joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cf330
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
xor esi, esi
mov qword [rsp + 0x58], rsi
lea rcx, [rsp + 0x58]
call fcn.1400055e0
nop
lea rcx, [rbx + 0xec4]
mov rbx, 0xffffffffffffffff
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400cf380
test rax, rax
jne 0x1400cf42f
mov rax, qword [rsp + 0x58]
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400cf3c0
cmp dword [rdx + 0x10], 0
jge 0x1400cf406
cmp dword [rax - 0xc], 0
jl 0x1400cf540
mov dword [rax - 0x10], esi
mov rax, qword [rsp + 0x58]
mov word [rax], si
xor dil, dil
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400cf3e0
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, dil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400ff350
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400cf41b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
jmp 0x1400cf3c0
lea rdx, str.SoftwareProcessLasso
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400cf440
lea rcx, [rsp + 0x58]
call fcn.140005c50
mov rdx, qword [rsp + 0x58]
cmp dword [rdx - 8], 1
jle 0x1400cf472
mov edx, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140005760
mov rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400cf3c0
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], 4
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6c]
xor r8d, r8d
lea rdx, str.UpdaterBetaCheck
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x1400cf500
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400cf3c0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x1400cf538
setne r8b
lea rdx, str.UpdateIncludeBetas
lea rcx, [0x14017ca70]
call fcn.140073e30
lea rdx, str.UpdaterBetaCheck
lea rcx, [0x14017ca10]
call fcn.140074480
mov dil, 1
jmp 0x1400cf3c3
mov ecx, 0x80070057
call fcn.140002b00
int3
Function at 0x1400cfa10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
call fcn.1400055e0
nop
mov r8, rbx
lea rdx, str.SYSTEMCurrentControlSetServices_s
lea rcx, [rsp + 0x40]
call fcn.140005d70
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400cfaca
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x4c], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, str.Disable_Performance_Counters
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x38], 0
setne bl
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400cfaf4
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ff350
add rsp, 0x60
pop rbx
ret

Function at 0x1400cfb10
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x58], rdi
lea rcx, [rsp + 0x58]
call fcn.1400055e0
nop
mov r8, rbx
lea rdx, str.SYSTEMCurrentControlSetServices_s
lea rcx, [rsp + 0x58]
call fcn.140005d70
mov dword [rsp + 0x60], edi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400cfbd1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 4]
xor r8d, r8d
lea rdx, str.Disable_Performance_Counters
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400cfbf2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400ff350
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x1400d0060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x60]
xor r15d, r15d
mov rax, qword [rsp + 0x68]
mov r13, rdx
mov r10, qword [rsp + 0x78]
mov qword [r14], r8
mov qword [r10], rax
mov rax, qword [r14]
cmp rax, r9
je 0x1400d0225
mov r12, qword [rsp + 0x70]
lea r8d, [r15 + 1]
mov rsi, qword [r10]
mov r9d, 0x3ff
mov r11d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x1400d0225
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rax]
cmp r8w, dx
jae 0x1400d00fa
lea eax, [r11 + rcx]
cmp ax, r9w
ja 0x1400d0245
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x1400d0110
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x1400d0110
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x1400d0123
movzx r9d, al
mov r11d, r15d
mov ebx, r15d
jmp 0x1400d016e
mov r9d, eax
cmp eax, 0x800
jae 0x1400d013d
shr r9d, 6
mov r11d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x1400d016e
cmp eax, 0x10000
jae 0x1400d0157
shr r9d, 0xc
mov r11d, 2
or r9b, 0xe0
mov ebx, r11d
jmp 0x1400d016e
shr r9d, 0x12
mov r11d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdi, r12
sub rdi, rsi
mov ecx, r8d
cmp rdi, rcx
jl 0x1400d0225
test dx, dx
jne 0x1400d01b9
mov rcx, qword [rsp + 0x40]
test byte [rcx + 0x14], 2
je 0x1400d01b9
lea edx, [r8 + 3]
cmp rdi, rdx
jl 0x1400d0225
mov byte [rsi], 0xef
inc qword [r10]
mov rcx, qword [r10]
mov byte [rcx], 0xbb
inc qword [r10]
mov rcx, qword [r10]
mov byte [rcx], 0xbf
inc qword [r10]
add qword [r14], 2
test bpl, bpl
jne 0x1400d01c8
cmp r11d, 3
jae 0x1400d01d4
mov rcx, qword [r10]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r10]
mov r9, qword [r10]
test r8d, r8d
jle 0x1400d0200
lea ecx, [r11 + r11*2]
add ecx, ecx
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r10]
mov r9, qword [r10]
test r8d, r8d
jg 0x1400d01e2
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rax, qword [r14]
cmp rax, qword [rsp + 0x58]
jne 0x1400d00af
mov rax, qword [rsp + 0x50]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x48]
mov eax, 2
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d1580
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rsi + 3]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400d1704
mov rdx, rbx
mov rcx, rdi
call fcn.1400d09b0
test al, al
jne 0x1400d1701
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rdx, [rdi + 0x81]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
mov r8d, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400d0750
nop
mov rax, qword [rsp + 0x40]
cmp dword [rax - 0x10], 0
je 0x1400d16d4
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call fcn.1400d02f0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x4c]
mov r8d, 2
lea rdx, [0x14014fc24]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400d16d4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d16cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d1726
call fcn.1400ff054
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov rax, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d1701
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400ff350
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14010b448
nop
int3
Function at 0x1400d3910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400d4920
push r12
push r13
push r15
sub rsp, 0x30
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x70], 0
mov rax, r8
mov qword [rsp], rax
mov r12, r9
mov r13, r8
mov r15, rdx
jbe 0x1400d4ba5
mov qword [rsp + 0x50], rbx
mov r11d, 1
mov qword [rsp + 0x60], rbp
mov r9d, 0x3ff
mov qword [rsp + 0x68], rsi
mov r10d, 0xdc00
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
cmp r13, r12
je 0x1400d4b88
mov rsi, r13
lea r14, [rsp + 8]
mov rax, r13
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0xa]
cmp r14, rcx
je 0x1400d4b4e
movzx ebp, word [r15]
movzx edx, byte [rax]
cmp bp, 1
jbe 0x1400d49d6
lea ecx, [rdx - 0x80]
cmp ecx, 0x3f
ja 0x1400d4b88
inc rax
and dx, 0x3f
or dx, bp
jmp 0x1400d4b31
cmp edx, 0x80
jae 0x1400d49f0
mov rsi, rax
xor ebx, ebx
inc rax
mov r8d, edx
xor edi, edi
jmp 0x1400d4acb
cmp edx, 0xc0
jb 0x1400d4b88
mov r8d, edx
cmp edx, 0xe0
jae 0x1400d4a1b
and r8d, 0x1f
xor r10d, r10d
xor edi, edi
mov r9d, r11d
mov ebx, r11d
xor r11d, r11d
jmp 0x1400d4a67
cmp edx, 0xf0
jae 0x1400d4a36
and r8d, 0xf
xor r10d, r10d
xor edi, edi
mov ebx, 2
xor r11d, r11d
jmp 0x1400d4a64
mov edi, r11d
cmp edx, 0xf8
jae 0x1400d4a4f
and r8d, 7
mov ebx, 3
mov r10d, r11d
jmp 0x1400d4a64
and r8d, 3
mov r10d, 1
cmp edx, 0xfc
sbb ebx, ebx
add ebx, 5
mov r9d, ebx
mov ecx, r9d
mov rsi, rax
sub ecx, r11d
inc ecx
movsxd rdx, ecx
mov rcx, r12
sub rcx, rax
cmp rcx, rdx
jl 0x1400d4b4e
inc rax
cmp r10d, r9d
jae 0x1400d4ab9
nop dword [rax]
movzx edx, byte [rax]
lea ecx, [rdx - 0x80]
cmp ecx, 0x3f
ja 0x1400d4b88
mov ecx, r8d
and edx, 0x3f
shl ecx, 6
mov r8d, edx
or r8d, ecx
dec r9d
inc rax
cmp r11d, r9d
jl 0x1400d4a90
mov r10d, 0xdc00
mov r9d, 0x3ff
mov r11d, 1
mov edx, r8d
shl edx, 6
test edi, edi
cmove edx, r8d
cmp edx, 0x10ffff
ja 0x1400d4b88
cmp edx, 0xffff
jbe 0x1400d4b0b
movzx ecx, dx
shr edx, 0xa
and cx, r9w
sub dx, 0x40
or cx, r10w
mov word [r15], cx
mov ecx, 0xd800
or dx, cx
jmp 0x1400d4b35
cmp ebx, 3
jb 0x1400d4b2c
cmp rax, r12
je 0x1400d4b4b
movzx r8d, byte [rax]
inc rax
lea ecx, [r8 - 0x80]
cmp ecx, 0x3f
ja 0x1400d4b88
and r8d, 0x3f
or edx, r8d
test bp, bp
jne 0x1400d4b35
mov word [r15], r11w
mov word [r14], dx
lea rcx, [r14 + 2]
mov r14, rcx
cmp rax, r12
jne 0x1400d49a0
jmp 0x1400d4b4e
mov rax, rsi
cmp rsi, rax
je 0x1400d4b88
lea rcx, [rsp + 0xa]
cmp r14, rcx
mov rcx, qword [rsp + 0x70]
jne 0x1400d4b6a
dec rcx
mov qword [rsp + 0x70], rcx
mov r13, rax
mov r11d, 1
mov r9d, 0x3ff
mov r10d, 0xdc00
test rcx, rcx
jne 0x1400d4980
mov rax, qword [rsp]
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
sub r13, rax
mov eax, 0x7fffffff
cmp r13, rax
cmovg r13d, eax
mov eax, r13d
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.1400ff350
add rsp, 0x30
pop r15
pop r13
pop r12
ret
Function at 0x1400d3930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x1400d3ac1
mov r15, qword [rsp + 0x60]
lea r8d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r9d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x1400d3ac1
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r8w, dx
jae 0x1400d39cb
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x1400d3ae8
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x1400d39e2
mov eax, ecx
add cx, r11w
cmp cx, r9w
ja 0x1400d39e2
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x1400d39f5
movzx r9d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x1400d3a42
mov r9d, eax
cmp eax, 0x800
jae 0x1400d3a0f
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov r11d, r8d
jmp 0x1400d3a42
cmp eax, 0x10000
jae 0x1400d3a29
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov r11d, r10d
jmp 0x1400d3a42
shr r9d, 0x12
mov r10d, 3
movzx r11d, sil
or r9b, 0xf0
xor r11d, 1
add r11d, r11d
lea r8d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r8d
cmp rdx, rcx
jl 0x1400d3ac1
add qword [r14], 2
test sil, sil
jne 0x1400d3a63
cmp r10d, 3
jae 0x1400d3a6f
mov rcx, qword [rbx]
mov r8d, r11d
mov byte [rcx], r9b
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jle 0x1400d3a9e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jg 0x1400d3a80
shr eax, 0xa
mov r8d, 1
test sil, sil
mov ecx, r8d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x1400d397f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x1400d3acf
Function at 0x1400d4f90
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rdx
mov esi, r8d
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400d5053
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1400d504a
mov qword [rsp + 0x60], rbx
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x1400d5033
cmp dword [rsp + 0x28], esi
je 0x1400d5033
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, dword [rsp + 0x28]
cmp r8d, eax
je 0x1400d5033
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x1400d5033
mov rcx, rax
call rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1400d4ff0
mov rbx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ff350
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x1400d5230
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rdx, rdx
je 0x1400d5312
lea rax, [0x14017c4c8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x40], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x28], rax
lea r8, [0x1400d4e60]
xor edx, edx
mov dword [rsp + 0x20], 4
xor ecx, ecx
mov dword [rsp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x1400d5312
mov r8d, dword [rsp + 0x48]
mov rdx, qword [sym.imp.KERNEL32.dll_SuspendThread]
call fcn.1400d4f90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x4c]
mov dword [rsp + 0x4c], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x48]
mov rdx, qword [sym.imp.KERNEL32.dll_ResumeThread]
call fcn.1400d4f90
cmp dword [rsp + 0x4c], 0
setne al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ff350
add rsp, 0x60
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ff350
add rsp, 0x60
pop rbx
ret
Function at 0x1400d6230
Capabilities:
Query service status
Stop service

Disassembly:
push rsi
sub rsp, 0x70
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x1400d626e
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ff350
add rsp, 0x70
pop rsi
ret
mov r8d, 0xa0
mov qword [rsp + 0x90], rdi
lea rdx, str.ProcessGovernor
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1400d62a4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400d6369
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400d62c4
cmp dword [rsp + 0x44], 4
je 0x1400d62c4
mov al, 1
jmp 0x1400d6369
mov qword [rsp + 0x88], rbp
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rdi
xor bpl, bpl
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1400d634b
mov qword [rsp + 0x80], rbx
mov ecx, 0xfa
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jle 0x1400d6340
nop dword [rax]
cmp ebx, 0x14
jge 0x1400d6343
cmp dword [rsp + 0x24], 1
je 0x1400d6340
mov ecx, 0xfa
inc ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jg 0x1400d6310
cmp ebx, 0x14
jge 0x1400d6343
mov bpl, 1
mov rbx, qword [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, bpl
mov rbp, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ff350
add rsp, 0x70
pop rsi
ret
Function at 0x1400d6950
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov eax, 0x1060
call fcn.1400ff8d0
sub rsp, rax
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rsi, r9
mov rdi, r8
mov rbx, rdx
xor ebp, ebp
mov qword [rsp + 0x38], rbp
lea rcx, [rsp + 0x38]
call fcn.1400055e0
nop
mov rcx, rsi
call fcn.1400056e0
mov r9, rdi
mov r8, rbx
lea rdx, str._s._s
lea rcx, [rsp + 0x38]
call fcn.140005d70
mov rdi, qword [rsp + 0x38]
mov word [rsp + 0x50], bp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9d, [rbp + 1]
xor r8d, r8d
lea rdx, str.Local_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rbx, [rbp - 1]
test eax, eax
jne 0x1400d6a31
mov dword [rsp + 0x40], 0x800
mov dword [rsp + 0x44], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x1400d6a78
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor dil, dil
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400d6a51
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, dil
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.1400ff350
mov rbx, qword [rsp + 0x1080]
add rsp, 0x1060
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rsi]
cmp dword [rax - 0x10], 0
je 0x1400d6a31
lea rax, [rsp + 0x50]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x1400d6a90
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140005a90
mov dil, 1
jmp 0x1400d6a34

Function at 0x1400f52fc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x1400e1926
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x1400e1909
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1400e18f4

Function at 0x1400ffac0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ffb0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ffb0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ffb0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ffb0a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ffb0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400ffb0c
xor al, al
add rsp, 0x28
ret

Function at 0x14011aee8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14011acd8
Function at 0x1401246ac
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140124733
mov rsi, rbx
cmp word [rax], bp
je 0x1401246f2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1401246dc
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1401246d8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14011d818
mov rdi, rax
test rax, rax
je 0x140124720
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14012c6c0
mov rbp, rdi
xor ecx, ecx
call fcn.14011d7dc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret