joyce8/EMBER2024-capa huggingface dataset:
Function at 0x75b850f98
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x75b923ae8]
xor rax, rsp
mov qword [rbp - 8], rax
xor r15d, r15d
mov rsi, r8
mov dword [rbp - 0x20], r15d
mov r14d, edx
mov qword [rbp - 0x18], r15
mov ebx, r15d
test r8, r8
jne 0x75b850fe5
mov eax, 0x80070057
jmp 0x75b85115c
mov dword [r8], r15d
lea rax, [0x75b91c130]
mov rdi, r15
lea r12, [0x75b91c090]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x75b851013
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rax, [0x75b91c130]
mov qword [rbp - 0x18], r15
test dword [rdi + rax], r14d
je 0x75b851135
mov rcx, qword [rdi + rax + 8]
test rcx, rcx
je 0x75b851070
lea rdx, [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
jne 0x75b8510c7
call fcn.75b89abc4
mov rcx, qword [0x75b91c090]
cmp rcx, r12
je 0x75b851068
test byte [rcx + 0x1c], 1
je 0x75b851068
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8e7e00]
mov edx, 0xb
mov r9d, eax
call fcn.75b803b0c
mov ebx, r15d
jmp 0x75b85112e
cmp dword [rdi + rax], 1
jne 0x75b8510c7
lea rax, [rbp - 0x18]
mov dword [rbp - 0x10], r15d
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x48], r15d
mov r9d, 0x220
mov dword [rsp + 0x40], r15d
mov r8d, 0x20
mov dword [rsp + 0x38], r15d
mov dl, 2
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov word [rbp - 0xc], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x75b851184
mov rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
xor ecx, ecx
mov dword [rbp - 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x75b8510e4
mov ebx, r15d
jmp 0x75b851124
call fcn.75b89abc4
mov ebx, eax
mov rcx, qword [0x75b91c090]
cmp rcx, r12
je 0x75b85111c
test byte [rcx + 0x1c], 1
je 0x75b85111c
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8e7e00]
mov edx, 0xa
mov r9d, eax
call fcn.75b803b0c
mov rcx, qword [0x75b91c090]
test ebx, ebx
js 0x75b8511bc
cmp dword [rbp - 0x20], r15d
jne 0x75b8511b7
lea rax, [0x75b91c130]
add rdi, 0x10
cmp rdi, 0x90
jb 0x75b850ff9
mov eax, dword [rbp - 0x20]
mov dword [rsi], eax
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x75b85115a
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.75b8bde70
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.75b89abc4
mov ebx, eax
mov rcx, qword [0x75b91c090]
cmp rcx, r12
je 0x75b85114b
test byte [rcx + 0x1c], 1
je 0x75b85114b
mov edx, 0xc
mov r9d, eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8e7e00]
call fcn.75b803b0c
jmp 0x75b85114b
mov ebx, r15d
jmp 0x75b851146
cmp rcx, r12
je 0x75b85114b
test byte [rcx + 0x1c], 1
je 0x75b85114b
mov edx, 0xd
mov r9d, ebx
jmp 0x75b8511a5
Function at 0x75b8555b8
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x75b923ae8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x248
call fcn.75b8c0190
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.75b855be8
xor esi, esi
mov ebx, eax
test eax, eax
js 0x75b855695
mov rdx, rdi
mov word [rsp + 0x30], si
lea rcx, [rsp + 0x30]
call fcn.75b855d18
mov ebx, eax
test eax, eax
js 0x75b855695
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x75b8556c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x75b855670
cmp eax, 3
jne 0x75b855687
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
call fcn.75b85545c
mov ebx, eax
test eax, eax
jne 0x75b855670
lea rcx, [rsp + 0x20]
call fcn.75b8555b8
mov ebx, eax
test eax, eax
js 0x75b855695
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x75b855695
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rcx, [rsp + 0x30]
call fcn.75b855eb4
mov eax, ebx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.75b8bde70
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
test al, 0x10
je 0x75b855645
mov ebx, esi
jmp 0x75b855695
Function at 0x75b86a4c0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x18]
mov rsi, rcx
mov rbp, rdx
mov rcx, qword [rax + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x80070002
je 0x75b86a54c
lea rdi, [0x75b91c090]
test ebx, ebx
jns 0x75b86a539
mov rax, qword [0x75b91c090]
cmp rax, rdi
je 0x75b86a542
test byte [rax + 0x1c], 1
je 0x75b86a542
mov rcx, qword [rax + 0x10]
lea r8, [0x75b8f74e0]
mov edx, 0x1f
mov dword [rsp + 0x20], ebx
mov r9, rbp
call fcn.75b81c350
jmp 0x75b86a53b
xor ebx, ebx
mov rax, qword [0x75b91c090]
test ebx, ebx
js 0x75b86a5ca
jmp 0x75b86a5b5
mov rax, qword [0x75b91c090]
lea rdi, [0x75b91c090]
cmp rax, rdi
je 0x75b86a5b5
test byte [rax + 0x1c], 2
je 0x75b86a5b5
mov rax, qword [rsi]
movabs r10, 0xfb150f3018dd3970
mov rax, qword [rax + 0x18]
mov rcx, rsi
call qword [0x75b8e0a70]
cmp qword [rax + 0x18], 8
jb 0x75b86a589
mov rax, qword [rax]
mov rcx, qword [0x75b91c090]
lea r8, [0x75b8f52c0]
mov edx, 0xb
mov dword [rsp + 0x28], 0x80070002
mov r9, rax
mov qword [rsp + 0x20], rbp
mov rcx, qword [rcx + 0x10]
call fcn.75b834414
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp rax, rdi
je 0x75b86a621
test byte [rax + 0x1c], 1
je 0x75b86a621
mov rax, qword [rsi]
movabs r10, 0xfb150f3018dd3970
mov rax, qword [rax + 0x18]
mov rcx, rsi
call qword [0x75b8e0a70]
cmp qword [rax + 0x18], 8
jb 0x75b86a5f9
mov rax, qword [rax]
mov rcx, qword [0x75b91c090]
lea r8, [0x75b8f52c0]
mov edx, 0xc
mov dword [rsp + 0x28], ebx
mov r9, rax
mov qword [rsp + 0x20], rbp
mov rcx, qword [rcx + 0x10]
call fcn.75b834414
mov ecx, ebx
call fcn.75b89ca74
int3
Function at 0x75b86be40
Capabilities:
Query or enumerate registry key

Disassembly:
mov rcx, rdx
mov edx, r8d
mov r8, qword [rsp + 0x28]
jmp 0x75b8a301c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, qword [r8]
mov rbp, r9
mov eax, r14d
mov rdi, r8
mov dword [rsp + 0x70], eax
mov rsi, rdx
cmp rax, r14
je 0x75b8a3050
mov ebx, 0x80070057
jmp 0x75b8a3131
mov eax, esi
cmp rax, rsi
jne 0x75b8a3046
and qword [rsp + 0x38], 0
lea r9, [rsp + 0x70]
and qword [rsp + 0x30], 0
mov r8, rbp
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x75b8a30d6
mov edx, dword [rsp + 0x70]
mov ecx, 0x800700ea
inc edx
test rbp, rbp
je 0x75b8a30a7
mov eax, edx
cmp rax, qword [rdi]
cmova ebx, ecx
mov eax, edx
mov qword [rdi], rax
mov eax, ebx
cmp ebx, ecx
je 0x75b8a313c
mov ecx, 0x80070103
cmp ebx, ecx
je 0x75b8a313c
test ebx, ebx
js 0x75b8a3131
mov r9, rbp
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.75b8a2f68
jmp 0x75b8a313c
mov ecx, 0x80070103
cmp ebx, ecx
je 0x75b8a313a
mov ecx, 0x800700ea
cmp ebx, ecx
je 0x75b8a311f
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b8a3131
test byte [rcx + 0x1c], 1
je 0x75b8a3131
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f74e0]
mov edx, 0x1c
mov dword [rsp + 0x20], ebx
mov r9d, esi
call fcn.75b816cf8
jmp 0x75b8a3131
mov edx, dword [rsp + 0x70]
inc edx
mov eax, edx
cmp qword [rdi], rax
jb 0x75b8a3135
mov ebx, 0x8000ffff
mov eax, ebx
jmp 0x75b8a313c
mov eax, edx
mov qword [rdi], rax
mov eax, ecx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x75b87bfe8
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x75b87c179
cmp ecx, 0x7c
je 0x75b87c179
cmp ecx, 0x29
jne 0x75b87c033
cmp dword [rbx + 0x1c], 0
jne 0x75b87c179
lea rdi, [rbx + 0x80]
test dword [rdi], 0x10000000
je 0x75b87c18f
jmp 0x75b87c12e
lea rdi, [rbx + 0x80]
cmp ecx, 0x2e
jne 0x75b87c05a
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.75b87c2bc
mov rcx, rbx
call fcn.75b87bfac
jmp 0x75b87c167
cmp ecx, 0x5c
jne 0x75b87c0ba
mov rcx, rbx
call fcn.75b87bfac
test byte [rdi], 0x80
je 0x75b87c0ad
cmp word [rbx + 0x78], 0x62
jne 0x75b87c08e
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.75b87c2bc
mov rcx, rbx
call fcn.75b87bfac
jmp 0x75b87c16f
cmp word [rbx + 0x78], 0x42
jne 0x75b87c0ad
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.75b87c2bc
mov rax, qword [rbx + 0x48]
xor dword [rax + 0xc], 1
jmp 0x75b87c081
mov rcx, rbx
call fcn.75b87c858
jmp 0x75b87c167
cmp ecx, 0x5b
jne 0x75b87c0de
mov rcx, rbx
call fcn.75b87bfac
mov rcx, rbx
call fcn.75b87c708
cmp dword [rbx + 0x7c], 0x5d
jne 0x75b87c19a
jmp 0x75b87c04d
cmp ecx, 0x28
jne 0x75b87c102
mov rcx, rbx
call fcn.75b87bfac
mov rcx, rbx
call fcn.75b87c99c
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x75b87c1a5
jmp 0x75b87c15a
cmp ecx, 0x5e
jne 0x75b87c10f
lea edx, [rcx - 0x5c]
jmp 0x75b87c078
cmp ecx, 0x24
jne 0x75b87c11c
lea edx, [rcx - 0x21]
jmp 0x75b87c078
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x75b87c184
cmp ecx, 0x3f
je 0x75b87c184
cmp ecx, 0x7b
je 0x75b87c184
cmp ecx, 0x7d
jne 0x75b87c13d
test dword [rdi], 0x10000000
je 0x75b87c1b0
jmp 0x75b87c14a
cmp ecx, 0x5d
jne 0x75b87c14a
test dword [rdi], 0x10000000
je 0x75b87c1bb
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.75b87cbd0
mov dil, 1
mov rcx, rbx
call fcn.75b87bfac
test dil, dil
je 0x75b87c16f
mov rcx, rbx
call fcn.75b87ca98
mov ecx, dword [rbx + 0x7c]
mov al, 1
jmp 0x75b87bffa
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
call fcn.75b87b79c
int3
mov edx, 5
call fcn.75b87b79c
int3
mov edx, 4
call fcn.75b87b79c
int3
mov edx, 5
call fcn.75b87b79c
int3
mov edx, 6
call fcn.75b87b79c
int3
mov edx, 4
call fcn.75b87b79c
int3
Function at 0x75b88b76c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r9d
mov rcx, qword [0x75b91c090]
lea rbx, [0x75b91c090]
cmp rcx, rbx
je 0x75b88b7ae
test byte [rcx + 0x1c], 4
je 0x75b88b7ae
mov rcx, qword [rcx + 0x10]
mov dword [rax - 0x28], r9d
call fcn.75b88b670
mov ecx, esi
call fcn.75b88d234
xor r14d, r14d
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], r14
mov edi, eax
call fcn.75b88e554
test eax, eax
js 0x75b88b8b3
mov rbx, qword [rsp + 0x40]
mov dword [rsp + 0x80], edi
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movabs rcx, 0xcbf29ce484222325
mov edx, r14d
movzx eax, byte [rsp + rdx + 0x80]
movabs r8, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r8
cmp rdx, 4
jb 0x75b88b7f4
mov rdx, qword [rbx + 0xb8]
mov r8, qword [rbx + 0xa0]
and rdx, rcx
mov rax, rdx
add rax, rax
mov rcx, qword [r8 + rax*8 + 8]
mov rax, qword [rbx + 0x90]
cmp rcx, rax
je 0x75b88b857
add rdx, rdx
mov r8, qword [r8 + rdx*8]
jmp 0x75b88b850
cmp rcx, r8
je 0x75b88b857
mov rcx, qword [rcx + 8]
cmp edi, dword [rcx + 0x10]
jne 0x75b88b847
jmp 0x75b88b85a
mov rcx, r14
test rcx, rcx
je 0x75b88b868
lea rdi, [rcx + 0x14]
cmp rcx, rax
jne 0x75b88b86b
mov rdi, r14
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x75b88b8a7
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
sub eax, 1
jg 0x75b88b8a7
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
movabs r10, 0xe5453fe31659f270
mov rax, qword [rax]
mov edx, 1
call qword [0x75b8e0a70]
test rdi, rdi
je 0x75b88b914
call fcn.75b88e41c
jmp 0x75b88b914
mov rcx, qword [0x75b91c090]
cmp rcx, rbx
je 0x75b88b8dd
test byte [rcx + 0x1c], 4
je 0x75b88b8dd
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f5f88]
mov edx, 0x11
mov r9d, eax
call fcn.75b803b0c
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x75b88b914
or ecx, 0xffffffff
lock xadd dword [rax + 8], ecx
sub ecx, 1
jg 0x75b88b914
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
movabs r10, 0xe5453fe31659f270
mov rax, qword [rax]
mov edx, 1
call qword [0x75b8e0a70]
mov rax, qword [0x75b9256c8]
test rax, rax
jne 0x75b88b92c
call fcn.75b88b5f0
mov qword [0x75b9256c8], rax
movabs r10, 0xc68c266878d3e870
mov rcx, qword [rsp + 0x88]
xor edx, edx
mov rax, qword [rax + 0x10]
mov r9d, esi
mov qword [rsp + 0x28], rcx
mov word [rsp + 0x20], r14w
lea ecx, [rdx + 2]
lea r8d, [rdx + 3]
call qword [0x75b8e0a70]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x75b88cd24
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x70
mov ebp, r9d
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rcx, qword [0x75b91c090]
lea r12, [0x75b91c090]
cmp rcx, r12
je 0x75b88cd78
test byte [rcx + 0x1c], 8
je 0x75b88cd78
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f5d80]
mov edx, 0xf
mov r9, rsi
call fcn.75b839ac8
mov rdx, qword [rsp + 0xb8]
movzx eax, dx
cmp rdx, rax
jne 0x75b88ce46
xor r14d, r14d
mov r8d, 2
test edi, edi
je 0x75b88cda8
cmp edi, r8d
jne 0x75b88ce67
lea ecx, [r8 + 0x5e]
jmp 0x75b88cdad
mov ecx, 0x50
xor eax, eax
lock cmpxchg qword [rcx + rsi], r14
mov r10, rax
je 0x75b88ce88
mov edi, 1
test ebx, ebx
je 0x75b88cde7
sub ebx, edi
je 0x75b88cde2
sub ebx, edi
je 0x75b88cddc
cmp ebx, edi
jne 0x75b88ced3
lea ecx, [rdi + 3]
jmp 0x75b88cdeb
movzx ecx, r8w
jmp 0x75b88cdeb
movzx ecx, di
jmp 0x75b88cdeb
movzx ecx, r14w
mov rax, qword [rsp + 0xc0]
mov r9d, ebp
movzx r8d, word [rsp + 0xb0]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov word [rsp + 0x28], dx
movzx edx, cx
mov rcx, r10
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
je 0x75b88cef4
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
mov edx, 0x80070057
lea rcx, [rsp + 0x50]
call fcn.75b88eb84
lea rdx, [0x75b916b08]
lea rcx, [rsp + 0x50]
call fcn.75b8c0320
int3
mov edx, 0x8000ffff
lea rcx, [rsp + 0x50]
call fcn.75b88eb84
lea rdx, [0x75b916b08]
lea rcx, [rsp + 0x50]
call fcn.75b8c0320
int3
mov rcx, qword [0x75b91c090]
cmp rcx, r12
je 0x75b88ceb2
test byte [rcx + 0x1c], r8b
je 0x75b88ceb2
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f5d80]
mov edx, 0x10
mov r9d, edi
call fcn.75b803b0c
mov edx, 0x8007139f
lea rcx, [rsp + 0x50]
call fcn.75b88eb84
lea rdx, [0x75b916b08]
lea rcx, [rsp + 0x50]
call fcn.75b8c0320
int3
mov edx, 0x8000ffff
lea rcx, [rsp + 0x50]
call fcn.75b88eb84
lea rdx, [0x75b916b08]
lea rcx, [rsp + 0x50]
call fcn.75b8c0320
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x75b91c090]
