joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019080
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x7e0]
sub rsp, 0x8e0
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rbp + 0x7d0], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x48], 0x400
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x28]
call fcn.14001a110
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x70]
call fcn.14001daf0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140019141
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001913c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001913c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dfb0
movdqa xmm0, xmmword [0x140023bf0]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], di
cmp qword [rbp - 0x80], 1
jae 0x140019265
mov qword [rbp - 0x3e], rdi
mov dword [rbp - 0x36], edi
mov dword [rbp - 0x50], 0x730075
mov dword [rbp - 0x4c], 0x720065
mov dword [rbp - 0x48], 0x61006e
mov dword [rbp - 0x44], 0x65006d
mov word [rbp - 0x40], di
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14001a110
nop
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.14001daf0
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x60]
movups xmmword [rbx + 0x10], xmm1
movdqa xmm0, xmmword [0x140023c00]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140019211
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001920c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001920c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dfb0
movdqa xmm0, xmmword [0x140023bf0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], di
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140019275
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001925e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001925e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dfb0
jmp 0x140019275
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rbp + 0x7d0]
xor rcx, rsp
call fcn.14001df90
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400192a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov qword [rbp - 0x61], rcx
xor edi, edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
mov dword [rbp + 0x37], eax
mov dword [rbp - 0x61], 0x32
mov word [rbp - 0x4c], di
mov dword [rbp - 0x59], 0x6e72654b
mov dword [rbp - 0x55], 0x32336c65
mov dword [rbp - 0x51], 0x6c6c642e
mov byte [rbp - 0x4d], al
lea rcx, [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov word [rbp - 0x38], di
mov byte [rbp - 0x36], dil
movdqa xmm0, xmmword [0x140023cf0]
movdqu xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x39], dil
lea rdx, [rbp - 0x49]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028c38], rax
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x29]
call rax
lea rdx, [rbp - 0x29]
lea rcx, [rsp + 0x28]
call fcn.14001a110
nop
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.14001daf0
nop
mov rdx, qword [rbp - 0x69]
cmp rdx, 7
jbe 0x1400193b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400193ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400193ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dfb0
mov rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14001df90
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001d9b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x48], rcx
xor r15d, r15d
mov dword [rbp - 0x50], r15d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x40], 0x6e72656b
mov dword [rbp - 0x3c], 0x32336c65
mov dword [rbp - 0x38], 0x6c6c642e
mov byte [rbp - 0x34], al
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp - 0x18], 0x726168
mov byte [rbp - 0x10], r15b
movdqa xmm0, xmmword [0x140023cc0]
movdqu xmmword [rbp - 0x28], xmm0
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028ca0], rax
mov r8, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14001da4d
mov r8, qword [rbx]
lea rsi, [rbx + 0x10]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, dword [rsi]
xor edx, edx
mov ecx, 0xfde9
call rax
movsxd r14, eax
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
mov r8, r14
mov rcx, rdi
call fcn.14001dcc0
mov dword [rbp - 0x50], 1
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14001da97
mov rcx, qword [rdi]
cmp qword [rbx + 0x18], 0xf
jbe 0x14001daa1
mov rbx, qword [rbx]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsi]
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [0x140028ca0]
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14001df90
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001daf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, rdx
mov rdi, rcx
mov qword [rbp - 0x11], rcx
xor r12d, r12d
mov dword [rbp - 0x19], r12d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 9], xmm0
mov dword [rbp + 7], eax
mov dword [rbp - 9], 0x6e72656b
mov dword [rbp - 5], 0x32336c65
mov dword [rbp - 1], 0x6c6c642e
mov byte [rbp + 3], al
lea rcx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x1f], 0x657479
mov byte [rbp + 0x27], r12b
movdqa xmm0, xmmword [0x140023cb0]
movdqu xmmword [rbp + 0xf], xmm0
lea rdx, [rbp + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028c98], rax
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r12b
mov dword [rbp - 0x19], 1
mov r8, r14
cmp qword [r14 + 0x18], 7
jbe 0x14001dbb1
mov r8, qword [r14]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, dword [r14 + 0x10]
xor edx, edx
mov ecx, 0xfde9
call rax
movsxd r15, eax
test eax, eax
jle 0x14001dc8a
mov rcx, r15
mov rdx, qword [rdi + 0x10]
cmp r15, rdx
ja 0x14001dc01
mov qword [rdi + 0x10], rcx
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14001dbfa
mov rdx, qword [rdi]
mov byte [rdx + r15], 0
jmp 0x14001dc4b
mov rsi, rcx
sub rsi, rdx
mov r8, qword [rdi + 0x18]
mov rax, r8
sub rax, rdx
cmp rsi, rax
ja 0x14001dc3d
mov qword [rdi + 0x10], rcx
mov rax, rdi
cmp r8, 0xf
jbe 0x14001dc26
mov rax, qword [rdi]
lea rbx, [rax + rdx]
mov r8, rsi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + rsi], 0
jmp 0x14001dc4b
mov r9, rsi
mov rdx, rsi
mov rcx, rdi
call fcn.14001ddf0
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14001dc58
mov rax, qword [rdi]
mov r8, r14
cmp qword [r14 + 0x18], 7
jbe 0x14001dc65
mov r8, qword [r14]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov r9d, dword [r14 + 0x10]
xor edx, edx
mov ecx, 0xfde9
call qword [0x140028c98]
mov rax, rdi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14001df90
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x14001eadc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001eb26
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001eb26
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001eb26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001eb26
cmp dword [rcx + 0x84], 0xe
jbe 0x14001eb26
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001eb28
xor al, al
add rsp, 0x28
ret
Function at 0x142904058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1429041df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x142904089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14290406f
add dl, dl
jne 0x142904096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1429040f6
xor eax, eax
add dl, dl
jne 0x1429040a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1429041ad
add dl, dl
jne 0x1429040b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1429040c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1429040d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1429040dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1429040ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14290407e
mov eax, 1
add dl, dl
jne 0x142904106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142904113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1429040fb
sub eax, ebx
mov ebx, 1
jne 0x14290414c
mov ecx, 1
add dl, dl
jne 0x14290412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14290413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x142904123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14290407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x142904168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x142904175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14290415d
cmp eax, 0x7d00
jae 0x14290419b
cmp eax, 0x500
jb 0x142904196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14290407e
cmp eax, 0x7f
ja 0x14290419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14290407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1429041d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14290407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000265c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x13e0
call fcn.140079330
sub rsp, rax
mov rax, qword [0x14009e040]
xor rax, rsp
mov qword [rsp + 0x13d0], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
and dword [rsp + 0x20], 0
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
and qword [rcx + 0x10], 0
and qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 0xf
mov byte [rcx], 0
mov dword [rsp + 0x20], 1
mov edi, 0x1e
mov edx, edi
call fcn.140003444
and qword [rbx + 0x10], 0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
or dword [rsp + 0x13c4], 0xffffffff
mov dword [rsp + 0x44], eax
lea edx, [rdi - 0x1d]
mov r8d, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [rsp + rdx*4 + 0x44], ecx
inc rdx
cmp rdx, r8
jb 0x1400026e2
mov dword [rsp + 0x40], r8d
and qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0x3d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.140003bb0
lea r9, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
mov r9b, byte [rax + r9]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x140002755
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000274a
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000275d
mov rcx, rbx
call fcn.140003540
sub rdi, 1
jne 0x140002711
mov rax, rbx
mov rcx, qword [rsp + 0x13d0]
xor rcx, rsp
call fcn.1400774a0
mov rbx, qword [rsp + 0x13f8]
add rsp, 0x13e0
pop rdi
ret
Function at 0x140006c34
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14009e040]
xor rax, rsp
mov qword [rbp - 8], rax
xor r12d, r12d
mov r15, r8
mov qword [rdx], r12
mov rbx, rdx
mov qword [rdx + 8], r12
mov r14d, r12d
mov dword [rdx + 0x10], r12d
movsxd rsi, dword [r8 + 0x3c]
add rsi, r8
movzx eax, word [rsi + 0x14]
lea rdi, [rsi + 0x18]
add rdi, rax
cmp r12w, word [rsi + 6]
jae 0x140006d69
xorps xmm0, xmm0
mov qword [rbp - 0x18], r12
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x10], r12
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], r12b
jne 0x140006ca2
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.140003660
mov rdx, qword [rbp - 0x10]
lea rax, [rbp - 0x28]
mov rcx, qword [rbp - 0x28]
cmp rdx, 0xf
cmova rax, rcx
cmp qword [rbp - 0x18], 5
jne 0x140006d26
cmp dword [rax], 0x7865742e
jne 0x140006d26
cmp byte [rax + 4], 0x74
jne 0x140006d26
mov r9d, dword [rdi + 0xc]
mov r8d, r12d
mov r11d, dword [rdi + 8]
add r9, r15
mov qword [rbp - 0x40], rdi
mov r10, r12
mov qword [rbp - 0x38], r9
test r11, r11
je 0x140006d11
movzx eax, byte [r9 + r10]
inc r10
crc32 r8d, eax
cmp r10, r11
jb 0x140006cfe
movups xmm0, xmmword [rbp - 0x40]
mov dword [rbp - 0x30], r8d
movsd xmm1, qword [rbp - 0x30]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
cmp rdx, 0xf
jbe 0x140006d55
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d50
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d91
call fcn.1400777d0
movzx eax, word [rsi + 6]
inc r14d
add rdi, 0x28
cmp r14d, eax
jl 0x140006c8f
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400774a0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x140006f9c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.1400774c0
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140007024]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x140006ff6
mov rax, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14000b398
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14009e040]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x14000b400
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14000b430
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14000b3e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400774a0
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov dword [0x14014ca50], eax
jmp 0x14000b40f
Function at 0x14000b934
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax]
xor ebx, ebx
mov eax, dword [rcx + rax]
cmp dword [0x14014e208], eax
jle 0x14000b9fe
lea rcx, [0x14014e208]
call fcn.1400778ac
cmp dword [0x14014e208], 0xffffffff
jne 0x14000b9fe
xorps xmm0, xmm0
movups xmmword [0x14014e1e8], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x14014e1f8], xmm1
mov qword [rsp + 0x30], 0x2f
lea rdx, [rsp + 0x30]
call fcn.140003e24
mov rdx, rax
mov qword [0x14014e1e8], rax
mov qword [0x14014e1f8], 0x22
mov rax, qword [rsp + 0x30]
mov qword [0x14014e200], rax
movups xmm0, xmmword [str.SystemCurrentControlSetServices_]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [0x1400850e8]
movups xmmword [rdx + 0x10], xmm1
movzx eax, word [0x1400850f8]
mov word [rdx + 0x20], ax
mov byte [rdx + 0x22], bl
lea rcx, [0x14007d318]
call fcn.140077b4c
nop
lea rcx, [0x14014e208]
call fcn.140077840
lea rdx, [0x14014e1e8]
cmp qword [0x14014e200], 0xf
cmova rdx, qword [0x14014e1e8]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea rdx, [0x14014b710]
cmp qword [0x14014b728], 0xf
cmova rdx, qword [0x14014b710]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x14000ba5e
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14000ba5e
mov bl, 1
mov al, bl
add rsp, 0x20
pop rbx
ret
Function at 0x14000ba68
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14009e040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
mov qword [rbp - 0x40], 0x2f
lea rdx, [rbp - 0x40]
call fcn.140003e24
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0x22
mov rcx, qword [rbp - 0x40]
mov qword [rbp - 0x20], rcx
movups xmm0, xmmword [str.SystemCurrentControlSetServices_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400850e8]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x1400850f8]
mov word [rax + 0x20], cx
xor edi, edi
mov byte [rax + 0x22], dil
mov rdx, rbx
lea rcx, [rbp - 0x38]
call fcn.140002e18
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rdx, qword [rbp - 0x38]
lea r8, [rbp - 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x14000bbea
mov byte [rbp - 0x50], 1
lea ebx, [rdi + 4]
mov dword [rsp + 0x28], ebx
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000bbea
mov byte [rbp - 0x4f], 3
mov dword [rsp + 0x28], ebx
lea rax, [rbp - 0x4f]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000bbea
mov byte [rbp - 0x4e], 3
mov dword [rsp + 0x28], ebx
lea rax, [rbp - 0x4e]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000bbea
mov eax, dword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x14000bbb3
mov rsi, qword [rsi]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000bbea
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete dil
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x14000bc28
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bc23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bc23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400777d0
mov al, dil
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400774a0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f288
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14009e040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [rcx]
mov rbx, rdx
add rcx, 0x48
mov qword [rsp + 0x28], rdx
call fcn.140011ab0
test rax, rax
je 0x14000f2c3
mov rdx, rax
mov rcx, rbx
call fcn.14000f1b4
jmp 0x14000f325
movdqa xmm0, xmmword [0x140091a70]
xor ecx, ecx
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], 0x5510
mov byte [rsp + 0x42], 0
mov al, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
inc rcx
cmp rcx, 0x11
jb 0x14000f2df
xorps xmm0, xmm0
mov byte [rsp + 0x42], 0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
lea rax, [rsp + 0x31]
and qword [rbx + 0x18], 0
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14000f30e
lea rdx, [rsp + 0x31]
mov rcx, rbx
call fcn.140003660
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400774a0
add rsp, 0x50
pop rbx
ret

Function at 0x14000ffac
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000ffdc
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140010054
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14000fff3
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000fff5
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14001004e
test ecx, ecx
jle 0x14001002e
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14001004e
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14001004e
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret