joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
lea rbp, [rsp - 0x710]
sub rsp, 0x810
lea rax, [rbp + 0x728]
mov r9d, 0xf013f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREdialerconfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
invalid
test eax, eax
jne 0x140001099
jmp 0x14000104b
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and qword [rsp + 0x38], 0
lea r9, [rbp + 0x720]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x40]
and qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rbp + 0x728]
and qword [rsp + 0x20], 0
mov dword [rbp + 0x720], 0x3e8
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rcx, qword [rbp + 0x728]
test eax, eax
je 0x140001040
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
lea rdx, str.SOFTWAREdialerconfig
mov r8d, 0xf013f
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
add rsp, 0x810
pop rbp
ret
Function at 0x1400014e4
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x148]
sub rsp, 0x248
mov ebx, 1
xor r14d, r14d
mov dword [rbp + 0x1a8], ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, 0x9c40
xor edx, edx
mov rcx, rax
mov r8d, edi

Function at 0x1400017f8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14d, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x3e80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], 0x3e8
mov rcx, rax
mov rbp, rax
call fcn.1400014e4
test eax, eax
je 0x140001891
mov ecx, dword [rsp + 0x48]
test ecx, ecx
je 0x140001891
mov rbx, rbp
mov edi, ecx

Function at 0x140001a44
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp + 0x18], r8d
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov r14, rdx
mov edi, ebx
mov rbp, rcx
mov rsi, rdx
mov eax, edi
lea r9, [rsp + 0x60]
mov r8d, 2
mov qword [rsp + 0x20], rbx
mov rcx, rbp
lea rdx, [r14 + rax*2]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001aac
cmp dword [rsp + 0x60], 2
jne 0x140001aac
cmp word [rsi], bx
je 0x140001aa7
inc edi
add rsi, 2
cmp edi, 0x105
jb 0x140001a68
jmp 0x140001aac
mov ebx, 1
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140001c64
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
xor esi, esi
mov word [rbp + 0x73], 0x100
lea rax, [rbp + 0x7f]
mov dword [rbp + 0x6f], esi
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov dword [rsp + 0x48], esi
lea rcx, [rbp + 0x6f]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], esi
xor r8d, r8d
mov dword [rsp + 0x30], esi
mov dl, 1
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140001d9c
lea rax, [rbp + 0x17]
mov qword [rbp + 0x77], rax
lea ecx, [rsi + 0x30]
mov rax, qword [rbp + 0x77]
mov byte [rax], sil
mov rax, qword [rbp + 0x77]
inc rax
mov qword [rbp + 0x77], rax
sub rcx, 1
jne 0x140001ccc
mov rax, qword [rbp + 0x7f]
lea r9, [rbp - 9]
xor r8d, r8d
mov dword [rbp + 0x17], 0x1f01ff
lea rdx, [rbp + 0x17]
mov qword [rbp + 0x1b], 2
mov dword [rbp + 0x33], esi
mov dword [rbp + 0x37], 5
lea ecx, [r8 + 1]
mov qword [rbp + 0x3f], rax
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x140001d9c
lea edx, [rax + 0x28]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140001d9c
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x140001d9c
mov r8, qword [rbp - 9]
xor r9d, r9d
mov rcx, rbx
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x140001d9c
lea rax, [rbp - 1]
mov dword [rbp - 1], 0x18
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov eax, 0x400
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
mov r9d, 0xff
mov rcx, rdi
mov dword [rsp + 0x20], eax
lea edx, [r8 + 3]
mov qword [rbp + 7], rbx
mov dword [rbp + 0xf], esi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
jmp 0x140001da0
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret

Function at 0x140001db4
Capabilities:
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
xor edi, edi
mov r12, rdx
mov r15d, edi
mov r10, rcx

Function at 0x140002078
Capabilities:
Read file via mapping

Disassembly:
test rcx, rcx
je 0x14000228a
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rbx, rcx
lea rdx, [0x140003470]
lea rcx, [rsp + 0x60]
xor r13d, r13d
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
test rax, rax
je 0x140002270
lea edi, [r13 + 0x18]
lea rax, [rsp + 0x40]
mov edx, edi
mov qword [rsp + 0x2b8], rax
lea ebx, [rdi - 0x17]
mov rcx, qword [rsp + 0x2b8]
mov byte [rcx], r13b
mov rcx, qword [rsp + 0x2b8]
add rcx, rbx
mov qword [rsp + 0x2b8], rcx
sub rdx, rbx
jne 0x1400020e9
Function at 0x140002c18
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 8], ecx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
lea rcx, str..pipedialercontrol_redirect64
and dword [rax - 0x20], 0
mov edi, r8d
mov rsi, rdx
mov dword [rax - 0x28], 3
xor r8d, r8d
mov edx, 0xc0000000
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002cad
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
je 0x140002ca4
test edi, edi
je 0x140002ca4
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140007fec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rax - 0x75], cl
lea ebp, [rax]
invalid
shl r12, 0xb4
or bpl, 5
xchg qword [rsp + 0x30], rdi
mov rbp, qword [rsp + 0x18]
jl 0x1400a89f0
js 0x140071db4
add qword [rsp], 0xfffffffffffbdf4e
shl r15w, 0x41
test r13b, 0xbb
setbe r15b
mov r13, qword [rsp + 0x10]
jle 0x140001087
cmp byte [rsp + 0x10], 0x12
jb 0x14002fa8d
test qword [rsp + 0x10], 0x78964994
sets byte [rsp + 0x10]
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
ret
push rax
pushfq
call fcn.140066c97
lea rsp, [rsp + 8]
ret
Function at 0x140008d4c
Capabilities:
Set registry value

Disassembly:
adc eax, 0x255375
test eax, eax
jne 0x140002602
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x58]
lea rdx, [0x140003530]
mov dword [rbp + 0xb8], eax
mov r9d, ebx
lea rax, [rbp + 0xb8]
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x28], rdi
lea r9, [0x1400026ac]
lea r8, [0x140002d84]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rcx, [0x1400026c8]
mov qword [rsp + 0x28], rdi
mov ebx, 0x64
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140002cc0]
mov qword [rax + 8], rcx
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, [0x1400026e8]
mov qword [rsp + 0x28], rdi
lea r8, [0x14000228c]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002693
cmp r14, rbx
push r13
jns 0x1400adac3
add qword [rsp + 0x20], 0xffffffffbffe1d6c
test r9d, 0xd400a5a8
mov rbx, qword [rsp + 0x28]
mov rbx, qword [rbx]
call fcn.1400c9886
mov rsi, qword [rsp + rsi*8 - 0xd6d28]
xor r12, qword [rsp + r12*4 - 0x93dc]
call fcn.140087f4e
mov rsi, qword [rsp + 0x20]
jb 0x14001b6f7
or dl, 0x38
sub dx, 0xcba9
push r15
movsx edx, word [rsp + 4]
jns 0x1400c8dff
push r13
lea rsi, [rsi + rdx*2 + 1]
jo 0x1400025ba
movabs r13, 0x6caff811f985d738
sub edx, 0x26031f0b
and r13b, byte [rsp + 9]
push r13
add r15w, r13w
mov qword [rsp + 0x38], rsi
call fcn.1400e1101
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x58]
ret
push rbp
mov rcx, qword [rsp + 0x30]
movabs rbp, 0xbfa556af9b225b84
and dx, 0x4a08
shr dl, 0xcb
push rdi
push r8
lea rcx, [rcx + 1]
sub r13w, 0x3d24
neg r13
or r13w, 0x5d2c
add r13w, 0xa1b9
mov qword [rsp + 0x40], rcx
not edx
mov rdi, rbp

Function at 0x14000996f
Capabilities:
Connect pipe
Read file on windows

Disassembly:
mov rcx, qword [rsp + rcx*4 + 0x1e5b8]
jae 0x14002f207
jno fcn.140060d21
jbe 0x14000d334
jle 0x1400a7757
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x28]
ret
and si, si
neg rsi
shr si, 0xbe
call fcn.1400d3a03
push rax
call fcn.14000748d
int3
Function at 0x14000fc8a
Capabilities:
Packed with generic packer

Disassembly:
bswap rsi
xor word [rsp + r14 - 0x1feff98], si
neg esi
mov r8, qword [rsp + 0x70]
jns 0x1400cc0a3
jno 0x1400aa63a
jae 0x1400de938
add qword [rsp + r14*8 - 0xff7fff8], 0xffffffffbff67bda
lea rsi, [rsi + r14*2 + 0x651ecf36]
add qword [rsp + r14 - 0x1feffb0], 0xffffffffbff8b497
lea rsp, [rsp + r14 - 0x1feffe8]
ret 0x18

Function at 0x140011510
Capabilities:
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rcx
add qword [rsp + 0x10], 0xffffffffbff716dc
push r14
movabs r14, 0xb8945377ca421a5
push r15
mov r15, r14
add qword [rsp + 0x10], 0x761d5
movabs rcx, 0x142b7e80d81d8a90
sub rcx, r15
movsxd r14, ecx
neg r15d
mov r14w, 0xc00
and r14d, 0xeb9e9fa7
add cl, r15b
mov rcx, qword [rsp + r14 - 0x4b180bf0]
mov rcx, qword [rcx + r14 - 0x4b180c00]
and r14d, 0xf6b9858a
add r14, r14
mov qword [rsp + 0x10], r14
jg 0x14006b83a
lea rcx, [rcx - 0x284322c6]
push rdi
and r14, qword [rsp + 0x18]
jae 0x14007928a
call fcn.140055a29
scasb al, byte [rdi]
xor byte [rsi - 0x1a6c8f57], dh
xchg edx, eax
rol byte [rdx], 1
or esp, esp
or dword fs:[rcx + 0x7b3ae96a], ecx
pop rsi
xchg esp, eax
invalid

Function at 0x14001eac8
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001fbf
xor ecx, ecx
cmp cx, word [rbx + 6]
jae 0x140001f2a
mov esi, ecx
movzx eax, word [rbx + 0x14]
add rax, rsi
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x69]
mov r8d, dword [rax + rbx + 0x2c]
mov edx, dword [rax + rbx + 0x24]
add r8, r12
mov r9d, dword [rax + rbx + 0x28]
add rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor ecx, ecx
test eax, eax
je 0x140001fbd
movzx eax, word [rbx + 6]
inc edi
add rsi, 0x28
cmp edi, eax
jl 0x140001ee4
lea rsi, [rbx + 0x30]
xor ecx, ecx
mov edx, 0x4d0
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp r13d, 0x2dac7f32
mov qword [rsp + r15*4 + 0x48], rbp
lea r15, [r15 + r15*8 + 0x310a658b]
jb fcn.14007fc2c
movabs r15, 0xa43c18887502511e
sub r15b, r15b
shl r13, 0xa9
bswap r13
bswap r13
add qword [rsp], 0xfffffffffff87515
movabs rbp, 0x7d0200814102a13d
push r15
shl r13w, 0xb1
js 0x1400e2ccd
shr r13w, 0xd9
test qword [rsp], r13
mov rbp, qword [rsp + 8]
mov rbp, qword [rbp + riz]
bswap r13d
lea r13, [r13*8 + 0x6a177600]
cmovae r15, qword [rsp]
and r15, qword [rsp + r13 - 0x6a177600]
cmovge r13d, dword [rsp + 2]
je 0x1400ae3fa
mov r15, qword [rsp + r13 - 0x6a177600]
lea rbp, [rbp + r13 - 0x53f0605b]
mov qword [rsp + 8], r15
call fcn.140093a3c
movabs r8, 0x8f87391c2eaba5a4
mov r8d, 0x836f8b7
pushfq
neg r8d
ja 0x140001ecc
bswap r8d
call fcn.14005bcf5
lodsb al, byte [rsi]
idiv byte [0x16e07d7c0]
ficom word [rax]
idiv dword [rbp + 0x1f]
jl 0x1400ae4a8
add edx, esi
invalid
sar dh, 1
mov bh, 0x85
rol byte [rsi], cl
xchg dword [r10 + r13], edx
in eax, 4
invalid
Function at 0x140021600
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], 0xffffffff860ddd1a
lea rdi, [rdi - 0x1a6a60d7]
add word [rsp + 0x20], 0x199c
sete byte [rsp + 0x20]
or word [rsp + 0x20], 0xdd9a
or qword [rsp + 0x20], 0xffffffff8736a992
call fcn.140061e66

Function at 0x140021631
Capabilities:
Terminate process

Disassembly:
add byte [rsp + 0x38], 0x8c
je 0x1400ad84e
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x50]
ret

Function at 0x140054253
Capabilities:
Connect pipe
Read file on windows

Disassembly:
movabs r11, 0x82081b9fd00bd9a
add qword [rsp], 0xfffffffffffe377f
push rdi
lea r12, [r12 + r11 - 0x66fcd4c6]
mov rdi, qword [rsp + r10 - 0x795517e9]

Function at 0x14005c1bb
Capabilities:
Connect pipe
Read file on windows

Disassembly:
cmp qword [rsp + 0x28], rdi
xchg qword [rsp + 0x50], rsi
mov r8, qword [rsp + 0x48]
jo 0x1400598e0
call fcn.14009e1ac
jmp qword [rcx + 0x33]

Function at 0x14006fa99
Capabilities:
Encode data using xor

Disassembly:
sub r11, 0xffffffff87b77800
neg r9b
jb 0x1400b1de1
xor edi, dword [0x10588ce5a]
rol dword [rcx - 0x7a6a876d], cl
push 0x7ba1f418
rcl al, 0x66
pop rcx
nop
push rbx
xchg ebp, eax
loop 0x14006fad3
sbb eax, 0x8293bd83
jge 0x14006fb35
enter 0xffffffffffffc5a5, 0xffffffffffffffa8
test al, 0x54
or ebx, eax
sal byte [rsi], 1
sal byte [rsi], 1
xchg dword [rbp - 0x4b], esi
invalid
mov eax, 0xe93a4429
mov al, 0x55
xlatb
pop rdx
xor al, byte [rcx]
add byte [rax], al
add byte [rbx - 0x4c], bl
xchg esi, eax
test al, 0xae
adc eax, 0xac075977
or sil, r12b
and al, 0x12
retf 0xaea0
mov r10, qword [rsp + r11 - 0x7d5407e8]
sub dword [rsp + r9 - 0x142d7001], 0x600184b7
lea r9, [rcx*8 - 0x6dd02d78]
shl qword [rsp + r11 - 0x7d5407a0], 0x7c
test dword [rsp + r11 - 0x7d5407af], ecx
call fcn.14009a36e
div byte [rsi]
adc byte [rsi], al
push rdi
mov ah, 0x42
test dword [rdi], edi
int 0x56
cmp ebx, dword [rbx - 0x4a]
sub r15b, byte [rdi]
jne 0x1400b1e3d
xchg byte [rax - 0x80], ah
invalid
cmp ah, al
xor eax, 0x4d3ac4d2
lahf
in eax, dx
mov dh, 0xad
and eax, dword [rsi]
sub eax, 0xee7dc23f
jge 0x1400b1e2d
invalid

Function at 0x140071d88
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rbx, [rbx - 0x23556c41]
lea r10, [r10*2 + 0x4222f528]
shr r10, 0x62
neg word [rsp + r10*2 - 0x5a6ad12c]
xchg qword [rsp + r10*2 - 0x5a6ad10c], rbx
mov r10, qword [rsp + r10*2 - 0x5a6ad114]

