joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180112070
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180112290
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180112177
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1801120d4
mov rax, qword [0x18021f008]
cmp qword [rsp + 0x20], rax
ja 0x1801120d4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180112096
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18011a7f0
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180112103
jmp 0x180112177
cmp dword [rsp + 0x50], 0x10000
jne 0x18011215a
cmp qword [rsp + 0x48], 0x10000
jb 0x18011215a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180112148
mov rax, qword [rsp + 0x28]
jmp 0x180112179
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180112172
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180112290
mov qword [rsp + 0x20], rax
jmp 0x180112096
xor eax, eax
add rsp, 0x68
ret

Function at 0x180112180
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1801122d0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180112283
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1801121db
mov rax, qword [0x18021f008]
cmp qword [rsp + 0x20], rax
ja 0x1801121db
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18011219d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18011a7f0
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18011220a
jmp 0x180112283
cmp dword [rsp + 0x50], 0x10000
jne 0x180112261
cmp qword [rsp + 0x48], 0x10000
jb 0x180112261
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18011224f
mov rax, qword [rsp + 0x28]
jmp 0x180112285
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18011227e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1801122d0
mov qword [rsp + 0x20], rax
jmp 0x18011219d
xor eax, eax
add rsp, 0x68
ret
Function at 0x180112320
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1801128b0
mov qword [rsp + 0x28], 0
cmp qword [0x18024f128], 0
jne 0x180112368
cmp qword [0x18024f120], 0
je 0x180112368
mov rax, qword [0x18024f120]
mov qword [0x18024f128], rax
cmp qword [0x18024f128], 0
je 0x18011240e
mov rax, qword [0x18024f128]
cmp qword [rax + 0x10], 0
je 0x18011240e
mov rax, qword [0x18024f128]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18011240e
mov rax, qword [0x18024f128]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18011240e
mov rax, qword [0x18024f128]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x1801123d4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x1801123db
xor eax, eax
jmp 0x180112589
mov rax, qword [0x18024f128]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.18011a7f0
mov rax, qword [rsp + 0x28]
jmp 0x180112589
mov rax, qword [0x18024f120]
mov qword [0x18024f128], rax
jmp 0x180112430
mov rax, qword [0x18024f128]
mov rax, qword [rax + 8]
mov qword [0x18024f128], rax
cmp qword [0x18024f128], 0
je 0x18011247d
cmp qword [0x18024f128], 0
je 0x18011247b
mov rax, qword [0x18024f128]
cmp qword [rax + 0x10], 0
je 0x18011247b
mov rax, qword [0x18024f128]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18011247b
mov rax, qword [0x18024f128]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18011247b
jmp 0x1801123ac
jmp 0x18011241e
mov rcx, qword [rsp + 0x60]
call fcn.180114730
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180112590
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180112587
mov rax, qword [rsp + 0x48]
mov qword [0x18024f128], rax
mov rax, qword [0x18024f128]
mov dword [rax], 0x52727464
mov rax, qword [0x18024f128]
mov qword [rax + 0x10], 0
mov rax, qword [0x18024f128]
mov rcx, qword [0x18024f120]
mov qword [rax + 8], rcx
mov rax, qword [0x18024f128]
mov qword [0x18024f120], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18024f128]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180112538
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180112572
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18011252e
mov rax, qword [0x18024f128]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x1801123ac
xor eax, eax
add rsp, 0x58
ret
Function at 0x180133ed8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180133ef8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180122ae0
or eax, 0xffffffff
jmp 0x180133efa
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400011a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, r9
mov r15, rcx
mov r14, qword [rsp + 0xc0]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
test eax, eax
jg 0x1400011e5
xor al, al
jmp 0x14000131e
xor eax, eax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov rcx, r15
call fcn.140001350
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
cmp rbp, rsi
je 0x1400012d8
xor ebx, ebx
sub rsi, rbp
sar rsi, 3
test rsi, rsi
je 0x1400012d4
mov rdi, rbp
mov r12d, dword [rdi]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__msize]
test eax, eax
jle 0x1400012d8
movsxd r13, eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, r13
mov edx, r12d
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9, r13
mov r8, r14
mov edx, r12d
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
setne byte [rsp + 0x30]
cmp dword [rsp + 0x34], 0
je 0x1400012b3
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov r8, r13
mov edx, r12d
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, r14
call fcn.140001bf0
cmp byte [rsp + 0x30], 0
je 0x1400012d8
inc ebx
add rdi, 8
movsxd rax, ebx
cmp rax, rsi
jb 0x140001232
mov bl, 1
jmp 0x1400012da
xor bl, bl
test rbp, rbp
je 0x14000131b
mov rdx, qword [rsp + 0x48]
sub rdx, rbp
and rdx, 0xfffffffffffffff8
mov rax, rbp
cmp rdx, 0x1000
jb 0x140001313
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001313
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbp
call fcn.140001bf0
movzx eax, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001bd0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001680
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor edx, edx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400016f8
nop dword [rax + rax]
lea rdx, str.AndroidEmulatorEx.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x140001738
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400016d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.error_attache_proccess.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140001bd0
add rsp, 0x180
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x48]
test r8d, r8d
je 0x140001701
xor edx, edx
mov dword [rsp + 0x30], r8d
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140001701
mov ecx, 9
call fcn.140001c34
mov ecx, 7
mov rbx, rax
mov dword [rax], 0x5e5ffff9
mov dword [rax + 4], 0x8c2c35b
mov byte [rax + 8], 0
call fcn.140001c34
mov r9, rax
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x30]
mov dword [rax], 0x5e5ffff9
mov word [rax + 4], 0xc35b
mov byte [rax + 6], 0xe9
call fcn.1400011a0
jmp 0x14000171d

Function at 0x14000256c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400025b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400025b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400025b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400025b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400025b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400025b8
xor al, al
add rsp, 0x28
ret
Function at 0x140005670
Capabilities:
Encode data using xor

Disassembly:
or rsi, r15
xor rsi, rsi
push r11
pop rbx
mov r12, qword [rsp + rsi]
sub r14, r11
mov r11, 0x47ec5383
push r10
pop rdi
mov r13, 0x47f47183
sub r15, 0x6c
xor r11, r13
xor r14, rax
sub r12, r11
add r13, r10
mov r11, 0xb7ebf13
xor rsi, 0x6e
mov r13, 0xb627b6b
or rsi, 0x5c
xor r11, r13
dec rsi
add r11, r12
push r14
pop r13
mov rbx, qword [r11]
push rsi
pop r10
mov r10, 0x4a42a7ec
xorps xmm11, xmm0
mov r13, 0x4a653c0c
mov r11, r15
xor r10, r13
shl rdi, 0x28
add r10, r12
and r15, 0x9a
mov r12, 0x673ef519
rol r14, 0xa
mov r11, 0x673e635c
ror r13, 0x1b
xor r12, r11
add rsi, r15
mov rdi, 0x9b
mov r15, 5
mov r13, 0x9f
test rax, r11
xor rdi, r13
xchg r11, rax
push r10
rol r14, 0x16
push r12
sub r11, rax
push rbx
inc r15
sub rsp, 0x20
rol r15, 0x22
mov rcx, r10
nop
mov rdx, r12
shr r14, 0x1b
mov r8, rdi
sub r14, 0x4b
lea r9, [rsp]
add rsi, 0x5a
call rbx
sub rdi, 0x44
add rsp, 0x20
mov rsi, rdi
pop r12
shl r10, 0xe
pop rax
sub rsi, 4
pop r14
add rsi, 0xcd
xor r11, r11
test rsi, r13
lea r15, [r14 + r11]
sub rbx, rdi
mov r13b, byte [r15]
cmp rdi, rbx
xor r13b, 0x67
sub rsi, r10
add r13b, 0x48
mov rsi, r10
mov byte [r15], r13b
pop rsi
mov r10, rsi
push r10
inc r11
test rsi, rdi
cmp r11, rax
lea rsi, [rsi + 0xe4]
jne 0x140005781
test rdi, r10
mov rbx, 0x96
subps xmm0, xmm11
mov r15, 0xb6
nop
xor rbx, r15
xor r13, 0x32
push r14
xchg r11, rdi
sub rsp, 0x20
add r11, 0x57
mov rcx, r14
or r10, rsi
mov rdx, rax
and r15, r10
mov r8, rbx
test rsi, r11
lea r9, [rsp]
cmp r15, r10
call r12
shr r13, 0x1e
add rsp, 0x20
xorps xmm7, xmm4
ret
Function at 0x140029f00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14024cdb8]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor r8d, r8d
lea rdx, [rsp + 0x48]
call fcn.140028320
cmp qword [rax + 0x18], 8
jb 0x140029f30
mov rax, qword [rax]
xor edi, edi
mov ebx, edi
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140029f67
mov eax, edi
mov rbx, qword [rsp + 0x38]
test eax, eax
jne 0x140029fc4
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x30], 8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.ChannelId
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140029fc4
cmp dword [rsp + 0x34], 0xb
jne 0x140029fc4
mov rdi, qword [rsp + 0x40]
test rbx, rbx
je 0x140029fd7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140029fd7
test rbx, rbx
je 0x140029fd2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x7d0
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14002a01c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a017
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a017
call qword [0x1401cdd00]
int3
call fcn.1401816cc
mov eax, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140181670
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x14002ca50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movss dword [rsp + 0x20], xmm3
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14024cdb8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xa0]
mov rdi, rdx
mov edx, dword [rsp + 0x98]
test eax, eax
mov r11d, 6
mov rbp, r8
mov r10d, r11d
mov r14, rcx
cmovns r10d, eax
mov eax, edx
and eax, 0x7fffff
shr edx, 0x17
lea r9d, [rax + rax]
test edx, edx
jne 0x14002cab1
neg eax
sbb ecx, ecx
and ecx, 0xffffff82
jmp 0x14002cab4
lea ecx, [rdx - 0x7f]
mov eax, r9d
mov r15d, 0x2d
bts eax, 0x18
test edx, edx
cmovne r9d, eax
mov eax, ecx
cdq
mov esi, eax
mov eax, 0x2b
xor esi, edx
sub esi, edx
test ecx, ecx
cmovns r15d, eax
cmp esi, 0xa
jae 0x14002cae5
lea edx, [rax - 0x27]
jmp 0x14002caee
cmp esi, 0x64
sbb rdx, rdx
add rdx, r11
mov rcx, rbp
movsxd r8, r10d
sub rcx, rdi
cmp rcx, r8
jge 0x14002cb0c
mov qword [r14], rbp
mov dword [r14 + 8], 0x84
jmp 0x14002cc5a
xor eax, eax
test r10d, r10d
setg al
sub rcx, r8
add rax, rdx
cmp rcx, rax
jl 0x14002cafc
mov qword [rsp + 0x80], rbx
cmp r10d, r11d
jge 0x14002cb51
lea r8d, [r9 + r9]
sub r11d, r10d
shl r11d, 2
lea eax, [r8 - 1]
or eax, r9d
movzx ecx, r11b
mov edx, 1
shl edx, cl
and edx, eax
and edx, r8d
add r9d, edx
mov eax, r9d
and r9d, 0xffffff
shr eax, 0x18
add al, 0x30
mov byte [rdi], al
inc rdi
test r10d, r10d
jle 0x14002cbde
mov byte [rdi], 0x2e
lea r11, str.0123456789abcdefghijklmnopqrstuvwxyz
mov eax, r9d
lea r8d, [r10 - 1]
shr rax, 0x14
mov ecx, 0x14
movzx eax, byte [rax + r11]
mov byte [rdi + 1], al
add rdi, 2
test r8d, r8d
je 0x14002cbde
mov edx, 0x100000
nop word [rax + rax]
test ecx, ecx
je 0x14002cbc8
lea eax, [rdx - 1]
sub ecx, 4
and r9d, eax
ror edx, 4
mov eax, r9d
shr rax, cl
movzx eax, byte [rax + r11]
mov byte [rdi], al
inc rdi
sub r8d, 1
jne 0x14002cba0
jmp 0x14002cbde
movsxd rbx, r8d
mov edx, 0x30
mov r8, rbx
mov rcx, rdi
call fcn.140182d06
add rdi, rbx
mov byte [rdi], 0x70
lea r9, [rsp + 0x40]
mov byte [rdi + 1], r15b
add rdi, 2
nop
dec r9
mov eax, 0xcccccccd
mul esi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub sil, cl
add sil, 0x30
mov byte [r9], sil
mov esi, edx
test edx, edx
jne 0x14002cbf0
lea rbx, [rsp + 0x40]
mov rax, rbp
sub rbx, r9
sub rax, rdi
cmp rax, rbx
jge 0x14002cc35
mov dword [r14 + 8], 0x84
jmp 0x14002cc4f
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call fcn.140182cfa
mov dword [r14 + 8], 0
lea rbp, [rbx + rdi]
mov qword [r14], rbp
mov rbx, qword [rsp + 0x80]
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140181670
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002d070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movsd qword [rsp + 0x20], xmm3
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14024cdb8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xa0]
mov rsi, rdx
mov rdx, qword [rsp + 0x98]
test eax, eax
mov r9, rdx
mov r11d, 0xd
mov r10d, r11d
movabs rbx, 0xfffffffffffff
cmovns r10d, eax
mov rbp, r8
and r9, rbx
shr rdx, 0x34
mov r14, rcx
test edx, edx
jne 0x14002d0e4
mov rax, r9
neg rax
sbb ecx, ecx
and ecx, 0xfffffc02
jmp 0x14002d0ea
lea ecx, [rdx - 0x3ff]
mov rax, r9
movabs r8, 0x10000000000000
or rax, r8
mov r15d, 0x2d
test edx, edx
cmovne r9, rax
mov eax, ecx
cdq
mov edi, eax
mov eax, 0x2b
xor edi, edx
sub edi, edx
test ecx, ecx
cmovns r15d, eax
cmp edi, 0xa
jae 0x14002d124
lea edx, [rax - 0x27]
jmp 0x14002d13d
cmp edi, 0x64
jae 0x14002d130
mov edx, 5
jmp 0x14002d13d
cmp edi, 0x3e8
sbb rdx, rdx
add rdx, 7
mov rcx, rbp
movsxd r8, r10d
sub rcx, rsi
cmp rcx, r8
jl 0x14002d27b
xor eax, eax
test r10d, r10d
setg al
sub rcx, r8
add rax, rdx
cmp rcx, rax
jl 0x14002d27b
cmp r10d, r11d
jge 0x14002d192
lea r8, [r9 + r9]
sub r11d, r10d
shl r11d, 2
lea rax, [r8 - 1]
or rax, r9
movzx ecx, r11b
mov edx, 1
shl rdx, cl
and rdx, rax
and rdx, r8
add r9, rdx
mov rax, r9
and r9, rbx
shr rax, 0x34
add al, 0x30
mov byte [rsi], al
inc rsi
test r10d, r10d
jle 0x14002d222
mov byte [rsi], 0x2e
lea r11, str.0123456789abcdefghijklmnopqrstuvwxyz
mov rax, r9
lea r8d, [r10 - 1]
shr rax, 0x30
mov ecx, 0x30
movzx eax, byte [rax + r11]
mov byte [rsi + 1], al
add rsi, 2
test r8d, r8d
je 0x14002d222
movabs rdx, 0x1000000000000
nop dword [rax]
test ecx, ecx
je 0x14002d20c
lea rax, [rdx - 1]
sub ecx, 4
and r9, rax
ror rdx, 4
mov rax, r9
shr rax, cl
mov eax, eax
movzx eax, byte [rax + r11]
mov byte [rsi], al
inc rsi
sub r8d, 1
jne 0x14002d1e0
jmp 0x14002d222
movsxd rbx, r8d
mov edx, 0x30
mov r8, rbx
mov rcx, rsi
call fcn.140182d06
add rsi, rbx
mov byte [rsi], 0x70
lea r9, [rsp + 0x40]
mov byte [rsi + 1], r15b
add rsi, 2
nop dword [rax]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r9], dil
mov edi, edx
test edx, edx
jne 0x14002d240
lea rbx, [rsp + 0x40]
mov rax, rbp
sub rbx, r9
sub rax, rsi
cmp rax, rbx
jge 0x14002d285
mov dword [r14 + 8], 0x84
jmp 0x14002d29f
mov r8, rbx
mov rdx, r9
mov rcx, rsi
call fcn.140182cfa
mov dword [r14 + 8], 0
lea rbp, [rbx + rsi]
mov qword [r14], rbp
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140181670
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140054f70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140054fa4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140054f90
ret
Function at 0x140055680
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rdx + 0x18], 0x10
mov r9, qword [rdx + 0x10]
jb 0x14005568e
mov rdx, qword [rdx]
xor r8d, r8d
movabs rax, 0xcbf29ce484222325
test r9, r9
je 0x1400556c4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
inc r8
xor rax, rcx
imul rax, r10
cmp r8, r9
jb 0x1400556b0
ret
Function at 0x140069a30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x14024cdb8]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbp, rdx
mov qword [rsp + 0x48], rdx
lea rdi, [rcx + 0x40]
call fcn.140027cc0
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140028320
cmp qword [rax + 0x18], 8
jb 0x140069a82
mov rax, qword [rax]
xor r14d, r14d
mov ebx, r14d
mov qword [rsp + 0x38], r14
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140069abc
mov eax, r14d
mov rbx, qword [rsp + 0x38]
test eax, eax
jne 0x140069b19
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x30], 8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.api_debug_mode
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140069b19
cmp dword [rsp + 0x34], 0xb
jne 0x140069b19
mov rsi, qword [rsp + 0x40]
test rbx, rbx
je 0x140069b2a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140069b2a
test rbx, rbx
je 0x140069b27
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, r14
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140069b6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140069b6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140069b6a
call qword [0x1401cdd00]
int3
call fcn.1401816cc
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r14w
cmp rsi, 1
jne 0x140069b94
cmp qword [rdi + 0x30], 0
je 0x140069b94
add rdi, 0x20
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1400237d0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call qword [0x1401cd358]
nop
xor r8d, r8d
mov rdx, rax
mov rcx, rbp
call qword [0x1401cd240]
nop
lea rcx, [rsp + 0x48]
call qword [0x1401cd4c8]
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x140069c12
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140069c0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140069c0d
call qword [0x1401cdd00]
int3
call fcn.1401816cc
mov rax, rbp
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140181670
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400727d0
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x458
mov rax, qword [0x14024cdb8]
xor rax, rsp
mov qword [rsp + 0x440], rax
cmp byte [0x14025b156], 0
je 0x14007280c
mov al, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140181670
add rsp, 0x458
ret
mov qword [rsp + 0x460], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x468], rsi
xor edx, edx
mov qword [rsp + 0x450], rdi
mov r8d, 0x208
mov rdi, qword [0x14025b1c8]
xor ebx, ebx
call fcn.140182d06
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x208
call fcn.140182d06
lea rcx, [rdi + 8]
call qword [0x1401cc9d0]
test eax, eax
je 0x14007286b
mov ecx, eax
call qword [0x1401cc9e8]
int3
cmp byte [rdi], bl
jne 0x140072956
mov r8d, 0x104
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140072892
lea ebx, [rax + 1]
jmp 0x140072956
cdqe
lea rdx, [rsp + 0x20]
mov r8d, 0x5c
lea rcx, [rsp + 0x20]
lea rdx, [rdx + rax*2]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
test rax, rax
jne 0x1400728bb
lea ebx, [rax + 2]
jmp 0x140072956
lea rcx, [rsp + 0x20]
sub rax, rcx
lea rdx, [rsp + 0x20]
sar rax, 1
lea rcx, [rsp + 0x230]
lea r8d, [rax + 1]
call qword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea rdx, [0x1402034e0]
lea rcx, [rsp + 0x230]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x230]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140072909
lea ebx, [rax + 3]
jmp 0x140072956
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rdi + 0x58], rax
test rax, rax
jne 0x140072925
lea ebx, [rax + 4]
jmp 0x140072956
lea rdx, [0x1402034f4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14007293f
lea ebx, [rax + 5]
jmp 0x140072956
lea rcx, str.0WIN0GIA035UNMF7
call rax
test eax, eax
jne 0x140072951
mov byte [rdi], 1
jmp 0x140072956
mov ebx, 6
lea rcx, [rdi + 8]
call qword [0x1401cc9c0]
mov rsi, qword [rsp + 0x468]
test ebx, ebx
mov rbx, qword [rsp + 0x460]
mov rdi, qword [rsp + 0x450]
sete al
mov byte [0x14025b156], al
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140181670
add rsp, 0x458
ret