joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ecc0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
cmp qword [rsp + 0x30], 0
jne 0x14000ecd5
xor eax, eax
jmp 0x14000ed42
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000ecf2
xor eax, eax
jmp 0x14000ed42
mov rax, qword [rsp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
cmp dword [rax], 0x4550
je 0x14000ed1c
xor eax, eax
jmp 0x14000ed42
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 0x16]
mov word [rsp], ax
movzx eax, word [rsp]
and eax, 0x2000
cmp eax, 0x2000
je 0x14000ed3d
xor eax, eax
jmp 0x14000ed42
mov eax, 1
add rsp, 0x28
ret

Function at 0x14000fc40
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x38
mov r8d, 1
lea rdx, [0x140029088]
xor ecx, ecx
call fcn.14000ee80
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x14000fc95
mov ecx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, str.Could_not_enable_SeDebugPrivilege._Are_you_elevated_
mov rcx, rax
call fcn.140001060
mov ecx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, [0x1400290e8]
mov rcx, rax
call fcn.140001060
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140011620
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
add rax, 0x118
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
cmp dword [rax], 6
ja 0x140011655
mov dword [rsp], 0x400
jmp 0x14001165c
mov dword [rsp], 0x1000
mov eax, dword [rsp]
bts eax, 7
add rsp, 0x28
ret

Function at 0x140011670
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
add rax, 0x118
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
cmp dword [rax], 6
ja 0x1400116a5
mov dword [rsp], 0x400
jmp 0x1400116ac
mov dword [rsp], 0x1000
mov eax, dword [rsp]
or eax, 0x10
add rsp, 0x28
ret

Function at 0x140013610
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
lea rax, str.SeDebugPrivilege
mov qword [rsp + 0x28], rax
lea rax, str.SeAssignPrimaryTokenPrivilege
mov qword [rsp + 0x30], rax
mov r9d, 2
lea r8, [rsp + 0x28]
mov rdx, qword [rsp + 0x50]
lea rcx, str.S_1_5_18
call fcn.1400136a0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x14001368a
mov ecx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, str.Could_not_impersonate_SYSTEM
mov rcx, rax
call fcn.140001060
mov ecx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, [0x14002ba78]
mov rcx, rax
call fcn.140001060
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x1400136a0
Capabilities:
Acquire debug privileges

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x58]
mov qword [rax], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rax, [0x14002b000]
mov qword [rsp + 0x30], rax
lea rax, [0x14002b028]
mov qword [rsp + 0x38], rax
mov r9d, 1
mov r8d, 2
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.14000fa20
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x14001371a
jmp 0x14001376c
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call fcn.140012b30
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x140013740
jmp 0x14001376c
mov rcx, qword [rsp + 0x28]
call fcn.140013560
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x140013757
jmp 0x14001376c
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov dword [rsp + 0x24], 1
cmp dword [rsp + 0x24], 0
jne 0x140013785
cmp qword [rsp + 0x28], 0
je 0x140013785
mov rcx, qword [rsp + 0x28]
call fcn.14001a1a5
mov eax, dword [rsp + 0x24]
add rsp, 0x48
ret
Function at 0x14001c99c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001c9e6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001c9e6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001c9e6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001c9e6
cmp dword [rcx + 0x84], 0xe
jbe 0x14001c9e6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001c9e8
xor al, al
add rsp, 0x28
ret

Function at 0x14001e010
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001e038
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001e038
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001000
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
lea rbp, [rsp - 0x710]
sub rsp, 0x810
lea rax, [rbp + 0x728]
mov r9d, 0xf013f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREdialerconfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001099
jmp 0x14000104b
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and qword [rsp + 0x38], 0
lea r9, [rbp + 0x720]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x40]
and qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rbp + 0x728]
and qword [rsp + 0x20], 0
mov dword [rbp + 0x720], 0x3e8
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rcx, qword [rbp + 0x728]
test eax, eax
je 0x140001040
invalid
invalid
invalid
invalid
invalid

Function at 0x1400010c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4b0
mov eax, dword [0x140005010]
lea rdx, [rbp + 0x400]
mov rdi, qword [0x140005008]
mov r14d, ecx
mov dword [rsp + 0x60], eax
xor ebx, ebx
call fcn.1400019ac
test eax, eax
je 0x1400014c5
cmp dword [rbp + 0x400], ebx
je 0x1400014c5
mov r8d, r14d
xor edx, edx
mov ecx, 0x43a
invalid
invalid
xor al, byte [rdi + 0x24]
Function at 0x140001c64
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
xor esi, esi
mov word [rbp + 0x73], 0x100
lea rax, [rbp + 0x7f]
mov dword [rbp + 0x6f], esi
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov dword [rsp + 0x48], esi
lea rcx, [rbp + 0x6f]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], esi
xor r8d, r8d
mov dword [rsp + 0x30], esi
mov dl, 1
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140001d9c
lea rax, [rbp + 0x17]
mov qword [rbp + 0x77], rax
lea ecx, [rsi + 0x30]
mov rax, qword [rbp + 0x77]
mov byte [rax], sil
mov rax, qword [rbp + 0x77]
inc rax
mov qword [rbp + 0x77], rax
sub rcx, 1
jne 0x140001ccc
mov rax, qword [rbp + 0x7f]
lea r9, [rbp - 9]
xor r8d, r8d
mov dword [rbp + 0x17], 0x1f01ff
lea rdx, [rbp + 0x17]
mov qword [rbp + 0x1b], 2
mov dword [rbp + 0x33], esi
mov dword [rbp + 0x37], 5
lea ecx, [r8 + 1]
mov qword [rbp + 0x3f], rax
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x140001d9c
lea edx, [rax + 0x28]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140001d9c
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x140001d9c
mov r8, qword [rbp - 9]
xor r9d, r9d
mov rcx, rbx
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x140001d9c
lea rax, [rbp - 1]
mov dword [rbp - 1], 0x18
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov eax, 0x400
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
mov r9d, 0xff
mov rcx, rdi
mov dword [rsp + 0x20], eax
lea edx, [r8 + 3]
mov qword [rbp + 7], rbx
mov dword [rbp + 0xf], esi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
jmp 0x140001da0
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret

Function at 0x140001db4
Capabilities:
Resolve function by parsing pe exports
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
xor edi, edi
mov r12, rdx
mov r15d, edi
mov r10, rcx
Function at 0x140002078
Capabilities:
Read file via mapping

Disassembly:
test rcx, rcx
je 0x14000228a
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rbx, rcx
lea rdx, [0x140003470]
lea rcx, [rsp + 0x60]
xor r13d, r13d
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
test rax, rax
je 0x140002270
lea edi, [r13 + 0x18]
lea rax, [rsp + 0x40]
mov edx, edi
mov qword [rsp + 0x2b8], rax
lea ebx, [rdi - 0x17]
mov rcx, qword [rsp + 0x2b8]
mov byte [rcx], r13b
mov rcx, qword [rsp + 0x2b8]
add rcx, rbx
mov qword [rsp + 0x2b8], rcx
sub rdx, rbx
jne 0x1400020e9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, edi
lea r8, [rsp + 0x40]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140002267
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov r8d, ebx
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002267
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r13d
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
test rax, rax
je 0x14000225e
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
je 0x140002255
mov rcx, qword [rsp + 0x40]
movzx edi, r13w
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp r13w, word [rbx + 6]
jae 0x140002255
movzx ecx, word [rbx + 0x14]
add rcx, rbx
movzx eax, di
lea rdx, [rax + rax*4]
lea r12, [rcx + rdx*8]
lea rcx, [r12 + 0x18]
lea rdx, str..text
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400021ff
inc di
cmp di, word [rbx + 6]
jb 0x1400021cc
jmp 0x140002255
mov edi, dword [r12 + 0x24]
lea r9, [rsp + 0x2b0]
add rdi, qword [rsp + 0x40]
mov r8d, 0x40
mov ebx, dword [r12 + 0x20]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [r12 + 0x24]
mov r8d, ebx
add rdx, r15
mov rcx, rdi
call fcn.1400018b8
mov r8d, dword [rsp + 0x2b0]
lea r9, [rsp + 0x2b0]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002c18
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 8], ecx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
lea rcx, str..pipedialercontrol_redirect64
and dword [rax - 0x20], 0
mov edi, r8d
mov rsi, rdx
mov dword [rax - 0x28], 3
xor r8d, r8d
mov edx, 0xc0000000
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002cad
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
je 0x140002ca4
test edi, edi
je 0x140002ca4
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000cf56
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
or bpl, bpl
mov qword [rsp + 0x28], rdx
setge bpl
not bp
seto bpl
sub bp, 0x2529
lea rbp, [rbp*4 + 0x343d7324]
jle 0x1400cf4ed
je fcn.14004a541
test qword [rsp + r12 + 0x18], 0x44aaf102
je 0x1400bb2df
xor r12w, 0x7e8f
neg r12b
or r12d, r12d
mov r12, qword [rsp + r12*2 - 0xfcaa]
add word [rsp + 0x18], 0x1491
shl dword [rsp + 0x18], 0x42
sets byte [rsp + 0x18]
sub byte [rsp + 0x18], 0xac
shr qword [rsp + 0x18], 0xdf
call fcn.14004cc86
neg dl
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx]
shr bpl, 0x8b
lea r9, [rbp*2 - 0xef8dfec]
or bp, 0x3830
jae 0x1400c697c
xchg edx, eax
jl 0x14007798d
invalid
invalid
je fcn.140074cdf
lea rdx, [rdx - 0x4c7d14f5]
test rbp, r9
mov qword [rsp + 0x10], rbp
push r10
call fcn.1400b343d
setb r13b
add qword [rsp], 0xfffffffffffdb7a4
or r13w, r13w
nop
movabs rsi, 0x1b2b55921f9875bc
or r13d, 0x66049bbc
jbe 0x1400526fd
xor r13b, r13b
push r13
mov rsi, qword [rsp + r13 - 0x77959af8]
mov rsi, qword [rsi + r13 - 0x77959b00]
call fcn.14007b532
lea rbp, [rbp + riz - 0x43e22241]
not rbp
add qword [rsp + 8], 0x62da1
movabs rdx, 0x5801cc052d85e93d
push r9
movabs r9, 0xe68240bc4193879a
xor dl, 0xa
lea rdx, [rdx + rbp*4 - 0xf6f4a44]
jae 0x14007793f
Function at 0x14001b610
Capabilities:
Encode data using base64
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
pushfq
movabs r12, 0x7732613a1b8a073e
and r12b, 0x8c
add r12d, r12d
add r12b, r12b
js 0x1400a29a6

Function at 0x14001e0f0
Capabilities:
Create pipe

Disassembly:
not qword [rsp + 8]
jne 0x140001d52
jg 0x1400a65aa
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x30]
ret

Function at 0x14004c854
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + r11 + 0x7fece467], r14
jle fcn.1400cb023
lea rbp, [rbp + r14 + 0x68946287]
not qword [rsp + r14 + 0x5100d308]
sub r14, 0x6e916421

Function at 0x140052782
Capabilities:
Encode data using base64

Disassembly:
shl dword [rsp + 0x28], 0x34
add byte [rsp + 0x28], 8
lea rcx, [rcx + 0x25298385]
not word [rsp + 0x28]
mov qword [rsp + 0x10], rdx
seto byte [rsp + 0x10]
setno dl
push rdi
call fcn.1400c88fd
shl rdx, 0x4e
shr rdx, 0xa4
seta dl
mov rdx, qword [rsp + rdx*2 + 0x28]
mov qword [rsp + 0x28], rax
js 0x1400da5c3

Function at 0x140053673
Capabilities:
Connect pipe
Read file on windows

Disassembly:
jne 0x14009580d
js 0x140064c2c
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x90]
ret

Function at 0x140057142
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx]
neg ebp
not rbp
lea rbp, [rbp + rbp*2 + 0xb2ee389]
test bpl, bpl
mov qword [rsp + 0x40], rbp
lea rdx, [rdx - 0xb41f8fa]
jle 0x1400a3ef2

Function at 0x140062054
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
jne 0x140080a4e
lea rax, [rax + r9 - 0x1914bfcc]
shr r9d, 0x11
push r11
xor r9d, 0x988a6d91
or r9w, 0x697
not r9
test r9d, 0x7584d49d
push r8
movabs r11, 0xfb0d389a0e924ab1
xchg qword [rsp + 0x30], rax
mov r11, qword [rsp + 8]
setl r9b
jle 0x14005c941
or r9d, 0x1d225082
movabs r8, 0xe292f7ad5fb3fa28
test r9w, 0x788d
ja 0x140081a1b
mov r8, qword [rsp + r9 - 0x7f77d982]
neg r9w
jle 0x1400526d6
lea r9, [r9*2 + 0x5e9f9c24]
call fcn.14004c166

Function at 0x1400620b6
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
and qword [rsp + rdx*2 + 0x30], 0xc237299
cmp bx, word [rsp + 0x38]
not bx
xchg qword [rsp + rdx + 0x50], rsi
mov rdx, qword [rsp + rdx + 0x48]
movabs rbp, 0xd5926f2f5124bc2b
jle 0x1400d0569
shl dword [rcx], cl
ret
push rbx
not byte [rsp]
shl bx, 0x26
push rbp
and dword [rsp + 8], edx
lea rsi, [rsi + 0x2a23f127]
or dl, dh
push r8
jae 0x140010383
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x78]
ret
jg 0x14009c6c0
jo 0x1400bda8c
and qword [rsp + 0x10], 0x3a227c9e
add byte [rsp + 0x38], bl
mov rbp, qword [rsp + 8]
test word [rsp + 0x10], 0x2306
call fcn.14009c850
Function at 0x140063a2d
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
lea rbp, [r8 + rbp*4 - 0x11fae549]
movabs rcx, 0xca92c30e13a1931b
add sil, 0x9f
mov ecx, dword [rsp + 0x14]
xor word [rsp + rcx + 0x10], 0x36a4
or esi, dword [rsp + rcx + 0x10]
cmp qword [rsp + rsi - 0x76f2efae], 0xbb85d32
mov rcx, qword [rsp + rsi - 0x76f2efbe]
jge 0x1400b042d
push rax
invalid
shr edx, 0xc5
mov rbp, qword [rsp + 0x10]
mov rbp, qword [rbp + rdx - 0x116]
jns 0x1400d4fef
mov qword [rsp + 0x10], r13
jns 0x140092d42
and dword [rsp + 0x10], 0x2f36a33d
jb fcn.1400073e9
test byte [rsp + 0x10], 0x92
setae byte [rsp + 0x10]
mov qword [rsp + 0x18], rbx
neg word [rsp + 0x10]
shr word [rsp + 0x10], 0xb9
neg word [rsp + 0x10]
xor byte [rsp + 0x10], 0xb2
jbe 0x1400b42bc
not qword [rsp + 0x10]
add qword [rsp + 8], 0x2e620
mov rbx, qword [rsp + 0x10]
not dword [rsp + 0x10]
add byte [rsp + 0x10], 0xbb
mov byte [rsp + 0x10], bl
movsx ebx, word [rsp + 0x13]
push r11
js 0x14001c217
jno 0x1400d0593
mov rbx, qword [rsp + rbx*4 - 0xc]
mov rbx, qword [rbx]
movabs r11, 0x372991a86f992d30
mov r11b, byte [rsp + 0x1e]
mov qword [rsp + 0x10], r11
lea rbx, [rbx - 0xb41f8fa]
bswap r11
jno 0x1400c054c
neg r11w
jl 0x1400d3e2c
pushfq
push r11
movabs r11, 0x87bbe5ba499aeea3
mov r11d, 0x622caa1e
or r11b, 0xa6
mov qword [rsp + 0x10], 0xffffffffe0eaf524
mov r11, qword [rsp + r11 - 0x622caabe]
call fcn.1400540e9
call fcn.14007b5bd
jl 0x140013a90
or byte [rsp + rsi - 0x76f2efae], sil
jne 0x1400deec0
sub dword [rsp + 8], 0xcd2a5530
lea rsi, [rsi + 1]
neg word [rsp + 8]
push r13
push r10
movabs r10, 0x3f2a95082e192eb4
or r10b, 0x36
mov qword [rsp + 0x40], rsi
shl r10w, 0xf6
cmp edi, r10d
push r14
push rdx
jg 0x14004a6a4
push r10
setne r10b
add qword [rsp + 0x28], 0xfffffffffffb65bf
xor qword [rsp + 0x48], 0xffffffffb8a8bdb6
push r9
movabs rdx, 0xa434db1ebdb1c724
call fcn.140095c1d
call fcn.140009860
push rdx
call fcn.140082c27
test byte [rsp + 0x18], r11b
xchg qword [rsp + 0x20], rbx
mov r11, qword [rsp]
call fcn.1400ae87d
call fcn.14005ad0a
cmp al, 0x86
sbb eax, 0xedd52151
je 0x1400d505f
shl byte [rax + rsi*8 + 0x3e], 1
xor eax, 0x75ed6949
mov edi, 0x3c700854
adc byte [rsi], 0x29
cmp ebp, edi
cdq
iretd
mov dh, 0x57
pop rdx
add dword [rax], eax
add byte [rax], al
and byte [rdi + 0x12], cl
hlt
or esi, 0x97904895
mov rsi, qword [rsp + 0x18]
call fcn.14006e091
xor byte [rsi - 0x18], ch
mov edi, 0x27bb0bb7
rcr edx, 1
cmpsb byte [rsi], byte [rdi]
mov esi, 0x2fa01a52
outsd dx, dword [rsi]
invalid

Function at 0x140064392
Capabilities:
Enumerate process modules

Disassembly:
pushfq
add qword [rsp + 8], 0xffffffffbff9a668
xchg qword [rsp + 0x10], rbx
call fcn.14004c2cf

Function at 0x1400643a6
Capabilities:
Enumerate process modules

Disassembly:
push rdi
pushfq
movabs rdi, 0x7014d08d30aaaf96
test di, 0xef9f
movabs rdi, 0x2703f9376a042591
call int.14004918d

Function at 0x1400643cb
Capabilities:
Enumerate process modules

Disassembly:
mov r13, qword [rsp + 0x70]
call fcn.140051a13

Function at 0x1400643d5
Capabilities:
Enumerate process modules

Disassembly:
not word [rsp + 0x78]
jae 0x140074ca4
call fcn.14001d409
mov rdi, qword [rsp + 0x18]
call fcn.14001c316
Function at 0x1400643e5
Capabilities:
Enumerate process modules

Disassembly:
adc eax, 0x242b88
and dword [rsp + 0x48], 0
mov rbp, rax
xor esi, esi
lea r8, [rsp + 0x48]
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140002d76
mov ecx, dword [rsp + 0x48]
xor ebx, ebx
shr ecx, 2
mov dword [rsp + 0x48], ecx
test ecx, ecx
je 0x140002d64
xor edx, edx
test esi, esi
je 0x140002d53
mov r8d, dword [rdi + rbx*4]
cmp r8d, dword [rbp + rdx*4]
je 0x140002d5e
inc edx
cmp edx, esi
jb 0x140002d46
mov ecx, dword [rdi + rbx*4]
call qword [r14 + reloc.OLEAUT32.dll_VariantClear]
mov ecx, dword [rsp + 0x48]
inc ebx
cmp ebx, ecx
jb 0x140002d3c
mov r8, r15
mov rdx, rdi
mov rcx, rbp
call fcn.1400018b8
mov esi, dword [rsp + 0x48]
mov ecx, dword [r14]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002d16
mov r9, qword [rsp + 0x48]
jg 0x1400b9106
call fcn.1400c68b6
push rbp
not r9w
call fcn.14006f6bf
jbe 0x140002d07
cmp si, 0xb3a3
js 0x1400a3d2b
or qword [rsp + 0x40], 0xffffffff9ab41ea9
mov rsi, qword [rsp + 0x38]
add byte [rsp + 0x40], 0x13
call fcn.1400d3dee
jmp 0x1950f9037

Function at 0x140064c11
Capabilities:
Connect pipe
Read file on windows

Disassembly:
movabs rsi, 0xcb9a699f8e1cffaa
neg rdi

Function at 0x14006534f
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports
Terminate process

Disassembly:
not qword [rsp + 0x28]
jge 0x1400c9e01

Function at 0x140065959
Capabilities:
Enumerate process modules

Disassembly:
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140002c00
mov ecx, dword [rbp + 0x380]
shr ecx, 2
mov dword [rbp + 0x380], ecx
test ecx, ecx
je 0x140002c00
mov eax, edi
mov r9d, 1
mov ecx, dword [rbx + rax*4]
call fcn.1400010c0
inc edi
cmp edi, dword [rbp + 0x380]
jb 0x14000289f
jmp 0x140002c00
jns 0x1400d7add
movabs r8, 0x79266012ea5b5b3
lea rcx, [rcx + rbx*2 - 0x7fd6384]
ja 0x14001e242
and r15d, dword [rsp + 0x83]
not dword [rsp + r15 + 0x80]
mov r15, qword [rsp + r15*2 + 0x28]
or byte [rsp + 0x80], 0x3a
jg 0x14000287a
cmp dword [rsp + 0x80], 0x66122502
push qword [rsp + 0x90]
popfq
lea rsp, [rsp + 0xa0]
ret

Function at 0x140068a4a
Capabilities:
Connect pipe
Execute shellcode via indirect call
Read file on windows
Resolve function by parsing pe exports

Disassembly:
shr r9d, 0xca
jb 0x1400975a8
call fcn.1400a550a

Function at 0x140074132
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
jl 0x1400b5248
cmp byte [rsi - 0x343c6c94], dl
invalid
mov qword [rsp + 0x58], rax
ja 0x1400d863b
push rcx
jle 0x140050402
call fcn.140012960
or qword [rsp + 0x10], 0xffffffffe0a51ea0
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x48]
ret