joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400174a0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rbp + 0x1f], 7
xor r12d, r12d
mov qword [rbp + 0x17], r12
mov word [rbp + 7], r12w
lea r8d, [r12 + 0x15]
lea rdx, [0x140036250]
lea rcx, [rbp + 7]
call fcn.14000c2e0
nop
mov qword [rbp - 9], 7
mov qword [rbp - 0x11], r12
mov word [rbp - 0x21], r12w
lea r8d, [r12 + 0x1d]
lea rdx, str.SOFTWAREHewlett_PackardSNMP
lea rcx, [rbp - 0x21]
call fcn.14000c2e0
nop
add rbx, 8
mov r13b, 1
mov qword [rbp - 0x41], r12
mov dword [rbp - 0x49], r12d
cmp qword [rsi + 0x18], 8
jb 0x140017542
mov rsi, qword [rsi]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
mov rcx, rbx
call fcn.14000c2e0
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x41]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400175ae
xor dil, dil
jmp 0x1400175ff
mov rax, qword [rbx + 0x10]
lea ecx, [rax + rax + 2]
cmp qword [rbx + 0x18], 8
jb 0x1400175c0
mov rbx, qword [rbx]
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdx, qword [rbp + 7]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx edi, r13b
test eax, eax
cmovne edi, r12d
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rbp - 9], 8
jb 0x140017638
mov rax, qword [rbp - 0x21]
mov qword [rbp - 0x31], rax
test rax, rax
je 0x140017638
mov rax, qword [0x140045d10]
test rax, rax
jne 0x140017630
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x14001763f
xor edx, edx
lea rcx, [rbp - 0x31]
call rax
mov rax, qword [0x140045d10]
mov qword [rbp - 9], 7
mov qword [rbp - 0x11], r12
mov word [rbp - 0x21], r12w
cmp qword [rbp + 0x1f], 8
jb 0x140017682
mov rcx, qword [rbp + 7]
mov qword [rbp - 0x39], rcx
test rcx, rcx
je 0x140017682
test rax, rax
jne 0x14001767a
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x140017682
xor edx, edx
lea rcx, [rbp - 0x39]
call rax
movzx eax, dil
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14001b510
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400176b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov qword [rbp - 0x11], 7
xor esi, esi
mov qword [rbp - 0x19], rsi
mov word [rbp - 0x29], si
lea r8d, [rsi + 0x15]
lea rdx, [0x140036250]
lea rcx, [rbp - 0x29]
call fcn.14000c2e0
nop
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], rsi
mov word [rbp - 0x51], si
lea r8d, [rsi + 0x1d]
lea rdx, str.SOFTWAREHewlett_PackardSNMP
lea rcx, [rbp - 0x51]
call fcn.14000c2e0
nop
mov dword [rbp - 0x79], 1
lea rdx, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rdx, qword [rbp - 0x51]
lea rax, [rbp - 0x71]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400177f4
mov dword [rbp - 0x75], 0x20
xor eax, eax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], rax
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x3f], rax
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rdx, qword [rbp - 0x29]
lea rax, [rbp - 0x75]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x79]
xor r8d, r8d
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400177e9
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 7]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbx + 8]
lea rdx, [rbp + 7]
call fcn.14000c2e0
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rbp - 0x39], 8
jb 0x140017830
mov rax, qword [rbp - 0x51]
mov qword [rbp - 0x61], rax
test rax, rax
je 0x140017830
mov rdi, qword [0x140045d10]
test rdi, rdi
jne 0x140017828
call fcn.140019630
mov rdi, rax
mov qword [0x140045d10], rax
test rax, rax
je 0x140017837
xor edx, edx
lea rcx, [rbp - 0x61]
call rdi
mov rdi, qword [0x140045d10]
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], rsi
mov word [rbp - 0x51], si
cmp qword [rbp - 0x11], 8
jb 0x14001787c
mov rax, qword [rbp - 0x29]
mov qword [rbp - 0x69], rax
test rax, rax
je 0x14001787c
test rdi, rdi
jne 0x140017874
call fcn.140019630
mov rdi, rax
mov qword [0x140045d10], rax
test rax, rax
je 0x14001787c
xor edx, edx
lea rcx, [rbp - 0x69]
call rdi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14001b510
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140018ed0
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x140018fc9
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x30]
mov esi, edx
mov qword [rsp + 0x48], rbx
call fcn.1400197a0
mov rcx, rax
mov rbx, rax
call fcn.140019880
test al, al
je 0x140018fba
mov rcx, qword [0x140045d40]
mov qword [rsp + 0x50], rbp
xor ebp, ebp
test rcx, rcx
je 0x140018f3f
cmp rcx, 0xffffffffffffffff
je 0x140018f3f
lea r9, [rsp + 0x40]
mov r8d, 0x1f8
mov rdx, rdi
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call fcn.140019de0
mov r10, qword [0x140045d48]
mov rbx, rax
test r10, r10
je 0x140018f8e
cmp r10, 0xffffffffffffffff
je 0x140018f8e
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
lea r9, [rsp + 0x40]
mov rdx, rbx
not rcx
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x20], rbp
lea r8, [rcx - 1]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbp, qword [rsp + 0x50]
test rbx, rbx
je 0x140018fba
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, rbx
call fcn.140019d50
mov rcx, rbx
call fcn.14001ce3c
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
repz ret
Function at 0x140019510
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
lea rdx, str.SOFTWAREHewlett_PackardHPProfiler
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
xor bl, bl
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001959f
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14001959f
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x48]
lea rdx, str.AppendCSLSymbolServerPath
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140019594
cmp dword [rsp + 0x40], eax
seta bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x30
pop rbx
ret
Function at 0x140019d50
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov esi, edx
mov rbp, rcx
lea edx, [rsi + 1]
lea eax, [rdx - 1]
cmp eax, 0x7ffdeeff
ja 0x140019dcf
mov qword [rsp + 0x30], rbx
mov ecx, edx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r12
mov r12d, edx
call fcn.14001ce7c
mov r8d, r12d
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.14001d640
mov rbx, qword [rsp + 0x30]
test rdi, rdi
je 0x140019dc5
mov r9d, esi
mov r8, rbp
mov edx, r12d
mov rcx, rdi
call fcn.14001c49c
test eax, eax
jne 0x140019dbd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call fcn.14001ce3c
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x14001a2a0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
push rbx
push rbp
sub rsp, 0x148
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
call qword [sym.imp.KERNEL32.dll_DebugBreak]
cmp byte [0x140045d30], 0
jne 0x14001a2e9
lea rcx, [0x140045cd0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x140045d30], 1
lea rcx, [0x140045cd0]
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x168], rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140045d18]
xor r13d, r13d
mov r14d, r13d
test rbx, rbx
je 0x14001a3ed
mov rcx, qword [rbx + 0x30]
call fcn.1400197a0
mov qword [rsp + 0x170], r12
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x30], rax
nop word [rax + rax]
add r13, qword [rbx + 0x20]
mov r8d, 2
mov rdx, rbx
mov rcx, rax
inc r14
call fcn.140019de0
mov rsi, rax
test rax, rax
je 0x14001a3cb
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
mov eax, ecx
lea r12, [rcx - 1]
dec ecx
cmp ecx, 0x7ffdeeff
ja 0x14001a3c3
mov ecx, eax
mov r15d, eax
call fcn.14001ce7c
mov r8d, r15d
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.14001d640
test rdi, rdi
je 0x14001a3c3
mov r9d, r12d
mov r8, rsi
mov edx, r15d
mov rcx, rdi
call fcn.14001c49c
test eax, eax
jne 0x14001a3bb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call fcn.14001ce3c
mov rcx, rsi
call fcn.14001ce3c
mov rbx, qword [rbx + 0x10]
mov rax, qword [rsp + 0x30]
test rbx, rbx
jne 0x14001a340
mov r15, qword [rsp + 0x130]
mov r12, qword [rsp + 0x170]
mov rax, qword [str._llu_allocations_active__consuming__llu_bytes_r_n]
lea rcx, [rsp + 0x71]
xor edx, edx
mov qword [rsp + 0x38], rax
mov rax, qword [0x140039b08]
mov r8d, 0xaf
mov qword [rsp + 0x40], rax
mov rax, qword [0x140039b10]
mov byte [rsp + 0x70], 0
mov qword [rsp + 0x48], rax
mov rax, qword [0x140039b18]
mov qword [rsp + 0x50], rax
mov rax, qword [0x140039b20]
mov qword [rsp + 0x58], rax
mov rax, qword [0x140039b28]
mov qword [rsp + 0x60], rax
call fcn.14001d640
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x70]
mov r9, r14
mov edx, 0xb0
mov qword [rsp + 0x20], r13
call fcn.14001ce18
mov r14, qword [rsp + 0x138]
mov r13, qword [rsp + 0x140]
mov ebp, eax
lea eax, [rbp + 1]
lea ecx, [rax - 1]
cmp ecx, 0x7ffdeeff
ja 0x14001a4d0
mov ecx, eax
mov esi, eax
call fcn.14001ce7c
mov r8d, esi
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.14001d640
mov rbx, rdi
test rdi, rdi
je 0x14001a4d0
lea r8, [rsp + 0x70]
mov r9d, ebp
mov edx, esi
mov rcx, rbx
call fcn.14001c49c
test eax, eax
jne 0x14001a4c8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rbx
call fcn.14001ce3c
lea rcx, [0x140045cd0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, qword [rsp + 0x168]
mov rsi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14001b510
add rsp, 0x148
pop rbp
pop rbx
ret
Function at 0x14001aab0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp qword [0x140045d88], 0
jne 0x14001ab8f
call qword [sym.imp.dbghelp.dll_SymGetOptions]
or eax, 0x80000006
mov ecx, eax
call qword [sym.imp.dbghelp.dll_SymSetOptions]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call fcn.14001d640
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jae 0x14001ab23
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x1000
jmp 0x14001ab2e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x400
mov r8d, eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140045d88], rax
test rax, rax
je 0x14001ab8f
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 1]
call qword [sym.imp.dbghelp.dll_SymInitialize]
test eax, eax
je 0x14001ab72
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14001b510
add rsp, 0x158
ret
mov rcx, qword [0x140045d88]
test rcx, rcx
je 0x14001ab8f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140045d88], 0
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14001b510
add rsp, 0x158
ret
Function at 0x14001d85b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400420e0]
jne 0x14001b52a
rol rcx, 0x10
test cx, 0xffff
jne 0x14001b526
repz ret
ror rcx, 0x10
jmp 0x14001d7b4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140044c20]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140044d18]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001d839
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140044c20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001d85b
mov rax, qword [rsp + 0x88]
mov qword [0x140044d18], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140044cb8], rax
mov rax, qword [0x140044d18]
mov qword [0x140044b90], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140044ca0], rax
mov dword [0x140044b80], 0xc0000409
mov dword [0x140044b84], 1
mov rax, qword [0x1400420e0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400420e8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140044c18], eax
mov ecx, 1
call fcn.140023d68
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140033c00]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140044c18], 0
jne 0x14001d8e2
mov ecx, 1
call fcn.140023d68
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14001e404
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14001e274
Function at 0x1400253d8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14001f354
xor ebx, ebx
cmp qword [0x140045c80], rbx
mov rdi, rax
jne 0x1400254eb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400255c2
lea rdx, [0x140035ea0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400255c2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140045c80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140045c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140045c90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140045ca0], rax
test rax, rax
je 0x1400254e2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140045c98], rax
jmp 0x1400254f2
mov rax, qword [0x140045c98]
jmp 0x1400254f9
mov rax, qword [0x140045c98]
mov r11, qword [0x140045ca0]
cmp rax, rdi
je 0x140025560
cmp r11, rdi
je 0x140025560
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140045ca0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140025560
test rax, rax
je 0x140025560
call rsi
test rax, rax
je 0x14002555a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14002555a
test byte [rsp + 0x40], 1
jne 0x140025560
bts ebp, 0x15
jmp 0x1400255a0
mov rcx, qword [0x140045c88]
cmp rcx, rdi
je 0x1400255a0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400255a0
call rax
mov rbx, rax
test rax, rax
je 0x1400255a0
mov rcx, qword [0x140045c90]
cmp rcx, rdi
je 0x1400255a0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400255a0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140045c80]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400255c2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400255c4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001b510
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800110be
Capabilities:
Enumerate processes

Disassembly:
jmp 0x18001dee0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x298
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x6e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2b8]
mov rax, qword [0x180030040]
xor rax, rbp
mov qword [rbp + 0x268], rax
lea rcx, [0x18003709f]
call fcn.1800118c0
nop
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0
xor edx, edx
mov ecx, 2
call fcn.180011410
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x70], 0x130
lea rdx, [rbp + 0x70]
mov rcx, qword [rbp + 0x48]
call fcn.180011758
nop
lea rdx, [rbp + 0x70]
mov rcx, qword [rbp + 0x48]
call fcn.1800118cf
test eax, eax
je 0x18001dfa4
mov rax, qword [rbp + 0x290]
mov rdx, qword [rax]
lea rcx, [rbp + 0x9c]
call fcn.1800119c9
test eax, eax
jne 0x18001dfa2
mov eax, dword [rbp + 0x24]
cmp dword [rbp + 0x8c], eax
jbe 0x18001dfa2
mov eax, dword [rbp + 0x8c]
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x78]
mov dword [rbp + 4], eax
jmp 0x18001df5d
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x18002a9c0]
call fcn.18001176c
mov eax, edi
mov rcx, qword [rbp + 0x268]
xor rcx, rbp
call fcn.180011429
lea rsp, [rbp + 0x278]
pop rdi
pop rbp
ret

Function at 0x18001144c
Capabilities:
Create thread

Disassembly:
jmp 0x18001ad10
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x30]
lea rcx, [0x18003705e]
call fcn.1800118c0
nop
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
cmp dword [rbp + 0xc0], 0
je 0x18001ad91
cmp dword [rbp + 0xc0], 1
je 0x18001ad6b
cmp dword [rbp + 0xc0], 2
je 0x18001ad91
cmp dword [rbp + 0xc0], 3
je 0x18001ad91
jmp 0x18001ada3
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1800115d2]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov eax, 1
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret

Function at 0x1800114bf
Capabilities:
Terminate process

Disassembly:
jmp 0x180022d70
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x180027ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, eax
and r10d, 7
je 0x180027cd1
cmp eax, r10d
jge 0x180027cbf
call fcn.1800217a0
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov dword [rbx + 0x14], eax
mov eax, dword [rbx + 0x10]
xor r8d, r8d
mov r9d, eax
test eax, eax
jle 0x180027d12
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r10d, cl
nop word [rax + rax]
shr ecx, 8
lea eax, [r9 - 8]
mov byte [rdx], r10b
lea rdx, [rdx + 1]
inc r8d
mov dword [rbx + 0x14], ecx
mov r9d, eax
movzx r10d, cl
test eax, eax
jg 0x180027cf0
mov dword [rbx + 0x10], eax
jns 0x180027d3f
mov edx, dword [0x1800b4280]
mov rax, qword gs:[0x58]
mov ecx, 0x20
mov rax, qword [rax + rdx*8]
lea rdx, str.Corrupt_PNG
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x180027d72
mov r8, qword [rbx + 8]
nop dword [rax]
mov rax, qword [rbx]
cmp rax, r8
jb 0x180027d5c
xor dl, dl
jmp 0x180027d65
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x180027d50
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x180027d14
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x180027de7
mov edx, dword [0x1800b4280]
mov rax, qword gs:[0x58]
mov ecx, 0x20
mov rax, qword [rax + rdx*8]
lea rdx, str.Corrupt_PNG
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x180027e01
mov rcx, rbx
call fcn.18002d0d0
test eax, eax
je 0x180027dda
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.180082c50
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x180046530
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea rax, [rcx + 8]
mov r9d, 0x270
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x180046540
ret

Function at 0x180046580
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r10d, r10d
mov r11, rcx
test r9, r9
je 0x180046665
cmp r9, 0x40
jb 0x180046643
movsx eax, byte [rcx]
lea rcx, [rdx - 1]
add rcx, r9
movd xmm2, eax
lea rax, [r8 - 1]
punpcklbw xmm2, xmm2
add rax, r9
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
cmp rdx, rax
ja 0x1800465cd
cmp rcx, r8
jae 0x180046643
cmp rdx, r11
ja 0x1800465d7
cmp rcx, r11
jae 0x180046643
mov rcx, r9
mov qword [rsp + 0x10], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp], rdi
mov rbx, r8
lea rax, [rdx + 0x10]
sub rbx, rdx
movdqu xmm0, xmmword [rbx + rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rbx + rax]
lea rax, [rax + 0x40]
xorps xmm0, xmm2
xorps xmm1, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm0, xmmword [rbx + rax - 0x30]
movdqu xmmword [rax - 0x40], xmm1
xorps xmm0, xmm2
movdqu xmm1, xmmword [rbx + rax - 0x20]
movdqu xmmword [rax - 0x30], xmm0
xorps xmm1, xmm2
movdqu xmmword [rax - 0x20], xmm1
cmp r10, rcx
jb 0x1800465f1
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp]
cmp r10, r9
jae 0x180046665
sub r8, rdx
lea rax, [r10 + rdx]
sub r9, r10
nop dword [rax]
movzx ecx, byte [r8 + rax]
lea rax, [rax + 1]
xor cl, byte [r11]
mov byte [rax - 1], cl
sub r9, 1
jne 0x180046650
add rsp, 8
ret

Function at 0x180046a00
Capabilities:
Encode data using xor

Disassembly:
mov dword [rcx + 4], edx
lea r10, [rcx + 8]
mov eax, 1
nop dword [rax]
mov r9d, edx
lea r10, [r10 + 4]
shr r9d, 0x1e
xor edx, r9d
imul edx, r8d
add edx, eax
inc rax
mov dword [r10 - 4], edx
cmp rax, 0x270
jb 0x180046a10
mov dword [rcx], 0x270
ret

Function at 0x18004c3f0
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, dl
xor eax, ecx
imul eax, eax, 0x1000193
ret