joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004e501
Capabilities:
Packed with generic packer

Disassembly:
bswap edx
or byte [rsp + rdx - 0x2d072a9b], 0x17
neg dx
lea rbx, [rbx + r15 + 0x648364b8]
shl r15, 0xca
mov qword [rsp + rdx - 0x2d07d52d], rdx
jns 0x1400d52c6
shl r15d, 0xf8
push r8
xchg qword [rsp + rdx*2 - 0x5a0faa4a], rbx
mov r15, qword [rsp + rdx*2 - 0x5a0faa62]
neg dl
add qword [rsp + rdx*2 - 0x5a0fab5e], 0xffffffffbff9bc04
test edx, edx
jae 0x14007ec52
movabs rdx, 0x53a4d02a94a9a583
pushfq
shl rdx, 0x8c
mov edx, 0x63a73bc
sub rdx, 0xffffffff85399132
jg 0x14006b012
adc byte [rdx], ah
add eax, 0x71993
add byte [rax], al
loopne 0x14004e53d
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc dword [rax], eax
add byte [rax], al
sbb byte [rax], bh
add byte [rax], dh
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rbx + rcx*4 + 0x5c], cl
mov r11, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0xffffffff9f4f4bfe
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.1400e1ab1
mov rdi, qword [rsp + 0x20]
shr r8, 0x42
shl r8, 0x17
setne r8b
add r8d, 0x7c055a83
jno 0x1400a89ef
not r8w
mov r8, qword [rsp + 0x48]
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x50]
ret
test byte [rax], ah
push 0x66ffff7f
shr edx, 0xd2
call fcn.1400d8197
seto r15b
jae 0x14000ae6c
je 0x1400568db
xchg qword [rsp + 0x18], rdi
or dx, 0x511f
xor edx, 0x6d25e981
sete dl
shr edx, 0xc6
call fcn.1400871d9
shr word [rsp + rdx - 0x2d07d593], 0xaa
mov rdx, qword [rsp + rdx*2 - 0x5a0fab36]
add qword [rsp + 0x10], 0xffffffffbff80c15
mov r8, qword [rsp + 0x20]
neg byte [rsp + r8 + 0x2fe00020]
sub r8, 0xffffffffc30cf7a3
lea r8, [r8*4 + 0x791a7]
mov r8, qword [rsp + r8 - 0x3453b31b]
jle 0x1400af753
xor byte [rsp + 0x20], 0x92
shl qword [rsp + 0x28], 0x6d
setbe byte [rsp + 0x28]
call fcn.1400ae6e6
mov qword [rsp + 0x28], rdi
push r11
movabs r11, 0x9fbe8ab7b197c7a6
jne 0x140089851
lahf
mov word [rcx], cs
sbb cl, byte [rcx]
xor eax, 0xf215331a
invalid
Function at 0x14004e54c
Capabilities:
Terminate process

Disassembly:
bswap edx
or byte [rsp + rdx - 0x2d072a9b], 0x17
neg dx
lea rbx, [rbx + r15 + 0x648364b8]
shl r15, 0xca
mov qword [rsp + rdx - 0x2d07d52d], rdx
jns 0x1400d52c6
shl r15d, 0xf8
push r8
xchg qword [rsp + rdx*2 - 0x5a0faa4a], rbx
mov r15, qword [rsp + rdx*2 - 0x5a0faa62]
neg dl
add qword [rsp + rdx*2 - 0x5a0fab5e], 0xffffffffbff9bc04
test edx, edx
jae 0x14007ec52
movabs rdx, 0x53a4d02a94a9a583
pushfq
shl rdx, 0x8c
mov edx, 0x63a73bc
sub rdx, 0xffffffff85399132
jg 0x14006b012
adc byte [rdx], ah
add eax, 0x71993
add byte [rax], al
loopne 0x14004e53d
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc dword [rax], eax
add byte [rax], al
sbb byte [rax], bh
add byte [rax], dh
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rbx + rcx*4 + 0x5c], cl
mov r11, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0xffffffff9f4f4bfe
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.1400e1ab1
mov rdi, qword [rsp + 0x20]
shr r8, 0x42
shl r8, 0x17
setne r8b
add r8d, 0x7c055a83
jno 0x1400a89ef
not r8w
mov r8, qword [rsp + 0x48]
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x50]
ret
test byte [rax], ah
push 0x66ffff7f
shr edx, 0xd2
call fcn.1400d8197
seto r15b
jae 0x14000ae6c
je 0x1400568db
xchg qword [rsp + 0x18], rdi
or dx, 0x511f
xor edx, 0x6d25e981
sete dl
shr edx, 0xc6
call fcn.1400871d9
shr word [rsp + rdx - 0x2d07d593], 0xaa
mov rdx, qword [rsp + rdx*2 - 0x5a0fab36]
add qword [rsp + 0x10], 0xffffffffbff80c15
mov r8, qword [rsp + 0x20]
neg byte [rsp + r8 + 0x2fe00020]
sub r8, 0xffffffffc30cf7a3
lea r8, [r8*4 + 0x791a7]
mov r8, qword [rsp + r8 - 0x3453b31b]
jle 0x1400af753
xor byte [rsp + 0x20], 0x92
shl qword [rsp + 0x28], 0x6d
setbe byte [rsp + 0x28]
call fcn.1400ae6e6
mov qword [rsp + 0x28], rdi
push r11
movabs r11, 0x9fbe8ab7b197c7a6
jne 0x140089851
lahf
mov word [rcx], cs
sbb cl, byte [rcx]
xor eax, 0xf215331a
invalid

Function at 0x14004e90a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
setbe byte [rsp + 0x38]
xor byte [rsp + 0x48], 0x30
lea rdi, [rdi + 0x679200a4]
mov r8, qword [rsp + 0x48]
mov r12, r8
push r9
mov r9, qword [rsp + 0x50]
xchg qword [rsp + 0x60], rdi
mov r9, qword [rsp]
mov rcx, r8
cmp word [rsp + 0x40], 0x7889
call fcn.1400ded67

Function at 0x14004e943
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x38], rcx
jl fcn.140063f91
movzx r10, word [rsp + 8]
not r12w
xor r12d, dword [rsp + 0xc]
mov r14b, byte [rsp + r10*2 - 0xc650]
push r9
add qword [rsp + 8], 0xfffffffffffbfe7a
push r13
shl byte [rsp + 0x18], 0xe5
mov rcx, r14
xor r10d, dword [rsp + 0x19]
jno 0x140063301
fcmovu st(0), st(3)
fdivr dword [rbx + 0x58]
mov dl, byte [rdi + 0x3d1e2536]
outsd dx, dword [rsi]
xor dh, bl
invalid
mov r9, qword [rsp + 0x18]
mov r10b, byte [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rcx]
mov r14b, byte [rsp + 0x18]
mov qword [rsp + 0x10], r12
shr r14b, 0xc7
call fcn.1400aa388
call fcn.14006502c
Function at 0x14004ee91
Capabilities:
Enumerate process modules

Disassembly:
lea rcx, [rcx + 1]
lea r11, [r11 + r11 - 0x29dcfc6a]
seto byte [rsp + 0x10]
xor r11b, byte [rsp + 0x14]
call fcn.140099622

Function at 0x14004eeac
Capabilities:
Enumerate process modules

Disassembly:
mov r8d, dword [r15 + rdi*4]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14000162f
lea r9, [rbp + 0x1a0]
mov r8d, 0x13880
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140001626
mov eax, dword [rbp + 0x1a0]
xor ebx, ebx
shr eax, 3
mov dword [rbp + 0x1a0], eax
test eax, eax
je 0x140001620
mov rdx, qword [r12 + rbx*8]
lea r8, [rsp + 0x40]
and qword [rsp + 0x20], 0
mov r9d, 0x200
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140001616
movzx edx, word [rbp - 0x80]
mov ecx, 0x7268
movzx eax, dx
sub ax, cx
cmp ax, 0xf
ja 0x140001616
mov ecx, 0x8801
bt ecx, eax
jb 0x140001683
inc ebx
cmp ebx, dword [rbp + 0x1a0]
jb 0x1400015d5
mov ebx, dword [rbp + 0x1a8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rsp + 0x30]
jb 0x140001586
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp + 0x198]
mov dword [rax], r14d
mov eax, ebx
add rsp, 0x248
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rbp + 0x198]
cmp r14d, dword [rax]
jae 0x1400016c8
mov eax, dword [r15 + rdi*4]
mov r9d, 0x7277
mov r8, qword [rbp + 0x190]
mov ecx, r14d
add rcx, rcx
mov dword [r8 + rcx*8], eax
xor eax, eax
cmp dx, r9w
mov word [r8 + rcx*8 + 4], dx
cmove rax, qword [rbp - 0x7e]
inc r14d
mov qword [r8 + rcx*8 + 8], rax
jmp 0x140001620
xor ebx, ebx
mov dword [rbp + 0x1a8], ebx
jmp 0x140001626
xor word [rsp + 0x50], 0x600e
neg dword [rsp + 0x50]
add dword [rsp + 0x50], 0xf3327105
je 0x1400015b6
mov r15, qword [rsp + 0x58]

Function at 0x14004f6f4
Capabilities:
Packed with generic packer
Set registry value

Disassembly:
not rbx
shl bx, 0xee
mov r9, rbx
call fcn.14006bb84

Function at 0x14004f703
Capabilities:
Set registry value

Disassembly:
jo 0x140051316
not r9
mov qword [rsp + 0x30], rdx
call fcn.140048ebd
adc al, 0xc7
xor al, 0xa7
cmp bl, byte [0xcb5204cb]
mov r9, qword [rsp + 0x10]
and esi, 0x1428119a
jle 0x140064291
jno 0x14008e78e
cmp dl, 0x87
push r10
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
movabs r15, 0x7e91e63f74b91f3b
movzx r12, r13b
lea rax, [rax + r12 - 0x6dc11651]
movsx r15, r13b
call fcn.1400b3499
and esi, 0x1482a195
je fcn.140058226
and si, 0x4209
mov rsi, qword [rsp + rsi - 0xfffffe0]
call fcn.14000714a
Function at 0x1400575f4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
add bl, bh
push rbx
mov rbx, qword [rsp + rbx - 0x34afc7c]
mov qword [rsp + 0x18], 0xffffffffdf4f23fb
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1400e1ab1
shl r8d, 0x22
not word [rsp + 0x60]
je 0x14005ac47
mov r13, qword [rsp + 0x40]
ja 0x1400b615e
fisttp word [rsi + 0xd]
invalid
and r8d, dword [rsp + r8 + 0x858b207]
jl 0x1400618d3
neg word [rsp + 8]
lea rcx, [rcx + r15 - 0xfff6]
and r15, r8
xor r8w, 0xe8bb
lea r15, [r8*2 + 0x61918989]
xor r15, 0x192b3516
not dword [rsp + 8]
and r8d, r8d
mov qword [rsp + 0x28], rcx
js 0x1400ddb49
add r8d, dword [rsp + 0x4b]
mov rcx, qword [rsp + 0x48]
setbe byte [rsp + rcx - 0x4022ca37]
mov r8, qword [rsp + rcx - 0x4022ca0f]
sub cx, word [rsp + rcx - 0x4022ca1a]
call fcn.14006952b
js 0x1400b2894
invalid
neg r15d
push r11
mov r11, r8
call fcn.14001c9c9
in eax, dx
mov esi, 0xa1ccde7d
fcomp st(3)
cmp byte [rbx + 0x31], cl
jl 0x1400ddb58
jge 0x1400ddb38
int3
invalid

Function at 0x140063f79
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sete byte [rsp + 0x38]
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x70]
ret
mov rbx, qword [rsp + rbx*2 + 0x7158]
shl dword [rsp + 0x60], 0xbe
shr byte [rsp + 0x60], 0x21
jge 0x14001633a

Function at 0x140063f91
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
xor r15, qword [rsp + 0x80]
lea r15, [rbp + r15*2 + 0x47adc48a]
movsx r10d, word [rsp + 0x60]
ja 0x1400c2e9b
out dx, eax
add dword [rdi], eax
add eax, dword [rax]
invalid
mov rbx, rsi
add dword [rsp + rsi - 0x548affe0], 0x55a7fa3d
jle 0x14008591f
shr qword [rsp + rsi - 0x548affe0], 0xd3
xor dword [rsp + rbx - 0x548affc8], 0x3231b8ba
jge 0x1400a9f56
call fcn.140054ae1
push rdi
sub byte [rsp + 0x20], 0xb1
and r14b, r9b
neg byte [rsp + 0x20]
and byte [rcx - 0x90eddbb], dh
pop rsp
and al, 0x20
lea rcx, [rcx - 0x1b61fe66]
mov r13, r12
bswap r10
call fcn.14000c62a
mov edx, 0x2349fffe
out dx, eax
and rbp, r15
xor r15d, dword [rsp + r10 - 0x164b0f57]
mov rdi, qword [rsp + 0x98]
jbe 0x1400c222b
mov qword [rsp + 0x80], 0x4c30aaa9
sub ebp, 0xd095536
jne 0x1400223d7
pop rcx
call fcn.140063e9a
mov eax, 0xf51c912b
mov dh, 0xa5
adc al, 0xd5
nop
or dword [rbx + 0x26], 0xb417ecff
jb 0x14008591c
loop 0x1400858fe
jmp 0x1400858f5
xchg qword [rsp + rsi - 0x548affa8], rdx
mov rbx, qword [rsp + rsi - 0x548afff0]
test byte [rsp + rsi - 0x548affdf], sil
jae 0x1400bfd9b
not cx
lea rax, [rax + r15 - 0x3714646b]
mov qword [rsp + 0x58], r9
and r9d, edi
add r15, rcx
not r9d
xchg qword [rsp + 0x60], rax
mov r15, qword [rsp + 0x30]
sub di, 0xc4ad
call fcn.14000f86a
mov r8, qword [rsp + 0x20]
mov r9, r10
setg byte [rsp + 0x18]
jle 0x1400090cf

Function at 0x1400647f8
Capabilities:
Set registry value

Disassembly:
or byte [rsp + r11 + 0x41506578], r11b
jns 0x1400b16c8
add qword [rsp], 0x5d893
xor qword [rsp + r11 + 0x41506578], 0xffffffffdc90bf26
shr dword [rsp + r11 + 0x41506578], 0xbb
Function at 0x140064f47
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
not bp
add bpl, 0x27
setge bpl
add ebp, 0x2d81cd1f
add qword [rsp + 0x10], 0x4b0d4
push r14
movzx ebp, bpl
not ebp
movabs r14, 0xfc8e199b319ebd8e
push r12
mov r12, r14

Function at 0x140065117
Capabilities:
Encode data using base64

Disassembly:
js 0x1400c0afd
ja 0x14005b0e7
add qword [rsp + 0x18], 0x2c2bd809
shr dl, 0x7d
shl byte [rsp + 0x18], 0xcb
mov rdx, qword [rsp + 0x58]
sub dword [rsp + 0x18], 0x733ccae
neg qword [rsp + 0x18]
mov byte [rsp + 0x18], 0xa1
mov word [rsp + 0x18], 0xfe86
js 0x1400080b1
or dword [rsp + 0x78], 0xc2975931
shl qword [rsp + 0x18], 0x86
shl dx, 0xe
mov r13, qword [rsp + 0x38]
not qword [rsp + 0x18]
mov r8b, byte [rsp + 0x1d]
shr byte [rsp + 0x78], 0xfe
sub dx, dx
mov r8, qword [rsp + 0x60]
jae 0x14009f6c0

Function at 0x14006b0e7
Capabilities:
Set registry value

Disassembly:
lea rax, [rax + r9*2 - 0x60c8b850]
mov di, r9w
mov qword [rsp + 0x20], r9
jno 0x14009c37f
xchg qword [rsp], rax
ja 0x14002f840
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + rdi - 0x1cf82]
xor rdi, 0x2cb07db7
setb r15b
movsx r15d, byte [rsp + rdi - 0x2cb1b222]
or rbx, qword [rsp + 0x10]
lea rcx, [rcx - 0x1ee6fc7f]
jb 0x140022eae
mov qword [rsp + rdi*2 - 0x5963644a], r15
neg r15
and r15b, 0xb5
xchg qword [rsp + 0x50], rcx
mov r15, qword [rsp + rdi*2 - 0x59636432]
add dword [rsp + rdi*2 - 0x5963644a], ebx
add qword [rsp + 8], 0xffffffffbff343d6
test word [rsp + 0x14], di
jo 0x1400bd286
and di, bx
shr qword [rsp + rdi*2 - 0x5963645a], 0x82
movzx r9d, ax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
bswap edi
sets byte [rsp]
movsx di, r9b
test r9b, 0x1e
jne 0x14006609c

Function at 0x14006b196
Capabilities:
Create pipe

Disassembly:
jns 0x1400c1350
jle 0x1400bbdf7
mov ch, 0x68
adc eax, 0xb3153ed3
xchg edx, eax
xchg qword [rsp + rsi - 0x6927ffc8], rcx
mov rsi, qword [rsp + rsi - 0x6927ffe8]
mov rdx, qword [rsp + 0x30]

Function at 0x14006b1aa
Capabilities:
Create pipe

Disassembly:
sub byte [rsp + 0x10], 0x22
mov byte [rsp + 0x10], 0x10
test dword [rsp + 0x10], 0x92be7f32
add qword [rsp], 0xffffffffffff8db2
not byte [rsp + 0x10]
xor dword [rsp + 0x10], 0xd0a6ec90
jbe 0x140001d52
jo 0x140093a3e
je fcn.14005554d
mov rbp, qword [rsp]
mov rbp, qword [rbp + riz]
and word [rsp + 0x10], 0xf62c
mov qword [rsp], 0x7e282f18
add dword [rsp + 0x10], 0xa6005437
call fcn.140071121

Function at 0x14006bdaa
Capabilities:
Delete registry key
Execute shellcode via indirect call
Query or enumerate registry key
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
js 0x140071430
mov r10, qword [rsp + 0x38]
setg byte [rsp + 0x48]
or bx, bx
sub dword [rsp + 0x48], 0xa71c5a1f
and ebx, ebx
sets bl
mov bx, word [rsp + 0x49]
mov rbx, qword [rsp + 0x20]
or qword [rsp + 0x48], 0x2420083f
setae byte [rsp + 0x48]
test byte [rsp + 0x48], 7
call fcn.14000cfef
invalid
jl 0x140022abb

Function at 0x14006c5d7
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
call fcn.1400ab9ae
pop rax
push r14
push r12
pushfq
movabs r12, 0x7d8b478bf425299d
lea r12, [r12 + r12*2 + 0x5f1f891b]
not r12d
Function at 0x140074e30
Capabilities:
Delete registry key
Packed with generic packer
Query or enumerate registry key

Disassembly:
not cl
mov rax, qword [rsp + 0x30]
lea r12, [r13 + r12*4 - 0x4447fe53]
mov r12d, 0x17980916
push rbx
movabs r8, 0x6317a79b0d035493
lea r13, [r13*2 - 0x2fe5b441]
mov r12, r8
je 0x140015cdc
add r12w, r12w
lea rax, [rax + 1]
jne 0x140097469
push r8
mov rbx, qword [rsp]
neg r8d
or r8w, r13w
jo 0x140087fa4
mov qword [rsp + 0x40], rax
push r11
neg r12d
mov r11, r13
movsx r8, r13w
setns r13b
bswap r12
add qword [rsp + 0x18], 0x49f9f
or dword [rsp + 8], r13d
call fcn.1400711ae

Function at 0x1400761cb
Capabilities:
Set registry value

Disassembly:
xchg qword [rsp + 0x10], rbx
jbe 0x1400c3585
jb 0x14005204a
add qword [rsp], 0x1466d
movabs rbx, 0x5980f43f0a3cc488
movabs r14, 0x24b7ec95928f8886
test r14, 0xffffffffb52b5685
bswap r14
call fcn.1400db6ca

Function at 0x140078916
Capabilities:
Delete registry key
Query or enumerate registry key
Terminate process

Disassembly:
mov r12b, 0xc
mov r15, qword [rsp + 0x28]
mov qword [rsp + 0x28], rbx
jno 0x1400773a6

Function at 0x140078929
Capabilities:
Terminate process

Disassembly:
jg 0x1400b2e0e
jl 0x1400a9feb
and dword [rsp + 0x78], 0xa11a8aa9
push qword [rsp + 0x98]
popfq
lea rsp, [rsp + 0xa8]
ret
test qword [rsp + 0x68], rdx
call fcn.14005554d

Function at 0x14007be38
Capabilities:
Encode data using xor

Disassembly:
pushfq
movabs r15, 0xb3364d045115a717
movsx r15w, r15b
shl r15, 0x78
push r10
mov rdx, qword [rsp + 0x30]
lea r15, [r15*2 - 0x3f40a67d]
movabs r10, 0x8f241f2d0892bf2d
call fcn.14009f174
sbb r10b, byte [rcx]
movabs byte [0xe35b75c49f4ca528], al
invalid

Function at 0x14008050e
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
js 0x14004f6e9
shr r9w, 0xea
js fcn.1400c206e
mov rbx, qword [rsp + rbx*4 + 0x68]
test word [rsp + 0x3c], di
je fcn.140064f07
xor dil, 0xbc
cmp qword [rsp + 0x30], 0x7d9364b4
jb 0x14004da53
mov r9, qword [rsp + 0x40]
lea rdi, [r15 + rdi*8 - 0x3ded3fc6]
add qword [rsp + 8], 0xffffffffbff49288
or qword [rsp + 0x30], rdi
add qword [rsp + 0x18], 0xffffffffbff52257
mov rdi, qword [rsp + 0x48]

Function at 0x140085919
Capabilities:
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
shl qword [rsp + r14 - 0x428004d], 0x23
shl r14d, 0x27
not word [rsp + 0x48]
shl r14w, 0xf3
lea rdi, [r14*8 + 0x51b4e24]
mov r14, qword [rsp + 0x68]
add qword [rsp + 0x10], 0xffffffffbffaab7c
neg byte [rsp + 0x48]
mov rdi, qword [rsp + 0x88]
jg 0x140048bbd
push rcx
add qword [rsp + 8], 0x454ad
lea r14, [r12 + r12*2 + 0x6120f127]
call fcn.140061016
jl 0x14007141e

Function at 0x140086727
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
je 0x1400a8423
push r13
lea rbx, [rbx + 1]
sub r14w, 0xef9d
jne 0x1400490bb
Function at 0x140088aa1
Capabilities:
Enumerate process modules

Disassembly:
shl r15w, 0x55
movabs r9, 0x7a0e8b32bf92c32e
jns 0x1400b9947
xor dword [rdx], ebx
cmp byte [rbx - 0x79512c42], dh
call fcn.1400072c0
pop rsi
lea edi, [rdi + rbp]
adc al, 0x77
add eax, 0x19320148
cmp ch, byte [rax + 5]
mov esp, 0x8dd7e48f
loopne 0x1400b98fa
fcmovu st(0), st(1)
stosb byte [rdi], al
adc byte [rsi + rsi - 0x1b9b84c1], bh
nop
outsb dx, byte [rsi]
jle 0x1400b999d
push rdi
fist word [rsi]
lodsb al, byte [rsi]
invalid
push rdi
fist word [rsi]
push rsp
ficomp dword fs:[rdx - 0x1f3c3f2f]
sub dword [rax + 0x305d388], edx
push rsi
invalid

Function at 0x14008f467
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
jle 0x1400c35db
mov rdi, qword [rsp + 0x48]
shr dword [rsp + rdi + 0x46d60060], 0x48
test qword [rsp + rdi + 0x46d60060], rdi
mov dword [rsp + rdi + 0x46d60060], edi
mov rdi, qword [rsp + rdi + 0x46d60010]
je 0x14006b182
shl byte [rsp + 0x60], 0x1c
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x68]
ret

Function at 0x14008f96d
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
mov rbx, qword [rsp + rcx*8 - 0x11138]
sete byte [rsp + rcx - 0x220a]
and word [rsp + rcx - 0x220a], 0xe18a
seta byte [rsp + rcx - 0x220a]
jne 0x1400b6691
je 0x140064ebb
Function at 0x1400912b0
Capabilities:
Set registry value

Disassembly:
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x28], rdi
lea r9, [0x1400026ac]
lea r8, [0x140002d84]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rcx, [0x1400026c8]
mov qword [rsp + 0x28], rdi
mov ebx, 0x64
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140002cc0]
mov qword [rax + 8], rcx
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, [0x1400026e8]
mov qword [rsp + 0x28], rdi
lea r8, [0x14000228c]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002693
neg rsi
add esi, ecx
call fcn.14005a574
movzx r11d, word [rsp + r11 + 0x4150657b]
add word [rsp + r11*4 + 0x18], r11w
mov rcx, r11
mov rcx, qword [rsp + r11*8]
mov rcx, qword [rcx + r11*8]
and word [rsp + r11*4 + 0x18], r11w
and dword [rsp + r11 + 0x18], 0x5fa70004
not r11d
lea r11, [r11*2 + 0x131f643d]
shr qword [rsp + 0x18], 9
ja 0x1400025f1
xor word [rsp + 0x18], r11w
sub word [rsp + 0x18], r11w
neg r11b
lea rcx, [rcx - 0x3a5a73f7]
or r11w, 0x541b
shr dword [rsp + 0x18], 0x5a
call fcn.14008c890
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x38]
ret 8
mov rbx, r9
shl rsi, 0x2c
xchg qword [rsp + rbx + 0x2d2bfbab], rbp
mov rsi, qword [rsp + rbx + 0x2d2bfb7b]
ja 0x140064824
test qword [rsp + rbx + 0x2d2bfb93], 0x88e49a1
not word [rsp + rbx + 0x2d2bfb93]
call fcn.14005cb90
movabs rbp, 0x45bb66a5c73a78b2
and ebp, 0x4608a88a
mov rbp, qword [rsp + r9*2 + 0x30]
mov rbp, qword [rbp + riz]
jbe 0x14005557b
add r9, 0x321c689c
add r9, 0xffffffffa0b79c11
jg fcn.14001bbb5
mov qword [rsp + 0x30], rsi
lea rbp, [rbp + 0x67bae310]
push rbx
push rdx
jl 0x14007152a
shl bl, 0xb7
not r13
push 0xffffffffe5b1a09b
lea r13, [r13 + rbx - 0x2d94fc5]
xchg qword [rsp + 0x60], rsi
mov r13, qword [rsp + 0x38]
call fcn.1400da4f5

Function at 0x14009423b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
jl 0x1400ad551
push qword [rsp + 0x78]
popfq
lea rsp, [rsp + 0x90]
ret

Function at 0x140094241
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0x58af1fb3
push r9
mov qword [rsp + rdx - 0x6b240a5c], rcx
Function at 0x1400974cd
Capabilities:
Delete registry key
Packed with generic packer
Query or enumerate registry key

Disassembly:
add r12, rdi
mov r12, qword [rsp + rdi*2 - 0x5ad404d0]
and word [rsp + rdi*2 - 0x5ad40500], di
neg word [rsp + rdi - 0x2d6a0278]
mov dword [rsp + rdi - 0x2d6a0278], 0x21aecf27
add rdi, 0x4f324180
xor byte [rsp + rdi - 0x7c9c43a8], dil
shr word [rsp + rdi - 0x7c9c43a8], 0x22
mov rdi, qword [rsp + rdi - 0x7c9c43d8]
jae 0x1400a8965
or edx, dword [rbx - 0x76]
sbb al, 0x1c
invalid
lea rsp, [rsp + 0x10]
ret 0x10
and qword [rsp + 0x20], 0xffffffffca018c17
sub byte [rsp + 0x20], 0x1a
xor dword [rsp + 0x20], 0x22046ea2
jns 0x14009ee9b

Function at 0x14009c454
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
movabs r11, 0xf419aea70e897092
xor byte [rsp + r14 - 0x5c41d0bc], 0xbd
add qword [rsp + r14 - 0x5c41d0a4], 0xffffffffbff4afb7
shr dword [rsp + r14 - 0x5c41d08c], 0xa6
mov rdx, qword [rsp + 0x30]
mov rdx, qword [rdx + r14 - 0x5c41d0c4]
sub dword [rsp + 0x18], ebx
jg 0x14005f911
mov r8, qword [rsp + r12 - 0x5b96fc4c]
mov qword [rsp + rbx*4 + 0x38], 0x3fa07981
not qword [rsp + r12 - 0x5b96fc7c]
not qword [rsp + rbx*2 + 0x40]
and qword [rsp + rbx*2 + 0x70], rbx
shr qword [rsp + r12 - 0x5b96fc74], 0xbb
ja fcn.1400b106d
mov qword [rsp + rbx*2 + 0x20], 0x12893c9b
mov r12, qword [rsp + r12 - 0x5b96fc6c]
shl dword [rsp + rbx*2 + 0x70], 0xd4
bswap ebx
mov rbx, qword [rsp + rbx*2 - 0x7ffff70]
call fcn.1400d35e5

Function at 0x14009de83
Capabilities:
Set registry value

Disassembly:
jb 0x140058a55
neg word [rsp + 0x50]
bswap rsi
call fcn.140065b5a
add eax, 0xa433a94c
dec byte [rdx + 0x291733]
adc ebp, dword [rax + 0x2b]
sub dword [rax + 0x1ca6d546], esi
jno 0x14009deb5
retf
xchg byte [rcx + rax*2 - 0x10], bl
pause
sal dword [rcx + 0x3c], cl
xor eax, 0xb1a158e6
add r13d, r8d
or eax, 0x977f4594
invalid

Function at 0x14009e487
Capabilities:
Delete registry key
Encode data using xor
Query or enumerate registry key

Disassembly:
push rbx
push r13
movabs r13, 0x6f9dc630f5018225
bswap r13d
pushfq
or r13b, r13b
mov rbx, qword [rsp + r13 - 0x258201dd]
jg 0x140048c30
setb r13b
neg r13w
bswap r13
bswap r13d
call fcn.140061a40
in eax, 0x7c
mov ebp, 0xc8ab2b69
mov ecx, dword [rcx]
adc al, 0xa5
out 0xf5, al
adc qword [rax + 0x696b2893], r8
xor al, 0xf5
invalid

Function at 0x14009e9fe
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
push rcx
xchg qword [rsp + 0x18], rdx
movabs rcx, 0xe82c7a96453f481e
pushfq
xor cl, 0xa9
jge fcn.14008f2a0
neg rcx
push r15
jbe 0x140021698