joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50e620
Capabilities:
Encrypt data using des

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x50e75f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
xor eax, eax
mov qword [rsp + 0x28], rax
cmp rax, 8
jge 0x50e74e
xor ecx, ecx
mov qword [rsp + 0x38], rcx
cmp rcx, 4
jge 0x50e73c
xor edx, edx
mov qword [rsp + 0x30], rdx
cmp rdx, 0x10
jge 0x50e72a
mov rbx, rax
shl rax, 6
lea rsi, [0x007b9140]
add rax, rsi
shl rcx, 4
mov qword [rsp + 0x40], rcx
add rax, rcx
movzx eax, byte [rax + rdx]
lea r8, [rbx - 7]
neg r8
shl r8, 2
mov rcx, r8
shl rax, cl
cmp rcx, 0x40
sbb r8, r8
and r8, rax
mov qword [rsp], r8
lea rax, [0x007aed60]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x20
mov qword [rsp + 0x18], 0x20
call fcn.0050e5b0
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rdx, rbx
cmp rdx, 0x40
jae 0x50e758
mov rsi, qword [rsp + 0x28]
mov rdi, rsi
shl rsi, 8
lea r8, [0x007fe560]
add rsi, r8
mov dword [rsi + rdx*4], eax
lea rdx, [rbx + 1]
mov rax, rdi
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x30], rdx
cmp rdx, 0x10
jl 0x50e67b
inc rcx
mov qword [rsp + 0x38], rcx
cmp rcx, 4
jl 0x50e66a
inc rax
mov qword [rsp + 0x28], rax
cmp rax, 8
jl 0x50e659
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.0042aaa0
ud2
call fcn.00453a80
jmp fcn.0050e620
Function at 0x5af220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5af3e0
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rcx
mov rsi, qword [rsp + 0x68]
cmp rax, rsi
jge 0x5af3d6
mov edi, dword [rcx]
shl edx, 1
mov word [rsp + 0x26], dx
test rax, rax
jne 0x5af288
add rcx, 4
inc rax
jmp 0x5af259
test edi, edi
jne 0x5af28e
jmp 0x5af27f
movsxd rdi, edi
mov r8, rbx
sub rbx, rdi
mov qword [rsp + 0x80], rbx
cmp rbx, r8
ja 0x5af3cf
mov rdi, qword [rsp + 0x58]
test byte [rdi], al
lea r9, [rdi + 0x78]
mov qword [rsp], r9
mov r9, qword [rsp + 0x88]
sub r9, rbx
mov r11, rbx
shl rbx, 3
lea r12, [r9 - 1]
sar r12, 0x3f
xor r12, 0xffffffffffffffff
and rbx, r12
mov r12, qword [rsp + 0x78]
add rbx, r12
mov qword [rsp + 0x38], rbx
mov qword [rsp + 8], rbx
sub r8, r11
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call fcn.005af6a0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
movzx ebx, word [rsp + 0x26]
mov rsi, qword [rsp + 0x38]
xor edi, edi
cmp rdi, rcx
jge 0x5af393
lea r8d, [rax - 0x10]
neg r8d
mov r9, rcx
mov ecx, r8d
mov r10d, ebx
shl ebx, cl
cmp cl, 0x20
sbb r8d, r8d
and r8d, ebx
movzx ebx, r8b
lea r11, [0x007b63e0]
movzx ebx, byte [r11 + rbx]
shr r8w, 8
movzx r8d, r8w
movzx r8d, byte [r11 + r8]
movzx r12d, word [rsi]
shl ebx, 8
or r8d, ebx
mov rbx, qword [rdx + 8]
mov r13, qword [rdx]
cmp r12, rbx
jae 0x5af3c8
shl r12, 2
mov word [r13 + r12], r8w
mov word [r13 + r12 + 2], ax
add rsi, 8
inc rdi
lea ebx, [r10 + 1]
mov rcx, r9
cmp rdi, rcx
jl 0x5af321
mov rcx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
cmp rcx, rsi
ja 0x5af3c1
mov rcx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x68]
mov edx, ebx
mov rbx, qword [rsp + 0x80]
jmp 0x5af27f
call fcn.0042ab10
ud2
call fcn.0042aaa0
ud2
call fcn.0042ab10
ud2
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00453a80
jmp fcn.005af220

Function at 0x7ab210
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [0x008024d0], rax
je 0x7ab248
mov rax, qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x008024e0]
add rsp, 0x28
jmp rax
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.runtime:_failed_to_create_runtime_initialization_wait_event._n
lea r9, [rax + 0x60]
mov r8d, 0x3d
mov edx, 1
call sym.fwrite
call sym.abort
nop
nop

Function at 0x7ab2e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
mov r8, rdx
xor edx, edx
call qword [sym.imp.msvcrt.dll__beginthread]
cmp rax, 0xffffffffffffffff
je 0x7ab2fc
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ebx, dword [rax]
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, [0x007dc040]
lea rcx, [rax + 0x60]
mov r8d, ebx
call sym.fprintf
call sym.abort
nop
nop word cs:[rax + rax]
Function at 0x7ab3f0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call sym._cgo_maybe_run_preinit
lea rcx, [0x008024e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x008024e0]
mov dword [0x008024c8], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x008024d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x7ab433
add rsp, 0x28
ret
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.runtime:_failed_to_signal_runtime_initialization_complete._n
lea r9, [rax + 0x60]
mov r8d, 0x3b
mov edx, 1
call sym.fwrite
call sym.abort
nop
nop word [rax + rax]

Function at 0x7ab4d0
Capabilities:
Create thread
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call sym.malloc
test rax, rax
je 0x7ab50a
mov rdx, qword [rbx]
mov rcx, rax
mov qword [rax], rdx
mov rdx, qword [rbx + 8]
mov qword [rax + 8], rdx
mov rdx, qword [rbx + 0x10]
mov qword [rax + 0x10], rdx
add rsp, 0x20
pop rbx
jmp dbg._cgo_sys_thread_start
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.runtime_cgo:_out_of_memory_in_thread_start_n
lea r9, [rax + 0x60]
mov r8d, 0x2b
mov edx, 1
call sym.fwrite
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x7abd70
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00802b04]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x7abef8
mov rax, qword [0x00802b08]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x7abdbc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x7abe45
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x7abda0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x7abf2d
mov rax, qword [0x00802b08]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00802b08]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x7abf10
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x7abe3e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x7abea0
add dword [0x00802b04], 1
cmp edi, 8
jae 0x7abe73
test dil, 4
jne 0x7abee4
test edi, edi
je 0x7abe68
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x7abeff
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x7abe68
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x7abe8c
jmp 0x7abe68
add rsi, qword [0x00802b08]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x7abe3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x7abe68
xor esi, esi
jmp 0x7abdc7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x7abe68
mov rax, qword [0x00802b08]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x7ac680
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00802de0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00802dc0]
test rbx, rbx
je 0x7ac6d4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x7ac6cb
test rsi, rsi
je 0x7ac6cb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x7ac6b0
lea rcx, [0x00802de0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x7aca10
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x007dc3f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x7aca7d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x7aca7d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x7aca7d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x7aca74
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x7aca7f
add rax, 0x28
cmp rax, r9
jne 0x7aca60
xor eax, eax
add rsp, 0x28
ret
Function at 0x140002750
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x608]
sub rsp, 0x6e0
mov rax, qword [0x14005c010]
xor rax, rsp
mov qword [rbp + 0x5d0], rax
xor r14d, r14d
xor edx, edx
mov r8d, 0x11c
lea rcx, [rbp + 0x60]
call fcn.140014730
lea rcx, [0x140055630]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400027c8
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400027c8
lea rcx, [rbp + 0x60]
call rax
lea r8, [rbp - 0x60]
lea rdx, str.kernel32.dll
mov ecx, 2
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
mov esi, eax
mov rbx, r14
mov rdi, r14
mov r12d, 0x1000
test eax, eax
je 0x140002817
mov ecx, esi
cmp rsi, r12
jb 0x1400027fe
call fcn.1400065b0
jmp 0x140002803
call fcn.140011594
mov rbx, rax
lea rdi, [rax + rsi]
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.140014730
sub rdi, rbx
mov qword [rsp + 0x20], rbx
mov r9d, edi
mov r8d, dword [rbp - 0x60]
lea rdx, str.kernel32.dll
mov ecx, 2
call qword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [0x1400558ac]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov rax, qword [rsp + 0x40]
movzx edx, word [rax + 0xe]
mov ecx, dword [rax + 8]
and ecx, 0xffff0000
cmp ecx, 0xa0000
jb 0x1400030d1
cmp edx, 0x4a61
jb 0x1400030d1
cmp edx, 0x585d
jb 0x1400028a3
call fcn.1400025dc
test al, al
je 0x1400028a3
lea rcx, str.ERROR:_Your_windows_version_is_Windows_11_22H2_or_higher_version__please_use_older_versions_of_windows._n_n
jmp 0x1400030d8
test rbx, rbx
je 0x1400028d4
cmp rdi, r12
jb 0x1400028c9
add rdi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14000314e
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.1400112f0
jmp 0x140f8cfb4
lea rcx, str.ERROR:_Your_windows_version_is_old__you_must_use_minimum_windows_10_x64_20h1_version_or_higher_version._n_n
call fcn.1400011c8
lea rcx, str.pause
call fcn.14001d874
test rbx, rbx
je 0x140003116
cmp rdi, r12
jb 0x14000310b
add rdi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14000314e
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.1400112f0
xor eax, eax
mov rcx, qword [rbp + 0x5d0]
xor rcx, rsp
call fcn.1400112d0
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001f0c0
nop
call fcn.1400056cc
nop
call fcn.140011400
nop
call fcn.14001f0c0
nop
call fcn.14001f0c0
nop
call fcn.14001f0c0
nop
call fcn.14001f0c0
int3
Function at 0x140003818
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140003838
xor eax, eax
jmp 0x14000391e
cmp qword [rcx + 0x68], 0
je 0x140003849
call fcn.140004558
jmp 0x14000391e
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140003860
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140003862
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140003894
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140014b10
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140003918
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400038cb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400038f4
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14001e8b0
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x140003918
cmp rdi, rbx
ja 0x1400038d2
test rdi, rdi
je 0x140003918
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call fcn.14001e8b0
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000dd70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x14000ddbb
cmp dword [rsp + 0x24], 0x105
jbe 0x14000dde7
lea rdx, [0x14004ba44]
mov rcx, qword [rsp + 0x270]
call fcn.1400047a8
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x270]
jmp 0x14000de79
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], 0xffffffffffffffff
inc qword [rsp + 0x28]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
cmp word [rax + rcx*2], 0
jne 0x14000ddfa
mov rax, qword [rsp + 0x28]
movzx eax, word [rsp + rax*2 + 0x4e]
cmp eax, 0x5c
jne 0x14000de54
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
cmp word [rax + rcx*2], 0
jne 0x14000de32
mov rax, qword [rsp + 0x30]
xor ecx, ecx
mov word [rsp + rax*2 + 0x4e], cx
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x270]
call fcn.1400047a8
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x14000df60
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov ecx, reloc.WS2_32.dll_inet_addr
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000004
jne 0x14000dff7
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x24]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov ecx, reloc.WS2_32.dll_inet_addr
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
jmp 0x14000df9b
cmp dword [rsp + 0x30], 0
jge 0x14000e020
cmp qword [rsp + 0x28], 0
je 0x14000e019
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14000e13a
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14000e039
xor eax, eax
jmp 0x14000e13a
mov dword [rsp + 0x20], 0
jmp 0x14000e04d
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x14000e125
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 8]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x128
mov rdx, qword [rsp + 0x38]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004970
mov rcx, qword [rsp + 0x90]
call fcn.1400047e0
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
call fcn.1400047e0
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call fcn.14001f39c
test eax, eax
jne 0x14000e116
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax + 0x18]
mov qword [rsp + 0x50], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
call fcn.1400048e4
mov rax, qword [rsp + 0x58]
jmp 0x14000e13a
lea rcx, [rsp + 0x60]
call fcn.1400048e4
jmp 0x14000e043
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x88
ret
Function at 0x14000e2a0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
cmp byte [rax + rcx], 0
jne 0x14000e2c9
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
jmp 0x14000e333
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x14000e3f9
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call fcn.140015260
test eax, eax
jne 0x14000e3f4
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
cmp byte [rax + rcx], 0
jne 0x14000e38f
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x48], rax
jne 0x14000e3f4
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0xc], 0
jne 0x14000e3bf
xor eax, eax
jmp 0x14000e3fb
cmp qword [rsp + 0x90], 0
je 0x14000e3dc
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
jmp 0x14000e3fb
jmp 0x14000e329
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000e7e0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
lea rcx, [0x140055460]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14000e80d
xor al, al
jmp 0x14000e976
mov r8, qword [rsp + 0xb0]
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rsp + 0x70]
call fcn.14000e980
nop
lea rcx, [rsp + 0x70]
call fcn.140004714
mov rdx, rax
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov r8, qword [rsp + 0xb0]
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rsp + 0x50]
call fcn.14000e980
nop
lea rcx, [rsp + 0x50]
call fcn.140004714
lea r8, [rsp + 0x38]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x14000e8d5
cmp dword [rsp + 0x24], 2
jne 0x14000e8b1
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x50]
call fcn.1400047a0
nop
lea rcx, [rsp + 0x70]
call fcn.1400047a0
movzx eax, byte [rsp + 0x20]
jmp 0x14000e976
mov byte [rsp + 0x21], 0
lea rcx, [rsp + 0x50]
call fcn.1400047a0
nop
lea rcx, [rsp + 0x70]
call fcn.1400047a0
movzx eax, byte [rsp + 0x21]
jmp 0x14000e976
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x90]
call qword [rsp + 0x48]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x50]
call fcn.140004714
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x14000e957
mov byte [rsp + 0x22], 0
lea rcx, [rsp + 0x50]
call fcn.1400047a0
nop
lea rcx, [rsp + 0x70]
call fcn.1400047a0
movzx eax, byte [rsp + 0x22]
jmp 0x14000e976
mov byte [rsp + 0x23], 1
lea rcx, [rsp + 0x50]
call fcn.1400047a0
nop
lea rcx, [rsp + 0x70]
call fcn.1400047a0
movzx eax, byte [rsp + 0x23]
add rsp, 0xa8
ret

Function at 0x14000ea50
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000ea74
xor eax, eax
jmp 0x14000eaa2
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x14000ea9d
xor eax, eax
jmp 0x14000eaa2
mov rax, qword [rsp + 8]
add rsp, 0x18
ret

Function at 0x1400120bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140012106
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140012106
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140012106
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140012106
cmp dword [rcx + 0x84], 0xe
jbe 0x140012106
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140012108
xor al, al
add rsp, 0x28
ret