joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a0a90
Capabilities:
Set registry value

Disassembly:
mov r11, qword [rsp + 0x40]
call fcn.14005feef
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
not qword [rsp + 0x20]
shr di, 0x5b
and qword [rsp + 0x18], 0x43b906a5
not dword [rsp + 0x20]
lea rax, [rax + rdi - 0x7e89ad46]
js 0x140078dc7
mov qword [rsp + 0x28], r15
sub dword [rsp + 0x20], edi
push 0x16a048a2
xor byte [rsp + 0x30], 0x27

Function at 0x1400a152e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test rsi, 0x6c94e31b
push 0xffffffffe719d727
lea rax, [rax + 1]
jl 0x140094a0c
mov rdx, qword [rsp]
and r15w, 0x9b0
mov qword [rsp + rdx*4 + 0x6398a394], rax
shl si, 0x6e
neg r15b
and dl, 0x14
jne 0x1400d2e5a
mov r8, qword [rsp]
lea r13, [r8*2 - 0x20d11c7b]
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
shl r13d, 0xc9
jb fcn.1400ddb7f
mov qword [rsp + 0x10], r13
call fcn.1400944fe
add dword [rdx], ecx
add al, 0
or dh, byte [rdx + rax]
add eax, 0x5d000134
push rcx
call fcn.140066f5c
call fcn.140094b30
stosd dword [rdi], eax
out dx, al
add eax, dword [rax]
call fcn.140020f81
push rax
push rsi
movabs rsi, 0xbca0e62ff6a03aaf
pushfq
cmp sil, 0x12
push r15
setg sil
mov r15, rsi
mov rax, qword [rsp + 0x20]
test r15, 0xfffffffff5acabb1
push rdx
jno 0x140019e90
add qword [rsp], 0xfffffffffffba2d2
movabs rax, 0xc6b7183cee134fac
push r8
test al, 0x25
push r13
jae 0x14006c80f
jns 0x1400c3a35
add byte [rsi + 0x6f48a193], ah
jns 0x1400a155a
cmpsb byte [rsi], byte [rdi]
xchg ebx, eax
movabs eax, dword [0x6f27fe79444a6f48]
or cl, al
pop r14
adc esp, dword [0x1be9834c0]
jae 0x1400a14f3
jns 0x1400a155a
invalid
add byte [rdi], al
jle 0x1400a1552
loope 0x1400a14fe
pop rbx
invalid
shr byte [rsp + 0x10], 0xa7
and qword [rsp + 0x10], 0x4381310
xchg qword [rsp + 0x30], rbp
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
ret

Function at 0x1400a7a97
Capabilities:
Set registry value

Disassembly:
mov rcx, r14
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x30], 0xffffffffbaa9bc05
mov r14, qword [rsp + 0x20]
jo 0x1400ace15

Function at 0x1400a8c6c
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
xor r9w, 0xc4ac
neg ebp
lea rax, [rax - 0x5e6db273]
sub bp, r9w
mov qword [rsp + r9*2 - 0x52087290], rdx
xor r9b, byte [rsp + r9*2 - 0x5208728b]
jle 0x140067f84
mov bp, 0x903e
cmovg rdx, qword [rsp + rdx - 0x2423a178]
setge bpl
xor qword [rsp + rdx - 0x2423a178], 0xffffffffc3167524
xchg qword [rsp + rdx - 0x2423a138], rax
mov rdx, qword [rsp + r9*2 - 0x52087258]

