joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004ec40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14004ec6d
xor eax, eax
jmp 0x14004edd9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14004eca7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14004eca7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14004edd9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14004edcc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004ecea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14004ed15
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004edd1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004ed84
sub eax, 1
je 0x14004ed84
cmp eax, 2
jne 0x14004edcc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004edd1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14004edb2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14004edcc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14004edd1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14010e990
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14004f2d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14004f3a3
cmp byte [rcx + 0x71], 0
je 0x14004f3a3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14004f39f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004f364
sub eax, 1
je 0x14004f368
cmp eax, 2
jne 0x14004f39f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010e990
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14004f396
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004f39f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14004f34c
xor al, al
jmp 0x14004f34c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010e990
add rsp, 0x60
pop rbx
ret
Function at 0x14004ffb0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r15, rdx
xor r14d, r14d
mov dword [r11 - 0x48], r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov esi, r14d
mov qword [r11 - 0x40], r14
mov edi, r14d
mov qword [r11 - 0x38], r14
mov ebp, r14d
mov qword [r11 - 0x30], r14
lea r9, [r11 - 0x48]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140050098
nop dword [rax + rax]
mov ebx, dword [rsp + 0x20]
mov rcx, rdi
sub rcx, rsi
cmp rbx, rcx
jae 0x140050035
lea rdi, [rbx + rsi]
jmp 0x140050073
jbe 0x140050078
mov rax, rbp
sub rax, rsi
cmp rbx, rax
jbe 0x140050060
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140050620
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
jmp 0x140050078
sub rbx, rcx
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.14010fb17
add rdi, rbx
mov qword [rsp + 0x30], rdi
mov r8, rdi
sub r8, rsi
lea r9, [rsp + 0x20]
mov rdx, rsi
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140050020
test eax, eax
js 0x1400500ee
lea r9, [rsi + 8]
mov r10d, r14d
mov r11d, dword [rsi]
test r11d, r11d
je 0x1400500ee
nop dword [rax + rax]
movzx r8d, word [r9 + 0x26]
add r8, 0x28
add r8, r9
mov rax, r15
sub r8, r15
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400500d5
inc rax
test ecx, ecx
jne 0x1400500c2
test edx, edx
je 0x1400500ea
inc r10d
add r9, 0x128
cmp r10d, r11d
jb 0x1400500b0
jmp 0x1400500ee
mov r14, qword [r9 + 0x10]
test rsi, rsi
je 0x140050129
sub rbp, rsi
mov rax, rsi
cmp rbp, 0x1000
jb 0x14005011e
add rbp, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005011e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rbp
mov rcx, rsi
call fcn.14010ef38
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010e990
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x140050170
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r14, r8
mov rbp, rdx
mov rdx, r14
lea r8, [rsp + 0x20]
mov r9d, 0x40
mov rdi, rcx
call fcn.140050320
