joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140086ac0
Capabilities:
Delete directory
Delete file

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
call method.std::filesystem.symlink_status_std::filesystem::__cxx11::path_const__std::error_code_
test al, al
je 0x140086b27
cmp al, 0xff
je 0x140086b18
mov rdx, rbx
mov rcx, rsi
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
cmp al, 2
je 0x140086b30
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140086b3d
mov eax, dword [rbx]
test eax, eax
jne 0x140086b27
call method.std::_V2.system_category__
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
xor eax, eax
jmp 0x140086b29
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140086ae8
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140086c30
Capabilities:
Move file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rbp, rcx
mov rdx, r8
mov rbx, r8
mov rcx, rsi
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
mov rdi, rax
cmp al, 0xff
je 0x140086cd0
mov ecx, dword [rbx]
test ecx, ecx
jne 0x140086ca8
test al, al
jne 0x140086ce8
mov rdx, qword [rsi]
mov rcx, qword [rbp]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140086cb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x140086d20
call rdi
mov dword [rax], 5
call method.std::_V2.generic_category__
mov rsi, rax
call rdi
mov eax, dword [rax]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
jmp 0x140086c61
mov rdx, rbx
mov rcx, rbp
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
mov edx, dword [rbx]
test edx, edx
jne 0x140086ca8
cmp dil, 2
je 0x140086d30
cmp al, 2
jne 0x140086c61
call method.std::_V2.generic_category__
mov dword [rbx], 0x14
mov qword [rbx + 8], rax
jmp 0x140086ca8
call rdi
mov dword [rax], 0xd
jmp 0x140086c96
cmp al, 2
je 0x140086c61
call method.std::_V2.generic_category__
mov dword [rbx], 0x15
mov qword [rbx + 8], rax
jmp 0x140086ca8
Function at 0x14008e5a0
Capabilities:
Get disk size

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r13, qword [rsp + 0xa0]
mov qword [rsp + 0x28], 0
mov r12, rdx
mov rbp, r8
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x30]
mov rdi, r9
lea r9, [rsp + 0x38]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov esi, eax
call method.std::_V2.system_category__
mov rbx, rax
test esi, esi
je 0x14008e648
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14008e609
mov qword [r12], rax
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14008e617
mov qword [rbp], rax
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x14008e640
mov dword [r13], 0
mov qword [r13 + 8], rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rdi], rax
jmp 0x14008e621
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [r13 + 8], rbx
mov dword [r13], eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x140093cb0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x140093cd7
call rbp
cmp dword [rax], 4
jne 0x140093cf4
mov rcx, rdi
call method.std::__basic_file_char_.fd__
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sym.read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x140093cd0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400a7810
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400a7838
xor ecx, ecx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400a7880
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400a7850
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400a788c
call rbp
cmp dword [rax], 4
je 0x1400a7850
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400b4730
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0x80000000
mov dword [rbp - 0x18], 0x7fffffff
mov qword [rbp - 8], 0
cmp qword [rbp - 8], 0xe2
ja 0x1400b47cc
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov eax, dword [rax + rdx*4]
and eax, 0x80000000
mov ecx, eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x7fffffff
or eax, ecx
mov dword [rbp - 0x1c], eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 0x18d]
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + rdx*4]
mov eax, dword [rbp - 0x1c]
shr eax, 1
xor edx, eax
mov eax, dword [rbp - 0x1c]
and eax, 1
test eax, eax
je 0x1400b47b1
mov eax, 0x9908b0df
jmp 0x1400b47b6
mov eax, 0
xor eax, edx
mov ecx, eax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov dword [rax + rdx*4], ecx
add qword [rbp - 8], 1
jmp 0x1400b4752
mov qword [rbp - 0x10], 0xe3
cmp qword [rbp - 0x10], 0x26e
ja 0x1400b484e
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x80000000
mov ecx, eax
mov rax, qword [rbp - 0x10]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x7fffffff
or eax, ecx
mov dword [rbp - 0x20], eax
mov rax, qword [rbp - 0x10]
lea rdx, [rax - 0xe3]
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + rdx*4]
mov eax, dword [rbp - 0x20]
shr eax, 1
xor edx, eax
mov eax, dword [rbp - 0x20]
and eax, 1
test eax, eax
je 0x1400b4833
mov eax, 0x9908b0df
jmp 0x1400b4838
mov eax, 0
xor eax, edx
mov ecx, eax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x10]
mov dword [rax + rdx*4], ecx
add qword [rbp - 0x10], 1
jmp 0x1400b47d4
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x9bc]
and eax, 0x80000000
mov edx, eax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax]
and eax, 0x7fffffff
or eax, edx
mov dword [rbp - 0x24], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x630]
mov eax, dword [rbp - 0x24]
shr eax, 1
xor edx, eax
mov eax, dword [rbp - 0x24]
and eax, 1
test eax, eax
je 0x1400b4891
mov eax, 0x9908b0df
jmp 0x1400b4896
mov eax, 0
xor edx, eax
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x9bc], edx
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x9c0], 0
nop
add rsp, 0x30
pop rbp
ret
Function at 0x1400b48c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov eax, dword [rbp + 0x18]
mov ecx, eax
call method.unsigned_int_std::__detail.__mod_unsigned_int__0u__1u__0u__unsigned_int_
mov rdx, qword [rbp + 0x10]
mov dword [rdx], eax
mov qword [rbp - 8], 1
cmp qword [rbp - 8], 0x26f
ja 0x1400b4942
mov rax, qword [rbp - 8]
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
shr eax, 0x1e
xor dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
imul eax, eax, 0x6c078965
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
mov ecx, eax
call method.unsigned_int_std::__detail.__mod_unsigned_int__624u__1u__0u__unsigned_int_
add dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, eax
call method.unsigned_int_std::__detail.__mod_unsigned_int__0u__1u__0u__unsigned_int_
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp - 8]
mov dword [rdx + rcx*4], eax
add qword [rbp - 8], 1
jmp 0x1400b48e7
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x9c0], 0x270
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400b4990
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x9c0]
cmp rax, 0x26f
jbe 0x1400b49b8
mov rcx, qword [rbp + 0x10]
call sym._ZNSt23mersenne_twister_engineIjLy32ELy624ELy397ELy31ELj2567483615ELy11ELj4294967295ELy7ELj2636928640ELy15ELj4022730752ELy18EL
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x9c0]
lea rcx, [rax + 1]
mov rdx, qword [rbp + 0x10]
mov qword [rdx + 0x9c0], rcx
mov rdx, qword [rbp + 0x10]
mov eax, dword [rdx + rax*4]
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shr eax, 0xb
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shr eax, 0x12
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x1400c9ce0
Capabilities:
Encode data using xor

Disassembly:
movabs r9, 0xc6a4a7935bd1e995
mov rax, rdx
mov r11, rdx
imul rax, r9
and r11, 0xfffffffffffffff8
add r11, rcx
xor rax, r8
cmp rcx, r11
je 0x1400c9d30
nop dword [rax + rax]
mov r10, qword [rcx]
add rcx, 8
imul r10, r9
mov r8, r10
shr r8, 0x2f
xor r8, r10
imul r8, r9
xor r8, rax
mov rax, r8
imul rax, r9
cmp r11, rcx
jne 0x1400c9d08
and edx, 7
je 0x1400c9d65
sub edx, 1
xor r8d, r8d
movsxd rdx, edx
nop
movzx ecx, byte [r11 + rdx]
shl r8, 8
sub rdx, 1
add r8, rcx
test edx, edx
jns 0x1400c9d40
xor r8, rax
movabs rax, 0xc6a4a7935bd1e995
imul rax, r8
mov r8, rax
shr r8, 0x2f
xor rax, r8
movabs r8, 0xc6a4a7935bd1e995
imul rax, r8
mov r8, rax
shr r8, 0x2f
xor rax, r8
ret

Function at 0x1400cab20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, r8
test rdx, rdx
je 0x1400cab4c
movabs r9, 0x100000001b3
add rdx, rcx
nop dword [rax]
movsx r8, byte [rcx]
add rcx, 1
xor rax, r8
imul rax, r9
cmp rcx, rdx
jne 0x1400cab38
ret
Function at 0x1400d39d0
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
call dbg.__main
mov rax, qword [0x1400dd420]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x1400dd410]
mov r8, qword [rax]
mov rax, qword [0x1400dd400]
mov rcx, qword [rax]
add rsp, 0x28
jmp sym.WinMain
Function at 0x140001070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x100
movdqa xmm2, xmmword [0x140a862c0]
lea rdx, [rsp + 4]
movdqa xmm3, xmmword [0x140a862d0]
mov ecx, 8
nop word [rax + rax]
lea eax, [rcx - 8]
movd xmm0, eax
lea rdx, [rdx + 0x10]
pshufd xmm0, xmm0, 0
lea eax, [rcx - 4]
paddd xmm0, xmm2
movd xmm1, eax
pshufd xmm1, xmm1, 0
lea eax, [rcx + 4]
paddd xmm1, xmm2
andps xmm0, xmm3
andps xmm1, xmm3
packuswb xmm0, xmm0
packuswb xmm1, xmm1
packuswb xmm0, xmm0
movd dword [rdx - 0x14], xmm0
packuswb xmm1, xmm1
movd dword [rdx - 0x10], xmm1
movd xmm0, ecx
add ecx, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
movd xmm1, eax
pshufd xmm1, xmm1, 0
andps xmm0, xmm3
paddd xmm1, xmm2
packuswb xmm0, xmm0
andps xmm1, xmm3
packuswb xmm0, xmm0
movd dword [rdx - 0xc], xmm0
lea eax, [rcx - 8]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [rdx - 8], xmm1
cmp eax, 0x100
jl 0x1400010a0
xor r8b, r8b
lea r10, [rsp]
xor r11d, r11d
lea rdi, str.advapi32.dll
mov r9d, r11d
nop word [rax + rax]
movzx ebx, byte [r10]
mov eax, 0xaaaaaaab
mul r9d
movzx r8d, r8b
mov eax, r9d
shr edx, 3
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
movsx edx, byte [rcx + rdi]
add edx, ebx
add r8d, edx
and r8d, 0x800000ff
jge 0x140001190
dec r8d
or r8d, 0xffffff00
inc r8d
movzx eax, r8b
lea rcx, [rsp]
add rcx, rax
inc r9d
movzx eax, byte [rcx]
mov byte [r10], al
inc r10
mov byte [rcx], bl
cmp r9d, 0x100
jl 0x140001150
xor bl, bl
lea rdi, [fcn.140001510]
mov r10, r11
nop
lea eax, [r11 + 1]
and eax, 0x800000ff
jge 0x1400011d4
dec eax
or eax, 0xffffff00
inc eax
movsxd r11, eax
lea r9, [rsp]
lea rcx, [rsp]
movzx r8d, byte [r9 + r11]
add bl, r8b
movzx eax, bl
add rcx, rax
movzx eax, byte [rcx]
mov byte [r9 + r11], al
mov byte [rcx], r8b
movzx ecx, byte [r9 + r11]
add rcx, r8
movzx eax, cl
movzx ecx, byte [rsp + rax]
xor byte [r10 + rdi], cl
inc r10
cmp r10, 0xa82edc
jl 0x1400011c0
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rdi
ret

Function at 0x140001230
Capabilities:
Allocate or change rwx memory
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 5
mov rbx, rax
call fcn.140001310
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
movsd xmm0, qword [0x140a862b0]
xorps xmm1, xmm1
sub rax, rbx
cvtsi2sd xmm1, rax
divsd xmm1, qword [0x140a862b8]
comisd xmm0, xmm1
jb 0x140001291
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r9, [rsp + 0x28]
mov dword [rsp + 0x28], 0
mov edx, 0xa82edc
lea rcx, [fcn.140001510]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400012ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error:__d
call fcn.140001010
call fcn.140001070
mov r8d, dword [rsp + 0x28]
lea r9, [rsp + 0x28]
mov edx, 0xa82edc
lea rcx, [fcn.140001510]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.140001510
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140a84410
add rsp, 0x40
pop rbx
ret
Function at 0x140a84cd0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140a84d1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140a84d1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140a84d1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140a84d1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140a84d1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140a84d1c
xor al, al
add rsp, 0x28
ret
Function at 0x10001e024
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1000301f8], rdi
je 0x10001e07d
cmp rax, rdi
jne 0x10001e070
mov esi, 1
jmp 0x10001e07d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001e057
mov eax, dword [0x1000301f0]
cmp eax, 1
jne 0x10001e092
lea ecx, [rax + 0x1e]
call fcn.1000c2000
jmp 0x10001e0f7
mov eax, dword [0x1000301f0]
test eax, eax
jne 0x10001e0ed
mov dword [0x1000301f0], 1
lea r12, [0x100001690]
lea rdi, [0x100001678]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
cmp rdi, r12
jae 0x10001e0df
test eax, eax
jne 0x10001e0df
mov rcx, qword [rdi]
test rcx, rcx
je 0x10001e0d4
call rcx
mov dword [rsp + 0x30], eax
add rdi, 8
mov qword [rsp + 0x38], rdi
jmp 0x10001e0bd
test eax, eax
je 0x10001e0f7
mov eax, 0xff
jmp 0x10001e241
mov dword [0x10002f924], 1
mov eax, dword [0x1000301f0]
cmp eax, 1
jne 0x10001e11f
lea rdx, [0x100001670]
lea rcx, [0x1000015f8]
call sub.msvcrt.dll__initterm
mov dword [0x1000301f0], 2
test esi, esi
jne 0x10001e12c
xor eax, eax
xchg qword [0x1000301f8], rax
cmp qword [0x100030210], 0
je 0x10001e155
lea rcx, [0x100030210]
call fcn.10001e5dc
test eax, eax
je 0x10001e155
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100030210]
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rdi, qword [rax]
mov qword [rsp + 0x28], rdi
mov esi, dword [rsp + 0x20]
cmp byte [rdi], 0x20
ja 0x10001e1e0
cmp byte [rdi], 0
je 0x10001e176
test esi, esi
jne 0x10001e1e0
cmp byte [rdi], 0
je 0x10001e18a
cmp byte [rdi], 0x20
ja 0x10001e18a
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10001e176
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rdi
xor edx, edx
lea rcx, [0x100000000]
call fcn.100008db4
mov dword [0x10002f920], eax
cmp dword [0x10002f904], 0
jne 0x10001e1c9
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10002f924], 0
jne 0x10001e1de
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10002f920]
jmp 0x10001e241
cmp byte [rdi], 0x22
jne 0x10001e1f2
xor eax, eax
test esi, esi
sete al
mov esi, eax
mov dword [rsp + 0x20], eax
movzx ecx, byte [rdi]
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x10001e207
inc rdi
mov qword [rsp + 0x28], rdi
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10001e168
lea r11, [rsp + 0xb0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret
sub rsp, 0x28
call fcn.10001e6e4
add rsp, 0x28
jmp 0x10001e024
Function at 0x140008bb4
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x18]
sub rsp, 0x110
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp], rax
mov esi, dword [0x14000c20c]
mov dword [rsp + 0x30], InitCommonControls
cmp esi, 0xfffffffe
jne 0x140008d4c
xor edi, edi
mov dword [rsp + 0x50], 0x94
lea rcx, [rsp + 0x50]
mov dword [0x14000c20c], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
nop dword [rax + rax]
test eax, eax
je 0x140008d46
lea esi, [rdi + 1]
cmp dword [rsp + 0x60], esi
jne 0x140008d46
cmp dword [rsp + 0x54], 4
jne 0x140008d46
cmp dword [rsp + 0x58], 0xa
jae 0x140008d46
lea ecx, [rdi + 0x4a]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
nop dword [rax + rax]
test eax, eax
je 0x140008d46
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Control_PanelDesktopResourceLocale
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [rax + rax]
test eax, eax
jne 0x140008d46
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rbp - 0x10]
xor r8d, r8d
lea rdx, [0x140009770]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jne 0x140008d46
lea rcx, [rbp - 0x10]
mov al, byte [rcx]
sub al, 0x30
cmp al, 9
ja 0x140008cef
movsx eax, byte [rcx]
add edi, 0xfffffffd
shl edi, 4
add edi, eax
jmp 0x140008d15
mov al, byte [rcx]
sub al, 0x20
cmp byte [rcx], 0x61
movzx edx, al
movzx eax, byte [rcx]
cmovl edx, eax
movsx r8d, dl
lea eax, [r8 - 0x41]
cmp eax, 5
ja 0x140008d26
shl edi, 4
add edi, 0xffffffc9
add edi, r8d
call qword [sym.imp.USER32.dll_CharNextA]
nop dword [rax + rax]
mov rcx, rax
jmp 0x140008cda
lea rax, [rbp - 0x10]
cmp rcx, rax
je 0x140008d46
and edi, 0x3ff
cmp edi, esi
je 0x140008d3e
cmp edi, 0xd
jne 0x140008d46
mov dword [0x14000c20c], esi
jmp 0x140008d4c
mov esi, dword [0x14000c20c]
mov eax, esi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400013e0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x140001c70
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001cba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001cba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001cba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001cba
cmp dword [rcx + 0x84], 0xe
jbe 0x140001cba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001cbc
xor al, al
add rsp, 0x28
ret
Function at 0x140001144
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140124d60]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx eax, byte [rdx]
mov r11, rcx
mov r10, qword [rsp + 0x88]
shl eax, 0x18
mov dword [rsp + 0x38], eax
movzx eax, word [rdx + 1]
mov dword [rsp + 0x3c], eax
mov rax, qword [rdx + 3]
add rdx, 0xb
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov qword [r10], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], r10
movzx ecx, word [rax]
mov dword [r10 + 8], ecx
lea rcx, str.ETW0
mov qword [r10 + 0x10], rdx
mov dword [r10 + 0xc], 2
movzx eax, word [rdx]
lea rdx, [rsp + 0x38]
mov dword [r10 + 0x18], eax
lea rax, [0x1400f9df0]
sub eax, ecx
mov dword [r10 + 0x1c], 1
mov rcx, qword [r11 + 0x20]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c0e50
add rsp, 0x58
ret
Function at 0x14001be2c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x140124d60]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov ebx, edx
mov rdi, rcx
and qword [rbp + 0x47], 0
lea rax, [rbp + 0x47]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftUEVAgentConfiguration
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001beee
mov dword [rbp + 0x37], 4
mov rcx, qword [rbp + 0x47]
test rcx, rcx
je 0x14001bf2a
lea rax, [rbp + 0x37]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3b]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001befd
mov edx, dword [rbp + 0x3b]
cmp edx, 4
jne 0x14001bee0
mov ebx, dword [rbp + 0x3f]
jmp 0x14001befd
lea rcx, str.AgentService.Util::GetDwordConfigValue:_Unexpected_value_type__type__0x_X
call fcn.140004fd0
jmp 0x14001befd
mov edx, eax
lea rcx, str.AgentService.Util::GetDwordConfigValue:_Failed_to_open_configuration_key__status__0x_X
call fcn.140004fd0
nop
lea rcx, [rbp + 0x47]
call fcn.140006c94
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400c0e50
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
lea rdx, str.Attempting_to_use_an_invalid_handle.
lea rcx, [rbp - 0x31]
call fcn.140006cf8
nop
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 9]
call fcn.140006514
lea rdx, [0x14011a6d0]
lea rcx, [rbp - 9]
call sub.msvcrt.dll__CxxThrowException
int3