joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5057c0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x505a09
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x5059f4
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x505802
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x50581c
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call sym.net.IP.String
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x505931
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005f2cc8]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call sym.runtime.concatstring3
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0076a098]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5058fb
xor eax, eax
lea rbx, [0x005f2e48]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x005a0003]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call sym.runtime.concatstring4
jmp 0x505928
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x005f2ed0]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0076a098]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x5059be
xor eax, eax
lea rbx, [0x005f2e48]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x005a0003]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call sym.runtime.concatstring4
jmp 0x5059eb
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005f2ed0]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
lea rax, [0x005a0398]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net._TCPAddr_.String
Function at 0x506980
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x506bc9
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x506bb4
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x5069c2
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x5069dc
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call sym.net.IP.String
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x506af1
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005f2cc8]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call sym.runtime.concatstring3
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0076a098]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x506abb
xor eax, eax
lea rbx, [0x005f2e48]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x005a0003]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call sym.runtime.concatstring4
jmp 0x506ae8
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x005f2ed0]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0076a098]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x506b7e
xor eax, eax
lea rbx, [0x005f2e48]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x005a0003]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call sym.runtime.concatstring4
jmp 0x506bab
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005f2ed0]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
lea rax, [0x005a0398]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net._UDPAddr_.String
Function at 0x50aba0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x50abb8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x50abb8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x50abc0
xor eax, eax
ret
cmp rbx, 3
je 0x50abcc
cmp rbx, 4
jne 0x50abf9
cmp al, 0x2c
ja 0x50abe6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x50abf6
cmp al, 0x24
je 0x50abf6
nop dword [rax]
cmp al, 0x26
jae 0x50abf6
jmp 0x50abf9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x50abf6
cmp al, 0x5b
je 0x50abf6
cmp al, 0x5d
jne 0x50abf9
xor eax, eax
ret
cmp al, 0x2f
ja 0x50ac32
nop dword [rax]
cmp al, 0x26
ja 0x50ac11
cmp al, 0x24
je 0x50ac51
cmp al, 0x26
je 0x50ac51
jmp 0x50accb
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x50ac51
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x50acc8
cmp al, 0x2f
je 0x50ac51
jmp 0x50accb
cmp al, 0x3d
ja 0x50ac49
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x50ac51
nop
cmp al, 0x3d
je 0x50ac51
jmp 0x50accb
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x50acc0
cmp rbx, 2
jg 0x50ac87
cmp rbx, 1
je 0x50ac81
nop dword [rax]
cmp rbx, 2
jne 0x50accb
cmp al, 0x2f
je 0x50ac72
cmp al, 0x3b
je 0x50ac72
cmp al, 0x2c
jne 0x50ac79
mov ecx, 1
jmp 0x50ac7e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x50acaa
cmp al, 0x40
je 0x50ac99
cmp al, 0x2f
je 0x50ac99
cmp al, 0x3f
jne 0x50aca2
mov ecx, 1
nop
jmp 0x50aca7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x50acb9
cmp rbx, 7
jne 0x50accb
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x50acc8
cmp al, 0x7e
jne 0x50accb
xor eax, eax
ret
cmp rbx, 7
jne 0x50ace1
cmp al, 0x21
je 0x50acdd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x50ace1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x50d540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d74b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x50d664
cmp rdx, 0x40
ja 0x50d73d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x50d5d4
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x50d640
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x0076a098]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x50d735
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x50d667
mov r8, rcx
cmp r8, 0x40
jl 0x50d6e5
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x0076a098]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x50d728
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x50d724
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_md5._digest_.Write
Function at 0x18025b62f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
add r10w, 0xc986
sub bl, ah
mov qword [rsp + 0x10], rdi
test spl, r10b
xor edi, edi
mov bl, sil
movzx ebx, r8b
movsxd r11, esp
movsx r9, r13w
mov r11, rcx
setge r8b
movzx r8w, r10b
mov r8, rdi
cmova r9, r8
nop
movzx r9d, byte [r11]
mov r10d, 0x3c26992b
inc r10b
movzx r10d, byte [rdx]
inc r11
jmp 0x18025b681
inc rdx
cmp r12d, edi
stc
test bl, bl
je 0x18025b6c6
mov ecx, r8d
clc
movsx eax, bp
rol ah, cl
mov eax, 0x4b32569b
cmc
clc
rol eax, cl
clc
test r10w, 0x1712
add al, r8b
cmp spl, 0xab
cmc
xor r9b, al
jmp 0x18025b6b9
inc r8
cmp di, 0x7704
jmp 0x18025b6c6
test r9b, r9b
jmp 0x18025b6ce
je 0x18025b6e2
cmp r9b, r10b
jmp 0x18025b6dc
je 0x18025b668
cmp r9b, r10b
jmp 0x18025b6ea
jae 0x18025b717
or eax, 0xffffffff
movzx ebx, r11w
movsx edi, bp
bswap rdi
mov rbx, qword [rsp + 8]
movzx edi, ax
movsx edi, bp
movsx rdi, r11w
mov rdi, qword [rsp + 0x10]
jmp 0x18025b716
ret
mov rbx, qword [rsp + 8]
seta dil
movsx ax, dh
mov eax, edi
movsx rdi, bx
mov rdi, qword [rsp + 0x10]
jmp 0x18025b734
ret
Function at 0x18026c896
Capabilities:
Hash data using murmur3

Disassembly:
shr rdx, 0x7a
adc r8, rbx
xor cx, bp
sar rax, cl
mov r10d, dword [r10 + r11 - 0x74280000]
pop r11
pop rdx
jnp fcn.180281242
neg bl
pop rbp
inc eax
rol bp, 0xa8
movzx edx, r11w
bswap eax
inc eax
mov qword [rsp + rbx + 0x3378ea00], r9
xor dword [rsp + rbx + 0x3378ea00], eax
movsx esi, r11b
shl ebp, 0x6f
pop r9
shl r11, 0x68
call fcn.1802c9e4c
mov rcx, qword [r10]
mov ebp, 0x750a3a96
and bp, bp
mov rax, qword [rbp + r10 - 0x750a3a8e]
sub ebp, ebp
mul rcx
push rbp
call fcn.1802c8666
mov rdx, qword [r10 + rbx*2 - 0x34]
not si
xchg r11d, eax
adc rcx, rdx
call fcn.18029be9d
mov esi, 0xed22bc90
movzx r11d, si
mov ebx, dword [rdi + r11 - 0xbc90]
movsx eax, r11w
push r11
xchg word [rsp + r11*2 - 0x1791e], r11w
lea rdi, [rdi + r11*2 + 4]
xor ebx, r9d
lea rdx, [rax*8 + 0x39a3c1b1]
bswap ebx
mov ebp, r11d
inc word [rsp + r11 + 6]
rol ebx, 2
sar word [rsp + r11*4 + 3], 3
sar word [rsp + r11*4 + 2], 0x8e
xor ebx, 0xab3ce19d
neg word [rsp + r11*4 + 5]
and ax, ax
push rbp
bswap ebx
xor dword [rsp + r11 + 4], 0x55a87428
mov ecx, r11d
xor r11d, eax
not ebx
dec qword [rsp + rbp*2 + 8]
shl cx, 0xa5
mov qword [rsp + rbp*8 + 8], r9
lea rdx, [rdx + rcx*2 - 0x13720efa]
lea r9, [r11*4 + 0x4f9acc1c]
xadd dword [rsp + rbp*4 + 2], r11d
xor dword [rsp + r11 - 0x7427fff8], ebx
add edx, 0x63e7ea6
mov r9, qword [rsp + r11 - 0x7427fff8]
movsxd rbx, ebx
or ebp, edx
jge 0x180263b54
mov ecx, dword [rdi]
mov eax, 0xe3071e2f
add rdi, 4
movsx esi, ax
lea r11, [rax*4 - 0x58da1beb]
movzx ebp, ax
xor ecx, r9d
lea ecx, [rcx + rax + 0x3f9ff0f]
bswap ecx
mov edx, esi
dec ecx
movsx ebx, bpl
dec rsi
xor ecx, 0x6c1d60a1
add edx, r11d
lea ecx, [rcx + rax - 0xb04c28b]
rol rsi, 0xf
ror al, 0x82
not esi
rol ecx, 3
dec dl
seto al
push r9
lea rax, [r11 + rbp*8 - 0x29f02763]
xor dword [rsp + rbp - 0x1e2f], ecx
call fcn.1802a5e25

Function at 0x18029f0ca
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0xffffffffb8a9be26
inc r11
shl dword [rsp + 1], 0x89
xor ebx, 0x44371797
mov qword [rsp + 8], 0xffffffffcd9be5bf
dec rsi
lea rsp, [rsp + 0x20]
jne 0x180268522
pop r9
mov edx, 0xd858aac
pop rdi

Function at 0x1802c0d3c
Capabilities:
Encode data using base64

Disassembly:
shr r11, cl
not ebx
mov qword [r10 + 2], r11
mov rbx, qword [r10 + 2]
movzx ecx, word [rdi]
xor cx, r9w
call fcn.1802ca38f
mov ecx, 0x9d0a39b8
movzx ebx, cx
movzx eax, cx
mov rdx, qword [r10 + rbx - 0x39b8]
mov esi, eax
mov cl, byte [rbx + r10 - 0x39b0]
bswap rax
mov ebp, 0xd7bf4e8c
shr rdx, cl
and esi, 0x2d22e7a7
call fcn.1802935ae

Function at 0x1802cbe3f
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rdx - 0x3e5400c7], rbx
mov qword [rsp + rdx*2 - 0x7ca8018e], r9
xor dword [rsp + rcx + 0xb881], eax
call fcn.180295aca
Function at 0x140001010
Capabilities:
Delete file
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor ebx, ebx
mov r14, r8
mov esi, edx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov rdi, rcx
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400010a1
lea rcx, [rsp + 0x50]
call fcn.140005ac0
lea rcx, str.Failed_to_CreateFile_:_pszTempFile___s
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea r9d, [rbx + 2]
lea r8, str.WriteTempFile
lea rdx, [rsp + 0x50]
mov ecx, eax
call fcn.140005b80
jmp 0x14000111f
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, r14
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400010d1
lea rcx, [rsp + 0x50]
call fcn.140005ac0
lea rcx, str.Failed_to_WriteFile_:_pszTempFile___s
jmp 0x1400010e8
cmp esi, dword [rsp + 0x40]
je 0x14000110d
lea rcx, [rsp + 0x50]
call fcn.140005ac0
lea rcx, str.Failed_to_WriteFile__cbData___dwWritten__:_pszTempFile___s
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea r8, str.WriteTempFile
lea rdx, [rsp + 0x50]
mov ecx, eax
mov r9d, 2
call fcn.140005b80
jmp 0x140001112
mov ebx, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140001128
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140006370
add rsp, 0x160
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400057b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [r11 - 0x18]
mov rdi, rdx
xor ebx, ebx
mov qword [r11 - 0x20], rax
lea rax, [r11 + 0x20]
lea r9, [r11 + 0x18]
lea rdx, str.DebugMsgLevel
xor r8d, r8d
mov rsi, rcx
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x68], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000580f
cmp dword [rsp + 0x60], 4
jne 0x14000580f
mov eax, dword [rsp + 0x68]
mov dword [rdi], eax
jmp 0x140005811
mov dword [rdi], ebx
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x60]
lea rdx, str.Msg_Level
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005861
cmp dword [rsp + 0x60], 4
jne 0x140005861
mov eax, dword [rsp + 0x68]
mov dword [rdi + 4], eax
jmp 0x140005864
mov dword [rdi + 4], ebx
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x60]
lea rdx, str.Msg_hWnd
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x30], 8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rsi, qword [rsp + 0x58]
test eax, eax
cmove rbx, qword [rsp + 0x38]
mov qword [rdi + 8], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140006000
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
lea rcx, [0x14001da98]
mov dword [0x14001da74], 1
mov dword [0x14001dac0], 3
mov qword [0x14001dac8], 0
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x14001da70], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, str.wxyz
mov rdx, rax
mov r8d, 4
call fcn.1400065c4
test eax, eax
je 0x140006066
xor eax, eax
add rsp, 0x50
pop rbx
ret
mov r9d, 0x64
lea r8, [0x14001dad0]
mov rcx, rbx
lea edx, [r9 + 9]
call qword [sym.imp.USER32.dll_LoadStringW]
mov rcx, rbx
call fcn.1400060f0
mov rcx, rbx
call fcn.140006190
test eax, eax
je 0x14000605e
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400060dd
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x1400060b0
call fcn.140005960
mov eax, dword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
Function at 0x4015dd
Capabilities:
Create thread
Hide graphical window
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov dword [rbp - 0x34], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
movabs rax, 0x6f736e6f43746547
mov qword [rbp - 0x80], rax
movabs rdx, 0x776f646e6957656c
mov qword [rbp - 0x78], rdx
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov byte [rbp - 0x40], 0
lea rdx, section..rdata
lea rcx, str.userdemo.png
call main
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
mov rax, qword [rbp - 8]
mov rcx, rax
call sub.msvcrt.dll_ftell
cdqe
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 8]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp - 0x28], rax
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov rax, qword [rbp - 0x20]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x30], rax
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x28]
lea rcx, [rbp - 0x80]
mov r9d, 0x41
mov r8, rcx
mov rcx, rax
call fcn.00401550
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x30]
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memmove
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x30]
lea rcx, [rbp - 0x34]
mov r9, rcx
mov r8d, 0x20
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
je 0x401792
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov eax, 0
add rsp, 0xb0
pop rbp
ret
Function at 0x4017a0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
call fcn.00401900
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_OpenEncryptedFileRawA]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0x7b
jne 0x4017d9
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
call rax
mov rcx, rax
lea rax, [rbp - 0x1c]
mov rdx, rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
lea rdx, str.rundemo
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
sete al
test al, al
je 0x401828
call fcn.004015dd
jmp 0x401832
mov ecx, 0
call sub.msvcrt.dll_exit
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov eax, 0
add rsp, 0x40
pop rbp
ret