Function at 0x140077324
Capabilities:
Packed with generic packer

Disassembly:
add r14d, r14d
lea rdx, [rdx + r14 + 0x1abec01]
shr dword [rsp + r14 + 0x18], 0x28
mov r14b, byte [rsp + r14 + 0x1a]
cmp r14w, 0xd7a5
jle fcn.1400de92e
xchg qword [rsp + r14 - 0x32], rdx
mov r14, qword [rsp + r14*2 - 0xa4]
call fcn.1400d728e
Function at 0x1400773d3
Capabilities:
Packed with generic packer

Disassembly:
sub byte [rbx], bh
add qword [rsp + 8], 0xffffffffbff3c46a
xor cx, word [rsp + 0x44]
mov rcx, qword [rsp + 0x28]
jne 0x14008d47c
jge 0x14004e998
movabs al, byte [0xa0c2b5036079e630]
jb 0x14004e9b9
invalid
adc al, 0xa4
cmp dword [rcx - 0x43], edx
or rax, 0x26851390
invalid
sub qword [rsp + 0x50], 0x3992698e
jo 0x1400c9339
or byte [rsp + 0x38], 0x82
not byte [rsp + 0x50]
stosd dword [rdi], eax
invalid
js 0x14004e9ad
jmp qword [rsi - 0x75]
mov di, word [rsp + rdi*8 - 0x55f]
call fcn.14005abbc
jns 0x1400c9335
jle 0x1400c9308
stosd dword [rdi], eax
jl 0x1400c9399
rcr ebp, cl
jge 0x1400c933e
movsb byte [rdi], byte [rsi]
invalid
invalid

Function at 0x140079a27
Capabilities:
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
mov rdi, qword [rsp + r11 - 0x50bf769]
mov rdi, qword [rdi]
mov qword [rsp + r11 - 0x50bf769], r15
movabs rcx, 0x12388482341b1e11
call fcn.14009fb49

Function at 0x140079a49
Capabilities:
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
sub rdx, 0x2daf6ebf
bswap esi
movabs rdx, 0xd48bdc17a531c40f
mov rsi, qword [rsp + rsi*2 - 0x72cc513a]
mov rsi, qword [rsi]
shl edx, 0xf5

Function at 0x14008c80e
Capabilities:
Enumerate process modules

Disassembly:
add qword [rsp], 0xc6939
mov rbx, r12
xor r12w, 0xfaac
test ebx, r12d
jg 0x140086e18

Function at 0x140094f73
Capabilities:
Connect pipe
Read file on windows

Disassembly:
lea rax, [rax - 0x107a8d47]
test r10b, 0xb5
mov qword [rsp + 0x18], r10
movsx r10d, word [rsp + 0x1b]
push rbp
movabs rbp, 0xa93d0703268eb7bc
push rdx
jbe 0x1400d2e33
shr sil, 0x96
not esi
setne r10b
jne 0x140081af9
test esi, 0x4c8365ba
jg 0x140087fa3
push r10
or qword [rsp + 0x30], rbp
xchg qword [rsp + r10 - 0x31e7], rax
mov r10, qword [rsp + 0x28]

Function at 0x14009577e
Capabilities:
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
lea r10, [rdi*4 - 0x394d4c70]
mov rdi, qword [rsp + rbx*4 - 0x20149890]
mov rdi, qword [rdi + rbx*4 - 0x201498c0]
jb 0x14006d6a0

Function at 0x1400965e2
Capabilities:
Terminate process

Disassembly:
lea rdi, [rdi*4 - 0x53de5642]
cmp dil, 0x9d
jle 0x1400a2cc2
mov rdi, qword [rsp + 0x28]
mov rdi, qword [rdi]
mov qword [rsp + 0x28], 0x552330bb
cmp qword [rsp + 0x28], 0x51057888
call fcn.14001ec29
pop rcx
push rbp
movabs rbp, 0xcd948c32f4b94e08
push rdi
movzx rbp, bpl
pushfq
shl bp, 0xd6
movabs rdi, 0x3135f892f625c202
jne 0x1400ad836
xchg qword [rsp + rbp*2 + 0x18], rcx
and dil, bpl
shr bp, 0x72
jns 0x140051b95

Function at 0x140096e84
Capabilities:
Connect pipe
Read file on windows

Disassembly:
ret 8
mov qword [rsp + 0x20], rdx
mov rcx, qword [rsp + 0x18]
sub cl, cl
call fcn.140079087
add qword [rsp + 0x10], 0xd38c
or edi, edi
jo 0x140063009
movabs rsi, 0xd58440bb13b5882f
add qword [rsp + rdi*8 - 0x2c3e2f80], 0xffffffffffff250d
pushfq
movabs rdx, 0x2113ab1ae70c3090
mov rdx, qword [rsp + 0x10]
xchg qword [rsp + 0x20], rdx
mov qword [rsp + 0x10], 0xffffffffa5a2430b
cmp qword [rsp + 0x10], 0x19bb9221
push rcx
jae 0x140094f13
Function at 0x140098a6b
Capabilities:
Connect pipe
Read file on windows

Disassembly:
mov r9w, dx
mov rdx, qword [rsp + 0x18]
mov qword [rsp + 0x18], rdi
push r9
xor r9, qword [rsp]
and word [rsp + r9], 0x198b
add r10d, 0xca5fe8b
jb 0x1400adb45
shr qword [rsp + r10 - 0x284e838b], 0x88
neg word [rsp + r9*2]
call fcn.1400726c2
call fcn.140015560
int3
pop rdi
push rdx
push r9
movabs r9, 0xd8939bb455254a3f
lea r9, [r9 + r9*8 - 0x65683043]
push r10
pushfq
movabs r10, 0x3fa523021ba8853f
xchg qword [rsp + 0x20], rdi
shr r10b, 0xb7
movabs rdx, 0x87236fbe5600de96
jns 0x140007060

Function at 0x140098ae5
Capabilities:
Connect pipe
Read file on windows

Disassembly:
setae dl
jl fcn.14000c761
mov r14, qword [rsp + r14 - 0x3217e3e6]
and rdx, rdx
xor dl, dl
or dl, 0x83
jno 0x14009b506
pop rdi
call fcn.140069357

Function at 0x14009b7f5
Capabilities:
Encode data using base64
Terminate process

Disassembly:
add qword [rsp + 8], 0xfffffffffffcef50
movabs rbx, 0xb89b24180989a804
neg ebx
jl 0x140058014

Function at 0x1400a2732
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resolve function by parsing pe exports
Resume thread
Terminate process
Use process replacement

Disassembly:
js 0x140001ecc
mov rsi, qword [rsp + 0x28]
jns 0x1400ab0e5
pushfq
push rbx
movabs rbx, 0x8b8d5c8fb23200a4
call fcn.1400bb96c

Function at 0x1400a9c62
Capabilities:
Terminate process

Disassembly:
movabs r8, 0x5e85c437dc916723
lea r8, [r8 + r8*8 + 0x738ce729]
mov rbx, r8
jns 0x1400d1a5a
mov rbx, qword [rsp + 0x20]
mov rbx, qword [rbx]
movabs r8, 0xb99e5ca9c4aec833

Function at 0x1400aecb7
Capabilities:
Encode data using xor

Disassembly:
and al, 0x30
movsd dword [rdi], dword [rsi]
push 0x3b
leave
cmp word [rsp + 8], 0x2c2e
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x60]
ret
add al, ch
invalid
call fcn.1400c8d69
sub dh, 0xa5
xor eax, 0x96756cf3
mov dil, 0xb5
xlatb
mov ch, 0xd7
xor al, 0x69
and dword [rbx - 0x65cdfc6c], esp
jns 0x1400aec68
outsd dx, dword [rsi]
and al, 0xee
fstp st(5)
jrcxz 0x1400aecc6
cmp eax, 0x689997c1
pop rcx
stosd dword [rdi], eax
pop r10
pop rax
xchg ebp, eax
mov dh, 0xaf
xchg edi, eax
imul dword [rax - 0x7fef9b2a]
jg 0x1400aecb1
push rsi
xor al, byte [rcx]
add byte [rax], al
add byte [rcx - 0x72], dh
xor al, 0xa
mov esp, 0x5330d17
mov esi, 0xd33491c
adc byte [rsi], dh
lodsd eax, dword [rsi]
invalid

Function at 0x1400af91d
Capabilities:
Connect pipe
Read file on windows

Disassembly:
bswap r13
add r13w, 0xcbb
sub r13d, 0x7915b00f
jge 0x14007e0f6
call 0x1400c0c0f
shr r13d, 0x68
sete byte [rsp + rcx*8 + 0x2363820]
xchg qword [rsp + rcx*2 + 0x8d8e40], rax
mov rcx, qword [rsp + r13*2 + 0x18]
jae 0x140007c00

Function at 0x1400be9c0
Capabilities:
Connect pipe
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
pushfq
movabs rdi, 0x1f39e0b0f8be9511
push r15
shr rdi, 0x8d
and di, di
movabs r15, 0xaebc698b599c079c
js 0x140094f24
or r8, 0xfffffffffc2e6da0
je 0x1400c7113
mov qword [rsp + 0x38], rdi
or rbp, 0x350eeb87
push r13
neg ebp
call fcn.1400adf82
lea rsp, [rsp + 0x78]
ret
Function at 0x1400beb05
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 8]
mov rax, qword [rax]
lea rax, [rax + 0x480ae607]
mov qword [rsp + 8], 0xffffffffb18c3b14
pushfq
add qword [rsp + 8], 0xffffffffbff6096c
call fcn.1400c87c5
cli
and al, 8
insb byte [rdi], dx
or esi, esi
mov edi, 0x9c99e8
add dl, bh
xor eax, 0x24563c5b
jg 0x1400beb96
or ch, byte [rax - 0x45]
jle 0x1400beb21
mov eax, 0x2a1bb9bb
popfq
mov dh, 0x68
push rdi
invalid
rcr dword [rbx - 0x13f9c44d], 1
test dword [rax - 0x17416396], esp
mov ebx, 0xac3443f0
movsd dword [rdi], dword [rsi]
jno 0x1400bebab
add byte [rax], al
sar byte [rdx], 0xcb
pop rbx
mov ah, 0xc9
mov edi, ebx
adc byte [0x1061e7175], cl
mov al, 0x47
invalid

Function at 0x1400bf483
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
add di, di
neg rdi
invalid
invalid
add qword [rsp + r12*2 - 0xf044], 0xffffffffbff21798
call fcn.14001c878
call 0x1400df009
cwde
xchg byte [rax - 0x2318eaf1], cl
ficomp word [rax]
jbe 0x140075fdf
mov bh, 0x5a
sub al, byte [rsi - 0x3d]
sbb dword [rdx], eax
and cl, byte [rbx + rsi]
jp 0x1400760ad
lahf
pop rax
loop 0x140075fb8
push rbx
scasb al, byte [rdi]
xchg esi, eax
hlt
sbb ecx, ecx
invalid
js 0x140008cc0
test word [rsp + r12 - 0x4a1f0ad0], r12w
movsx r12w, byte [rsp + r12 - 0x4a1f0ad0]
bswap r12d
lea r12, [r12 + r12 + 0x4aa597b3]
movzx r12d, word [rsp + 0x33]
mov qword [rsp + r12*2 - 0xf014], rcx
je 0x140076007