joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058ec0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rax, dword [rdx + 0x10]
mov rbx, rdx
test eax, eax
jle 0x140058f34
mov rdx, qword [rdx + 0x18]
mov r8, rax
xor eax, eax
nop
mov rcx, rbx
cmp rdx, 0x10
jb 0x140058eec
mov rcx, qword [rbx]
cmp byte [rax + rcx], 0x61
jge 0x140058f04
mov rcx, rbx
cmp rdx, 0x10
jb 0x140058efe
mov rcx, qword [rbx]
cmp byte [rax + rcx], 0x41
jl 0x140058f2c
mov rcx, rbx
cmp rdx, 0x10
jb 0x140058f10
mov rcx, qword [rbx]
cmp byte [rax + rcx], 0x7a
jle 0x140058fa3
mov rcx, rbx
cmp rdx, 0x10
jb 0x140058f26
mov rcx, qword [rbx]
cmp byte [rax + rcx], 0x5a
jle 0x140058fa3
inc rax
cmp rax, r8
jl 0x140058ee0
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x140058f41
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov rdx, qword [rbx + 0x18]
mov edi, eax
cmp rdx, 0x10
jb 0x140058f83
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140058f7e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140058fff
mov rcx, r8
call fcn.14005a21c
mov eax, edi
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], send
mov byte [rbx], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
cmp rdx, 0x10
jb 0x140058faf
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rdx, qword [rbx + 0x18]
test rax, rax
je 0x140058fc9
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov edi, dword [rcx]
jmp 0x140058f4d
cmp rdx, 0x10
jb 0x140058ffb
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140058ff6
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140058fff
mov rcx, r8
call fcn.14005a21c
xor eax, eax
jmp 0x140058f85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140059bd0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x140284010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
lea r9, [rsp + 0x20]
mov r14, rcx
mov dword [rsp + 0x20], ebp
xor r8d, r8d
xor edx, edx
mov ebx, ebp
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140059c5e
nop dword [rax]
test rbx, rbx
je 0x140059c26
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, reloc.WS2_32.dll_inet_addr
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140059c10
test eax, eax
jns 0x140059c7f
test rbx, rbx
je 0x140059c84
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140059d76
test rbx, rbx
jne 0x140059c8b
xor eax, eax
jmp 0x140059d76
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x140059d56
mov esi, edi
lea rdx, [rbx + 0x30]
imul rax, rsi, 0x128
mov qword [rsp + 0x28], rbp
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], send
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
add rdx, rcx
inc r8
cmp byte [rdx + r8], bpl
jne 0x140059cd4
lea rcx, [rsp + 0x28]
call fcn.14003ccb0
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x140059cf4
mov rdx, qword [r14]
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140059d8c
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140059d4c
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059d47
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140059ddd
call fcn.14005a21c
inc edi
cmp edi, dword [rbx]
jb 0x140059ca2
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140059ea0
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
imul rax, rsi, 0x128
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rdi, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140059de9
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059de4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140059de4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a21c
mov rax, rdi
jmp 0x140059d69
Function at 0x140004ef0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x141992390]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor ebx, ebx
mov dword [rsp + 0x48], ebx
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140004ffa
mov qword [rsp + 0x50], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
lea rax, [0x1402d77f0]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140033460
mov rsi, rax
lea r8d, [rbx + 0x2b]
lea rdx, [0x1402d7868]
lea rcx, [rsp + 0x28]
call fcn.1400405f0
nop
lea rdx, [rsp + 0x28]
mov rcx, qword [rsi]
call fcn.140050a50
nop
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
test edx, edx
je 0x140004fbd
cmp edx, 0xffffffff
je 0x140004fd0
mov rax, qword [rsp + 0x28]
mov ebx, 0xffffffff
lock xadd dword [rax], ebx
cmp ebx, 1
jne 0x140004fd0
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x28]
call fcn.140049bf0
mov rcx, qword [rsi]
cmp byte [rcx + 0x20], 0
je 0x140004fe1
mov dl, 0x20
call fcn.140050ad0
nop
lea rcx, [rsp + 0x40]
call fcn.140047e10
lea rcx, [0x1401a1e20]
mov qword [rdi], rcx
jmp 0x14000509c
mov ebx, 0xffffffff
mov r8d, ebx
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140040590
nop
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
lea rcx, [0x1401a1e20]
mov qword [rax], rcx
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax]
test ecx, ecx
je 0x140005043
cmp ecx, ebx
je 0x140005057
mov rax, qword [rsp + 0x38]
mov ecx, ebx
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140005057
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x38]
call fcn.140049bf0
nop
mov r8d, 2
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140041340
nop
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax]
test ecx, ecx
je 0x140005089
cmp ecx, 0xffffffff
je 0x14000509c
mov rax, qword [rsp + 0x30]
lock xadd dword [rax], ebx
cmp ebx, 1
jne 0x14000509c
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x30]
call fcn.140049bf0
mov rax, rdi
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140121c90
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400050d0
Capabilities:
Contain obfuscated stackstrings
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x11d0]
mov eax, 0x12d0
call fcn.140122660
sub rsp, rax
mov rax, qword [0x141992390]
xor rax, rsp
mov qword [rbp + 0x11c0], rax
mov dword [rsp + 0x20], 0x360033
mov dword [rsp + 0x24], 0x740030
mov dword [rsp + 0x28], 0x610072
mov dword [rsp + 0x2c], 0x2e0079
mov dword [rsp + 0x30], 0x780065
mov dword [rsp + 0x34], reloc.WS2_32.dll_WSAAsyncSelect
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], di
lea r8d, [rdi + 8]
lea rdx, [0x1402d78c8]
lea rcx, [rsp + 0x60]
call fcn.140007d50
nop
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
lea r8d, [rdi + 0x53]
lea rdx, [0x1402d78e0]
lea rcx, [rsp + 0x40]
call fcn.140007d50
nop dword [rax]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005283
mov dword [rbp - 0x80], 0x238
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000527a
lea rcx, [rbp - 0x54]
lea r8, [rsp + 0x20]
sub r8, rcx
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x1400051e4
add rcx, 2
test eax, eax
jne 0x1400051d0
mov rcx, rbx
test edx, edx
je 0x1400051f7
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x1400051bc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x78]
test ebx, ebx
je 0x140005283
lea r8, [rsp + 0x38]
mov edx, 0x1000
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140005283
mov edx, dword [rsp + 0x38]
shr edx, 2
mov dword [rsp + 0x38], edx
mov ecx, edi
test edx, edx
je 0x140005283
mov eax, ecx
cmp dword [rbp + rax*4 + 0x1c0], ebx
je 0x140005247
inc ecx
cmp ecx, edx
jae 0x140005283
jmp 0x140005234
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae r8, qword [rsp + 0x60]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
xor ecx, ecx
lea r9d, [rcx + 0x40]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140005190
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400052c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005340
call fcn.140121cec
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140005316
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005311
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000533a
call fcn.140121cec
mov rcx, qword [rbp + 0x11c0]
xor rcx, rsp
call fcn.140121c90
lea r11, [rsp + 0x12d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1401285bc
nop
call fcn.1401285bc
nop
int3
Function at 0x14001806c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
and dword [rsp + 0x20], 0
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call fcn.1400109b8
and dword [rsi], 0
mov qword [rsp + 0x28], rax
call fcn.1400109b8
lea r8, [rsp + 0x20]
mov qword [rsi + 8], rax
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140017790
cmp dword [rsp + 0x60], 3
jne 0x1400180bc
xor al, al
jmp 0x140018122
cmp qword [rdi + 0x10], 0
je 0x140018109
cmp qword [rbx + 0x18], 8
jb 0x1400180cd
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x1400180d7
mov rdi, qword [rdi]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
test eax, eax
jne 0x140018120
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
call fcn.1400109b8
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movdqu xmmword [rsi], xmm0
jmp 0x1400180b8
cmp qword [rbx + 0x18], 8
jb 0x140018113
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1400180e6
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140018764
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
and dword [rdx], 0
mov rbx, rdx
mov rdi, rcx
call fcn.1400109b8
mov qword [rbx + 8], rax
cmp qword [rdi + 0x18], 8
jb 0x140018797
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1400187b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 2]
cmp ecx, 1
ja 0x1400187d7
xor al, al
jmp 0x140018835
test sil, 1
je 0x1400187f5
mov edx, esi
mov rcx, rdi
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1400187f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400187e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x10], eax
call fcn.1400109b8
mov qword [rbp - 8], rax
movups xmm0, xmmword [rbp - 0x10]
movdqu xmmword [rbx], xmm0
cmp dword [rbx], 0
jne 0x140018832
mov rcx, rdi
test sil, 0x10
je 0x14001880b
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140018811
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001882f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x10], eax
call fcn.1400109b8
mov qword [rbp - 8], rax
movups xmm0, xmmword [rbp - 0x10]
movdqu xmmword [rbx], xmm0
cmp dword [rbx], 0
sete al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x140019c78
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp qword [rcx + 0x10], rbx
jne 0x140019c8a
xor al, al
jmp 0x140019c9f
cmp qword [rcx + 0x18], 8
jb 0x140019c94
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
add rsp, 0x20
pop rbx
ret
Function at 0x14001af7c
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
and dword [r8], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
call fcn.1400109b8
mov qword [rdi + 8], rax
test rsi, rsi
jns 0x14001afc6
mov dword [rsp + 0x40], 0xdf
call fcn.1400109b8
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rdi], xmm0
jmp 0x14001b055
cmp qword [rbx + 0x18], 8
jb 0x14001afd0
mov rbx, qword [rbx]
and qword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14001b00c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
jmp 0x14001afae
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b02f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14001b04c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
call fcn.1400109b8
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rdi], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140036130
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
movzx edi, cl
cmp dword [section..data], 0xffffffff
jne 0x14003617d
lea rbx, [0x1419951d0]
mov rcx, rbx
call fcn.140069150
cmp dword [section..data], 0xffffffff
jne 0x140036171
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [section..data], eax
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.140069660
mov ecx, dword [section..data]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x14003622f
test dil, dil
je 0x14003622f
lea ecx, [rax + 0x78]
call fcn.140121cb0
mov qword [rsp + 0x78], rax
lea edx, [rsi + 1]
mov rcx, rax
call fcn.140037770
mov rsi, rax
mov qword [rsp + 0x88], rax
mov rdx, rax
mov ecx, dword [section..data]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov ecx, 0x10
call fcn.140121cb0
mov qword [rsp + 0x78], rax
mov rdx, rsi
mov rcx, rax
call fcn.1400375a0
nop
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsi + 0x38], rax
mov rcx, rsi
call fcn.140037d70
mov byte [rsi + 0x72], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
mov qword [rsi + 0x40], rax
mov rax, qword [0x141996658]
test rax, rax
jne 0x14003623a
mov rax, qword [rsi + 0x38]
mov qword [0x141996658], rax
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x78], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x78]
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rsi + 0x38]
mov rcx, qword [rsp + 0x78]
call fcn.140036990
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140052b10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140052b71
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140052b30
mov ecx, dword [r10]
jmp 0x140052c5a
cmp ecx, 0x4e0
jb 0x140052c5a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140052b90
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140052be0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140052ca0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbx
push rbp
push rdi
push r14
sub rsp, 0x28
mov ebx, dword [rcx]
mov rbp, r8
mov rdi, rdx
mov r14, rcx
call fcn.140053030
test ebx, ebx
je 0x140052d71
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r12
mov r12d, 1
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x20], r15
lea r15, [rax + 0x40]
cmp r14, r15
jne 0x140052cfb
call fcn.140053030
mov rcx, rax
xor eax, eax
lock cmpxchg qword [rcx], r12
je 0x140052cfb
call fcn.140069280
xor r13d, r13d
mov rsi, rbp
sub rsi, rdi
mov ebx, r13d
add rsi, 3
shr rsi, 2
cmp rdi, rbp
cmova rsi, r13
test rsi, rsi
je 0x140052d37
nop dword [rax + rax]
lea rcx, [r14 + 4]
call fcn.140052b10
inc rbx
mov dword [rdi], eax
lea rdi, [rdi + 4]
cmp rbx, rsi
jne 0x140052d20
mov rsi, qword [rsp + 0x58]
cmp r14, r15
mov r15, qword [rsp + 0x20]
jne 0x140052d5d
call fcn.140053030
mov rcx, rax
mov rax, r12
lock cmpxchg qword [rcx], r13
je 0x140052d5d
call fcn.1400696b0
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
add rsp, 0x28
pop r14
pop rdi
pop rbp
pop rbx
ret
lea rcx, [rax + 0xc]
mov r8, rbp
mov rdx, rdi
add rsp, 0x28
pop r14
pop rdi
pop rbp
pop rbx
jmp fcn.140052d90
Function at 0x140052d90
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov rsi, r8
mov r14, rdx
sub rsi, rdx
sar rsi, 2
xor ebx, ebx
mov ebp, ebx
mov rax, qword [0x141999038]
test rax, rax
jne 0x140052dd6
call fcn.1400bab40
nop
mov rax, qword [0x141999038]
bt rax, 0xc
jae 0x140052dec
mov rdx, rsi
mov rcx, r14
call fcn.1400bad30
nop
mov rbp, rax
cmp rbp, rsi
je 0x140052e6d
mov rdi, rsi
sub rdi, rbp
shl rdi, 2
lea rcx, [r14 + rbp*4]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
nop
mov rcx, rbx
test al, al
cmovne rcx, rdi
mov rax, rcx
cqo
and edx, 3
add rax, rdx
sar rax, 2
add rbp, rax
cmp rbp, rsi
je 0x140052e6d
lea rdi, [r14 + rbp*4]
sub rsi, rbp
lea rax, [rdi + rsi*4]
lea rsi, [rsi*4 + 3]
shr rsi, 2
cmp rdi, rax
cmova rsi, rbx
test rsi, rsi
je 0x140052e6d
nop dword [rax + rax]
lea rcx, [rsp + 0x58]
call fcn.14012d9b0
nop
mov eax, dword [rsp + 0x58]
mov dword [rdi], eax
lea rdi, [rdi + 4]
inc rbx
cmp rbx, rsi
jne 0x140052e50
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x140052f20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x9f0
mov rax, qword [0x141992390]
xor rax, rsp
mov qword [rsp + 0x9e0], rax
lea rsi, [rcx + 4]
xor ebx, ebx
mov dword [rsi], ebx
mov edi, 1
mov dword [rcx], edi
call fcn.140053030
mov ecx, 0x1571
mov dword [rsi + 0x1384], 0xffffffff
mov dword [rsi + 4], ecx
lea rdx, [rsi + 8]
mov r8d, 0x26f
lea r9, [rax + 0xc]
nop dword [rax + rax]
mov eax, ecx
lea rdx, [rdx + 4]
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edi
inc edi
mov dword [rdx - 4], ecx
sub r8, 1
jne 0x140052f80
lea r8, [rsp + 0x9e0]
mov dword [rsi], 0x270
lea rdx, [rsp + 0x20]
mov rcx, r9
call fcn.140052d90
lea rcx, [rsp + 0x20]
mov r9, rsi
sub r9, rcx
lea r8, [rsp + 0x20]
mov edx, ebx
nop dword [rax + rax]
mov eax, dword [r8]
mov ecx, eax
mov dword [r9 + r8 + 4], eax
lea r8, [r8 + 4]
or ecx, ebx
mov ebx, eax
shr ebx, 0x1f
test edx, edx
cmovne ebx, ecx
inc edx
cmp edx, 0x270
jb 0x140052fd0
test ebx, ebx
jne 0x140052fff
mov dword [rsi + 4], 0xffffffff
mov dword [rsi], 0x270
mov rcx, qword [rsp + 0x9e0]
xor rcx, rsp
call fcn.140121c90
lea r11, [rsp + 0x9f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400579b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0xb0
mov rax, qword [0x141992390]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x38]
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], 0
mov r9d, 0x20119
lea rdx, [0x1401a3870]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140057a92
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x1401a38b0]
lea rax, [rsp + 0x50]
mov qword [rsp + 0xc8], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x4a
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0xc8]
jne 0x140057a92
mov edx, dword [rsp + 0x30]
lea rax, [rsp + 0x50]
dec edx
mov qword [rsp + 0x48], rax
shr rdx, 1
mov rcx, rdi
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.14003f980
jmp 0x140057a9c
lea rax, [0x1401a1e20]
mov qword [rdi], rax
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140121c90
add rsp, 0xb0
pop rdi
ret