joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001823c
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r14
push r15
sub rsp, 0x30
mov rax, rdx
mov dword [rsp + 0x28], 2
xor edx, edx
mov ebp, r8d
mov r8, qword [rsp + 0x60]
mov r14, rcx
xor bl, bl
mov rcx, rax
test r9d, r9d
sete dl
and qword [r11 - 0x18], 0
xor r9d, r9d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileExW]
nop dword [rax + rax]
mov rdi, qword [rsp + 0x68]
or r15, 0xffffffffffffffff
mov qword [rdi], rax
cmp rax, r15
jne 0x1400182cd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [0x140045ba8], eax
mov al, bl
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
mov rcx, qword [rsp + 0x60]
mov edx, ebp
mov rax, r14
call qword [0x140033e78]
test eax, eax
je 0x140018365
and dword [0x140045ba8], 0
mov bl, 1
mov rax, qword [rdi]
cmp rax, r15
je 0x140018329
mov r8, qword [0x140045bc0]
test r8, r8
je 0x140018332
mov edx, dword [0x140045bc8]
cmp edx, dword [0x140045bcc]
jge 0x14001838b
test r8, r8
je 0x140018327
mov rax, qword [rdi]
movsxd rcx, edx
inc edx
mov dword [0x140045bc8], edx
mov qword [r8 + rcx*8], rax
mov bl, 1
test bl, bl
jne 0x1400182af
jmp 0x14001829d
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x28]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r8, rax
mov edx, dword [0x140045bc8]
mov qword [0x140045bc0], rax
jmp 0x140018310
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
nop dword [rax + rax]
test eax, eax
je 0x1400183d0
cmp qword [rdi], r15
jne 0x1400182cd
jmp 0x14001829d
lea eax, [rdx + 1]
movsxd rbx, eax
shl rbx, 3
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, qword [0x140045bc0]
mov r9, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
nop dword [rax + rax]
mov r8, rax
test rax, rax
je 0x1400250bc
inc dword [0x140045bcc]
jmp 0x140018356
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
nop dword [rax + rax]
mov rax, r15
mov qword [rdi], r15
jmp 0x1400182f1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [rdi]
mov dword [0x140045ba8], eax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
nop dword [rax + rax]
xor al, al
mov qword [rdi], r15
jmp 0x1400182b1
Function at 0x1400186f0
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x14003d0f8]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r12d, r12d
lea rdx, [rsp + 0x20]
mov r15d, r12d
mov ebp, r12d
mov r13, rcx
call fcn.1400188c0
test eax, eax
js 0x140025140
mov eax, dword [rsp + 0x20]
cmp eax, 3
jae 0x1400251ac
test eax, eax
jne 0x14002515c
lea r15d, [rax + 1]
mov ecx, 0x40002748
mov esi, r15d
call fcn.14001885c
mov rbp, rax
test rax, rax
je 0x14002519c
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], r12w
jne 0x140018775
mov r14d, 0x104
cmp rdi, r14
jae 0x1400187ff
mov ecx, 0x208
call fcn.14000cd90
mov rbx, rax
test rax, rax
je 0x1400187ff
mov r8, rbp
mov edx, r14d
mov rcx, rax
call fcn.1400113e0
test r13, r13
je 0x1400251b4
mov r8, qword [r13 + 0x78]
test r8, r8
je 0x14001884f
mov edx, r14d
mov rcx, rbx
call fcn.140011300
test eax, eax
jne 0x1400187f2
test rbx, rbx
je 0x1400187ea
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_console_l2_2_0.dll_SetConsoleTitleW]
nop dword [rax + rax]
mov byte [0x140045b2c], r12b
mov esi, r12d
test r15d, r15d
je 0x1400187ff
test rbx, rbx
je 0x1400187ff
mov rcx, rbx
call fcn.14000ff70
test rbp, rbp
je 0x140018813
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test esi, esi
jne 0x14002519c
mov eax, esi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140018f90
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov esi, r12d
jmp 0x1400187f2
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
test r13, r13
je 0x140025229
mov rcx, qword [r13 + 0x78]
call fcn.1400109f4
mov rbx, rax
test rax, rax
je 0x1400187ea
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], r12w
jne 0x14002517e
mov r14d, 0x104
cmp rdi, r14
jb 0x1400187cf
mov esi, 1
xor edx, edx
lea ecx, [rdx + 8]
call fcn.140003278
nop
jmp 0x14001881b
add eax, 0xfffffff0
jmp 0x14001874c
mov edx, r14d
lea rcx, [rsp + 0x30]
lea r12, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_console_l2_2_0.dll_GetConsoleTitleW]
nop dword [rax + rax]
test eax, eax
je 0x1400187f2
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x14002520b
add rdi, rdi
add r12, rdi
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x1400251f1
mov r8, r12
mov rdx, r14
mov rcx, rbx
call fcn.140011300
xor r12d, r12d
test eax, eax
jne 0x1400187f2
jmp 0x1400187cf
mov rbx, r12
jmp 0x1400187cf
Function at 0x1400193ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140019438
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140019430
cmp dword [rcx + 0x3c], edx
jl 0x140019430
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140019430
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140019438
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14002d838
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x30
mov rsi, rcx
mov r14d, r8d
mov ecx, dword [rcx]
mov r15, r9
mov rbp, rdx
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FlushFileBuffers]
nop dword [rax + rax]
mov ecx, dword [rsi]
call fcn.14000d208
xor edx, edx
mov rcx, rbp
call fcn.140007420
mov dword [rsi], eax
cmp eax, 0xffffffff
je 0x14002d95d
mov ebx, r14d
mov ecx, eax
neg ebx
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
mov r9d, 2
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov ecx, dword [rsi]
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x70]
lea r9, [rsp + 0x50]
and qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, r14d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x14002d953
cmp dword [rsp + 0x50], r14d
jne 0x14002d953
mov rdx, qword [rsp + 0x70]
mov r8d, r14d
mov rcx, r15
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14002d953
mov ecx, dword [rsi]
call fcn.14000d208
mov edx, 1
mov rcx, rbp
call fcn.140007420
mov dword [rsi], eax
cmp eax, 0xffffffff
je 0x14002d95d
mov ecx, eax
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
mov r9d, 2
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
xor eax, eax
jmp 0x14002d974
mov ecx, dword [rsi]
call fcn.14000d208
or dword [rsi], 0xffffffff
mov r8, rbp
mov edx, 1
mov ecx, 0x4000271f
call fcn.140003278
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rsi
ret
Function at 0x14002e7d0
Capabilities:
Delete file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, r9
mov ebp, r8d
mov rbx, rdx
mov esi, ecx
xor edi, edi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
and qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
mov rcx, rax
mov r8d, ebp
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
je 0x14002e837
cmp ebp, dword [rsp + 0x30]
jne 0x14002e837
cmp dword [0x140041924], edi
je 0x14002e8ba
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x70]
mov dword [0x140045ba8], eax
call fcn.14000d208
mov ecx, esi
call fcn.14000d208
mov ecx, esi
call fcn.1400101b8
test eax, eax
je 0x14002e86b
mov edi, 0x1d
jmp 0x14002e87a
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov ecx, dword [0x140045ba8]
mov eax, 0x70
and dword [0x140045b98], 0
test ecx, ecx
cmove ecx, eax
cmp dword [0x140041924], 0
mov dword [0x140045ba8], ecx
je 0x14002e8a4
xor edi, edi
jmp 0x14002e8ad
test edi, edi
jne 0x14002e8ad
call fcn.14002f198
mov edx, 1
mov ecx, edi
call fcn.14002d990
int3
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14002ebd4
Capabilities:
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x158]
sub rsp, 0x250
mov rax, qword [0x14003d0f8]
xor rax, rsp
mov qword [rbp + 0x148], rax
mov esi, 0x104
mov byte [rbp + 0x130], 1
mov ebx, ecx
mov qword [rbp + 0x138], rsi
xor r14d, r14d
lea rcx, [rsp + 0x20]
mov r8d, esi
mov qword [rbp + 0x128], r14
xor edx, edx
mov edi, r14d
call sub.msvcrt.dll_memset
mov al, byte [rbp + 0x130]
lea rcx, [rsp + 0x20]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, rsi
call fcn.14000ca40
test eax, eax
js 0x14002edb7
lea eax, [r14 + 0x3d]
mov dword [rbp + 0x144], 0x3a
add bx, 0x40
mov word [rbp + 0x140], ax
lea rcx, [rbp + 0x140]
mov word [rbp + 0x142], bx
call fcn.14001081c
mov rbx, rax
test rax, rax
je 0x14002ecbb
mov rcx, rax
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetCurrentDirectoryW]
nop dword [rax + rax]
test al, al
jne 0x14002ed94
lea ecx, [r14 + 1]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetErrorMode]
nop dword [rax + rax]
mov edi, eax
mov rcx, qword [rbp + 0x128]
lea rdx, [rsp + 0x20]
test rcx, rcx
cmovne rdx, rcx
movzx ecx, word [rbp + 0x142]
mov word [rdx], cx
lea rdx, [rsp + 0x20]
mov rcx, qword [rbp + 0x128]
movzx eax, word [rbp + 0x144]
test rcx, rcx
cmovne rdx, rcx
lea rcx, [rsp + 0x20]
mov word [rdx + 2], ax
lea rdx, [rsp + 0x20]
mov rax, qword [rbp + 0x128]
test rax, rax
cmovne rcx, rax
mov eax, 0x5c
mov word [rcx + 4], ax
lea rcx, [rsp + 0x20]
mov rax, qword [rbp + 0x128]
test rax, rax
cmovne rcx, rax
mov word [rcx + 6], r14w
lea rcx, [rbp + 0x140]
mov rax, qword [rbp + 0x128]
test rax, rax
cmovne rdx, rax
call fcn.14001498c
mov rax, qword [rbp + 0x128]
lea rcx, [rsp + 0x20]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetCurrentDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14002ed81
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
xor edx, edx
call fcn.140003278
test rbx, rbx
je 0x14002ed94
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetErrorMode]
nop dword [rax + rax]
mov rax, qword [0x140058458]
lea rcx, [0x140058250]
mov edx, dword [0x140058468]
test rax, rax
cmovne rcx, rax
xor r8d, r8d
call fcn.14001417c
mov rcx, qword [rbp + 0x128]
mov qword [rbp + 0x128], r14
test rcx, rcx
je 0x14002edd6
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x148]
xor rcx, rsp
call fcn.140018f90
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14002ee0c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov edx, 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
test eax, eax
jne 0x14002ee37
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [0x140045ba8], eax
xor eax, eax
add rsp, 0x28
ret

Function at 0x14002f318
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x168]
sub rsp, 0x260
mov rax, qword [0x14003d0f8]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor esi, esi
mov rdi, rcx
mov r8d, 0x104
mov qword [rsp + 0x20], rsi
xor edx, edx
mov qword [rbp + 0x138], rsi
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x148], r8
lea ebx, [rsi + 1]
mov byte [rbp + 0x140], bl
call sub.msvcrt.dll_memset
mov al, byte [rbp + 0x140]
lea rcx, [rsp + 0x30]
neg al
sbb rdx, rdx
and edx, 0xfdc6
add rdx, 0x208
call fcn.14000ca40
test eax, eax
js 0x14002f413
mov rax, qword [rbp + 0x138]
lea r8, [rsp + 0x30]
mov edx, dword [rbp + 0x148]
lea r9, [rsp + 0x20]
test rax, rax
mov rcx, rdi
cmovne r8, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
nop dword [rax + rax]
test eax, eax
je 0x14002f413
cmp eax, 0xffce
jbe 0x14002f413
mov rax, qword [rbp + 0x138]
lea rcx, [rsp + 0x30]
test rax, rax
cmovne rcx, rax
mov word [rcx + 6], si
lea rcx, [rsp + 0x30]
mov rax, qword [rbp + 0x138]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
nop dword [rax + rax]
cmp eax, 4
je 0x14002f415
mov ebx, esi
mov rcx, qword [rbp + 0x138]
mov qword [rbp + 0x138], rsi
test rcx, rcx
je 0x14002f434
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140018f90
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140003670
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140093080]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, Ordinal_301
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x130
cmp rdi, 0xffffffffffffffff
je 0x140003732
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140003732
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140003729
cmp qword [rbx + 0x18], 0x10
mov r8, rbx
jb 0x1400036f1
mov r8, qword [rbx]
lea rax, [rsp + 0x4c]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140003713
inc rax
test ecx, ecx
jne 0x140003700
mov rcx, rdi
test edx, edx
je 0x140003755
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400036e4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140072360
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x28], 0
setne al
jmp 0x140003734

Function at 0x140003770
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140093080]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
lea rdx, str.ComputerHKEY_CLASSES_ROOTSAPI_OneCore.SpGramCompBackEnd.1CLSID
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 0x20106
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140003803
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea rdx, str.IsBanned
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x58], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140072360
add rsp, 0x78
ret
Function at 0x140005150
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2260
call fcn.140072ea0
sub rsp, rax
mov rax, qword [0x140093080]
xor rax, rsp
mov qword [rsp + 0x2250], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x20]
mov r8d, 0x2000
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140005263
mov esi, dword [rsp + 0x20]
shr rsi, 3
test rsi, rsi
je 0x140005263
xor edi, edi
nop dword [rax]
mov rbx, qword [rsp + rdi*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x104
lea r8, [rsp + 0x2030]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x14000521d
lea rdx, str.C:WindowsSystem32_
lea rcx, [rsp + 0x2030]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsstr]
test rax, rax
jne 0x140005257
lea rdx, str.C:WindowsSysWow64_
lea rcx, [rsp + 0x2030]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsstr]
test rax, rax
jne 0x140005257
mov rdx, qword [rsp + rdi*8 + 0x30]
lea r8, [rsp + 0x2140]
mov r9d, 0x104
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x140005257
lea rdx, str..dll
lea rcx, [rsp + 0x2140]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x14000528e
inc rdi
cmp rdi, rsi
jl 0x1400051c0
xor al, al
mov rcx, qword [rsp + 0x2250]
xor rcx, rsp
call fcn.140072360
lea r11, [rsp + 0x2260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140003770
mov al, 1
jmp 0x140005265
Function at 0x1400110c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140011121
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400110e0
mov ecx, dword [r9]
jmp 0x140011208
cmp ecx, 0x4e0
jb 0x140011208
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140011140
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140011190
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140012050
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140012084
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140012070
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140011c90
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400120a9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140010850
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140012123
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001211e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001211e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400723bc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140012130
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140012164
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140012150
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140011c90
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140012189
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140010850
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140012203
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400121fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400121fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400723bc
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret