joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b076c
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov r8, qword [rsp + rbx*4 - 0x754070c]
neg word [rsp + rbx*2 - 0x3aa036a]
call fcn.14005910c
sub si, bp
jge 0x14007a96a
xor r11d, ebx
shr ebx, 0x23
mov qword [rsp + rbx*4 - 0x75587e4], rbx
xchg qword [rsp + 0x50], rsi
mov r11, qword [rsp + r8*2 + 0x30]
setae bl
cmp dword [rsp + rbx*2 - 0x3aac3c2], r8d
mov bx, word [rsp + r8 + 0x42]
jbe 0x1400b0742
cmovb r8w, word [rsp + r8*8 + 0x43]
jg 0x14006b954
call fcn.14008793c
jns 0x1400889c8
mov bpl, 0x95
mov rdx, rbp
add qword [rsp + 0x18], 0xfffffffffffbe085
cmp ebx, 0x8eb84b0e
movabs rcx, 0x353ca82a951095a4
jle 0x14007ad28
sub ebx, 0x22bdf5a8
movabs r15, 0xa0355f941eb8582a
lea r15, [rbp + rdx*4 + 0x4329f89e]
or rcx, r15
mov bp, r15w
mov rcx, qword [rsp + 0x18]
mov rcx, qword [rcx]
shl bp, 0x81
mov qword [rsp + 0x18], r15
ja 0x1400cf3c8
and r15b, r15b
neg rbx
lea rcx, [rcx + 0x7ea09f86]
push r10
setl bpl
push r11
sub r15d, ebx
push r12
shl qword [rsp + 0x30], 0xfb
jne 0x1400162c4
mov qword [rsp + 8], 0x56164395
not dword [rsp + 8]
and word [rsp + 8], 0xb893
mov word [rsp + 8], 0x4506
push rdi
lea rsi, [rsi + 0x19131d8d]
push rcx
jns 0x1400dcb5a
mov qword [rsp + 0x58], rbp
setb r14b
xor r8d, r14d
call fcn.1400c44cd
shl rbx, 0x14
push r15
test edi, 0xa39c740f
push rdx
mov rdi, qword [rsp + 0x28]
mov qword [rsp + 0x28], rcx
je 0x1400af43b
push rbp
mov rbp, rbx
add bpl, bpl
jno 0x1400973ae
test r15w, 0x809a
not r15w
jae 0x14008d062
and byte [rbx - 0x24], dl
invalid
call fcn.14000f277
add qword [rsp + 0x20], 0xfffffffffffe3797
xor r11d, 0x97a28233
jno 0x1400c0ec6
mov qword [rsp + 0x10], r10
cmp qword [rsp + 0x10], 0xffffffff9c3e10a2
push rbp
cmovno r9w, word [rsp + 0x1b]
jle fcn.1400dd11e
neg r10
lea rcx, [rcx + 0x4a9e0c9c]
or r9b, byte [rsp + 0x18]
shr byte [rsp + 0x18], 0x8d
call fcn.140058e0b
call fcn.140072a54

Function at 0x1400b20e4
Capabilities:
Connect pipe
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
bswap r12
lea r12, [r12 + r12 - 0x5c20efa]
jns 0x1400c4386
push rax
push r12
push rbx
movabs r12, 0x9b141bbd472f120d
call fcn.1400cd352
movabs rcx, 0x5b0612a6aeaec63e
ja 0x14004e2dc
mov rbx, r10
push r9
lea rdx, [rdx + r10 + 1]
mov r10, rbx
call fcn.14006ffe9
push rsi
pushfq
call fcn.14004e197
jae 0x140059203
cmovne r12, qword [rsp + 0x28]
call fcn.140009d64

Function at 0x1400b21fd
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
cmp si, di
ja 0x140008180

Function at 0x1400b2409
Capabilities:
Connect pipe
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
push rdx
mov qword [rsp + rsi*2 + 0x38], rdx
movabs rdx, 0x605f18b5b08db39
call fcn.1400d4e83
adc al, 0x9a
or bl, byte [rsi - 0x33333334]
push rbp
sub rsp, 0x20
mov rbp, rdx
mov rcx, qword [rbp + 0x40]
add rcx, 0x18
call fcn.14000c280
add rsp, 0x20
pop rbp
ret
sub sil, sil
jae 0x14002f120
Function at 0x1400b26ab
Capabilities:
Enumerate process modules
Packed with generic packer

Disassembly:
mov rbp, qword [rsp + rbp*2 - 0x14c]
mov rbp, qword [rbp + riz]
cmp qword [rsp + 0x10], 0x413713a0
jo 0x140082cbe
shl byte [rsp + 0x10], 0xb0
mov rsi, qword [rsp + 0x10]
mov r10, rsi
xor si, 0x2919
lea rbp, [rbp + r10*2 - 0x5ba5f564]
mov qword [rsp + rsi - 0x532227f9], r10
lea rsi, [rsi*2 - 0x4e5dccfa]
and r10b, r10b
or r10, qword [rsp + rsi - 0x57e68318]
bswap r10
call fcn.14000cd42
pushfq
add qword [rsp + 8], 0x3bbc2
movabs rbp, 0xc712b91308b6d8b6
push 0x532250b9
xor word [rsp], 0x542d
push rsi
shr word [rsp + 8], 0xa2
push r10
movzx ebp, bpl
ja 0x14009bd25

Function at 0x1400b2ec6
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
call fcn.1400eb236

Function at 0x1400b2ed5
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
mov qword [rsp], 0xfffffffff2daa0bd
call fcn.1400eb236

Function at 0x1400b2ee3
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
lea rsi, [r14 + r14*4 - 0x66cadac3]
call fcn.1400bb969

Function at 0x1400b2ef0
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
neg r8d
test r8w, r13w
add qword [rsp + 0x30], 0x1fb0b
neg r8
push rcx
mov rax, r13
bswap r8
jg 0x14008aa29
cmp r8b, r13b
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
call fcn.14001c878
Function at 0x1400b308b
Capabilities:
Delete registry value

Disassembly:
add word [rsp + 0x40], 0x2b2f
jl 0x14004ad2f
setns byte [rsp + 0x40]
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x68]
ret

Function at 0x1400b4ba8
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
shl bpl, 0x58
not dword [rsp + 0x70]
call fcn.14005eb99
shr word [rsp + 0x10], 0xb
sub qword [rsp + 0x10], 0x47add625
push r13
mov rcx, qword [rsp + r10*2 - 0xd182312]
shl r10, 0x48
jne 0x14009328b

Function at 0x1400b4be0
Capabilities:
Authenticate hmac
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
setns byte [rsp + 0x60]
js fcn.14006ff5e
call fcn.1400932e4

Function at 0x1400b644f
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov r9, qword [rsp + 0x88]
setno byte [rsp + r12 - 0x63fb8f13]
jns 0x1400c8b18
lea r12, [r12 + rsi*8 - 0x406c6867]
add qword [rsp + 0x50], 0xffffffffbffa61bf
call fcn.14009d7f0

Function at 0x1400b70d5
Capabilities:
Connect pipe
Encode data using base64
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0xed3e1536
lea rcx, [r10 + r10*2 + 0x68b0a381]
add r10, 0xffffffff868ef83a
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x28], rax

Function at 0x1400b739d
Capabilities:
Set registry value

Disassembly:
mov r14, qword [rsp + 0x30]
movsxd r14, dword [rsp + 0x30]
xchg qword [rsp + r14*2 + 0x1a8df11c], rcx
mov r15, qword [rsp + 0x38]
jle 0x140002581
or r14d, dword [rsp + r14*8 + 0x6a37c344]
shl dword [rsp + 0x30], 0x37
mov r14, qword [rsp + 0x18]
call fcn.1400b3ee5

Function at 0x1400b76c2
Capabilities:
Authenticate hmac
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
js 0x14006b981
push rbp
push r11
push rsi
pushfq
movabs r11, 0xf96ff2fa6a0722b
shr r11w, 0x8c
jbe 0x14006d480
call fcn.140071160
adc eax, 0xf8237ade
out 0xbb, eax
invalid

Function at 0x1400b913a
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
not word [rsp + 0x10]
add qword [rsp + 8], 0xffffffffbff1d68b
call fcn.140051b63
add qword [rsp + r12*2 - 0x8b558], 0xfffffffffff2ed0c
mov qword [rsp + r12*4 - 0x116a88], rdx
test r12w, 0xc304
call fcn.1400a4cae

Function at 0x1400bac2f
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
setb r10b
jns 0x140078e43
push rbp
xchg qword [rsp + 0x58], rax
mov r10, qword [rsp + 0x18]
call fcn.14008f118

Function at 0x1400bb5c8
Capabilities:
Connect pipe
Encode data using base64
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push rdi
push r15
push r12
movabs r12, 0x362c67b564a604b1
pushfq
Function at 0x1400bb60f
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
lea rsp, [rsp + 0x90]
ret
lea rdx, [rdx + 1]
shr r9d, 0x1d
jne 0x1400d9b1c
wait
invalid
setns bl
mov r13, qword [rsp + 0x40]
ja 0x1400e2016
jne 0x1400aaf41
pop rdi
add al, 0x78
nop
or al, 0x19
invalid
je 0x1400b803b
js 0x14000b047
bswap r9
push 0x36341f27
sub word [rsp], r9w
mov qword [rsp], 0x609ff503
mov qword [rsp + 0x28], rdx
neg byte [rsp]
neg dword [rsp]
mov r9b, byte [rsp + 3]
push r15
mov r15, r9
add qword [rsp + 8], r9
call fcn.1400ae5c0
mov rsi, qword [rsp + 0x48]
add r13b, r13b
shl qword [rsp], 0xea
call fcn.140094194

Function at 0x1400bc9a0
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], 0x71a02cbb
mov r12, qword [rsp + 0x38]
add qword [rsp], 0xffffffffbff423b6
mov rdx, rbx
or dword [rsp + 0x10], 0x4424e0a3
call fcn.1400bc97a
lea rax, [rax + r10 + 0x193a9ed8]
push rbx
add r11b, byte [rsp + 0x4e]
push rsi
jbe 0x14009021e
mov qword [rsp], 0x464f9dbd
call fcn.1400eb236
call fcn.1400161c0
neg r12d
or qword [rsp + 0x50], 0xfffffffff4aedc9b
jae 0x14001b527

Function at 0x1400bd19e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not rdx
bswap r8
jl 0x1400bac72
adc dword [0x16fccea02], 0x56
mov dl, 0xfb
adc dh, bl
ret

Function at 0x1400bdc4a
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + 0x50], 0xf31
setbe byte [rsp + 0x50]
mov rcx, qword [rsp + 0x68]

Function at 0x1400bdc60
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add al, bpl
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
test rbp, 0x201721a3
jle 0x1400caf42
mov qword [rsp + 0x20], rbp
jb 0x140098f6b
mov byte [rsp + 0x20], 0xa8
and rbp, 0xfffffffffbacdb30
mov byte [rsp + 0x20], 0x29
lea rax, [rax + 0x629ef407]
call fcn.140084043

Function at 0x1400be610
Capabilities:
Execute shellcode via indirect call

Disassembly:
push rdi
movabs rdi, 0xf10a80105e8f3525
lea rdi, [rdi + r12 - 0x86c49ff]
mov rdi, qword [rsp]
xchg qword [rsp + 0x60], rdi
mov r12, qword [rsp + 0x58]
ja 0x1400a22e5

Function at 0x1400c4391
Capabilities:
Connect pipe
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
and rdx, qword [rsp + 0x40]
not r10w
neg r10w
mov r10, qword [rsp + 0x48]
xor dl, dh
jge 0x140081622
call fcn.140090047
Function at 0x1400c44cd
Capabilities:
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
lea rcx, [r14*2 - 0x7bdf9f73]
add qword [rsp + 0x30], 0xfffffffffffbb077
shr r8, 7
add qword [rsp + 0x38], 0x10dd5
movabs rbp, 0xbaa99f2f3e2b4621
shr r14w, cl
push r12
add cx, 0x728e
cmp bpl, r15b
mov rbp, qword [rsp + r8 + 0x37]
mov rbp, qword [rbp + riz]
mov qword [rsp + 0x38], r14
push r15
movabs r12, 0xc937e1fbbadfb00
call fcn.1400c3792
sub byte [rax + rsi*4 + 0x3822ba9f], al
je 0x1400c4570
invalid
neg dh
xor r14d, 0xb62d8113
shr r14b, 0x6e
lea rbx, [rbx + 1]
push r15
call fcn.140084391
xor al, 0xb1
cdq
invalid

Function at 0x1400c556b
Capabilities:
Connect pipe
Encode data using base64
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push r15
movabs r15, 0x4219e895c533520b
push rdx
push r8
xchg qword [rsp + 0x20], rbx
mov rdx, r15
call fcn.140093dcd
add qword [rsp + 8], 0xffffffffbff28314
sub rcx, 0x5335f828
add esi, 0xa827a89d
cmp r11, 0xffffffffa2053e87
jl fcn.140067909
xchg qword [rsp + rsi - 0x28f24c22], rbp
mov r9, qword [rsp + rsi - 0x28f24c5a]
call fcn.1400e75d9
sub bp, word [rsp + 0x32]
test r12, 0xffffffffdb899e33
not dword [rsp + 0x30]
push 0x608a5919
add qword [rsp + 0x28], 0xfffffffffff6539c
call fcn.14006f001

Function at 0x1400c62c9
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
and dword [rsp + 0x60], 0x97a23409
jne 0x14009632f
shr qword [rsp + 0x48], 0x52
sub qword [rsp + 0x38], 0xfffffffffe9fd90c
mov word [rsp + 0x38], 0xbb0
not word [rsp + 0x38]
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x50]
ret
push qword [rsp + 0x78]
popfq
lea rsp, [rsp + 0x90]
ret
and word [rsp + 0x60], 0x5f05
jno 0x14006b604
push rcx
push rdx
call fcn.140097046
neg dword [rsp + 0x60]
jne 0x14001017c

Function at 0x1400c7b4b
Capabilities:
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
setns byte [rsp + 0x40]
call fcn.1400e5746

Function at 0x1400c8ae2
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
call fcn.1400afed7
invalid
push r9
push r13
lea rcx, [rcx - 0x65433141]
cmovo r13, qword [rsp + 8]
jbe 0x140058476

Function at 0x1400c90f7
Capabilities:
Encode data using base64
Enumerate process modules
Execute shellcode via indirect call
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
je 0x140083caf
mov word [rsp + rcx*2 - 0x4be7b028], 0x2a5
mov rcx, qword [rsp + 0x28]
test dword [rsp + 0x38], 0x109fe984
jne 0x1400e0267

Function at 0x1400ca4e2
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x48], rax
push r14
or ebp, 0x5fb14f0b
movabs rsi, 0x8999c58129282e08
mov r14, rbp
xor r14, rbp
sub bp, 0xf395
add qword [rsp + r14 + 0x40], 0xffffffffbff7c37a
add qword [rsp + 0x20], 0xfffffffffff65910
mov ebp, esi
lea rsi, [rsi*8 - 0x68d14cd9]
shr sil, 0x55
movzx esi, r14w
movzx si, bpl
jns 0x1400e423d
Function at 0x1400ca92a
Capabilities:
Authenticate hmac
Delete registry value
Encrypt data using speck
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
movabs rdx, 0x50a9129341809b8f
movabs r9, 0x6e89e9b58f2e9721
call fcn.140012960
jl 0x140012903
mov rbp, qword [rsp]
add qword [rsp + 0x30], 0xffffffffbff274b7
and word [rsp + 8], r13w
and byte [rsp + 8], 0x15
mov r13, qword [rsp + 0x20]
test byte [rsp + 8], 0x91
setne byte [rsp + 8]
jo 0x1400aaf28
not word [rsp + 8]
setle byte [rsp + 8]
call fcn.140010a8c
mov qword [rsp + 0x28], rdi
or byte [rsp + 0x10], 0x92
movabs rdx, 0xf529f10f3c1f4bbe
add qword [rsp + 0x18], 0xfffffffffffb8914
cmp rdx, qword [rsp + 0x10]
nop
push rcx
push rbp
lea rdx, [rdx + rdx - 0x5bd2d6d8]
mov rcx, rdx
not rcx
not rcx
mov rdi, qword [rsp + 0x28]
mov rdi, qword [rdi]
bswap edx
mov qword [rsp + 0x28], rcx
call fcn.1400d493f
movabs r10, 0x3ca7beb722bb9db6
add dx, word [rsp + 0x3a]
add r10w, r9w
movsx r10d, byte [rsp + 0x3c]
add qword [rsp + 0x20], 0x8302e
mov rsi, qword [rsp + rdx + 0x3ddf3e08]
mov rsi, qword [rsi + rdx + 0x3ddf3de0]
or dl, dl
mov r9, qword [rsp + 0x18]
mov rdx, qword [rsp + rdx + 0x3ddf3df0]
mov r10, qword [rsp]
lea rsp, [rsp + 0x20]
ret 8
test bpl, bpl
call fcn.14009c5c9
shr word [rsp + 8], 5
add qword [rsp + 8], 0xffffffffcbaba30e
shr dword [rsp + 8], 0x1f
call fcn.14000804b
mov rdx, rbx
seto r15b
push r15
add qword [rsp + 0x38], 0xfffffffffff50daa
movabs rcx, 0xf6b41336e58aeb26
call fcn.1400ab1d9
shl r12d, 0x7e
ja 0x14007508a
mov r12b, 0xd
mov qword [rsp + r12*2 + 0x16], rbp
shr r12d, 0x3c
mov r12, qword [rsp + r12]
lea rsp, [rsp + 0x10]
ret
and byte [rsp + 0x70], cl
call fcn.14000fde0
movabs dword [0x5aca4ad4c287fe0], eax
movsd dword [rdi], dword [rsi]
std
cmp r15b, r10b
mov esp, 0x8500c0dc
cmp ah, byte [0x12190fc76]
movsb byte [rdi], byte [rsi]
ret 0x49fa
jg 0x14009cfc9
or r11b, byte [rsp + r11 + 0xd2eab2f]
setge r11b
setge byte [rsp + r11*2 + 0x1a5d562e]
shr r11d, 0xed
add qword [rsp + 0x10], 0xfffffffffffddb0a
movabs rdx, 0x3aa7f32a8e2bfabc
or byte [rsp + r11*2 - 0xf2cfc], 0x90
shl byte [rsp + r11*4 - 0x1e5a10], 0x4c
mov rdx, qword [rsp + r11 - 0x7967a]
mov rdx, qword [rdx + r11*2 - 0xf2d14]
or r11, r11
shr byte [rsp + r11*2 - 0xf2ce4], 0x24
mov qword [rsp + r11*8 - 0x3cb440], r11
movsx r11w, byte [rsp + r11*2 - 0xf2cfe]
jne 0x1400b6c65
setbe r11b
lea rdx, [rdx + r11 + 0x5c063809]
or qword [rsp + r11 - 0x6fff1], r11
jo 0x140011725
add word [rsp + r11*2 - 0xdfff2], r11w
test word [rsp + r11*2 - 0xdfff2], 0xe8ad
jns 0x1400ba6da
sete byte [rsp + r11*8 - 0x37fff0]
xchg qword [rsp + r11 - 0x6ffc1], rdx
mov r11, qword [rsp + r11 - 0x6ffc9]
call fcn.1400cafdd

Function at 0x1400caf7a
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
movabs r12, 0x5210f1ba6ead100d
pushfq
or r12, r12
jb 0x14008d07b
test r12d, 0x37beb1b4
call fcn.14006b612
Function at 0x1400cafac
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
jg 0x14001e026
js 0x14005f54d
push rbp
setl r15b
setge bpl
add bpl, bpl
bswap r13d
not word [rsp + r15*2 - 0xd8e93c0]
xchg qword [rsp + r13*4 - 0x30338], rsi
mov r15, qword [rsp + 0x18]
jns 0x1400ae759

Function at 0x1400cc672
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
setno r12b
lea rdx, [rdx + r12]
neg r12b
jae 0x1400d6189
shr r12, 0x30
sub r12, 0xfffffffff68b850e
and r12d, 0xe48e5fb5
jge 0x1400b914d
xor r12d, r12d
jge 0x14004c30d

Function at 0x1400cd349
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
not esi
push rcx
jno 0x1400d1b85
ja 0x1400e282d
push r11
movabs r11, 0x71b8a903ef0c282e
mov r12, qword [rsp + r12 - 0x5bd202f3]
mov qword [rsp + 0x10], rax
test r11b, 0xa
call fcn.1400e1eb0
adc dword [rdx + 0x26], edx
invalid

Function at 0x1400cd6fb
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
push rdx
movabs rdx, 0x5429e78503895204
pushfq
shl edx, 0x3d
xor rdx, 0xffffffffa811f421
call fcn.14007e51f

Function at 0x1400cd716
Capabilities:
Authenticate hmac
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
shr r13b, 0x55
mov r13, qword [rsp + 0x10]
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x28]
call fcn.1400eb236
call fcn.1400126f0
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x80]
ret
lea r13, [r13 + r13*8 - 0x726a3ed0]
je 0x1400aa152

Function at 0x1400cd724
Capabilities:
Authenticate hmac
Encrypt data using speck
Enumerate process modules
Execute shellcode via indirect call
Get http document via iwebbrowser2
Resolve function by parsing pe exports
Schedule task via itaskservice

Disassembly:
neg byte [rsp + 0x38]
neg si
shr di, 0xa9
mov rsi, qword [rsp + 0x20]
mov rsi, qword [rsi]
or edi, dword [rsp + 0x38]
shl qword [rsp + rdi - 0x4e8000c7], 0x60
add qword [rsp + rdi - 0x4e8000c7], rdi
jg 0x14008835e

Function at 0x1400cda86
Capabilities:
Connect pipe
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
jno 0x1400cda55
push qword [rbp + 0x3a]
rcr byte [rdi - 0x7c], cl
invalid
movzx r15w, r9b
setae bl
lea rsi, [rsi - 0x6d7372e2]
call fcn.1400a9655
leave
clc
push 0x20521
add eax, 0xdb000b74
adc eax, 0x15fc0001
add dword [rax], eax
in al, 0xca
cld
adc eax, 0xcae40001
or eax, 0xc58d0f00
loop 0x1400cda78
inc dword [rcx - 0xa]
rol dword [rdx - 0x40], 1
lodsb al, byte [rsi]
push rdx
invalid
Function at 0x1400cdaba
Capabilities:
Connect pipe
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
movsx r10, r10b
setns r10b
push r11
add qword [rsp + 8], 0x27f67
call fcn.1400bf1d3
lea r10, [r10 + riz - 0x1ec8106c]
add r10b, 0xa8
add r15d, 0xd811a61c
mov r15, qword [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea r10, [r10 + r10*8 + 0x1800a18b]
lea r10, [r10 + r10 + 0x4810228c]
cmp r10, 0x2500943a
jae 0x140075d52

Function at 0x1400ce8c5
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
not qword [rsp + 0x50]
je 0x1400df130
push qword [rsp + 0x70]
popfq
lea rsp, [rsp + 0x80]
ret
mov r11, qword [rsp + 0x50]
call fcn.14007a13e

Function at 0x1400cebc8
Capabilities:
Authenticate hmac
Encrypt data using speck
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov rbp, r14
push rbp
test byte [rsp], 0x34
jl 0x14007ea38
jb 0x1400c2910
mov rbp, qword [rsp + 0x18]
mov rbp, qword [rbp + riz]
mov qword [rsp + 0x18], r14
push r10
movabs r10, 0xb2a662d652bc190
mov r14d, dword [rsp + 0x20]
neg r14w
lea rbp, [rbp + r14 - 0x5eaed847]
call fcn.140075700
Function at 0x1400cef16
Capabilities:
Enumerate process modules

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, 0x9c40
xor edx, edx
mov rcx, rax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
and dword [rsp + 0x30], r14d
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x13880
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
and dword [rbp + 0x1a0], r14d
lea r8, [rsp + 0x30]
mov edx, edi
mov rcx, r15
mov r12, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14000163b
mov eax, dword [rsp + 0x30]
xor edi, edi
shr eax, 2
mov dword [rsp + 0x30], eax
test eax, eax
je 0x14000163b
mov r8d, dword [r15 + rdi*4]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14000162f
lea r9, [rbp + 0x1a0]
mov r8d, 0x13880
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140001626
mov eax, dword [rbp + 0x1a0]
xor ebx, ebx
shr eax, 3
mov dword [rbp + 0x1a0], eax
test eax, eax
je 0x140001620
mov rdx, qword [r12 + rbx*8]
lea r8, [rsp + 0x40]
and qword [rsp + 0x20], 0
mov r9d, 0x200
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140001616
movzx edx, word [rbp - 0x80]
mov ecx, 0x7268
movzx eax, dx
sub ax, cx
cmp ax, 0xf
ja 0x140001616
mov ecx, 0x8801
bt ecx, eax
jb 0x140001683
inc ebx
cmp ebx, dword [rbp + 0x1a0]
jb 0x1400015d5
mov ebx, dword [rbp + 0x1a8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rsp + 0x30]
jb 0x140001586
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
mov rax, qword [rbp + 0x198]
cmp r14d, dword [rax]
jae 0x1400016c8
mov eax, dword [r15 + rdi*4]
mov r9d, 0x7277
mov r8, qword [rbp + 0x190]
mov ecx, r14d
add rcx, rcx
mov dword [r8 + rcx*8], eax
xor eax, eax
cmp dx, r9w
mov word [r8 + rcx*8 + 4], dx
cmove rax, qword [rbp - 0x7e]
inc r14d
mov qword [r8 + rcx*8 + 8], rax
jmp 0x140001620
xor ebx, ebx
mov dword [rbp + 0x1a8], ebx
jmp 0x140001626
push r11
xchg qword [rsp + 0x18], rbp
movabs r11, 0xf62a50b1792896aa
pushfq
and r11w, 0x623e
jle 0x140001517
not r11b
add qword [rsp + 0x18], 0xffffffffbff46f32
add r11w, r11w
xor r11, 0xffffffff97b41e3d
mov qword [rsp + 0x18], rbp
ja 0x14007b503