joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d9290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x220
mov rsi, r8
lea rcx, [rsp + 0x20]
mov rdi, rdx
mov r8d, 0xff
xor edx, edx
call fcn.1403ccc50
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x120]
mov r8d, 0xff
call fcn.1403ccc50
movzx r8d, byte [rdi]
xor ecx, ecx
mov dword [rsp + 0x248], 0x5b303125
mov word [rsp + 0x24c], 0x24
movsxd rax, ecx
xor byte [rsp + rax + 0x248], cl
inc ecx
cmp ecx, 5
jb 0x1401d9300
lea rdx, [rsp + 0x248]
mov byte [rsp + 0x24d], 0
lea rcx, [rsp + 0x120]
call fcn.14013f0b8
lea rax, [rsp + 0x20]
dec rax
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x1401d9336
lea r8, [rsp + 0x120]
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1401d9350
inc ebx
inc rdi
cmp ebx, 0x28
jb 0x1401d92d0
lea rcx, [rsp + 0x20]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1401d9380
test rax, rax
je 0x1401d9393
mov byte [rsp + rax + 0x1f], 0
lea rax, [rsp + 0x20]
sub rsi, rax
lea rcx, [rsp + 0x20]
movzx eax, byte [rcx]
mov byte [rsi + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1401d93a0
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1401d99b0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140549208]
mov r14, r9
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r15, r8
mov dword [rsp + 0x28], 0x80
mov rcx, rdx
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
lea r8d, [r9 + 1]
call rax
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1401d9acc
mov qword [rsp + 0x68], rbx
xor edx, edx
mov qword [rsp + 0x70], rbp
mov rcx, rax
mov qword [rsp + 0x78], rsi
call qword [sym.imp.kernel32.dll_GetFileSize]
mov edx, eax
mov r9d, 4
mov r8d, 0x3000
mov ebx, eax
xor ecx, ecx
mov ebp, eax
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.1403ccc50
mov r10, qword [0x140549160]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov dword [rsp + 0x60], 0
mov rdx, rsi
mov qword [rsp + 0x20], 0
mov rcx, rdi
call r10
mov rbx, qword [rsp + 0x68]
test eax, eax
jne 0x1401d9ab9
mov r8d, ebp
xor edx, edx
mov rcx, rsi
call fcn.1403ccc50
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.kernel32.dll_VirtualFree]
mov rcx, rdi
call qword [0x140549178]
xor al, al
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov qword [r15], rsi
mov rcx, rdi
mov qword [r14], rbp
call qword [0x140549178]
mov al, 1
jmp 0x1401d9aa5
xor al, al
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x1401d9ae0
Capabilities:
Check if file exists
Delete file
Get file attributes
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rcx, r9
mov rbx, r9
mov rdi, r8
mov rsi, rdx
call qword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1401d9b14
mov rcx, rbx
call qword [sym.imp.kernel32.dll_DeleteFileA]
mov rax, qword [0x140549208]
xor r9d, r9d
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x10000000
mov rcx, rbx
mov dword [rsp + 0x20], 1
call rax
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1401d9b91
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
mov r8d, edi
mov qword [rsp + 0x20], 0
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.kernel32.dll_WriteFile]
mov rcx, rbx
call qword [0x140549178]
mov al, 1
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x58]
xor al, al
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1401d9bb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x140549208]
lea rsi, [rcx + 0x20]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, rsi
mov dword [rsp + 0x20], 1
lea r8d, [rbx + 1]
call rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1401d9d5d
mov rcx, rax
mov qword [rsp + 0x448], rdi
call qword [0x140549178]
xor eax, eax
mov word [rbp + 0x370], 0x3131
mov byte [rbp + 0x372], al
mov ecx, ebx
nop dword [rax + rax]
movsxd rax, ecx
xor byte [rbp + rax + 0x370], cl
inc ecx
cmp ecx, 2
jb 0x1401d9c30
lea rcx, [rbp + 0x370]
mov byte [rbp + 0x372], bl
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rbp + 0x378], 0x37313331
mov byte [rbp + 0x37c], cl
mov edx, ebx
nop word [rax + rax]
movsxd rcx, edx
xor byte [rbp + rcx + 0x378], dl
inc edx
cmp edx, 4
jb 0x1401d9c70
mov r8d, eax
mov byte [rbp + 0x37c], bl
xor edx, edx
lea rcx, [rbp + 0x378]
call fcn.1403d6cb0
mov edi, eax
mov dword [rbp + 0x380], 0x766e6076
mov edx, ebx
mov word [rbp + 0x384], 0x61
nop
movsxd rcx, edx
xor byte [rbp + rcx + 0x380], dl
inc edx
cmp edx, 5
jb 0x1401d9cb0
xor eax, eax
mov byte [rbp + 0x385], bl
mov byte [rbp + 0x38e], al
mov dword [rbp + 0x388], 0x73677343
mov word [rbp + 0x38c], 0x614d
nop dword [rax]
nop word [rax + rax]
movsxd rax, ebx
xor byte [rbp + rax + 0x388], bl
inc ebx
cmp ebx, 6
jb 0x1401d9cf0
xor edx, edx
mov byte [rbp + 0x38e], 0
mov r8d, 0x400
lea rcx, [rsp + 0x40]
call fcn.1403ccc50
mov r8d, 0xa
lea rdx, [rsp + 0x40]
mov ecx, edi
call fcn.1403e1154
mov r9, rsi
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x388]
call qword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
mov rdi, qword [rsp + 0x448]
mov al, 1
add rsp, 0x450
pop rsi
pop rbx
pop rbp
ret
xor al, al
add rsp, 0x450
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401d9d70
Capabilities:
Check if file exists
Encode data using xor
Get file attributes
Read .ini file

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x338]
sub rsp, 0x438
lea rdi, [rcx + 0x20]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1401d9f13
mov qword [rsp + 0x468], rbx
xor ebx, ebx
mov qword [rsp + 0x430], rsi
mov ecx, ebx
mov esi, ebx
mov dword [rbp + 0x358], 0x766e6076
mov word [rbp + 0x35c], 0x61
movsxd rax, ecx
xor byte [rbp + rax + 0x358], cl
inc ecx
cmp ecx, 5
jb 0x1401d9dc1
xor eax, eax
mov byte [rbp + 0x35d], bl
mov byte [rbp + 0x366], al
mov ecx, ebx
mov dword [rbp + 0x360], 0x73677343
mov word [rbp + 0x364], 0x614d
nop word [rax + rax]
movsxd rax, ecx
xor byte [rbp + rax + 0x360], cl
inc ecx
cmp ecx, 6
jb 0x1401d9e00
xor edx, edx
mov byte [rbp + 0x366], bl
mov r8d, 0x400
lea rcx, [rsp + 0x30]
call fcn.1403ccc50
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rdi
lea r8, [rbp + 0x350]
mov byte [rbp + 0x350], bl
lea rdx, [rbp + 0x358]
mov dword [rsp + 0x20], 0x400
lea rcx, [rbp + 0x360]
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
test eax, eax
setne dil
test eax, eax
je 0x1401d9e72
lea rcx, [rsp + 0x30]
call fcn.1403d6dc0
mov esi, eax
test dil, dil
je 0x1401d9f01
xor eax, eax
mov word [rbp + 0x350], 0x3131
mov byte [rbp + 0x352], al
mov edx, ebx
nop
movsxd rcx, edx
xor byte [rbp + rcx + 0x350], dl
inc edx
cmp edx, 2
jb 0x1401d9e90
lea rcx, [rbp + 0x350]
mov byte [rbp + 0x352], al
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rbp + 0x358], 0x37313331
mov byte [rbp + 0x35c], cl
nop word [rax + rax]
movsxd rcx, ebx
xor byte [rbp + rcx + 0x358], bl
inc ebx
cmp ebx, 4
jb 0x1401d9ed0
mov r8d, eax
mov byte [rbp + 0x35c], 0
xor edx, edx
lea rcx, [rbp + 0x358]
call fcn.1403d6cb0
cmp esi, eax
jne 0x1401d9f03
xor al, al
jmp 0x1401d9f03
mov al, 1
mov rbx, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x430]
add rsp, 0x438
pop rdi
pop rbp
ret
Function at 0x1401daac0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
xor eax, eax
mov dword [rbp - 0x10], 0x35326562
xor r8d, r8d
mov dword [rbp - 0xc], 0x66603465
mov ecx, r8d
mov dword [rbp - 8], 0x3f3e3f3a
mov byte [rbp - 4], al
nop dword [rax]
movsxd rax, ecx
xor byte [rbp + rax - 0x10], cl
inc ecx
cmp ecx, 0xc
jb 0x1401daaf0
mov byte [rbp - 4], r8b
lea rcx, [rdx - 1]
cmp byte [rcx + 1], r8b
lea rcx, [rcx + 1]
jne 0x1401dab06
lea r10, [rbp - 0x10]
xor r9d, r9d
nop word [rax + rax]
movzx eax, byte [r10 + r9]
mov byte [rcx + r9], al
lea r9, [r9 + 1]
test al, al
jne 0x1401dab20
xor eax, eax
mov dword [rbp - 0x10], 0x613a6735
mov byte [rbp - 4], al
mov ecx, r8d
mov dword [rbp - 0xc], 0x30603136
mov dword [rbp - 8], 0x6d6b6c6a
nop
movsxd rax, ecx
xor byte [rbp + rax - 0x10], cl
inc ecx
cmp ecx, 0xc
jb 0x1401dab50
mov byte [rbp - 4], r8b
lea rcx, [rdx - 1]
cmp byte [rcx + 1], r8b
lea rcx, [rcx + 1]
jne 0x1401dab66
lea r10, [rbp - 0x10]
xor r9d, r9d
nop word [rax + rax]
movzx eax, byte [r10 + r9]
mov byte [rcx + r9], al
lea r9, [r9 + 1]
test al, al
jne 0x1401dab80
xor eax, eax
mov dword [rbp - 0x10], 0x60353738
mov byte [rbp - 8], al
mov dword [rbp - 0xc], 0x66306461
nop dword [rax]
nop dword [rax + rax]
movsxd rax, r8d
xor byte [rbp + rax - 0x10], r8b
inc r8d
cmp r8d, 8
jb 0x1401dabb0
mov byte [rbp - 8], 0
dec rdx
nop dword [rax + rax]
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x1401dabd0
lea r8, [rbp - 0x10]
xor ecx, ecx
movzx eax, byte [r8 + rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1401dabe0
add rsp, 0x10
pop rbp
ret
Function at 0x1401dac00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov r12, rdx
lea eax, [r8 + 0x3fff]
cdq
lea r15d, [r8 + 6]
and edx, 0x3fff
xor r13d, r13d
add eax, edx
mov r14, r9
sar eax, 0xe
mov rsi, r8
lea r15d, [r15 + rax*4]
add r15d, eax
mov edi, r15d
jne 0x1401dac58
mov ebx, r13d
jmp 0x1401dac7f
mov r9d, 4
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov r8, rdi
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.1403ccc50
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.1403ccc50
xorps xmm0, xmm0
lea rcx, [rbp - 0x39]
movups xmmword [rbp - 0x39], xmm0
xor eax, eax
mov dword [rbp - 0x31], esi
movups xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x2d], esi
mov dword [rbp - 0x21], r15d
mov dword [rbp - 0x1d], r15d
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x29], rbx
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp + 0x17], rax
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
call fcn.140212380
test eax, eax
jne 0x1401dacf7
lea edx, [rax + 4]
lea rcx, [rbp - 0x39]
call fcn.140212740
cmp eax, 1
jne 0x1401dad4f
lea rcx, [rbp - 0x39]
call fcn.1402133b0
mov rax, qword [rbp + 0x77]
mov ecx, dword [rbp - 0x1d]
mov qword [r14], rbx
mov qword [rax], rcx
mov al, 1
jmp 0x1401dad51
xor eax, eax
mov dword [rbp - 0x59], 0x6e0043
mov word [rbp - 0x3d], ax
mov dword [rbp - 0x55], 0x73006f
mov dword [rbp - 0x51], 0x600076
mov dword [rbp - 0x4d], 0x740075
mov dword [rbp - 0x49], 0x6c0028
mov dword [rbp - 0x45], 0x790078
mov dword [rbp - 0x41], 0x7f0063
nop
movsxd rcx, eax
xor word [rbp + rcx*2 - 0x59], ax
inc eax
cmp eax, 0xe
jb 0x1401dad30
lea rdx, [rbp - 0x59]
mov word [rbp - 0x3d], r13w
xor ecx, ecx
call fcn.1401a8110
xor al, al
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1401dd930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push r14
sub rsp, 0x70
mov rcx, r8
mov r14, rdx
lea r8, [rsp + 0x30]
mov rdx, r9
call fcn.140252550
xor eax, eax
mov dword [rsp + 0x80], 0x7b303125
xorps xmm0, xmm0
mov byte [rsp + 0x60], al
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
xor ecx, ecx
movups xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x28], ax
mov byte [rsp + 0x84], al
nop
movsxd rax, ecx
xor byte [rsp + rax + 0x80], cl
inc ecx
cmp ecx, 4
jb 0x1401dd990
lea rax, [rsp + 0x20]
mov byte [rsp + 0x84], 0
dec rax
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x1401dd9b1
lea r8, [rsp + 0x80]
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1401dd9d0
lea rbx, [rsp + 0x30]
mov esi, 0x10
lea rdi, [rsp + 0x40]
nop
movzx r8d, byte [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1401a0fe0
add rdi, 2
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x1401dd9f0
lea rax, [rsp + 0x40]
sub r14, rax
lea rcx, [rsp + 0x40]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [r14 + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1401dda20
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1401dda50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rdi, rdx
mov qword [rsp + 0x90], rsi
mov r8, rdx
lea rdx, [rbp - 0x20]
call fcn.1401da680
call fcn.140141104
mov r14, qword [rbp - 0x18]
xor r8d, r8d
mov r15, qword [rbp - 0x20]
mov ecx, 0xf
mov rdx, r14
mov qword [rbp - 0x40], 0
sub rdx, r15
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x28], rcx
cmp rdx, rcx
jbe 0x1401ddac1
lea rcx, [rbp - 0x40]
call fcn.1401a7420
mov rcx, qword [rbp - 0x28]
xor r8d, r8d
mov qword [rbp - 0x30], r8
mov rsi, r15
cmp r15, r14
je 0x1401ddb2b
mov qword [rsp + 0x88], rbx
movzx ebx, byte [rbp + 0x20]
movzx r9d, byte [rsi]
cmp r8, rcx
jae 0x1401ddaff
lea rax, [r8 + 1]
cmp rcx, 0x10
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x40]
cmovae rax, qword [rbp - 0x40]
mov byte [rax + r8], r9b
mov byte [rax + r8 + 1], 0
jmp 0x1401ddb11
movzx r8d, bl
lea rcx, [rbp - 0x40]
mov edx, 1
call fcn.1401a7570
mov rcx, qword [rbp - 0x28]
inc rsi
cmp rsi, r14
je 0x1401ddb23
mov r8, qword [rbp - 0x30]
jmp 0x1401ddad5
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
lea rax, [rbp - 0x40]
cmp rdi, rax
je 0x1401ddb90
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x1401ddb76
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x1401ddb71
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401ddc9d
mov rcx, r8
call fcn.1403cad84
movups xmm0, xmmword [rbp - 0x40]
mov ecx, 0xf
mov byte [rbp - 0x40], 0
movups xmm1, xmmword [rbp - 0x30]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
nop
cmp rcx, 0x10
jb 0x1401ddbc8
lea rdx, [rcx + 1]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401ddbc3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401ddc9d
call fcn.1403cad84
movdqa xmm0, xmmword [0x1404cf8f0]
xor eax, eax
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x30], al
xor ecx, ecx
nop dword [rax]
movsxd rax, ecx
xor byte [rbp + rax - 0x40], cl
inc ecx
cmp ecx, 0x10
jb 0x1401ddbe0
xor edx, edx
mov byte [rbp - 0x30], 0
sub r14, r15
je 0x1401ddc56
xor ecx, ecx
lea rax, [rbp - 0x40]
mov r10, 0xffffffffffffffff
inc r10
cmp byte [rax + r10], cl
jne 0x1401ddc06
nop
xor r8d, r8d
test r10, r10
je 0x1401ddc4e
lea r11, [rbp - 0x40]
sub r11, rcx
nop
movsxd rax, edx
cmp rax, r14
jae 0x1401ddc4e
cmp qword [rdi + 0x18], 0x10
mov rax, rdi
movzx r9d, byte [r11 + rcx]
jb 0x1401ddc3a
mov rax, qword [rdi]
xor byte [rax + rcx], r9b
inc r8d
movsxd rax, r8d
inc edx
inc rcx
cmp rax, r10
jb 0x1401ddc20
movsxd rax, edx
cmp rax, r14
jb 0x1401ddc10
test r15, r15
je 0x1401ddc8b
mov rdx, qword [rbp - 0x10]
mov rax, r15
sub rdx, r15
cmp rdx, 0x1000
jb 0x1401ddc83
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401ddc9d
mov rcx, r15
call fcn.1403cad84
mov rdi, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rbp
ret
call fcn.1403d7020
int3
Function at 0x1401ddcb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
test r8d, r8d
je 0x1401ddec9
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r15
mov rbp, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov r12d, r8d
mov qword [rax - 0x28], rsi
mov r13, rdx
mov qword [rax - 0x30], rdi
xor r15d, r15d
mov qword [rax - 0x38], r14
nop word [rax + rax]
xor eax, eax
mov word [rbp + 0x38], 0x3731
mov byte [rbp + 0x3a], al
nop dword [rax + rax]
movsxd rcx, eax
xor byte [rbp + rcx + 0x38], al
inc eax
cmp eax, 2
jb 0x1401ddd00
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], 0
call fcn.1403d6dc0
mov ebx, eax
mov dword [rbp - 0x34], 0x46447930
xor eax, eax
mov dword [rbp - 0x30], 0x32323246
mov byte [rbp - 0x28], al
xor ecx, ecx
mov dword [rbp - 0x2c], 0x33383c3f
nop dword [rax]
movsxd rax, ecx
xor byte [rbp + rax - 0x34], cl
inc ecx
cmp ecx, 0xc
jb 0x1401ddd40
xor eax, eax
mov byte [rbp - 0x28], 0
mov byte [rbp + 0x2a], al
xor ecx, ecx
mov word [rbp + 0x28], 0x3731
nop
movsxd rax, ecx
xor byte [rbp + rax + 0x28], cl
inc ecx
cmp ecx, 2
jb 0x1401ddd60
lea rcx, [rbp + 0x28]
mov byte [rbp + 0x2a], 0
call fcn.1403d6dc0
mov edi, eax
mov dword [rbp - 0x41], 0x33357930
xor edx, edx
mov word [rbp - 0x3d], 0x30
nop dword [rax]
movsxd rcx, edx
xor byte [rbp + rcx - 0x41], dl
inc edx
cmp edx, 5
jb 0x1401ddd90
xor eax, eax
mov byte [rbp - 0x3c], 0
mov byte [rbp + 0x42], al
xor ecx, ecx
mov word [rbp + 0x40], 0x3731
nop
movsxd rax, ecx
xor byte [rbp + rax + 0x40], cl
inc ecx
cmp ecx, 2
jb 0x1401dddb0
lea rcx, [rbp + 0x40]
mov byte [rbp + 0x42], 0
call fcn.1403d6dc0
mov r14d, eax
mov dword [rbp - 0x3b], 0x33417930
xor eax, eax
mov word [rbp - 0x37], 0x4040
mov byte [rbp - 0x35], al
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx - 0x3b], dl
inc edx
cmp edx, 6
jb 0x1401ddde2
mov byte [rbp - 0x35], al
xor ecx, ecx
mov word [rbp - 0x48], 0x3131
mov byte [rbp - 0x46], al
nop
movsxd rax, ecx
xor byte [rbp + rax - 0x48], cl
inc ecx
cmp ecx, 2
jb 0x1401dde00
lea rcx, [rbp - 0x48]
mov byte [rbp - 0x46], 0
call fcn.1403d6dc0
mov esi, eax
mov dword [rbp - 0x45], 0x3a3139
xor edx, edx
nop word [rax + rax]
movsxd rcx, edx
xor byte [rbp + rcx - 0x45], dl
inc edx
cmp edx, 3
jb 0x1401dde30
mov r8d, ebx
mov byte [rbp - 0x42], 0
xor edx, edx
lea rcx, [rbp - 0x34]
call fcn.1403d6cb0
mov r8d, edi
lea rcx, [rbp - 0x41]
xor edx, edx
mov ebx, eax
call fcn.1403d6cb0
movzx ecx, al
mov r8d, esi
movzx edi, bl
xor edx, edx
imul edi, ecx
lea rcx, [rbp - 0x45]
call fcn.1403d6cb0
movzx ecx, r15b
mov r8d, r14d
movzx ebx, al
xor edx, edx
imul ebx, ecx
lea rcx, [rbp - 0x3b]
add bl, dil
call fcn.1403d6cb0
movsxd rcx, r15d
add al, bl
inc r15d
xor byte [rcx + r13], al
cmp r15d, r12d
jb 0x1401ddcf0
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x98]
add rsp, 0x68
pop r15
pop r13
pop r12
pop rbp
ret
Function at 0x1401de5b0
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbp
push rdi
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x88
xor r15d, r15d
lea rax, [rbp + 0x67]
mov qword [r11 - 0x50], r15
mov rdi, rdx
mov qword [r11 - 0x58], r15
mov r14, rcx
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [r11 - 0x60], r15
xor r8d, r8d
mov qword [r11 - 0x68], r15
xor edx, edx
mov qword [r11 - 0x70], r15
mov qword [r11 - 0x78], r15
mov qword [r11 - 0x80], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x77], r15d
mov dword [rbp + 0x67], r15d
call qword [sym.imp.advapi32.dll_RegQueryInfoKeyW]
xorps xmm0, xmm0
mov qword [rbp + 0x2f], r15
movdqu xmmword [rbp + 0x1f], xmm0
test eax, eax
je 0x1401de644
lea rcx, [rbp + 0x1f]
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
call fcn.140194884
mov rax, rdi
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rbp
ret
mov eax, dword [rbp + 0x67]
inc eax
mov qword [rsp + 0xb8], rbx
mov ecx, eax
mov dword [rbp + 0x67], eax
mov eax, 2
mul rcx
mov qword [rsp + 0x80], rsi
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovo rbx, rax
mov rcx, rbx
call fcn.1403caeb8
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.1403ccc50
mov eax, dword [rbp + 0x77]
mov rcx, qword [rbp + 0x2f]
mov edx, eax
sub rcx, qword [rbp + 0x1f]
sar rcx, 5
cmp rax, rcx
jbe 0x1401de6ae
lea rcx, [rbp + 0x1f]
call fcn.1401e6820
mov eax, dword [rbp + 0x77]
mov ebx, r15d
test eax, eax
je 0x1401de746
nop dword [rax]
mov eax, dword [rbp + 0x67]
lea r9, [rbp + 0x7f]
mov rcx, qword [r14]
mov r8, rsi
mov qword [rsp + 0x38], r15
mov edx, ebx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov dword [rbp + 0x7f], eax
call qword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1401de746
mov rax, qword [rbp + 0x27]
mov qword [rbp + 0x17], rsi
cmp rax, qword [rbp + 0x2f]
je 0x1401de727
mov r8d, dword [rbp + 0x7f]
mov rdx, rsi
mov qword [rax], r15
mov rcx, rax
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
call fcn.14013ee4c
add qword [rbp + 0x27], 0x20
jmp 0x1401de73b
lea r9, [rbp + 0x7f]
mov rdx, rax
lea r8, [rbp + 0x17]
lea rcx, [rbp + 0x1f]
call fcn.1401e6ab0
inc ebx
cmp ebx, dword [rbp + 0x77]
jb 0x1401de6c0
mov rcx, qword [rbp + 0x27]
mov rax, qword [rbp + 0x1f]
mov rdx, qword [rbp + 0x2f]
mov qword [rdi + 8], rcx
mov rcx, rsi
mov qword [rdi], rax
mov qword [rdi + 0x10], rdx
mov qword [rbp + 0x2f], r15
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x1f], r15
call fcn.1403cad84
lea rcx, [rbp + 0x1f]
call fcn.140194884
mov rbx, qword [rsp + 0xb8]
mov rax, rdi
mov rsi, qword [rsp + 0x80]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rbp
ret
Function at 0x1401e0270
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x190]
sub rsp, 0x290
lea rax, [rbp + 0x1b0]
mov byte [rbp + 0x1b0], 0
mov rbx, rcx
lea rdx, [rbp + 0x1b0]
sub rcx, rax
nop
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1401e02a0
lea rdx, [rbp + 0x1c0]
mov dword [rbp + 0x1b8], 4
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.bthprops.cpl_BluetoothFindFirstRadio]
mov rdi, rax
test rax, rax
jne 0x1401e0320
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x103
jne 0x1401e0320
lea rax, [rbp + 0x1b0]
mov byte [rbp + 0x1b0], dil
sub rbx, rax
lea rcx, [rbp + 0x1b0]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rbx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1401e0300
add rsp, 0x290
pop rdi
pop rbx
pop rbp
ret
mov rcx, qword [rbp + 0x1c0]
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x208
call qword [sym.imp.bthprops.cpl_BluetoothGetRadioInfo]
test eax, eax
jne 0x1401e0460
xor eax, eax
mov dword [rsp + 0x50], 0x3e4a2320
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
movups xmmword [rsp + 0x60], xmm0
xor ecx, ecx
mov dword [rsp + 0x78], eax
movdqa xmm0, xmmword [0x1404cf160]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x7c], ax
mov dword [rsp + 0x54], 0x4f242531
mov dword [rsp + 0x58], 0x292a3c35
mov word [rsp + 0x5c], 0x44
nop word [rax + rax]
movsxd rax, ecx
xor byte [rsp + rax + 0x40], cl
inc ecx
cmp ecx, 0x1d
jb 0x1401e0390
mov byte [rsp + 0x5d], 0
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x40]
mov byte [rsp + rcx + 0x60], al
lea rcx, [rcx + 1]
test al, al
jne 0x1401e03b0
movzx ecx, byte [rbp - 0x77]
movzx edx, byte [rbp - 0x76]
movzx r10d, byte [rbp - 0x75]
movzx r9d, byte [rbp - 0x74]
movzx r8d, byte [rbp - 0x73]
mov byte [rbx], al
movzx eax, byte [rbp - 0x78]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov rcx, rbx
mov dword [rsp + 0x28], edx
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x20], r10d
call fcn.1401a0fe0
xor ecx, ecx
mov word [rbp + 0x1b0], 0x7c
nop word [rax + rax]
movsxd rax, ecx
xor byte [rbp + rax + 0x1b0], cl
inc ecx
cmp ecx, 1
jb 0x1401e0410
mov byte [rbp + 0x1b1], 0
lea rax, [rbx - 1]
nop dword [rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x1401e0430
lea r8, [rbp + 0x1b0]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1401e0450
lea rdx, [rbp + 0x1c0]
mov rcx, rdi
call qword [sym.imp.bthprops.cpl_BluetoothFindNextRadio]
test eax, eax
jne 0x1401e0320
mov rcx, rdi
call qword [sym.imp.bthprops.cpl_BluetoothFindRadioClose]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1401e0490
test eax, eax
jle 0x1401e04a4
cdqe
mov byte [rax + rbx - 1], 0
add rsp, 0x290
pop rdi
pop rbx
pop rbp
ret