joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005427f
Capabilities:
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
test rax, rax
je 0x140002270
lea edi, [r13 + 0x18]
lea rax, [rsp + 0x40]
mov edx, edi
mov qword [rsp + 0x2b8], rax
lea ebx, [rdi - 0x17]
mov rcx, qword [rsp + 0x2b8]
mov byte [rcx], r13b
mov rcx, qword [rsp + 0x2b8]
add rcx, rbx
mov qword [rsp + 0x2b8], rcx
sub rdx, rbx
jne 0x1400020e9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, edi
lea r8, [rsp + 0x40]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140002267
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov r8d, ebx
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002267
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r13d
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
test rax, rax
je 0x14000225e
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
je 0x140002255
mov rcx, qword [rsp + 0x40]
movzx edi, r13w
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp r13w, word [rbx + 6]
jae 0x140002255
movzx ecx, word [rbx + 0x14]
add rcx, rbx
movzx eax, di
lea rdx, [rax + rax*4]
lea r12, [rcx + rdx*8]
lea rcx, [r12 + 0x18]
lea rdx, str..text
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400021ff
inc di
cmp di, word [rbx + 6]
jb 0x1400021cc
jmp 0x140002255
mov edi, dword [r12 + 0x24]
lea r9, [rsp + 0x2b0]
add rdi, qword [rsp + 0x40]
mov r8d, 0x40
mov ebx, dword [r12 + 0x20]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [r12 + 0x24]
mov r8d, ebx
add rdx, r15
mov rcx, rdi
call fcn.1400018b8
mov r8d, dword [rsp + 0x2b0]
lea r9, [rsp + 0x2b0]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
push r9
pushfq
movabs r9, 0x979583a5eeb42721
sub r9, r9
jl 0x1400cc1bb
add qword [rsp + 0x10], 0x29755
mov rcx, r9
and r9b, 0x94
cmp r9b, 0xac
bswap r9d
movabs r9, 0x3baa822169cc6aa
push rdx
mov rcx, r9
ja 0x1400020aa
mov rcx, qword [rsp + 0x18]
mov rcx, qword [rcx]
movabs r9, 0x8bbcb6a776294e8c
movabs rdx, 0xde2075a92f1ae98a
mov qword [rsp + 0x18], rdx
cmp r9d, dword [rsp + 0x1b]
push 0x6b3803ae
setg r9b
test qword [rsp + 0x20], 0xffffffffa7216e0a
mov byte [rsp + 0x20], 0xbc
lea rcx, [rcx + 0x7d992b3a]
call fcn.14009418f
Function at 0x1400582a3
Capabilities:
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
mov rdx, qword [rsp + 0x48]
jl 0x140068a50
cmp qword [rsp + 0x38], r15
lea r15, [r15 + riz - 0x64737545]
ja 0x14004fd80

Function at 0x14005b0e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop rcx
jl 0x140092707
popfq
lea rsp, [rsp + 8]
ret
je fcn.1400e0493
not rsi
mov rsi, qword [rsp + 0x48]
mov rsi, qword [rsi]
neg r10b
xor r13, 0x3d32c69e
lea r13, [r13 + r10 + 0x7ba5ceb0]
shr r10b, 0xb9
not r13
mov qword [rsp + r10*2 - 0x73329e0], r10
je 0x1400db416
loopne 0x14005b16a
sbb ebx, dword [0xee60a092]
mov dl, 0xd3
xchg ecx, eax
xchg ecx, edx
jne 0x14005b12e
pop rax
movabs eax, dword [0x23c2deca8f93c5f3]
invalid
add eax, 0x4df11a51
xor eax, 0xf842dacb
invalid
push r10
movabs r10, 0x3595bfaf7c97de36
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x18], rax
call int.140078af7
lea rsi, [rsi + r10 - 0x70dbcf5c]
test qword [rsp + 0x20], 0xffffffffe1acf0b2
mov qword [rsp + 0x48], r13
setle r10b
cmp qword [rsp + 0x20], r13
lea r13, [r10 + r10*8 + 0x459478b8]
push rcx
xchg qword [rsp + r10 - 0x3999498], rsi
mov r13, qword [rsp + r10*2 - 0x73329d0]
mov rcx, qword [rsp + r10 - 0x39994b0]
jno 0x140011b7c
mov r9, qword [rsp + 0x88]
jl 0x1400cb6ff
call fcn.1400af0d6
mov esp, 0x60c21
or al, 0xc4
add al, 0
or byte [rsi + rax], ah
add al, 0x54
invalid

Function at 0x140060614
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
add qword [rsp + 0x20], 0xffffffffbff7dc05
or r10, 0xffffffffe29c813b
mov rdi, r10
mov qword [rsp + 0x38], rax
not rdi
cmp r10w, di
push rbx
setb dil
add qword [rsp + 8], 0x49c15
mov rbx, rdi
push r11
add qword [rsp + rdi*8 - 0x22099fd8], 0xfffffffffff85872

Function at 0x140060671
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and qword [rsp + 0x38], 0
lea r9, [rbp + 0x720]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x40]
and qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rbp + 0x728]
and qword [rsp + 0x20], 0
mov dword [rbp + 0x720], 0x3e8
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rcx, qword [rbp + 0x728]
test eax, eax
je 0x140001040
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
lea rdx, str.SOFTWAREdialerconfig
mov r8d, 0xf013f
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
add rsp, 0x810
pop rbp
ret
add qword [rsp + 0x38], 0xffffffffbffe4a3a
add qword [rsp + 8], 0xffffffffbff20da2
not qword [rsp + 0x30]
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x40]
ret
test r15w, r15w
lea rbx, [rbx + 0x56852710]
jo 0x14004bb11
jg 0x14001f35a
add rdx, rdx
mov qword [rsp + 0x48], rdx
or word [rsp + 0x10], 0x6e3e
xchg qword [rsp + 0x58], rbx
mov r15, qword [rsp + 0x18]
movabs rdx, 0x258ec53cfe98b7ad
jg 0x140001045
setbe dl
add dword [rsp + 0x10], 0x74afa2b7
xor dx, word [rsp + 0x4c]
sub byte [rsp + 0x10], dl
mov rdx, qword [rsp + 0x40]
call fcn.1400961f8
Function at 0x140064efc
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
shr qword [rsp + r15 - 0xd38a53b], 0x6b
add byte [rsp + r15*4 - 0x34e29564], 0x14
setb r15b
test dword [rsp + 0x28], 0x1f0c1c89
setne r8b
test word [rsp + 0x28], r15w
mov r15, qword [rsp + r15 - 0xd38a4c0]
lea r8, [r8 + riz + 0x61af83ba]
jae 0x1400a315a
jb 0x140075585
lea r12, [r15*4 + 0x57b2a82a]
neg r12d
xchg qword [rsp + 0x48], rdx
mov r12, qword [rsp + 0x20]
jno 0x1400136c7

Function at 0x140072453
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
bswap rdi
lea rsi, [rsi + 0x901497]
call fcn.140083f7f

Function at 0x140074177
Capabilities:
Set registry value

Disassembly:
movabs r10, 0x92ac2a3b2a4eb0
mov dword [rsp + 0x18], 0x51b555ae
sub r14, 0x66ba5a85
sub r14, 0x4844039
ja 0x140071567

Function at 0x140077624
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], r15
add qword [rsp], 0xffffffffbff26e2c
neg r13
push rbp
push r12
lea rax, [rax + 0x4a2e553c]
jno 0x14001e47a
je 0x14009c511
or al, 0xa0
or al, 0xa0
in eax, 0xa9
movsd dword [rdi], dword [rsi]
mov ah, 0x16
adc dh, 2
push rdi
xor ebp, dword [rdi]
scasb al, byte [rdi]
in al, dx
movabs byte [0xf03e6cc5d91d58e4], al
mov dh, 0x22
ja 0x14009c4c6
invalid
jmp qword [rsi - 0x2f4b1d0c]
cmp edx, eax
pop rsi
outsd dx, dword [rsi]
sti
sbb byte [rbx], bl
xchg ebp, eax
mov esi, 0xb23caa3e
adc dword [rdi], 0x7c
push rax
and al, 0xb5
jl 0x14009c4db
xor eax, 0x57af9d06
or dword [rdx], ecx
rcl dword [rax + rax], 0xd
sbb dword [rbp + 0x611b0412], ebx
sahf
hlt

Function at 0x140078af7
Capabilities:
Set registry value

Disassembly:
setne r10b
jns 0x140056ab4
movsb byte [rdi], byte [rsi]
mov eax, 0x4c5549fd
invalid

Function at 0x14007abac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jle 0x1400d9a33
mov r15w, word [rsp + r15 - 0x30]
mov r15, qword [rsp + r15*2 - 0x1d598]
add qword [rsp + 0x40], 0x27534
not dword [rsp + 0xa0]
call fcn.140072713

Function at 0x14007ac8a
Capabilities:
Encode data using base64

Disassembly:
neg byte [rsp + 0x40]
test qword [rsp + 0x40], r10
lea rax, [rax + r10*8 - 0x546a6cd]
push r14
mov qword [rsp + 0x20], rdx
push rdx
push r10
lea rdx, [r10 + riz - 0x515a25f1]
jae 0x1400d8719
add qword [rsp + r10 - 0xa8], 0xffffffffbfff867e
or word [rsp + r10*4 - 0x2a8], 0xca8d
xchg qword [rsp + 0x78], rax
mov r13, qword [rsp + rdx + 0x515a2591]
bswap r10d
movsx dx, r10b
sub r14w, 0x109c
mov r10, qword [rsp + 0x38]
not dword [rsp]
neg rdx
cmp byte [rsp + rdx - 0x515afff8], r14b
mov r14, qword [rsp + rdx - 0x515affc0]
jle 0x1400959b4
retf
Function at 0x140082767
Capabilities:
Set registry value

Disassembly:
adc eax, 0x2493d3
mov ecx, eax
call fcn.1400017f8
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREdialerconfig
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000260d
lea r9, [rbp + 0xb0]
mov qword [rbp + 0xc8], rdi
lea r8, [rbp + 0xc8]
mov dword [rbp + 0xb0], edi
lea edx, [rax + 1]
lea rcx, str.D:_A_OICI_GA___AU__A_OICI_GA___BA_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov ebx, 4
test eax, eax
je 0x140002587
mov r8, qword [rbp + 0xc8]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rdi
lea rdx, [0x140003330]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], edi
add qword [rsp], 0x52f51
shr qword [rsp + r14 - 0x689a01f1], 0xad
js 0x1400024e4
neg r14w
call fcn.1400d2283
sete r14b
mov r10, qword [rsp + 0x20]
mov qword [rsp + 0x20], rax
jb 0x140070000
cmp dword [rsp + r14 - 0x689a01f1], 0xf12d320
ja 0x14004cb49

Function at 0x140084758
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov r9, qword [rsp + r9*4 + 0x20]
sub qword [rsp + 0x28], 0x2d9e780e
js 0x140057214
mov qword [rsp + 0x40], 0xffffffffcb32d684
jle 0x140001170
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x60]
ret

Function at 0x140085a55
Capabilities:
Enumerate process modules

Disassembly:
adc eax, 0x249031
xor edi, edi
lea r8, [rbp + 0x380]
mov rcx, rax
mov dword [rbp + 0x380], edi
mov edx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140002c00
mov ecx, dword [rbp + 0x380]
shr ecx, 2
mov dword [rbp + 0x380], ecx
test ecx, ecx
je 0x140002c00
mov eax, edi
mov r9d, 1
mov ecx, dword [rbx + rax*4]
call fcn.1400010c0
inc edi
cmp edi, dword [rbp + 0x380]
jb 0x14000289f
jmp 0x140002c00
mov rbx, qword [rsp + 0x488]
add rsp, 0x450
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
ja 0x14000285e
movabs r14, 0x3ab2a145b808f24

Function at 0x1400860dd
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
shl dword [rsp + 8], 0xe7
jb 0x14009482d
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x50]
ret
setne r11b
call fcn.1400cf4e6
jo 0x1400b24b8
jne 0x1400ccecb
jb 0x14008ad44
movsx r15d, r15w
Function at 0x140086603
Capabilities:
Create thread
Resolve function by parsing pe exports
Set registry value

Disassembly:
lea rdx, [rdx + r13*8 - 0x5daefc1a]
bswap ecx
shl byte [rsp + 0x18], cl
jne fcn.1400df6a0
shl dword [rsp + 0x18], cl
push 0xffffffffc13a598a
xchg qword [rsp + 0x50], rdx
mov r12, qword [rsp + 0x30]
shl word [rsp + 0x20], cl
shr r13, cl
sub r13b, r13b
je 0x1400d7588
not rcx
not cl
mov r12w, 0x369a
mov qword [rsp + r13 - 0xdebffb3], rcx
jns 0x140060cb3
mov di, cx
mov rbx, qword [rsp + 0x30]
add cx, 0x4f9e
lea rcx, [rdi*2 - 0x42723dd5]
movabs r14, 0xde330d2f05af7c19
mov dil, cl
jns 0x14007415f
neg di
not edi
or byte [rsp + r13*8 + 0x20], 0x86
je 0x1400c699a
add qword [rsp + r13*8 + 0x28], 0xffffffffbffe96cc
lea r13, [r13*4 - 0x587d745c]
mov rcx, qword [rsp + 0x40]
shl qword [rsp + r13 + 0x587d745c], 0x48
call fcn.1400a0bc7

Function at 0x140093fd7
Capabilities:
Connect pipe

Disassembly:
sub dword [rsp + 0x18], 0xd09d6102
call fcn.1400860dd
call fcn.1400cbf5c
mov rbx, rdi
call fcn.14007e22b
push rdx
movabs rdx, 0x95abe2b7bb19dd8c
mov rdx, qword [rsp]
mov qword [rsp], 0x44d918ef
call fcn.1400e7143
jae 0x14006de81
test byte [rsp + r15*2 - 0x9a], r12b
lea r12, [r13*4 - 0x5e4b624f]
mov r15, qword [rsp + r15*2 - 0x32]
movzx r9w, byte [rsp + 0x1d]
js 0x1400098e7
mov r9, qword [rsp + 0x70]
add qword [rsp], 0xffffffffbffa40ad
sub r12, 0x4a22d0b
test qword [rsp + 0x18], r13
mov r12, qword [rsp + 0x30]
call fcn.1400a01a2
mov r10, r14
xchg qword [rsp + r10 + 0x63655c66], rdi
mov r10, qword [rsp + r10 + 0x63655c46]
or dword [rsp + r14 + 0x63655c3e], r14d
or r14d, r14d
call fcn.140061bb5
sar byte [rcx - 0x10b4e215], 0x9a
retf 0x153
call fcn.1400d16a6
mov rbx, qword [rsp + 0x28]
not qword [rsp + 0x40]
shl dword [rsp + 0x20], 0x2e
ja 0x1400899cd

Function at 0x140095965
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rsp + 0x28], 1
add qword [rsp + 0x20], 0xffffffffbff5e8cd
mov dword [rsp + 0x28], 0x463c1735
add qword [rsp + 0x28], 0x749d0007
call fcn.1400b9e6c
cdqe
int 0xa9
mov ch, 0xa4
invalid
mov r9, rbp
add qword [rsp + 0x18], 0xfffffffffffcc038
cmp bp, 0xbb26
js 0x14004ee5f
jg 0x1400c6abd
mov r14, qword [rsp + 0x40]
jge 0x14005f75f
jae 0x1400831c5
mov rdx, qword [rsp + rbp*8 + 0x7231d5c0]
mov qword [rsp + 0x20], rax
setl bpl
push r9
jae 0x14008dc79
neg r8d
mov rcx, qword [rsp + 0x10]
mov r8w, r12w
sub r12, r14
jg fcn.140085421
movzx r12d, r8w
cmp r8w, 0x8104
jg 0x1400d6784
mov byte [rsp + rdx - 0x515b0000], dh
shl dl, 0xb8
mov word [rsp + rdx - 0x515b0000], 0x1abc
shr dword [rsp + rdx - 0x515afff0], 0xb7
mov byte [rsp + rdx - 0x515b0000], 0x34
shr qword [rsp + rdx - 0x515affd0], 0x14
mov rdx, qword [rsp + rdx - 0x515affb8]
shl qword [rsp + 0x58], 0xb4
sete byte [rsp + 8]
not word [rsp + 8]
jb 0x1400b6ab3
add dword [rsp + 0x30], 0xe307ec90
shl word [rsp + 8], 0x3a
push qword [rsp + 0x68]
popfq
lea rsp, [rsp + 0x78]
ret

Function at 0x1400984fd
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rcx, qword [rsp + rcx*2 + 0x33e1c512]
mov qword [rsp + 0x18], rdx
js 0x1400a634e
xor ecx, ecx
or rcx, 0xffffffffe60f1d83
jae 0x14007133c
Function at 0x1400a010c
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
or cx, 0x8e19
add qword [rsp], 0xffffffffbff28276
add ecx, 0x2b16005
cmp cl, 0x8d
mov rcx, qword [rsp + rcx*2 - 0x7b89ddf4]
mov rcx, qword [rcx]
call fcn.140099980

Function at 0x1400a0133
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
lea rcx, str..pipedialerchildproc64
call fcn.140001c64
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002db1
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002d91
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x140002e0f
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002e1a
mov ecx, dword [rsp + 0x60]
call rdi
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, 1
mov byte [rsp + 0x58], 0x4d
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140002e1a
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x140002db1
lea rdx, [rdx*2 + 0x28202a98]
call fcn.14005d5e2
adc eax, 0xd6807634
xchg edx, eax
cmpsd dword [rsi], dword [rdi]
invalid
jbe 0x140002da9
jle 0x1400879dd
movabs rdi, 0x61b5e2bb5cadf5a3
mov qword [rsp + 0x38], rcx
cmp edi, 0xd60fac99
push r9
js 0x1400d4225
call fcn.1400644b3

Function at 0x1400a103d
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
and byte [rsp + rdi + 0x38], 0x1b
jbe 0x1400dd66c
mov rdi, qword [rsp + rdi + 0x40]
call fcn.140053c97

Function at 0x1400a1058
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
xor r9b, r9b
mov r9, qword [rsp + 0x10]
xor word [rsp + 0x38], 0x58b4
shr qword [rsp + 0x38], 0x35
je 0x1400ac837
jb fcn.140061bb5
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x50]
ret
not r12d
bswap r9
neg r12d
add qword [rsp], 0xffffffffbff9e3aa
xor r9b, byte [rsp + 0x3c]
xchg qword [rsp + 0x50], rsi
mov r12, qword [rsp + 0x20]
and r9w, r9w
xor dword [rsp + 0x38], r9d
add r9b, r9b
sub r9, qword [rsp + 0x38]
jbe 0x1400210d0
sub dword [rsp + 0x30], edi
jno 0x1400c0d8a
push r8
movabs r8, 0x7201c3862c14979c
call fcn.14008b9b5
out 0x2c, eax
and dword [rax], eax
add byte [rax], al
xor dl, dh
add byte [rax], al
add byte [rax], al
sub byte [rsi - 0x7eb7fff5], dh
invalid
invalid
and al, 0
loopne 0x1400ac899
invalid
and edx, ebp
test rbx, 0xffffffffa018080e
mov byte [rsp + 0x38], 0xb1
mov rbx, qword [rsp + 0x30]
call fcn.140007f94

Function at 0x1400a1090
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
seto byte [rsp + 0x18]
neg r13b
jae 0x1400921f7
or r13b, 0xa6
push r13
jb 0x140002150
mov r13w, 0x7e34
Function at 0x1400a4be2
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
shr r10w, 0xe5
push r15
mov r10w, 0x31be
jb 0x1400827ca
push rbx
movabs rcx, 0xe51e46b95e33ce14
mov rcx, qword [rsp + 0x18]
mov rcx, qword [rcx + r10 - 0x432e31be]
mov r15, r10
setb r10b
mov rbx, r10
lea rcx, [rcx + rbx - 0x7780a269]
mov qword [rsp + r15 - 0x432e31a6], rbx
mov rbx, r15
test qword [rsp + r15 - 0x432e31a6], rbx
push r12
call fcn.140086137

Function at 0x1400a4c38
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
test rsi, rsi
mov qword [rsp + 0x38], rsi
call fcn.14009d42e

Function at 0x1400a4c45
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
movabs r11, 0x39b472bbeb28282
movabs rax, 0xd7b60c8c8ebed72f
push rbp
shr r11w, 0x2b
call fcn.140071e23
jne 0x140060652
shr cl, 0x7b
push r11
mov rsi, qword [rsp + rcx*2 + 0x10]
mov rsi, qword [rsi]
mov qword [rsp + 0x10], rcx
or ecx, dword [rsp + rcx + 0x12]
or rdi, rcx
lea rsi, [rsi + rcx + 0x7c35c3a9]
sub word [rsp + rcx*8 + 0x10], 0xb504
sub di, 0xa78b
call fcn.14009de82
mov dil, byte [rsp + r15 - 0x5d4580f4]
add qword [rsp + rdi*2], 0x258df
bswap r15
add qword [rsp + 8], 0x40be63ad
shl edi, 0x3c
lea rcx, [rcx - 0x47d7bfec]
bswap edi
jne 0x14007137c
mov qword [rsp + 0x10], r15
and word [rsp + rdi*2 + 8], r15w
call fcn.140099e96
mov rcx, qword [rsp + r15 - 0x5d45813b]
shr edi, 0xb3
test dword [rsp + rcx - 0x5d458139], r15d
setl r15b
mov rcx, qword [rsp + r15 - 0x5d4580f0]
mov rcx, qword [rcx + r15 - 0x5d458100]
ja 0x14007240e

Function at 0x1400aa0aa
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
bswap r8d
jl 0x14000d078
lea rax, [rax + 1]
mov r8b, bpl
and bp, bp
push rbp
call fcn.14002f133

Function at 0x1400ac8ed
Capabilities:
Connect pipe

Disassembly:
call fcn.1400201d6
push rdx
setbe r8b
lea rax, [rax + 0x4c2f38b8]
setg byte [rsp + 0x40]
movabs rdx, 0xde2aa798f52c3c05
movzx di, dil
movzx edi, r8b
movabs rcx, 0x1085ea229f9aad2b
neg dx
add qword [rsp + 8], 0xfffffffffffffba1
test dword [rsp + 0x40], 0x313ea1b
xchg qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp]
lea rsp, [rsp + 8]
ret 8
and rcx, rcx
lea rcx, [r14 + r14*2 - 0x12eff26b]
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rcx]
jb 0x1400a7e34
and r14d, r14d
xor r14, 0x75919d0b
shr r14w, 0x1c
lea rcx, [rcx + r14*2 - 0x2834d4c6]
test r14b, 0xac
setae r14b
movabs r14, 0xda98d9206abaa60d
shl r14w, 0x10
jne 0x14006de7c
or r14w, r14w
neg r14b
test r14d, r14d
xchg qword [rsp + 0x28], rcx
mov r14, qword [rsp + 0x20]
je 0x14009f068
call fcn.1400c8439

Function at 0x1400b1bc3
Capabilities:
Encode data using xor

Disassembly:
pushfq
add qword [rsp + 8], 0xfffffffffffb9cfb
nop
movabs rax, 0x7a0dfab097bc79bc
call fcn.1400bbaab
adc bh, cl
sbb edx, eax
stosb byte [rdi], al
movabs byte [0xa821cd71c4404ba9], al
cli
xchg esp, eax
rol byte [rsi + 0x3a0b17d3], cl
pop rax
outsb dx, byte [rsi]
cmp ah, al
or dword [rbp - 0x7be5b77f], 0x675326c2
jnp 0x1400b1c35
invalid
invalid
Function at 0x1400b808e
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Resolve function by parsing pe exports
Resume thread
Terminate process
Use process replacement

Disassembly:
xor r15b, 0x17
xor word [rsp + 0x20], 0xb709
jno 0x1400781b4
add qword [rsp + r9 - 0x634affe8], 0x3fcb0
call fcn.14006b174
push rax
call fcn.1400638ea
invalid
mov r15, qword [rsp + 0x28]
or qword [rsp + 0x38], 0xffffffffcb083b9b
shl word [rsp + 0x20], 0x34
xor dword [rsp + 0x20], 0xef974414
not dword [rsp + 0x38]
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x68]
ret
not r13d
mov r13, qword [rsp + r13*8 - 0x790]
jo 0x140052987
jl 0x14004fd84
cmp dl, 0xae
call fcn.1400d02ca

Function at 0x1400b9181
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
neg r10d
jl 0x1400860ba
jb 0x1400cf17a
mov rdx, qword [rsp + 0x58]
mov rdx, qword [rdx]
sub dword [rsp + rbx*8 + 0x1e810], 0x82a3458b
mov r10, rbx
jge 0x1400e00ba
cmp bx, word [rsp + 0x24]
js 0x140012870
lea rdx, [rdx + r10 - 0x16705fe0]
je 0x14009fe61
mov qword [rsp + rbx + 0x3d58], r10
setle byte [rsp + r10 + 0x3d20]
call fcn.140093f0f
pop rax
or eax, 0xe6c1d71
invalid

Function at 0x1400bc056
Capabilities:
Connect pipe

Disassembly:
mov rsi, qword [rsp + rsi*8 - 0x21f8b7f8]
mov rsi, qword [rsi]
js 0x1400ce5ed
neg r9b
add r9w, r9w
test r9w, r9w
call fcn.14006de44
nop
and dword [rax], eax
add byte [rax], al
invalid
add qword [rsp], 0x3fe32
push r9
movabs rsi, 0xf31c443329043f17
shl esi, 0x48
movabs r9, 0x5b3ce684f187d02a
jb 0x14006895a

Function at 0x1400bf04b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
add byte [rsp + r15*2 + 0x26], 0x26
call fcn.1400ac025
jb 0x1400a1082
mov r9, qword [rsp + r9 - 0x3113a8c1]
jae 0x14009f7d4

Function at 0x1400c98b9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
pushfq
movabs rbp, 0x5133a9e4abe22b2
xchg qword [rsp + 0x28], rax
movabs rdx, 0x3d936e3e608c4c87
movzx ebp, bpl
cmp bpl, 0x9d
lea rbp, [rbp + riz - 0xe463b66]
lea rdx, [rdx + rbp*2 - 0x64598cfa]
jae 0x140095976

Function at 0x1400cbf5c
Capabilities:
Connect pipe
Read file on windows

Disassembly:
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1400022fd
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002308
cmp dword [rsp + 0x48], 4
jne 0x140002308
mov ecx, dword [rsp + 0x50]
mov rdx, rbx
call rdi
jmp 0x140002308
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x1400022b9
js 0x1400022be
xor qword [rsp + 0x68], 0x490dc58f
push qword [rsp + 0x70]
popfq
lea rsp, [rsp + 0x80]
ret

Function at 0x1400cd326
Capabilities:
Encode data using xor

Disassembly:
lea rsi, [rsi + 1]
not cx
jbe 0x1400b15a4
shr ecx, cl
shl cx, 0xea
mov ecx, 0x933e5fb4
mov qword [rsp + 0x20], rsi
jne 0x1400d4ae0
call fcn.1400b4008
mov cl, 0xb3
shr cl, 0x74
shl cx, 0xc5
add ecx, ecx
neg rcx