 0x79
rcr ebp, 0xdd
insd dword [rdi], dx
jle 0x14013a7b2
or edi, dword [rbx - 1]
invalid
invalid
je 0x140114a4e
add qword [rsp], 0x4e553
sub byte [rsp + 0x10], 0x19
ja 0x140174214
jg 0x14013a73f
jge 0x1400be6f8
jle 0x1400ba586
pop rbx
call fcn.14018ef72
sub r14b, r14b
call fcn.140132e05

Function at 0x140195cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jns 0x14013296a
jns 0x14010653d

Function at 0x1401ac0a9
Capabilities:
Encode data using base64

Disassembly:
movabs r14, 0x28910c2218a7642a
shl r14b, 0x59
setne cl
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rcx + r9*2 - 0x3011334]
add r9b, r14b
add r9, 0xffffffff872914ad
jl 0x1401ab32c
movabs al, byte [0xe90f480cbc2ba570]
invalid
jne 0x1401a2f93

Function at 0x1401ad1bb
Capabilities:
Execute command

Disassembly:
call fcn.140028900
int 0x49
int3
not byte [rsp + rdi*8 - 0x536927c0]
mov rdi, qword [rsp + rdi*2 - 0x14da49b8]
jno 0x140035243
mov r10, qword [rsp + r10 - 0x4267f717]
and byte [rsp + rdi*2 - 0x14da49c0], 0xa7
setno byte [rsp + rdi*4 - 0x29b493f8]
neg byte [rsp + rdi - 0xa6d2488]
mov qword [rsp + rdi - 0xa6d2488], 0x43bafcbd
test qword [rsp + rdi - 0xa6d24f8], 0x6c0c9707
setae byte [rsp + rdi*8 - 0x536927c0]
jae 0x140155ea1
Function at 0x1401ad22b
Capabilities:
Encode data using xor

Disassembly:
test r15w, 0xc13b
push r11
mov rdx, r15
mov r15b, byte [rsp + 0x11]
call fcn.1401c757e
sub qword [rsp + 0x28], 0xffffffff960bd49e
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x50]
ret
call fcn.14001f11b
mov rbp, qword [rbp + riz]
setbe r8b
and r8d, 0xa53f94bd
seto dl
jo 0x1401105f8
sub r14w, r14w
call fcn.14002b93d
mov al, 0xa8
cmp byte [rbp + 0x45507005], cl
mov ch, 0xc0
push 0xfffffffff8d0a57d
shr byte [rax + 0x7d], 0xa5
sar al, 1
int 0xd
cwde
sub byte [0x145ca4090], bl
test dword [rax - 0x2f5a0218], edx
mov eax, 0x80d0c58d
xchg ebp, eax
insd dword [rdi], dx
sbb byte [rax - 0x1b], dh
jne 0x140197fac
lea ebp, cs:[rax]
sub dword [rdi + 0x62c6b767], ebp
fisttp qword [rcx]
je 0x140197fb8
not r8w
js 0x1401d667e
shl r8, 0xac
xchg qword [rsp + 0x38], rsi
mov r8, qword [rsp + 0x10]
add word [rsp + 0x30], 0xe6ab
bswap r13d
out 0x41, al
bswap ebp
add qword [rsp], 0xffffffffbff45048
add dword [rsp + 0x30], r13d
and qword [rsp + 0x30], r13
mov r13, qword [rsp + 8]
shr qword [rsp + 0x30], 0x35
jb 0x1400a9e8b
ja 0x140197f81
jbe 0x1400cec59
fcomp qword [rcx]
bnd jmp rsp
in al, 0x32
pop rax
ja 0x1401ad279
loope 0x1401ad2bd
jg 0x1401ad249
invalid
push r8
adc byte [rcx + 0x65], cl
ret

Function at 0x1401b6bb3
Capabilities:
Execute shellcode via indirect call

Disassembly:
add qword [rsp + rbx + 0x7aae001e], 0xffffffffbfe2173c
call fcn.1401853e8
not word [rsp + rbx + 0x7aae004e]
test dword [rsp + rbx + 0x7aae004e], 0xae16f63f
js 0x14012c36d
jmp 0x14016fdbf

Function at 0x1401b707f
Capabilities:
Execute command

Disassembly:
adc eax, 0x5c633a
push rbp
pushfq
movabs rbp, 0x7384da909696248c
sub rbp, 0x1b872bb0
movabs rbp, 0x45a412b90f8133b0
jb 0x14000380d
xchg qword [rsp + 0x18], rcx
push r9
test bp, 0xe894
lea rbp, [rbp + riz - 0x54db3d4b]
call fcn.14017e2e0
push 0xffffffffab083b88
out 0xb6, al
lea ebx, [rsi]
call 0xde7ea1b4
mov cs, word cs:[rsi]
add bl, dl
xor byte [rbx], dh
outsb dx, byte [rsi]
invalid

Function at 0x1401bb293
Capabilities:
Packed with generic packer

Disassembly:
push r12
add r13b, r13b
xchg qword [rsp + 0x40], rax
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x30]
jae 0x14016780f
xor byte [rsp + 0x30], 0xb4
xor r12d, r12d
mov r12, qword [rsp + r12*2]
add qword [rsp + 0x28], 0xffffffffbfec1e4b
and dword [rsp + 0x30], 0x6d1fc12a
jne 0x1401977cf
xor byte [rsp + 0x30], 0xba
shl dword [rsp + 0x30], 0x87
shr qword [rsp + 0x30], 0xd0
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x40]
ret
jbe 0x14001d654
push rdx
call fcn.1401bfca9
Function at 0x1401cb3f7
Capabilities:
Execute shellcode via indirect call

Disassembly:
movsx r15w, r13b
movabs r9, 0xd113b72e791a5f01
add qword [rsp + 0x38], 0xffffffffbfebe407
sub byte [rsp + r13 - 0x682bb584], 0xb8
neg r15
lea rbp, [rbp - 0x4663e368]
add qword [rsp + r13 - 0x682bb594], 0xffffffffffe92480
movzx r9, byte [rsp + r13 - 0x682bb584]
cmp r13b, byte [rsp + r9*4 - 0x109]
not r9w
jo 0x14001ddb5
call fcn.1400b91c5
syscall
push rbx
movabs rbx, 0x2997de0b30a8cb92
mov rbx, qword [rsp]
mov qword [rsp], 0xffffffffc2e2fad4
call fcn.14020abd5
mov rsi, qword [rsp + 0x20]
neg r14b
jns 0x140186da1
and dword [rsp + 0x18], 0xfe986b16
mov byte [rsp + rdx*2 - 0x6a94eba6], r10b
add dx, 0xcdaa
call fcn.1400f0025

Function at 0x1401d52ea
Capabilities:
Hide thread from debugger

Disassembly:
movabs rdx, 0x91af53be2318c39d
je 0x1401c75c3

Function at 0x1401d66bb
Capabilities:
Execute command

Disassembly:
test ebp, r9d
jle fcn.1400326f0
push r14
movzx r9d, byte [rsp + 0x7a]
xchg qword [rsp + 0x98], rax
mov r9, qword [rsp + 0x40]

Function at 0x1401d798c
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x70], r13
add qword [rsp + rbx - 0x6006401a], 0xffffffffbfef8061
shr dword [rsp + 0x28], 0x32
add byte [rsp + rdx - 0x23186327], bh
and r13w, si
xchg qword [rsp + 0x78], rbp
mov r13, qword [rsp + rdx - 0x23186367]
shl dx, 0xf0
add word [rsp + 0x70], si
call fcn.14013a161
cwde
mov byte [rsp + rdx*2 + 0x5e4a1a9f], ch
popf
invalid

Function at 0x1401def4e
Capabilities:
Encode data using xor

Disassembly:
shr ebx, 0xb8
ja 0x1401db0a8
add qword [rsp + 0x10], 0xfffffffffffe385a
movabs rdi, 0x3f900a230bbaeeb8
mov qword [rsp + 0x18], rbx
cmp r13b, bl
call fcn.14003309b
and eax, r9d
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + rsi - 0x71e1]
mov word [rsp + 0x30], 0x7d15
sub r13d, 0x5a01a4b3
movabs rbx, 0x5e21f522b191dbbd
js 0x14019ebb6
add r8, 0x2e36ff98
jo 0x140184b3e
add qword [rsp], 0xfffffffffff580b7
mov r8b, 7
nop
add qword [rsp + 0x10], 0x10c770
push r9
push qword [rsp + 0x10]
popfq
mov rdx, qword [rsp + 8]
lea rsp, [rsp + 0x18]
ret

Function at 0x1401e0b34
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
lea rdi, [rdi - 0x23e0f9f7]
and qword [rsp + 0x28], 0x27915d82
mov r11, qword [rsp + 0x28]
push r15
movsxd r11, dword [rsp + r11*2 - 0x430237d0]
test byte [rsp + r11 - 0x21811bd0], r11b
call fcn.1400c696f
mov qword [rsp + 0x20], 0xffffffff9c19c794
jge 0x140150787

Function at 0x1401eafb0
Capabilities:
Encode data using xor

Disassembly:
lea rdx, [rdx - 0x87684fd]
cmp ecx, 0x91b0edbc
Function at 0x14057ccf3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
xor rbx, 0x4da8d6b1
xchg r11d, ebx
mov qword [rsp + 0x10], rdi
bt r11d, 0xa2
sub edi, edi
movzx ebx, r8b
movsx r9d, r11w
movsx r11w, r11b
mov r11, rcx
mov r8, rdi
inc r10b
xchg r10b, r9b
movsx r10, cx
nop
jmp 0x14057cd34
movzx r9d, byte [r11]
movzx r10d, byte [rdx]
jmp 0x14057cd41
inc r11
jmp 0x14057cd49
inc rdx
stc
test bl, bl
jmp 0x14057cd54
je 0x14057cd89
mov ecx, r8d
rol eax, 0x1c
mov eax, 0x790fd50d
rol eax, cl
cmp ecx, 0x7a15d991
clc
stc
add al, r8b
cmp rsi, r12
xor r9b, al
jmp 0x14057cd7d
inc r8
jmp 0x14057cd89
test r9b, r9b
jmp 0x14057cd91
je 0x14057cda5
cmp r9b, r10b
jmp 0x14057cd9f
je 0x14057cd34
cmp r9b, r10b
jmp 0x14057cdad
jae 0x14057cdd8
or eax, 0xffffffff
movzx rbx, r12w
movsx edi, r14w
jmp 0x14057cdc3
mov rbx, qword [rsp + 8]
mov edi, ecx
movsxd rdi, r8d
mov rdi, qword [rsp + 0x10]
jmp 0x14057cdd7
ret
mov rbx, qword [rsp + 8]
jmp 0x14057cde5
seta dil
mov al, 0xd
movzx ax, r11b
movzx rax, si
mov eax, edi
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140001140
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140003638], rbx
je 0x14000118c
cmp rax, rbx
jne 0x14000117f
mov ebx, 1
mov esi, ebx
jmp 0x140001191
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001164
mov ebx, 1
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x1400011a7
mov ecx, 0x1f
call fcn.140094000
jmp 0x140001216
mov eax, dword [0x140003640]
test eax, eax
jne 0x140001210
mov dword [0x140003640], ebx
lea r15, [0x140002320]
lea rdi, [0x140002308]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140001202
test eax, eax
jne 0x140001206
cmp qword [rdi], 0
je 0x1400011f7
movabs r10, 0xd30527475e523070
mov rax, qword [rdi]
mov rcx, qword [vtable.q:P:H_tH_:.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400011ce
test eax, eax
je 0x140001216
mov eax, 0xff
jmp 0x1400012fc
mov dword [0x140003044], ebx
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x14000123d
lea rdx, [0x140002300]
lea rcx, [0x1400022f0]
call sub.msvcrt.dll__initterm
mov dword [0x140003640], 2
test esi, esi
jne 0x14000124a
xor eax, eax
xchg qword [0x140003638], rax
cmp qword [0x140003648], 0
je 0x140001288
lea rcx, [0x140003648]
call fcn.140001510
test eax, eax
je 0x140001288
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140003648]
mov r9, qword [vtable.q:P:H_tH_:.0]
call r9
mov r8, qword [0x140003058]
mov rdx, qword [0x140003050]
mov ecx, dword [0x140003048]
call fcn.140001a78
mov dword [0x140003040], eax
cmp dword [0x140003060], 0
jne 0x1400012b8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140003044], 0
jne 0x1400012cd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140003040]
jmp 0x1400012fc
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400015a4
add rsp, 0x28
jmp 0x140001140

Function at 0x1400013fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001448
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001440
cmp dword [rcx + 0x3c], edx
jl 0x140001440
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001440
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140001448
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140001570
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001598
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140001598
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0xbf8f70
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xbf8f7d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xbf8f8d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xbf8f75
lea eax, [rcx + 1]
jmp 0xbf8f9b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xbf8fae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xbf8f94
sub eax, 3
jb 0xbf8fce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xbf901d
sar eax, 1
movsxd rbp, eax
jb 0xbf9004
jmp 0xbf8fdc
add ebx, ebx
jne 0xbf8fda
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xbf9004
inc ecx
add ebx, ebx
jne 0xbf8fea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xbf9004
call r11
adc ecx, ecx
add ebx, ebx
jne 0xbf8ffd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xbf8fec
add ecx, 2
jmp 0xbf9009
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00bf8f32
jmp 0xbf8f7d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x292a00
mov dl, 0x51
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xbf9069
cmp rsi, rcx
jae 0xbf9071
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xbf9050
cmp al, 0x8f
ja 0xbf9050
cmp byte [rsi - 2], 0xf
je 0xbf9056
sub al, 0xe8
cmp al, 1
ja 0xbf903a
cmp rsi, rcx
jae 0xbf9071
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xbf9040
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xbf9071
lodsb al, byte [rsi]
jmp 0xbf9050
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x7f6000]
mov eax, dword [rdi]
or eax, eax
je 0xbf90ce
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x7f9000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xbf907e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xbf90c8
mov qword [rbx], rax
add rbx, 8
jmp 0xbf909e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xbf9126
sub rsp, 0xffffffffffffff80
jmp 0x464dd0
Function at 0x140001568
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdx, rcx
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000158a
xor eax, eax
jmp 0x1400015ba
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140001586
lea rdx, str.logs
mov rcx, rbx
call fcn.140006994
test eax, eax
je 0x140001586
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140001674
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
and qword [rsp + 0x28], 0
lea r8, [0x14000165c]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400016a5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret