joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push rbx
sub rsp, 0x870
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbx, rcx
cmp edx, 2
je 0x140001152
cmp edx, 0x10
je 0x14000114a
cmp edx, 0x111
je 0x140001043
call qword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x140001154
cmp r8w, 1
jne 0x140001152
mov rcx, qword [0x140005628]
lea rdx, [rsp + 0x250]
mov r8d, 0x100
mov qword [rsp + 0x868], rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [0x140005630]
lea rdx, [rsp + 0x50]
mov r8d, 0x100
call qword [sym.imp.USER32.dll_GetWindowTextW]
add byte [rax - 0x39], cl
and al, 0x30
add byte [rax], al
add byte [rax], al
lea rcx, [rsp + 0x250]
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov r8, 0xffffffffffffffff
lea rax, [rsp + 0x50]
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400010d0
add r8d, r8d
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rdi
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x250]
lea rdx, str.Path:__s_nContent:__s
lea rcx, [rsp + 0x450]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
lea r8, str.Info
lea rdx, [rsp + 0x450]
mov rcx, rbx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdi, qword [rsp + 0x868]
jmp 0x140001152
xor ecx, ecx
invalid
invalid
mov ah, ch
invalid

Function at 0x1400016ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140001d30
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d7a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d7a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d7a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d7a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d7a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d7c
xor al, al
add rsp, 0x28
ret
Function at 0x14000f550
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14000f57c
xor al, al
jmp 0x14000f6a0
movdqa xmm0, xmmword [0x14002fae0]
movdqa xmm1, xmmword [0x14002faf0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x14002fb00]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x14002fb10]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x14000f692
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14000f5f9
mov r11d, 2
jmp 0x14000f61d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14000f613
mov r11d, 1
jmp 0x14000f61d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x14000f6b5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14000f65a
mov byte [rcx + 2], 0x3d
jmp 0x14000f66a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x14000f67c
mov byte [rcx], 0x3d
jmp 0x14000f683
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x14000f5e0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x14000f69b

Function at 0x1400ca420
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x58], r8
seto dl
lea r9, [rdx + r8*4 + 0x7d545482]
mov dword [rsp + 0x20], 0x69c14a7b
mov r8, qword [rsp + 0x70]
sub rdx, qword [rsp + 0x58]
mov qword [rsp + 0x58], 0xcd27058
jge 0x140127f44
adc al, 0x5e
shr byte [rax], 0x1f
mov ebx, 0x86943862
movabs dword [0xf6d70632ae2d0b9b], eax
adc eax, 0xf3c9cd28
or dword [rdi + 0x55], edi
add al, 0x67
push 0x74
mov dh, 0xbc
test rax, 0xffffffff980c2b33
sub ecx, dword [rax + rbx*4]
adc bh, dl
insb byte [rdi], dx
xor dword [rdx], esi
cmp al, 0xb3
scasb al, byte [rdi]
or dword [rdi - 0x5d4a793a], eax
pop rbp
xchg ebx, eax
out dx, eax
mul dword [rdi - 0x25]
outsd dx, dword [rsi]
cmp byte [rsi + rsi*8 + 0x2d0b96cb], dl
test byte [rdx], 0xb
xlatb
div byte [0x133d664a5]
push rcx
push rcx
sub dh, cl
sti
lodsd eax, dword [rsi]
or byte [rdx - 0x34], bh
and ecx, edx
xor eax, ebx
mov bh, 4
fadd qword [rdi + 0x21]
nop
loope 0x1400ca47b
imul edi, dword [rbp - 0x110fd814], 0x53
cmp dh, byte [rax - 0x443f9bfb]
setp byte [rbx + 0x77]
invalid
Function at 0x1400e0a23
Capabilities:
Encode data using xor

Disassembly:
cmc
sbb al, 0xe3
pop rdi
stc
invalid
push rbx
sbb dh, byte [rbx]
add dword [rbx + 0x49], esp
cmp eax, 0x5d8d685e
mov qword [rsp + 0x18], rdi
setbe bl
sub r15, rdi
sub r15d, 0x3cdc36cd
lea rax, [rax + 0x14b91b54]
test rbx, rbx
jl 0x1401bb452
fadd dword [rbx - 0x6f75af72]
jno 0x1400e09f7
or bl, bl
xor edi, dword [rax + 0x6de803c5]
mov ebx, 0x7bef3af8
cmp dword [rdx], ebp
je 0x1400e09ea
or dword [rax - 0x23], esp
in eax, dx
xlatb
sbb bh, byte [rsi - 0x69]
int1
int1
pop rsp
pop rax
out dx, al
mov dh, 0x27
push rsi
sti
or al, 0xed
xor al, 0x41
invalid

Function at 0x140106fb1
Capabilities:
Encode data using xor

Disassembly:
call fcn.140188448
lea r13, [r10*8 + 0x740f546d]
or r13b, 0x88
neg r13
lea rax, [rax + 0x5a995ec1]
lea r13, [r10 + r10*2 + 0x64ef09b3]
mov r13d, 0x42e163a
mov r10b, 0xfd
xor r10w, r13w
xchg qword [rsp + 0x40], rax
mov qword [rsp + 0x28], r13
setge byte [rsp + 0x28]
not qword [rsp + 0x28]
jno 0x1400e3d75
loopne 0x140107053
sahf
retf
movsd dword [rdi], dword [rsi]
cdq
in eax, 0xc2
pop rcx
jmp 0xd827e55b
int1
lodsd eax, dword [rsi]
test byte [rsi + 0x880e35c], bl
scasb al, byte [rdi]
scasb al, byte [rdi]
xchg dword [0xc9ae5152], eax
std
pop rsi
sbb byte [rcx], cl
outsd dx, dword [rsi]
in eax, dx
mov edi, 0x7efc492e
in al, 0xb2
xor qword cs:[rdi + 0x78], rbx
cld
jle 0x14010703b
mov dl, 0x2e
xor qword [rdi + 0x78], rbx
xchg ebp, eax
js 0x14010704d
movsb byte [rdi], byte [rsi]
int1
loop 0x140107030
xor ah, byte [rsi + rbp*2 + 0x5e275e2a]
cmp ebp, dword [rcx]
adc eax, 0x848d319a
cmp edi, dword [rsi]
nop
pop rsi
mov edi, dword [rax + 0xa416c7d]
invalid

Function at 0x14016abea
Capabilities:
Encode data using xor

Disassembly:
jg 0x140129c98
lea r15, [r9 + 0x2c4b049b]
mov r9w, 0x7d7f
xor r15w, 0x2cb1
mov r9, qword [rsp + 0x10]
add qword [rsp + 8], 0xffffffffbfe7986e
or r15, 0x119a4a83
lea r15, [r15 + r15*4 + 0x58bd2e80]
xor r15, 0xaae67e1
and r15w, r15w
xor r15d, r15d
mov r15, qword [rsp + 0x20]
jne 0x14016ac02
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x40]
call fcn.1402068d4

Function at 0x1401dc0dd
Capabilities:
Encode data using xor

Disassembly:
xor rbp, qword [rsp + 0x50]
add qword [rsp], 0xffffffffffef2a8a
not r10d
mov r10, qword [rsp + 0x38]
bswap rbp
and rbp, qword [rsp + 0x50]
bswap ecx
test bpl, 0xb8
call fcn.1400acd70

Function at 0x1401e5529
Capabilities:
Encode data using xor

Disassembly:
jbe 0x14018ba3b
mov r15, qword [rsp + 0x60]
add qword [rsp + 0x28], 0xffffffffbfe763c0
add qword [rsp + 8], 0xffffffffbffee8d7
mov bx, word [rsp + 0x48]
mov r11, rsi
test r8b, bl
sets cl
mov rbx, qword [rsp + 0x30]
and r11d, dword [rsp + 0x4c]
and esi, dword [rsp + 0x49]
cmp r12w, 0x8e6
sete byte [rsp + 0x48]
add r8w, word [rsp + 0x4d]
call fcn.1401cff75
Function at 0x1406dc7ac
Capabilities:
Encode data using xor

Disassembly:
movabs rbp, 0x1c584d767daa5293
jb 0x14071d0b8
in eax, dx
sub byte [rax - 0x77], ah
cli
outsb dx, byte [rsi]
pushfq
fsubr qword [rsi]
in eax, dx
imul byte [rbx + 0xdb368dc]
and byte [rbx], ah
stosb byte [rdi], al
and eax, 0x10dcd12a
mov bh, 0x53
and r13d, dword [r11 + rdi]
xchg r10, rax
and edx, dword [rcx + 0x42]
js 0x1406dc83f
and ecx, dword [rcx - 0x2333c8de]
popfq
out 0x5a, al
je 0x1406dc810
adc ebx, dword [rbx + rbp*8]
sub eax, 0xed9a4d23
stosd dword [rdi], eax
fsubr qword [rbx + 0x40]
invalid
ficom word [rcx]
fcom qword fs:[rbx + 0x38]
jne 0x1406dc7c4
fdiv st(3), st(0)
invalid
xchg ebp, eax
call 0x1577cac28
invalid
or r13w, word [rsp + 0x32]
mov r13, qword [rsp + 0x20]
setl r12b
neg r12b
and rbp, r12
sete byte [rsp + 0x30]
cmp rbp, qword [rsp + 0x30]
mov r12d, 0x322b6188
mov byte [rsp + 0x30], r12b
mov rbp, qword [rsp + 0x10]
movsx r12w, r12w
call fcn.14034c7fc
cli
adc dword [rbx - 0x4072586a], ecx
sti
push rsi
adc al, 0x83
xchg esi, eax
add ebx, dword [rcx - 0x3c41f060]
test dword [rcx + 0x29b4f119], eax
shl dh, 0xe
fsub st(2)
invalid

Function at 0x14071d6cf
Capabilities:
Encode data using xor

Disassembly:
not dx
call fcn.1406eac38
jg 0x140684b41
lea r15, [r9 + 0x2c4b049b]
mov r9w, 0x7d7f
xor r15w, 0x2cb1
mov r9, qword [rsp + 0x10]
add qword [rsp + 8], 0xffffffffbf91538d
or r15, 0x119a4a83
lea r15, [r15 + r15*4 + 0x58bd2e80]
xor r15, 0xaae67e1
and r15w, r15w
xor r15d, r15d
mov r15, qword [rsp + 0x20]
jne 0x14071d6e7
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x40]
call fcn.1407c8ce2
Function at 0x140001ca0
Capabilities:
Get hostname

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x1400e8f01]
mov ecx, 0x20a
mov edx, 2
call fcn.140011aa0
test rax, rax
je 0x140001de9
mov dword [rbp - 0x14], 0x105
lea rdx, [rbp - 0x14]
mov qword [rbp - 0x10], rax
mov rcx, rax
call sub.KERNEL32.dll_GetComputerNameW
test eax, eax
je 0x140001d30
mov r8d, dword [rbp - 0x14]
lea rcx, [rbp - 0x58]
mov rdx, qword [rbp - 0x10]
call fcn.14002e700
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x48]
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x20], rdx
call fcn.140036c70
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x140001d4b
vmovdqu xmm0, xmmword [rbp - 0x30]
jmp 0x140001da6
mov qword [rsi], 0
mov edx, 0x20a
mov r8d, 2
mov rcx, qword [rbp - 0x10]
jmp 0x140001dd5
mov r14, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x140001d89
js 0x140001dfa
movzx eax, byte [0x1400e8f01]
mov edx, 1
mov rcx, rdi
call fcn.140011aa0
mov rbx, rax
test rax, rax
jne 0x140001d8e
mov ecx, 1
mov rdx, rdi
call fcn.1400b9dc0
jmp 0x140001dff
mov ebx, 1
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
vmovq xmm0, rdi
vpbroadcastq xmm0, xmm0
mov rcx, qword [rbp - 0x10]
mov qword [rsi], rbx
vmovdqu xmmword [rsi + 8], xmm0
mov edx, 0x20a
mov r8d, 2
call fcn.140011ab0
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x140001dda
mov r8d, 1
mov rcx, qword [rbp - 0x20]
call fcn.140011ab0
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov ecx, 2
mov edx, 0x20a
call fcn.1400b9dc0
ud2
call fcn.1400480a0
ud2
Function at 0x140001ea0
Capabilities:
Get hostname

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov dword [rbp - 0xc], 0
xor edi, edi
lea rdx, [rbp - 0xc]
xor ecx, ecx
call sub.KERNEL32.dll_GetComputerNameW
mov ebx, dword [rbp - 0xc]
test rbx, rbx
mov qword [rbp - 0x18], rbx
je 0x140001f09
lea rdi, [rbx + rbx]
movzx eax, byte [0x1400e8f01]
mov edx, 2
mov rcx, rdi
call fcn.140011aa0
test rax, rax
je 0x140002020
mov rcx, rax
mov edi, dword [rbp - 0xc]
jmp 0x140001f0e
mov ecx, 2
lea rdx, [rbp - 0xc]
mov qword [rbp - 0x20], rcx
call sub.KERNEL32.dll_GetComputerNameW
test eax, eax
je 0x140001f57
lea rcx, [rbp - 0x60]
mov rdx, qword [rbp - 0x20]
mov r8, rdi
call fcn.14002e700
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x50]
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x28], rdx
call fcn.140036c70
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x140001f7c
vmovdqu xmm0, xmmword [rbp - 0x38]
jmp 0x140001fd7
mov qword [rsi], 0
mov rdx, qword [rbp - 0x18]
test edx, edx
je 0x140002011
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp - 0x20]
jmp 0x14000200c
mov r14, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
test rdi, rdi
je 0x140001fba
js 0x14000202f
movzx eax, byte [0x1400e8f01]
mov edx, 1
mov rcx, rdi
call fcn.140011aa0
mov rbx, rax
test rax, rax
jne 0x140001fbf
mov ecx, 1
mov rdx, rdi
call fcn.1400b9dc0
jmp 0x140002034
mov ebx, 1
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
vmovq xmm0, rdi
vpbroadcastq xmm0, xmm0
mov qword [rsi], rbx
vmovdqu xmmword [rsi + 8], xmm0
mov rdx, qword [rbp - 0x18]
test edx, edx
je 0x140001ff9
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp - 0x20]
call fcn.140011ab0
mov rdx, qword [rbp - 0x58]
test rdx, rdx
je 0x140002011
mov r8d, 1
mov rcx, qword [rbp - 0x28]
call fcn.140011ab0
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov ecx, 2
mov rdx, rdi
call fcn.1400b9dc0
ud2
call fcn.1400480a0
ud2
Function at 0x1400032b0
Capabilities:
Get session user name

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x1400e8f01]
mov ecx, 0x202
mov edx, 2
call fcn.140011aa0
test rax, rax
je 0x1400033fc
mov dword [rbp - 0x14], 0x101
lea rdx, [rbp - 0x14]
mov qword [rbp - 0x10], rax
mov rcx, rax
call sub.ADVAPI32.dll_GetUserNameW
test eax, eax
je 0x140003343
mov r8d, dword [rbp - 0x14]
dec r8
lea rcx, [rbp - 0x58]
mov rdx, qword [rbp - 0x10]
call fcn.14002e700
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x48]
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x20], rdx
call fcn.140036c70
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x14000335e
vmovdqu xmm0, xmmword [rbp - 0x30]
jmp 0x1400033b9
mov qword [rsi], 0
mov edx, 0x202
mov r8d, 2
mov rcx, qword [rbp - 0x10]
jmp 0x1400033e8
mov r14, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x14000339c
js 0x14000340d
movzx eax, byte [0x1400e8f01]
mov edx, 1
mov rcx, rdi
call fcn.140011aa0
mov rbx, rax
test rax, rax
jne 0x1400033a1
mov ecx, 1
mov rdx, rdi
call fcn.1400b9dc0
jmp 0x140003412
mov ebx, 1
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
vmovq xmm0, rdi
vpbroadcastq xmm0, xmm0
mov rcx, qword [rbp - 0x10]
mov qword [rsi], rbx
vmovdqu xmmword [rsi + 8], xmm0
mov edx, 0x202
mov r8d, 2
call fcn.140011ab0
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x1400033ed
mov r8d, 1
mov rcx, qword [rbp - 0x20]
call fcn.140011ab0
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov ecx, 2
mov edx, 0x202
call fcn.1400b9dc0
ud2
call fcn.1400480a0
ud2

Function at 0x140006140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rbx, rcx
xor r14d, r14d
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
test rax, rax
je 0x140006209
mov rsi, rax
movsxd rax, dword [rax + 0x3c]
mov r12d, dword [rax + rsi + 0x88]
mov ebp, dword [r12 + rsi + 0x18]
test rbp, rbp
je 0x140006209
xor r13d, r13d
lea r14, [rsp + 0x20]
jmp 0x140006198
inc r13
cmp rbp, r13
je 0x140006206
mov eax, dword [rsi + r12 + 0x20]
add rax, rsi
mov r15d, dword [rax + r13*4]
add r15, rsi
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea r8, [rax + 1]
mov rcx, r14
mov rdx, r15
call fcn.140049cc0
cmp qword [rsp + 0x20], 0
jne 0x140006190
cmp qword [rsp + 0x30], rdi
jne 0x140006190
mov rcx, qword [rsp + 0x28]
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140006190
mov eax, dword [rsi + r12 + 0x1c]
add rax, rsi
mov eax, dword [rax + r13*4]
movzx ecx, word [rax + rsi]
cmp ecx, 0x50f
jne 0x140006206
movzx edx, byte [rax + rsi + 2]
mov r14d, 1
jmp 0x140006209
xor r14d, r14d
mov eax, r14d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400108e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140010922
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14001092a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14001093b
jmp 0x140010952
xor r10d, r10d
jmp 0x1400109dd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140010952
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140010969
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140010989
add r11, r8
jmp 0x140010aba
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140010a52
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140010a00
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140010a70
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140010a82
jmp 0x140010a9c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140010a9c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140010ab6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140010c50
Capabilities:
Enumerate threads
Hide thread from debugger

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
call sub.KERNEL32.dll_GetCurrentProcessId
mov esi, eax
mov ecx, 0xc
mov edx, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140010d11
mov rdi, rax
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x24], 0x1c
lea rdx, [rsp + 0x24]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x140010d09
mov r15, qword [sym.imp.ntdll.dll_NtSetInformationThread]
lea rbx, [rsp + 0x24]
jmp 0x140010ccf
mov rcx, rdi
mov rdx, rbx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x140010d09
cmp dword [rsp + 0x30], esi
jne 0x140010cc0
mov r8d, dword [rsp + 0x2c]
mov ecx, 0x60
xor edx, edx
call sub.KERNEL32.dll_OpenThread
test rax, rax
je 0x140010cc0
mov r14, rax
mov rcx, rax
mov edx, 0x11
xor r8d, r8d
xor r9d, r9d
call r15
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
jmp 0x140010cc0
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140011160
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov qword [rbp - 8], rcx
mov r14, qword [rdx]
add r9, r8
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x28], r9
mov word [rbp - 0x20], 0
mov dword [rbp - 0x18], 1
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x30]
call fcn.14000e470
mov dword [rbp + 0x1c], 0x800
mov dword [rbp + 0x18], 0
movzx eax, byte [0x1400e8f01]
mov ecx, 0x800
mov edx, 1
call fcn.140011aa0
test rax, rax
je 0x140011338
mov rbx, rax
mov qword [rbp], rax
mov qword [rbp + 8], 0x800
mov qword [rbp + 0x10], 0
mov rdi, qword [rbp - 0x48]
lea r12, [rbp + 0x1c]
lea r15, [rbp + 0x18]
mov rsi, qword [rbp + 8]
mov r13, qword [rbp + 0x10]
sub rsi, r13
nop word [rax + rax]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x14001124c
mov r8d, dword [rbp + 0x1c]
cmp rsi, r8
jae 0x140011210
mov rcx, rbp
mov rdx, r13
call fcn.1400b8bf0
mov rbx, qword [rbp]
jmp 0x1400111ff
test eax, eax
jne 0x14001126d
mov eax, dword [rbp + 0x1c]
mov qword [rbp + 0x10], rax
mov r14d, dword [rbp + 0x18]
cmp r14d, 0xb
jbe 0x1400112de
movabs rax, 0xde00000002
jmp 0x140011275
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x30], rax
mov byte [rbp - 0x18], 0xc
mov rdx, qword [rbp + 8]
mov r14b, 0xc
test rdx, rdx
je 0x140011297
mov r8d, 1
mov rcx, rbx
call fcn.140011ab0
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x1400112b1
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140011ab0
mov rax, qword [rbp - 0x30]
cmp r14b, 0xc
jne 0x1400112cb
mov rsi, qword [rbp - 8]
mov qword [rsi + 8], rax
mov dword [rsi], 1
jmp 0x140011321
cmp r14b, 4
jne 0x1400112ff
mov eax, dword [rax]
mov rsi, qword [rbp - 8]
mov dword [rsi + 4], eax
xor eax, eax
jmp 0x140011316
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x20], rax
vmovups xmm0, xmmword [rbp]
vmovaps xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x18], r14b
mov rdx, qword [rbp - 0x40]
test rdx, rdx
jne 0x1400112a0
jmp 0x1400112b1
movabs rax, 0xde00000002
mov rsi, qword [rbp - 8]
mov qword [rsi + 8], rax
mov eax, 1
mov dword [rsi], eax
lea rcx, [rbp - 0x30]
call fcn.140010d60
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 1
mov edx, 0x800
call fcn.1400b9dc0
ud2