joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017000
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x580]
sub rsp, 0x680
mov rax, qword [0x14002ff78]
xor rax, rsp
mov qword [rbp + 0x570], rax
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rbp + 0x360]
mov dword [rsp + 0x34], 3
mov rsi, r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x20c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
xor r14d, r14d
test eax, eax
jne 0x14001717f
mov ebx, 0x106
lea r8, [0x14001f688]
lea rax, [rsp + 0x40]
mov edx, ebx
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffef8]
test rax, rax
je 0x1400170ab
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400170ab
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140017088
test rdx, rdx
lea rax, [rcx - 2]
mov edi, r14d
cmovne rax, rcx
mov word [rax], r14w
cmp dword [rsp + 0x30], r14d
jbe 0x140017125
mov eax, edi
lea r8, str._02x
mov edx, 0x104
lea rcx, [rbp + 0x150]
movzx r9d, byte [rbp + rax + 0x360]
call fcn.140001b7c
lea r8, [rsp + 0x38]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400095a4
test eax, eax
js 0x14001711d
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov rdx, rbx
lea r9, [rbp + 0x150]
sub rdx, rax
lea rcx, [rcx + rax*2]
call fcn.140009610
inc edi
cmp edi, dword [rsp + 0x30]
jb 0x1400170c4
lea r8, [rsp + 0x38]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400095a4
test eax, eax
js 0x14001715b
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
sub rbx, rax
lea r9, [0x14001f688]
mov rdx, rbx
lea rcx, [rcx + rax*2]
call fcn.140009610
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140017164
lea r8, [rsp + 0x40]
mov edx, eax
mov rcx, rsi
call sym.WmiApSrv.exe_protected:_void___cdecl_CHString::AssignCopy_int__unsigned_short_int_const____ptr64____ptr64
xor eax, eax
invalid
invalid

Function at 0x1400171b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
sub rsp, 0x38
and dword [rax + 8], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
lea r9, [rax + 8]
mov qword [rax - 0x18], r8
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
add rsp, 0x38
ret

Function at 0x1400171e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [rsp + 0x70]
mov r10, r8
and dword [rsp + 0x30], 0
mov rcx, rdx
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], r9
mov rdx, r10
lea r9, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
add rsp, 0x48
ret
Function at 0x14001943c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x1400306f8], rbx
je 0x1400194a3
cmp rax, rbx
jne 0x140019496
mov ebx, 1
mov esi, ebx
jmp 0x1400194a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14001947b
mov ebx, 1
mov eax, dword [0x140030700]
cmp eax, ebx
jne 0x1400194c0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14001952c
mov eax, dword [0x140030700]
test eax, eax
jne 0x140019521
mov dword [0x140030700], ebx
lea r15, [0x14001dcb8]
lea rdi, [0x14001dca0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x140019513
test eax, eax
jne 0x140019517
cmp qword [rdi], r14
je 0x140019508
mov rax, qword [rdi]
mov rcx, qword [0x14001dc18]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400194ea
test eax, eax
je 0x140019527
mov eax, 0xff
jmp 0x140019682
mov dword [0x14002ffb4], ebx
mov edi, 0x1f
mov eax, dword [0x140030700]
cmp eax, ebx
jne 0x140019553
lea rdx, [0x14001dc98]
lea rcx, [0x14001dc20]
call sub.msvcrt.dll__initterm
mov dword [0x140030700], 2
test esi, esi
jne 0x140019561
mov rax, r14
xchg qword [0x1400306f8], rax
cmp qword [0x140030718], r14
je 0x140019594
lea rcx, [0x140030718]
call fcn.140019a50
test eax, eax
je 0x140019594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140030718]
mov r9, qword [0x14001dc18]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x1400195ad
mov eax, 0xff
jmp 0x140019682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140019633
test ax, ax
je 0x1400195c8
test edx, edx
jne 0x140019633
sub ax, bx
cmp ax, di
ja 0x1400195de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400195c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003e4c
mov dword [0x14002ffb0], eax
cmp dword [0x14002ffd0], r14d
jne 0x14001961c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14002ffb4], r14d
jne 0x140019631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14002ffb0]
jmp 0x140019682
cmp ax, 0x22
jne 0x140019647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400195b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1401a2000
add rsp, 0x28
jmp 0x14001943c
Function at 0x4a5bc0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x008d54a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x008d5480]
test rbx, rbx
je 0x4a5c14
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4a5c0b
test rsi, rsi
je 0x4a5c0b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4a5bf0
lea rcx, [0x008d54a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4a5f50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00879760]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x4a5fbd
mov rcx, r8
call fcn.004a5e30
test eax, eax
je 0x4a5fbd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x4a5fbd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x4a5fb4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4a5fbf
add rax, 0x28
cmp rax, r9
jne 0x4a5fa0
xor eax, eax
add rsp, 0x28
ret

Function at 0x4a65d0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.004a6560
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.004a6560
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530

Function at 0x1430fe9e4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1430fe9ee
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1430fea17
pop rbp
sub rbp, 0x33
sub rbp, 0x30fe9e4
sub rsp, 0x20
jmp 0x1430fea36
mov rax, 0x30fe9e4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff9ac2c2d9
xor byte [rax], dl
inc rax
dec rcx
jne 0x1430fea55
jmp 0x1430fea6c
xchg ecx, eax
push rax
xor byte [rdx + 0x50], dl
in eax, 0xd9
fstpnce st(1), st(0)
xchg ecx, eax
pop rax
sbb cl, dl
fcomp st(1)
fst dword [rcx + 0x1e9130d8]
sbb esi, ebx
fstpnce st(1), st(0)
fst dword [rcx - 0x260ee4e2]
fstpnce st(1), st(0)
xchg ecx, eax
cmp edx, dword cs:[rcx + 0x585218d8]
invalid
Function at 0x140c02058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140c021df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c02089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c0206f
add dl, dl
jne 0x140c02096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c020f6
xor eax, eax
add dl, dl
jne 0x140c020a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c021ad
add dl, dl
jne 0x140c020b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c020c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c020d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c020dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c020ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c0207e
mov eax, 1
add dl, dl
jne 0x140c02106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c02113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c020fb
sub eax, ebx
mov ebx, 1
jne 0x140c0214c
mov ecx, 1
add dl, dl
jne 0x140c0212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c0213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c02123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c0207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c02168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c02175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c0215d
cmp eax, 0x7d00
jae 0x140c0219b
cmp eax, 0x500
jb 0x140c02196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c0207e
cmp eax, 0x7f
ja 0x140c0219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c0207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c021d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c0207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
retf
retf
retf
invalid
jl 0x140023127
int 0xed
jl 0x14002312b
retf
int 0x9a
movabs al, byte [0x7ced99cb56f0cdcb]
retf
retf
retf
retf
retf
in eax, dx
cmp ecx, ebx
int 0xfb
jl 0x14002314b
retf
retf
int 0xed
jl 0x14002314f
retf
int 0xed
invalid
jmp 0x10bd31f80
retf
jl 0x14002315f
retf
enter 0x30f5, 0xffffffffffffffda
int 0xed
jl 0x1400231e4
int 0xed
int 0xed
jl 0x14002316b
retf
int 0x8d
jl 0x14002316f
retf
int 0xed
jl 0x140023173
retf
int 0x4e
jl 0x140023177
retf
int 0x54
jl 0x14002317b
xchg esp, eax
in eax, dx
jl 0x14002317f
retf
int 0xed
jl 0x140023183
retf
int 0xed
jl 0x140023187
retf
int 0xed
jl 0x14002318b
retf
int 0xed
jl 0x140023179
mov ch, 0xcd
in eax, dx
int 0xed
jl 0x140023193
int 0xc2
jl 0x14002315a
int 0xed
jl 0x14002319b
fmul st(4)
jl 0x14002319f
int 0xed
jl 0x1400231a3
retf
int 0xed
jl 0x1400231a7
retf
int 0xc3
jl 0x1400231ab
int 0xed
jl 0x140023167
int 0xed
jl 0x1400231b3
int 0xed
jl 0x1400231b7
int 0xed
jl 0x1400231bb
insd dword [rdi], dx
in eax, dx
jl 0x1400231bf
retf
int 0x7f
wait
jg 0x140023192
mov dl, 0xcd
int 0x7c
retf
retf
in eax, dx
int 0xed
adc bl, cl
in eax, dx
jl 0x1400231d7
retf
int 0xed
jl 0x1400231db
int 8
mov cs, ebx
int 0xed
xchg ebp, eax
retf
out dx, al
retf
and al, 0x55
push rbp
int 0xed
jl 0x1400231f3
int 0xed
jl 0x1400231c3
int 0xed
loop 0x14002328b
pop rbx
int 0xed
loop 0x1400231ff
int 0xed
jl 0x140023203
int 0xed
jl 0x1400231ee
int 0xed
jl 0x14002320b
retf
int 0xed
outsb dx, byte [rsi]
retf
retf
retf
jg 0x140023222
in eax, dx
jl 0x140023223
push rbx
in eax, dx
jl 0x14002328c
xor ch, cl
in eax, dx
int 0xed
jl 0x1400231f5
int 0xed
jl 0x14002322f
sub dword [rsp + rdi*2], ebx
retf
adc cl, ch
in eax, dx
jl 0x14002323f
retf
int 0xed
jl 0x14002328c
int 0xce
jl 0x140023247
int 0xed
jl 0x14002324b
int 0xed
or bl, 0xcd
in eax, dx
jl 0x140023253
fldln2
xlatb
retf
int 0xed
jl 0x14002325b
cmp eax, dword [rbp + 0x7c]
shl dword [rdx], 0xed
jl 0x14002321e
int 0x67
or bl, 0xde
in eax, dx
jl 0x1400232da
int 0xed
jl 0x14002326f
int 0xed
jl 0x140023273
retf
int 0x95
wait
retf
jl 0x1400232a7
int 0x5a
jl 0x1400232ab
mov eax, 0xfecb7ced
invalid
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
mov ecx, dword [rax + 0x18]
push rax
jrcxz 0x1400040ca
dec rcx
xor r9, r9
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x18077dcf0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18077dcfa
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x18077dd23
pop rbp
sub rbp, 0x33
sub rbp, 0x77dcf0
cmp edx, 1
je 0x18077dd66
ldmxcsr dword [rsp]
add rsp, 8
popfq
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rbp
pop rbx
pop rdx
pop rcx
pop rax
xor rax, rax
ret
sub rsp, 0x20
jmp 0x18077dd76
mov rax, 0x77dcf0
add rax, rbp
add rax, 0xb8
mov rcx, 0x647
mov rdx, 0xffffffff8a6b09da
xor byte [rax], dl
inc rax
dec rcx
jne 0x18077dd95
jmp 0x18077ddac
xchg edx, eax
push rbx
xor edx, dword [rcx + 0x53]
out 0xda, al
fcmovu st(0), st(2)
xchg edx, eax
pop rbx
sbb edx, edx
fcmovnu st(0), st(2)
ficom dword [rdx + 0x1d9233db]
sbb bl, ch
fcmovu st(0), st(2)
ficom dword [rdx - 0x250de7e3]
fcmovu st(0), st(2)
xchg edx, eax
sub eax, 0x1bdb9238
push rcx
pop rbx
invalid
Function at 0x1400047f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rsi
sub rsp, 0x88
mov rax, qword [0x14026d600]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rbp, rdx
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000494b
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0xb0], rbx
xor r9d, r9d
mov qword [rsp + 0xb8], rdi
xor r8d, r8d
mov qword [rsp + 0x80], r14
xor edx, edx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x60], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [rsp + 0x60]
mov eax, 2
inc ecx
mul rcx
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call fcn.1401f33ec
mov ebx, r14d
mov rdi, rax
cmp dword [rsp + 0x70], ebx
jbe 0x14000491c
nop word [rax + rax]
mov ecx, dword [rsp + 0x60]
lea r9, [rsp + 0x74]
inc ecx
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x74], ecx
mov r8, rdi
mov rcx, qword [rsp + 0x68]
mov edx, ebx
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140004914
mov rcx, qword [rsp + 0x68]
mov rdx, rdi
call fcn.1400047f0
inc ebx
cmp ebx, dword [rsp + 0x70]
jb 0x1400048d0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov r14, qword [rsp + 0x80]
mov rdi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401f3070
add rsp, 0x88
pop rsi
pop rbp
ret
Function at 0x140008a10
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x290
mov rax, qword [0x14026d600]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140008a6b
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140008a72
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140008b5a
mov qword [rsp + 0x2a0], rdi
xor edi, edi
nop dword [rax]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rdi
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], di
jne 0x140008aa0
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.1400c48c0
cmp qword [rbx + 0x18], 7
mov rax, rbx
jbe 0x140008ac6
mov rax, qword [rbx]
mov r10, qword [rsp + 0x38]
lea r8, [rsp + 0x20]
mov r9, qword [rsp + 0x20]
cmp r10, 7
mov rdx, qword [rsp + 0x30]
cmova r8, r9
cmp rdx, qword [rbx + 0x10]
jne 0x140008b7b
test rdx, rdx
je 0x140008b08
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x140008b7b
add rax, 2
sub rdx, 1
jne 0x140008af4
mov edi, dword [rsp + 0x48]
cmp r10, 7
jbe 0x140008b47
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140008b3f
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bcd
mov rcx, r9
call fcn.1401f3090
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rdi, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1401f3070
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rsi
ret
cmp r10, 7
jbe 0x140008bb2
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140008baa
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bcd
mov rcx, r9
call fcn.1401f3090
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140008a80
jmp 0x140008b47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400c0a40
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14026d600]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rax, qword [rcx]
mov rbx, rcx
mov byte [rax + 0x68], 1
call fcn.140007520
call fcn.140004970
call fcn.140008c50
call fcn.140008fd0
mov rax, qword [rbx]
lea rdx, [rbp + 0x20]
movabs rcx, 0xeba7f6e373c1d8
mov byte [rax + 0x68], 0
mov rax, qword [rbx]
mov byte [rax + 0x67], 1
movabs rax, 0xed9b810b94671db1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xcfe1a82d803d5b56
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x9441333ffd519172
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x99f8f479e01478f5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xa992db48e3480876
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x9441333ffd28fd07
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov rcx, qword [rbx]
mov qword [rbp + 0x58], rax
add rcx, 0x70
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.1400c2eb0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400c0f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
mov rbx, qword [rsp + 0x60]
mov r12, r9
mov rcx, qword [rsp + 0x50]
mov r13, r8
mov rbp, qword [rsp + 0x58]
mov r15, rdx
mov qword [rsi], r8
mov qword [rbx], rcx
mov rax, qword [rsi]
cmp rax, r9
je 0x1400c10c5
cmp rcx, rbp
je 0x1400c10c5
mov r9d, 1
movzx edx, word [r15]
xor dil, dil
movzx ecx, word [rax]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp r9w, dx
jae 0x1400c0fcc
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x1400c10ec
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x1400c0fe3
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x1400c0fe3
shl eax, 0xa
mov dil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x1400c0ff6
movzx r8d, al
mov r10d, r14d
mov r11d, r14d
jmp 0x1400c1043
mov r8d, eax
cmp eax, 0x800
jae 0x1400c1010
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x1400c1043
cmp eax, 0x10000
jae 0x1400c102a
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x1400c1043
shr r8d, 0x12
mov r10d, 3
movzx r11d, dil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, rbp
sub rdx, qword [rbx]
mov ecx, r9d
cmp rdx, rcx
jl 0x1400c10c5
add qword [rsi], 2
test dil, dil
jne 0x1400c1064
cmp r10d, 3
jae 0x1400c1070
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
mov r8, qword [rbx]
test r9d, r9d
jle 0x1400c109e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop
sub ecx, 6
mov edx, eax
shr edx, cl
dec r9d
and dl, 0x3f
or dl, 0x80
mov byte [r8], dl
inc qword [rbx]
mov r8, qword [rbx]
test r9d, r9d
jg 0x1400c1080
shr eax, 0xa
mov r9d, 1
test dil, dil
mov ecx, r9d
cmovne ecx, eax
mov word [r15], cx
mov rax, qword [rsi]
cmp rax, r12
je 0x1400c10c5
cmp qword [rbx], rbp
jne 0x1400c0f8d
cmp r13, qword [rsi]
sete r14b
mov eax, r14d
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
mov eax, 2
jmp 0x1400c10cf