joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f93c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
and qword [r11 - 0x18], 0
mov rdi, r9
mov rsi, r8
test rdx, rdx
je 0x14000f990
lea rax, [r11 - 0x18]
mov r9d, 0x20019
xor r8d, r8d
mov qword [r11 - 0x28], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000f9e5
mov rcx, qword [rsp + 0x30]
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rsi
mov dword [rsp + 0x58], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000f9e5
cmp dword [rsp + 0x50], 4
je 0x14000f9e3
mov ebx, 0x8007139f
jmp 0x14000f9e5
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000f9fb
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000fa14
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov r15, r9
mov r14, r8
mov rsi, rcx
xor r12d, r12d
mov qword [rbp - 0x18], r12
mov ebx, 0x80070000
test rdx, rdx
je 0x14000fa87
mov qword [rbp - 0x18], r12
lea rax, [rbp - 0x18]
mov qword [r11 - 0x58], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
movzx edi, ax
or edi, ebx
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14000fb7e
mov rsi, qword [rbp - 0x18]
mov dword [rbp + 0x38], r12d
mov dword [rbp + 0x30], r12d
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x38]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
movzx edi, ax
or edi, ebx
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14000fb7e
cmp dword [rbp + 0x38], 1
je 0x14000fad8
mov edi, 0x8007139f
jmp 0x14000fb7e
mov eax, dword [rbp + 0x30]
inc eax
mov dword [rbp + 0x30], eax
mov ecx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140035c9c
mov rbx, rax
mov qword [rbp - 8], rax
test rax, rax
jne 0x14000fb10
mov edi, 0x8007000e
jmp 0x14000fb6b
mov dword [rbp + 0x38], r12d
mov eax, dword [rbp + 0x30]
mov dword [rbp - 0x20], eax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x38]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14000fb6b
mov eax, dword [rbp + 0x30]
dec eax
mov word [rbx + rax*2], r12w
mov rdx, rbx
mov rcx, r15
call fcn.14000908c
mov edi, r12d
test rbx, rbx
je 0x14000fb7e
mov edx, 2
mov rcx, rbx
call fcn.140035240
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14000fb93
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140024e24
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rsi, rdx
mov rbx, rcx
and dword [rcx + 8], 0
lea rax, vtable.std::time_get_unsigned_short_int__class_std::istreambuf_iterator_unsigned_short_int__struct_std::char_traits_unsigned_short_int___.0
mov qword [rcx], rax
and qword [rcx + 0x10], 0
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
mov qword [r11 + 0x10], rcx
lea rcx, [r11 - 0x50]
call fcn.14001cdb4
lea rbp, [rbx + 0x2c]
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rbp + 0x20], xmm0
mov eax, dword [rax + 0x28]
mov dword [rbp + 0x28], eax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__Getdays]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140024ec4
lea rcx, [rsi + 8]
mov rdx, rax
call fcn.14000d7c4
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
lea rcx, str.:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
cmp qword [rsi + 8], 0
cmovne rcx, qword [rsi + 8]
mov r8, rbp
call fcn.1400222fc
mov qword [rbx + 0x10], rax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__Getmonths]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140024f10
lea rcx, [rsi + 0x18]
mov rdx, rax
call fcn.14000d7c4
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
lea rcx, str.:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December
cmp qword [rsi + 0x18], 0
cmovne rcx, qword [rsi + 0x18]
mov r8, rbp
call fcn.1400222fc
mov qword [rbx + 0x18], rax
mov r8, rbp
lea rcx, [0x14003dc88]
call fcn.1400222fc
mov qword [rbx + 0x20], rax
and dword [rsp + 0x90], 0
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o____lc_locale_name_func]
nop dword [rax + rax]
mov edi, 2
mov r9d, edi
lea r8, [rsp + 0x90]
lea edx, [rdi + 0x20]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoEx]
nop dword [rax + rax]
mov eax, dword [rsp + 0x90]
cmp ax, 0x30
je 0x140024f9d
cmp ax, 0x31
jne 0x140024f91
mov edi, 1
jmp 0x140024f9d
xor edi, edi
lea ecx, [rdi + 3]
cmp ax, 0x32
cmove edi, ecx
mov dword [rbx + 0x28], edi
mov rax, rbx
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400285e4
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, rcx
and dword [rcx + 8], 0
lea rax, vtable.std::time_get_wchar_t__class_std::istreambuf_iterator_wchar_t__struct_std::char_traits_wchar_t___.0
mov qword [rcx], rax
and qword [rcx + 0x10], 0
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
mov qword [r11 + 0x10], rcx
lea rcx, [r11 - 0x50]
call fcn.14001cdb4
movups xmm0, xmmword [rax]
movups xmmword [rbx + 0x2c], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x3c], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rbx + 0x4c], xmm0
mov eax, dword [rax + 0x28]
mov dword [rbx + 0x54], eax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__W_Getdays]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14002867c
lea rcx, [rsi + 0x28]
mov rdx, rax
call fcn.14001f934
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
lea rcx, [0x14003d9d0]
cmp qword [rsi + 0x28], 0
cmovne rcx, qword [rsi + 0x28]
call fcn.14001d278
mov qword [rbx + 0x10], rax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__W_Getmonths]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400286c5
lea rcx, [rsi + 0x38]
mov rdx, rax
call fcn.14001f934
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
lea rcx, [0x14003da80]
cmp qword [rsi + 0x38], 0
cmovne rcx, qword [rsi + 0x38]
call fcn.14001d278
mov qword [rbx + 0x18], rax
lea rcx, str.:AM:am:PM:pm
call fcn.14001d278
mov qword [rbx + 0x20], rax
and dword [rsp + 0x90], 0
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o____lc_locale_name_func]
nop dword [rax + rax]
mov edi, 2
mov r9d, edi
lea r8, [rsp + 0x90]
lea edx, [rdi + 0x20]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoEx]
nop dword [rax + rax]
mov eax, dword [rsp + 0x90]
cmp ax, 0x30
je 0x14002874c
cmp ax, 0x31
jne 0x140028740
mov edi, 1
jmp 0x14002874c
xor edi, edi
lea ecx, [rdi + 3]
cmp ax, 0x32
cmove edi, ecx
mov dword [rbx + 0x28], edi
mov rax, rbx
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x140034c98
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x14004b6b0], eax
call fcn.1400353d0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x14004b6b0], 0
jne case.default.0x140034cee
mov ecx, 1
call fcn.1400353d0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
invalid
Function at 0x140001650
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x130
mov rbp, rcx
test rcx, rcx
je 0x140001706
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rsi, qword [rdx + 0x20]
test rsi, rsi
je 0x140001706
mov r15d, 0x103
mov r14, qword [rsi + 0x50]
test r14, r14
je 0x140001706
cmp word [rsi + 0x48], r15w
jae 0x1400016fe
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.140001120
xor ebx, ebx
cmp word [r14], bx
je 0x1400016e1
nop dword [rax]
cmp ebx, r15d
jae 0x1400016e1
movzx ecx, byte [r14 + rbx*2]
call fcn.140001590
mov r14, qword [rsi + 0x50]
mov byte [rsp + rbx + 0x20], al
inc ebx
cmp word [r14 + rbx*2], 0
jne 0x1400016c0
mov rcx, rbp
mov byte [rsp + rbx + 0x20], 0
call fcn.1400014b0
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.1400014b0
cmp eax, ebx
je 0x140001725
mov rsi, qword [rsi]
test rsi, rsi
jne 0x140001693
xor eax, eax
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rax, qword [rsi + 0x20]
jmp 0x140001708

Function at 0x140001730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x240
mov r15d, edx
mov rbp, rcx
test rcx, rcx
je 0x14000188a
test edx, edx
je 0x14000188a
movsxd r12, dword [rcx + 0x3c]
xor r14d, r14d
mov eax, dword [r12 + rcx + 0x88]
add rax, rcx
mov ebx, dword [rax + 0x20]
mov r13d, dword [rax + 0x1c]
add rbx, rcx
mov edi, dword [rax + 0x24]
add r13, rcx
mov esi, dword [rax + 0x18]
add rdi, rcx
test esi, esi
je 0x140001885
nop word [rax + rax]
mov ecx, dword [rbx]
dec esi
add rcx, rbp
call fcn.1400014b0
cmp eax, r15d
je 0x1400017c5
add rbx, 4
add rdi, 2
test esi, esi
jne 0x1400017a0
mov rax, r14
jmp 0x14000188c
movzx eax, word [rdi]
mov ecx, dword [r12 + rbp + 0x88]
mov edx, dword [r13 + rax*4]
lea r14, [rdx + rbp]
cmp ecx, edx
ja 0x140001885
add ecx, dword [r12 + rbp + 0x8c]
cmp ecx, edx
jb 0x140001885
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.140001120
xor edx, edx
lea rcx, [rsp + 0x130]
mov r8d, 0x104
call fcn.140001120
mov rcx, r14
call fcn.140001460
test eax, eax
je 0x14000188a
mov r8d, eax
lea rcx, [rsp + 0x20]
mov rdx, r14
mov ebx, eax
call fcn.1400010d0
lea rcx, [rbx + 1]
add rcx, r14
call fcn.140001540
lea rdx, [rbx + 1]
mov r8, rax
add rdx, r14
lea rcx, [rsp + 0x130]
call fcn.1400010d0
lea rcx, [rsp + 0x20]
call fcn.140001900
mov rbx, rax
test rax, rax
je 0x140001885
lea rcx, [rsp + 0x130]
call fcn.1400014b0
mov edx, eax
mov rcx, rbx
call fcn.140001730
mov r14, rax
mov rax, r14
jmp 0x14000188c
xor eax, eax
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400019c0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
xor ebx, ebx
mov dword [rsp + 0x70], 0x4b005c
mov r8d, 0x1f2
mov dword [rbp + 0x3c0], ebx
lea rcx, [rbp - 0x7a]
mov dword [rsp + 0x74], 0x6f006e
mov r14d, ebx
mov dword [rsp + 0x78], 0x6e0077
lea edx, [rbx + 0x5c]
mov dword [rsp + 0x7c], 0x6c0044
mov word [rbp - 0x7c], dx
mov edi, ebx
xor edx, edx
mov dword [rbp - 0x80], 0x73006c
call fcn.140001120
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x180]
call fcn.140001610
lea rdx, [0x1400060c0]
lea rcx, [rbp + 0x180]
call fcn.1400015c0
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.140001500
lea rax, [rsp + 0x30]
mov dword [rsp + 0x40], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
lea r8, [rbp + 0x3c8]
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x58], 0x40
lea ecx, [rbx + 0xc]
movdqu xmmword [rsp + 0x60], xmm0
call fcn.140004c20
cmp dword [rbp + 0x3c8], ebx
jl 0x140001c02
cmp rax, 0xffffffffffffffff
je 0x140001c02
lea rcx, [rbp + 0x3c8]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov rcx, rax
mov dword [rsp + 0x20], 2
xor edx, edx
call fcn.140004a90
lea rcx, str.NTDLL.DLL
mov rsi, rax
call fcn.140001650
cmp dword [rbp + 0x3c8], ebx
jl 0x140001c0e
mov r8, rax
test rsi, rsi
je 0x140001c0e
test rax, rax
je 0x140001c0e
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x140001c0e
movsxd rcx, dword [r8 + 0x3c]
add rcx, r8
cmp dword [rcx], 0x4550
jne 0x140001c0e
movzx edx, word [rcx + 6]
test rdx, rdx
je 0x140001c0e
movzx eax, word [rcx + 0x14]
add rax, 0x24
add rax, rcx
nop dword [rax]
mov ecx, dword [rax - 0xc]
or ecx, 0x20202020
cmp ecx, 0x7865742e
jne 0x140001b5e
mov ecx, dword [rax]
mov edi, dword [rax - 4]
lea rbx, [rcx + r8]
lea r14, [rcx + rsi]
add rax, 0x28
sub rdx, 1
jne 0x140001b40
test rdi, rdi
je 0x140001c0e
test rbx, rbx
je 0x140001c0e
test r14, r14
je 0x140001c0e
lea rax, [rbp + 0x3c0]
mov r9d, 0x80
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rdx, rbx
xor ecx, ecx
call fcn.140004cc0
cmp dword [rbp + 0x3c0], 0
mov r15d, eax
jl 0x140001c0e
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call fcn.1400010d0
lea rax, [rbp + 0x3c0]
mov r9d, r15d
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rdx, rbx
xor ecx, ecx
call fcn.140004cc0
cmp dword [rbp + 0x3c0], 0
jl 0x140001c0e
lea r8, [rbp + 0x3c0]
mov rdx, rsi
xor ecx, ecx
call fcn.140004db0
cmp dword [rbp + 0x3c0], 0
jl 0x140001c0e
mov eax, 1
jmp 0x140001c10
lea rcx, str.NTDLL.DLL
call fcn.140001650
xor eax, eax
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001c30
Capabilities:
Check os version

Disassembly:
push rbx
push rdi
sub rsp, 0x38
mov rbx, qword gs:[0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x361c
jne 0x140001d1e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CheckMenuItem]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenu]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMenu]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuItemID]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnableMenuItem]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UpdateWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
jmp 0x140001d32
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x30], rsi
test rbx, rbx
je 0x140001d88
cmp dword [rbx + 0x118], 0xa
jne 0x140001d88
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov rbp, qword [rbx + 0x10]
movsxd rsi, dword [rbp + 0x3c]
lea rbx, [rbp + 0x108]
add rbx, rsi
mov rcx, rbx
call fcn.1400014b0
cmp eax, 0x9f520b2d
je 0x140001d9e
movzx eax, word [rsi + rbp + 6]
add rbx, 0x28
inc rdi
cmp rdi, rax
jbe 0x140001d68
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x60]
add rsp, 0x38
pop rdi
pop rbx
ret
mov edi, dword [rbx + 0xc]
mov ebx, dword [rbx + 0x10]
add rdi, rbp
je 0x140001d88
test rbx, rbx
je 0x140001d88
call fcn.1400018b0
test eax, eax
je 0x140001d88
lea rax, [rsp + 0x50]
mov r8d, ebx
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov ecx, 1
call fcn.140001300
test eax, eax
jne 0x140001d88
mov rdx, qword [rsp + 0x50]
lea r8d, [rax + 1]
mov rcx, qword [rsp + 0x58]
call fcn.140001e00
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x140004210
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
lea r8, [0x1400070a0]
nop dword [rax]
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x140004220
ret

Function at 0x1400042c0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400042ee
lea r10, [0x1400070a0]
nop dword [rax]
movzx r9d, byte [rdx]
lea rdx, [rdx + 1]
mov eax, ecx
shr ecx, 8
xor r9, rax
movzx eax, r9b
xor ecx, dword [r10 + rax*4]
sub r8, 1
jne 0x1400042d0
mov eax, ecx
ret

Function at 0x140004f10
Capabilities:
Check os version
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x58
mov rax, qword gs:[0x60]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x10], 0
je 0x140004f38
mov rax, qword [rsp + 0x10]
cmp dword [rax + 0x118], 0xa
je 0x140004f3f
xor eax, eax
jmp 0x14000508e
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
sub rax, 0x10
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x30]
mov qword [rsp], rax
cmp qword [rsp], 0
jne 0x140004f73
xor eax, eax
jmp 0x14000508e
mov rax, qword [rsp]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140004f92
xor eax, eax
jmp 0x14000508e
mov rax, qword [rsp + 0x18]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0x4550
je 0x140004fbe
xor eax, eax
jmp 0x14000508e
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0
jne 0x140004ff1
xor eax, eax
jmp 0x14000508e
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp]
mov qword [0x140007060], rax
mov rax, qword [rsp + 0x18]
mov qword [0x140007068], rax
mov rax, qword [rsp + 0x20]
mov qword [0x140007070], rax
mov rax, qword [rsp + 8]
mov qword [0x140007078], rax
mov rax, qword [rsp + 0x30]
mov qword [0x140007080], rax
mov rax, qword [rsp + 0x38]
mov qword [0x140007088], rax
mov rax, qword [rsp + 0x40]
mov qword [0x140007090], rax
mov eax, 1
add rsp, 0x58
ret
Function at 0x140005731
Capabilities:
Execute syscall

Disassembly:
mov rax, rcx
mov r10, rax
mov eax, dword [section..data]
syscall
ret
Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x1400130e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011276
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014430
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014450
xor al, al
jmp 0x1400144d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014463
xor al, al
jmp 0x1400144d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001448d
xor al, al
jmp 0x1400144d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400144a1
xor al, al
jmp 0x1400144d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400144b3
xor al, al
jmp 0x1400144d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400144cf
xor al, al
jmp 0x1400144d1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011253
Capabilities:
Terminate process

Disassembly:
jmp 0x140013990
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112ee
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014ce0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014d00
xor al, al
jmp 0x140014d81
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014d13
xor al, al
jmp 0x140014d81
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014d3d
xor al, al
jmp 0x140014d81
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014d51
xor al, al
jmp 0x140014d81
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014d63
xor al, al
jmp 0x140014d81
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014d7f
xor al, al
jmp 0x140014d81
mov al, 1
add rsp, 0x38
ret