mov eax, 0x5a4d
cmp word [rsp + 0x20], ax
jne 0x14005030e
movsxd rdx, dword [rsp + 0x5c]
lea r8, [rsp + 0x60]
add rdx, r14
mov r9d, pe_nt_image_headers64
mov rcx, rdi
call fcn.140050320
cmp dword [rsp + 0x60], 0x4550
jne 0x14005030e
mov eax, 0x20b
cmp word [rsp + 0x78], ax
jne 0x14005030e
mov rbx, qword [rsp + 0xe8]
xor ecx, ecx
mov rdx, rbx
mov r13, rbx
shr rdx, 0x20
mov r8d, 0x3000
shr r13, 0x20
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, ebx
mov r9, r13
add rdx, r14
mov r15d, ebx
mov r8, rax
mov rcx, rdi
mov rsi, rax
call fcn.140050320
test rsi, rsi
je 0x14005030e
mov r10d, dword [rsi + 0x20]
mov r11, rsi
mov edi, dword [rsi + 0x24]
sub r11, r15
mov ebx, dword [rsi + 0x18]
add r10, r11
mov qword [rsp + 0x1c8], r12
add rdi, r11
mov r12d, dword [rsi + 0x1c]
xor r9d, r9d
add r12, r11
test rbx, rbx
je 0x1400502a3
mov r8d, dword [r10]
mov rax, rbp
add r8, r11
sub r8, rbp
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140050293
inc rax
test ecx, ecx
jne 0x140050280
test edx, edx
je 0x1400502e0
inc r9
add r10, 4
cmp r9, rbx
jb 0x140050270
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov r12, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14010e990
add rsp, 0x180
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx eax, word [rdi + r9*2]
mov ebx, dword [r12 + rax*4]
cmp rbx, r15
jb 0x1400502f7
lea rax, [r15 + r13]
cmp rbx, rax
jbe 0x1400502a3
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rax, [r14 + rbx]
jmp 0x1400502b6
xor eax, eax
jmp 0x1400502be
Function at 0x1400507a0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r14
push r15
mov rbx, qword [rcx + 0x38]
mov r9, rdx
xor r8d, r8d
mov r14, rcx
mov rax, qword [rbx + 0xb0]
lea rdx, [rbx + 0x18]
movzx r10d, word [rbx + 6]
mov qword [rsp + 0x20], rax
dec r10d
mov r11d, eax
movzx eax, word [rbx + 0x14]
add rdx, rax
test r10d, r10d
jle 0x1400507f4
nop
mov eax, dword [rdx + 0x34]
cmp r11, rax
jb 0x1400507f4
inc r8d
add rdx, 0x28
cmp r8d, r10d
jl 0x1400507e0
mov r15d, dword [rdx + 0x14]
xor esi, esi
mov eax, dword [rdx + 0xc]
sub r15, rax
add r15, r11
sub r9, qword [rbx + 0x30]
je 0x140050901
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140050901
mov qword [rsp + 0x28], rbp
mov ebp, eax
mov qword [rsp + 0x30], rdi
nop word [rax + rax]
mov rcx, qword [r14 + 0x38]
xor r8d, r8d
mov rbx, qword [r14]
add rbx, rsi
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
movzx r10d, word [rcx + 6]
add rdx, rax
mov r11d, dword [rbx + r15]
dec r10d
test r10d, r10d
jle 0x140050874
nop dword [rax]
mov eax, dword [rdx + 0x34]
cmp r11, rax
jb 0x140050874
inc r8d
add rdx, 0x28
cmp r8d, r10d
jl 0x140050860
mov edi, dword [rdx + 0x14]
lea r10, [r15 + 8]
mov eax, dword [rdx + 0xc]
lea r10, [r10 + rbx]
mov r8d, dword [rbx + r15 + 4]
sub rdi, rax
add rdi, r11
add rsi, 8
sub r8, 8
shr r8, 1
je 0x1400508ee
lea rsi, [rsi + r8*2]
nop
movzx ecx, word [r10]
mov eax, ecx
movzx edx, cx
and eax, 0xfff
shr edx, 0xc
add rax, qword [r14]
add rax, rdi
test edx, edx
je 0x1400508e4
sub edx, 1
je 0x1400508da
sub edx, 1
je 0x1400508d4
sub edx, 1
je 0x1400508cf
cmp edx, 7
jne 0x1400508e4
add qword [rax], r9
jmp 0x1400508e4
add word [rax], r9w
jmp 0x1400508e4
mov rcx, r9
shr rcx, 0x10
add word [rax], cx
add r10, 2
sub r8, 1
jne 0x1400508a0
cmp rsi, rbp
jb 0x140050830
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
pop r15
pop r14
pop rsi
ret
Function at 0x140050910
Capabilities:
Enumerate pe sections
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r15, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rdx
mov r8, qword [rcx + 0x38]
mov r10d, dword [r8 + 0x90]
movzx eax, word [r8 + 0x14]
lea rdx, [r8 + 0x18]
add rdx, rax
xor ecx, ecx
movzx r9d, word [r8 + 6]
dec r9d
test r9d, r9d
jle 0x140050973
mov eax, dword [rdx + 0x34]
cmp r10, rax
jb 0x140050973
inc ecx
add rdx, 0x28
cmp ecx, r9d
jl 0x140050960
mov r14d, dword [rdx + 0x14]
mov eax, dword [rdx + 0xc]
sub r14, rax
add r14, r10
add r14, qword [rsi]
cmp dword [r14 + 0xc], 0
je 0x140050b09
mov r11d, dword [r14 + 0xc]
mov rcx, qword [rsi + 0x38]
movzx eax, word [rcx + 0x14]
lea r10, [rcx + 0x18]
add r10, rax
mov rdx, r10
xor r8d, r8d
movzx r9d, word [rcx + 6]
dec r9d
test r9d, r9d
jle 0x1400509c8
mov eax, dword [rdx + 0x34]
cmp r11, rax
jb 0x1400509c8
inc r8d
add rdx, 0x28
cmp r8d, r9d
jl 0x1400509b4
mov ebp, dword [rdx + 0x14]
mov eax, dword [rdx + 0xc]
sub rbp, rax
add rbp, r11
mov r11, qword [rsi]
add rbp, r11
mov r8d, dword [r14 + 0x10]
mov rcx, r10
xor edx, edx
test r9d, r9d
jle 0x1400509fb
mov eax, dword [rcx + 0x34]
cmp r8, rax
jb 0x1400509fb
inc edx
add rcx, 0x28
cmp edx, r9d
jl 0x1400509e8
mov edi, dword [rcx + 0x14]
mov eax, dword [rcx + 0xc]
sub rdi, rax
add rdi, r11
add rdi, r8
mov eax, dword [r14]
test eax, eax
je 0x140050a47
mov edx, eax
xor ecx, ecx
test r9d, r9d
jle 0x140050a34
nop word [rax + rax]
mov eax, dword [r10 + 0x34]
cmp rdx, rax
jb 0x140050a34
inc ecx
add r10, 0x28
cmp ecx, r9d
jl 0x140050a20
mov ebx, dword [r10 + 0x14]
mov eax, dword [r10 + 0xc]
sub rbx, rax
add rbx, r11
add rbx, rdx
jmp 0x140050a4a
mov rbx, rdi
mov r9, qword [rbx]
test r9, r9
je 0x140050af0
nop word [rax + rax]
mov rax, r9
not rax
test rax, rax
jns 0x140050b00
mov rcx, qword [rsi + 0x38]
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
xor edx, edx
movzx r8d, word [rcx + 6]
dec r8d
test r8d, r8d
jle 0x140050aa3
nop dword [rax]
mov ecx, dword [rax + 0x34]
cmp r9, rcx
jb 0x140050aa3
inc edx
add rax, 0x28
cmp edx, r8d
jl 0x140050a90
mov edx, dword [rax + 0x14]
mov ecx, dword [rax + 0xc]
sub rdx, rcx
add rdx, qword [rsi]
lea rax, [rdx + 2]
add rax, r9
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbp
mov rcx, qword [r15 + 0x38]
test rcx, rcx
je 0x140050af9
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
mov qword [rdi], rax
add rbx, 8
add rdi, 8
mov r9, qword [rbx]
test r9, r9
jne 0x140050a60
add r14, 0x14
jmp 0x140050983
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rcx, qword [r15 + 0x38]
test rcx, rcx
je 0x140050b26
mov rax, qword [rcx]
cmp rcx, r15
setne dl
call qword [rax + 0x20]
mov qword [r15 + 0x38], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14010e990
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400517d0
Capabilities:
Encode data using xor
Unload driver

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov r8, rcx
mov dword [rbp - 0x55], 0xf000dd
mov ecx, 0x34
mov dword [rbp - 0x51], 0xe300e6
xor r10d, r10d
mov dword [rbp - 0x59], ecx
mov dword [rbp - 0x4d], 0xf500ec
mov eax, r10d
mov dword [rbp - 0x49], 0xfa00f3
mov r9d, 0x81
mov dword [rbp - 0x45], 0xd600f0
mov dword [rbp - 0x41], 0xed00e6
mov dword [rbp - 0x3d], 0xe600ee
mov dword [rbp - 0x39], 0xfe00e6
mov dword [rbp - 0x35], 0xce00f4
mov dword [rbp - 0x31], 0xcd00c0
mov dword [rbp - 0x2d], 0xc200c6
mov dword [rbp - 0x29], 0xd500d2
mov dword [rbp - 0x25], 0xd900c5
mov dword [rbp - 0x21], 0xee00ee
mov dword [rbp - 0x1d], 0xfb00ef
mov dword [rbp - 0x19], 0xd400f1
mov dword [rbp - 0x15], 0xcd00e2
mov dword [rbp - 0x11], 0xd000cd
mov dword [rbp - 0xd], 0xc900d7
mov dword [rbp - 9], 0xfb00cb
mov dword [rbp - 5], 0xde00cc
mov dword [rbp - 1], 0xff00f7
mov dword [rbp + 3], 0xdc00c8
mov dword [rbp + 7], 0xd900d9
mov dword [rbp + 0xb], 0xd700d2
mov dword [rbp + 0xf], 0xe800c0
mov dword [rbp + 0x13], 0xb5
nop dword [rax]
nop dword [rax + rax]
mov ecx, eax
lea rdx, [rbp - 0x55]
lea rdx, [rdx + rcx*2]
lea ecx, [r9 + rax]
inc eax
xor word [rdx], cx
mov ecx, dword [rbp - 0x59]
cmp eax, ecx
jb 0x1400518d0
mov word [rbp + rcx*2 - 0x55], r10w
lea rdx, [rbp - 0x55]
lea rcx, [rbp + 0x17]
call fcn.140052020
cmp qword [rbp + 0x2f], 8
lea rdx, [rbp + 0x17]
lea rcx, [rbp + 0x37]
cmovae rdx, qword [rbp + 0x17]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rbp + 0x37]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
test eax, eax
lea rcx, [rbp + 0x17]
setns bl
call fcn.140051a90
movzx eax, bl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14010e990
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rbp
ret
Function at 0x140051950
Capabilities:
Delete file
Delete registry key
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x60
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rsp + 0x50], rax
movdqa xmm0, xmmword [0x140122010]
xor edx, edx
movdqa xmm1, xmmword [0x140121780]
mov rdi, rcx
mov eax, 0x21
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x4c], 0xa2d2
movdqu xmmword [rsp + 0x2c], xmm0
movdqu xmmword [rsp + 0x3c], xmm1
test eax, eax
je 0x1400519b9
nop dword [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x2c]
add rcx, rax
lea eax, [rdx - 0x7f]
inc edx
xor byte [rcx], al
mov eax, dword [rsp + 0x28]
cmp edx, eax
jb 0x1400519a0
lea r8, [rsp + 0x20]
mov qword [rsp + 0x78], rbx
lea rdx, [rsp + 0x2c]
mov byte [rsp + rax + 0x2c], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140051a5b
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x1400519eb
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140051a5b
cmp qword [rdi + 0x38], 8
lea rdx, [rdi + 0x20]
mov rax, qword [rdx + 0x10]
jb 0x140051a22
mov rcx, qword [rdx]
mov rdx, rcx
lea r8, [rcx + rax*2]
jmp 0x140051a26
lea r8, [rdx + rax*2]
lea rcx, [rsp + 0x28]
call fcn.140051ee0
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x28]
mov ebx, eax
call fcn.14004f470
test ebx, ebx
je 0x140051a5b
mov al, 1
jmp 0x140051a5d
xor al, al
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14010e990
add rsp, 0x60
pop rdi
ret
Function at 0x140052370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rbx, rcx
mov qword [rbp - 0x28], rcx
xor edi, edi
mov ecx, 0x5e
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x44], 0xb0b0b0b0
mov dword [rsp + 0x48], 0xb0b0b0b0
mov dword [rsp + 0x4c], 0xeeeabab0
movdqa xmm0, xmmword [0x140121cb0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140122020]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x140121820]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1401213d0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x140121bf0]
movdqa xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0xdfeee4
mov eax, edi
nop dword [rax]
mov ecx, eax
lea rdx, [rsp + 0x44]
add rdx, rcx
lea ecx, [rax - 0x7f]
xor byte [rdx], cl
inc eax
mov ecx, dword [rsp + 0x40]
cmp eax, ecx
jb 0x140052410
mov byte [rsp + rcx + 0x44], dil
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rdi
lea rax, [rsp + 0x44]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x140052450
lea rdx, [rsp + 0x44]
lea rcx, [rbp]
call fcn.14004f9b0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov r9, qword [rbp + 0x10]
lea rcx, [r9 + 1]
xor edx, edx
div rcx
movsxd rcx, edx
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
cmp r9, rcx
jb 0x140052565
sub r9, rcx
mov r8d, 1
cmp r9, r8
cmovb r8, r9
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rdx, qword [rbp]
add rdx, rcx
lea rcx, [rbp - 0x48]
call fcn.14004f9b0
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x20]
call fcn.14004f100
nop
lea rcx, [rbp - 0x48]
call fcn.14004f470
cmp qword [rbp - 0x10], 0x26
jne 0x140052480
lea r9, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r9, qword [rbp - 0x20]
mov qword [rsp + 0x30], 1
lea rax, [0x14011f9d4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x26
mov rcx, rbx
call fcn.14004fe00
nop
lea rcx, [rbp - 0x20]
call fcn.14004f470
nop
lea rcx, [rbp]
call fcn.14004f470
mov rax, rbx
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.14010e990
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14004f550
nop
int3
Function at 0x14006b3b0
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movdqa xmm0, xmmword [0x140121850]
xor ebx, ebx
movdqa xmm1, xmmword [0x140121280]
mov edx, ebx
mov eax, 0x35
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x1c], 0x9b93c6d0
mov dword [rbp - 0x18], 0xb6d3
movdqu xmmword [rbp - 0x4c], xmm0
movdqa xmm0, xmmword [0x140121a00]
movdqu xmmword [rbp - 0x2c], xmm0
movdqu xmmword [rbp - 0x3c], xmm1
test eax, eax
je 0x14006b437
nop dword [rax]
nop word [rax + rax]
mov eax, edx
lea rcx, [rbp - 0x4c]
add rcx, rax
lea eax, [rdx - 0x7f]
inc edx
xor byte [rcx], al
mov eax, dword [rbp - 0x50]
cmp edx, eax
jb 0x14006b420
lea rcx, [rbp - 0x4c]
mov byte [rbp + rax - 0x4c], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140121cc0]
mov edx, ebx
movdqa xmm1, xmmword [0x1401217e0]
mov eax, 0x3e
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x140121330]
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x4c], 0xa4e4e7f3
mov dword [rbp - 0x48], 0xedebe3e1
mov dword [rbp - 0x44], 0xc4abeffd
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0xbfd892
test eax, eax
je 0x14006b4b7
nop word [rax + rax]
mov eax, edx
lea rcx, [rbp - 0x4c]
add rcx, rax
lea eax, [rdx - 0x7f]
inc edx
xor byte [rcx], al
mov eax, dword [rbp - 0x50]
cmp edx, eax
jb 0x14006b4a0
lea rcx, [rbp - 0x4c]
mov byte [rbp + rax - 0x4c], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140121cc0]
movdqa xmm1, xmmword [0x1401217e0]
mov eax, 0x3a
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x140120cc0]
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x4c], 0xa4e4e7f3
mov dword [rbp - 0x48], 0xedebe3e1
mov dword [rbp - 0x44], 0xc4abeffd
movdqa xmmword [rbp - 0x30], xmm1
test eax, eax
je 0x14006b527
nop dword [rax]
mov eax, ebx
lea rcx, [rbp - 0x4c]
add rcx, rax
lea eax, [rbx - 0x7f]
inc ebx
xor byte [rcx], al
mov eax, dword [rbp - 0x50]
cmp ebx, eax
jb 0x14006b510
lea rcx, [rbp - 0x4c]
mov byte [rbp + rax - 0x4c], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x14006b550
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x28]
mov rsi, rcx
mov dword [rsp + 0x28], 0x101
lea rcx, [rsp + 0x30]
xor r14d, r14d
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov rbx, 0xffffffffffffffff
mov qword [rsi + 0x18], r14
nop
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x14006b5b0
movabs rbp, 0x7ffffffffffffffe
cmp rbx, rbp
ja 0x14006b67a
mov qword [rsi + 0x18], 7
cmp rbx, 8
jae 0x14006b5f9
mov qword [rsi + 0x10], rbx
lea rdx, [rsp + 0x30]
add rbx, rbx
mov rcx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], r14w
jmp 0x14006b653
mov rax, rbx
mov qword [rsp + 0x278], rdi
or rax, 7
cmp rax, rbp
ja 0x14006b61c
mov ecx, 0xa
mov rbp, rax
cmp rax, rcx
cmovb rbp, rcx
lea rdx, [rbp + 1]
call fcn.140052280
mov qword [rsi + 0x10], rbx
lea rdx, [rsp + 0x30]
add rbx, rbx
mov qword [rsi], rax
mov r8, rbx
mov qword [rsi + 0x18], rbp
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r14w
mov rdi, qword [rsp + 0x278]
mov rax, rsi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14010e990
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
call fcn.14004c210
int3