joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011c76
Capabilities:
Encode data using base64

Disassembly:
push rdx
jb 0x18000f351
xchg cx, cx
jae 0x18000f351
mov rcx, qword [rdx + 8]
mov rax, qword [rdx]
mov qword [rcx], rax

Function at 0x180011fdf
Capabilities:
Encode data using base64

Disassembly:
movsxd rcx, dword [rcx]
js 0x18000b179
xchg rsp, rsp
jns 0x18000b179
mov rcx, qword [rsp + 8]
jp 0x180007e1d
mov al, al
jnp 0x180007e1d
test rbx, 0
jne 0x1800096f0
cmp word [rdx], r15w
jne 0x18000eb2e
call fcn.18000d45e
pushfq
invalid
mov rcx, rbp
call qword [0x18001a645]
call fcn.180012b04
push rsi
invalid
push rcx
js 0x180008e94
mov si, si
jns 0x180008e94

Function at 0x180011fef
Capabilities:
Encode data using base64

Disassembly:
movsxd rbp, dword [rbp]
jl 0x180007469
mov rcx, rcx
jge 0x180007469
add qword [rsp + 0x10], rax
jb 0x1800130ed
mov r12, r12
jae 0x1800130ed
mov rbp, qword [rsp + 8]
je 0x180008140
mov r14, r14
jne 0x180008140
push rbp
jl 0x18000de58
mov r9, r9
jge 0x18000de58
popfq
jmp fcn.18001200f

Function at 0x180012437
Capabilities:
Packed with generic packer

Disassembly:
ret
sub qword [rsp + 0x10], r12
jo 0x180014800
mov al, al
jno 0x180014800
jnp 0x18001290d
test eax, eax
call fcn.18000fcac
nop
xor ebx, ecx
cmp edi, edi
dec dword [rax - 0x7d]
and dword [rax], eax
test r14, 0
jo 0x1800074e5
call fcn.18000998a
mov ch, 0xa0
int3
mov r12, qword [rsp + 8]
jmp 0x180010d21
movsxd r12, dword [r12]
jb 0x1800147cb
mov rdx, rdx
jae 0x1800147cb
push r13
push r14
lea rbp, [rax - 0x568]
test ch, 0
jb 0x180009c3a
call fcn.18000d243
add r13d, dword [r9 + 0x36]
invalid
push r12
ja 0x18000db1c
xchg sp, sp
jbe 0x18000db1c
mov ecx, dword [0x18001a63d]
xor r12, 0x27e05ec2
jg 0x18000d8fa
xchg bx, bx
jle 0x18000d8fa
inc r10d
inc r8
call fcn.1800148bb
test byte [rcx + 0x10], bh
ret
pushfq
jmp 0x180013520
popfq
jb 0x18000e460
xchg r11, r11
jae 0x18000e460
call fcn.18001125a
popfq
cwde
mov ebx, 0x48ffffde
invalid

Function at 0x18001266e
Capabilities:
Encode data using base64

Disassembly:
pushfq
ja 0x18000fd94
xchg sp, sp
jbe 0x18000fd94
push rcx
call fcn.180012b04
mov bh, 0x1f
cmp al, 0xfe
invalid
add rcx, 0x14d866a8
jb 0x180012749
mov bh, bh
jae 0x180012749
push rcx
js 0x180012bc0
mov bh, bh
jns 0x180012bc0
sub qword [rsp + 0x10], rcx
ja 0x180008026
mov bl, bl
jbe 0x180008026
mov rcx, qword [rsp + 8]
jb 0x180012d8c
xchg al, al
jae 0x180012d8c
jmp fcn.18000c703
movsxd rcx, dword [rcx]
jg 0x18000d4fe
xchg bl, bl
jle 0x18000d4fe
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
call fcn.18000d2e3
inc ah
ret 0xff2b
Function at 0x180012878
Capabilities:
Encode data using base64

Disassembly:
popfq
jg 0x180013e82
xchg bp, bp
jle 0x180013e82
sub qword [rsp + 0x10], rbp
jmp 0x18000ac02
movsxd rbp, dword [rbp]
jb 0x1800124c7
mov sp, sp
jae 0x1800124c7
mov r10d, edx
shr rcx, 2
mov edi, 0xfffffffc
mov r8d, dword [r11 + rcx*4]
call fcn.1800141a6
push 0xffffffffffffff8d
add cl, 0xff
dec dword [rax + 0x63]
invalid
mov byte [rax + 0x2bffffcc], dh
ret 0xe8d1
ret
sub rbp, 0x188b3dd6
js 0x18000b5a2
xchg dh, dh
jns 0x18000b5a2
call fcn.180011999
test byte [rsi - 0x3d4e], al
pushfq
jmp 0x18000e667
mov rbp, qword [rsp + 8]
jb 0x18000b6c1
xchg r9, r9
jae 0x18000b6c1
jnp 0x180011a27
and dword [rdi + 0x90], 0
test r13, 0
jb 0x18000cf4d
and qword [rdi + 0x98], 0
call fcn.1800134ff
sub dh, ch
fsub dword [rdi + rdi*8]
dec dword [rbp + 0x63]
add byte [rdi], cl
mov bl, dh
outsd dx, dword [rsi]
invalid
push rbp
jmp 0x18001267d
pop rbp
js 0x18000e567
mov dh, dh
jns 0x18000e567
pop rbx
call fcn.1800148bb
shr byte [rbx - 0x3cf0], cl

Function at 0x180012b04
Capabilities:
Encode data using base64

Disassembly:
movsxd rdi, dword [rdi]
js 0x1800070ff
xchg al, al
jns 0x1800070ff
jne 0x180009ba9
lea rcx, [rsp + 0x30]
call fcn.18000d2e3
adc dword [rdx + rax*8 + 0x2b], 0xffffffff
dec dword [rdi]
invalid
pushfq
je 0x180014cfa
xchg rsi, rsi
jne 0x180014cfa
mov rax, qword [rsp]
call fcn.180010af4
mov word [rdi + 0x7e], ds
invalid
lea edx, [rsp + 0x20]
mov r8d, 0x30
call fcn.180010af4
mov ecx, 0xff258188
call [rdi + rcx - 0x100f7c]
dec dword [rbp - 0x79]
test byte [rdi], 0x85
out 0xef, eax
invalid
mov rdi, qword [rsp + 8]
jg 0x180006e34
xchg r15, r15
jle 0x180006e34
add qword [rsp + 0x10], rbp
jl 0x18000b1a7
xchg ch, ch
jge 0x18000b1a7
call fcn.18000dd05
mov rbp, rax
test r15, 0
call fcn.180010ad4
enter 0x4f8b, 0x2b
invalid
push rdi
jl 0x18000e263
mov rbp, rbp
jge 0x18000e263

Function at 0x180012cb3
Capabilities:
Encode data using base64

Disassembly:
movsxd rax, dword [rax]
js 0x18000f0a1
mov rbp, qword [rsp + 8]
jo 0x180013a87
mov al, al
jno 0x180013a87
push rbp
js 0x18000de6c
xchg dl, dl
jns 0x18000de6c
call fcn.18000ac54
lea rcx, [rbp - 0x29]
mov edi, eax
call fcn.18000d2a2
adc dword [rsi], esi
insb byte [rdi], dx
cmp bh, bh
dec dword [rax - 0x77]
jl 0x180012d00
sbb byte [rcx + 0x54], al
call fcn.180013c6b
xor bl, byte [rax]
popfq
invalid
add byte [rbp - 0x73], 0x41
add dword [rax - 0x75], ecx
enter 0x44c7, 0x24
and byte [rbx], al
add byte [rax], al
add bh, bh
adc eax, 0x7c46
call fcn.18000b3c2
mov dword [rax + rcx*4 + 0x48ffffd7], ebx
mov eax, dword [rsp + 8]
jmp 0x18000b1bf
Function at 0x1800134ff
Capabilities:
Encode data using base64

Disassembly:
call fcn.1800093a6
fld qword [rcx]
xchg ecx, eax
invalid
movsxd rcx, dword [rcx]
jp 0x18000c679
xchg dl, dl
jnp 0x18000c679
invalid
pushfq
jl 0x1800145d5
mov di, di
jge 0x1800145d5
mov ecx, dword [rsp + 0x28]
mov al, byte [rcx]
test dx, 0
call fcn.18000d0ce
invalid
mov eax, dword [rbx + rbp + 0x8c]
invalid
push rcx
jp 0x1800146b9
mov rdx, rdx
jnp 0x1800146b9
jo 0x180012f3e
call fcn.18000a24d
jb 0x1800134fd
nop
sub al, 0xff
dec dword [rcx - 0x7f]
hlt
mov rcx, qword [rsp + 8]
jo 0x18000b0fb
mov al, al
jno 0x18000b0fb
je 0x180005fd1
je 0x18000b794
test r14, 0
jne 0x18000f294
cmp ebp, 3
call fcn.180009682
invalid

Function at 0x180013b18
Capabilities:
Encode data using xor

Disassembly:
push r15
jb 0x180012968
mov si, si
jae 0x180012968

Function at 0x180013c38
Capabilities:
Encode data using base64

Disassembly:
push r14
jb 0x1800133ae
mov rsi, rsi
jae 0x1800133ae

Function at 0x180013ee2
Capabilities:
Encode data using base64

Disassembly:
add qword [rsp + 0x10], rax
jb 0x18000bbd6
mov cl, cl
jae 0x18000bbd6
ret
movsxd rax, dword [rax]
jp 0x1800147d1
xchg bx, bx
jnp 0x1800147d1
pop rdi
pop rsi
pop rbp
call fcn.18000e253
push rcx
pop rdx
cmp eax, 0x48ffffd9
lea ecx, [rbp - 0x30]
mov rsi, r9
mov edi, r8d
mov ebx, edx
call fcn.18000fc2e
mov r13d, 4
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x30]
call fcn.180009682
push rax
ret
popfq
jmp 0x180012392
ret
movsxd rbp, dword [rbp]
jl 0x180007487
xchg ch, ch
jge 0x180007487
mov r9, qword [rsp + 8]
jl 0x18000f364
xchg rcx, rcx
jge 0x18000f364
pop rax
jb 0x18000bd2c
xchg r9, r9
jae 0x18000bd2c
mov rbp, qword [rsp + 8]
js 0x18000d726
mov dh, dh
jns 0x18000d726
mov edx, 0x2ada31f0
call fcn.1800116a0
sub byte [0x180006017], dl
push rax
js 0x180014baa
xchg rdi, rdi
jns 0x180014baa
mov r8d, 0xba5374ea
call fcn.18000b829
sal byte [rbx], 0x8a
add bh, bh
dec dword [rdi]
mov byte [rdi], al
and edi, edi
invalid
pushfq
jb 0x180014847
mov ax, ax
jae 0x180014847
call fcn.18000f002
call fcn.18000b89a
fsub dword [rbx + 0x41]
sub eax, 0xc1f7ffff
add byte [rax], al
add rax, 0x12faff22
jg 0x18000879a
xchg rsi, rsi
jle 0x18000879a
call fcn.18000d74c
sahf
movabs dword [0x6bef8148ffff2de6], eax
fbld tbyte [0x161905787]
invalid
mov rax, qword [rsp + 8]
jp 0x18000a326
xchg ah, ah
jnp 0x18000a326
test rax, 0
jb 0x180009dd8
call fcn.180011999
sbb ecx, dword [rcx - 0x3d4f]
push r12
test ebx, 0
call fcn.180007ee1
invalid

Function at 0x1800141a6
Capabilities:
Encode data using base64

Disassembly:
pushfq
jl 0x18000709b
xchg si, si
push r14
js 0x18000ef81
xchg r11, r11
jns 0x18000ef81
mov r15, qword [rsp + 8]
jg 0x1800152c8
mov r11, r11
jle 0x1800152c8
jl 0x18000f07f
movsxd r15, dword [r15]
jmp 0x18000f0ee

Function at 0x18001426c
Capabilities:
Encode data using base64

Disassembly:
mov rsi, qword [rsp + 8]
jmp 0x18001247f
movsxd rsi, dword [rsi]
js 0x1800133d4
xchg si, si
jns 0x1800133d4
call fcn.18000dc11
call fcn.180008ca1
sbb r9, rcx
in eax, dx
invalid
push rsi
jg 0x180010edf
xchg di, di
jle 0x180010edf
mov r8, rbp
call fcn.18000b829
mov eax, 0xff008a74
invalid
Function at 0x1800142f0
Capabilities:
Encode data using base64

Disassembly:
push rdi
je 0x180014b1b
xchg ah, ah
jne 0x180014b1b

Function at 0x180014f93
Capabilities:
Encode data using base64

Disassembly:
movsxd rcx, dword [rcx]
jo 0x18000f3d3
mov rbp, rbp
jno 0x18000f3d3
mov byte [rsp + rbx*8 + 0x6ce8ffff], ch
add byte [rax], al
push r10
out 0x2d, eax
invalid
add qword [rsp + 0x10], rcx
jg 0x18000f196
xchg dl, dl
jle 0x18000f196
mov rdx, rdi
call fcn.1800138ea
call fcn.18000bb63
movabs byte [0xc3f748ffffc5d813], al
add byte [rax], al
add byte [rax], al
jnp 0x18000e06c
cmp byte [rcx + r8], 0xff
jne 0x180010e16
call fcn.180010f0e
invalid
mov dword [rax], 0xccb0880f
invalid
pushfq
js 0x180014d30
xchg r8, r8
jns 0x180014d30
jne 0x18000f8a2
mov eax, dword [rcx + 0xc]
test rdx, 0
jb 0x18000f521
xor eax, 0xd98d516f
test dh, 0
call fcn.18000fe05
mov dword [r10], ebx
invalid
rol byte [rdx], 0x45
mov byte [rbx + rax], al
mov dword [rbx], edx
call fcn.180012ed4
xchg byte [rdi - 0xf92d], bl
test dx, 0
call fcn.18000d74c
mov cl, 0xd2
out 0x2d, al
invalid
adc byte [rax + 0x48ffff97], 0x81
in al, dx
adc byte [rcx], al
add byte [rax], al
test si, 0
jnp 0x180012c6d
inc eax
inc r8
call fcn.18000e76f
movabs dword [0xc7f749ffff36776b], eax
add byte [rax], al
add byte [rax], al
jb 0x180008cd6
call fcn.18001360e
sbb r14b, r8b
adc al, 0xff
dec dword [rcx + rbp + 0x44]
and al, 0x10
js 0x18000d3e3
mov r9, r9
jns 0x18000d3e3
call fcn.180014611
test al, 0
call fcn.18000624e
lodsd eax, dword [rsi]
invalid
mov rcx, qword [rsp + 8]
jb 0x1800072c2
mov r8, r8
jae 0x1800072c2
mov bh, 0xf3
idiv ah
mov r10d, 0x24924925
mov r9, rdx
lea r11d, [rcx + rbx]
call fcn.18000be99
sub al, 0x47
imul edx, dword [rbx], 0xffffffff
inc dword [0x130012c8e]
call int.180008f8b
cwde
ret
xor rcx, 0x1a600dd1
jp 0x18000b50c
xchg rsi, rsi
jnp 0x18000b50c
jo 0x180012d56
call fcn.18000ef70
and byte [rsi - 0x3138], ch
push rcx
jp 0x180011985
mov r11, r11
jnp 0x180011985
jnp 0x18000cf4a
and dword [rbx + 0x18], 0
Function at 0x18001524c
Capabilities:
Encode data using base64

Disassembly:
movsxd r9, dword [r9]
jb 0x18000d0bf
nop
jae 0x18000d0bf
mov r8d, edi
mov rcx, rbx
call fcn.18000a0ff
lea rcx, [rbp - 0x29]
call fcn.180013824
call fcn.18000cef1
invalid
mov r9, qword [rsp + 8]
je 0x180008599
mov r13, r13
jne 0x180008599
cmp r10d, 0xffffffff
jb 0x18000b094
jb 0x18000dda7
call fcn.1800116a0
sub eax, 0xffc3ad8e
inc ebx
add qword [rsp + 0x10], r15
jb 0x18000a135
mov r11, r11
jae 0x18000a135
test rax, rax
call fcn.180012437
ret 0xe05a
popfq
jo 0x180011ac2
xchg dl, dl
jno 0x180011ac2
add qword [rsp + 0x10], r13
jmp fcn.180009242
ret
pushfq
jb 0x180011558
mov ah, ah
jae 0x180011558
popfq
je 0x18000fda9
xchg r8, r8
jne 0x18000fda9
mov eax, dword [rbp + 7]
mov edi, 4
call fcn.18000c75f
sub eax, ecx
invalid
invalid
sub r9, 0x1e3b0fe4
jo 0x180014b5a
mov rcx, rcx
jno 0x180014b5a
lea rax, [rsp + 0x48]
lea r8d, [rdx + 0x10]
call fcn.1800073e0
mov ebx, 0xfffacc48
jmp [rbx - 0x2e]
add qword [rsp + 0x10], r9
jg 0x18000d0f2
xchg dl, dl
jle 0x18000d0f2
ret
xor r13, 0x3753c770
jmp fcn.18000e9c1
push r9
jo 0x180009ac4
xchg dx, dx
jno 0x180009ac4
pop rdx
ja 0x18000ce96
xchg r14, r14
jbe 0x18000ce96
mov rcx, rax
call fcn.18001426c
jbe 0x180015284
adc eax, 0x9cffffd0
ja 0x180014df8
mov r15, r15
jbe 0x180014df8
dec dword [rdi]
xchg byte [rbp - 5], ch
invalid
lea rdx, [0x1800134e2]
mov r9, r14
call fcn.18000d0ce
push rbx
cmp al, 0xf9
invalid
Function at 0x140001510
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov qword [r11 + 8], rdi
lea rax, [r11 + 8]
mov qword [r11 - 0x18], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 2
jne 0x140001558
mov ebx, edi
jmp 0x14000157c
test eax, eax
js 0x14000157c
lea rdx, str.TpmInit
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 2
cmove ebx, edi
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001592
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400044b8
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x870
mov rax, qword [0x14000c078]
xor rax, rsp
mov qword [rsp + 0x860], rax
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], r15d
mov ebx, 0x400
mov qword [rsp + 0x58], rbx
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x140004553
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400045ea
mov r9d, dword [rsp + 0x40]
cmp r9d, 1
jle 0x1400045cd
mov eax, 1
mov dword [rsp + 0x44], eax
cmp eax, r9d
jge 0x1400045cd
lea r14d, [rax + 1]
cdqe
lea rcx, [0x140009ba4]
lea r8, [0x140009bb0]
cmp r14d, r9d
cmove r8, rcx
mov rax, qword [rdi + rax*8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rsi
call fcn.1400012f0
mov ebx, eax
test eax, eax
js 0x1400045ea
mov eax, r14d
mov dword [rsp + 0x44], eax
mov r9d, dword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
jmp 0x140004567
lea rcx, [rsp + 0x60]
cmp r9d, 1
cmovle rcx, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
nop dword [rax + rax]
mov ebx, eax
test rdi, rdi
je 0x1400045fe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140007750
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x140004740
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
lea r8, str.LocalTpmInit
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
nop dword [rax + rax]
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov dword [rsp + 0x20], ebx
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400047c3
cmp ebx, 0x800700b7
jne 0x1400047c3
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
and qword [rdi], rbx
xor edx, edx
lea rcx, [0x140004640]
call qword [sym.imp.USER32.dll_EnumWindows]
nop dword [rax + rax]
nop
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140006c5c
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14000c078]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbp, qword [rdx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov esi, 0x104
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x34], esi
mov rcx, rbp
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
test eax, eax
jne 0x140006d29
cmp dword [rsp + 0x30], 2
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x143], bl
jne 0x140006cf8
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
nop dword [rax + rax]
dec eax
cmp eax, 0x103
setbe bl
jmp 0x140006d29
sub rcx, rdi
lea rax, [rsi + 0x7ffffefa]
test rax, rax
je 0x140006d19
mov al, byte [rcx + rdi]
test al, al
je 0x140006d19
mov byte [rdi], al
inc rdi
sub rsi, 1
jne 0x140006cfb
test rsi, rsi
lea rdx, [rdi - 1]
cmovne rdx, rdi
mov byte [rdx], bl
setne bl
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140007750
mov rbx, qword [rsp + 0x190]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret

Function at 0x140006d64
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x2d0
mov rax, qword [0x14000c078]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_memset
nop
lea rax, str.690113
mov qword [rsp + 0x20], rax
lea r9, str.http:__go.microsoft.com_fwlink__LinkID
lea r8, [0x140009f68]
mov edx, 0x104
lea rcx, [rsp + 0xb0]
call fcn.14000126c
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x140006e1b
mov dword [rsp + 0x40], 0x70
and dword [rsp + 0x44], 0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop dword [rax + rax]
test eax, eax
jne 0x140006e1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov dword [rsp + 0x30], ebx
mov eax, ebx
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.140007750
add rsp, 0x2d0
pop rbx
ret
Function at 0x1400074e8
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.1400a2000
add rsp, 0x28
jmp 0x1400074e8
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x14000c6a8], rbx
je 0x140007532
cmp rax, rbx
jne 0x140007547
mov edi, 1
mov eax, dword [0x14000c6b0]
cmp eax, 1
jne 0x140007554
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x1400075c1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000751b
mov eax, dword [0x14000c6b0]
test eax, eax
jne 0x1400075b7
mov dword [0x14000c6b0], 1
lea r14, [0x140009530]
lea rbx, [0x140009518]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x1400075a9
test eax, eax
jne 0x1400075ad
cmp qword [rbx], 0
je 0x14000759e
mov rax, qword [rbx]
mov rcx, qword [0x1400094f8]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x14000757f
test eax, eax
je 0x1400075c1
mov eax, 0xff
jmp 0x140007714
mov dword [0x14000c094], 1
mov eax, dword [0x14000c6b0]
cmp eax, 1
jne 0x1400075e9
lea rdx, [0x140009510]
lea rcx, [0x140009500]
call sub.msvcrt.dll__initterm
mov dword [0x14000c6b0], 2
test edi, edi
jne 0x1400075f6
xor eax, eax
xchg qword [0x14000c6a8], rax
cmp qword [0x14000c6b8], 0
je 0x14000762a
lea rcx, [0x14000c6b8]
call fcn.140007920
test eax, eax
je 0x14000762a
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000c6b8]
mov r9, qword [0x1400094f8]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x1400076b6
test cl, cl
je 0x14000764d
test edi, edi
jne 0x1400076b6
dec cl
cmp cl, 0x1f
ja 0x140007660
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x14000764d
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400047d8
mov dword [0x14000c090], eax
cmp dword [0x14000c0b0], 0
jne 0x14000769f
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000c094], 0
jne 0x1400076b4
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000c090]
jmp 0x140007714
cmp cl, 0x22
jne 0x1400076c8
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x1400076da
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x14000763d
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x14000780c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140007858
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140007850
cmp dword [rcx + 0x3c], edx
jl 0x140007850
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140007850
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140007858
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14011aab4
Capabilities:
Write file on windows

Disassembly:
jmp 0x1401e7d00
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140687f4b]
call fcn.14012139b
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x1401e7d58
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1401e7e6a
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x1401e7e03
cmp qword [rbp + 0x28], 0
jle 0x1401e7e03
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1401e7da1
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140120c11
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x1401e7e59
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1401e7e59
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14011b3ab
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1401aeb90
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1406875e6]
call fcn.14012139b
nop
mov qword [rbp + 8], 0
jmp 0x1401aebcf
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1401aec25
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1401aebc4
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret