joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e35f4
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x840
mov rax, qword [0x14014d030]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rdi, rcx
mov byte [rsp + 0x30], 0
mov rcx, qword [rcx + 0x368]
mov ebx, edx
test rcx, rcx
je 0x1400e363a
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
and qword [rdi + 0x368], 0
and dword [rdi + 0x374], 0
mov edx, ebx
and dword [rdi + 0x370], 0
mov rcx, rdi
call fcn.1400e3858
mov ebx, eax
test eax, eax
jns 0x1400e3683
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e3829
test byte [rcx + 0x1c], 1
je 0x1400e3829
mov edx, 0x42
jmp 0x1400e3816
mov rcx, rdi
call fcn.1400e1bd4
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov r8d, 0x800
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov rcx, rdi
mov ebx, eax
call fcn.1400e1c24
test ebx, ebx
je 0x1400e37db
mov rcx, rdi
call fcn.1400e1f40
mov ebx, eax
test eax, eax
js 0x1400e37bb
mov esi, dword [rdi + 0x3b8]
test esi, esi
je 0x1400e37b7
mov r14, qword [rdi + 0x378]
test r14, r14
je 0x1400e3755
mov rax, qword [r14]
mov rbx, qword [rax + 0x20]
mov rcx, rbx
call qword [fcn.140009050]
lea r9, [rsp + 0x20]
mov r8d, esi
lea rdx, [rsp + 0x30]
mov rcx, r14
call rbx
mov ebx, eax
test eax, eax
js 0x1400e3797
mov eax, dword [rdi + 0x3b8]
cmp dword [rsp + 0x20], eax
jae 0x1400e3683
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e374b
test byte [rcx + 0x1c], 1
je 0x1400e374b
mov rcx, qword [rcx + 0x10]
lea r8, [0x140129d60]
mov edx, 0x46
call fcn.140003614
mov ebx, 0x8007001d
jmp 0x1400e3829
mov r8d, esi
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400e43bc
mov ebx, eax
test eax, eax
jns 0x1400e3683
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e3829
test byte [rcx + 0x1c], 1
je 0x1400e3829
mov edx, 0x47
jmp 0x1400e3816
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e3829
test byte [rcx + 0x1c], 1
je 0x1400e3829
mov edx, 0x45
jmp 0x1400e3816
xor ebx, ebx
jmp 0x1400e3829
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e3829
test byte [rcx + 0x1c], 1
je 0x1400e3829
mov edx, 0x44
jmp 0x1400e3816
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e3829
test byte [rcx + 0x1c], 1
je 0x1400e3829
mov edx, 0x43
mov rcx, qword [rcx + 0x10]
lea r8, [0x140129d60]
mov r9d, ebx
call fcn.1400036d4
mov eax, ebx
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140106ed0
mov rbx, qword [rsp + 0x870]
add rsp, 0x840
pop r14
pop rdi
pop rsi
ret
Function at 0x1400e4244
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
call sub.KERNEL32.dll_SetEvent
test eax, eax
jne 0x1400e429b
mov rax, qword [0x14014dd40]
lea rcx, [0x14014dd40]
cmp rax, rcx
je 0x1400e429b
test byte [rax + 0x1c], 1
je 0x1400e429b
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x14014dd40]
lea r8, [0x140129d60]
mov r9d, eax
mov edx, 0x75
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
lea rdi, [rbx + 0x88]
mov rcx, rdi
call fcn.1400e75b0
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400e42bc
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
and qword [rbx], 0
mov rcx, rdi
call fcn.1400e761c
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400e42dc
Function at 0x1400e65dc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14014d030]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, qword [rbp + 0x60]
lea rax, str.SOFTWAREMicrosoftTelemetryClientSampleStore
xor edi, edi
mov dword [rbp - 0x40], 4
and qword [rbp - 0x48], rdi
mov r13, 0xffffffff80000002
and dword [rbp - 0x4c], edi
mov rbx, r13
and dword [rbp - 0x50], edi
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
test r15, r15
jne 0x1400e664a
mov edi, 0x80070057
jmp 0x1400e6723
and dword [r15], edi
lea rsi, [rbp - 0x38]
xor r14d, r14d
mov rdx, qword [rsi]
test rdx, rdx
je 0x1400e66b7
lea rax, [rbp - 0x48]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400e66a0
cmp rbx, r13
je 0x1400e6689
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rbp - 0x48]
inc r14d
and qword [rbp - 0x48], rdi
add rsi, 8
cmp r14d, 5
jb 0x1400e6654
jmp 0x1400e66b7
and qword [rbp - 0x48], rdi
cmp eax, 2
je 0x1400e66b7
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
cmp rbx, r13
je 0x1400e6701
lea rax, [rbp - 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x4c]
lea rax, [rbp - 0x50]
mov rcx, rbx
lea rdx, str.SampledOut
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e6701
cmp dword [rbp - 0x4c], 4
jne 0x1400e6701
cmp dword [rbp - 0x40], 4
jne 0x1400e6701
cmp dword [rbp - 0x50], eax
jbe 0x1400e6701
mov dword [r15], 1
test rbx, rbx
je 0x1400e6714
cmp rbx, r13
je 0x1400e6714
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400e6723
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140106ed0
add rsp, 0x80
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400e6a54
Capabilities:
Delete registry key

Disassembly:
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov r14, r9
mov r15, r8
mov rsi, rdx
mov rdi, rcx
and qword [rbp - 0x18], 0
and dword [rbp - 0xc], 0
and dword [rbp - 0x10], 0
lea rdx, str.SOFTWAREMicrosoftTelemetryClientThrottleStore
lea rcx, [rbp - 0x18]
call fcn.1400d8f6c
mov ebx, eax
test eax, eax
js 0x1400e6b9e
test rdi, rdi
je 0x1400e6ae0
lea rdx, str._DB
lea rcx, [rbp - 0x18]
call fcn.1400d9104
mov ebx, eax
test eax, eax
js 0x1400e6b9e
mov rdx, rdi
lea rcx, [rbp - 0x18]
call fcn.1400d9104
mov ebx, eax
test eax, eax
js 0x1400e6b9e
test rsi, rsi
je 0x1400e6b15
lea rdx, str._DB
lea rcx, [rbp - 0x18]
call fcn.1400d9104
mov ebx, eax
test eax, eax
js 0x1400e6b9e
mov rdx, rsi
lea rcx, [rbp - 0x18]
call fcn.1400d9104
mov ebx, eax
test eax, eax
js 0x1400e6b9e
test r15, r15
je 0x1400e6b42
lea rdx, str._DB
lea rcx, [rbp - 0x18]
call fcn.1400d9104
mov ebx, eax
test eax, eax
js 0x1400e6b9e
mov rdx, r15
lea rcx, [rbp - 0x18]
call fcn.1400d9104
mov ebx, eax
test eax, eax
js 0x1400e6b9e
test r14, r14
je 0x1400e6b6f
lea rdx, str._DB
lea rcx, [rbp - 0x18]
call fcn.1400d9104
mov ebx, eax
test eax, eax
js 0x1400e6b9e
mov rdx, r14
lea rcx, [rbp - 0x18]
call fcn.1400d9104
mov ebx, eax
test eax, eax
js 0x1400e6b9e
neg dword [rbp + 0x40]
sbb rcx, rcx
neg rcx
add rcx, 0xffffffff80000001
mov rdx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_RegDeleteTreeW]
test eax, 0xfffffffd
je 0x1400e6b9e
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov edx, 1
lea rcx, [rbp - 0x18]
call fcn.1400d9748
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x1400e6ef0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x30
and qword [rbp + 0x20], 0
or rbx, 0xffffffffffffffff
mov rdi, rcx
cmp rcx, rbx
jne 0x1400e6f13
xor eax, eax
jmp 0x1400e7030
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rbp + 0x28]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400e6f7c
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x1400e6f7c
xor edx, edx
lea r8, [rdi - 1]
mov rax, rbx
div r8
sub rbx, rdx
lea r8, [rbp + 0x20]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
cmp rax, rbx
ja 0x1400e6f4c
xor edx, edx
div rdi
inc rdx
mov qword [rbp + 0x20], rdx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rax, qword [rbp + 0x20]
test rax, rax
jne 0x1400e7030
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ebx, dword [rbp + 0x30]
xor ebx, dword [rbp + 0x34]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 0xdeadbeef
xor ebx, eax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor ebx, eax
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_srand]
call qword [sym.imp.msvcrt.dll_rand]
xorps xmm1, xmm1
movd xmm0, eax
lea rax, [rdi - 1]
cvtdq2pd xmm0, xmm0
cvtsi2sd xmm1, rax
divsd xmm0, qword [0x14012ee40]
test rax, rax
jns 0x1400e6ff5
addsd xmm1, qword [0x14012ee58]
mulsd xmm0, xmm1
xor ecx, ecx
movsd xmm1, qword [0x14012ee50]
addsd xmm0, qword [0x14012edf8]
comisd xmm0, xmm1
jb 0x1400e7028
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x1400e7028
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rax, xmm0
add rax, rcx
add rsp, 0x30
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400e7104
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
and dword [rcx], 0
lea r8, str.TelemetrySampleNumber
and qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftTelemetryClient
mov rdi, rcx
mov rbx, 0xffffffff80000001
mov rcx, rbx
xor r9d, r9d
call fcn.1400d756c
mov dword [rsp + 0x60], eax
test eax, eax
jne 0x1400e7214
mov ecx, 0x5f5e100
call fcn.1400e6ef0
mov r8, rax
mov eax, 0xabcc76f5
mul r8d
shr edx, 0x1a
imul ecx, edx, 0x5f5e101
sub r8d, ecx
mov dword [rsp + 0x60], r8d
jne 0x1400e7178
mov eax, 0x80004005
jmp 0x1400e7218
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMicrosoftTelemetryClient
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x20106
xor r8d, r8d
and dword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, eax
test eax, eax
je 0x1400e71c6
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x1400e7218
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov r9d, 4
lea rdx, str.TelemetrySampleNumber
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1400e7210
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1400e7218
mov eax, dword [rsp + 0x60]
mov dword [rdi], eax
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400e9c04
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov r14, rcx
mov rcx, qword [0x14014dd40]
lea r12, [0x14014dd40]
mov edi, 2
cmp rcx, r12
je 0x1400e9c50
test byte [rcx + 0x1c], dil
je 0x1400e9c50
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 8]
lea r8, [0x14012a0d8]
call fcn.140003614
mov eax, 0x1f40
xor ebx, ebx
mov dword [rsp + 0x58], eax
mov ecx, eax
lea rdx, [0x14011cc3a]
call fcn.1401084ac
mov rsi, rax
test rax, rax
je 0x1400e9d11
xor r8d, r8d
lea rax, [rsp + 0x58]
mov r9, rsi
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r8 + 0xe]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov ebp, eax
cmp eax, 0x7a
je 0x1400e9c9d
cmp eax, 0x6f
jne 0x1400e9cb5
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
xor esi, esi
inc ebx
cmp ebx, 3
jae 0x1400e9cc7
mov eax, dword [rsp + 0x58]
jmp 0x1400e9c5b
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400e9d16
movzx ebx, bp
or ebx, 0x80070000
test ebp, ebp
cmovle ebx, ebp
test ebx, ebx
js 0x1400e9d16
mov qword [r14 + 0x10], rsi
xor esi, esi
call fcn.1401083a4
test al, al
je 0x1400e9d16
call qword [sym.imp.ext_ms_win_casting_receiver_l1_1_0.dll_GetXboxWirelessNetworkInterfaceIndex]
test eax, eax
je 0x1400e9d16
mov rcx, qword [r14 + 0x10]
jmp 0x1400e9d01
cmp dword [rcx + 4], eax
je 0x1400e9d08
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x1400e9cf8
jmp 0x1400e9d16
mov dword [rcx + 0x64], 0x47
jmp 0x1400e9d16
mov ebx, 0x8007000e
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [0x14014dd40]
cmp rcx, r12
je 0x1400e9d59
test byte [rcx + 0x1c], dil
je 0x1400e9d59
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, 5
cmovns edi, eax
cmp edx, edi
jl 0x1400e9d59
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 6]
mov r9d, ebx
lea r8, [0x14012a0d8]
call fcn.1400036d4
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x1400fb190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14014d030]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r15d, 0x50
mov rcx, rax
mov r8d, r15d
lea edx, [r15 - 0x48]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400fb2f5
mov r8, r15
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
xor edi, edi
mov eax, edi
mov ecx, edi
shr eax, 2
inc edi
mov edx, eax
shl eax, 2
sub ecx, eax
movzx eax, byte [rsi]
shl ecx, 3
inc rsi
shl eax, cl
or dword [rbx + rdx*4], eax
cmp edi, 0x14
jb 0x1400fb1f9
movups xmm0, xmmword [0x14014d07c]
mov eax, dword [0x14014d08c]
lea rdi, [rbp - 0x28]
xor r8d, r8d
mov dword [rbp - 0x40], 0x123174bb
mov dword [rbp - 0x3c], 0x86521ff8
mov dword [rbp - 0x38], 0x98d2438b
mov dword [rbp - 0x34], 0x7966ce12
lea r9d, [r8 + 5]
mov dword [rbp - 0x30], 0xc5d92014
movups xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], eax
mov rcx, r8
movabs rax, 0xcccccccccccccccd
mul r8
inc r8
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rbp + rcx*4 - 0x40]
xor dword [rdi], eax
lea rdi, [rdi + 4]
sub r9, 1
jne 0x1400fb25e
movups xmm0, xmmword [rbp - 0x28]
mov eax, dword [rbp - 0x18]
lea r8, [rbp - 0x40]
mov r9d, dword [0x14014d090]
mov edx, reloc.Cabinet.dll_FDICreate
mov dword [rbp - 0x30], eax
mov rcx, rbx
lea rax, [0x14014dbc0]
mov qword [rsp + 0x30], r14
and qword [rsp + 0x28], 0
movups xmmword [rbp - 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.1401018cc
xor eax, eax
lea rdi, [rbp - 0x40]
lea ecx, [rax + 0x14]
rep stosb byte [rdi], al
mov rdi, rbx
mov rcx, r15
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140106ed0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400fc0e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
cmp dword [0x140151200], 0
mov rbx, rdx
mov rdi, rcx
jne 0x1400fc1d7
lea rax, [0x140150d20]
test rax, rax
je 0x1400fc13f
and dword [0x140150d28], 0
and dword [0x140150d30], 0
mov dword [0x140150d20], 0x1423
mov dword [0x140150d24], 0x100
mov dword [0x140150d2c], 7
mov dword [0x140150d34], 1
lea rax, [rsp + 0x80]
mov dword [rsp + 0x70], 0x50
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREMicrosoftCryptographyDRM_RNG
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 1
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400fc1cd
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x88]
lea rax, [0x140150e40]
xor r8d, r8d
lea rdx, str.Seed
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x140151200], 1
test rdi, rdi
je 0x1400fc1f1
test rbx, rbx
je 0x1400fc1f1
mov r8d, dword [rbx]
test r8d, r8d
je 0x1400fc1f1
mov rdx, qword [rdi]
call fcn.1401043c0
mov eax, 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400fcf2c
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x5c]
call sub.msvcrt.dll_memset
mov dword [rbx + 0x48], 0x67452301
mov dword [rbx + 0x4c], 0xefcdab89
mov dword [rbx + 0x50], 0x98badcfe
mov dword [rbx + 0x54], 0x10325476
mov dword [rbx + 0x58], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret
Function at 0x140100234
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov r11, rdx
mov rbx, rcx
test r9, r9
je 0x140100278
sub rbx, rdx
sub r8, rdx
mov ecx, dword [rbx + r11]
mov edx, dword [r11]
lea eax, [rdx + rcx]
add r10d, eax
mov eax, edx
mov dword [r8 + r11], r10d
xor eax, ecx
and r10d, eax
lea r11, [r11 + 4]
or edx, ecx
xor r10d, edx
shr r10d, 0x1f
sub r9, 1
jne 0x14010024d
mov rbx, qword [rsp + 8]
mov eax, r10d
ret

Function at 0x140100288
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov rbp, qword [rsp + 0x30]
xor eax, eax
mov rdi, r9
mov rsi, r8
mov r11, rdx
mov r14, rcx
mov ebx, eax
test rbp, rbp
je 0x14010030e
sub r14, rdx
sub rsi, rdx
sub rdi, rdx
mov r8d, dword [r14 + r11]
mov edx, dword [r11]
mov r9d, dword [rsi + r11]
lea r10d, [rdx + r8]
add r10d, eax
mov eax, r10d
mov ecx, r10d
sub eax, r9d
xor ecx, edx
sub eax, ebx
mov ebx, eax
mov dword [rdi + r11], eax
xor ebx, r10d
lea r11, [r11 + 4]
mov eax, r10d
xor eax, r8d
or eax, ecx
mov ecx, r10d
xor ecx, r9d
xor eax, r10d
or ebx, ecx
shr eax, 0x1f
xor ebx, r10d
shr ebx, 0x1f
sub rbp, 1
jne 0x1401002c0
mov rbp, qword [rsp + 0x18]
sub eax, ebx
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret

Function at 0x140100540
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov r10, rdx
mov rbx, rcx
test r9, r9
je 0x140100583
sub rbx, rdx
sub r8, rdx
mov ecx, dword [rbx + r10]
mov edx, ecx
mov eax, dword [r10]
sub edx, eax
sub edx, r11d
xor eax, ecx
mov dword [r8 + r10], edx
xor edx, ecx
or edx, eax
lea r10, [r10 + 4]
xor edx, ecx
shr edx, 0x1f
mov r11d, edx
sub r9, 1
jne 0x140100559
mov rbx, qword [rsp + 8]
mov eax, r11d
ret
Function at 0x1401043c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x14014d030]
xor rax, rsp
mov qword [rbp + 0x2f], rax
lea r15, [0x140150d20]
mov r14d, r8d
mov rsi, rdx
test r15, r15
je 0x1401044d8
cmp dword [0x140150d20], 0x1423
jne 0x1401044d8
mov ebx, dword [0x140150d24]
lea rcx, [rbp - 0x59]
mov edi, dword [0x140150d30]
call fcn.1400fcf2c
cmp dword [0x140150d34], 1
lea r8, [rbp - 0x59]
mov edx, r14d
mov rcx, rsi
jne 0x140104467
call fcn.1400fcf70
test byte [0x140150d28], 1
je 0x140104454
lea r8, [rbp - 0x59]
mov edx, ebx
lea rcx, [0x140150d40]
call fcn.1400fcf70
lea rdx, [rbp + 3]
lea rcx, [rbp - 0x59]
call fcn.1400fd25c
lea r8, [rbp + 3]
jmp 0x140104498
call fcn.1400fcf70
test byte [0x140150d28], 1
je 0x140104487
lea r8, [rbp - 0x59]
mov edx, ebx
lea rcx, [0x140150d40]
call fcn.1400fcf70
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x59]
call fcn.1400fd25c
lea r8, [rbp + 0x17]
mov r9d, edi
mov r10d, reloc.Cabinet.dll_FDICreate
mov cl, byte [r8]
cmp r9d, ebx
sbb eax, eax
inc r8
and eax, r9d
mov r9d, eax
inc r9d
xor byte [rax + r15 + 0x20], cl
sub r10, 1
jne 0x1401044a1
mov eax, dword [0x140150d2c]
xor edx, edx
add eax, edi
div ebx
lea eax, [r10 + 1]
mov dword [0x140150d30], edx
jmp 0x1401044da
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140106ed0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140106c20
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0xb0
xor r15d, r15d
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov r14d, r15d
xor eax, eax
lock cmpxchg qword [0x140151238], rbx
je 0x140106c89
cmp rax, rbx
jne 0x140106c7c
mov edi, 1
mov r14d, edi
jmp 0x140106c8e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140106c60
mov edi, 1
mov eax, dword [0x140151240]
cmp eax, edi
jne 0x140106ca6
mov esi, 0x1f
mov ecx, esi
call fcn.1401fc000
jmp 0x140106d17
mov eax, dword [0x140151240]
test eax, eax
jne 0x140106d0c
mov dword [0x140151240], edi
lea r12, [0x140112fe0]
lea rbx, [0x140112fc8]
mov qword [rsp + 0x30], rbx
mov eax, r15d
mov dword [rsp + 0x24], eax
cmp rbx, r12
jae 0x140106cfe
test eax, eax
jne 0x140106d02
mov rsi, qword [rbx]
test rsi, rsi
je 0x140106cf3
mov rcx, rsi
mov rax, qword [fcn.140009050]
call rax
call rsi
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x140106cd0
test eax, eax
je 0x140106d12
mov eax, 0xff
jmp 0x140106e73
mov dword [0x14014eaf0], edi
mov esi, 0x1f
mov eax, dword [0x140151240]
cmp eax, edi
jne 0x140106d3e
lea rdx, [0x140112fc0]
lea rcx, [0x140112e40]
call sub.msvcrt.dll__initterm
mov dword [0x140151240], 2
test r14d, r14d
jne 0x140106d4d
mov rax, r15
xchg qword [0x140151238], rax
cmp qword [0x140151258], r15
je 0x140106d84
lea rcx, [0x140151258]
call fcn.140107740
test eax, eax
je 0x140106d84
mov rbx, qword [0x140151258]
mov rcx, rbx
mov rax, qword [fcn.140009050]
call rax
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call rbx
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rdx, qword [rax]
test rdx, rdx
jne 0x140106d9d
mov eax, 0xff
jmp 0x140106e73
mov qword [rsp + 0x28], rdx
mov ecx, dword [rsp + 0x20]
cmp word [rdx], 0x20
ja 0x140106e24
cmp word [rdx], r15w
je 0x140106db6
test ecx, ecx
jne 0x140106e24
movzx eax, word [rdx]
sub ax, di
cmp ax, si
ja 0x140106dcc
add rdx, 2
mov qword [rsp + 0x28], rdx
jmp 0x140106db6
mov ecx, dword [rsp + 0x7c]
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
and cl, dil
cmovne r9d, eax
mov r8, rdx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003948
mov dword [0x14014eaec], eax
cmp dword [0x14014eb10], r15d
jne 0x140106e0d
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14014eaf0], r15d
jne 0x140106e22
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14014eaec]
jmp 0x140106e73
cmp word [rdx], 0x22
jne 0x140106e38
mov eax, r15d
test ecx, ecx
sete al
mov ecx, eax
mov dword [rsp + 0x20], eax
add rdx, 2
mov qword [rsp + 0x28], rdx
jmp 0x140106da6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
sub rsp, 0x28
call fcn.140107084
add rsp, 0x28
jmp 0x140106c20