cmp rcx, r12
je 0x75b88cf32
test byte [rcx + 0x1c], dil
je 0x75b88cf32
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f5d80]
mov edx, 0x11
mov r9d, ebx
call fcn.75b803b0c
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.75b88eb84
lea rdx, [0x75b916b08]
lea rcx, [rsp + 0x50]
call fcn.75b8c0320
int3
Function at 0x75b89a5d8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r14
mov rbp, rsp
sub rsp, 0x60
mov r14b, r8b
mov rsi, rdx
mov rdi, rcx
or qword [rbp - 0x20], 0xffffffffffffffff
and dword [rax - 0x50], 0
mov dword [rax - 0x58], 3
mov r9d, 5
mov r8d, 0x80000000
mov rdx, rcx
lea rcx, [rbp - 0x20]
call fcn.75b89ce14
mov ebx, eax
test eax, eax
js 0x75b89a736
or qword [rbp - 0x18], 0xffffffffffffffff
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov r9d, 1
mov r8d, 0x40000000
mov rdx, rsi
lea rcx, [rbp - 0x18]
call fcn.75b89ce14
mov ebx, eax
test eax, eax
js 0x75b89a773
mov r12d, 0x1000
mov ecx, r12d
call fcn.75b8cbec4
mov rsi, rax
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x38], r12
mov r8, rax
lea rdx, [rbp + 0x38]
mov rbx, qword [rbp - 0x20]
mov rcx, rbx
call fcn.75b89d008
test eax, eax
js 0x75b89a72e
mov rdi, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x75b89a6e4
xor ecx, ecx
test rdx, rdx
je 0x75b89a6bc
xor eax, eax
xor byte [rax + rsi], r14b
inc ecx
mov eax, ecx
cmp rax, rdx
jb 0x75b89a6af
mov r8, rsi
mov rcx, rdi
call fcn.75b89ced8
test eax, eax
js 0x75b89a726
mov qword [rbp + 0x38], r12
mov r8, rsi
lea rdx, [rbp + 0x38]
mov rcx, rbx
call fcn.75b89d008
test eax, eax
js 0x75b89a72e
jmp 0x75b89a69d
mov rcx, rsi
call fcn.75b8bde90
nop
cmp rdi, 0xffffffffffffffff
je 0x75b89a6fd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rbx, 0xffffffffffffffff
je 0x75b89a70c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rbp
ret
mov ecx, eax
call fcn.75b89ca74
int3
mov ecx, eax
call fcn.75b89ca74
nop
lea rax, [0x75b91c090]
mov rcx, qword [0x75b91c090]
cmp rcx, rax
je 0x75b89a76b
test byte [rcx + 0x1c], 1
je 0x75b89a76b
mov edx, 0xe
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, str.HC_bE_6aV_
mov rcx, qword [rcx + 0x10]
call fcn.75b81c350
mov ecx, ebx
call fcn.75b89ca74
nop
lea rax, [0x75b91c090]
mov rcx, qword [0x75b91c090]
cmp rcx, rax
je 0x75b89a7a8
test byte [rcx + 0x1c], 1
je 0x75b89a7a8
mov edx, 0xf
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, str.HC_bE_6aV_
mov rcx, qword [rcx + 0x10]
call fcn.75b81c350
mov ecx, ebx
call fcn.75b89ca74
int3

Function at 0x75b89a7e0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x75b89a837
call fcn.75b89abc4
mov ebx, eax
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89a833
test byte [rcx + 0x1c], 1
je 0x75b89a833
mov rcx, qword [rcx + 0x10]
lea r8, str.HC_bE_6aV_
mov edx, 0x10
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.75b81c350
mov eax, ebx
jmp 0x75b89a839
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x75b89aa40
Capabilities:
Parse pe header

Disassembly:
test cx, cx
jne 0x75b89ab24
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, 0x5a4d
mov rdi, rcx
cmp word [rcx], ax
jne 0x75b89ab1a
test byte [rcx + 0x3c], 3
jne 0x75b89ab1a
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x75b89ab1a
cmp dword [rdx + 0x84], 6
jb 0x75b89ab1a
mov r8d, dword [rdx + 0x50]
mov r9d, dword [rdx + 0xb8]
lea eax, [r8 - 1]
lea ecx, [r9 - 1]
cmp ecx, eax
jae 0x75b89ab1a
mov ecx, dword [rdx + 0xbc]
mov eax, r8d
sub eax, r9d
cmp ecx, eax
ja 0x75b89ab1a
movabs rax, 0x2492492492492493
lea r10, [rdi + r9]
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 4
test ecx, ecx
je 0x75b89ab1a
dec ecx
mov eax, ecx
imul rbx, rax, 0x1c
add rbx, r10
cmp dword [rbx + 0xc], 2
jne 0x75b89aad3
cmp dword [rbx + 0x14], r8d
jae 0x75b89aad3
mov eax, r8d
sub eax, dword [rbx + 0x14]
cmp dword [rbx + 0x10], eax
ja 0x75b89aad3
mov edx, 0x1c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
test eax, eax
je 0x75b89ab1a
mov ecx, dword [rbx + 0x14]
mov edx, dword [rbx + 0x10]
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualLock]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x75b89baf0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x2f]
sub rsp, 0xe0
and qword [rbp - 0x69], 0
mov r14d, r8d
mov r8, qword [rbp + 0x57]
mov rdi, rcx
lea rcx, [rbp - 0x69]
mov rsi, r9
call fcn.75b89b9fc
mov ebx, eax
test eax, eax
jns 0x75b89bb45
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x75b89bb3e
call fcn.75b8bde90
mov eax, ebx
jmp 0x75b89bc2e
xor eax, eax
lea rcx, [rbp - 0x45]
xorps xmm0, xmm0
mov qword [rbp - 0x51], rax
xor edx, edx
movups xmmword [rbp - 0x61], xmm0
lea r8d, [rax + 0x64]
call fcn.75b8c0190
movzx edx, byte [rbp + 0x6f]
lea rcx, [rbp - 0x61]
mov rbx, qword [rbp - 0x69]
lea rax, [rbp - 0x49]
mov r9, qword [rbp + 0x67]
test rsi, rsi
mov r8, qword [rbp + 0x5f]
mov qword [rsp + 0x48], rcx
cmovne rax, rsi
mov rcx, qword [rbp + 0x57]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x77]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], edx
mov rdx, rbx
mov dword [rbp - 0x49], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x75b89bc0a
call fcn.75b89abc4
mov edi, eax
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89bbf9
test byte [rcx + 0x1c], 1
je 0x75b89bbf9
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f6e50]
mov edx, 0x1a
mov dword [rsp + 0x20], edi
mov r9, rbx
call fcn.75b81c350
test rbx, rbx
je 0x75b89bc06
mov rcx, rbx
call fcn.75b8bde90
mov eax, edi
jmp 0x75b89bc2e
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x75b89bc18
call fcn.75b89cdc8
mov rax, qword [rbp - 0x61]
mov qword [rdi], rax
test rbx, rbx
je 0x75b89bc2c
mov rcx, rbx
call fcn.75b8bde90
xor eax, eax
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x75b89c0b4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov esi, dword [rdx]
mov rbp, rcx
xor ecx, ecx
mov r14, r8
mov r15, rdx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, esi
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r12d, r12d
mov ebx, eax
test eax, eax
jne 0x75b89c156
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x75b89c156
mov eax, 0x800700cb
cmp edi, eax
je 0x75b89c17d
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89c152
test byte [rcx + 0x1c], 1
je 0x75b89c152
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 0x1d]
mov r9, rbp
mov dword [rsp + 0x20], edi
lea r8, [0x75b8f6e50]
call fcn.75b81c350
mov eax, edi
jmp 0x75b89c17d
cmp ebx, esi
jae 0x75b89c168
cmp word [r14 + rbx*2], r12w
je 0x75b89c168
mov eax, 0x8000ffff
jmp 0x75b89c17d
inc ebx
cmp ebx, esi
jbe 0x75b89c176
test esi, esi
je 0x75b89c176
mov word [r14], r12w
mov eax, ebx
mov qword [r15], rax
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret