joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1807bb66c
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rdi + r14 - 0x5dd]
jne 0x1806aca5a
neg r10w
sub r10w, dx
add r10w, 0x2150
setne dl
neg r10b
mov qword [rsp + rdx - 0x6d400df1], r10
push rcx
jae 0x1805f4ce3
xchg qword [rsp + rdx - 0x6d400dc9], rbp
mov r10, qword [rsp + r10*8 - 0x9e60]
neg rdx
add qword [rsp + rdx + 0x6d400e11], 0x7f835661
movabs rcx, 0x18b548f72e4178e3
or dl, byte [rsp + 0x18]
shr edx, cl
mov rdx, qword [rsp + 0x20]
shl ecx, 0x28
pop rcx
call fcn.18029adcf
invalid

Function at 0x1807c5764
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + rbp - 0xd1e4bc2], rax
mov rbp, qword [rsp + 0x28]
jns 0x180278277

Function at 0x1807d84cc
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
not r12
bswap r12d
lea rdx, [rdx + 0x625561fd]
mov qword [rsp + 0x18], r12
and byte [rsp + 0x18], r12b
neg r12w
jns 0x180191572
shr r12b, 0x31
cmove r12d, dword [rsp + 0x18]
add qword [rsp], 0x7fdef22b
cmp r12d, dword [rsp + 0x18]
xchg qword [rsp + 0x20], rdx
mov r12, qword [rsp + 8]
jg 0x18022ed92
call fcn.1806f02ac
or al, byte [rbx - 0x372f805f]
pop rax
pop rcx
mov r11d, 0x53c00c23
and bl, byte [rdx]
invalid
shl r12d, 0xdc
add r12d, 0x7cc02189
shr r12w, 0x9b
jns 0x1804efa21

Function at 0x1807ef4de
Capabilities:
Packed with generic packer

Disassembly:
xor edx, edx
and edx, 0x422275d9
movabs rdi, 0x4e375d4d382d55d7
push r11
add qword [rsp + 0x40], 0x3976ba
shr r9, 0x3c
mov edi, 0x19867545
and rdx, 0x75fa5070
call fcn.18038e6df

Function at 0x180828b12
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + 0x68], rax
mov r12, qword [rsp + 0x30]
mov r13, qword [rsp + 0x40]
mov bx, 0x1ccf
cmove r13w, word [rsp + 0x45]
sub r8d, dword [rsp + r13*2 - 0x1623ffbd]
movsx rbx, r11b
lea r11, [rbx*4 + 0x160916cd]
shr word [rsp + r13 - 0xb11ffc0], 0xb3
shr r13w, 0xa
movzx r11, r13b
mov r11, qword [rsp + r8 - 0x41ef02fd]
ja fcn.180524114
movzx r8, byte [rsp + r13 - 0xb11ffc0]
Function at 0x140001000
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
lea rbp, [rsp - 0x710]
sub rsp, 0x810
lea rax, [rbp + 0x728]
mov r9d, 0xf013f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREdialerconfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001099
jmp 0x14000104b
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
invalid
and qword [rsp + 0x38], 0
lea r9, [rbp + 0x720]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x40]
and qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rbp + 0x728]
and qword [rsp + 0x20], 0
mov dword [rbp + 0x720], 0x3e8
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rcx, qword [rbp + 0x728]
test eax, eax
je 0x140001040
invalid
invalid
or eax, 0x24

Function at 0x1400010c0
Capabilities:
Allocate or change rwx memory
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4b0
mov eax, dword [0x140005010]
lea rdx, [rbp + 0x400]
mov rdi, qword [0x140005008]
mov r14d, ecx
mov dword [rsp + 0x60], eax
xor ebx, ebx
call fcn.1400019ac
test eax, eax
je 0x1400014c5
cmp dword [rbp + 0x400], ebx
je 0x1400014c5
mov r8d, r14d
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400014c5
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
mov r15d, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]

Function at 0x1400014e4
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x148]
sub rsp, 0x248
mov ebx, 1
xor r14d, r14d
mov dword [rbp + 0x1a8], ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, 0x9c40
xor edx, edx
mov rcx, rax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
and dword [rsp + 0x30], r14d
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x13880
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
and dword [rbp + 0x1a0], r14d
lea r8, [rsp + 0x30]
mov edx, edi
mov rcx, r15
mov r12, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]

Function at 0x1400017f8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14d, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x3e80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], 0x3e8
mov rcx, rax
mov rbp, rax
call fcn.1400014e4
test eax, eax
je 0x140001891
mov ecx, dword [rsp + 0x48]
test ecx, ecx
je 0x140001891
mov rbx, rbp
mov edi, ecx
Function at 0x140001a44
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp + 0x18], r8d
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov r14, rdx
mov edi, ebx
mov rbp, rcx
mov rsi, rdx
mov eax, edi
lea r9, [rsp + 0x60]
mov r8d, 2
mov qword [rsp + 0x20], rbx
mov rcx, rbp
lea rdx, [r14 + rax*2]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001aac
cmp dword [rsp + 0x60], 2
jne 0x140001aac
cmp word [rsi], bx
je 0x140001aa7
inc edi
add rsi, 2
cmp edi, 0x105
jb 0x140001a68
jmp 0x140001aac
mov ebx, 1
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x140001c64
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
xor esi, esi
mov word [rbp + 0x73], 0x100
lea rax, [rbp + 0x7f]
mov dword [rbp + 0x6f], esi
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov dword [rsp + 0x48], esi
lea rcx, [rbp + 0x6f]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], esi
xor r8d, r8d
mov dword [rsp + 0x30], esi
mov dl, 1
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140001d9c
lea rax, [rbp + 0x17]
mov qword [rbp + 0x77], rax
lea ecx, [rsi + 0x30]
mov rax, qword [rbp + 0x77]
mov byte [rax], sil
mov rax, qword [rbp + 0x77]
inc rax
mov qword [rbp + 0x77], rax
sub rcx, 1
jne 0x140001ccc
mov rax, qword [rbp + 0x7f]
lea r9, [rbp - 9]
xor r8d, r8d
mov dword [rbp + 0x17], 0x1f01ff
lea rdx, [rbp + 0x17]
mov qword [rbp + 0x1b], 2
mov dword [rbp + 0x33], esi
mov dword [rbp + 0x37], 5
lea ecx, [r8 + 1]
mov qword [rbp + 0x3f], rax
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x140001d9c
lea edx, [rax + 0x28]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140001d9c
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x140001d9c
mov r8, qword [rbp - 9]
xor r9d, r9d
mov rcx, rbx
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x140001d9c
lea rax, [rbp - 1]
mov dword [rbp - 1], 0x18
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov eax, 0x400
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
mov r9d, 0xff
mov rcx, rdi
mov dword [rsp + 0x20], eax
lea edx, [r8 + 3]
mov qword [rbp + 7], rbx
mov dword [rbp + 0xf], esi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
jmp 0x140001da0
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002078
Capabilities:
Read file via mapping

Disassembly:
test rcx, rcx
je 0x14000228a
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rbx, rcx
lea rdx, [0x140003470]
lea rcx, [rsp + 0x60]
xor r13d, r13d

Function at 0x140002328
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x90]
sub rsp, 0x190
lea rcx, str.ntdll.dll
call fcn.140002078
mov edx, 0x11c
lea rax, [rsp + 0x70]
mov ecx, edx
mov qword [rbp + 0xc0], rax
xor edi, edi
mov rax, qword [rbp + 0xc0]
mov byte [rax], dil
mov rax, qword [rbp + 0xc0]
inc rax
mov qword [rbp + 0xc0], rax
sub rcx, 1
jne 0x14000235c
mov dword [rsp + 0x70], edx
mov r8b, 3
lea edx, [rcx + 2]
mov qword [rsp + 0x74], 0xa
mov word [rbp + 0x84], di
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov edx, 0x23
lea rcx, [rsp + 0x70]
mov r8, rax

Function at 0x140002c18
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 8], ecx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
lea rcx, str..pipedialercontrol_redirect64
and dword [rax - 0x20], 0
mov edi, r8d
mov rsi, rdx
mov dword [rax - 0x28], 3
xor r8d, r8d
mov edx, 0xc0000000
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002cad
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
je 0x140002ca4
test edi, edi
je 0x140002ca4
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140007667
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
mov r12, qword [rsp + r12 + 0x211e45d]
jo fcn.1400a8416
test byte [rsp + 0x50], 0x12
mov word [rsp + 0x38], 0xbb90
setb byte [rsp + 0x38]
jne 0x1400c4d2b
add byte [rsp + 0x60], 0x12
shr word [rsp + 0x50], 0x7d
call fcn.1400c5399

Function at 0x14000d343
Capabilities:
Set registry value

Disassembly:
jae 0x1400dbdf6
mov qword [rsp], 0x5807a3fd
call fcn.1400e1ab1
movabs eax, dword [0x48bb234aa023aed3]
add dword [rsp], 0xfff682e3
Function at 0x140010d47
Capabilities:
Packed with generic packer
Set registry value

Disassembly:
add qword [rsp], 0x186e8
mov rax, rbx
or bx, 0x70a9
cmp rax, 0x3d881a8c
push r9
push r8
push r13
mov rax, qword [rsp + rax - 0x781b77e8]
mov rax, qword [rax + rbx - 0x781b78a9]
mov ebx, 0x4998d907
movabs r8, 0x4dbd3781c0b8609f
js 0x14006630d
jbe 0x1400cf32d
movzx r8, bx
movabs r13, 0xa99ff8819d3ab8b6
lea rax, [rax + r8 - 0x1ce5bc59]
call fcn.14004f6f4
not r15w

Function at 0x140011bc9
Capabilities:
Delete registry key
Query or enumerate registry key
Set registry value

Disassembly:
jno 0x1400d7065
jne 0x14000d2ee
clts
add byte [rdi], cl
invalid
mov ebx, dword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rbx, qword [rbx]
mov r9, qword [rsp + 0x30]
setns r14b
cmovle r12w, r14w
mov r12b, 0xa1
or r14b, byte [rsp + 0x36]
not qword [rsp + 0x18]
and r9d, 0x8c068a1a
mov qword [rsp + 0x20], r15
lea rbx, [rbx + 0x608a8890]
sub r12b, byte [rsp + 0x1b]
jg 0x14000d2c5
seta bpl
shl bpl, 0x6b
je 0x140098fba
call fcn.140082d05
add word [rsp + 0x10], 0xc990
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x40]
ret 8
cmp bp, 0x630d
not bp
mov r13, qword [rsp + 0x38]
call fcn.1400b1768
test rdi, r13
mov edi, r13d
jle 0x1400d2405
or r13, 0x59b9e12d
add qword [rsp + 8], 0xfffffffffff54720
shr dil, 0xa8
mov dil, r13b
add edi, 0x3415f10b
seta dil
push rsi
push r8
mov rcx, qword [rsp + rdi - 0x46321de9]
mov rcx, qword [rcx + rdi - 0x46321e01]
lea r13, [rdi + rdi*8 + 0x6b959434]
and edi, 0x6089d491
mov qword [rsp + 0x18], rdi
je 0x14006c600
movabs r8, 0xb393ba2ead81c521
not rdi
mov rsi, qword [rsp + 0x18]
lea rcx, [rcx + rdi - 0x34fadcec]
add qword [rsp + 0x10], 0xffffffffbfff677a
neg sil
xor r13b, 0x37
call fcn.1400888a7

Function at 0x140011c1b
Capabilities:
Set registry value

Disassembly:
jg 0x1400c0e04
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + riz]
call fcn.140063e7c
push r15
movabs r15, 0x6c074eac8121aa8f
xchg qword [rsp + 0x48], rdi
mov r9, qword [rsp + 0x18]
shr dword [rsp + 0x30], 0xc8
not r15d
neg r15
jg 0x14006482d
je 0x140007517
call fcn.140093228
lea rdi, [rdi + 0x4a1a668a]
or r9d, 0x2e3ec880
cmp word [rsp + 0x28], 0xc589
js 0x140058a49
adc eax, 0x40821
or byte [rbp + rax], dh
add al, 0x34
or eax, 0xf24e00
add byte [rax - 0xe], bh
add byte [rax], al
je 0x1400c0e36
add dword [rax], eax
and eax, 0x3f818eec
test byte [rax - 0x2f5e178b], bl
cli
inc dword [rcx - 0x80]
xor r11b, 0xa0
lea rcx, [rcx + 1]
xor bp, 0x842a
and ebp, 0x75004ebd
invalid
xchg dword [rax], esi
invalid
test dword [rsi + 0x6934ae1d], esi
test al, 0xeb
js 0x1400c0ead
fld dword [rbp + rax - 0x1b195afa]
stc
jnp 0x1400c0ead
jmp 0xdd92e477
cli
xor dl, cl
xor dh, al
cmp byte [rsi - 0x40], al
invalid
Function at 0x140014605
Capabilities:
Enumerate process modules

Disassembly:
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edi, edi
lea r8, [rbp + 0x380]
mov rcx, rax
mov dword [rbp + 0x380], edi
mov edx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je fcn.140002c00
mov ecx, dword [rbp + 0x380]
shr ecx, 2
mov dword [rbp + 0x380], ecx
test ecx, ecx
je fcn.140002c00
mov eax, edi
mov r9d, 1
mov ecx, dword [rbx + rax*4]
call fcn.1400010c0
inc edi
cmp edi, dword [rbp + 0x380]
jb 0x14000289f
jmp fcn.140002c00
xchg qword [rsp + 0x28], rbp
cmp r15, 0xffffffffb7359537
jge 0x14002f2a0
jl 0x14000285d
not r9d
add qword [rsp], 0xfffffffffffd0296
ret 8

Function at 0x1400168a4
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
jbe 0x140057e74
mov qword [rsp + 0x28], rsi
add qword [rsp], 0x591cf
xor qword [rsp + 0x18], 0x82790d
test word [rsp + 0x18], 0x9d8b
jge fcn.1400b8102

Function at 0x14001d290
Capabilities:
Delete registry key
Encode data using base64
Get token privileges
Packed with generic packer
Query or enumerate registry key

Disassembly:
sub cx, 0xcc9d
and rcx, 0xffffffffd8a7380a
shl rcx, 0x91
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rcx]
jb 0x140022f02
mov qword [rsp + 0x10], 0x69281ab1
push rsi
mov rsi, qword [rsp + 0x18]
shr si, 0x52
lea rcx, [rcx - 0x38d2a360]
push rdx
jne 0x1400d834d
push rcx
call fcn.14006b196
mov rdx, qword [rsp + r9 - 0x1e7]
mov rdx, qword [rsp + rdx*2 - 0x500edb0e]
mov rdx, qword [rdx + r9*2 - 0x3de]
call fcn.14007bb50

Function at 0x14001d9e9
Capabilities:
Set registry value

Disassembly:
jbe 0x14004f72f
js 0x1400a13f0
syscall
call fcn.140071db0
add qword [rsp + rbp + 0x1cc2755b], 0x265f
test r12w, r12w
jo 0x14002677f
mov qword [rsp + rbp + 0x1cc27583], rbx
or byte [rsp + rbp + 0x1cc27563], bpl
ja 0x1400662fe
sub r12b, r12b
setne r12b
jl 0x1400dd755
nop
push rsi
push 0xffffffffb488a631
shr rbp, 0x18
push r10
ja 0x140094aad
lea r13, [r14*4 - 0x24804c3]
xchg qword [rsp + 0x68], rsi
mov rdi, qword [rsp + r13 + 0x2457dfb]
jbe fcn.1400cbb57
shl r13d, 0xa4
mov r11, qword [rsp + 0x60]
or qword [rsp + 0x60], 0x4c96e4ba
xor r14b, r14b
test r14b, r13b
ja fcn.14000fce0
mov r13, qword [rsp + 0x38]
sub r14b, r14b
cmp r11d, r14d
movsx r14d, byte [rsp + 0x63]
setg r11b
lea r14, [r14 + r11 + 0x5f068d06]
lea r11, [r11 + r14*4 - 0x6677e0f3]
shr qword [rsp + 0x60], 0xf3
mov r11w, r14w
mov r14, qword [rsp + 0x50]
test r11b, 0xaf
not qword [rsp + 0x60]
mov r11b, byte [rsp + 0x66]
call fcn.1400783a3
and bx, 0xe82a
push r9
xor r10b, dil
push rdi
mov qword [rsp + 0x40], rax
push rdi
jbe 0x1400904fa
call fcn.140053844
xchg qword [rsp + 0x20], rax
push rcx
call fcn.140051d84
Function at 0x1400216ac
Capabilities:
Terminate process

Disassembly:
mov r14, qword [rsp + r14 - 0x2a0411fd]
jo 0x1400b2db5
call fcn.1400c4f00
invalid
lea rdx, [rdx - 0x66dc3ad0]
and byte [rsp + rbx*4 + 0x10], dil
movabs r9, 0xf02a5c18353a368e
call fcn.14004f6a7
pop rsi
int 0xcc
iretd
push r15
lea rdx, [rdx + r14 - 0x407bc5c3]
movabs r15, 0x9e1a62b1e92e222f
push rdx
push rbx
jne 0x1400add8b
movabs rdx, 0x68b42eb5d787ef08
shr r10b, 0xaf
mov rdx, qword [rsp + 8]
xchg qword [rsp + 0x50], rdx
mov r10, qword [rsp + 0x20]
movzx r15w, r14b
movabs rbx, 0xd50a919c3a3ae639
test word [rsp + 0x40], bx
call fcn.14001392d
add word [rsp + 0x70], 0xfa08

Function at 0x14002f2a0
Capabilities:
Enumerate process modules

Disassembly:
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edi, edi
lea r8, [rbp + 0x380]
mov rcx, rax
mov dword [rbp + 0x380], edi
mov edx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je fcn.140002c00
mov ecx, dword [rbp + 0x380]
shr ecx, 2
mov dword [rbp + 0x380], ecx
test ecx, ecx
je fcn.140002c00
mov eax, edi
mov r9d, 1
mov ecx, dword [rbx + rax*4]
call fcn.1400010c0
inc edi
cmp edi, dword [rbp + 0x380]
jb 0x14000289f
jmp fcn.140002c00
xchg qword [rsp + 0x28], rbp
cmp r15, 0xffffffffb7359537
jge 0x14002f2a0
jl 0x14000285d
not r9d
add qword [rsp], 0xfffffffffffd0296
ret 8

Function at 0x14002fa8f
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
lea r13, [r13 + r15*8 - 0x20c2dbff]
sub di, r13w
and di, word [rsp + 0x30]
cmp r15d, dword [rsp + 0x32]
mov rdi, qword [rsp + 0x48]
jno 0x1400168db

Function at 0x14002faed
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
jns 0x1400beb15
shl dil, 0x68
jns 0x140048e54
and dword [rsp + 0x58], 0x488f440c
setbe r14b
setg r15b
mov r11, qword [rsp + 0x38]
lea r13, [r14*4 + 0x511b9635]
jl 0x1400cbc60
sub r15d, 0xa4ba4d94
and r13, qword [rsp + r14 - 0x64ab7aa8]
and word [rsp + r15 - 0x462cb215], 0xfe84
shl r15b, 0x36
shl r13, 0x92
sub r15, qword [rsp + 0x58]
cmovle r13, qword [rsp + 0x58]
mov r15, qword [rsp + r14 - 0x64ab7ab0]
sub r13, qword [rsp + r14 - 0x64ab7aa8]
call fcn.1400d0d55
je fcn.14006952b
je 0x1400cdaa1
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
ret
movabs rdi, 0x4a99ccb42abfb999
and dil, dil
lea rdi, [rdi*8 - 0x7d7ac041]
shl rdi, 0x44
add qword [rsp + 8], 0x5f1cd
movabs rax, 0x8013f0a8dd337d03
sub edi, eax
sub dil, dil
cmp rdi, 0x3b05f198
lea rdi, [rax*8 + 0x38a07783]
mov rax, qword [rsp + 8]
mov rax, qword [rax]
movabs rdi, 0x898c78549aec509
mov qword [rsp + 8], rdi
not qword [rsp + 8]
lea rdi, [rdi + rdi*4 + 0x173ae535]
jg 0x140094083
call fcn.140082cf3

Function at 0x140048e90
Capabilities:
Delete registry key
Packed with generic packer
Query or enumerate registry key

Disassembly:
jge 0x1400c227c
add r15w, 0xab10
mov r15, qword [rsp + 0x38]
not rbx
mov byte [rsp + rdi - 0x15792974], 0x84
shr edi, 0xb9
js 0x1400713fc
mov ebx, edi
jne 0x1400816b4
movabs rbp, 0xce3b662fbb2ae182
call fcn.1400daa56
Function at 0x140048ebd
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
movzx r9, r9w
jns 0x1400c2d5b
add qword [rsp + 0x30], 0xfffffffffff630a3
push rsi
shr r9d, 0x4b
mov rsi, r9
not rsi
call fcn.1400c8dd0

Function at 0x140048fa8
Capabilities:
Set registry value

Disassembly:
jle fcn.14004f716
call fcn.14008d7b7
cmc
int3
je 0x14008063e
nop
movabs rbp, 0x7b281001293642a9
shl bpl, 0x31
sete dl
push rbp
neg r8b
movsxd rdx, r8d
mov rbp, qword [rsp + 0x28]
mov rbp, qword [rbp + riz]
js 0x1400d240d
not si
jb 0x14002023e
lea rsi, [rsi - 0x4e480768]
neg dword [rsp + 0x10]
and dword [rsp + 0x10], 0xa719b20e
jne 0x1400c799e
popfq
lea rsp, [rsp + 0x58]
ret
push r9
cmp qword [rsp + 0x18], rbx
call fcn.14000cf82
neg qword [rsp + r9 + 0xa7e9909]
xchg qword [rsp + r9 + 0xa7e9921], rdx
mov r9, qword [rsp + r9*4 + 0x29fa6374]
call fcn.14008f33f
sbb eax, 0x52697a43
invalid
jg 0x14008c8e4
shl bpl, 6
jae 0x140087f53

Function at 0x14004c4ce
Capabilities:
Delete registry key
Query or enumerate registry key
Terminate process

Disassembly:
lea rsp, [rsp + 0x88]
ret
jge 0x14001e484
and bx, 0x8504
jg 0x1400788df
mov r14, qword [rsp + r14*2 - 0x1e003854]
call fcn.1400bfea0
mov byte [rbx], bl
clc
mov esi, ecx
mov esp, 0x7e1d2635
int3
lea rbx, [r9 + r9*4 + 0x57a262ae]
test r9d, 0xba82c5b0
mov r9, qword [rsp + 0x20]
mov qword [rsp + 0x20], rbp
seto bl
xor bx, bx
add qword [rsp], 0xa5ab9
add qword [rsp + 8], 0x49d33
nop
call fcn.1400d245b

Function at 0x14004e23f
Capabilities:
Delete registry key
Encode data using base64
Execute shellcode via indirect call
Packed with generic packer
Query or enumerate registry key
Read file via mapping
Resolve function by parsing pe exports
Set registry value
Spawn thread to rwx shellcode

Disassembly:
call fcn.140080d20
call fcn.14004c275
and word [rsp + r8 + 0x1ce80f8a], 0xa7a5
push r13
neg dword [rsp + r8 + 0x1ce80f92]
mov qword [rsp + r8*4 + 0x73a03e10], rbp
mov r13, r8
xor r13, r13
js 0x14004ee50
shr r13, 0xbb
jbe 0x14000d2a0
add r14, 0xffffffffce83bc16
not r15w
not r9b
mov rbx, qword [rsp + 0x28]
call fcn.1400b6f0f
pop rcx
push rbx
Function at 0x14004e277
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
test rax, rax
je 0x140002270
lea edi, [r13 + 0x18]
lea rax, [rsp + 0x40]
mov edx, edi
mov qword [rsp + 0x2b8], rax
lea ebx, [rdi - 0x17]
mov rcx, qword [rsp + 0x2b8]
mov byte [rcx], r13b
mov rcx, qword [rsp + 0x2b8]
add rcx, rbx
mov qword [rsp + 0x2b8], rcx
sub rdx, rbx
jne 0x1400020e9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, edi
lea r8, [rsp + 0x40]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140002267
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov r8d, ebx
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002267
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r13d
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
test rax, rax
je 0x14000225e
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
je 0x140002255
mov rcx, qword [rsp + 0x40]
movzx edi, r13w
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp r13w, word [rbx + 6]
jae 0x140002255
movzx ecx, word [rbx + 0x14]
add rcx, rbx
movzx eax, di
lea rdx, [rax + rax*4]
lea r12, [rcx + rdx*8]
lea rcx, [r12 + 0x18]
lea rdx, str..text
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400021ff
inc di
cmp di, word [rbx + 6]
jb 0x1400021cc
jmp 0x140002255
mov edi, dword [r12 + 0x24]
lea r9, [rsp + 0x2b0]
add rdi, qword [rsp + 0x40]
mov r8d, 0x40
mov ebx, dword [r12 + 0x20]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [r12 + 0x24]
mov r8d, ebx
add rdx, r15
mov rcx, rdi
call fcn.1400018b8
mov r8d, dword [rsp + 0x2b0]
lea r9, [rsp + 0x2b0]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
and rsi, rdx
js 0x1400020aa
mov rsi, qword [rsp + rsi*4 - 0x40c04450]
sub dx, r8w
mov r10, qword [rsp + 0x68]
xor qword [rsp + 8], 0xd0bed26
call fcn.140092dcf
and r13b, 0x3f
mov qword [rsp + 0x28], rdi
test r13, rdi
ja 0x1400cbd06
mov qword [rsp + 0x28], rcx
shr r13w, 0x22
jb 0x1400d706f