joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004907
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.1400123e0
mov r15, qword [0x14002048c]
cmp r15, 1
jne 0x1400049d6
push qword [0x14002057c]
pop rcx
call fcn.14000d5b4
mov r15, rax
and r15, r15
jle 0x14000496c
mov rcx, qword [0x14002057c]
call fcn.14000d5bc
mov rcx, qword [0x14002057c]
call fcn.14000d5d0
or rax, rax
je 0x14000496c
mov rbp, qword [0x140020584]
push qword [rbp + 0x10]
pop rcx
call fcn.14000da6c
jmp 0x140004949
push qword [0x14002056c]
pop rcx
call fcn.14000d5b4
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x1400049d6
push 5
push 0
push 1
push qword [0x14002056c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009070
mov rcx, qword [0x14002056c]
call fcn.14000d5bc
mov rcx, qword [0x14002056c]
call fcn.14000d5d0
or rax, rax
je 0x1400049d6
mov rbp, qword [0x140020574]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x1400049b3
mov rax, 1
jmp 0x1400049e2
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006a58
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movabs dword [0xa3ff07aba3ff07ab], eax
stosd dword [rdi], eax
invalid
movabs dword [0xa3ff07aba3ff07ab], eax
stosd dword [rdi], eax
invalid
movabs dword [0xa3ff07aba3ff07ab], eax
stosd dword [rdi], eax
invalid
invalid
movabs dword [0xa3ff07aba3ff07ab], eax
stosd dword [rdi], eax
invalid
movabs dword [0xa3ff07aba3ff07ab], eax
stosd dword [rdi], eax
invalid
movabs dword [0xa3ff07aba3ff07ab], eax
stosd dword [rdi], eax
invalid
invalid
xor edi, edi
pop rbx
invalid
Function at 0x1400d99c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400d99e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400d99e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1405f9058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1405f91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405f9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f906f
add dl, dl
jne 0x1405f9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f90f6
xor eax, eax
add dl, dl
jne 0x1405f90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f91ad
add dl, dl
jne 0x1405f90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405f90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405f907e
mov eax, 1
add dl, dl
jne 0x1405f9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f90fb
sub eax, ebx
mov ebx, 1
jne 0x1405f914c
mov ecx, 1
add dl, dl
jne 0x1405f912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405f913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405f9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405f9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f915d
cmp eax, 0x7d00
jae 0x1405f919b
cmp eax, 0x500
jb 0x1405f9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f907e
cmp eax, 0x7f
ja 0x1405f919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405f91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405f907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400010f0
Capabilities:
Query or enumerate registry value

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x40
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], r8
mov r12, r8
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x38], 0x1fe
xor r8d, r8d
mov qword [rsp + 0x28], rax
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov r13d, eax
test eax, eax
jne 0x14000112f
cmp dword [rsp + 0x3c], 1
je 0x140001140
mov eax, r13d
add rsp, 0x40
pop rbx
pop r12
pop r13
ret
cmp word [r12], 0
je 0x1400011a8
mov rdx, r12
nop dword [rax + rax]
add rdx, 2
cmp word [rdx], 0
jne 0x140001150
sub rdx, r12
sar rdx, 1
movsxd rdx, edx
lea rax, [rdx + rdx + 2]
xor ecx, ecx
mov rbx, qword [sym.imp.ucrtbase.dll_wcschr]
mov word [r12 + rax], cx
jmp 0x140001189
xor edx, edx
lea r12, [rax + 2]
mov word [rax], dx
mov edx, 0x2c
mov rcx, r12
call rbx
test rax, rax
jne 0x140001180
mov eax, r13d
add rsp, 0x40
pop rbx
pop r12
pop r13
ret
mov eax, 2
jmp 0x140001168
Function at 0x140001cd0
Capabilities:
Check if process is running under wine

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x230
lea rdx, str.SoftwareWineWineBrowser
mov r12, rcx
lea r8, [rsp + 0x28]
mov rcx, 0xffffffff80000001
call qword [sym.imp.advapi32.dll_RegOpenKeyW]
lea r13, [rsp + 0x30]
test eax, eax
je 0x140001db0
mov eax, dword [0x1400054e0]
movdqa xmm0, xmmword [str._usr_bin_open]
movdqa xmm1, xmmword [0x140005470]
movdqa xmm2, xmmword [0x140005480]
mov dword [rsp + 0xb0], eax
movzx eax, word [0x1400054e4]
movdqa xmm3, xmmword [str.mozilla_thunderbird]
movdqa xmm4, xmmword [0x1400054a0]
movaps xmmword [rsp + 0x30], xmm0
movdqa xmm5, xmmword [0x1400054b0]
movdqa xmm0, xmmword [0x1400054c0]
movaps xmmword [rsp + 0x40], xmm1
mov word [rsp + 0xb4], ax
movdqa xmm1, xmmword [str.evolution]
movaps xmmword [rsp + 0x50], xmm2
movaps xmmword [rsp + 0x60], xmm3
movaps xmmword [rsp + 0x70], xmm4
movaps xmmword [rsp + 0x80], xmm5
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm1
mov rdx, r12
mov rcx, r13
call fcn.1400019b0
add rsp, 0x230
pop rbx
pop r12
pop r13
ret
mov rcx, qword [rsp + 0x28]
mov r8, r13
lea rdx, str.Mailers
call fcn.1400010f0
mov rcx, qword [rsp + 0x28]
mov ebx, eax
call qword [sym.imp.advapi32.dll_RegCloseKey]
test ebx, ebx
je 0x140001d92
jmp 0x140001d05

Function at 0x140001de0
Capabilities:
Check if process is running under wine

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x230
lea rdx, str.SoftwareWineWineBrowser
mov r12, rcx
lea r8, [rsp + 0x28]
mov rcx, 0xffffffff80000001
call qword [sym.imp.advapi32.dll_RegOpenKeyW]
lea r13, [rsp + 0x30]
test eax, eax
je 0x140001eb0
mov rax, qword [0x140005430]
movdqa xmm0, xmmword [str.xdg_open]
movdqa xmm1, xmmword [0x1400053d0]
movdqa xmm2, xmmword [0x1400053e0]
mov qword [rsp + 0xa0], rax
mov eax, dword [0x140005438]
movdqa xmm3, xmmword [0x1400053f0]
movdqa xmm4, xmmword [0x140005400]
movaps xmmword [rsp + 0x30], xmm0
movdqa xmm5, xmmword [0x140005410]
movdqa xmm0, xmmword [0x140005420]
movaps xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0xa8], eax
movaps xmmword [rsp + 0x50], xmm2
movaps xmmword [rsp + 0x60], xmm3
movaps xmmword [rsp + 0x70], xmm4
movaps xmmword [rsp + 0x80], xmm5
movaps xmmword [rsp + 0x90], xmm0
mov rdx, r12
mov rcx, r13
call fcn.1400019b0
add rsp, 0x230
pop rbx
pop r12
pop r13
ret
mov rcx, qword [rsp + 0x28]
mov r8, r13
lea rdx, str.Browsers
call fcn.1400010f0
mov rcx, qword [rsp + 0x28]
mov ebx, eax
call qword [sym.imp.advapi32.dll_RegCloseKey]
test ebx, ebx
je 0x140001e92
jmp 0x140001e15
Function at 0x140003a30
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov ecx, 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x140003aa0
mov r12d, dword [rax]
call sub.ucrtbase.dll___p___wargv
mov r13, qword [rax]
call sub.ucrtbase.dll__get_initial_wide_environment
xor ecx, ecx
mov rbx, rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x10]
mov edx, dword [rax + 0x3c]
cmp word [rax + rdx + 0x5c], 2
sete cl
add ecx, 1
call sub.ucrtbase.dll__set_app_type
mov ecx, r12d
mov r8, rbx
mov rdx, r13
call fcn.1400025e0
mov ecx, eax
call sub.ucrtbase.dll_exit
nop
nop
nop
nop
jmp qword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x14000219c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400021e6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400021e6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400021e6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400021e6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400021e6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400021e8
xor al, al
add rsp, 0x28
ret

Function at 0x140009220
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000901c
Function at 0x14000d7dc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000d80c
xor eax, eax
jmp 0x14000d8cf
mov rbp, rbx
cmp word [rax], si
je 0x14000d831
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000d818
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000d814
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000d6fc
movsxd r14, eax
test eax, eax
jne 0x14000d86f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000d805
mov rcx, r14
call fcn.14000c044
mov rdi, rax
test rax, rax
jne 0x14000d888
xor ecx, ecx
call fcn.14000b720
jmp 0x14000d864
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000d6fc
test eax, eax
jne 0x14000d8b9
mov rcx, rdi
call fcn.14000b720
jmp 0x14000d8c3
xor ecx, ecx
call fcn.14000b720
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400110c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400110e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400110e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x100002454
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100004758], rdi
je 0x1000024a2
cmp rax, rdi
jne 0x100002495
mov edi, 1
mov r12d, edi
jmp 0x1000024a7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100002479
mov edi, 1
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x1000024bd
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x10000251a
mov eax, dword [0x100004750]
test eax, eax
jne 0x100002514
mov dword [0x100004750], edi
lea r13, [0x100001290]
lea rsi, [0x100001278]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100002506
test eax, eax
jne 0x100002506
mov rcx, qword [rsi]
test rcx, rcx
je 0x1000024fb
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x1000024e4
test eax, eax
je 0x10000251a
mov eax, 0xff
jmp 0x1000025ec
mov dword [0x100004184], edi
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x100002541
lea rdx, [0x100001270]
lea rcx, [0x100001260]
call sub.msvcrt.dll__initterm
mov dword [0x100004750], 2
test r12d, r12d
jne 0x10000254f
xor eax, eax
xchg qword [0x100004758], rax
cmp qword [0x100004760], 0
je 0x100002578
lea rcx, [0x100004760]
call fcn.10000284c
test eax, eax
je 0x100002578
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100004760]
mov r8, qword [0x100004168]
mov rdx, qword [0x100004170]
mov ecx, dword [0x100004160]
call fcn.100001b54
mov dword [0x100004180], eax
cmp dword [0x100004164], 0
jne 0x1000025a8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100004184], 0
jne 0x1000025bd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100004180]
jmp 0x1000025ec
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.100180000
add rsp, 0x28
jmp 0x100002454
Function at 0x140097820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x840
mov rax, qword [0x140127628]
xor rax, rsp
mov qword [rsp + 0x830], rax
cmp dword [0x140d1f0ac], 0
mov rdi, rdx
mov rbx, rcx
je 0x14009792e
cmp dword [0x140d1f090], 0
je 0x14009792a
cmp qword [0x140d1f098], 0
je 0x140097873
call fcn.140097820
jmp 0x140097933
cmp qword [0x140d1f0a0], 0
je 0x14009792e
call fcn.1400031f0
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x800
mov rcx, qword [rax]
or rcx, 2
call fcn.1400cffe4
mov ebx, eax
mov eax, 0xffffffff
test ebx, ebx
cmovs ebx, eax
cmp ebx, 0x800
jb 0x1400978d0
mov ebx, 0x800
mov byte [rsp + 0x82f], 0xa
nop
xor r8d, r8d
lea rcx, [0x140d1f0b4]
lea edx, [r8 + 1]
call fcn.1400c9f70
test eax, eax
jne 0x1400978d0
movsxd rbx, ebx
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.140097960
mov r9, qword [0x140d1f0a0]
lea rcx, [rsp + 0x30]
mov r8, rbx
mov edx, 1
call fcn.1400d7b24
xor edx, edx
lea rcx, [0x140d1f0b4]
call fcn.1400c9f80
mov rcx, qword [0x140d1f0a0]
call fcn.1400d77a4
xor eax, eax
jmp 0x140097933
mov eax, 1
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1400cb770
mov rbx, qword [rsp + 0x860]
add rsp, 0x840
pop rdi
ret

Function at 0x140097960
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
mov r8, rcx
test rdx, rdx
je 0x140097a1e
mov r11d, dword [0x140d1f0b8]
mov eax, dword [0x140d1f0c8]
mov r9d, dword [0x140d1f0cc]
mov qword [rsp + 0x10], rbx
mov ebx, dword [0x140d1f0bc]
mov qword [rsp + 0x18], rsi
mov esi, dword [0x140d1f0c4]
mov qword [rsp], rdi
mov edi, dword [0x140d1f0c0]
nop word [rax + rax]
lea ecx, [rax*8]
mov edx, r11d
shr edx, 2
lea r8, [r8 + 1]
xor edx, r11d
add r9d, 0x587c5
xor ecx, edx
mov r11d, ebx
add ecx, ecx
mov ebx, edi
mov edi, esi
mov esi, eax
xor eax, ecx
xor eax, edx
lea ecx, [r9 + rax]
add byte [r8 - 1], cl
sub r10, 1
jne 0x1400979b0
mov dword [0x140d1f0bc], ebx
mov rbx, qword [rsp + 0x10]
mov dword [0x140d1f0c0], edi
mov rdi, qword [rsp]
mov dword [0x140d1f0c4], esi
mov rsi, qword [rsp + 0x18]
mov dword [0x140d1f0c8], eax
mov dword [0x140d1f0cc], r9d
mov dword [0x140d1f0b8], r11d
add rsp, 8
ret
Function at 0x1400e91e0
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1098
call fcn.140112170
sub rsp, rax
mov rax, qword [0x140338648]
xor rax, rsp
mov qword [rsp + 0x1090], rax
lea r14, [rsp + 0x30]
mov qword [rsp + 0x20], r14
lea rcx, [0x14033bdec]
lea rdx, [0x14034c4f8]
lea r8, [0x14034c509]
lea r9, [rsp + 0x38]
call fcn.1400e9aa0
test eax, eax
je 0x1400e9238
xor esi, esi
jmp 0x1400e926d
mov rdi, qword [rsp + 0x30]
lea rcx, [rdi + 1]
call fcn.140267418
mov rsi, rax
mov rbx, qword [rsp + 0x38]
test rax, rax
je 0x1400e9265
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.140253b20
mov byte [rsi + rdi], 0
mov rcx, rbx
call fcn.140266344
mov rcx, rsi
call fcn.140266344
mov qword [rsp + 0x20], r14
lea rcx, [0x14033c0f8]
lea rdx, [0x14034c4f8]
lea r8, [0x14034c509]
lea r9, [rsp + 0x38]
call fcn.1400e9aa0
test eax, eax
je 0x1400e92a1
xor esi, esi
jmp 0x1400e92d6
mov rdi, qword [rsp + 0x30]
lea rcx, [rdi + 1]
call fcn.140267418
mov rsi, rax
mov rbx, qword [rsp + 0x38]
test rax, rax
je 0x1400e92ce
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.140253b20
mov byte [rsi + rdi], 0
mov rcx, rbx
call fcn.140266344
call fcn.1400ea530
call fcn.1400ea670
call fcn.1400ea530
mov rcx, rsi
call fcn.1400eb390
test eax, eax
je 0x1400e92fd
call fcn.1400ea670
call fcn.1400ea530
jmp 0x1400e9317
lea rcx, str.C:Windowscomsetup.log
call fcn.1400eb390
call fcn.1400ea670
call fcn.1400eb0f0
test eax, eax
jne 0x1400e9339
mov rcx, qword [rsp + 0x1090]
xor rcx, rsp
call fcn.1401121d0
xor eax, eax
add rsp, 0x1098
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400ea530
lea rcx, [0x14033bef0]
call fcn.1400e9000
mov rdi, rax
lea rcx, [0x14033bff4]
call fcn.1400e9000
mov rbx, rax
mov rcx, rdi
mov rdx, rax
call fcn.1400eae60
test eax, eax
je 0x1400e9479
call fcn.1400ea530
call fcn.1400eb340
test eax, eax
jne 0x1400e9479
call fcn.1400ea670
call fcn.1400eb230
mov ebp, eax
call fcn.1400ea530
test ebp, ebp
je 0x1400e93b7
call fcn.1400eb340
call fcn.1400ea670
call fcn.1400eb230
call fcn.1400ea530
call fcn.1400ea670
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [0x14033bce8]
call fcn.1400e9000
mov r14, rax
lea rcx, [rsp + 0x38]
mov rdx, rax
call fcn.1400ea720
mov rcx, r14
call fcn.140266344
call fcn.1400ea670
call fcn.1400ea530
lea r14, [rsp + 0x14e]
lea r15, [0x1402f8f74]
mov edx, 0x65
mov rcx, r14
mov r8, r15
call fcn.1400eb170
call fcn.1400ea670
lea rcx, [rsp + 0x252]
mov edx, 0x66
mov r8, r15
call fcn.1400eb170
call fcn.1400ea530
lea rcx, [rsp + 0x45a]
mov edx, 0x68
mov r8, r15
call fcn.1400eb170
call fcn.1400ea670
lea rcx, [rsp + 0x356]
mov edx, 0x69
mov r8, r15
call fcn.1400eb170
call fcn.1400ea530
mov rcx, r14
call fcn.1400ead50
call fcn.1400ea530
call fcn.1400ea670
mov rcx, rsi
call fcn.1400eb3f0
mov rcx, rsi
call fcn.140266344
mov rcx, rdi
call fcn.140266344
mov rcx, rbx
call fcn.140266344
call fcn.1400ea530
int3
Function at 0x1400e96e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov rsi, r8
mov r8, rcx
mov r9d, dword [rdx]
mov eax, dword [rdx + 4]
bswap r9d
bswap eax
mov r11d, dword [rdx + 8]
bswap r11d
mov edx, dword [rdx + 0xc]
bswap edx
xor r10d, r10d
nop word cs:[rax + rax]
mov ebx, eax
xor r9d, eax
mov ecx, ebx
rol r9d, cl
mov eax, r11d
mov ecx, edx
xor eax, edx
mov r11d, edx
rol eax, cl
mov edx, r9d
add edx, dword [r8 + r10*8]
add eax, dword [r8 + r10*8 + 4]
inc r10
mov r9d, ebx
cmp r10, 0x14
jne 0x1400e9710
add ebx, dword [r8 + 0xa0]
add r11d, dword [r8 + 0xa4]
mov ecx, ebx
shr ecx, 0x18
mov byte [rsi], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [rsi + 1], cl
mov byte [rsi + 2], bh
mov byte [rsi + 3], bl
mov ecx, eax
shr ecx, 0x18
mov byte [rsi + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rsi + 5], cl
mov byte [rsi + 6], ah
mov byte [rsi + 7], al
mov ecx, r11d
mov eax, r11d
shr eax, 0x18
mov byte [rsi + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [rsi + 9], al
mov byte [rsi + 0xa], ch
mov byte [rsi + 0xb], cl
mov eax, edx
shr eax, 0x18
mov byte [rsi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [rsi + 0xd], al
mov byte [rsi + 0xe], dh
mov byte [rsi + 0xf], dl
pop rbx
pop rsi
ret
Function at 0x1400eac70
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x160
mov rdi, rcx
mov rax, qword [0x140338648]
xor rax, rsp
mov qword [rsp + 0x158], rax
call fcn.1400ea670
call fcn.1400ea530
xor ebx, ebx
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x1400ead2b
mov rsi, rax
mov dword [rsp + 0x28], 0x130
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1400ead10
call fcn.1400ea670
call fcn.1400ea530
lea rbx, [rsp + 0x54]
mov r15, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea r14, [rsp + 0x28]
nop dword [rax + rax]
mov rcx, rdi
mov rdx, rbx
call r15
test eax, eax
je 0x1400ead14
mov rcx, rsi
mov rdx, r14
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400eacf0
xor ebx, ebx
jmp 0x1400ead18
xor ebx, ebx
jmp 0x1400ead22
mov ebx, dword [rsp + 0x30]
call fcn.1400ea670
call fcn.1400ea530
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1401121d0
mov eax, ebx
add rsp, 0x160
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400ead50
Capabilities:
Create process on windows

Disassembly:
push rsi
sub rsp, 0xf0
movaps xmmword [rsp + 0xe0], xmm6
mov rsi, rcx
mov rax, qword [0x140338648]
xor rax, rsp
mov qword [rsp + 0xd8], rax
call fcn.1400ea530
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
mov qword [rsp + 0xd0], 0
movaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x60], 0
mov word [rsp + 0xb0], 0
call fcn.1400ea670
call fcn.1400ea530
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400eae30
call fcn.1400ea670
mov rcx, qword [rsp + 0x50]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x58]
call rsi
call fcn.1400ea530
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1401121d0
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop rsi
ret