joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400649c0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400649cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400649dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400649c5
lea eax, [rcx + 1]
jmp 0x1400649eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400649fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400649e4
sub eax, 3
jb 0x140064a1e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140064a6d
sar eax, 1
movsxd rbp, eax
jb 0x140064a54
jmp 0x140064a2c
add ebx, ebx
jne 0x140064a2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140064a54
inc ecx
add ebx, ebx
jne 0x140064a3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140064a54
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140064a4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140064a3c
add ecx, 2
jmp 0x140064a59
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140064982
jmp 0x1400649cd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x28800
mov dl, 0x12
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140064ab9
cmp rsi, rcx
jae 0x140064ac1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140064aa0
cmp al, 0x8f
ja 0x140064aa0
cmp byte [rsi - 2], 0xf
je 0x140064aa6
sub al, 0xe8
cmp al, 1
ja 0x140064a8a
cmp rsi, rcx
jae 0x140064ac1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140064a90
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140064ac1
lodsb al, byte [rsi]
jmp 0x140064aa0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x62000]
mov eax, dword [rdi]
or eax, eax
je 0x140064b2a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x734bc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140064ace
jns 0x140064b03
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140064b0d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140064b24
mov qword [rbx], rax
add rbx, 8
jmp 0x140064aee
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140064b64
cmp al, 0xef
ja 0x140064b56
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140064b36
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140064b45
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140064bb8
sub rsp, 0xffffffffffffff80
jmp 0x14000afa0
Function at 0x140816058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408161df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140816089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14081606f
add dl, dl
jne 0x140816096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408160f6
xor eax, eax
add dl, dl
jne 0x1408160a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408161ad
add dl, dl
jne 0x1408160b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408160c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408160d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408160dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408160ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14081607e
mov eax, 1
add dl, dl
jne 0x140816106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140816113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408160fb
sub eax, ebx
mov ebx, 1
jne 0x14081614c
mov ecx, 1
add dl, dl
jne 0x14081612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14081613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140816123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14081607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140816168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140816175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14081615d
cmp eax, 0x7d00
jae 0x14081619b
cmp eax, 0x500
jb 0x140816196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14081607e
cmp eax, 0x7f
ja 0x14081619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14081607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408161d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14081607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400014f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140023e80], rbx
je 0x14000153c
cmp rax, rbx
jne 0x14000152f
mov ebx, 1
mov esi, ebx
jmp 0x140001541
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001514
mov ebx, 1
mov eax, dword [0x140023e88]
cmp eax, ebx
jne 0x140001557
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400015c6
mov eax, dword [0x140023e88]
test eax, eax
jne 0x1400015c0
mov dword [0x140023e88], ebx
lea r15, [0x14001cb68]
lea rdi, [0x14001cb50]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400015b2
test eax, eax
jne 0x1400015b6
cmp qword [rdi], 0
je 0x1400015a7
movabs r10, 0xd30527475e523070
mov rax, qword [rdi]
mov rcx, qword [vtable._SH_HAHHtH.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000157e
test eax, eax
je 0x1400015c6
mov eax, 0xff
jmp 0x1400016ac
mov dword [0x1400232a4], ebx
mov eax, dword [0x140023e88]
cmp eax, ebx
jne 0x1400015ed
lea rdx, [0x14001cb48]
lea rcx, [0x14001cab8]
call sub.msvcrt.dll__initterm
mov dword [0x140023e88], 2
test esi, esi
jne 0x1400015fa
xor eax, eax
xchg qword [0x140023e80], rax
cmp qword [0x140023ea0], 0
je 0x140001638
lea rcx, [0x140023ea0]
call fcn.140001dc0
test eax, eax
je 0x140001638
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140023ea0]
mov r9, qword [vtable._SH_HAHHtH.0]
call r9
mov r8, qword [0x1400232b8]
mov rdx, qword [0x1400232b0]
mov ecx, dword [0x1400232a8]
call fcn.14000f2c0
mov dword [0x1400232a0], eax
cmp dword [0x1400232c0], 0
jne 0x140001668
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400232a4], 0
jne 0x14000167d
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400232a0]
jmp 0x1400016ac
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400b5000
add rsp, 0x28
jmp 0x1400014f0

Function at 0x14000179c
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400017a8
push rbx
sub rsp, 0x540
mov rax, qword [0x140023250]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140001825
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x140001845
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140001700
add rsp, 0x540
pop rbx
ret
Function at 0x1400017a8
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400017a8
push rbx
sub rsp, 0x540
mov rax, qword [0x140023250]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140001825
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x140001845
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140001700
add rsp, 0x540
pop rbx
ret

Function at 0x140001cac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001cf8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001cf0
cmp dword [rcx + 0x3c], edx
jl 0x140001cf0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001cf0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140001cf8
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140001e20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001e48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140001e48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140007bbc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140023250]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, r9
mov rdi, rcx
mov qword [rbp - 0x30], rcx
mov r14, qword [rbp + 0x50]
mov qword [rbp - 0x28], r14
mov dword [rcx + 8], 1
lea rax, [0x14001c090]
mov qword [rcx], rax
add rcx, 0x10
mov rax, qword [r14]
mov qword [rcx], rax
call fcn.1400047a0
nop
lea r15, [rdi + 0x28]
and qword [r15], 0
mov qword [rdi + 0x30], rdi
mov dword [rdi + 0x44], 0x1f40
mov dword [rdi + 0x40], 4
lea rsi, [rdi + 0x18]
and dword [rsi], 0
mov rdx, rbx
mov rcx, r15
call fcn.140007f70
and qword [rdi + 0x50], 0
mov qword [rsp + 0x28], rsi
mov eax, dword [rdi + 0x40]
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [0x1400082f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__beginthreadex]
nop dword [rax + rax]
mov qword [rdi + 0x20], rax
mov byte [rdi + 0x48], 1
mov ebx, 0xa
test rax, rax
je 0x140007d00
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], eax
mov r9d, dword [rsi]
lea r8, [0x14001d288]
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.1400037c0
test eax, eax
jns 0x140007cdc
lea r8d, [rbx - 9]
lea rdx, section..data
lea rcx, [rbp - 0x48]
call qword [sym.imp.msvcrt.dll_public:_void___cdecl_exception::constructor_char_const__const___ptr64_const____ptr64__int____ptr64]
nop dword [rax + rax]
lea rax, [0x14001c050]
mov qword [rbp - 0x48], rax
lea rdx, [0x1400213e0]
lea rcx, [rbp - 0x48]
call sub.msvcrt.dll__CxxThrowException
int3
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x50]
call fcn.140002fb4
nop
lea rdx, [rbp - 0x50]
mov rcx, r15
call fcn.140007fc0
nop
lea rcx, [rbp - 0x50]
call fcn.14000383c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
mov qword [rdi + 0x50], rax
test rax, rax
jne 0x140007d9a
lea rax, [0x140023008]
mov rcx, qword [0x140023008]
cmp rcx, rax
je 0x140007d61
test byte [rcx + 0x1c], 1
je 0x140007d61
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9d, eax
mov rax, qword [0x140023008]
mov edx, ebx
lea r8, [0x14001d290]
mov rcx, qword [rax + 0x10]
call fcn.1400079a0
nop
mov r8d, 1
lea rdx, section..data
lea rcx, [rbp - 0x48]
call qword [sym.imp.msvcrt.dll_public:_void___cdecl_exception::constructor_char_const__const___ptr64_const____ptr64__int____ptr64]
nop dword [rax + rax]
lea rax, [0x14001c050]
mov qword [rbp - 0x48], rax
lea rdx, [0x1400213e0]
lea rcx, [rbp - 0x48]
call sub.msvcrt.dll__CxxThrowException
int3
lea rax, [0x140023008]
mov rcx, qword [0x140023008]
cmp rcx, rax
je 0x140007dcc
test byte [rcx + 0x1c], 4
je 0x140007dcc
mov edx, SafeArrayDestroy
mov r9d, dword [rsi]
lea r8, [0x14001d290]
mov rcx, qword [rcx + 0x10]
call fcn.140008338
nop
mov rcx, r14
call fcn.1400050cc
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001700
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140008230
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [0x140023008]
lea rax, [0x140023008]
cmp rcx, rax
je 0x14000826b
test byte [rcx + 0x1c], 4
je 0x14000826b
mov r9d, dword [rbx + 0x18]
lea r8, [0x14001d290]
mov rcx, qword [rcx + 0x10]
mov edx, SafeArrayDestroy
call fcn.140008338
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop dword [rax + rax]
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rbx
ret

Function at 0x14000fc80
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [0x140023e18]
cmp qword [rbx + 0x20], 0
mov rdx, qword [rbx + 8]
cmovne rcx, qword [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
test eax, 0xfffffffd
je 0x14000fcc7
test eax, eax
jle 0x14000fcbd
movzx eax, ax
or eax, 0x80070000
mov edx, eax
mov rcx, rbx
call fcn.140010418
add rsp, 0x20
pop rbx
ret

Function at 0x14000fdc8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, rdx
call fcn.140005d98
mov r8, rbx
mov rcx, rdi
lea r9d, [rax*2 + 2]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140010390
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov rsi, rcx
mov edx, 2
call fcn.14000fbf0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsi + 0x10]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x1400103f5
jle 0x1400103ea
movzx eax, ax
or eax, 0x80070000
mov edx, eax
mov rcx, rsi
call fcn.140010418
nop
lea rcx, [rsp + 0x40]
call fcn.14000dbcc
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400100a0
Capabilities:
Query environment variable

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], r14
mov rax, qword [0x140023250]
xor rax, rbp
mov qword [rbp + 8], rax
mov edi, edx
mov r14, rcx
xor esi, esi
mov ebx, esi
mov qword [rbp], rbx
test edx, edx
je 0x140010143
mov edx, edi
cmp rdi, qword [0x140023ea8]
ja 0x140010143
mov rcx, qword [0x140023eb0]
add rcx, 8
add rcx, rdx
cmp rcx, rdx
jb 0x140010143
call fcn.140018c28
test eax, eax
je 0x140010143
lea eax, [rdi + 8]
mov ecx, eax
add rax, 0xf
cmp rax, rcx
ja 0x140010119
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140018ec0
sub rsp, rax
lea rbx, [rsp + 0x20]
mov qword [rbp], rbx
test rbx, rbx
je 0x140010143
mov dword [rbx], 0x6b637453
add rbx, 8
mov qword [rbp], rbx
jne 0x14001017d
lea eax, [rdi + 8]
cmp eax, edi
jb 0x14001017d
mov ecx, eax
movabs r10, 0xa7f48fd31453a870
mov rax, qword [0x140023eb8]
call qword [vtable._SH_HAHHtH.0]
mov rbx, rax
mov qword [rbp], rax
test rax, rax
je 0x14001017d
mov dword [rax], 0x70616548
add rbx, 8
mov qword [rbp], rbx
mov r9d, edi
mov r8, rbx
mov edx, 2
mov rcx, r14
call fcn.140010214
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov edx, eax
test eax, eax
jne 0x1400101ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x1400101c2
movzx eax, ax
or eax, 0x80070000
mov edx, eax
mov rcx, r14
call fcn.140010418
jmp 0x1400101de
mov rcx, rdx
add rcx, rcx
cmp rcx, rdi
jbe 0x1400101dc
lea edi, [rdx + rdx]
mov esi, edi
lea rcx, [rbp]
call fcn.14000fbb4
mov eax, esi
mov rcx, qword [rbp + 8]
xor rcx, rbp
call fcn.140001700
mov rbx, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x30]
mov r14, qword [rbp + 0x38]
lea rsp, [rbp + 0x10]
pop rbp
ret

Function at 0x140010214
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov ebx, r9d
mov rbp, r8
mov esi, edx
mov rdi, rcx
mov edx, 1
call fcn.14000fcd4
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400102ac
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x34], ebx
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140010293
jle 0x140010287
movzx eax, ax
or eax, 0x80070000
mov edx, eax
mov rcx, rdi
call fcn.140010418
jmp 0x1400102ac
cmp dword [rsp + 0x30], 2
jne 0x1400102ac
cmp esi, 1
jne 0x1400102ac
shr ebx, 1
mov edx, ebx
mov rcx, rbp
call fcn.14000fe04
nop
lea rcx, [rsp + 0x38]
call fcn.14000dbcc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400102d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov edx, 1
mov dword [rsp + 0x30], edx
call fcn.14000fcd4
mov qword [rsp + 0x60], rax
xor ebx, ebx
test rax, rax
jne 0x14001030d
lea rcx, [rsp + 0x60]
call fcn.14000dbcc
xor eax, eax
jmp 0x14001037c
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140010351
jle 0x140010345
movzx eax, ax
or eax, 0x80070000
mov edx, eax
mov rcx, rdi
call fcn.140010418
jmp 0x140010370
cmp dword [rsp + 0x30], 2
jne 0x14001036a
mov edx, dword [rsp + 0x58]
mov rcx, rdi
call fcn.1400100a0
mov dword [rsp + 0x58], eax
jmp 0x14001036e
mov eax, dword [rsp + 0x58]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.14000dbcc
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140010390
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, rdx
call fcn.140005d98
mov r8, rbx
mov rcx, rdi
lea r9d, [rax*2 + 2]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140010390
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov rsi, rcx
mov edx, 2
call fcn.14000fbf0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsi + 0x10]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x1400103f5
jle 0x1400103ea
movzx eax, ax
or eax, 0x80070000
mov edx, eax
mov rcx, rsi
call fcn.140010418
nop
lea rcx, [rsp + 0x40]
call fcn.14000dbcc
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140017990
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140023250]
xor rax, rsp
mov qword [rsp + 0x160], rax
movzx eax, word [rsp + 0x1d0]
lea rcx, [rsp + 0x70]
mov r14, qword [0x140023e48]
mov r13d, 1
add ax, r13w
mov dword [rsp + 0x50], edx
test r8, r8
mov r15, r8
mov esi, edx
mov r12, r9
cmove ax, word [rsp + 0x1d0]
lea edi, [r13 + 1]
xor ebx, ebx
test r8, r8
mov r8d, 0xf0
setne bl
lea ebp, [rax + r13]
test r9, r9
cmovne rbx, rdi
cmove bp, ax
xor edx, edx
call sub.msvcrt.dll_memset
lea eax, [rdi + 0x1e]
lea rdx, [0x140023008]
cmp ax, bp
ja 0x140017a5a
mov rcx, qword [0x140023008]
cmp rcx, rdx
je 0x140017a55
test byte [rcx + 0x1c], r13b
je 0x140017a55
mov rcx, qword [rcx + 0x10]
mov r9d, esi
movzx eax, bp
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
call fcn.140018184
mov ebp, 0x1f
movzx edx, bp
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r12
cmp rbx, rdx
jae 0x140017a8c
mov rcx, qword [rsp + 0x1d8]
add rcx, 0xfffffffffffffff8
lea rcx, [rcx + 8]
mov rax, qword [rcx]
mov qword [rsp + rbx*8 + 0x60], rax
add rbx, r13
cmp rbx, rdx
jl 0x140017a78
lea rdx, [rsp + 0x50]
lea rcx, [r14 + 8]
call fcn.140017c28
mov rbx, rax
cmp rax, qword [r14 + 0x10]
je 0x140017aa8
cmp esi, dword [rax + 0x18]
jae 0x140017aac
mov rbx, qword [r14 + 0x10]
cmp rbx, qword [r14 + 0x10]
je 0x140017ad2
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_time]
nop dword [rax + rax]
mov ecx, eax
sub ecx, dword [rbx + 0x28]
cmp ecx, dword [rbx + 0x24]
jb 0x140017b65
mov qword [rbx + 0x28], rax
mov eax, esi
shr eax, 0x1e
sub eax, r13d
je 0x140017ae9
sub eax, r13d
je 0x140017aee
mov edi, r13d
cmp eax, r13d
je 0x140017aee
mov edi, 4
mov rcx, qword [r14]
lea rax, [rsp + 0x60]
xor ebx, ebx
xor r8d, r8d
mov qword [rsp + 0x40], rbx
mov r9d, esi
mov qword [rsp + 0x38], rax
movzx edx, di
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x28], bp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
nop dword [rax + rax]
test eax, eax
jne 0x140017b65
mov rax, qword [0x140023008]
lea rcx, [0x140023008]
cmp rax, rcx
je 0x140017b65
test byte [rax + 0x1c], r13b
je 0x140017b65
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x140023008]
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.14001812c
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140001700
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400185c0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
and qword [rcx + 8], 0
mov rbx, rcx
and qword [rcx + 0x10], 0
cmp dword [0x140023e60], 0
mov dword [rcx + 4], 0
jne 0x14001860b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop dword [rax + rax]
mov ecx, 1
cmp ecx, dword [rsp + 0x40]
mov dword [0x140023e60], ecx
sbb eax, eax
mov dword [0x140023e78], eax
and dword [rbx], 0
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x1419dde40
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1419dde4a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1419dde73
pop rbp
sub rbp, 0x33
sub rbp, 0x19dde40
sub rsp, 0x20
jmp 0x1419dde92
mov rax, 0x19dde40
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x2e4e5267
xor byte [rax], dl
inc rax
dec rcx
jne 0x1419ddeb1
jmp 0x1419ddec8
invalid
Function at 0x14001127b
Capabilities:
Terminate process

Disassembly:
jmp 0x140013e00
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret