joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007a625
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r8, qword [rsp + 0x58]
sub dword [rsp + 0x48], 0xb7145aae
jbe 0x14008609e
and dword [rsp + 0x48], 0x3a8441ae
shl byte [rsp + 0x48], 0x81
add qword [rsp + 0x30], 0xffffffffbff290f5
and dword [rsp + 0x48], 0x1fa85cac
jns 0x1400b785b
shl r8d, 0x39
seta r8b
or byte [rsp + 0x48], 0x9a
shl qword [rsp + 0x48], 0x98
jbe 0x14007650e
sal ebp, 1
xchg ebx, eax
fadd dword [rsi - 0x635d1679]
mov edx, 0xf8be3f03
jno 0x14007a698
or al, 0x1d
cmp edx, dword [rax + 0x7e]
push 0x254b5c9
ret
or bh, bl
pop rdx
stosd dword [rdi], eax
sbb al, bh
movabs dword [0xdbfa735f6140f9b5], eax
invalid
bswap r13d
movzx r13d, r10w
test r13b, 0xad
lea r13, [r13 + r10*2 - 0x21edabe8]
mov r10, qword [rsp + r13 - 0x6ed48fbd]
jbe 0x140068bfe
test dword [rsp + r13 - 0x6ed48fe5], r13d
jae 0x1400b0335

Function at 0x14007c995
Capabilities:
Check os version
Delete registry key
Extract resource via kernel32 functions
Query or enumerate registry key
Resolve function by parsing pe exports
Set registry value

Disassembly:
mov r11, qword [rsp + 0x60]
call fcn.14005e78c
invalid
jge 0x1400d916f
test dword [rsp + 0x80], 0x2514b68a
mov r8, qword [rsp + 8]
jb 0x1400b6ba9
mov qword [rsp + 0x80], 0xffffffffc03e1ca3
or r10w, r10w
shr dword [rsp + 0x40], 0xda
seta byte [rsp + 0x40]
jae 0x140072310
push rdi
push rdx
movabs rdx, 0x9731b8a257277e2b
mov qword [rsp + 0x18], rbx
pushfq
shr rdx, 0xa8
call fcn.14006c598

Function at 0x140080c1a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jns 0x1400e05a8
cmp ebx, 0x7237d7b7
jno 0x1400b6c0e

Function at 0x1400835ce
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
pushfq
and r12d, 0x26344628
jge 0x14009cb50
sbb cl, byte [rcx]
rol dh, 1
invalid
mov rax, qword [rsp + r12*4 - 0x10901080]
add qword [rsp + r12*2 - 0x8480848], 0x10ba4
push rdi
movzx r12d, r12b
call fcn.1400c392a
jns 0x14001f3ce
jg 0x1400547e2
mov r14w, 0xac23
xchg qword [rsp + 0x60], rcx
mov rbp, qword [rsp + 0x18]
setns r10b
add r10d, 0xdf08ff06
and r14w, r10w
mov dword [rsp + 0x30], 0x158b9320
mov r14d, r10d
add word [rsp + 0x38], r14w
mov r14, qword [rsp + 0x40]
sub r10, qword [rsp + 0x38]
mov qword [rsp + 0x30], 0xffffffffe5a61c82
add byte [rsp + 0x38], r10b
sub byte [rsp + 0x38], r10b
jne 0x1400cb605
shl r10, 0xaf
mov r10, qword [rsp + r10*4 + 0x50]
not dword [rsp + 0x30]
call fcn.140072a1a
invalid

Function at 0x140086078
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setae r14b
lea r13, [r13*8 + 0x41ae7827]
cmova r10, qword [rsp + 0x60]
xor r14w, 0x1c1f
mov r14, qword [rsp + r10 - 0x486113af]
jo 0x14006a5e2

Function at 0x14008d45b
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
lea r10, [r15 + r15*8 - 0x46f39d9]
call fcn.1400092ad

Function at 0x14008d468
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
shl edi, 0xb0
or rdi, 0x1ca6f7b7
mov rdi, qword [rsp + 0x18]
mov qword [rsp + 0x18], rcx
movabs r9, 0xe00ecda63da1843c
push r9
setl r9b
test dword [rsp], 0x54b69a9d
bswap r9
jne 0x1400807d4
invalid
push r9
jne 0x14007f9d2
Function at 0x14008d470
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
mov rbx, r9
neg word [rsp + 8]
je 0x140054809
mov qword [rsp + 0x48], rdi
jbe 0x140073944
leave
cli
xchg esp, eax
scasd eax, dword [rdi]
mov ecx, 0x6b452eef
push rcx
jle 0x14008d4ef
ja 0x14008d495
mov dl, 0x4b
or al, byte [rdi + rcx + 0x51]
add byte [rsi + 0x2d], dl
sbb bl, byte [r10 + r15*2 + 0x23]
invalid
and eax, 0x6905ac56
rcr byte [rcx], 0xd6
invalid

Function at 0x14008fb5c
Capabilities:
Encode data using base64

Disassembly:
add qword [rsp], 0xffffffffffffd6a0
mov rbx, qword [rsp + rbp - 0x498eeacc]
and ebp, ebp
movabs rsi, 0xac83bb2e40bf54a8
shl byte [rsp + 0x10], 0x6f
add bpl, bl
jo 0x1400bc972
mov rbx, qword [rsp + rbp - 0x498eeaae]
mov rbx, qword [rbx]
test word [rsp + 0x35], bp
setle byte [rsp + rbp - 0x498eea7e]
shl rsi, 0xe1
js 0x1400211cc

Function at 0x140094242
Capabilities:
Encode data using base64

Disassembly:
mov r9, qword [rsp + 0x40]
call fcn.1400b6b6c
call fcn.1400153b0
pop rcx
push rdi
pushfq
movabs rdi, 0xdba9972b878f4906
lea rdi, [rdi*4 - 0x13ed94d1]
lea rdi, [rdi*2 + 0x5db5cea1]
mov edi, 0xc991d2b5
add di, 0xdd12
test rdi, 0xffffffff9094e73e
xchg qword [rsp + 0x10], rcx
call fcn.14008d468

Function at 0x140095c21
Capabilities:
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
popfq
lea rsp, [rsp + 0x20]
ret
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
jo 0x1400c5b34
lea rbp, [rbp*4 - 0x28ea226b]
mov qword [rsp + 8], rbp
neg rbp
call fcn.1400aa46c
jle 0x14007e5a5
xchg qword [rsp + 8], rbp
call fcn.14004c87e
add qword [rsp], 0xfffffffffffa0e50
push rbp
movabs rbp, 0xdf34b0935b0af7a9
movabs rcx, 0xdb2e611ceb181aaa
and bp, 0x9590
jne 0x14008da4e
clc
int3
mov qword [rsp + 0x30], rcx
jns 0x14001c1f8
sub r10d, 0xeeb86c32
movsx r10w, r10b
call fcn.1400b5dee

Function at 0x14009d6d4
Capabilities:
Execute shellcode via indirect call
Packed with generic packer
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
push r8
pushfq
xor r12b, 0x1b
jbe 0x140080747
jge 0x1400b8812
wait
mov eax, 0xcddb85ce
sub al, 0x47
imul edi, dword [rax], 0x9d8b426e
sub al, 0x10
xchg ecx, eax
mov al, 0x8e
invalid
call fcn.140069e32

Function at 0x1400a3876
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and dword [rsp + r11 - 0x59], 0xcb0f8011
not dword [rsp + r11*4 - 0x1d4]
mov r11, qword [rsp + r11 - 0x81]
sub dword [rsp + 0x28], 0x6dbbeebe
not byte [rsp + 0x10]
call fcn.1400bf544
push r11
xchg qword [rsp + r9 - 0x29], rax
mov r9, qword [rsp + r9 - 0x41]
mov r11, qword [rsp + 0x10]
jne 0x1400672a7
xor byte es:[rsi], dl
out dx, eax
invalid

Function at 0x1400b19a4
Capabilities:
Encode data using base64

Disassembly:
push r9
movabs r9, 0x3d17c587b82bcb83
pushfq
test r9d, 0x5fa7bdae
jae 0x140009af9
Function at 0x1400b6bcc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r10, rbp
js 0x1400dcc3a
jb fcn.140050efd
xchg qword [rsp + r10 + 0x3c], rax
mov r10, qword [rsp + r10*8 - 0x18]
sub ecx, 0x142d980f
movabs r14, 0x523aad93588c342b
or ebp, dword [rsp + 0x14]
call fcn.1400cfe39
mov qword [rsp + 0x28], r9
mov r15, qword [rsp + 0x28]
mov qword [rsp + 0x28], rdi
movzx r15w, byte [rsp + 0x51]
lea rsi, [rsi + 0x43138f91]
sub qword [rsp + 0x28], 0x340ace35
push rbp
add r8w, 0x75b1
push r14
shr r8b, 7
xchg qword [rsp + 0x78], rsi
mov rdi, qword [rsp + 0x20]
call fcn.14006c180
mov rbp, qword [rsp + r11 - 0x74bf6699]
movabs r12, 0x3d12fe8e1796332a
test r12, 0x6d864193
setl dil
cmp dil, 0xa
mov r13, r12
jae 0x140068bfe
mov r11, qword [rsp + r11 - 0x74bf66b1]
sub r9, qword [rsp + 0x28]
not r13w
or r12, qword [rsp + 0x28]
call fcn.140075d38
push rax
push r13
pushfq
movabs r13, 0xb1b004bb40036998
cmp r13b, 0xa3
call fcn.1400ce651
adc ah, byte ss:[rdi + rbx + 0x39]
invalid
push r15
pushfq
movabs r15, 0x52ad2f1b791de320
or r15b, r15b
xchg qword [rsp + 0x18], rax
mov r15, qword [rsp + 8]
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
ret

Function at 0x1400b6f5d
Capabilities:
Execute shellcode via indirect call
Packed with generic packer
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
or dword [rsp + 8], 0x6208bc36
add dword [rsp + 8], 0x58a7d490
jns 0x14001e37c
call fcn.1400d66c1
add qword [rsp + 8], 0x3add2
sub ebx, 0x8ab2a7a0
mov qword [rsp + 0x40], rdi
jne 0x1400d231e
test r13, 0x1707b1a2
call fcn.1400cd647
call fcn.1400dd469
push rdx
push rbp
call fcn.14009817b
int3
xchg qword [rsp + 0x50], rdx
mov r15, qword [rsp + 0x48]
lea rbp, [r11 + rbp - 0x75cc606d]
test r14d, 0x11b58f9f
jl fcn.14009fbaa
not dword [rsp]
jl fcn.1400a228a
mov r11, qword [rsp + 0x20]
or r14d, 0xc21be28e
or word [rsp], 0x9222
shr r14d, 0x77
xor r14w, word [rsp + 4]
or word [rsp], 0x8997
xor r14b, byte [rsp + 4]
shr r14w, 0xc
mov r14, qword [rsp + 0x38]
jb 0x140007bec
setae bpl
call fcn.1400b8339
mov qword [rsp], rbp
neg bpl
neg ebp
jbe 0x140080705
neg dword [rsp + 0x28]
shl r9d, 0x61
xor byte [rsp + r9 - 0x6f081ad8], 0xae
shr r9d, 0xab
mov r9, qword [rsp + r9*2 - 0x1bc1e6]
add dword [rsp + 0x28], 0x7e011e28
shl byte [rsp + 0x28], 0x4b
setns byte [rsp + 0x10]
setns byte [rsp + 0x10]
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x58]
ret
setns r15b
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx]
cmp qword [rsp + rbp - 0x45c64730], 0x23172807
mov word [rsp], bp
setle r11b
shl r15w, 0x47
add qword [rsp + rbp - 0x45c64708], 0xffffffffbff640d4
lea rdx, [rdx - 0x17fb826b]
add qword [rsp + 8], 0xffffffffbffad954
lea rbp, [rbp*4 - 0xe5ba4e8]
add dword [rsp], ebp
cmp r15d, dword [rsp + 1]
jae 0x14005bfd4
and bx, word [rsp + r14 - 0x243c69a5]
mov rbx, qword [rsp + 0x10]
not esi
jbe 0x1400641dc
call fcn.14001ad72
lea rsi, [rsi - 0x725a88f4]
xor word [rsp + 0x40], 0x1a17
shl r13d, 0x12
lea rbx, [r13*8 + 0x76092d17]
add rbx, 0xffffffff82181a3b
mov bl, byte [rsp + 0x43]
xchg qword [rsp + 0x50], rsi
mov rdi, qword [rsp + 0x30]
jb 0x14001d37f
call fcn.1400860cd
jg 0x140069599
Function at 0x1400b8175
Capabilities:
Enumerate process modules
Packed with generic packer

Disassembly:
push r12
jg fcn.14006bec7
movzx r13, r12b
not r12b
test r13, r13
mov qword [rsp + 0x30], rdi
call fcn.14006caef

Function at 0x1400b8191
Capabilities:
Enumerate process modules

Disassembly:
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
and dword [rsp + 0x48], 0
mov rbp, rax
xor esi, esi
lea r8, [rsp + 0x48]
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140002d76
mov ecx, dword [rsp + 0x48]
xor ebx, ebx
shr ecx, 2
mov dword [rsp + 0x48], ecx
test ecx, ecx
je 0x140002d64
xor edx, edx
test esi, esi
je 0x140002d53
mov r8d, dword [rdi + rbx*4]
cmp r8d, dword [rbp + rdx*4]
je 0x140002d5e
inc edx
cmp edx, esi
jb 0x140002d46
mov ecx, dword [rdi + rbx*4]
call qword [r14 + reloc.OLEAUT32.dll_VariantClear]
mov ecx, dword [rsp + 0x48]
inc ebx
cmp ebx, ecx
jb 0x140002d3c
mov r8, r15
mov rdx, rdi
mov rcx, rbp
call fcn.1400018b8
mov esi, dword [rsp + 0x48]
mov ecx, dword [r14]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002d16
and qword [rsp + r9*2 - 0x1af44], 0xfffffffff319648d
setb bl
call fcn.1400a5aaa
and r10w, r13w
xchg qword [rsp + 0x58], rsi
mov r12, qword [rsp + r13 - 0x103fffc0]
neg dword [rsp + r13*4 - 0x40ffffb8]
bswap r13d
movzx r13, byte [rsp + 0x48]
shl r13b, 0x54
mov rcx, r13
add qword [rsp + r13 + 8], 0xffffffffbff777dd
mov r10, qword [rsp + rcx*8 + 0x28]
neg byte [rsp + r13 + 0x48]
test byte [rsp + r13*4 + 0x48], 0x86
ja 0x140002d06
neg dword [rsp + r13 + 0x48]
movabs r8, 0x983bed11e636cd18
movzx r8w, r8b
mov rcx, qword [rsp + r13*2]
xor r8d, dword [rsp + 0x49]
jne 0x14007550b

Function at 0x1400bb056
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + r8*2 - 0xd126fe2], rbp
push rcx
lea rbx, [rbx + rbp + 0x29168703]
jle 0x1400afed4

Function at 0x1400bb06d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
js fcn.1400cd7cb
movabs rdi, 0x6eb246b3a68e9a15
add qword [rsp + 0x18], 0xfffffffffffc9f47
mov edi, 0x461891a8
push r15
lea rbp, [rdi*4 - 0x4ae96d57]
xor rdi, rdi
setns bpl
call fcn.140075449
invalid

Function at 0x1400bd263
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub bx, 0x2d96
jo 0x14008ed7b
mov rbx, qword [rsp + 0x18]
mov rbx, qword [rbx]
js 0x14006c0b1
mov qword [rsp + 0x18], 0x4ba11ab3
xor word [rsp + 0x18], 0x579b
call fcn.1400d20e1
ja 0x1400b2bfb
shl bx, 0xb9
xor qword [rsp + 0x48], 0x37331509
lea rbx, [r9 + rbx*8 + 0x62bdd9ac]
not byte [rsp + 0x48]
xor dword [rsp + 0x48], 0xbab9b081
call fcn.14004da77
shl bx, 0xbc
jns 0x140011b20

Function at 0x1400c03be
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
movsx r14w, r14b
test r11d, r11d
not r14w
call fcn.140071d64
Function at 0x1400c03cf
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x140002e0f
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002e1a
mov ecx, dword [rsp + 0x60]
call rdi
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, 1
mov byte [rsp + 0x58], 0x4d
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140002e1a
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x140002db1
shr r12d, 0xd4
test word [rsp + r12 - 0x185], r12w
mov r12b, byte [rsp + r12*8 - 0xdc9]
sets byte [rsp + r12*4 - 0x560]
jb 0x140002db6
mov r12, qword [rsp + r12*8 - 0xaf0]
add qword [rsp + 0x18], 0xffffffffbff996db
add dword [rsp + 0x58], 0x3cbc9a8e
cmp word [rsp + 0x58], 0xfaa2
ja fcn.140056f0d
not qword [rsp + 0x58]
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x60]
ret

Function at 0x1400c0b0b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shr word [rsp + 0x30], 0xfa
lea rcx, [rcx + 0x59249307]
movabs rdi, 0xd826072582837593
mov rsi, rdi
call fcn.14006a76e

Function at 0x1400c3fa6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdx
pushfq
movabs rdx, 0x4823ebb62112f425
cmp rdx, 0x4d80f73f
call fcn.14008106a

Function at 0x1400c3fbe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or r13, qword [rsp + r13 - 0x4dd159bd]
mov r13, qword [rsp + 0x40]
add qword [rsp + 0x10], 0xffffffff9d13dab0
mov dword [rsp + 0x38], 0xf2a9afa0
jg 0x1400aebf2
mov rsi, qword [rsp + 0x28]
shl dword [rsp + r13 - 0x4dd159bd], 0x30
neg dword [rsp + r13 - 0x4dd15995]
jns 0x14001b649
and al, 0x22
outsb dx, byte [rsi]
mov bh, 0xb1
sbb byte [rbx], ah
jne 0x1400a49a1
push rdx
outsb dx, byte [rsi]
out dx, eax
stc
sbb byte [rdi*8 - 0x8561d24], dh
invalid
cmp al, 0xd5
hlt
js fcn.1400df8c8
call fcn.14007e1f0
lea rsi, [rsi + 1]
push r15
pushfq
movabs r15, 0xaebf2a0d3e27c892
movzx r15, r15b
push r14
mov qword [rsp + r15*2 - 0xf4], rsi
add qword [rsp + r15 - 0x7a], 0xfffffffffff91c58
movabs r14, 0x398c3c9ff9233100
lea r15, [r15*8 - 0x3479fb7c]
and r15w, 0x809d
push rbp
jb 0x1400a4917
neg r14w
jl 0x1400b448a
cmp dword [rdx], ebp
xchg ebx, eax
call 0xdafe2fe8
hlt

Function at 0x1400c5aa6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setns byte [rsp + 0x30]
movabs r12, 0x55a57a8370afa438
lea rbx, [rbx - 0x3bf484eb]
neg r10w
lea r12, [r12 - 0x3b61bf51]
test r12b, r12b
Function at 0x1400d307e
Capabilities:
Delete registry value

Disassembly:
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002825
mov rcx, qword [rbp + 0x390]
lea rdx, str.dialerstager
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call fcn.140001ac4
call fcn.140001768
call entry0
or ecx, 0xffffffff
call fcn.1400017f8
jmp fcn.140002c00
mov rax, qword [rax + r9 - 1]
or r9b, 0x81
call fcn.1400a7de6
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x68]
ret
jg 0x1400b2bd0
mov rsi, qword [rsp + 0x70]
jg 0x140091397
jb 0x140002807
call fcn.1400b5b6b
shr byte [rsp + 0x68], 0xe6
xchg qword [rsp + rdx - 0xd7d1], rax
mov rdx, qword [rsp + 0x48]
and esi, 0xe1ac2900
jbe 0x1400c2e9e
jno 0x1400d0332

Function at 0x1400d4ae2
Capabilities:
Encode data using xor

Disassembly:
push r9
xchg qword [rsp + 0x78], rax
mov r11, qword [rsp + 0x40]
mov r8, qword [rsp + r10*2 - 0x5b8418e6]
call fcn.140019e99

Function at 0x1400d5f4c
Capabilities:
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rsp + 8]
lea rsp, [rsp + 0x50]
ret
ja 0x1400d4718
mov qword [rsp + r8*2 + 0x18], r11
mov r15, qword [rsp + 0x18]
and byte [rsp + 0x18], 0x1a
push r15
test qword [rsp], r12
lea rdx, [rdx + 0x7507f01c]
call fcn.140066194
xor qword [rsp + 0x30], 0x301273a4
call fcn.140022daa
push r12
jl 0x140075e4c
add qword [rsp + 0x18], 0xfffffffffffd26a7
or r8w, r15w
shr r8b, 0x66
call fcn.1400154d0
mov r11, r12
call fcn.1400153c0
mov qword [rsp + r12 + 0xc], rdx
not r12
xor r8b, 9
cmovae r8w, word [rsp + r12*8 + 0x134]
setg r12b
push r15
push r11
add qword [rsp + 0x10], 0x94d5
mov rdx, r8
movabs r11, 0x6bd7ba1d73abb0a
push rbx
neg r11b
movsx r12, r8w
mov rdx, qword [rsp + r12*8 + 0x18]
mov rdx, qword [rdx + r8*2]
jl 0x14006a788
neg qword [rsp + rsi + 0x18]
and rsi, 0x76a78632
call fcn.1400201ce
lea rdx, [rdx + 1]
ja 0x14000ff2c
xor r12, r12
or r12b, 0x24
jno 0x140071aaf

Function at 0x1400d5f63
Capabilities:
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0x2bd8
shr edi, 0x47
add edi, edi
or di, 0x6132
push 0xffffffffcb944e33
and di, di
shl di, 0x30
push r10
mov rax, qword [rsp + rdi - 0x309fff8]
shr word [rsp + rdi*8 - 0x184ffff8], 0x91
mov rax, qword [rsp + rdi - 0x309fff0]
jg 0x1400a1e56

Function at 0x1400d868c
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + 8], 0x6111
call fcn.14004b289

Function at 0x1400d86b7
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
add qword [rsp], 0x8a22a
push r15
push rcx
movabs r15, 0x1592ed1338848428
shr r15d, 0xa8
push r8
add r15b, 0x28
push rbx
mov rsi, qword [rsp + r15 - 0x38848c]
mov rsi, qword [rsi + r15 - 0x3884ac]
mov qword [rsp + r15 - 0x38848c], r15
not r15
not r15w
test byte [rsp + r15 + 0x387b78], r15b
jge 0x1400b8703
Function at 0x1400dbc74
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
jne 0x1400b6f45
movabs r8, 0xa5318aab402de1a2
jge 0x1400b2b90
movabs rbp, 0xf715ea87a327dca5
push r8
add qword [rsp + 0x38], 0xfffffffffff9f615
setne r12b
neg r12w
mov rsi, qword [rsp + 0x10]
mov rsi, qword [rsi]
xor r12d, r14d
call fcn.140091dca
mov qword [rsp + 0x20], rax
jb 0x1400862c8
add qword [rsp + 0x18], 0x72a8
push r11
push rbp
movabs rbp, 0x7c062f2b6583dab3
sub di, bp
add qword [rsp + 0x10], 0x400c1
mov rax, rdi
movabs r11, 0x1e8965b2e12042a9
shl r11d, 0xcc
mov eax, 0x26b9f893
mov rax, qword [rsp + r11 - 0x42a8ff0]
mov rax, qword [rax]
bswap r11
call fcn.14000d08d

Function at 0x1400def06
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jg 0x1400d16f2
and al, byte [0x14006b115]
add byte [rax], al
cld
stc
or eax, 0
add byte [rax], al
add byte [rax], al
add byte [rbx], al
add byte [rax], al
add byte [rdx + rdi*8], al
or eax, 0x2000
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rcx - 9], al
invalid
movzx r12, r12w
mov rsi, r12
mov rsi, qword [rsp + 0x18]
mov rsi, qword [rsi + r12 - 0x2e]
mov word [rsp + rdx*2 - 0x70fff0], 0xf3c
xor byte [rsp + rdx - 0x387ff0], 0xb
jne 0x140059776

Function at 0x14011a591
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call 0x140100199
call rax
mov r11, rax
test rax, rax
jmp 0x14023b37b
call rax
jmp 0x14023b4e6
call rax
mov r11, rax
test r11b, 0x25
test rax, rax
jmp 0x14023b39c
xor eax, eax
jmp 0x14023b2c5
jmp 0x14023b4e6
jne 0x14023b3a2
lea rcx, [rsp + 0x40]
movsx eax, r13w
not ah
movzx rax, dx
mov rax, qword [0x1400eb098]
jmp 0x1401564a6
je 0x14023b2be
cmp r11, rsi
jne 0x14023b433
cmp byte [rsp + 0x180], bl
jmp 0x14023b3b7
je 0x14023b419
lea rax, [rsp + 0x40]
bt dx, bx
ror ch, cl
dec dl
sub rbp, rax
nop
cwd
lea rdx, [rsp + rbx + 0x40]
rol cx, 0x2f
bts ecx, r14d
mov ecx, ebx
mov eax, 0x5d3e5f0b
clc
rol eax, cl
add al, bl
xor al, byte [rdx + rbp]
mov byte [rdx], al
je 0x14023b409
inc rbx
cmp rbx, 0x104
jmp 0x14023b403
jb 0x14023b3d0
lea rbp, [rsp + 0x40]
mov cx, 0x82a6
rdtsc
movsx dx, r15b
mov rdx, rbp
mov rcx, rsi
jmp 0x14023b427
mov rax, qword [0x1400eb0a8]
jmp 0x14013890d
cmp byte [rdi + 1], 0x23
movsx edx, dx
mov dx, 0x861f
lea rdx, [rdi + 1]
jne 0x14023b4be
movzx edx, byte [rdi + 2]
add rdi, 2
cmp r10w, 0x73a0
test dl, dl
jmp 0x14023b45d
je 0x14023b4bb
nop
cwde
movzx eax, r9w
mov rax, 0x171c8203
lea eax, [rdx - 0x30]
jmp 0x14023b478
inc rdi
jmp 0x14023b482
cmp al, 9
jmp 0x14023b489
ja 0x14023b4bb
movsx eax, dl
sar cx, 0x96
sbb ch, 0xbc
mov dl, byte [rdi]
and cx, r14w
lea ecx, [rbx + rbx*4]
sar rbx, cl
shl rbx, 0xae
cmc
lea ebx, [rax + rcx*2 - 0x30]
test dl, dl
jmp 0x14023b4b5
jne 0x14023b470
movsxd rdx, ebx
sub r8d, r8d
movzx ecx, r10w
movsxd rcx, r13d
mov rcx, r11
jmp 0x14023b4d0
call fcn.14023af59
jmp 0x14023b4e6
mov rbx, qword [rsp + 0x178]
not ebp
sets sil
cmp rsi, 0xffffffffcfa0ea90
mov rdi, qword [rsp + 0x150]
bsf si, r10w
movzx bp, r12b
ror bpl, 4
add rsp, 0x158
movsxd rbp, esi
jmp 0x14023b520
pop rsi
xchg bpl, bpl
pop rbp
jmp 0x14023b52a
ret
Function at 0x14023ad85
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
test r12b, al
mov qword [rsp + 0x10], rdi
sub edi, edi
movzx r11d, ax
movsx r11d, bp
movzx ebx, r8b
jmp 0x14023ada5
mov r11, rcx
movsx r10w, r9b
movsx r9, r9w
mov r8, rdi
xchg r9, r10
movsx r9, sp
bswap r10w
nop
mov r9w, 0xbc0a
bswap r10w
movzx r9d, byte [r11]
inc r10
xchg r10d, r10d
mov r10w, 0x270b
movzx r10d, byte [rdx]
jmp 0x14023ade1
inc r11
inc rdx
clc
test r8w, 0xa2a3
test bl, bl
jmp 0x14023adf5
je 0x14023ae28
mov ecx, r8d
setb al
cmc
mov eax, 0x5d3e5f0b
jmp 0x14023ae0c
rol eax, cl
test r15b, r9b
add al, r8b
clc
jmp 0x14023ae1a
xor r9b, al
jmp 0x14023ae22
inc r8
test rbx, r15
test r9b, r9b
jmp 0x14023ae30
je 0x14023ae44
cmp r9b, r10b
jmp 0x14023ae3e
je 0x14023adc9
cmp r9b, r10b
jmp 0x14023ae4c
jae 0x14023ae77
or eax, 0xffffffff
movsx di, dil
mov di, 0x9e2c
movzx rbx, r14w
mov rbx, qword [rsp + 8]
movsx di, spl
mov rdi, qword [rsp + 0x10]
jmp 0x14023ae76
ret
mov rbx, qword [rsp + 8]
seta dil
lahf
mov eax, edi
jmp 0x14023ae92
mov rdi, qword [rsp + 0x10]
jmp 0x14023ae9c
ret
Function at 0x140005920
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400c1ed0]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400059ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1400d35a0]
movabs r8, 0x8fafd21e25c5e09b
mov edx, eax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
test cl, 1
jne 0x140005996
or ecx, 1
lea rax, vtable.V_.ts_taesrA__etcot_y_tsm_dyoysgrsrliabor_eeeom.0
mov dword [0x1400d35a0], ecx
mov rcx, r8
mov qword [0x1400d3590], rax
mov qword [0x1400d3598], rcx
jmp 0x1400059a4
mov rcx, qword [0x1400d3598]
mov rax, qword [0x1400d3590]
mov dword [rsp + 0x20], edx
lea rdi, [0x1400d3590]
cmp rcx, r8
je 0x1400059cb
movabs r8, 0xb2ab117a257edf0d
cmp rcx, r8
je 0x1400059cb
mov rcx, rdi
call qword [rax + 0x30]
jmp 0x1400059d0
test edx, edx
setne al
lea rdx, [0x1400a1138]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x24], al
mov qword [rsp + 0x28], rdi
call fcn.140005494
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140046830
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret