joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a8c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13d0
call fcn.1400287d0
sub rsp, rax
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
lea ecx, [rdi + 0x10]
call fcn.140027b44
mov qword [rsi], rax
mov qword [rsi + 8], rax
add rax, 0x10
mov qword [rsi + 0x10], rax
mov rax, qword [rsi]
lea rcx, [rax + 0x10]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rsi + 8], rcx
mov ebx, 1
mov dword [rsp + 0x20], ebx
call fcn.140027208
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, ebx
mov dword [rsp + rbx*4 + 0x34], eax
inc rbx
cmp rbx, 0x270
jb 0x14001a950
mov dword [rsp + 0x30], 0x270
nop word [rax + rax]
lea rcx, [rsp + 0x30]
call fcn.14001c720
movzx edx, al
mov rcx, qword [rsi]
mov byte [rdi + rcx], dl
inc rdi
cmp rdi, 0x10
jl 0x14001a980
mov rax, rsi
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.140027af0
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14001a9d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x130
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov ebp, edx
mov rbx, r8
add ebp, 0xfffffff0
mov r14, rcx
test rcx, rcx
je 0x14001aa07
movups xmm0, xmmword [rcx]
jmp 0x14001aa1a
call fcn.14003316c
mov dword [rax], 0x16
call fcn.14002e468
xorps xmm0, xmm0
mov rdx, qword [rbx]
lea rcx, [rsp + 0x20]
add r14, 0x10
call fcn.140001bf0
movaps xmmword [rsp + 0x110], xmm0
mov rbx, r14
mov esi, ebp
test ebp, ebp
je 0x14001aaa9
mov qword [rsp + 0x158], rdi
lea rdi, [rsp + 0x110]
sub rdi, r14
dec rsi
shr rsi, 4
inc rsi
nop dword [rax]
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140002600
mov ecx, 0x10
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14001aa80
sub rdi, 0x10
movaps xmmword [rsp + 0x110], xmm0
sub rsi, 1
jne 0x14001aa60
mov rdi, qword [rsp + 0x158]
lea eax, [rbp - 1]
xor ecx, ecx
movzx eax, byte [rax + r14]
sub ebp, eax
cmp eax, 0x10
cmova ebp, ecx
mov eax, ebp
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140027af0
mov rbx, qword [rsp + 0x160]
add rsp, 0x130
pop r14
pop rsi
pop rbp
ret
Function at 0x14001aaf0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x170
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [r11 + 8], rbx
xorps xmm0, xmm0
mov qword [r11 - 0x18], rdi
mov rbx, rcx
mov qword [r11 - 0x20], r14
lea rcx, [rsp + 0x20]
xor eax, eax
mov qword [r11 - 0x28], r15
mov r14, r8
mov qword [rsp + 0x30], rax
mov rdi, rdx
movups xmmword [rsp + 0x20], xmm0
call fcn.14001a8c0
mov rax, qword [r14]
mov rsi, qword [rsp + 0x20]
mov r15, qword [rbx]
test rax, rax
je 0x14001ac50
mov qword [rsp + 0x168], rbp
mov ebp, dword [rdi + 0x10]
test rsi, rsi
je 0x14001ab6b
movups xmm0, xmmword [rsi]
movups xmmword [rax], xmm0
jmp 0x14001ab81
xorps xmm0, xmm0
movups xmmword [rax], xmm0
call fcn.14003316c
mov dword [rax], 0x16
call fcn.14002e468
cmp qword [rdi + 0x18], 0x10
jb 0x14001ab8b
mov rdi, qword [rdi]
mov rcx, qword [r14]
mov r9, rbp
add rcx, 0x10
mov r8, rdi
mov rdx, rbp
call fcn.14001c8b0
mov rcx, qword [r14]
mov eax, ebp
and eax, 0xf
add rcx, 0x10
mov edi, 0x10
mov r8d, 0x10
sub edi, eax
add rcx, rbp
movzx eax, bpl
mov edx, edi
and eax, 0xf
sub r8, rax
call fcn.14002a410
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140001bf0
mov rbx, qword [r14]
lea eax, [rdi + rbp]
movups xmm0, xmmword [rsi]
mov rbp, qword [rsp + 0x168]
lea r8, [rsp + 0x130]
add rbx, 0x10
mov edi, eax
movaps xmmword [rsp + 0x130], xmm0
test eax, eax
je 0x14001ac4b
dec rdi
shr rdi, 4
inc rdi
nop
mov rax, rbx
sub r8, rbx
mov edx, 0x10
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14001ac20
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140002300
mov r8, rbx
add rbx, 0x10
sub rdi, 1
jne 0x14001ac10
mov rsi, qword [rsp + 0x20]
mov r15, qword [rsp + 0x150]
mov r14, qword [rsp + 0x158]
mov rdi, qword [rsp + 0x160]
mov rbx, qword [rsp + 0x180]
test rsi, rsi
je 0x14001aca6
mov rdx, qword [rsp + 0x30]
mov rax, rsi
sub rdx, rsi
cmp rdx, 0x1000
jb 0x14001ac9e
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001acbf
mov rcx, rsi
call fcn.140027b3c
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140027af0
add rsp, 0x170
pop rsi
ret
call fcn.14002e488
int3
Function at 0x14001ae90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0x80]
xor sil, sil
cmp qword [r8 + 0x18], 0x10
mov rdi, r9
mov rax, r8
jb 0x14001aec9
mov rax, qword [r8]
lea rcx, [rsp + 0x30]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001afb2
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
mov dword [rsp + 0x38], eax
jb 0x14001af05
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001afa7
mov edx, dword [rsp + 0x38]
xor r8d, r8d
dec edx
mov dword [rsp + 0x3c], 1
mov rcx, rbx
call fcn.140002820
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
jb 0x14001af53
mov rax, qword [rbx]
cmp qword [rdi + 0x18], 0x10
jb 0x14001af5d
mov rdi, qword [rdi]
lea rcx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x3c]
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001afa7
cmp dword [rsp + 0x38], eax
jne 0x14001afa4
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
jb 0x14001af99
mov rax, qword [rbx]
mov qword [rbx + 0x10], 0
mov byte [rax], sil
mov sil, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140027af0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14001d770
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rcx
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 5
test rax, rax
jne 0x14001d7b7
mov eax, 7
jmp 0x14001d877
xor r15d, r15d
mov edi, r15d
test rax, rax
je 0x14001d872
mov r14d, r15d
mov ebp, 0xf
nop
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rbp
mov byte [rsp + 0x48], 0
add rdx, r14
lea rcx, [rsp + 0x28]
call fcn.1400012e0
mov rbx, rax
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x14001d801
mov rcx, qword [rax]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov rdx, qword [rbx + 0x18]
test eax, eax
je 0x14001d89e
cmp rdx, 0x10
jb 0x14001d849
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14001d844
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001d8e2
mov rcx, r8
call fcn.140027b3c
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], rbp
mov byte [rbx], 0
inc rdi
add r14, 0x20
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, rdx
sar rax, 5
cmp rdi, rax
jb 0x14001d7d0
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140027af0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
cmp rdx, 0x10
jb 0x14001d8d0
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14001d8cb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001d8e2
mov rcx, r8
call fcn.140027b3c
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], rbp
mov byte [rbx], 0
mov eax, 6
jmp 0x14001d877
call fcn.14002e488
int3
Function at 0x14001ef60
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rcx
xor r14d, r14d
mov esi, r14d
cmp qword [rdx + 0x18], 0x10
jb 0x14001ef9b
mov rdx, qword [rdx]
mov qword [rbp + 7], r14
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], 0xf
mov byte [rbp + 7], sil
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], sil
jne 0x14001efc0
lea rcx, [rbp + 7]
call fcn.1400019d0
nop
cmp qword [rdi + 0x18], 0x10
jb 0x14001efdd
mov rdi, qword [rdi]
mov qword [rbp - 0x19], r14
mov qword [rbp - 9], r14
mov qword [rbp - 1], 0xf
nop dword [rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x14001eff0
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x19]
call fcn.1400019d0
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae rdx, qword [rbp - 0x19]
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001f090
mov dword [rbp + 0x2f], r14d
mov dword [rbp + 0x33], 4
mov dword [rbp + 0x37], 4
lea r8, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae r8, qword [rbp + 7]
lea rax, [rbp + 0x33]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x37]
lea rdx, [0x140061cb8]
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
cmove esi, dword [rbp + 0x2f]
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x14001f0c7
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f0c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f13a
call fcn.140027b3c
mov qword [rbp - 9], r14
mov qword [rbp - 1], 0xf
mov byte [rbp - 0x19], 0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x14001f10e
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f109
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f134
call fcn.140027b3c
mov eax, esi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140027af0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14002e488
nop
call fcn.14002e488
nop
Function at 0x14001f140
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov esi, r8d
mov rdi, rcx
cmp qword [rdx + 0x18], 0x10
jb 0x14001f171
mov rdx, qword [rdx]
xor r14d, r14d
mov qword [rbp - 9], r14
mov qword [rbp + 7], r14
mov qword [rbp + 0xf], 0xf
mov byte [rbp - 9], r14b
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdx + r8], r14b
jne 0x14001f192
lea rcx, [rbp - 9]
call fcn.1400019d0
nop
cmp qword [rdi + 0x18], 0x10
jb 0x14001f1af
mov rdi, qword [rdi]
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], 0xf
nop
inc rbx
cmp byte [rdi + rbx], 0
jne 0x14001f1c0
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x29]
call fcn.1400019d0
mov dword [rbp + 0x1f], esi
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae rdx, qword [rbp - 0x29]
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
mov r9d, 0x20206
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001f24c
lea r8, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae r8, qword [rbp - 9]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea rdx, [0x140061cb8]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x14001f283
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f27e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f2ea
call fcn.140027b3c
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], 0xf
mov byte [rbp - 0x29], 0
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x14001f2ca
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f2c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f2e4
call fcn.140027b3c
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140027af0
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002e488
nop
call fcn.14002e488
nop
Function at 0x1400214f0
Capabilities:
Get session information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
xor ebx, ebx
lea r9, [rsp + 0x48]
mov edi, eax
mov dword [rsp + 0x5c], ebx
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rbx
mov edx, edi
mov qword [rsp + 0x20], rax
lea r8d, [rbx + 0x18]
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x140021555
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140021555
cmp dword [rcx], ebx
jne 0x14002154f
mov eax, edi
jmp 0x1400215c7
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
xor edx, edx
mov dword [rsp + 0x58], ebx
lea rax, [rsp + 0x58]
xor ecx, ecx
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r8d, [rdx + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
test r8d, r8d
je 0x1400215b9
nop word [rax + rax]
mov eax, ebx
lea rcx, [rax + rax*2]
movups xmm0, xmmword [rdx + rcx*8]
movsd xmm1, qword [rdx + rcx*8 + 0x10]
movsd qword [rsp + 0x40], xmm1
cmp dword [rsp + 0x40], 0
movups xmmword [rsp + 0x30], xmm0
je 0x1400215e2
inc ebx
cmp ebx, r8d
jb 0x140021590
mov rcx, rdx
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140027af0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov rcx, rdx
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, dword [rsp + 0x30]
jmp 0x1400215c7

Function at 0x140021740
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [0x140021770]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret
Function at 0x1400217f0
Capabilities:
Delete registry key
Delete service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x1400218cb
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.1400140b0
cmp qword [rsp + 0x48], 0x10
lea rdx, [rsp + 0x30]
mov r8d, 0x10000
mov rcx, rbx
cmovae rdx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdx, qword [rsp + 0x48]
mov rdi, rax
cmp rdx, 0x10
jb 0x140021894
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002188f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021995
call fcn.140027b3c
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
test rdi, rdi
je 0x1400218c2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x30]
call fcn.14001f2f0
cmp qword [rax + 0x18], 0x10
jb 0x1400218ea
mov rax, qword [rax]
lea rcx, [rsp + 0x50]
mov r9d, 0xf023f
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002192e
mov rcx, qword [rsp + 0x50]
lea rdx, [0x140061cb8]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140021967
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021962
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002198f
call fcn.140027b3c
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400219a0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140027af0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
call fcn.14002e488
int3
call fcn.14002e488
int3
Function at 0x1400219a0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x1620]
mov eax, 0x1720
call fcn.1400287d0
sub rsp, rax
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rbp + 0x1610], rax
xor edx, edx
lea rcx, [rbp + 0x610]
mov r8d, 0x1000
call fcn.14002a410
mov r8d, 0x800
lea rdx, [rbp + 0x610]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea rcx, [rbp + 0x200]
mov r8d, 0x410
call fcn.14002a410
mov edx, 0x49
lea rcx, [rsp + 0x50]
call fcn.140014500
cmp qword [rax + 0x18], 8
jb 0x140021a1e
mov rax, qword [rax]
lea r9, [rbp + 0x610]
mov r8, rax
mov edx, 0x208
lea rcx, [rbp + 0x200]
call fcn.140021630
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140021a7b
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021a76
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021b9f
call fcn.140027b3c
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x200
call fcn.14002a410
mov edx, 0x4a
lea rcx, [rsp + 0x50]
call fcn.140014500
cmp qword [rax + 0x18], 8
jb 0x140021aa5
mov rax, qword [rax]
mov r8d, 0x100
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140021afa
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021af5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021b99
call fcn.140027b3c
xor ecx, ecx
lea rdx, [rbp + 0x200]
xorps xmm0, xmm0
xor eax, eax
mov qword [rbp - 0x10], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
movups xmmword [rbp - 0x30], xmm0
mov dword [rsp + 0x20], ecx
mov word [rbp - 0x30], cx
lea rcx, [rbp]
movups xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x70], 0x68
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x34], 1
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1610]
xor rcx, rsp
call fcn.140027af0
add rsp, 0x1720
pop rbp
ret
call fcn.14002e488
int3
call fcn.14002e488
int3
Function at 0x140022fe0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rbp + 0x1a8], rax
xor r15d, r15d
mov edi, r15d
call fcn.1400214f0
mov r14d, eax
cmp eax, 0xffffffff
jne 0x140023024
xor eax, eax
jmp 0x140023223
mov edx, 0x1e
mov qword [rsp + 0x2d8], rsi
lea rcx, [rbp + 0x188]
call fcn.140014500
xor edx, edx
mov dword [rsp + 0x40], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400231d7
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x1400231ce
mov qword [rsp + 0x2d0], rbx
nop dword [rax]
lea rcx, [rsp + 0x6c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140023090
cmp qword [rbp + 0x1a0], 8
lea r10, [rbp + 0x188]
mov r11, qword [rbp + 0x198]
lea rcx, [rsp + 0x6c]
cmovae r10, qword [rbp + 0x188]
mov r9, r11
cmp rax, r11
cmovb r9, rax
test r9, r9
je 0x140023114
movzx edx, word [r10]
movzx r8d, word [rsp + 0x6c]
cmp dx, r8w
jb 0x1400231af
lea rbx, [rsp + 0x6c]
sub r10, rbx
cmp dx, r8w
ja 0x1400231af
cmp r9, 1
je 0x140023114
movzx edx, word [r10 + rcx + 2]
add rcx, 2
dec r9
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x1400230ec
jmp 0x1400231af
cmp r11, rax
jb 0x1400231af
ja 0x1400231af
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400231af
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], r15
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400231a6
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x180]
mov r9d, 4
mov dword [rbp + 0x180], 4
lea r8, [rbp + 0x184]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14002319b
cmp dword [rbp + 0x184], r14d
cmove edi, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140023080
mov rbx, qword [rsp + 0x2d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x1a0]
mov rsi, qword [rsp + 0x2d8]
cmp rdx, 8
jb 0x140023221
mov rcx, qword [rbp + 0x188]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002321c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023247
call fcn.140027b3c
mov eax, edi
mov rcx, qword [rbp + 0x1a8]
xor rcx, rsp
call fcn.140027af0
mov rdi, qword [rsp + 0x2e0]
add rsp, 0x2b0
pop r15
pop r14
pop rbp
ret
call fcn.14002e488
int3