joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d540
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
call fcn.00020f48
cmp dword [rax + 0x130], 1
mov rbx, rax
je 0x4d56a
mov ecx, dword [rax + 0x134]
mov dword [rax + 0x130], ecx
mov rcx, qword [rax + 0x248]
call fcn.00020f48
mov rcx, qword [rax + 0x240]
call fcn.0005040c
test al, al
je 0x4d594
mov rcx, qword [rbx + 0x240]
xor edx, edx
call fcn.000504c8
and dword [rbx + 0x130], 0
and dword [rdi + 0x30], 0
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor edx, edx
mov rcx, rbx
call fcn.0004e5ac
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x4e234
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
call fcn.00020f48
cmp dword [rax + 0x130], 1
mov rdi, rax
je 0x4e26c
mov ebx, 0xc0000010
xor edx, edx
mov rcx, rsi
mov dword [rsi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
jmp 0x4e2e8
mov rcx, qword [rax + 0x248]
call fcn.00020f48
mov rcx, qword [rax + 0x240]
call fcn.0005040c
test al, al
je 0x4e296
mov rcx, qword [rdi + 0x240]
xor edx, edx
call fcn.000504c8
mov rdx, qword [rsi + 0xb8]
mov r8d, 0x38
lea rbx, [rdx - 0x48]
mov rcx, rbx
call fcn.0003aae0
mov byte [rbx + 3], 0
mov rax, qword [rsi + 0xb8]
and qword [rax - 8], 0
lea rcx, [0x0001d678]
mov byte [rax - 0x45], 0xe0
mov qword [rax - 0x10], rcx
lock add dword [rdi + 0x220], 1
mov rcx, qword [rdi + 0x250]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x50ddc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
sub esp, 0x40

Function at 0x50f58
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50

Function at 0x510e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 8], ebx

Function at 0x513d4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, r9
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], rdx
push rsp
and al, 0x20
mov r9d, 3
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
invalid
dec dword [rbx + 0x5c8b48c3]
and al, 0x40
add rsp, 0x30
pop rdi
ret
Function at 0x55824
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, r9
mov rdi, rdx
mov rbp, rcx
call fcn.00020f48
cmp dword [rdi + 0x30], 0
mov r13d, 0xc00000bb
mov rsi, rax
mov ebx, r13d
jl 0x55865
cmp byte [rsp + 0x60], 0
je 0x5587c
jmp 0x5586b
cmp dword [rdi + 0x30], r13d
jne 0x5587c
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
call r12
mov ebx, eax
test byte [rsi], 0x20
je 0x558a3
cmp ebx, 0x103
je 0x558ce
cmp ebx, r13d
je 0x55893
mov dword [rdi + 0x30], ebx
jmp 0x55896
mov ebx, dword [rdi + 0x30]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
jmp 0x558ce
cmp ebx, 0x103
je 0x558ce
cmp ebx, r13d
je 0x558b3
mov dword [rdi + 0x30], ebx
test ebx, ebx
jns 0x558bc
cmp ebx, r13d
jne 0x55896
mov rcx, qword [rsi + 0x250]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov ebx, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x558f0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov r12, r8
mov rdi, rdx
mov rbx, rcx
call fcn.00020f48
mov edx, 0x30
xor ecx, ecx
mov r8d, 0x49706341
mov rbp, rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
mov rsi, rax
jne 0x5594f
mov ebx, 0xc000009a
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
jmp 0x559f3
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoAllocateWorkItem]
test rax, rax
mov r11, rax
jne 0x5596d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x55935
mov al, byte [rsp + 0x50]
and qword [rsi + 0x28], 0
mov qword [rsi + 0x10], r12
mov byte [rsi + 0x18], al
mov qword [rsi], rbx
mov byte [rsi + 0x19], 1
mov byte [rsi + 0x1a], 0
mov byte [rsi + 0x1b], 0
mov qword [rsi + 8], rdi
mov qword [rsi + 0x20], r11
lock add dword [rbp + 0x220], 1
mov rdx, qword [rdi + 0xb8]
mov r8d, 0x38
lea rbx, [rdx - 0x48]
mov rcx, rbx
call fcn.0003aae0
mov byte [rbx + 3], 0
mov rax, qword [rdi + 0xb8]
mov qword [rax - 8], rsi
mov byte [rax - 0x45], 0xe0
lea rcx, [0x0002b90c]
mov qword [rax - 0x10], rcx
mov rax, qword [rdi + 0xb8]
mov rdx, rdi
or byte [rax + 3], 1
mov rcx, qword [rbp + 0x250]
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov eax, 0x103
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x55a14
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rbx, rdx
mov rbp, rcx
call fcn.00020f48
mov rdi, qword [rbx + 8]
mov r10, qword [rbx + 0x10]
mov r8, qword [rbx + 0x28]
mov r12, rax
xor eax, eax
mov esi, 0xc00000bb
cmp dword [rdi + 0x30], eax
jl 0x55a58
cmp byte [rbx + 0x18], al
jmp 0x55a6f
cmp dword [rdi + 0x30], esi
jne 0x55a62
cmp byte [rbx + 0x19], al
jmp 0x55a6f
cmp byte [rbx + 0x1a], al
jne 0x55a71
cmp byte [rdi + 0x44], al
je 0x55a7f
cmp byte [rbx + 0x1b], al
je 0x55a7f
mov r9b, 1
mov rdx, rdi
mov rcx, rbp
call r10
mov esi, eax
mov rcx, r12
call fcn.00020f14
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoFreeWorkItem]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp esi, 0x103
je 0x55aba
cmp esi, 0xc00000bb
je 0x55aaf
mov dword [rdi + 0x30], esi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x56948
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x00042100]
xor rax, rsp
mov qword [rsp + 0xf0], rax
and qword [rsp + 0x30], 0
mov rsi, rdx
mov ebx, 1
lea r9, [rsp + 0x40]
mov r8d, 0xf003f
mov edx, ebx
call qword [sym.imp.ntoskrnl.exe_IoOpenDeviceRegistryKey]
test eax, eax
js 0x56ae1
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x38]
lea rcx, str.Routing_Info
mov edx, ebx
call fcn.0005a194
test eax, eax
js 0x56ae1
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, str.Flags
mov byte [rsp + 0x5c], 0
call fcn.00050ddc
test eax, eax
js 0x569fc
mov rcx, qword [rsp + 0x30]
cmp dword [rcx + 4], 0
je 0x569eb
cmp dword [rcx], 4
jne 0x569eb
mov al, byte [rcx + 8]
mov byte [rsp + 0x5c], al
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
jmp 0x56a01
mov rbx, qword [rsp + 0x30]
lea rdx, str.LinkNode
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x48]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov r8d, 2
mov dword [rsp + 0x20], 0x78
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x56a81
cmp dword [rsp + 0x74], 3
jne 0x56a81
cmp dword [rsp + 0x48], 0x78
jae 0x56a81
mov eax, dword [rsp + 0x78]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x7c]
mov byte [rsp + rax + 0x7c], 0
call fcn.00056544
test eax, eax
mov edi, eax
js 0x56ac4
mov rcx, qword [rsp + 0x40]
and dword [rsp + 0x58], 0
mov qword [rsp + 0x50], rcx
jmp 0x56aba
mov rcx, qword [rsp + 0x38]
and qword [rsp + 0x50], 0
lea r8, [rsp + 0x30]
lea rdx, str.StaticVector
call fcn.00050ddc
mov rbx, qword [rsp + 0x30]
test eax, eax
mov edi, eax
js 0x56ac4
cmp dword [rbx + 4], 0
je 0x56aba
cmp dword [rbx], 4
jne 0x56aba
mov eax, dword [rbx + 8]
mov dword [rsp + 0x58], eax
movdqu xmm0, xmmword [rsp + 0x50]
movdqu xmmword [rsi], xmm0
test rbx, rbx
je 0x56ad4
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.0003aa80
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x56b0c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
xor ebx, ebx
lea r9, [rsp + 0x68]
lea edx, [rbx + 1]
mov r8d, 0xf003f
call qword [sym.imp.ntoskrnl.exe_IoOpenDeviceRegistryKey]
test eax, eax
js 0x56c5b
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x60]
lea edx, [rbx + 1]
lea rcx, str.Routing_Info
call fcn.0005a194
test eax, eax
js 0x56c5b
lea rdx, str.Flags
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsi + 0xc]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdx
lea r9d, [rbx + 4]
lea rdx, [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
mov edi, eax
js 0x56c4e
mov rcx, qword [rsi]
test rcx, rcx
je 0x56c00
mov rcx, qword [rcx + 0x1a8]
and qword [rsp + 0x68], rbx
lea rdx, [rsp + 0x68]
call fcn.000113a4
test eax, eax
mov edi, eax
cmovns rbx, qword [rsp + 0x68]
test eax, eax
js 0x56c3e
lea rdx, str.LinkNode
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
lea r9d, [rax + 3]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
jmp 0x56c29
lea rdx, str.StaticVector
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsi + 8]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov edi, eax
test rbx, rbx
je 0x56c4e
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x5a2cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x100
mov rbx, rcx
mov r13, r8
mov rsi, rdx
lea rcx, [rsp + 0x58]
xor r14d, r14d
xor edx, edx
mov r8d, 0xa0
mov r12, r9
mov qword [rsp + 0x50], r14
call fcn.0003cb30
mov r11d, dword [0x00042140]
lea r9, [rsp + 0x40]
lea edx, [r14 + 1]
mov r8d, 0xf003f
mov rcx, rbx
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x34], 2
mov rbp, r14
mov rdi, r14
mov qword [rsp + 0x38], r14
call qword [sym.imp.ntoskrnl.exe_IoOpenDeviceRegistryKey]
cmp eax, r14d
jl 0x5a516
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x38]
lea rcx, str.Affinity_Policy
xor edx, edx
call fcn.0005a194
cmp eax, r14d
jl 0x5a516
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
lea rdx, str.AssignmentSetOverride
mov qword [rsp + 0x40], r14
call fcn.00050ddc
cmp eax, r14d
jl 0x5a3e1
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx]
sub eax, 3
je 0x5a3b4
sub eax, 1
je 0x5a3af
cmp eax, 7
jne 0x5a3d9
mov rdi, qword [rcx + 8]
jmp 0x5a3d9
mov edi, dword [rcx + 8]
jmp 0x5a3d9
cmp dword [rcx + 4], r14d
jbe 0x5a3d9
cmp dword [rcx + 4], 8
ja 0x5a3d9
add dword [rcx + 4], 0xffffffff
mov eax, dword [rcx + 4]
shl rdi, 8
movzx edx, byte [rax + rcx + 8]
or rdi, rdx
cmp dword [rcx + 4], r14d
jne 0x5a3c0
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rdx, qword [rsp + 0x38]
mov ecx, 0x20
lea rax, str.DevicePolicy
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x58], ecx
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x90], ecx
mov qword [rsp + 0x78], rax
lea rax, str.DevicePriority
lea r8, [rsp + 0x50]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x34]
mov ecx, 0x40000000
mov dword [rsp + 0x70], 4
mov dword [rsp + 0x80], r14d
mov dword [rsp + 0xa8], 4
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
mov ecx, dword [rsp + 0x30]
cmp eax, r14d
mov ebx, eax
jl 0x5a4e2
cmp ecx, 5
cmove ecx, r14d
cmp rsi, r14
mov dword [rsp + 0x30], ecx
je 0x5a4b5
test byte [rsi + 4], 4
je 0x5a4b5
mov ecx, dword [rsi + 0x10]
mov eax, dword [rsi + 0x14]
mov rdi, qword [rsi + 0x18]
cmp ecx, 4
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], eax
je 0x5a4ba
mov rdi, r14
cmp ecx, 4
jne 0x5a4ce
mov rax, qword [sym.imp.ntoskrnl.exe_InitSafeBootMode]
cmp dword [rax], r14d
jne 0x5a4cb
cmp rdi, r14
jne 0x5a4df
mov ecx, r14d
cmp ecx, r14d
mov ebx, r14d
cmove ecx, dword [0x00042140]
mov dword [rsp + 0x30], ecx
mov rbp, rdi
mov rax, qword [rsp + 0x38]
cmp rax, r14
je 0x5a4f9
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [rsp + 0x30]
cmp ebx, r14d
jl 0x5a514
mov rax, qword [rsp + 0x140]
mov qword [r13], rbp
mov dword [rax], ecx
mov eax, dword [rsp + 0x34]
mov dword [r12], eax
mov eax, ebx
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x5bd14
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
lea rcx, [rsp + 0x30]
mov rsi, r8
call sub.ntoskrnl.exe_RtlInitUnicodeString
xor r9d, r9d
lea r11, [rsp + 0x68]
mov qword [rsp + 0x28], r11
and dword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
lea r8d, [r9 + 3]
mov rcx, rdi
call sub.ntoskrnl.exe_ZwQueryValueKey
cmp eax, 0x80000005
je 0x5bd64
cmp eax, 0xc0000023
jne 0x5bdca
mov edx, dword [rsp + 0x68]
mov ecx, 1
mov r8d, 0x4d627241
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
mov rbx, rax
jne 0x5bd88
mov eax, 0xc000009a
jmp 0x5bdca
lea rax, [rsp + 0x68]
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x68]
mov r8d, 3
mov rcx, rdi
mov dword [rsp + 0x20], eax
call sub.ntoskrnl.exe_ZwQueryValueKey
test eax, eax
mov edi, eax
jns 0x5bdc5
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x5bdca
mov qword [rsi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140004630]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140004640]
mov dword [rax], 1
mov rax, qword [0x140004650]
mov dword [rax], 1
mov rax, qword [0x1400045f0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140004620]
mov dword [0x14000700c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140004700]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400046e0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400045a0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x140004680]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x140004690]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140007008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x1400045e0]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call dbg._pei386_runtime_relocator
mov rcx, qword [dbg._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140004670]
lea rcx, [dbg.__mingw_invalidParameterHandler]
mov qword [rdx], rax
call sym._set_invalid_parameter_handler
call dbg._fpreset
mov ebx, dword [0x140007028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sym.malloc
mov r12, qword [0x140007020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
mov rcx, qword [r12 + rbx]
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [r12 + rbx]
mov rcx, rax
add rbx, 8
call sym.memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, rbp
mov qword [rdi], 0
mov qword [0x140007020], rbp
call dbg.__main
mov rax, qword [0x140004600]
mov r8, qword [0x140007018]
mov ecx, dword [0x140007028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140007020]
call sym.main
mov ecx, dword [0x14000700c]
mov dword [0x140007010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140007008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x140004690]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call dbg._amsg_exit
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x1400046b0]
mov rcx, qword [0x1400046a0]
call sym._initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sym._cexit
mov eax, dword [0x140007010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x1400046d0]
mov rcx, qword [0x1400046c0]
mov dword [rsi], 1
call sym._initterm
jmp 0x1400011f5
mov rdi, rax
jmp 0x1400012b5
mov ecx, eax
call sym.exit
nop
Function at 0x140001450
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov dword [rbp + 0x28], r9d
mov dword [rbp - 4], 0
mov eax, dword [rbp + 0x20]
mov dword [rbp - 0x20], eax
mov eax, dword [rbp + 0x20]
mov dword [rbp - 0x1c], eax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x18], rax
mov eax, dword [rbp + 0x28]
mov dword [rbp - 0x30], eax
mov eax, dword [rbp + 0x28]
mov dword [rbp - 0x2c], eax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x28], rax
lea rax, str.Advapi32
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov rcx, rax
lea rax, str.SystemFunction033
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x30]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call r8
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x1400014fa
mov eax, dword [rbp - 4]
mov edx, eax
lea rax, str.____SystemFunction033_FAILED_With_Error:_0x_0.8X__n
mov rcx, rax
call dbg.printf
mov eax, 0
jmp 0x1400014ff
mov eax, 1
add rsp, 0x50
pop rbp
ret

Function at 0x140001505
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x200
lea rbp, [rsp + 0x80]
call dbg.__main
lea rax, [rbp - 0x60]
lea rdx, [0x140004068]
mov ecx, 0x39
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
mov ecx, dword [rdx]
mov dword [rax], ecx
lea rax, [rax + 4]
lea rdx, [rdx + 4]
movzx ecx, byte [rdx]
mov byte [rax], cl
lea rax, str.maldev123
mov qword [rbp + 0x178], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x178]
mov r9d, 0x1cd
mov r8d, 8
mov rcx, rax
call sym.Rc4EncryptionViSystemFunc033
test eax, eax
jne 0x140001596
lea rax, str.error
mov rcx, rax
call sym.puts
mov ecx, 1
call sym.exit
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1cd
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x170]
mov rdx, rax
lea rax, [rbp - 0x60]
mov ecx, 0x1cd
mov r8, qword [rax]
mov qword [rdx], r8
mov r8d, ecx
add r8, rdx
lea r9, [r8 + 8]
mov r8d, ecx
add r8, rax
add r8, 8
mov r8, qword [r8 - 0x10]
mov qword [r9 - 0x10], r8
lea r8, [rdx + 8]
and r8, 0xfffffffffffffff8
sub rdx, r8
sub rax, rdx
add ecx, edx
and ecx, 0xfffffff8
shr ecx, 3
mov edx, ecx
mov edx, edx
mov rdi, r8
mov rsi, rax
mov rcx, rdx
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rbp + 0x170]
call rax
mov eax, 0
add rsp, 0x200
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400018f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call dbg.vfprintf
call sym.abort
nop
nop dword [rax]