Function at 0x1400ace4d
Capabilities:
Set registry value

Disassembly:
xor r13, 0x730f75a0
neg r13d
add r13b, 0x3a
lea rax, [rax + r13*2 - 0x3c68c6ce]
je 0x1400ba9a6
not r13b
test r13d, 0x1ba823b3
jo fcn.1400a7780
xchg qword [rsp + r13 - 0x4b7f02cb], rax
mov r13, qword [rsp + r13 - 0x4b7f02d3]
Function at 0x1400aebe3
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov r14, rdi
bswap r8d
add bp, 0xfbab
call fcn.140011a56
and r9d, dword [rsp + 0xb]
neg byte [rsp + 8]
lea rax, [rax + 0xc0dde2a]
add qword [rsp], 0xffffffffbff8f2b8
test rbp, r8
js 0x1400d7d41
movzx bp, byte [rsp + 8]
jb 0x14004f835
neg bpl
xchg qword [rsp + 0x38], rax
mov r9, qword [rsp + 0x18]
call fcn.14006b7d5
lea rax, [rax + 0x22324dad]
xor rdx, qword [rsp + 0x20]
jg 0x1400ccf4f
mov qword [rsp + rdx + 0x48], rdx
push r9
add qword [rsp + rdx*4 + 0x30], 0xffffffffbff76950
call fcn.14009bb43
jrcxz 0x1400aecd0
push rbp
jl 0x1400aecab
and al, 0xa1
sbb eax, 0xc4238a60
int 7
push 0x1d
int3
invalid
invalid
movabs al, byte [0x591c423956bf124c]
loop 0x1400aed39
cmp al, 0xeb
sub ecx, ebx
sbb edi, dword [rdi - 0x5c56422e]
jl 0x1400aec73
test al, 0xe0
or al, 0xcb
sub edi, esi
pop rsp
invalid
and eax, 0x4026ab51
invalid

Function at 0x1400af53e
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
bswap rdx
movabs r9, 0x7bb78e9159816a32
not rbx
mov byte [rsp + 0x18], 0x34
bswap rbp
and word [rsp + r15 + 0x28], 0x4b36
not edx
xchg qword [rsp + 0x88], rax
mov r10, qword [rsp + rbp*2 + 0x50]
cmp rbp, qword [rsp + r15*2 + 0x18]
setb bpl
seto bpl
jns 0x14008335b
call fcn.14005d8a5
xchg esp, eax
jne 0x1400af5f6
stosb byte [rdi], al
pop rdi
insb byte [rdi], dx
pop r15
invalid
push rax
cmp al, 0x59
wait
sbb al, byte [0x154ca8c17]
ror dword [rbp - 0x1b14e510], 0xd1
mov edi, 0xf08dc114
sbb ch, bl
in al, 0xd1
out dx, eax
out dx, al
mov ebp, 0x23e5ec44
cmpsb byte [rsi], byte [rdi]
invalid
cmp eax, 0xbc024d29
pop rax
xor dword [rbx + 0x57], 0x1f
mov bl, 0x48
jp 0x1400af5a1
test ebp, 0x43c10501
cmpsd dword [rsi], dword [rdi]
jl 0x1400af599
test al, 0xa0
fadd dword [rsi]
adc al, 0x22
in eax, dx
mov bl, 0xe6
insd dword [rdi], dx
rcl esi, 1
invalid

Function at 0x1400b155a
Capabilities:
Execute shellcode via indirect call
Extract resource via kernel32 functions
Inject thread
Resolve function by parsing pe exports
Set registry value
Spawn thread to rwx shellcode
Terminate process
Use process replacement

Disassembly:
jl 0x14006234f
lea r8, [r8*8 - 0x2d4da0f3]
mov r8, qword [rsp + 0x48]
mov word [rsp + 0x20], 0xb8a9
add qword [rsp + 0x10], 0xffffffffbff2daef
neg bl
neg dword [rsp + 0x28]
test qword [rsp + 0x20], 0xfffffffffe252f12
mov r12, qword [rsp + 0x28]
mov r12, qword [rsp + 0x58]
jns 0x140059f98
Function at 0x1400b15b7
Capabilities:
Execute shellcode via indirect call
Extract resource via kernel32 functions
Inject thread
Resolve function by parsing pe exports
Set registry value
Spawn thread to rwx shellcode
Terminate process
Use process replacement

Disassembly:
call 0x14006919d
push rcx
movabs rcx, 0x4b9943a1d438408b
test ecx, 0x97934c28
push r11
mov qword [rsp + 0x20], rbx
movabs r11, 0xba92a292d2bb630b
lea rcx, [rcx + riz - 0x62ded14f]
jo 0x1400d0449
jo 0x14006ea0a
shr cx, cl
push 0x3216ae09
sub qword [rsp], r11
add qword [rsp + 0x18], 0xfffffffffffd5435
call fcn.1400d4c48

Function at 0x1400b3d15
Capabilities:
Encode data using xor

Disassembly:
call fcn.14007715d
jmp 0x140013a4f
int3
jns 0x140013a43
sub eax, 0x6e5fd346
stc
jnp 0x1400b3d8b
iretd
movsb byte [rdi], byte [rsi]
movabs dword [0xf726b77403595672], eax
invalid

Function at 0x1400bb9ec
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
or r15d, r11d
call fcn.14009e416
mov r13, qword [rsp + 0x40]
call fcn.14009e32f
mov rdx, qword [rsp + 0x50]
xor ebx, ebx
call fcn.1400de276
setae cl
shl cx, cl
movsx rcx, word [rsp + rdi - 0xbaf9]
lea rbp, [rbp + rdi - 0x7fdf7043]
mov qword [rsp + rcx - 0x5a9e], rcx
push r14
push r15
jns 0x1400cdc42
call fcn.140073cd0
jl 0x1400afe60
sbb cl, byte [rsi + 0x78176d25]
and al, 0xa
call fcn.14008f948
lea rbp, [rbp + 0x1639211e]
test word [rsp + 0x28], 0x85b9
jns 0x140066261
add al, 0x79
lahf
invalid

Function at 0x1400bba40
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
lea rdi, [rdi - 0x1ece0b4c]
cmovbe r8w, r12w
sub word [rsp + 0x28], r8w
setle byte [rsp + 0x28]
neg r8d
xchg qword [rsp + r8 - 0x5fee45f5], rdi
mov r12, qword [rsp + r8 - 0x5fee463d]
add r8d, edx
and byte [rsp + 0x28], 0xa2

Function at 0x1400bba8e
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
jne 0x140001fad
or dword [rsp + 0x40], ebp
and rdx, qword [rsp + 0x40]
not rdx
mov rdx, qword [rsp + rbp*2 - 0x11fc8]
neg bpl
jl 0x1400b3897
Function at 0x1400be2d8
Capabilities:
Set registry value

Disassembly:
movabs rsi, 0xa0d720f0e07e32b
pushfq
neg si
shr rsi, 0x5c
neg esi
push r13
push r12
mov rax, qword [rsp + rsi - 0x5f28dee8]
jns 0x1400bbc52
mov qword [rsp + 0x28], r13
add r12, r12
xchg qword [rsp + 0x40], rax
mov r12, qword [rsp + 0x10]
xor dword [rsp + 0x28], 0x121a250a
setge byte [rsp + 0x28]
sub ecx, 0x8a82122c
shl ecx, cl
mov word [rsp + r11*2 + 0x20], r9w
xor rdx, r11
sub word [rsp + rdx - 0x72e0], 0x1e80
and rdx, 0x748549a6
xchg qword [rsp + rdx*2 - 0x81b0], rcx
mov rdx, qword [rsp + rdx - 0x40d8]
call fcn.140007529
xchg qword [rsp + 0x20], rcx
bswap r10d
movzx r13w, r10b
not r13d
shl r10, 0xb5
and rdi, rdi
mov r10b, r13b
mov r10, qword [rsp + 0x18]
mov qword [rsp + 0x18], rcx
lea rdi, [r13*8 + 0x143a9632]
js 0x1400d4aee
popfq
jle 0x140075693
stosd dword [rdi], eax
movsd dword [rdi], dword [rsi]
rol byte [rsp + rdx*2], cl
neg r14w
neg esi
and r14d, 0x6a1d589b
jbe 0x140089c7b
and r14b, 0x11
add qword [rsp + 0x10], 0xfffffffffff9490f
movsx r9, r9b
xor r9w, 0x1f2b
mov rbx, r9
add qword [rsp + r14 - 0x81c47f8], 0xfffffffffff8b05c
test ebx, r14d
call fcn.14001044d
call fcn.1400918bd
jae 0x140075657
shl sil, 0xd8
mov r13, rsi
add r13b, r13b
movabs r14, 0x183067b26418d0b0
xchg qword [rsp + 0x50], rcx
mov r14, qword [rsp + 8]
jge 0x140063560
jle 0x1400073b2
cmovno edx, dword [rsp + r9 - 0x2de]
add r9w, word [rsp + r9*4 - 0xbe0]
add qword [rsp + 0x40], 0xffffffffbff36154
xor dl, dl
lea rcx, [rcx + r9 - 0x4941b7d0]
and r11, r9
jle 0x14001e2a0
call fcn.14001d290
xor rdi, 0x57a1c53b
not rdi
mov edi, 0x748a9e85
or r13d, 0xcca1a489
call fcn.140092bd6

Function at 0x1400bed83
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
cmp r12d, ecx
mov r12, qword [rsp + 0x28]
jl 0x1400c743d
not cx
jb fcn.1400aebe3
jne 0x1400d1d4e
call fcn.1400d2511

Function at 0x1400beda0
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp], 0x3e258
cmp edi, 0xd31fcb26
nop
bswap r10
lea r12, [rdi*2 - 0x5df6c348]
mov rax, r12
jle 0x1400de2ae
wait
test byte [rcx - 0x2022079c], 0x36
adc dword [rdx + rdi], esi
xor al, 0x3a
sbb ebp, dword [rax + 0x7e58711d]
mov edi, 0xf6f31160
cdq
je 0x1400bedcd
std
invalid
call fcn.14009a2ee

Function at 0x1400c0775
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
push r15
jae 0x1400c9d66
call fcn.1400b7c49
shl word [rsp + 0x60], 0x44
mov r10, qword [rsp + rdx + 0x28]
xchg qword [rsp + rdx*4 + 0x68], rsi
mov rbx, qword [rsp + 0x20]

Function at 0x1400c1732
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + rdi*4 + 0x1ac], 0xffffffffbff6ff71
test dword [rsp + r11 + 0x92], r11d
jo 0x14001b919
mov r9, qword [rsp + r11*4 + 0x1fc]
add dword [rsp + 0x28], 0xfa5a325
shr edi, 5
add r11d, r15d
sete byte [rsp + rdi*2 - 0xfffffd0]
add qword [rsp + 0x20], 0xffffffffbff706f5
test qword [rsp + 0x28], rdi
mov r11, qword [rsp + rdi*8 - 0x3fffffd8]
call fcn.140098869
Function at 0x1400c230b
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
shl dword [rsp + 0x18], 0xe4
sub word [rsp + 0x18], 0x7818
call fcn.1400c13c4
mov qword [rsp + 0x18], rbp
neg dword [rsp + r8*2 - 0x11038]
lea rbx, [rbx + r8 + 0x5a94b502]
jae 0x14008285d
sub dword [rsp + 0x30], 0x5701641a
and r8w, 0xf82e
lea r8, [rbp*4 - 0xfce3c7]
or byte [rsp + 0x18], bpl
setbe byte [rsp + 0x30]
xor qword [rsp + 0x18], 0x53845290
add ebp, dword [rsp + 0x19]
xchg qword [rsp + 0x48], rbx
mov rbp, qword [rsp + 0x20]
add r8b, r8b
xor dword [rsp + 0x38], 0x3a92bc02
cmovl r8d, dword [rsp + 0x3c]
xor dword [rsp + r8 + 0x37], 0x96971617
not dword [rsp + r8*2 + 0x36]
test byte [rsp + r8*2 + 0x16], 5
mov qword [rsp + r8 + 0x2f], r8
mov r8, qword [rsp + r8 + 0x27]
je 0x1400dc9ff
mov r12, r14
mov qword [rsp + r12*2 + 0x28], 0x62acad20
lea rdx, [rdx + r12*8 + 0x28148b8f]
cmp dword [rsp + r14*2 + 0x28], 0xe297b929
push r11
call fcn.1400647e0
jb 0x1400828e8
lock add edi, dword [rsi - 0x68]
stc
mov bh, byte [rdi]
push rbx
xchg esp, eax
pop rcx
invalid
invalid
neg dword [rsp + rdi*2 + 0x6fe3f038]
mov rdi, qword [rsp + rdi + 0x37f1f848]
test word [rsp + 0x38], 0x16b8
jle 0x1400d889f
not word [rsp + 0x38]
not qword [rsp + 0x38]
jb 0x1400a60f4
call fcn.1400badc7
add rdi, 0xffffffffc80e06a3
mov r15b, byte [rsp + rdi + 0x37f1f7ae]
jge 0x1400727c0
mov r15, qword [rsp + rdi + 0x37f1f7a0]
shr dil, 0x95
shl dword [rsp + rdi*2 + 0x6fe3f038], 0xf5
add dword [rsp + rdi*2 + 0x6fe3f038], edi
test dword [rsp + rdi*2 + 0x6fe3f039], edi
jne 0x1400b2232
add qword [rsp + 0x10], 0xffffffffbff81a85
add dword [rsp + 0x38], 0x693a4997
call fcn.14008e935

Function at 0x1400c2356
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
test r12w, 0x38ba
not byte [rsp + r12*2 - 0xeb0a]
mov r12, qword [rsp + r12*4 - 0x1d674]
sets byte [rsp + 0x40]
sub word [rsp + 0x40], 0x5688
call fcn.14006340b
jae 0x14006b99c
ja 0x14009cbce

Function at 0x1400c2abd
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
lea rbp, [rbp*8 + 0x5d95bb82]
push rdx
mov rbp, qword [rsp + 0x18]
mov qword [rsp + 0x18], rax
call fcn.1400a41d3
Function at 0x1400c76fc
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
mov cx, 0xfc85
lea rdx, [rdx + rcx - 0x6fa9fc84]
jle 0x14009211b
mov qword [rsp + rcx - 0x6fa9fc5d], rcx
test dword [rsp + rcx - 0x6fa9fc5b], ecx
push r10
setns byte [rsp + rcx - 0x6fa9fc55]
shr cx, 0x12
movabs r10, 0xba3cd51dbf294212
shl r10w, 0xe4
mov qword [rsp + rcx - 0x6fa8ffc0], rdx
cmp byte [rsp + rcx - 0x6fa8ffd0], 0xc
jb 0x1400634cf

Function at 0x1400c819c
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
mov word [rsp + 0x10], 0x9a19
not qword [rsp + 0x10]
sets byte [rsp + 0x10]
push qword [rsp]
popfq
lea rsp, [rsp + 0x28]
ret
and byte [rsp + r9*2 - 0x52087290], 0x1a
or r9, 0x76b7243d
setl byte [rsp + r9 - 0x7fb73d65]
mov word [rsp + 0x18], 0x2726
mov word [rsp + 0x18], 0x8a1f
sub qword [rsp + r9 - 0x7fb73d65], 0xffffffffb23893b6
or r9w, 0x9e83
add byte [rsp + 0x18], r9b
mov rbp, qword [rsp + 0x40]
test r9w, r9w
jle 0x1400da482
mov esp, 0x49132a31
adc r15d, esi
jp 0x1400a8d78
pop rbp
nop
invalid
xor eax, 0x3887882c
or dword [rsi - 0x703693d2], esi
or cl, dl
sal byte [rdi - 0x31], cl
jno 0x1400a8d9e
mov ecx, 0x45f4bf07
xor al, 0x2d
or byte [0xfc81e663], cl
invalid
movabs al, byte [0xc3597c578c008ab9]
jb 0x1400a8e00
pop rdi
invalid
sal byte [rdi - 0x1b], cl
pop rbx
push rsi
invalid
jne 0x14009b2f8
cmp r11b, byte [rsp + r11*2 + 0x10c141fa]
je 0x14006b790
mov r15, qword [rsp + 0x48]
je 0x1400a8cc2
movabs rbp, 0x5431621a2e29f9bd
add r11, r11
xor dword [rsp + 0x38], ebp
shl byte [rsp + r11 + 0x10c141f4], 0xb1
sub qword [rsp + r11*4 + 0x43050728], 0xffffffffc33b9c19
jae 0x1400be99f
mov rbp, qword [rsp + 0x10]
or r11d, 0x7bb0ec91
xor r11, qword [rsp + 0x38]
test dword [rsp + 0x38], 0xf30f653e
jg 0x14006d56f
mov bl, 0x22
or eax, 0x2c7b7640
std
int 0xc8
sub bl, byte [rbx + 0x12070554]
or eax, 0xb251498
invalid
add word [rsp + r9 - 0x7fb7bfe7], 0x4fad
jbe 0x1400bea8d

Function at 0x1400c9442
Capabilities:
Enumerate process modules

Disassembly:
mov dx, 0xa52e
bswap r11
jb 0x1400b9193

Function at 0x1400c9633
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
movsx r12w, r10b
jle 0x1400d61cf
add qword [rsp + 0x18], 0x129d5
push r13
push qword [rsp + 0x48]
popfq
mov r12, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
mov r10, qword [rsp + 0x18]
mov r9, qword [rsp + 0x10]
lea rsp, [rsp + 0x50]
ret

Function at 0x1400c9c01
Capabilities:
Packed with generic packer
Set registry value

Disassembly:
jb 0x1400a0a2a
xchg ebp, eax
xchg edx, eax
invalid

Function at 0x1400cb276
Capabilities:
Set registry value

Disassembly:
not word [rsp + rdi*4]
lea rdx, [rdx + rdi*4 - 0x175424f7]
push rcx
jb fcn.1400d2f98
movabs r10, 0x79ad0005bf1a4933
cmovs rbx, rbp
je 0x14000a54c
setbe byte [rsp + rbp - 0x8f95]
xchg qword [rsp + rbx*4 - 0x23e84], rdx
mov rbp, qword [rsp + 0x58]
call fcn.140061347
Function at 0x1400d2f98
Capabilities:
Set registry value

Disassembly:
shr r13, 0xb9
push r15
mov qword [rsp + 0x38], rax
push r10
add qword [rsp + r13 + 6], 0x63db3
add r13d, 0x8b981f16
mov r15, r13
call 0x1400a454b
mov r10, rbp
call fcn.14007240a
and dword [0x1b40afa50], eax
invalid
bswap r9d
mov qword [rsp + 0x38], rdi
js fcn.1400db9d2
setne r9b
jb fcn.140085fce
push rbp
jl 0x14005fa40
jbe 0x140012894
neg r9
call fcn.1400c9c8f
call fcn.1400853e5

Function at 0x1400d3492
Capabilities:
Enumerate process modules

Disassembly:
jge 0x1400612db
shr r11d, 0x7c
sub r11d, 0x761dde3a
bswap r11d
mov qword [rsp + r12 + 0x24], rbx
push r13
movabs r13, 0xa1aa598cc28cc4b3
call fcn.14002f796

Function at 0x1400d56fe
Capabilities:
Encode data using xor

Disassembly:
jo 0x140067c94
xchg qword [rsp + 0x38], rsi
mov rbp, qword [rsp + 0x28]

Function at 0x1400d9d90
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
setns cl
movabs r10, 0xf6209332e70032a1
and r15, 0xffffffffce364f25
xchg qword [rsp + 0x58], rbx
mov r10, qword [rsp + 0x20]
bswap edx
jno 0x140086d26

Function at 0x1400dd71a
Capabilities:
Enumerate process modules
Extract resource via kernel32 functions
Set registry value

Disassembly:
and qword [rsp], 0xffffffffe309901b
push r12
movzx si, sil
mov qword [rsp + 0x38], rcx
push r11
push r14
sub rsi, 0x339181b1
movabs r11, 0x7bac2d0c7a151a3b
call fcn.1400b0a88
js 0x1400612d3
and al, 0x86
mov word [rcx + rdi*4], es
fsubr dword [rcx - 0x319f175a]
call fcn.14005d2b2
lea r12, [r14*2 + 0xd1bd31c]
mov r14, qword [rsp + r12 - 0x600d8bea]
call fcn.1400cc431
jg 0x140010410
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x78]
ret

Function at 0x1400dda05
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resolve function by parsing pe exports
Resume thread
Terminate process
Use process replacement

Disassembly:
neg r12
jae 0x140096856
add qword [rsp], 0x5966f
movabs rbp, 0x5e32cca58db5e6a1

Function at 0x1400df218
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
mov rsi, qword [rsp + r12*2 + 0x5c050]
mov rsi, qword [rsi]
call fcn.14008f95f

Function at 0x1400df228
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
call fcn.1400125c0
shl r15, 0x8e
shl word [rsp + 0x10], 0xf3
add qword [rsp + 0x40], 0x1f64f
shl edx, 0x6d
xor edx, dword [rsp + 0x11]
jns 0x140069368

Function at 0x1400df277
Capabilities:
Acquire debug privileges
Create thread
Encode data using xor
Extract resource via kernel32 functions
Set registry value

Disassembly:
js 0x1400c0790
shr word [rsp + 0x18], 0xb9
shl r10, 0x51
lea rax, [rax - 0x3ee7e27c]
neg byte [rsp + 8]
mov byte [rsp + 8], r10b
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
neg r10w
test word [rsp + 0x18], 0x73a8
ja 0x14000b0c7
iretd
Function at 0x1400dfbe3
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x18]
je 0x1400dfc47
mov ebx, 0xd1b8ee35
push r11
lea rbx, [0x1400e55d0]
mov r11d, 0xae095ebf
movzx r11d, byte [rdx]
push 0xffffffffdb178003
xor r11d, ebp
sal word [rsp + 4], 1
and r11d, 0xff
mov r11d, dword [rbx + r11*4]
shr ebp, 8
xor ebp, r11d
inc rdx
neg qword [rsp]
xor ebp, 0xabb89037
dec rdi
lea rsp, [rsp + 8]
jne 0x1400dfbfc
mov r11d, 0xdbadb2f
pop r11
jmp 0x1400dfeba
Function at 0x14023bef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
shl bh, cl
sub edi, edi
movsx r10d, r14w
movzx r11w, dl
cmovns r11w, cx
movzx ebx, r8b
dec r11b
setbe r8b
mov r11, rcx
movsx r10, cx
dec r9b
mov r8, rdi
nop
movzx r9, r15w
movzx r9d, byte [r11]
movsx r10, r9w
bswap r10w
movzx r10d, byte [rdx]
inc r11
inc rdx
cmc
test r8d, r13d
clc
test bl, bl
je 0x14023bf77
mov ecx, r8d
bts eax, edi
jmp 0x14023bf59
mov eax, 0xd51f713b
rol eax, cl
stc
clc
add al, r8b
xor r9b, al
jmp 0x14023bf6d
inc r8
cmp r12b, bl
test bpl, 0xbb
test r9b, r9b
jmp 0x14023bf7f
je 0x14023bf8e
cmp r9b, r10b
je 0x14023bf29
cmp r9b, r10b
jmp 0x14023bf96
jae 0x14023bfb9
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
bswap di
sete dil
movsxd rdi, edx
mov rdi, qword [rsp + 0x10]
jmp 0x14023bfb8
ret
mov rbx, qword [rsp + 8]
mov al, 0xbf
seta dil
setne al
mov eax, edi
mov rdi, qword [rsp + 0x10]
jmp 0x14023bfd3
ret
Function at 0x140241ba4
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x18]
je 0x140241c08
mov ebx, 0xd1b8ee35
push r11
lea rbx, [0x14023df60]
mov r11d, 0xae095ebf
movzx r11d, byte [rdx]
push 0xffffffffdb178003
xor r11d, ebp
sal word [rsp + 4], 1
and r11d, 0xff
mov r11d, dword [rbx + r11*4]
shr ebp, 8
xor ebp, r11d
inc rdx
neg qword [rsp]
xor ebp, 0xabb89037
dec rdi
lea rsp, [rsp + 8]
jne 0x140241bbd
mov r11d, 0xdbadb2f
pop r11
jmp 0x140243514
call fcn.140242c85
mov esi, 0x6bb39389
mov rsi, qword [rsi + r11 - 0x6bb39389]
mov ebp, 0x33042f9f
xor rbp, rbp
adc bpl, bpl
xor rbp, qword [r11 + rbp*2 + 8]
call fcn.14023d629
Function at 0x140001a01
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r12, rcx
test edx, edx
je 0x140001b75
mov r13d, edx
mov edi, 0
lea r14, [0x140001530]
lea rbx, [0x1405b7201]
jmp 0x140001a67
mov byte [0x1405b7201], 0
mov edx, esi
sar edx, 0x1f
shr edx, 0x1b
lea eax, [rsi + rdx]
and eax, 0x1f
sub eax, edx
cdqe
lea rdx, [0x1405b71e0]
xor bpl, byte [rdx + rax]
mov byte [r12 + rdi], bpl
add rdi, 1
cmp r13, rdi
je 0x140001b75
mov esi, edi
movzx ebp, byte [r12 + rdi]
mov byte [rsp + 0x20], 0x78
mov byte [rsp + 0x21], 0x82
mov byte [rsp + 0x22], 0x77
mov byte [rsp + 0x23], 0x7b
mov byte [rsp + 0x24], 0x84
mov byte [rsp + 0x25], 0x86
mov byte [rsp + 0x26], 0x83
mov byte [rsp + 0x27], 0x7c
mov byte [rsp + 0x28], pe_nt_image_headers64
mov byte [rsp + 0x29], 0x7c
mov byte [rsp + 0x2a], 0x81
mov byte [rsp + 0x2b], 0x7e
mov byte [rsp + 0x2c], 0x7d
mov byte [rsp + 0x2d], 0x7f
mov byte [rsp + 0x2e], 0x85
mov byte [rsp + 0x2f], 0x76
mov byte [rsp + 0x30], 0x76
mov byte [rsp + 0x31], 0x75
mov byte [rsp + 0x32], 0x7c
mov byte [rsp + 0x33], 0x7d
mov byte [rsp + 0x34], 0x8d
mov byte [rsp + 0x35], 0x83
mov byte [rsp + 0x36], 0x85
mov byte [rsp + 0x37], 0x77
mov byte [rsp + 0x38], 0x81
mov byte [rsp + 0x39], pe_nt_image_headers64
mov byte [rsp + 0x3a], 0x7b
mov byte [rsp + 0x3b], 0x7a
mov byte [rsp + 0x3c], 0x79
mov byte [rsp + 0x3d], 0x7e
mov byte [rsp + 0x3e], 0x77
mov byte [rsp + 0x3f], 0x7c
mov byte [rsp + 0x40], 0x13
cmp byte [0x1405b71c0], 0
jne 0x140001b50
mov byte [0x1405b7201], 1
mov eax, 0
lea rcx, [0x1405b71e0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x21
jne 0x140001b2f
mov byte [0x1405b71c0], 1
mov rcx, r14
call fcn.1400014f0
cmp byte [0x1405b7201], 0
je 0x140001a39
lea rax, [0x1405b71e0]
sub byte [rax], 0x13
add rax, 1
cmp rbx, rax
jne 0x140001b64
jmp 0x140001a32
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140006a70
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x140006aa0
mov eax, 0
cmp word [rcx], 0x5a4d
jne 0x140006a9f
mov eax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140006aa5
cdqe
add rax, rcx
cmp dword [rax], 0x4550
mov edx, 0
cmovne rax, rdx
ret
mov rax, rcx
jmp 0x140006a9f
mov eax, 0
jmp 0x140006a9f

Function at 0x140007120
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.1400070d0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140010730
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140019270
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140019270
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]