joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140067040
Capabilities:
Get graphical window text

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rcx, qword [0x1401e8670]
xor eax, eax
xor r9d, r9d
mov qword [rbp - 0x48], rax
xor r8d, r8d
mov qword [rbp - 0x34], rax
mov edx, 0x147
mov qword [rbp - 0x50], 0x55
mov dword [rbp - 0x40], 0x55
mov qword [rbp - 0x3c], 0xaa
mov dword [rbp - 0x2c], 0xff
mov dword [rbp - 0x28], 0x55
mov qword [rbp - 0x24], 0xaa
mov dword [rbp - 0x1c], 0xff
mov dword [rbp - 0x18], 0x33
mov qword [rbp - 0x14], 0xcc
mov dword [rbp - 0xc], 0xff
mov dword [rbp - 8], 0x1c71c7
mov dword [rbp - 4], 0xe38e38
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rdx, eax
mov ecx, 3
add rdx, rdx
cmp eax, 2
cmovge eax, ecx
mov ecx, dword [rbp + rdx*8 - 0x44]
mov r9d, dword [rbp + rdx*8 - 0x48]
mov r8d, dword [rbp + rdx*8 - 0x4c]
mov edx, dword [rbp + rdx*8 - 0x50]
mov dword [rsp + 0x20], ecx
lea ecx, [rax + 0xc51]
call fcn.140021050
mov rcx, qword [0x1401e8670]
mov rdx, rax
mov r8d, 0xffffffff
add rsp, 0x80
pop rbp
jmp fcn.140055910
Function at 0x140067930
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r12d, r8d
mov rdi, rdx
mov r15, rcx
mov r14d, 0x104
mov r8d, r14d
lea rcx, [rsp + 0x70]
xor edx, edx
mov r13, r9
call fcn.140136540
mov eax, dword [rbp + 0xf0]
xor esi, esi
mov r8d, eax
mov qword [rsp + 0x60], rsi
xor edx, edx
mov qword [rsp + 0x50], rsi
mov rcx, r13
mov dword [rsp + 0x58], 0xffffffff
mov dword [rsp + 0x5c], eax
call fcn.140136540
test rdi, rdi
je 0x140067b22
mov rax, 0xffffffffffffffff
mov rbx, rax
nop
inc rbx
cmp byte [rdi + rbx], sil
jne 0x1400679c0
test rbx, rbx
je 0x1400679dc
nop
cmp byte [rdi + rbx], 0x5c
je 0x140067a0d
sub rbx, 1
jne 0x1400679d0
lea rax, [rsp + 0x60]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140067a75
mov qword [rsp + 0x60], rsi
jmp 0x140067b0e
cmp rbx, r14
jae 0x140067b22
inc rax
cmp byte [rdi + rax], sil
jne 0x140067a16
inc rax
lea rcx, [rsp + 0x70]
cmp rax, r14
mov rdx, rdi
cmovb r14, rax
mov r8, r14
call fcn.140135ea0
lea rax, [rsp + 0x50]
mov byte [rsp + r14 + 0x6f], sil
mov byte [rsp + rbx + 0x70], sil
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r15
inc rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140067abd
mov qword [rsp + 0x50], rsi
jmp 0x140067afe
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, str.Akeo_ConsultingRufus
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140067abd
mov qword [rsp + 0x50], rsi
jmp 0x140067afe
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x140067af9
test eax, eax
jne 0x140067afe
cmp dword [rsp + 0x58], r12d
jne 0x140067afe
cmp dword [rsp + 0x5c], esi
jbe 0x140067afe
mov esi, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140067b0e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140067b1e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x140067b24
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400b2a30
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140068210
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rdi, qword [0x14019f588]
lea rcx, str.Disk_image_analysis:
xor ebx, ebx
mov qword [rsp + 0x88], rbx
call fcn.14004f2f0
mov rcx, rdi
call fcn.140067550
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test rsi, rsi
je 0x14006828c
mov rcx, rsi
call fcn.1400e8c70
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rbp, 0xffffffffffffffff
jne 0x1400682b9
mov rdx, rdi
lea rcx, str.__Could_not_open_image__s
call fcn.14004f2f0
movzx eax, bpl
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, rdi
call fcn.140067f30
test al, al
setne dil
cmp byte [0x1401e8f6c], bl
jne 0x14006838c
mov eax, dword [0x1401e9090]
mov dword [0x140196fb0], eax
add eax, 0xfffffe00
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbp
cmp eax, 0xfe00
jbe 0x1400682ff
mov dword [0x140196fb0], 0x200
lea rcx, [rsp + 0x40]
call fcn.14007bc50
test eax, eax
jne 0x140068331
lea rdx, str.__Image
lea rcx, str._s_does_not_have_a_Boot_Marker
call fcn.14004f2f0
mov eax, dword [0x14019f630]
neg eax
sbb dil, dil
and dil, 2
jmp 0x14006838c
lea r14, [0x14014fed0]
mov edi, ebx
mov rsi, r14
nop dword [rax]
lea rcx, [rsp + 0x40]
call qword [rsi]
test eax, eax
jne 0x14006836b
inc edi
add rsi, 0x10
cmp edi, 0xd
jb 0x140068340
lea rdx, str.__Image
lea rcx, str._s_has_an_unknown_Master_Boot_Record
call fcn.14004f2f0
jmp 0x140068389
movsxd r8, edi
lea rdx, str.__Image
add r8, r8
lea rcx, str._s_has_a__s_Master_Boot_Record
mov r8, qword [r14 + r8*8 + 8]
call fcn.14004f2f0
mov dil, 1
lea rdx, [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400683ba
call fcn.14004fba0
mov rdx, rax
lea rcx, str.__Could_not_get_image_size:__s
call fcn.14004f2f0
mov dil, 0xfe
jmp 0x140068431
mov rax, qword [rsp + 0x90]
xor r9d, r9d
xor r8d, r8d
mov qword [0x1401e8f30], rax
mov rdx, rbx
mov dword [rsp + 0x80], 8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r8d, dword [rsp + 0x80]
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14006842b
movabs rax, 0x4d4957534d
mov byte [0x1401e8f4f], 1
cmp qword [rsp + 0x88], rax
je 0x140068431
mov byte [0x1401e8f4f], bl
test rbp, rbp
je 0x14006843f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14006b9b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rdx
mov r15, rcx
mov r14d, 0x104
lea rcx, [rsp + 0x70]
mov r8d, r14d
xor edx, edx
call fcn.140136540
xor esi, esi
mov dword [rsp + 0x58], 0xffffffff
lea r12, [0x1401e5eb0]
mov qword [rsp + 0x60], rsi
mov rcx, r12
mov qword [rsp + 0x50], rsi
xor edx, edx
mov dword [rsp + 0x5c], 0x1ff
mov r8d, 0x1ff
call fcn.140136540
test rdi, rdi
je 0x14006bba3
mov rax, 0xffffffffffffffff
mov rbx, rax
inc rbx
cmp byte [rdi + rbx], sil
jne 0x14006ba43
test rbx, rbx
je 0x14006ba5d
cmp byte [rdi + rbx], 0x5c
je 0x14006ba8e
sub rbx, 1
jne 0x14006ba51
lea rax, [rsp + 0x60]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14006baf6
mov qword [rsp + 0x60], rsi
jmp 0x14006bb8f
cmp rbx, r14
jae 0x14006bba3
inc rax
cmp byte [rdi + rax], sil
jne 0x14006ba97
inc rax
lea rcx, [rsp + 0x70]
cmp rax, r14
mov rdx, rdi
cmovb r14, rax
mov r8, r14
call fcn.140135ea0
lea rax, [rsp + 0x50]
mov byte [rsp + r14 + 0x6f], sil
mov byte [rsp + rbx + 0x70], sil
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r15
inc rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14006bb3e
mov qword [rsp + 0x50], rsi
jmp 0x14006bb7f
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, str.Akeo_ConsultingRufus
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14006bb3e
mov qword [rsp + 0x50], rsi
jmp 0x14006bb7f
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r12
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x14006bb7a
test eax, eax
jne 0x14006bb7f
cmp dword [rsp + 0x58], 1
jne 0x14006bb7f
cmp dword [rsp + 0x5c], esi
jbe 0x14006bb7f
mov esi, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14006bb8f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14006bb9f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x14006bba5
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400b2a30
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14006bed0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
lea rcx, [0x1401e8440]
mov r15, r9
call fcn.14006bbf0
lea rcx, [0x140156a6c]
mov rdi, rax
call fcn.14006bbf0
mov rsi, rax
test r15, r15
jne 0x14006bf12
xor ebx, ebx
jmp 0x14006bf24
mov edx, 2
mov ecx, 0x104
call fcn.1400c4f6c
mov rbx, rax
mov r9, rbx
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test ebp, ebp
je 0x14006bf89
mov qword [rsp + 0x38], 0
mov r9d, 0xffffffff
mov qword [rsp + 0x30], 0
mov r8, rbx
mov dword [rsp + 0x28], 0x104
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test eax, eax
jne 0x14006bf89
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test rbx, rbx
je 0x14006bf96
mov rcx, rbx
call fcn.1400e8c70
test rsi, rsi
je 0x14006bfa3
mov rcx, rsi
call fcn.1400e8c70
test rdi, rdi
je 0x14006bfb0
mov rcx, rdi
call fcn.1400e8c70
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x60]
mov eax, ebp
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14006d250
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
xor edx, edx
mov byte [rsp + 0x30], 0
mov r8d, 0x103
lea rcx, [rsp + 0x31]
call fcn.140136540
xor eax, eax
cmp dword [0x1401d0500], 0x62
mov qword [0x1401e8f6e], rax
jb 0x14006d2cc
mov ebx, 1
mov ecx, ebx
call fcn.140068780
test al, 4
je 0x14006d2cc
cmp byte [0x1401e8f4f], 0
jne 0x14006d320
mov rcx, qword [0x14019f588]
xor edx, edx
call fcn.14006ab70
test rax, rax
jne 0x14006d2e7
lea rcx, str.Could_not_mount_Windows_ISO_for_build_number_detection
call fcn.14004f2f0
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400b2a30
add rsp, 0x1d0
pop rbx
ret
lea rcx, [0x1401e8c82]
mov edx, 0x80
mov qword [rsp + 0x28], rcx
lea r9, [0x140163980]
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x20], rax
mov r8, 0xffffffffffffffff
call fcn.140004fd0
mov byte [rsp + 0x1bf], 0
mov qword [rsp + 0x1e0], rsi
lea r9, [rsp + 0x30]
mov qword [rsp + 0x1e8], rdi
call fcn.14006bed0
test eax, eax
je 0x14006d345
cmp byte [rsp + 0x30], 0
jne 0x14006d36e
mov eax, dword [0x140172238]
movsd xmm0, qword [str..RufVXml.tmp]
mov dword [rsp + 0x38], eax
movzx eax, word [0x14017223c]
mov word [rsp + 0x3c], ax
mov byte [rsp + 0x3d], 0
movsd qword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call fcn.14006bbf0
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rdi, rdi
je 0x14006d399
mov rcx, rdi
call fcn.1400e8c70
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [0x1401e8f4f], 0
lea rcx, [rsp + 0x140]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], ebx
cmovne rcx, qword [0x14019f588]
lea r8, str._1_.xml
xor edx, edx
call fcn.1400696f0
test eax, eax
jne 0x14006d3e1
lea rcx, str.Could_not_acquire_WIM_index
call fcn.14004f2f0
jmp 0x14006d3ed
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.14006d090
lea rcx, [rsp + 0x30]
call fcn.14006bbf0
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rdi, rdi
je 0x14006d418
mov rcx, rdi
call fcn.1400e8c70
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [0x1401e8f4f], 0
mov rdi, qword [rsp + 0x1e8]
mov rsi, qword [rsp + 0x1e0]
jne 0x14006d47e
mov rcx, qword [0x14019cca0]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14006d477
xor r8d, r8d
xor edx, edx
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
mov rcx, qword [0x14019cca0]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14006d477
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14019cca0], 0xffffffffffffffff
mov byte [0x1401e5bd0], 0
cmp word [0x1401e8f6e], 0
je 0x14006d492
cmp word [0x1401e8f72], 0
jne 0x14006d494
xor ebx, ebx
mov eax, ebx
jmp 0x14006d2ce
Function at 0x1400778a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, rdx
mov eax, 0xffffffff
imul rbx, r9
mov r14, r9
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
cmp rbx, rax
jbe 0x1400778e7
lea rcx, str.read_sectors:_nSectors_x_SectorSize_is_too_big_n
call fcn.14004f2f0
mov rax, 0xffffffffffffffff
jmp 0x1400779ab
mov eax, r14d
xor r9d, r9d
imul eax, esi
xor r8d, r8d
imul rdx, rdi
mov dword [rsp + 0x58], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x140077928
call fcn.14004fba0
mov r8, rax
lea rcx, str.read_sectors:_Could_not_access_sector_0x_08llx____s_n
mov rdx, rdi
call fcn.14004f2f0
mov rax, 0xffffffffffffffff
jmp 0x1400779ab
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, qword [rsp + 0x70]
mov rcx, rbp
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140077956
mov ecx, dword [rsp + 0x58]
cmp rcx, rbx
je 0x1400779a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140077967
call fcn.14004fba0
jmp 0x14007796e
lea rax, [0x1401564ce]
mov rdx, rax
lea rcx, str.read_sectors:_Read_error__s_n
call fcn.14004f2f0
mov edx, dword [rsp + 0x58]
lea rcx, str.__Read:__d__Expected:__llu_n
mov r8, rbx
call fcn.14004f2f0
mov r9, rsi
lea rcx, str.__StartSector:_0x_08llx__nSectors:_0x_llx__SectorSize:_0x_llx_n
mov r8, r14
mov rdx, rdi
call fcn.14004f2f0
mov ecx, dword [rsp + 0x58]
mov eax, ecx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14007b160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rbx, rcx
mov dword [rsp + 0x30], 0x4e204f4e
lea rcx, [rbp + 0x150]
mov dword [rsp + 0x34], 0x20454d41
mov word [rsp + 0x38], 0x2020
lea rdx, str.FAT32___1
mov byte [rsp + 0x3a], 0x20
mov eax, 7
mov dword [rsp + 0x20], 0x4d9058eb
mov dword [rsp + 0x24], 0x4e495753
mov word [rsp + 0x28], 0x2e34
mov byte [rsp + 0x2a], 0x31
nop dword [rax]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x14007b1d0
mov eax, dword [rdx + 0x10]
movups xmm0, xmmword [rdx]
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
movzx eax, word [rdx + 0x14]
mov edx, 4
mov word [rcx + 0x14], ax
lea rax, [rsp + 0x50]
lea rcx, [0x140177050]
mov dword [rsp + 0x4c], 0xaa550000
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x14007b261
mov r9d, 0xb
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.140077b50
test eax, eax
je 0x14007b357
mov r9d, 0xb
lea r8, [rsp + 0x30]
mov edx, 0x47
mov rcx, rbx
call fcn.140077b50
test eax, eax
je 0x14007b357
mov r9d, 0x396
lea r8, [rbp + 0x150]
mov edx, 0x52
mov rcx, rbx
call fcn.140077b50
test eax, eax
je 0x14007b357
mov r9d, 0x10
lea r8, [rsp + 0x40]
mov edx, 0x3f0
mov rcx, rbx
call fcn.140077b50
test eax, eax
je 0x14007b357
mov r9d, 0x200
lea r8, [rsp + 0x50]
mov edx, 0x1c00
mov rcx, rbx
call fcn.140077b50
test eax, eax
je 0x14007b357
mov eax, 1
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
mov rbx, qword [rsp + 0x600]
xor eax, eax
add rsp, 0x5f0
pop rbp
ret
Function at 0x14007f8d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov r9d, 0x10b
mov dword [rsp + 0x20], 0xc031fcfa
lea r8, [rsp + 0x20]
mov dword [rsp + 0x24], 0xd88ed08e
xor edx, edx
mov dword [rsp + 0x28], 0x8d7c00bd
mov rbx, rcx
mov dword [rsp + 0x2c], 0xb8fbe066
mov dword [rsp + 0x30], 0xc08e1fe0
mov dword [rsp + 0x34], 0xef89ee89
mov dword [rsp + 0x38], 0xf30100b9
mov dword [rsp + 0x3c], 0x7c22eaa5
mov dword [rsp + 0x40], 0xd88e1fe0
mov dword [rsp + 0x44], 0xc031d08e
mov dword [rsp + 0x48], 0xbe8dc08e
mov dword [rsp + 0x4c], 0x5f601be
mov dword [rsp + 0x50], 0x836d7580
mov dword [rsp + 0x54], 0xff8110c7
mov dword [rsp + 0x58], 0xf2727dfe
mov dword [rsp + 0x5c], 0x6e00c4e8
mov dword [rsp + 0x60], 0x6361206f
mov dword [rsp + 0x64], 0x65766974
mov dword [rsp + 0x68], 0x72617020
mov dword [rsp + 0x6c], 0x69746974
mov dword [rsp + 0x70], 0x66206e6f
mov dword [rsp + 0x74], 0x646e756f
mov dword [rsp + 0x78], 0xe8feeb00
mov dword [rsp + 0x7c], 0x657200a5
mov dword [rbp - 0x80], 0x65206461
mov dword [rbp - 0x7c], 0x726f7272
mov dword [rbp - 0x78], 0x69687720
mov dword [rbp - 0x74], 0x7220656c
mov dword [rbp - 0x70], 0x69646165
mov dword [rbp - 0x6c], 0x6420676e
mov dword [rbp - 0x68], 0x65766972
mov dword [rbp - 0x64], 0xe8daeb00
mov dword [rbp - 0x60], 0x61700081
mov dword [rbp - 0x5c], 0x74697472
mov dword [rbp - 0x58], 0x206e6f69
mov dword [rbp - 0x54], 0x6e676973
mov dword [rbp - 0x50], 0x72757461
mov dword [rbp - 0x4c], 0x3d212065
mov dword [rbp - 0x48], 0x41353520
mov dword [rbp - 0x44], 0xb9eb0041
mov dword [rbp - 0x40], 0x720010e8
mov dword [rbp - 0x3c], 0x3e8126b6
mov dword [rbp - 0x38], 0xaa557dfe
mov dword [rbp - 0x34], 0xead175
mov dword [rbp - 0x30], 0xbb00007c
mov dword [rbp - 0x2c], 0x41b455aa
mov dword [rbp - 0x28], 0x327213cd
mov dword [rbp - 0x24], 0xaa55fb81
mov dword [rbp - 0x20], 0xc1f62c75
mov dword [rbp - 0x1c], 0xeb277401
mov dword [rbp - 0x18], 0x4001010
mov qword [rbp - 0x14], 0x7c0000
mov dword [rbp - 0xc], 0
mov dword [rbp - 8], 0x8458b00
mov dword [rbp - 4], 0x8b7cd1a3
mov dword [rbp], 0xd3a30a45
mov dword [rbp + 4], 0x4200b87c
mov dword [rbp + 8], 0xcd7cc9be
mov dword [rbp + 0xc], 0x4b8c313
mov dword [rbp + 0x10], 0x7c00bb02
mov dword [rbp + 0x14], 0x8a024d8b
mov dword [rbp + 0x18], 0x13cd0175
mov dword [rbp + 0x1c], 0xb4db31c3
mov dword [rbp + 0x20], 0x5e10cd0e
mov dword [rbp + 0x24], 0x3c56ac
mov word [rbp + 0x28], 0xf375
mov byte [rbp + 0x2a], 0xc3
call fcn.140077b50
test eax, eax
je 0x14007fb07
mov rcx, rbx
call fcn.14007ed30
test eax, eax
je 0x14007fb07
mov eax, 1
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rbp
ret
mov rbx, qword [rsp + 0x140]
xor eax, eax
add rsp, 0x130
pop rbp
ret
Function at 0x1400874a0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140087519
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140087519
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
cmp r9w, r11w
jae 0x140087519
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x14008750d
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x14008752b
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1400874fb
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x14008751b
Function at 0x14008d9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r13
push r15
sub rsp, 0x10
mov r9d, dword [rcx + 0x10]
mov r15, r8
mov r10, rdx
mov r13, rcx
mov rbp, 0xffffffffffffffff
cmp r8, 4
ja 0x14008d9d0
xor eax, eax
add rsp, 0x10
pop r15
pop r13
pop rbp
ret
mov qword [rsp], r14
mov r14d, 0
mov r8d, r14d
sub r15, 4
je 0x14008db6e
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 8], r12
lea r12, [0x140000000]
mov qword [rsp + 0x40], rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + r10]
and al, 0xfe
cmp al, 0xe8
jne 0x14008db4e
mov rcx, r8
sub rcx, rbp
cmp rcx, 3
jbe 0x14008da4e
mov r9d, r14d
movzx ecx, byte [r10 + r8 + 4]
lea rdx, [r10 + 4]
mov rbp, r8
lea eax, [rcx - 1]
cmp al, 0xfd
ja 0x14008da8e
add r9d, r9d
or r9d, 1
jmp 0x14008db4e
add cl, 0xff
shl r9d, cl
and r9d, 7
je 0x14008da2e
cmp byte [r9 + r12 + 0x13efc8], r14b
je 0x14008da7f
movzx eax, byte [r9 + r12 + 0x13efd0]
mov rcx, r8
sub rcx, rax
movzx eax, byte [rcx + r10 + 4]
inc al
test al, 0xfe
jne 0x14008da2e
add r9d, r9d
mov rbp, r8
or r9d, 1
jmp 0x14008db4e
movzx eax, byte [r10 + r8 + 3]
lea rdi, [r10 + 3]
mov esi, dword [r13 + 0xc]
lea rbx, [r10 + 2]
shl ecx, 8
lea r11, [r10 + 1]
or eax, ecx
movzx ecx, byte [rbx + r8]
shl eax, 8
or eax, ecx
movzx ecx, byte [r11 + r8]
shl eax, 8
or eax, ecx
sub eax, esi
sub eax, r8d
sub eax, 5
test r9d, r9d
je 0x14008db1c
mov ecx, r9d
mov ebx, 0x18
movzx r11d, byte [rcx + r12 + 0x13efd0]
shl r11d, 3
sub ebx, r11d
mov edx, eax
mov ecx, ebx
shr edx, cl
inc dl
test dl, 0xfe
jne 0x14008db0c
mov ecx, 0x20
mov edx, 1
sub ecx, r11d
shl edx, cl
dec edx
xor eax, edx
sub eax, esi
sub eax, r8d
sub eax, 5
jmp 0x14008dae2
lea r11, [r10 + 1]
lea rbx, [r10 + 2]
lea rdi, [r10 + 3]
lea rdx, [r10 + 4]
and eax, 0x1ffffff
mov ecx, eax
and ecx, 0x1000000
neg ecx
or eax, ecx
mov ecx, eax
mov byte [r11 + r8], al
shr ecx, 8
mov byte [rbx + r8], cl
mov ecx, eax
shr ecx, 0x10
shr eax, 0x18
mov byte [rdi + r8], cl
mov byte [rdx + r8], al
add r8, 4
inc r8
cmp r8, r15
jb 0x14008da10
mov r12, qword [rsp + 8]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, r8
sub rcx, rbp
cmp rcx, 3
ja 0x14008db83
add cl, 0xff
shl r9d, cl
mov r14d, r9d
mov dword [r13 + 0x10], r14d
mov rax, r8
mov r14, qword [rsp]
add rsp, 0x10
pop r15
pop r13
pop rbp
ret