joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7418ff70
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x10], 0x32528592
xor ebx, dword [rbp - 0x10]
sub edi, 0x4c1ca012
xor edx, ebx
xor eax, 0xbd586160
xor ecx, 0x6a6a5f8b
sub esi, 0xb8efa3de
add ebx, ecx
add ebx, esi
and ebx, 0x10
je 0x7ff74182246
sub ebx, 0x38f08af7
xor edi, esi
rol edx, 7
add ebx, edi
add ebx, ecx
and ebx, 0x800
or byte [rax], al
add byte [rdi], cl
test byte [rsi], cl
add byte [r8], r8b
ror ecx, 0x19
rol edx, 7
xor ecx, 0xe11f662d
add ebx, ecx
add ebx, edi
and ebx, 0x80000000
je 0x7ff74186b1a
rol ecx, 0xd
rol ecx, 5
ror eax, 0x1d
jmp 0x7ff74183ebb
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x113e841
jmp 0x7ff74182f85

Function at 0x7ff741901b8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub ecx, 0xd09863a0
rol ecx, 4
sub edi, 0xfbdee666
rol ecx, 0x11
add ebx, edx
add ebx, eax
add ebx, edi
and ebx, 0x2000
je fcn.7ff74182947
rol esi, 7
xor ecx, 0x117cbae1
ror esi, 0x13
add ebx, 0x7bba14f8
jmp 0x7ff741868fe
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r13d, r13d
mov r12, rdx
mov rdi, rcx
cmp word [rcx], r13w
je 0x7ff7419cdf8
cmp rdx, r13
je 0x7ff7419cdf8
mov qword [rdx], r13
lea rdx, [rsp + 0x20]
call fcn.7ff74193430
lea ebx, [r13 + 0x5c]
cmp eax, r13d
jne 0x7ff74181d82
cmp word [rdi], bx
je 0x7ff74197963
mov rcx, rdi
call fcn.7ff74190148
cmp eax, r13d
jne 0x7ff741a076c
mov r9d, 4
lea r10, [0x7ff741d0b58]
mov r8, rdi
movzx ecx, word [r8]
add r8, 2
lea eax, [rcx - 0x41]
cmp eax, 0x19
ja 0x7ff7419024a
add ecx, 0x20
movzx edx, word [r10]
add r10, 2
lea eax, [rdx - 0x41]
cmp eax, 0x19
jbe 0x7ff741a0775
sub r9d, 1
je 0x7ff7419026d
cmp ecx, r13d
je 0x7ff7419026d
cmp ecx, edx
je 0x7ff74190237
cmp ecx, edx
mov eax, r13d
sete al
cmp eax, r13d
jne 0x7ff741a077d
movzx ecx, word [rdi]
call sub.ntdll.dll_iswalpha
cmp eax, r13d
je 0x7ff7419cdf8
cmp word [rdi + 2], 0x3a
jne 0x7ff7419cdf8
add rdi, 4
cmp word [rdi], bx
jne 0x7ff741902a7
add rdi, 2
mov qword [r12], rdi
xor eax, eax
jmp 0x7ff741902af
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.7ff741947a0
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp word [rdi + 2], bx
jne 0x7ff741902a3
jmp 0x7ff74190216
mov eax, 0x80070057
jmp 0x7ff741902af
add rdi, 0x60
jmp 0x7ff7419029e
add edx, 0x20
jmp 0x7ff7419025e
add rdi, 8
jmp 0x7ff7419027e

Function at 0x7ff741908f8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x10], 0x551d3567
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x113e841
jmp 0x7ff74186989
Function at 0x7ff74190ce0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x113e841
jmp 0x7ff74182cae

Function at 0x7ff74190d70
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
or cl, al
invalid
mov esp, ebp
sub rsp, 0x20
add dword [rbp - 8], 1
mov ebx, 0x37d420d1
mov dword [rbp - 0x10], 0x77da0913
mov edx, 0xb60c4ed7
mov esi, 0xc246133a
mov edi, 0xe7344c97
mov eax, dword [rbp - 8]
mov ecx, 0xeb44d5a2
jmp fcn.7ff7418a400
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebp, ebp
mov rbx, rcx
cmp rcx, rbp
je 0x7ff74190eb5
movzx ecx, word [rcx]
cmp cx, bp
je 0x7ff74190eb5
call sub.ntdll.dll_iswalpha
lea esi, [rbp + 3]
lea rdi, [0x7ff741d0810]
lea r12d, [rbp + 1]
cmp eax, ebp
je 0x7ff74190e33
mov r10d, esi
mov r9, rdi
lea rcx, [rbx + 2]
movzx edx, word [rcx]
add rcx, 2
lea eax, [rdx - 0x41]
cmp eax, 0x19
jbe 0x7ff74191749
movzx r8d, word [r9]
add r9, 2
lea eax, [r8 - 0x41]
cmp eax, 0x19
jbe 0x7ff741a0689
sub r10d, r12d
je 0x7ff74190e02
cmp edx, ebp
je 0x7ff74190e02
cmp edx, r8d
je 0x7ff74190dcc
cmp edx, r8d
mov ecx, ebp
sete cl
cmp ecx, ebp
je 0x7ff74190e33
mov eax, r12d
jmp 0x7ff74190e13
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.7ff741947a0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp word [rbx], 0x5c
je 0x7ff74181c62
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.7ff74193430
cmp eax, ebp
jne 0x7ff74181c71
mov r9d, 4
lea r10, [0x7ff741d0b58]
mov r8, rbx
movzx ecx, word [r8]
add r8, 2
lea eax, [rcx - 0x41]
cmp eax, 0x19
ja 0x7ff74190e75
add ecx, 0x20
movzx edx, word [r10]
add r10, 2
lea eax, [rdx - 0x41]
cmp eax, 0x19
jbe 0x7ff741a0692
sub r9d, r12d
je 0x7ff74190e96
cmp ecx, ebp
je 0x7ff74190e96
cmp ecx, edx
je 0x7ff74190e62
cmp ecx, edx
mov eax, ebp
sete al
cmp eax, ebp
jne 0x7ff741a069a
mov rcx, rbx
call fcn.7ff74190148
cmp eax, ebp
jne 0x7ff741a06f5
xor eax, eax
jmp 0x7ff74190e13
add edx, 0x20
jmp 0x7ff74190ddf
add r8d, 0x20
jmp 0x7ff74190df4
add edx, 0x20
jmp 0x7ff74190e89
movzx ecx, word [rbx + 8]
call sub.ntdll.dll_iswalpha
cmp eax, ebp
je 0x7ff74190ea5
lea r8, [rbx + 0xa]
movzx ecx, word [r8]
add r8, 2
lea eax, [rcx - 0x41]
cmp eax, 0x19
ja 0x7ff741a06c2
add ecx, 0x20
movzx edx, word [rdi]
add rdi, 2
lea eax, [rdx - 0x41]
cmp eax, 0x19
ja 0x7ff741a06d4
add edx, 0x20
sub esi, r12d
je 0x7ff741a06e1
cmp ecx, ebp
je 0x7ff741a06e1
cmp ecx, edx
je 0x7ff741a06af
cmp ecx, edx
mov eax, ebp
sete al
cmp eax, ebp
je 0x7ff74190ea5
jmp 0x7ff74190e0e
cmp word [rbx + 0x60], 0x5c
jne 0x7ff74190eb5
cmp word [rbx + 0x62], bp
jne 0x7ff74190eb5
jmp 0x7ff74190e0e

Function at 0x7ff74190f44
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
invalid
Function at 0x7ff74190fec
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0xeb44d5a2
mov rsp, rbp
mov ebx, 0x37d420d1
sub rsp, 0x20
mov edx, 0xb60c4ed7
add dword [rbp - 8], 1
mov edi, 0xe7344c97
mov eax, dword [rbp - 8]
mov dword [rbp - 0x10], 0x77da0913
mov esi, 0xc246133a
jmp fcn.7ff7418a400
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x113e841
jmp 0x7ff74183bd8
Function at 0x7ff74191660
Capabilities:
Query or enumerate registry value

Disassembly:
mov r9d, 0x20019
mov qword [rsp + 0x20], rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExA]
nop
jmp 0x7ff741916fd
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x54]
xor r8d, r8d
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov rdx, r13
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x7ff7419171d
mov edx, dword [rsp + 0x50]
test edx, edx
je 0x7ff7419171d
mov rcx, rbx
call fcn.7ff741900dc
test eax, eax
js 0x7ff7419dfbe
mov rcx, qword [rdi]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x18]
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExA]
mov r11d, dword [rsp + 0x50]
mov dword [rbx + 0x24], r11d
jmp 0x7ff7419171d
mov rcx, qword [rdi]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
and qword [rdi], 0
jmp 0x7ff74191725
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov esi, r9d
mov r13, r8
mov rbp, rdx
mov r12, rcx
test rcx, rcx
je 0x7ff7419dfc9
xor edx, edx
xor ecx, ecx
call fcn.7ff74190014
mov rbx, rax
test rax, rax
je 0x7ff7419dfc9
mov dword [rax + 0x2c], esi
test rbp, rbp
je 0x7ff741a4f4c
cmp byte [rbp], 0
je 0x7ff741a4f4c
xor r8d, r8d
lea rdi, [rax + 0x30]
mov rdx, rbp
mov rcx, r12
test sil, 3
je 0x7ff7418b7ea
and qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdi
and qword [rsp + 0x30], r8
xor r9d, r9d
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], r8d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExA]
jmp 0x7ff741916fd
test eax, eax
jne 0x7ff7419dfb5
mov rcx, qword [rdi]
test rcx, rcx
je 0x7ff7419dfbe
and esi, 3
cmp esi, 1
jne 0x7ff7418b801
test esi, esi
je 0x7ff7418b87b
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff741947a0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
and qword [rdi], 0
jmp 0x7ff74191705
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x7ff7419dfc9
xor eax, eax
jmp 0x7ff74191728
mov rcx, r12
lea rdi, [rax + 0x30]
call sym.SHLWAPI.dll_SHRegDuplicateHKey
mov qword [rdi], rax
jmp 0x7ff74191705
Function at 0x7ff74191a88
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x10], 0x7262f435
xor ebx, dword [rbp - 0x10]
add edx, 0x4185b72f
sub edx, 0x9e0d685b
sub eax, 0xaf1bcf91
add edi, 0x1d81f23c
add ebx, ecx
add ebx, eax
add ebx, edi
and ebx, 2
je fcn.7ff74186bca
ror ebx, 0x19
ror edi, 0x17
rol eax, 0xd
add ebx, edx
add ebx, edi
and ebx, 0x40000
je fcn.7ff74185b03
add edx, 0xeedc4d3c
xor eax, 0xdcaeb91
sub edx, 0x44c60c53
add eax, 0x34c908c7
xor edx, dword [rbp - 8]
add ebx, ecx
add ebx, eax
add ebx, edi
and ebx, 0x20000
je 0x7ff741818b7
xor edx, ebx
rol eax, 0x1e
add eax, 0x46f24916
sub edx, 0xa38bf46f
rol ebx, 4
jmp fcn.7ff7418320c
mov esi, 0xe981ffff
push rbp
in al, dx
cmp dword [0x7ffde7b7442], 0xffffffe0
stc
cmp eax, 0x6a62ea81
loopne 0x7ff741889bb
add edx, 0xbe4cd688
sub esi, 0xf03617da
add esi, 0xb910f035
add ebx, ecx
add ebx, esi
and ebx, 0x1000
je 0x7ff74186c56
add byte [rdi], cl
test byte [rdx - 0x1e], dh
invalid
rol edi, 4
add ecx, 0x7fbf988e
add ebx, 0x1cf5743b
add edi, 0x93d5fa5c
sub ebx, 0x18d99aea
add ebx, ecx
add ebx, eax
add ebx, edi
and ebx, 0x10000
je 0x7ff741874df
sub esi, 0x9b67325d
ror ebx, 0x1e
add esi, 0xbfb6c6e1
ror ebx, 0xe
ror esi, 0x12
jmp fcn.7ff74189d13
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbp, rdx
mov rsi, rcx
cmp rdx, rdi
je 0x7ff74191b5b
cmp rcx, rdi
je 0x7ff74191b5b
bt r8d, 0x10
jb 0x7ff74191ac4
cmp word [rdx], 0x20
je 0x7ff741a1776
movzx eax, word [rcx]
mov ecx, 0x2a
mov word [rsp + 0x48], ax
lea edx, [rcx + 0x15]
cmp ax, di
je 0x7ff741889dd
cmp word [rbp], di
je 0x7ff741889d4
movzx eax, word [rbp]
cmp eax, ecx
jne 0x7ff74191b32
cmp word [rbp + 2], di
je 0x7ff741889e7
cmp word [rbp + 2], 0x2e
jne 0x7ff741a17da
cmp word [rbp + 4], cx
je 0x7ff741a17cb
movzx eax, word [rsi]
cmp ax, di
je 0x7ff74191b5b
mov ebx, dword [rsp + 0x50]
add rsi, 2
cmp ax, 0x2e
je 0x7ff74191c3c
mov ax, word [rsi]
cmp ax, di
jne 0x7ff74191b1a
jmp 0x7ff74191b5b
cmp eax, edx
je 0x7ff741889bb
movzx ecx, word [rbp]
call qword [sym.imp.USER32.dll_CharUpperW]
movzx ecx, word [rsp + 0x48]
mov rbx, rax
call qword [sym.imp.USER32.dll_CharUpperW]
cmp rbx, rax
je 0x7ff741889b3
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rbp + 4]
mov r8d, ebx
mov rcx, rsi
call fcn.7ff74191a88
cmp eax, edi
je 0x7ff74191b28
jmp 0x7ff741889e7
add rbp, 2
cmp word [rbp], 0x20
jne 0x7ff74191ac4
jmp 0x7ff741a1776
cmp word [rbp + 6], di
jne 0x7ff74191b0e
jmp 0x7ff741889e7
cmp word [rsi], di
je 0x7ff74191b5b
mov ebx, dword [rsp + 0x50]
lea rdx, [rbp + 2]
mov r8d, ebx
mov rcx, rsi
call fcn.7ff74191a88
cmp eax, edi
jne 0x7ff741889e7
add rsi, 2
cmp word [rsi], di
jne 0x7ff741a17e7
jmp 0x7ff74191b5b

Function at 0x7ff74192a54
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x113e841
jmp 0x7ff74181600
Function at 0x7ff74192acc
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x113e841
jmp 0x7ff74183d99

Function at 0x7ff74193280
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
adc dword [rcx], 0xdc7c14b
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x38], rax
and qword [rdx], 0
mov rsi, rdx
mov rdi, rcx
mov ebx, 0x80004005
test rcx, rcx
je 0x7ff741932e8
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
lea rdx, [0x7ff741d0b40]
call qword [rax]
test eax, eax
js 0x7ff741815d1
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx]
mov ebx, eax
call qword [rdx + 0x10]
jmp 0x7ff741932e8
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff741947a0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x7ff74193e14
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
js 0x7ff74189db0
mov bh, 0x81
invalid
fidivr word [rdi - 0x38cec865]
xor ecx, ebx
ror ecx, 9
xor eax, eax
cmp rcx, rax
je 0x7ff7418a8c5
cmp word [rcx], 0x5c
je 0x7ff74181dda
cmp word [rcx], ax
je 0x7ff7418a8c5
cmp word [rcx + 2], 0x3a
jne 0x7ff7418a8c5
mov edx, 0x61
cmp word [rcx], dx
jae 0x7ff74189dad
mov edx, 0x41
cmp word [rcx], dx
jb 0x7ff7418a8c5
cmp word [rcx], 0x5a
ja 0x7ff7418a8c5
movzx eax, word [rcx]
sub eax, edx
ret
Function at 0x7ff74193ef0
Capabilities:
Encrypt data using chaskey
Encrypt data using speck
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
rol dword [rcx], cl
and ebx, 0x800000
invalid
pop rbp
invalid
test bl, al
invalid
invalid
add ebx, ecx
add ebx, edi
and ebx, 0x40000000
je fcn.7ff74188306
add esi, 0x42a0810b
rol ecx, 6
rol esi, 0x12
jmp fcn.7ff74183a40
add dword [rbp - 0x10], 0x3ff770a7
xor ebx, dword [rbp - 0x10]
sub ecx, 0x9b7398c8
rol ebx, 8
sub ebx, 0x587632d9
sub edi, 0x536b5af
add ebx, edx
add ebx, ecx
add ebx, edi
and ebx, 0x10000000
je 0x7ff741874df
rol ecx, 0xb
ror edx, 0xd
rol ebx, 0x19
sub ebx, 0x872cd481
xor ebx, 0xf9d61b86
add ebx, ecx
add ebx, eax
add ebx, esi
and ebx, 0x10000000
je 0x7ff7418a2ec
rol edx, 0x12
add edx, 0x53a57e60
xor eax, ecx
ror edx, 0x1f
sub edi, 0xe5657ef4
add ebx, edi
add ebx, ecx
and ebx, 0x100
je 0x7ff74185264
ror esi, 0x14
add esi, 0xf0b71354
sub esi, 0xaff05539
ror edi, 0x10
sub edi, 0xe2afd4ec
jmp 0x7ff741895a9
add dword [rbp - 0x10], 0xe2e3741f
xor ebx, dword [rbp - 0x10]
rol ecx, 0x11
add edx, 0x4dbecd83
rol ecx, 0x14
sub eax, 0x5a257b5b
add ebx, edi
add ebx, eax
and ebx, 0x800
je 0x7ff7418156f
sub ecx, 0x794e25d1
rol eax, 0xc
sub edi, 0x63b6c628
add eax, 0xa19d811a
add ebx, ecx
add ebx, eax
and ebx, 0x800
je fcn.7ff74186fb9
rol edx, 0x16
xor edx, 0xb7cc9a6f
add edx, 0xb721a570
sub edx, 0x456f3593
add edi, 0xb3377c7f
add ebx, ecx
add ebx, edi
and ebx, 0x2000000
je fcn.7ff74186bca
xor edi, 0xa3347a16
xor edx, eax
xor ebx, edx
ror edx, 0x19
jmp fcn.7ff741845f3
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp ecx, 0x15
jbe 0x7ff74188148
cmp ecx, 0x20
ja 0x7ff74186cee
je 0x7ff741a56d2
cmp ecx, 0x1b
jbe 0x7ff74181e6c
sub ecx, 0x1c
mov edi, 1
je 0x7ff74182883
sub ecx, edi
jne 0x7ff741a5657
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebx, eax
test eax, eax
je 0x7ff74193f7c
mov al, byte [rsp + 0x16a]
cmp al, 3
je 0x7ff74186d51
cmp al, 2
je 0x7ff74186d51
jmp 0x7ff74193f78
xor ebx, ebx
jmp 0x7ff74193f7c
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.7ff741947a0
mov rbx, qword [rsp + 0x190]
add rsp, 0x180
pop rdi
ret
sub ecx, edi
je 0x7ff741a5693
cmp ecx, edi
jne 0x7ff74193f78
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebx, eax
test eax, eax
je 0x7ff74193f7c
mov ebx, dword [rsp + 0x168]
mov ecx, 0x400
and ebx, ecx
jmp 0x7ff74193f7c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and qword [rsp + 0x20], 0
mov r9d, 8
lea edx, [r9 + 0x12]
lea r8, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x7ff74193f78
cmp qword [rsp + 0x48], 0
jmp 0x7ff741881b7
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebx, eax
test eax, eax
je 0x7ff74193f7c
mov ebx, dword [rsp + 0x168]
and ebx, 0x20
jmp 0x7ff74193f7c
Function at 0x7ff741940a0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x10], 0xa3a969e0
xor ebx, dword [rbp - 0x10]
xor edi, 0xd5e56785
ror eax, 0x10
ror edi, 0x10
add ebx, eax
add ebx, edi
and ebx, 0x8000
je fcn.7ff74188306
xor edx, ecx
add esi, 0xab850240
ror edi, 2
sub eax, 0xe365453e
add ebx, esi
add ebx, ecx
add ebx, edi
and ebx, 0x40000
je 0x7ff74189e2c
sub esi, 0xc72387d0
rol ecx, 0x15
xor ecx, 0x4ae0d8df
add ebx, ecx
add ebx, edx
add ebx, edi
and ebx, 0x800
je 0x7ff74182836
xor ecx, 0xb376521a
xor ebx, edx
sub eax, 0xab231c31
ror edx, 0x1b
sub ebx, 0xb8658a6f
jmp fcn.7ff74185619
add dword [rbp - 0x10], 0x9553821f
xor ebx, dword [rbp - 0x10]
add ebx, 0x25b99c97
add eax, 0xa7c94824
ror edi, 0xd
ror edi, 4
xor edx, dword [rbp - 8]
add ebx, eax
add ebx, edx
add ebx, edi
and ebx, 0x2000000
je 0x7ff7418134e
xor edi, 0xbe4db56f
sub ebx, 0xe84c8e4a
ror ebx, 0x1e
add ebx, ecx
add ebx, edi
and ebx, 0x10000
je 0x7ff741857a3
rol esi, 0xb
ror esi, 0xe
sub ecx, 0xdb6ac779
ror ebx, 0x1b
add ebx, edi
add ebx, esi
and ebx, 0x400
je 0x7ff74186260
sub eax, 0xb837f3b
ror edi, 9
rol eax, 4
rol edi, 0xd
ror edx, 4
jmp fcn.7ff74183a40
mov edi, 0xe7344c97
mov edx, 0xb60c4ed7
mov ecx, 0xeb44d5a2
mov esi, 0xc246133a
mov ebx, 0x37d420d1
mov rsp, rbp
sub rsp, 0x20
mov dword [rbp - 0x10], 0x77da0913
lock adc ecx, dword [rcx]
fidiv dword [rdi - 1]
clc
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 8], 0x113e841
jmp 0x7ff74183296
Function at 0x7ff7419441c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
je 0x7ff74183e29
add byte [rax], al
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor r13d, r13d
mov rdi, r8
mov rsi, rcx
cmp rcx, r13
je 0x7ff741a0d7f
cmp rdx, r13
je 0x7ff741a0d7f
mov rbx, r13
cmp r8, r13
jne 0x7ff74197994
cmp word [rcx], 0x5c
mov r8, rcx
je 0x7ff74182287
cmp word [rdx], 0x5c
je 0x7ff741822b0
movzx eax, word [r8]
mov rbp, r8
jmp 0x7ff7419447b
cmp ax, r13w
je 0x7ff74194491
cmp ax, 0x5c
je 0x7ff74194491
add rbp, 2
mov ax, word [rbp]
jmp 0x7ff7419447b
movzx eax, word [rdx]
mov r12, rdx
jmp 0x7ff74194499
cmp ax, r13w
je 0x7ff741944b0
cmp ax, 0x5c
je 0x7ff741944b0
add r12, 2
mov ax, word [r12]
jmp 0x7ff74194499
mov r9, rbp
mov rcx, r12
sub r9, r8
sub rcx, rdx
sar r9, 1
sar rcx, 1
movsxd rax, r9d
cmp rax, rcx
jne 0x7ff74194508
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rdx
mov ecx, 0x400
mov edx, 0x10000001
call qword [sym.imp.KERNEL32.dll_CompareStringW]
sub eax, 2
jne 0x7ff74194508
mov rbx, rbp
cmp word [rbp], r13w
je 0x7ff74194508
lea r8, [rbp + 2]
cmp word [r12], r13w
je 0x7ff74194508
lea rdx, [r12 + 2]
jmp 0x7ff74194472
cmp rbx, r13
je 0x7ff74194545
sub rbx, rsi
sar rbx, 1
cmp ebx, 2
jne 0x7ff7419451f
mov ebx, 3
jmp 0x7ff7419451f
cmp rdi, r13
jne 0x7ff7419799d
mov eax, ebx
jmp 0x7ff7419452c
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
mov ebx, r13d
jmp 0x7ff7419451f
mov word [r8], r13w
jmp 0x7ff7419445b
mov eax, 0x104
cmp ebx, eax
jge 0x7ff74194528
movsxd rcx, ebx
cmp rcx, 0x7ffffffe
ja 0x7ff741979e3
sub rsi, rdi
cmp rcx, r13
je 0x7ff741979da
movzx edx, word [rsi + rdi]
cmp dx, r13w
je 0x7ff741979da
dec rax
mov word [rdi], dx
dec rcx
add rdi, 2
cmp rax, r13
jne 0x7ff741979b9
cmp rax, r13
je 0x7ff741a0d76
mov word [rdi], r13w
jmp 0x7ff74194528
sub rdi, 2
jmp 0x7ff741979e3
xor eax, eax
jmp 0x7ff7419452c
Function at 0x7ff741947a0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x7ff741e7790]
jne 0x7ff7419fd54
rol rcx, 0x10
test cx, 0xffff
jne 0x7ff7419fd50
ret 0
ror rcx, 0x10
jmp 0x7ff741c40e8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x7ff741e7920]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x7ff741e7a18]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x7ff741c416d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x7ff741e7920]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x7ff741c418f
mov rax, qword [rsp + 0x88]
mov qword [0x7ff741e7a18], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x7ff741e79b8], rax
mov rax, qword [0x7ff741e7a18]
mov qword [0x7ff741e7890], rax
mov rax, qword [rsp + 0x90]
mov qword [0x7ff741e79a0], rax
mov dword [0x7ff741e7880], 0xc0000409
mov dword [0x7ff741e7884], 1
mov rax, qword [0x7ff741e7790]
mov qword [rsp + 0x68], rax
mov rax, qword [0x7ff741e7798]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x7ff741dc888]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x7ff74195680
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
xor ebx, ebx
mov rax, r9
mov r10d, r8d
mov qword [r11 - 0x10], rbx
mov qword [r11 - 0x18], rbx
mov word [r9], bx
mov r9, qword [rsp + 0x70]
mov rcx, rdx
mov qword [r11 - 0x20], rbx
mov r8, rax
mov edx, r10d
mov qword [r11 - 0x28], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
mov r11d, eax
cmp eax, 0x103
je 0x7ff741956d7
movzx eax, ax
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
add rsp, 0x40
pop rbx
ret
lea eax, [rbx + 1]
jmp 0x7ff741956d1

Function at 0x7ff741963bc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x40], rax
and qword [r9], 0
mov r12, r8
mov rbp, rdx
lea rax, [rsp + 0x30]
mov rsi, r9
xor r8d, r8d
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov rdx, r12
xor r9d, r9d
mov rcx, rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
xor ecx, ecx
sub ecx, eax
neg ecx
sbb edi, edi
and edi, 0x80004005
jl 0x7ff74196475
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov edx, 0x40
xor ecx, ecx
call fcn.7ff7419edac
mov edi, eax
test eax, eax
js 0x7ff74196475
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
xor ecx, ecx
sub ecx, eax
neg ecx
sbb edi, edi
and edi, 0x80004005
jl 0x7ff7419646c
mov qword [rsi], rbx
xor ebx, ebx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.7ff741947a0
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret