joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100003c80
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x58
and dword [rsp + 0x60], 0
mov dword [rsp + 0x68], 5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
cmp dword [rsp + 0x60], 0
je 0x100003cb6
test eax, eax
jne 0x100003d5c
lea rcx, [rsp + 0x68]
call fcn.100003e50
test eax, eax
js 0x100003d5c
cmp dword [rsp + 0x68], 1
jne 0x100003d5c
and qword [rsp + 0x40], 0
and qword [rsp + 0x78], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, [0x100002110]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100003d5c
mov rcx, qword [rsp + 0x78]
lea r9d, [rax + 4]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], r9d
lea rdx, [0x100002220]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
test eax, eax
je 0x100003d63
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x58
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.100003a64
mov eax, 1
jmp 0x100003d5e

Function at 0x100003d7c
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 5
call fcn.100003e50
test eax, eax
js 0x100003e2e
cmp dword [rsp + 0x60], 1
jne 0x100003e2e
and qword [rsp + 0x40], 0
and qword [rsp + 0x70], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, [0x100002110]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100003e2e
mov rcx, qword [rsp + 0x70]
lea r9d, [rax + 4]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], r9d
lea rdx, [0x100002220]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 2
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
test eax, eax
je 0x100003e35
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x58
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.100003a64
mov eax, 1
jmp 0x100003e30
Function at 0x1000097fc
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
cmp dword [rcx + 0x79c], ebp
jne 0x100009988
mov dword [rcx + 0x79c], 1
mov ecx, dword [rcx + 0x798]
mov edi, ebp
mov esi, ebp
cmp ecx, ebp
je 0x1000098ae
sub ecx, 1
je 0x10000988c
sub ecx, 1
je 0x10000986a
cmp ecx, 1
jne 0x100009982
mov eax, dword [rbx + 0x6dc]
sub eax, dword [rbx + 0x6d4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x100003700]
jmp 0x100009886
mov eax, dword [rbx + 0x6dc]
sub eax, dword [rbx + 0x6d4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x1000036f8]
cvttsd2si edi, xmm0
jmp 0x1000098ce
mov eax, dword [rbx + 0x6e0]
sub eax, dword [rbx + 0x6d8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x100003700]
cvttsd2si esi, xmm0
jmp 0x1000098d2
mov eax, dword [rbx + 0x6e0]
sub eax, dword [rbx + 0x6d8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x1000036f8]
cvttsd2si esi, xmm0
cmp edi, ebp
jne 0x1000098da
cmp esi, ebp
je 0x100009982
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb ecx, ecx
neg ecx
inc ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp ax, bp
jge 0x100009945
mov rcx, qword [0x10001e120]
lea rax, [0x10001e120]
cmp rcx, rax
je 0x100009926
test byte [rcx + 0x1c], 0x10
je 0x100009926
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001fa0]
mov edx, 0x20
call fcn.100003954
mov r9d, 1
mov r8d, esi
mov edx, edi
mov rcx, rbx
mov dword [rbx + 0x7a0], 1
call fcn.100007c28
jmp 0x100009982
mov rcx, qword [0x10001e120]
lea rax, [0x10001e120]
cmp rcx, rax
je 0x100009973
test byte [rcx + 0x1c], 0x10
je 0x100009973
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001fa0]
mov edx, 0x21
call fcn.100003954
mov rcx, qword [rbx + 0x50]
mov edx, 0x89a
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rbx + 0x79c], ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x10000c9e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x10001e110]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [0x100002810]
mov rbx, rcx
lea rcx, [rsp + 0x50]
mov qword [rcx], rax
mov rax, qword [0x100002818]
lea rdx, [0x100001d60]
mov qword [rcx + 8], rax
mov eax, dword [0x100002820]
mov r9d, 3
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10000cadf
and dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, 0x10
xor edx, edx
mov dword [rsp + 0x44], 4
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x10000ca97
cmp dword [rsp + 0x40], eax
setne al
test eax, eax
jne 0x10000cad4
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbx + 0x1ac], 0x1388
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1000192d0
add rsp, 0x70
pop rbx
ret
Function at 0x100014438
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x60
mov rax, qword [rcx + 0x108]
mov rbx, rcx
cmp byte [rax + 0x10], 0
je 0x1000146a2
lea rax, [r11 + 0x18]
lea rdx, [0x100003150]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [r11 - 0x48], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000146a2
lea rdi, [0x10001e490]
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000144e5
mov r8d, dword [rsp + 0x78]
mov edx, dword [rdi + 8]
mov rcx, qword [rbx + 0x108]
mov r9b, 1
call fcn.1000148a8
mov r11d, eax
test eax, eax
jne 0x100014648
lea rax, [0x10001e4f0]
add rdi, 0x10
cmp rax, rdi
ja 0x10001448c
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x70]
lea rdx, [0x100003188]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x70], 0x30
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100014694
mov eax, dword [rsp + 0x34]
cmp eax, 1
je 0x100014550
cmp eax, 3
je 0x100014550
test eax, eax
je 0x100014550
cmp eax, 2
je 0x100014550
xor r8d, r8d
jmp 0x10001457e
lea rcx, [0x10001e480]
mov r9b, 1
mov edx, 7
mov r8d, dword [rcx + rax*4]
mov rcx, qword [rbx + 0x108]
call fcn.1000148a8
mov r11d, eax
test eax, eax
jne 0x100014648
lea r8d, [rax + 1]
mov rcx, qword [rbx + 0x108]
mov edx, 6
mov r9b, 1
call fcn.1000148a8
mov r11d, eax
test eax, eax
jne 0x100014648
mov r8d, dword [rsp + 0x50]
mov rcx, qword [rbx + 0x108]
lea edx, [rax + 8]
mov r9b, 1
call fcn.1000148a8
mov r11d, eax
test eax, eax
jne 0x100014648
mov r8d, dword [rsp + 0x54]
mov rcx, qword [rbx + 0x108]
lea edx, [rax + 9]
mov r9b, 1
call fcn.1000148a8
mov r11d, eax
test eax, eax
jne 0x100014648
mov r8d, dword [rsp + 0x58]
mov rcx, qword [rbx + 0x108]
lea edx, [rax + 0xa]
sub r8d, dword [rsp + 0x50]
mov r9b, 1
call fcn.1000148a8
mov r11d, eax
test eax, eax
jne 0x100014648
mov r8d, dword [rsp + 0x5c]
mov rcx, qword [rbx + 0x108]
lea edx, [rax + 0xb]
sub r8d, dword [rsp + 0x54]
mov r9b, 1
call fcn.1000148a8
mov r11d, eax
test eax, eax
jne 0x100014648
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x100014659
mov rcx, qword [rbx + 0x108]
mov r9b, 1
mov edx, 0xc
call fcn.1000148a8
mov r11d, eax
test eax, eax
je 0x100014663
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
jmp 0x1000146a4
mov r8d, dword [rsp + 0x48]
test r8d, r8d
jne 0x10001462d
mov r8d, dword [rsp + 0x44]
test r8d, r8d
je 0x10001468a
mov rcx, qword [rbx + 0x108]
mov r9b, 1
mov edx, 0xd
call fcn.1000148a8
mov r11d, eax
test eax, eax
je 0x100014694
jmp 0x100014648
mov r8d, dword [rsp + 0x4c]
test r8d, r8d
jne 0x10001466d
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x1000146b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r13
sub rsp, 0x50
and qword [rcx], 0
lea rdi, [rcx + 8]
mov rbx, rcx
and qword [rdi], 0
mov qword [rsp + 0x20], rcx
mov ebp, 1
mov r13, 0xffffffff80000001
lea rdx, [0x100001d60]
mov r9d, ebp
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 5
test eax, eax
setne al
mov byte [rbx + 0x10], al
call fcn.100003e50
test eax, eax
js 0x10001471f
cmp dword [rsp + 0x70], ebp
je 0x100014745
mov r9b, bpl
mov r8d, ebp
mov edx, 0x12
mov rcx, rbx
call fcn.1000148a8
mov r9b, bpl
mov r8d, ebp
mov edx, 0x11
mov rcx, rbx
call fcn.1000148a8
lea rax, [rsp + 0x80]
lea rdx, [0x100001d60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
and qword [rsp + 0x30], 0
xor r8d, r8d
mov rcx, r13
mov dword [rsp + 0x28], 3
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x100014788
and qword [rdi], 0
cmp qword [rbx], 0
jne 0x1000147da
lea rdx, [0x100001d60]
mov r9d, ebp
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000147b1
and qword [rbx], 0
cmp qword [rbx], 0
jne 0x1000147da
lea rdx, [0x100001d60]
mov r9d, ebp
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000147da
and qword [rbx], 0
lea rdi, [0x10001e16c]
mov rcx, qword [rbx]
test rcx, rcx
je 0x100014836
mov rdx, qword [rdi - 0xc]
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x78], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100014836
cmp dword [rdi - 4], 0
mov eax, dword [rsp + 0x70]
je 0x100014833
cmp eax, dword [rdi]
cmovl eax, dword [rdi]
cmp eax, dword [rdi + 4]
cmovg eax, dword [rdi + 4]
mov dword [rsp + 0x70], eax
mov dword [rdi + 0xc], eax
lea rax, [0x10001e48c]
add rdi, 0x20
cmp rdi, rax
jl 0x1000147e1
mov rax, rbx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r13
pop rdi
pop rbp
ret

Function at 0x100014908
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd rbx, edx
mov rdi, rcx
cmp ebx, 0x18
ja 0x100014983
cmp ebx, 0xf
jne 0x100014940
lea r8d, [rbx - 0xe]
cmp dword [0x10001e358], r8d
jne 0x100014940
mov edx, 0x1734
xor ecx, ecx
call sub.ntdll.dll_WinSqmIncrementDWORD
mov rcx, qword [rdi + 8]
lea rsi, [0x10001e160]
shl rbx, 5
mov eax, dword [rbx + rsi + 0x18]
mov rdx, qword [rbx + rsi]
mov r9d, 4
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100014988
and dword [rbx + rsi + 0x1c], eax
jmp 0x100014988
mov eax, 0x57
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x10001850c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, edx
mov rbx, rcx
mov rax, qword [0x10001e120]
lea rcx, [0x10001e120]
cmp rax, rcx
je 0x100018560
test byte [rax + 0x1c], 0x10
je 0x100018560
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x10001e120]
lea r8, [0x100001cf8]
sub eax, dword [rbx + 0x30]
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
mov r9d, edi
mov dword [rsp + 0x20], eax
call fcn.100010338
cmp dword [rbx + 0x1c], 2
jne 0x100018576
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0x30]
cmp eax, 0xc8
jbe 0x100018579
mov dword [rbx + 0x1c], edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1000192d0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10001e110]
jne 0x1000192eb
rol rcx, 0x10
test cx, 0xffff
jne 0x1000192e7
ret 0
ror rcx, 0x10
jmp 0x1000195ec
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10001e7f0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x10001e8e8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100019671
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10001e7f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x100019693
mov rax, qword [rsp + 0x88]
mov qword [0x10001e8e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10001e888], rax
mov rax, qword [0x10001e8e8]
mov qword [0x10001e760], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10001e870], rax
mov dword [0x10001e750], 0xc0000409
mov dword [0x10001e754], 1
mov rax, qword [0x10001e110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10001e118]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001b60]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x100019488
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1000194d5
cmp rcx, 0xffffffffffffffff
je 0x1000194d5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1000194cd
cmp dword [rcx + 0x3c], edx
jl 0x1000194cd
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1000194cd
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1000194d5
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140c3d160
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140c3d2e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c3d191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c3d177
add dl, dl
jne 0x140c3d19e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c3d1fe
xor eax, eax
add dl, dl
jne 0x140c3d1ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c3d2b5
add dl, dl
jne 0x140c3d1be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c3d1cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c3d1d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c3d1e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c3d1f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c3d186
mov eax, 1
add dl, dl
jne 0x140c3d20e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c3d21b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c3d203
sub eax, ebx
mov ebx, 1
jne 0x140c3d254
mov ecx, 1
add dl, dl
jne 0x140c3d236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c3d243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c3d22b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3d186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c3d270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c3d27d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c3d265
cmp eax, 0x7d00
jae 0x140c3d2a3
cmp eax, 0x500
jb 0x140c3d29e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3d186
cmp eax, 0x7f
ja 0x140c3d2a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3d186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c3d2da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c3d186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x140001394
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 0x18]
test rbx, rbx
je 0x1400013bc
mov ecx, dword [rbx]
lea rdx, [0x140003018]
mov qword [0x140003010], rcx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rbx + 4], eax
add rsp, 0x20
pop rbx
ret
Function at 0x10000129c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1000036f8]
lea rdx, [0x100003700]
call qword [sym.imp.API_MS_WIN_Service_Core_L1_1_0.dll_SetServiceStatus]
test eax, eax
jne 0x1000012e6
mov dword [0x100003704], 1
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp qword [0x1000036f8], 0
mov dword [0x10000370c], eax
je 0x1000012dd
call fcn.10000129c
xor ecx, ecx
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_ExitProcess]
inc dword [0x100003714]
add rsp, 0x28
ret

Function at 0x1000014b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100003740], rdi
je 0x1000014fe
cmp rax, rdi
jne 0x1000014f1
mov edi, 1
mov r12d, edi
jmp 0x100001503
mov ecx, 0x3e8
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x1000014d5
mov edi, 1
mov eax, dword [0x100003738]
cmp eax, edi
jne 0x100001519
mov ecx, 0x1f
call fcn.10011f000
jmp 0x100001576
mov eax, dword [0x100003738]
test eax, eax
jne 0x100001570
mov dword [0x100003738], edi
lea r13, [0x1000011a0]
lea rsi, [0x100001188]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100001562
test eax, eax
jne 0x100001562
mov rcx, qword [rsi]
test rcx, rcx
je 0x100001557
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x100001540
test eax, eax
je 0x100001576
mov eax, 0xff
jmp 0x100001648
mov dword [0x100003164], edi
mov eax, dword [0x100003738]
cmp eax, edi
jne 0x10000159d
lea rdx, [0x100001180]
lea rcx, [0x100001170]
call sub.msvcrt.dll__initterm
mov dword [0x100003738], 2
test r12d, r12d
jne 0x1000015ab
xor eax, eax
xchg qword [0x100003740], rax
cmp qword [0x100003748], 0
je 0x1000015d4
lea rcx, [0x100003748]
call fcn.10000189c
test eax, eax
je 0x1000015d4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100003748]
mov r8, qword [0x100003148]
mov rdx, qword [0x100003150]
mov ecx, dword [0x100003140]
call fcn.100001440
mov dword [0x100003160], eax
cmp dword [0x100003144], 0
jne 0x100001604
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100003164], 0
jne 0x100001619
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100003160]
jmp 0x100001648
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.1000019b0
add rsp, 0x28
jmp 0x1000014b0

Function at 0x100001908
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100001955
cmp rcx, 0xffffffffffffffff
je 0x100001955
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000194d
cmp dword [rcx + 0x3c], edx
jl 0x10000194d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000194d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100001955
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140028be0
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
mov r8, rcx
xor edi, edi
xor ecx, ecx
xor eax, eax
xchg rbx, r9
cpuid
xchg rbx, r9
test eax, eax
jle 0x140028d02
mov r10d, eax
xor ecx, ecx
mov eax, 1
xchg rbx, r9
cpuid
xchg rbx, r9
mov r9d, ecx
mov r11d, edx
mov esi, eax
cmp r10d, 7
jb 0x140028d38
mov eax, 7
xor ecx, ecx
xchg rbx, rdi
cpuid
xchg rbx, rdi
mov r10d, ecx
and edi, 0x20
shr r10b, 4
and r10b, 1
mov dword [r8], esi
mov eax, esi
and eax, 0xf
mov dword [r8 + 8], eax
shr esi, 0xc
and esi, 3
mov dword [r8 + 4], esi
mov eax, r11d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r11d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r11d, 0x1a
and r11b, 1
mov byte [r8 + 0xe], r11b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x1a], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x140028d40
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
test al, al
setne al
test edi, edi
setne cl
and cl, al
mov byte [r8 + 0x16], cl
mov byte [r8 + 0x18], r10b
xor ecx, ecx
mov eax, 0x80000000
xchg rbx, r9
cpuid
xchg rbx, r9
cmp eax, 0x80000006
jle 0x140028d44
mov eax, 0x80000007
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
shr edx, 8
and dl, 1
mov byte [r8 + 0x19], dl
test dl, dl
je 0x140028d4a
pop rdi
pop rsi
ret
xor r10d, r10d
jmp 0x140028c3c
xor eax, eax
jmp 0x140028cd1
mov dl, byte [r8 + 0x19]
jmp 0x140028d31
cmp byte [r8 + 0x1a], 0
je 0x140028d35
mov eax, 0x40000000
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
cmp r9d, 0x7263694d
jne 0x140028d35
cmp ecx, 0x666f736f
jne 0x140028d35
cmp edx, 0x76482074
jne 0x140028d35
mov byte [r8 + 0x19], 1
jmp 0x140028d35