joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140f023b0
Capabilities:
Encode data using xor

Disassembly:
or cx, 0x7a5a
push r8
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x50], 0x539e7452
movabs r8, 0x70a42dff3cec06d8
cmovge rsi, r11
movabs r9, 0x2d1c231531bc7184
not rsi
lea r9, [rsi*2 + 0x762f3c93]
or r8d, 0x4ce17a6d
movsx r11w, r11w
xor r11w, 0x138
or r11d, 0x3d362c97
je 0x140d7a04c
setbe r9b
push r11
add r8, 0x3f9349ac
neg rsi
xor word [rsp], 0x5edb
add r11b, byte [rsp + 2]
seta r8b
sub word [rsp], 0x4359
not r8d
mov rsi, qword [rsp + 0x48]
bswap r8d
sete byte [rsp]
setle r8b
xor r8b, 0x9a
add qword [rsp + 0x30], 0xfffffffffff04f44
neg dword [rsp]
neg byte [rsp]
sub word [rsp], 0x5368
not dword [rsp]
mov byte [rsp], 0xc2
lea r9, [r8*2 + 0x5e837c93]
and dword [rsp], 0x772a2522
xor r9w, word [rsp + 1]
add qword [rsp + 0x20], 0xffffffffbf24e9ea
lea r11, [r9 + r8*8 + 0x6a295f0e]
movzx r11w, r9w
add r9d, 0x1e5434fb
mov r9w, 0x5d17
setbe r8b
neg r9w
ja 0x140d7a064
sub r8d, 0x66681a37
or r9d, dword [rsp + 2]
cmp r8w, word [rsp + 5]
call fcn.140ec3484
add byte [rax], al
js 0x140d7a150
je 0x140d7a139
jb 0x140d7a15a
invalid
invalid
jnp 0x140d7a1ca
invalid
cmpsd dword [rsi], dword [rdi]
loop 0x140d7a195
cbw
test byte [0x1a670017c], ch
setne byte [rdx]
mov esi, dword [rcx + 0x6784382c]
or byte [rbx - 0x5a2e6793], dl
xchg ebx, eax
sbb r10, rcx
add dword [rax + rcx - 0x679d4e9f], esi
hlt
invalid
invalid
test eax, 0xa5ccbf23
invalid
stc
pop rax
test dl, dl
loopne 0x140d7a153
fcmovnbe st(0), st(0)
sbb dword [rdx], ebx
fisubr dword [rcx]
mov edi, 0xd1ac2eaf
jb 0x140d7a1aa
fst st(7)
xchg esp, eax
fisttp qword [rdx - 0x23aa40d4]
in al, 0x21
mov edi, 0xdedcfb22
scasd eax, dword [rdi]
outsb dx, byte [rsi]
fldenv [0x16fa76cba]
sub byte [r9 - 0x586a7702], al
nop
invalid
test si, r9w
jl 0x140d79fce
or r9b, 0xca
xor rcx, 0x486a5134
call fcn.140e8c5e0

Function at 0x140f028f5
Capabilities:
Encode data using xor

Disassembly:
jle 0x140e7be9a
js 0x140f02906
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.140fa129f
Function at 0x140001790
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140012010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, r8
mov rsi, rdx
mov rbp, rcx
xor r8d, r8d
mov rdx, r9
lea rcx, str.xPatchMemory_Addr_p_Offset_I64u_n
mov rdi, r9
call fcn.140001070
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi + 8]
mov r9d, 0x40
sub r8, qword [rsi]
mov ebx, eax
lea rax, [rsp + 0x30]
mov rdx, rdi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1400018a0
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [r14]
mov rdx, rdi
mov r9, qword [r14 + 8]
mov ebx, eax
lea rax, [rsp + 0x38]
sub r9, r8
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400018ae
mov dword [rsp + 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi + 8]
mov rdx, rdi
sub r8, qword [rsi]
mov ebx, eax
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x34]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140001892
lea rcx, str.xPatchMemory_DONE_n
call fcn.140001070
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000a7b0
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r8d, ebx
mov edx, 0xa8
call fcn.1400014e0
int3
mov r8d, ebx
mov edx, 0xa2
call fcn.1400014e0
int3
mov r8d, ebx
mov edx, 0xa5
call fcn.1400014e0
int3
Function at 0x140003e20
Capabilities:
Delete service
Stop service

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140012010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp qword [0x140016400], 8
lea rdx, [0x1400163e8]
mov r8d, 0x20
mov qword [0x140016d90], rax
cmovae rdx, qword [0x1400163e8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor ecx, ecx
lea r8, [rsp + 0x20]
xorps xmm0, xmm0
mov qword [0x140016dd8], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x38], ecx
lea edx, [rcx + 1]
mov rcx, rax
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140003ea5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140016dd8]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140003ebc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140016d90]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x140016dd8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000a7b0
add rsp, 0x58
ret
Function at 0x140007d90
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140007db8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140007dde
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140007de0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140007e39
test ecx, ecx
jle 0x140007e19
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call fcn.14000badb
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140007e39
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140007e39
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140007e60
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140007e82
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140007e98
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140007eb4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140007eb6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140007ef2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.14000badb
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140007f8e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140007f2d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140007f6e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140007f8e
cmp rbx, rax
ja 0x140007f40
test rbx, rbx
je 0x140007f8e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1400083c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140012010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400083ed
xor eax, eax
jmp 0x140008559
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140008427
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140008427
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140008559
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000854c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000846a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140008495
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140008551
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140008504
sub eax, 1
je 0x140008504
cmp eax, 2
jne 0x14000854c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140008551
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140008532
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000854c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140008551
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000a7b0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140008bd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140012010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140008ca3
cmp byte [rcx + 0x71], 0
je 0x140008ca3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140008c9f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140008c64
sub eax, 1
je 0x140008c68
cmp eax, 2
jne 0x140008c9f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000a7b0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140008c96
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140008c9f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140008c4c
xor al, al
jmp 0x140008c4c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000a7b0
add rsp, 0x60
pop rbx
ret

Function at 0x14000aeb8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14000b394
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000b3de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000b3de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000b3de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000b3de
cmp dword [rcx + 0x84], 0xe
jbe 0x14000b3de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000b3e0
xor al, al
add rsp, 0x28
ret

Function at 0x14001a660
Capabilities:
Encode data using xor

Disassembly:
push r14
pushfq
movabs r14, 0x51573d857c197832
xor r14, 0x3180fd0
jbe 0x14001a663
setge r14b
setb r14b
mov qword [rsp + 0x18], 0x4709edd
or r14, r14
jbe 0x14001a67e
add qword [rsp + 0x10], 0xffffffffbff22cac
call fcn.140140e4a
Function at 0x140021550
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14002157c
xor al, al
jmp 0x1400216a0
movdqa xmm0, xmmword [0x140041ae0]
movdqa xmm1, xmmword [0x140041af0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x140041b00]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x140041b10]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x140021692
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400215f9
mov r11d, 2
jmp 0x14002161d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140021613
mov r11d, 1
jmp 0x14002161d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x1400216b5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14002165a
mov byte [rcx + 2], 0x3d
jmp 0x14002166a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x14002167c
mov byte [rcx], 0x3d
jmp 0x140021683
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x1400215e0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x14002169b

Function at 0x1400a0e97
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], 0x47c2207
push rcx
movabs rcx, 0x9f36fa731a31459
pushfq
xor rcx, 0x5112e80
lea rcx, [rcx + rcx + 0x6fca0059]
lea rcx, [rcx*8 + 0xbae3f34]
add rcx, 0x6a210344
movabs rcx, 0x1d2064f856e45fba
mov rcx, qword [rsp + 8]
jns 0x1400a0eab
call fcn.1400ab5a2

Function at 0x1400d79bf
Capabilities:
Encode data using xor

Disassembly:
call fcn.1401301af
mov r11, qword [rsp]
call fcn.140187436
setle r11b
call fcn.1400c86f4
jns fcn.1401dd52f
push r10
cmp qword [rsp + 0x20], r10
nop
movabs rax, 0x4bc6793947fe1784
push r10
mov qword [rsp + 0x28], 0x3ca76290
call fcn.1400c7d38
lea esi, [rsi + rbx + 0x701f66b9]
cmove r11, rdi
neg word [rsp + 0x28]
add qword [rsp + 0x10], 0x141bf1
not edi
xchg qword [rsp + r11*8 - 0x2a8], rsi
xor byte [rsp + 0x28], r11b
cmp word [rsp + 0x28], 0x2f1d
mov di, 0x29c
js 0x14002d9d0
test r11b, 0x7a
lea r11, [r11 + r11*8 + 0x9e54a05]
jno 0x140153f9e
call fcn.140105780
movsx rbx, byte [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
call fcn.1400ebb9f
popfq
jbe 0x1400d7974
invalid
sub r11d, 0x6d6f6bc4
mov r11, qword [rsp]
jge 0x1400195e3
call fcn.14019749a
push rax
push r13
push rcx
movabs rcx, 0x7fd037c46ae147d0
movabs r13, 0x36611a4525451571
pushfq
and r13b, r13b
push rdx
not r13d
mov rax, qword [rsp + 0x28]
mov cl, 0x69
call fcn.14010351b
Function at 0x1400d867c
Capabilities:
Delete service
Stop service

Disassembly:
sub r15d, 0x63fe5ae3
mov word [rsp + 0x70], 0x4599
neg byte [rsp + 0x70]
jo 0x140003e3d
mov r15, qword [rsp + 0x20]
setbe byte [rsp + 0x70]
jbe 0x1400c2549
invalid

Function at 0x1400ecb21
Capabilities:
Encode data using xor

Disassembly:
pushfq
add qword [rsp + 8], 0x4ffa9
push r11
movabs r11, 0x4dc0377900a013a6
sub r11d, 0x467914bf
call fcn.140206ba9
idiv byte [rax - 0x38]
movabs dword [0x11b56d5f86aa9264], eax
loopne 0x1400ecbad
sti
invalid
mov al, al
xor ebp, dword [rax]
jne 0x1400ecbc9
sub byte [rdi + 0x75], cl
sbb byte [rbx], ch
pop rbx
lahf
sub ebx, dword [rbx - 0x61]
outsd dx, dword [rsi]
or edx, dword [rdi]
sti
lodsd eax, dword [rsi]
jae 0x1400ecbaa
sti
invalid
or ah, byte [rbx - 0x42da9d9]
xor al, 0x82
popfq
sub eax, 0x4ead4f13
mov ch, 0x16
mov al, 0x2c
mov bh, 0x42
shr byte [rbp - 0x4ff06049], 1
push rax
cwde
push rsi
invalid

Function at 0x14010da02
Capabilities:
Encode data using xor

Disassembly:
push rcx
push r12
call fcn.1401d9254
call fcn.1401e9577
clc
mov byte [rdx + 0x7a], al
jne 0x14010da31
outsd dx, dword [rsi]
mov ebp, 0x6d9fc846
mov ebp, 0x6d391e10
mov ebp, 0x8685019e
lodsd eax, dword [rsi]
and dword [rbx + 0x64], esi
mov ebp, 0x6a07669b
mov ebp, 0x81b3ae13
in eax, 0xb
xor bh, byte [rbp - 0x43]
jge 0x14010d9f0
invalid

Function at 0x1401405ae
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x30], 0xffffffffbffd0d3a
mov r12, qword [rsp + 0x68]
or byte [rsp + 0x40], r8b
add qword [rsp + 0x50], 0xffffffffbff4ca21
and dword [rsp + 0x40], r8d
and di, dx
call fcn.14015b336
xor byte [rax], cl
mov cl, cl
mov dl, 0xaa
sbb eax, 0xffd79d7
sub ebx, esp
stc
movabs eax, dword [0x8aeb7ce6497169d5]
mov dh, 0xe5
or al, 0x77
fyl2xp1
adc ebp, dword [rbx + 0x46]
fdiv st(1), st(0)
add ebp, dword [rbx]
out dx, al
jno 0x1401405c7
retf 0xbff4
jnp 0x14014066d
dec dword [rsi + 0x1eb148b6]
jae 0x140140651
movabs eax, dword gs:[0x368296e77286257d]
int3
xchg esi, eax
mov r14b, 0x5f
hlt
pop rbx
sub edi, dword [rax - 0x19]
pushfq
invalid

Function at 0x140142144
Capabilities:
Encode data using xor

Disassembly:
call fcn.14013a08f
pushfq
add qword [rsp + 8], 0xffffffffbfca2c44
mov qword [rsp + 8], 0xffffffff85388350
push r9
movabs r9, 0x772a5956191946ea
neg r9d
xor r9d, 0x672a57aa
jbe 0x140142166
mov r9, qword [rsp]
call fcn.140021515
mov dl, ch
invalid

Function at 0x14014450b
Capabilities:
Encode data using xor

Disassembly:
push rbx
movabs rbx, 0x41564f930e7c5b55
pushfq
xor bx, 0x494f
push r9
mov r9, rbx
mov qword [rsp + 0x18], 0xffffffffbd1aacd5
not r9b
test rbx, 0x4fcf37e0
jbe 0x14014450c
movabs r9, 0x7625289147f22193
mov r9, qword [rsp]
call fcn.14014b679
call fcn.1401c7167

Function at 0x1401ee33b
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + 0x30], rcx
and dword [rsp + 0x28], 0x61d3741e
call fcn.1400cee7c
push 0x61c98693
xchg ebx, eax
xor edx, ebp
stc
adc eax, 0x497871a1
stosb byte [rdi], al
jo 0x1401ee351
invalid
xor dword [rsi - 0x2f90afc7], 0xfffffff9
invalid
Function at 0x14037b01d
Capabilities:
Encode data using xor

Disassembly:
push rbx
movabs rbx, 0x41564f930e7c5b55
pushfq
xor bx, 0x494f
push r9
mov r9, rbx
mov qword [rsp + 0x18], 0xffffffffbcd7b0ad
not r9b
test rbx, 0x4fcf37e0
jbe 0x14037b01e
movabs r9, 0x7625289147f22193
mov r9, qword [rsp]
call fcn.1406fd438
pop rbp
jno 0x14037b0c2
adc dword [rsi + 0x5575ff89], edx
xor bl, dl
cmp eax, 0xcb0d5df0
xor eax, 0xeaae8f16
lahf
mov dl, 0xff
adc dh, byte [rbx + 0x17]
mov dword [rbx - 0x582d372a], 0xb0d9179f
jle 0x14037b0e8
invalid
xchg esi, eax
pop rsp
imul edi, edi, 0x66601167
or al, 0xe8
sbb dword [rsi - 0x659f23a2], 0x66
mov esp, 0x6125b3e6
mov byte [rdx], bl
push rdi
movabs al, byte [0x1b0f16ff7d7540a5]
in al, 0x6e
or eax, 0x7ae82964
pop rbp
sub eax, ebp
jp 0x14037b14a
invalid
pop rax
imul edx, dword [rsi], 0x658c0e9d
sub al, 0x3e
sub al, 0x5b
hlt
Function at 0x1406e66f4
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp], 0xffffffffbf8d7541
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.1407c9c0f
mov rsi, qword [rsp + 0x10]
jae 0x14037d345
xchg esi, eax
invalid

Function at 0x140748b9f
Capabilities:
Encode data using xor

Disassembly:
movabs rdi, 0x1bc954ce64857dbe
lea r9, [rdi + rdi + 0x4bf40cd2]
not r9d
bswap r9
mov r9, qword [rsp + 0x18]
call fcn.140791782
push r11
pushfq
movabs r11, 0x1a9e6d5d25fd78f5
neg r11
call int.1406ff79c
invalid
Function at 0x1400110b9
Capabilities:
Create process on windows

Disassembly:
jmp 0x1400117b0
push rbp
push rdi
sub rsp, 0xcf8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x23a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0xc98], rax
lea rcx, [0x1400240a2]
call fcn.140011370
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rbp + 0x10], 0x68
mov r8d, 0x6a
lea rdx, str._C:UsersJalenDesktopOutfled_Microphone_Mute.exe_
lea rcx, [rbp + 0xd0]
call fcn.1400111b8
lea rcx, str._C:UsersJalenDesktopOutfled_Microphone_Mute.exe_
call fcn.14001102d
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str._C:UsersJalenDesktopOutfled_Microphone_Mute.exe_
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
test eax, eax
je 0x1400118a5
lea rax, [rbp + 0x98]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xd0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14001ae50]
call fcn.14001102d
lea rcx, [rbp - 0x50]
lea rdx, [0x14001ad00]
call fcn.140011302
mov rcx, qword [rbp + 0xc98]
xor rcx, rbp
call fcn.1400111b3
lea rsp, [rbp + 0xca8]
pop rdi
pop rbp
ret

Function at 0x1400111f4
Capabilities:
Terminate process

Disassembly:
jmp 0x140013050
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011276
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400143a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400143c0
xor al, al
jmp 0x140014441
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400143d3
xor al, al
jmp 0x140014441
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400143fd
xor al, al
jmp 0x140014441
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014411
xor al, al
jmp 0x140014441
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014423
xor al, al
jmp 0x140014441
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001443f
xor al, al
jmp 0x140014441
mov al, 1
add rsp, 0x38
ret