joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400027e0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400044d0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002800
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002808
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002800
movzx r8d, word [rdx + 6]
movzx eax, word [rdx + 0x14]
test r8w, r8w
lea rax, [rdx + rax + 0x18]
je 0x140002850
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140002847
test rcx, rcx
je 0x140002800
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140002838
xor eax, eax
ret

Function at 0x140002860
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400044d0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000287f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002888
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400028a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400044d0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400028c0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400028c8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400028c0
movzx r9d, word [r8 + 6]
sub rcx, rdx
movzx edx, word [r8 + 0x14]
test r9w, r9w
lea rdx, [r8 + rdx + 0x18]
je 0x1400028c0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140002914
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002920
add rdx, 0x28
cmp r9, rdx
jne 0x140002900
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002930
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400044d0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002952
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002960
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002952
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002952
movzx r10d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
test r10w, r10w
lea rdx, [r8 + rdx + 0x18]
je 0x140002952
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov r8, r9
jb 0x1400029b5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400029c8
add rdx, 0x28
cmp rdx, r10
jne 0x1400029a0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1400029d7
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x1400029e7
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400029be
test ecx, ecx
jg 0x1400029d0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140014450
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14001445d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14001446d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140014455
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140014485
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140014472
sub eax, 3
jb 0x14001449f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400144d6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x1400144c6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400144c4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400144b3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140014412
jmp 0x14001445d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x7400
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140014522
cmp rsi, rcx
jae 0x14001452a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140014509
cmp al, 0x8f
ja 0x140014509
cmp byte [rsi - 2], 0xf
je 0x14001450f
sub al, 0xe8
cmp al, 1
ja 0x1400144f3
cmp rsi, rcx
jae 0x14001452a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400144f9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14001452a
lodsb al, byte [rsi]
jmp 0x140014509
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x12000]
mov eax, dword [rdi]
or eax, eax
je 0x140014587
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x14000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140014537
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140014581
mov qword [rbx], rax
add rbx, 8
jmp 0x140014557
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400145c1
cmp al, 0xef
ja 0x1400145b3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140014593
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400145a2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140014640], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140014640
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140014630
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0
Function at 0x140001070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov edx, 0x65
xor ecx, ecx
lea r8d, [rdx - 0x5b]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov qword [0x140004660], rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
mov esi, eax
mov rax, 0xffffffffffffffff
xor ebx, ebx
add ecx, 1
cmovb rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea r8d, [rsi + 1]
xor edx, edx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
xor r9d, r9d
xor r10d, r10d
test esi, esi
je 0x140001149
mov rdx, qword [0x140004660]
movzx r8d, byte [rdx]
test r8b, 0xdf
je 0x140001120
cmp ebx, 0x100
jb 0x14000113e
mov byte [rcx + rdi], r8b
inc ecx
jmp 0x14000113e
cmp r9d, 0x2fe
jae 0x140001149
cmp ebx, 0x100
jae 0x140001135
inc ebx
jmp 0x14000113b
mov byte [rcx + rdi], 0x20
inc ecx
inc r9d
inc r10d
inc rdx
cmp r10d, esi
jb 0x140001106
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], 0
lea rdx, [0x140002290]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
test rax, rax
je 0x140001189
nop dword [rax]
lea r8, [rsp + 0x20]
xor ecx, ecx
lea rdx, [0x140002290]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
test rax, rax
jne 0x140001170
lea rcx, [0x140002294]
call fcn.140001010
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400011d0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140001a90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ada
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ada
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ada
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ada
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ada
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001adc
xor al, al
add rsp, 0x28
ret
Function at 0x14076a0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14076a237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14076a0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14076a0c7
add dl, dl
jne 0x14076a0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14076a14e
xor eax, eax
add dl, dl
jne 0x14076a0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14076a205
add dl, dl
jne 0x14076a10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14076a11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14076a128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14076a135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14076a142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14076a0d6
mov eax, 1
add dl, dl
jne 0x14076a15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14076a16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14076a153
sub eax, ebx
mov ebx, 1
jne 0x14076a1a4
mov ecx, 1
add dl, dl
jne 0x14076a186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14076a193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14076a17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14076a0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14076a1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14076a1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14076a1b5
cmp eax, 0x7d00
jae 0x14076a1f3
cmp eax, 0x500
jb 0x14076a1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14076a0d6
cmp eax, 0x7f
ja 0x14076a1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14076a0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14076a22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14076a0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1401e09c0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1401e09cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401e09dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401e09c5
lea eax, [rcx + 1]
jmp 0x1401e09eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1401e09fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401e09e4
sub eax, 3
jb 0x1401e0a1e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1401e0a6d
sar eax, 1
movsxd rbp, eax
jb 0x1401e0a54
jmp 0x1401e0a2c
add ebx, ebx
jne 0x1401e0a2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401e0a54
inc ecx
add ebx, ebx
jne 0x1401e0a3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401e0a54
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1401e0a4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1401e0a3c
add ecx, 2
jmp 0x1401e0a59
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1401e0982
jmp 0x1401e09cd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x36200
mov dl, 0xd
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401e0ab9
cmp rsi, rcx
jae 0x1401e0ac1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401e0aa0
cmp al, 0x8f
ja 0x1401e0aa0
cmp byte [rsi - 2], 0xf
je 0x1401e0aa6
sub al, 0xe8
cmp al, 1
ja 0x1401e0a8a
cmp rsi, rcx
jae 0x1401e0ac1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401e0a90
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401e0ac1
lodsb al, byte [rsi]
jmp 0x1401e0aa0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1de000]
mov eax, dword [rdi]
or eax, eax
je 0x1401e0b1e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1e0000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401e0ace
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1401e0b18
mov qword [rbx], rax
add rbx, 8
jmp 0x1401e0aee
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1401e0b58
cmp al, 0xef
ja 0x1401e0b4a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1401e0b2a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1401e0b39
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.1401e0bd7], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.1401e0bd7
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401e0bc7
sub rsp, 0xffffffffffffff80
jmp 0x1400013d0
Function at 0x14003e9d0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003e9dd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003e9ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003e9d5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003ea05
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003e9f2
sub eax, 3
jb 0x14003ea1f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003ea56
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003ea46
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003ea44
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003ea33
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003e992
jmp 0x14003e9dd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1e400
mov dl, 7
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003eaa2
cmp rsi, rcx
jae 0x14003eaaa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003ea89
cmp al, 0x8f
ja 0x14003ea89
cmp byte [rsi - 2], 0xf
je 0x14003ea8f
sub al, 0xe8
cmp al, 1
ja 0x14003ea73
cmp rsi, rcx
jae 0x14003eaaa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003ea79
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003eaaa
lodsb al, byte [rsi]
jmp 0x14003ea89
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x3b000]
mov eax, dword [rdi]
or eax, eax
je 0x14003eb13
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x43eb0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003eab7
jns 0x14003eaec
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003eaf6
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003eb0d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003ead7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14003eb4d
cmp al, 0xef
ja 0x14003eb3f
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14003eb1f
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14003eb2e
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003eba1
sub rsp, 0xffffffffffffff80
jmp 0x14001ee78
Function at 0x1401818c0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1401818cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401818dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401818c5
lea eax, [rcx + 1]
jmp 0x1401818eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1401818fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401818e4
sub eax, 3
jb 0x14018191e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14018196d
sar eax, 1
movsxd rbp, eax
jb 0x140181954
jmp 0x14018192c
add ebx, ebx
jne 0x14018192a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140181954
inc ecx
add ebx, ebx
jne 0x14018193a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140181954
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14018194d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14018193c
add ecx, 2
jmp 0x140181959
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140181882
jmp 0x1401818cd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2d000
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401819bd
cmp rsi, rcx
jae 0x1401819c5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401819a4
cmp al, 0x8f
ja 0x1401819a4
cmp byte [rsi - 2], 0xf
je 0x1401819aa
sub al, 0xe8
cmp al, 1
ja 0x14018198e
cmp rsi, rcx
jae 0x1401819c5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140181994
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401819c5
lodsb al, byte [rsi]
jmp 0x1401819a4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x161000]
mov eax, dword [rdi]
or eax, eax
je 0x140181a22
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x181b30]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401819d2
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140181a1c
mov qword [rbx], rax
add rbx, 8
jmp 0x1401819f2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140181a5c
cmp al, 0xef
ja 0x140181a4e
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140181a2e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140181a3d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140181ab0
sub rsp, 0xffffffffffffff80
jmp 0x140013ff0
Function at 0x1400019b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov qword [rsp + 0xd8], 0xfffffffffffffffe
mov rax, qword [0x1400472d0]
xor rax, rsp
mov qword [rsp + 0xe8], rax
movzx eax, byte [0x140058b01]
test eax, eax
je 0x140001a7e
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.1400099b0
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x28]
call fcn.1400091c0
nop
lea rcx, [0x14003a840]
call fcn.140018050
mov qword [rsp + 0x78], rax
mov r8, qword [rsp + 0x78]
lea rdx, [0x14003a840]
lea rcx, [rsp + 0x28]
call fcn.140008f60
cmp qword [rsp + 0x48], 0x10
jb 0x140001a53
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xe0], rax
jmp 0x140001a60
lea rax, [rsp + 0x30]
mov qword [rsp + 0xe0], rax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.1400099b0
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.1400189a0
add rsp, 0xf8
ret
Function at 0x140005c10
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x228
mov qword [rsp + 0x1f0], 0xfffffffffffffffe
mov qword [rsp + 0x30], 0
mov r8, qword [rsp + 0x238]
lea rdx, str.__del_reg__KEY:
lea rcx, [rsp + 0x40]
call fcn.14000dd40
mov qword [rsp + 0x1f8], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x200], rax
mov rcx, qword [rsp + 0x200]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x40]
call fcn.1400099b0
mov rax, qword [rsp + 0x238]
cmp qword [rax + 0x20], 0x10
jb 0x140005ca9
mov rax, qword [rsp + 0x238]
mov rax, qword [rax + 8]
mov qword [rsp + 0x208], rax
jmp 0x140005cbd
mov rax, qword [rsp + 0x238]
add rax, 8
mov qword [rsp + 0x208], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x208]
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140005e3a
mov rax, qword [rsp + 0x238]
cmp qword [rax + 0x20], 0x10
jb 0x140005d13
mov rax, qword [rsp + 0x238]
mov rax, qword [rax + 8]
mov qword [rsp + 0x210], rax
jmp 0x140005d27
mov rax, qword [rsp + 0x238]
add rax, 8
mov qword [rsp + 0x210], rax
mov rdx, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x38], 0
jne 0x140005dc3
lea rax, [rsp + 0xe0]
mov qword [rsp + 0xe8], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.1400099b0
lea rcx, str.____done.
call fcn.140018050
mov qword [rsp + 0x110], rax
mov r8, qword [rsp + 0x110]
lea rdx, str.____done.
lea rcx, [rsp + 0x68]
call fcn.14000aae0
nop
lea rcx, [rsp + 0x68]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x68]
call fcn.1400099b0
mov al, 1
jmp 0x140005eaf
lea rax, [rsp + 0x139]
mov qword [rsp + 0x140], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.1400099b0
lea rcx, str.____failed.
call fcn.140018050
mov qword [rsp + 0x168], rax
mov r8, qword [rsp + 0x168]
lea rdx, str.____failed.
lea rcx, [rsp + 0x90]
call fcn.14000aae0
nop
lea rcx, [rsp + 0x90]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x90]
call fcn.1400099b0
xor al, al
jmp 0x140005eaf
lea rax, [rsp + 0x191]
mov qword [rsp + 0x198], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xb8]
call fcn.1400099b0
lea rcx, str.____not_exist
call fcn.140018050
mov qword [rsp + 0x1c0], rax
mov r8, qword [rsp + 0x1c0]
lea rdx, str.____not_exist
lea rcx, [rsp + 0xb8]
call fcn.14000aae0
nop
lea rcx, [rsp + 0xb8]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xb8]
call fcn.1400099b0
xor al, al
add rsp, 0x228
ret