joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6562f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x656556
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
test rdx, rdx
jle 0x656539
mov qword [rsp + 0x58], rdx
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
xor r8d, r8d
jmp 0x6563bd
mov dword [rsp + 0x3c], r11d
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r11d
mov dword [rsp + 0x1c], r11d
call fcn.00655bb0
mov eax, dword [rsp + 0x3c]
mov r10d, dword [rsp + 0x48]
lea r11d, [r10 + rax]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
mov r9d, dword [rsp + 0x4c]
cmp r11d, r9d
jle 0x656352
inc r8
cmp r8, rdx
jge 0x6563eb
add rcx, 6
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x50], r8
movzx r9d, word [rcx + 2]
movzx r10d, word [rcx + 4]
movzx r11d, word [rcx]
cmp r10d, 1
je 0x6564f1
mov dword [rsp + 0x4c], r9d
mov dword [rsp + 0x48], r10d
jmp 0x6563ac
mov rcx, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
test rax, rax
jle 0x65648f
mov qword [rsp + 0x58], rax
xor edx, edx
jmp 0x656468
mov dword [rsp + 0x38], r10d
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r10d
mov dword [rsp + 0x1c], r10d
call fcn.00655bb0
mov eax, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x44]
lea r10d, [r8 + rax]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov r9d, dword [rsp + 0x40]
cmp r10d, r9d
jle 0x656405
inc rdx
cmp rdx, rax
jge 0x65648f
add rcx, 0xc
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rdx
mov r8d, dword [rcx + 8]
mov r9d, dword [rcx + 4]
mov r10d, dword [rcx]
cmp r8d, 1
je 0x6564b1
mov dword [rsp + 0x44], r8d
mov dword [rsp + 0x40], r9d
jmp 0x656457
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r10d
mov dword [rsp + 0x1c], r9d
call fcn.00655bb0
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
jmp 0x65645c
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r11d
mov dword [rsp + 0x1c], r9d
call fcn.00655bb0
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
jmp 0x6563b1
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
jmp 0x6563eb
call fcn.00458a70
jmp fcn.006562f0
Function at 0x7ff7b509dbc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x7ff7b50d0588]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x7ff7b509dc93
cmp byte [rcx + 0x71], 0
je 0x7ff7b509dc93
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x7ff7b509dc8f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.msvcp140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x7ff7b509dc54
sub eax, 1
je 0x7ff7b509dc58
cmp eax, 2
jne 0x7ff7b509dc8f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff7b50c16f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x7ff7b509dc86
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.ucrtbase.dll_fwrite]
cmp rdi, rax
jne 0x7ff7b509dc8f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x7ff7b509dc3c
xor al, al
jmp 0x7ff7b509dc3c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff7b50c16f0
add rsp, 0x60
pop rbx
ret
Function at 0x7ff7b50b09c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x7ff7b50d0588]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x12c
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rsp + 0x20], 0x130
lea ecx, [rdx + 2]
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x7ff7b50b0a17
call qword [sym.imp.kernel32.dll_GetLastError]
jmp 0x7ff7b50b0a71
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.kernel32.dll_Process32First
test eax, eax
je 0x7ff7b50b0a68
nop dword [rax + rax]
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x7ff7b50b0a53
inc rax
test ecx, ecx
jne 0x7ff7b50b0a40
test edx, edx
je 0x7ff7b50b0a94
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.kernel32.dll_Process32Next
test eax, eax
jne 0x7ff7b50b0a30
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.7ff7b50c16f0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
mov eax, dword [rsp + 0x28]
jmp 0x7ff7b50b0a73
Function at 0x7ff7b50b0aa0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x7ff7b50d0588]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov esi, edx
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], r14b
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp - 0x7c]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x80], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x7ff7b50b0c5b
call qword [sym.imp.kernel32.dll_GetLastError]
movabs rcx, 0x90f747038d31e511
mov qword [rbp + 0xb0], rcx
movabs rcx, 0xf632543e64af3d06
mov qword [rbp + 0xb8], rcx
movabs rcx, 0x5720947deb937b4b
mov qword [rbp + 0xc0], rcx
movabs rcx, 0x57ba92e040cd6ec8
mov qword [rbp + 0xc8], rcx
movabs rcx, 0xc4cf699f788c1c05
mov qword [rbp + 0xd0], rcx
movabs rcx, 0x6bb44ecaa67151ca
mov qword [rbp + 0xd8], rcx
movabs rcx, 0xf1923540ad6cc84a
mov qword [rsp + 0x20], rcx
movabs rcx, 0x935a38510bfb5872
mov qword [rsp + 0x28], rcx
movabs rcx, 0x2741fa2ed9a00b27
mov qword [rsp + 0x30], rcx
movabs rcx, 0x3edbf4c034a206bb
mov qword [rsp + 0x38], rcx
movabs rcx, 0xe1b759bf42e87969
mov qword [rsp + 0x40], rcx
movabs rcx, 0x6bb44ecaa6715b92
mov qword [rsp + 0x48], rcx
movdqa xmm0, xmmword [rsp + 0x20]
pxor xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [rsp + 0x30]
pxor xmm1, xmmword [rbp + 0xc0]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [rsp + 0x40]
pxor xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rsp + 0x40], xmm0
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.7ff7b50c05b0
mov qword [rbx], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r14b
mov r8, rdi
inc r8
cmp byte [r14 + r8], 0
jne 0x7ff7b50b0c45
xor edx, edx
mov rcx, rbx
call fcn.7ff7b509fc20
jmp 0x7ff7b50b0cc4
lea rdx, [rbp - 0x80]
mov rcx, rdi
call sub.kernel32.dll_Process32First
test eax, eax
je 0x7ff7b50b0caa
nop dword [rax + rax]
cmp dword [rbp - 0x78], esi
je 0x7ff7b50b0c87
lea rdx, [rbp - 0x80]
mov rcx, rdi
call sub.kernel32.dll_Process32Next
test eax, eax
jne 0x7ff7b50b0c70
jmp 0x7ff7b50b0caa
lea rax, [rbp - 0x54]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x7ff7b50b0c92
lea rdx, [rbp - 0x54]
lea rcx, [rsp + 0x58]
call fcn.7ff7b509fc20
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.7ff7b50c16f0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x7ff7b50bf170
Capabilities:
Create process on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x7ff7b50d0588]
xor rax, rsp
mov qword [rbp + 0x40], rax
xorps xmm0, xmm0
mov dword [rbp - 0x60], 0x68
xor eax, eax
mov rdx, rcx
mov dword [rbp + 4], eax
xor r9d, r9d
mov qword [rbp - 0x70], rax
xor r8d, r8d
lea rax, [rbp - 0x80]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp - 0x80], xmm0
call qword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
jne 0x7ff7b50bf2dd
call qword [sym.imp.kernel32.dll_GetLastError]
movabs rdx, 0x6bb44ecaa67151ca
movabs r8, 0xc4cf699f788c1c05
mov qword [rsp + 0x78], rdx
movabs rcx, 0x90f747038d31e511
mov qword [rbp + 0x10], rcx
movabs rcx, 0xf632543e64af3d06
mov qword [rbp + 0x18], rcx
movabs rcx, 0x5720947deb937b4b
mov qword [rbp + 0x20], rcx
movabs rcx, 0x57ba92e040cd6ec8
mov qword [rbp + 0x28], rcx
movabs rcx, 0xf1923540ad6cc84a
mov qword [rsp + 0x50], rcx
movabs rcx, 0x8557375116ff5872
mov qword [rsp + 0x58], rcx
movabs rcx, 0x324cfd1c8db33a38
movdqa xmm0, xmmword [rsp + 0x50]
pxor xmm0, xmmword [rbp + 0x10]
mov qword [rsp + 0x60], rcx
movabs rcx, 0x5d94bb8465e54eac
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
pxor xmm1, xmmword [rbp + 0x20]
mov qword [rsp + 0x70], r8
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp + 0x38], rdx
mov edx, eax
mov qword [rbp + 0x30], r8
pxor xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmmword [rsp + 0x70], xmm0
call fcn.7ff7b50c05b0
xor al, al
jmp 0x7ff7b50bf2df
mov al, 1
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.7ff7b50c16f0
add rsp, 0x150
pop rbp
ret
Function at 0x7ff7b50bf3e0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0xa0
xor edx, edx
mov r8d, ecx
lea ecx, [rdx + 1]
call qword [sym.imp.kernel32.dll_OpenProcess]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x7ff7b50bf559
movabs rax, 0x90f747038d31e511
movabs rcx, 0xd4bd5dece093b74c
mov qword [rsp + 0x60], rax
movabs rax, 0xf632543e64af3d06
mov qword [rsp + 0x68], rax
movabs rax, 0x5720947deb937b4b
mov qword [rsp + 0x70], rax
movabs rax, 0x57ba92e040cd6ec8
mov qword [rsp + 0x78], rax
movabs rax, 0xc4cf699f788c1c05
mov qword [rsp + 0x80], rax
movabs rax, 0x6bb44ecaa67151ca
mov qword [rsp + 0x88], rax
movabs rax, 0x58be1ca939a135bf
mov qword [rsp + 0x90], rax
movabs rax, 0xfc9e2665ad6cc84a
mov qword [rsp + 0x20], rax
movabs rax, 0x84517451108f5963
mov qword [rsp + 0x28], rax
movabs rax, 0x3941fc5d8ee71a2e
movdqa xmm0, xmmword [rsp + 0x20]
pxor xmm0, xmmword [rsp + 0x60]
mov qword [rsp + 0x30], rax
movabs rax, 0x239afd9460a802ac
mov qword [rsp + 0x38], rax
movabs rax, 0xa1bb08f111e16e60
movdqa xmm1, xmmword [rsp + 0x30]
pxor xmm1, xmmword [rsp + 0x70]
mov qword [rsp + 0x40], rax
movabs rax, 0x18c72ba9c90321ea
mov qword [rsp + 0x48], rax
movabs rax, 0x58be1ca9338f1b91
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rax
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x40]
pxor xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm1, xmmword [rsp + 0x50]
mov qword [rsp + 0x98], rcx
lea rcx, [rsp + 0x20]
pxor xmm1, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmmword [rsp + 0x40], xmm0
call fcn.7ff7b50c05b0
xor al, al
add rsp, 0xa0
pop rbx
ret
xor edx, edx
mov rcx, rbx
call qword [sym.imp.kernel32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
add rsp, 0xa0
pop rbx
ret

Function at 0x7ff7b50c0a70
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
movabs rax, 0x90f747038d31e511
mov ebx, ecx
mov qword [rsp + 0x30], rax
lea rcx, section._________1
movabs rax, 0xf632543e64af3d06
mov rdi, rdx
mov qword [rsp + 0x38], rax
movabs rax, 0xe4d92277ec559544
mov qword [rsp + 0x20], rax
movabs rax, 0xf632543e64af497e
mov qword [rsp + 0x28], rax
xor eax, eax
movdqa xmm0, xmmword [rsp + 0x20]
pxor xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x20], xmm0
nop word [rax + rax]
movzx r8d, byte [rsp + rax + 0x20]
mov byte [rax + rcx], r8b
lea rax, [rax + 1]
test r8b, r8b
jne 0x7ff7b50c0ae0
call qword [sym.imp.kernel32.dll_DeleteFileA]
mov rdx, rdi
mov ecx, ebx
call fcn.7ff7b50b38f0
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x142ee0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.142ee01df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x142ee0089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x142ee006f
add dl, dl
jne 0x142ee0096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x142ee00f6
xor eax, eax
add dl, dl
jne 0x142ee00a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x142ee01ad
add dl, dl
jne 0x142ee00b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142ee00c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142ee00d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142ee00dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x142ee00ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x142ee007e
mov eax, 1
add dl, dl
jne 0x142ee0106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142ee0113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x142ee00fb
sub eax, ebx
mov ebx, 1
jne 0x142ee014c
mov ecx, 1
add dl, dl
jne 0x142ee012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x142ee013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x142ee0123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x142ee007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x142ee0168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x142ee0175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x142ee015d
cmp eax, 0x7d00
jae 0x142ee019b
cmp eax, 0x500
jb 0x142ee0196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x142ee007e
cmp eax, 0x7f
ja 0x142ee019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x142ee007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x142ee01d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x142ee007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400298c0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400298cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400298dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400298c5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x1400298f5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400298e2
sub eax, 3
jb 0x14002990f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140029946
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140029936
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140029934
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140029923
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140029882
jmp 0x1400298cd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x3400
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140029992
cmp rsi, rcx
jae 0x14002999a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140029979
cmp al, 0x8f
ja 0x140029979
cmp byte [rsi - 2], 0xf
je 0x14002997f
sub al, 0xe8
cmp al, 1
ja 0x140029963
cmp rsi, rcx
jae 0x14002999a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140029969
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002999a
lodsb al, byte [rsi]
jmp 0x140029979
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x27000]
mov eax, dword [rdi]
or eax, eax
je 0x1400299f7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x35db4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400299a7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400299f1
mov qword [rbx], rax
add rbx, 8
jmp 0x1400299c7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140029a31
cmp al, 0xef
ja 0x140029a23
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140029a03
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140029a12
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140029a85
sub rsp, 0xffffffffffffff80
jmp 0x140003660
Function at 0x140005e37
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
xor r9d, r9d
mov r8d, 0x10000
mov dword [rcx + 0x30], eax
lea rax, [rcx + 0x10]
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, eax
mov eax, 1
test edx, edx
jne 0x140005e7d
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
sete al
movzx eax, al
neg eax
mov dword [rbx + 8], eax
add rsp, 0x30
pop rbx
ret

Function at 0x140006347
Capabilities:
Read file on windows

Disassembly:
push r15
mov eax, 0x1188
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1400747a0
sub rsp, rax
xor eax, eax
lea rsi, [rsp + 0x108f]
mov r12d, ecx
mov ecx, 0x40
mov rbp, r8
and rsi, 0xffffffffffffffc0
mov rdi, rsi
rep stosd dword [rdi], eax
xor ecx, ecx
test rdx, rdx
sete al
test r8, r8
mov dword [rsp + 0x4c], ecx
sete cl
or al, cl
jne 0x1400064d5
cmp r12d, 3
ja 0x1400064d5
mov rcx, rdx
call fcn.140005d30
xor edx, edx
xor r9d, r9d
mov r8d, 1
mov qword [rsp + 0x30], rdx
mov rcx, rax
mov rdi, rax
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r13d, eax
test rdi, rdi
je 0x1400063f4
mov rcx, rdi
call sub.msvcrt.dll_free
mov ecx, r13d
call qword [sym.imp.KERNEL32.DLL_SetLastError]
cmp rbx, 0xffffffffffffffff
mov r13, qword [0x1400b1100]
jne 0x14000642b
call fcn.140036bd7
lea rcx, str.Could_not_open_file:__s
mov rdx, rax
call fcn.140036717
mov dword [r13], 0xc003006e
jmp 0x1400064d9
mov edi, r12d
lea rax, [0x1400790a0]
mov rcx, rsi
call qword [rax + rdi*8]
lea r14, [rsp + 0x4c]
lea r12, [0x140079080]
mov eax, dword [r13]
test eax, eax
jns 0x140006459
cmp ax, 0x4c7
je 0x1400064d9
xor eax, eax
lea r15, [rsp + 0x50]
mov r9, r14
mov r8d, 0x1000
mov qword [rsp + 0x20], rax
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x14000649c
mov dword [r13], 0xc003001e
call fcn.140036bd7
lea rcx, str.__Read_error:__s
mov rdx, rax
call fcn.140036717
jmp 0x1400064d9
mov r8d, dword [rsp + 0x4c]
test r8d, r8d
je 0x1400064b2
mov rdx, r15
mov rcx, rsi
call qword [r12 + rdi*8]
jmp 0x140006447
lea rax, [0x140079060]
mov rcx, rsi
call qword [rax + rdi*8]
lea rax, [0x1400790c0]
mov ecx, dword [rax + rdi*4]
mov rdi, rbp
rep movsb byte [rdi], byte [rsi]
mov esi, 1
jmp 0x1400064db
or rbx, 0xffffffffffffffff
xor esi, esi
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400064ee
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
add rsp, 0x1188
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000c3cd
Capabilities:
Set registry value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rax, qword [0x1400b1aa0]
mov r8, qword [rax]
mov rsi, rcx
mov rbx, rdx
test r8, r8
je 0x14000c3fb
call fcn.14002295b
xor ebx, ebx
test rax, rax
setne bl
jmp 0x14000c50c
xor edi, edi
test rdx, rdx
je 0x14000c40c
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov edi, eax
xor r9d, r9d
mov edx, 0x5c
mov rcx, rsi
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x68], r9
call sub.msvcrt.dll_strchr
test rax, rax
je 0x14000c445
mov r8d, 0x91
lea rdx, [0x140082e74]
lea rcx, [0x140082e8a]
call qword [sym.imp.msvcrt.dll__wassert]
lea rax, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov r9d, 0x2001d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c475
xor r8d, r8d
mov qword [rsp + 0x60], r8
jmp 0x14000c4c1
lea rax, [rsp + 0x5c]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x30], rdx
lea rdx, [0x140082ec8]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14000c4c5
xor eax, eax
mov qword [rsp + 0x68], rax
xor ebx, ebx
jmp 0x14000c4ec
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rcx, qword [rsp + 0x68]
mov rdx, rsi
mov dword [rsp + 0x28], edi
mov r9d, 1
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000c4fc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000c50c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret