joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400164b0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x1400920a0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r11, rcx
mov qword [rsp], rcx
xor r9b, r9b
lea r10, [rsp + 0x30]
mov ebx, 0x10
nop word [rax + rax]
movzx eax, r9b
lea r10, [r10 + 4]
movzx r8d, byte [rax + r11]
lea rdx, [rax + r11]
shl r8d, 8
movzx eax, r9b
add r9b, 4
movzx ecx, byte [rax + r11 + 1]
movzx eax, byte [rdx + 2]
or r8d, ecx
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + 3]
shl r8d, 8
or r8d, eax
mov dword [r10 - 4], r8d
sub rbx, 1
jne 0x140016500
mov r10b, 0x10
lea r9, [rsp + 0x30]
nop
mov ecx, dword [r9 + 4]
lea r9, [r9 + 4]
mov r8d, ecx
movzx eax, r10b
rol r8d, 0xe
inc r10b
mov edx, dword [rsp + rax*4 + 0x28]
mov eax, ecx
shr ecx, 3
ror eax, 7
xor r8d, eax
mov eax, edx
xor r8d, ecx
rol eax, 0xd
mov ecx, edx
shr edx, 0xa
rol ecx, 0xf
xor ecx, eax
xor ecx, edx
add r8d, ecx
add r8d, dword [r9 + 0x20]
add r8d, dword [r9 - 4]
mov dword [r9 + 0x3c], r8d
cmp r10b, 0x40
jb 0x140016550
movups xmm0, xmmword [r11 + 0x50]
lea rax, [r11 + 0x50]
xor esi, esi
movups xmm1, xmmword [rax + 0x10]
mov qword [rsp + 8], rax
movups xmmword [rsp + 0x10], xmm0
mov r15d, dword [rsp + 0x18]
lea r13d, [rsi + 0x40]
mov r12d, dword [rsp + 0x14]
mov ebx, dword [rsp + 0x10]
mov r11d, dword [rsp + 0x1c]
movups xmmword [rsp + 0x20], xmm1
mov ebp, dword [rsp + 0x28]
mov r14d, dword [rsp + 0x24]
mov edi, dword [rsp + 0x20]
mov eax, dword [rsp + 0x2c]
nop dword [rax]
nop dword [rax + rax]
mov ecx, edi
lea rsi, [rsi + 4]
rol ecx, 7
mov r10d, edi
ror r10d, 0xb
mov edx, edi
xor r10d, ecx
not edx
and edx, ebp
mov ecx, edi
ror ecx, 6
mov r9d, r12d
xor r10d, ecx
mov r8d, r15d
mov ecx, r14d
and ecx, edi
xor edx, ecx
lea rcx, [0x140082d90]
add r10d, edx
mov edx, ebx
add r10d, dword [rsi + rcx - 4]
mov ecx, ebx
add r10d, dword [rsp + rsi + 0x2c]
rol ecx, 0xa
add r10d, eax
ror edx, 0xd
mov eax, ebp
xor edx, ecx
mov ebp, r14d
mov ecx, ebx
mov r14d, edi
ror ecx, 2
lea edi, [r11 + r10]
xor edx, ecx
mov r11d, r15d
mov r15d, r12d
and r9d, r11d
mov r12d, ebx
mov ecx, r15d
or ecx, r11d
and ebx, ecx
lea ecx, [r10 + rdx]
or ebx, r9d
add ebx, ecx
sub r13, 1
jne 0x1400165f0
lea r8, [rsp + 0x10]
mov dword [rsp + 0x2c], eax
sub r8, qword [rsp]
lea edx, [r13 + 8]
mov rax, qword [rsp + 8]
mov dword [rsp + 0x10], ebx
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x24], r14d
mov dword [rsp + 0x18], r15d
mov dword [rsp + 0x14], r12d
mov dword [rsp + 0x1c], r11d
mov ecx, dword [r8 + rax - 0x50]
add dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x1400166b1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14003cd70
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001bc30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, qword [rsp + 0x90]
mov rsi, r9
mov rdi, r8
mov rbx, rdx
test r9, r9
jne 0x14001bc57
mov rdx, qword [rdx + 0x18]
jmp 0x14001bc8d
cmp qword [rdx + 0x18], 8
jb 0x14001bc61
mov rdx, qword [rdx]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001bd1f
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14001bcc8
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001bcc3
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001be11
mov rcx, r8
call fcn.14003cd90
xor esi, esi
mov word [rbx], si
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14001bd18
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001bd13
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001be11
mov rcx, r8
call fcn.14003cd90
xor al, al
jmp 0x14001bdf7
xor bpl, bpl
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001bd2f
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r14
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001bd61
cmp dword [rsp + 0x30], 3
mov eax, 1
movzx ebp, bpl
cmove ebp, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14001bda7
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001bda2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001be11
mov rcx, r8
call fcn.14003cd90
xor esi, esi
mov word [rbx], si
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14001bdf3
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001bdee
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001be11
mov rcx, r8
call fcn.14003cd90
movzx eax, bpl
mov word [rdi], si
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14004f8c4
int3
Function at 0x14001be20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x1400920a0]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rbx
cmp qword [rdx + 0x18], 8
jb 0x14001be5e
mov rdx, qword [rdx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001bf1c
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14001bec5
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001bec0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c068
mov rcx, r8
call fcn.14003cd90
xor esi, esi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14001bf15
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14001bf10
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c06e
mov rcx, r8
call fcn.14003cd90
xor al, al
jmp 0x14001c036
xor bpl, bpl
mov dword [rsp + 0x30], 0x800
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001bf34
mov rdx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001bf9b
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x14001bf9b
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001bf80
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140007c30
mov bpl, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14001bfe6
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001bfe1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c068
mov rcx, r8
call fcn.14003cd90
xor esi, esi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14001c032
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14001c02d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c06e
mov rcx, r8
call fcn.14003cd90
movzx eax, bpl
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.14003cd70
mov rbx, qword [rsp + 0x880]
add rsp, 0x860
pop rdi
pop rsi
pop rbp
ret
call fcn.14004f8c4
nop
call fcn.14004f8c4
int3
Function at 0x14001c080
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
cmp qword [rdx + 0x18], 8
mov rbx, r9
mov rsi, r8
mov r14, rdx
jb 0x14001c09c
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rbp
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x40], rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001c1b3
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x14001c10d
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001c108
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c307
mov rcx, r8
call fcn.14003cd90
xor edi, edi
mov word [r14], di
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 7
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14001c15e
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001c159
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c307
mov rcx, r8
call fcn.14003cd90
mov word [rsi], di
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 7
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14001c1ac
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001c1a7
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c307
mov rcx, r8
call fcn.14003cd90
xor al, al
jmp 0x14001c2e5
cmp qword [rbx + 0x18], 8
mov dil, 1
mov eax, dword [rbx + 0x10]
lea ecx, [rax*2 + 2]
mov rax, rbx
jb 0x14001c1cd
mov rax, qword [rbx]
cmp qword [rsi + 0x18], 8
mov rdx, rsi
jb 0x14001c1da
mov rdx, qword [rsi]
mov dword [rsp + 0x28], ecx
mov r9d, 1
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
movzx ebp, dil
xor edi, edi
test eax, eax
cmovne ebp, edi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x14001c24c
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001c247
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c307
mov rcx, r8
call fcn.14003cd90
mov word [r14], di
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 7
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14001c297
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001c292
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c307
mov rcx, r8
call fcn.14003cd90
mov word [rsi], di
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 7
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14001c2e1
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001c2dc
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c307
mov rcx, r8
call fcn.14003cd90
movzx eax, bpl
mov word [rbx], di
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
call fcn.14004f8c4
int3
Function at 0x14001c310
Capabilities:
Delete registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x48
cmp qword [rdx + 0x18], 8
mov rbx, r8
mov rdi, rdx
jb 0x14001c327
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rbp
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x40], rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001c3ef
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14001c398
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001c393
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c4c9
mov rcx, r8
call fcn.14003cd90
xor esi, esi
mov word [rdi], si
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14001c3e8
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001c3e3
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c4c9
mov rcx, r8
call fcn.14003cd90
xor al, al
jmp 0x14001c4a9
cmp qword [rbx + 0x18], 8
mov sil, 1
mov rdx, rbx
jb 0x14001c3ff
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
movzx ebp, sil
xor esi, esi
test eax, eax
cmovne ebp, esi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14001c45b
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001c456
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c4c9
mov rcx, r8
call fcn.14003cd90
mov word [rdi], si
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14001c4a5
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001c4a0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c4c9
mov rcx, r8
call fcn.14003cd90
movzx eax, bpl
mov word [rbx], si
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x60]
add rsp, 0x48
pop rdi
pop rbx
ret
call fcn.14004f8c4
int3
Function at 0x14001dc00
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400920a0]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor edi, edi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 7
lea r8d, [rdi + 0x17]
lea rdx, str.Uninstalling_service...
lea rcx, [rsp + 0x28]
call fcn.140007c30
lea rcx, [rsp + 0x28]
call fcn.14002e330
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 7
lea r8d, [rdi + 8]
lea rdx, str.SUPLSTCK
lea rcx, [rsp + 0x28]
call fcn.140007c30
lea rcx, [rsp + 0x28]
call fcn.14001b4f0
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 7
lea r8d, [rdi + 7]
lea rdx, str.UPLSTCK
lea rcx, [rsp + 0x28]
call fcn.140007c30
lea rcx, [rsp + 0x28]
call fcn.14001b4f0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14001dcd9
lea eax, [rdi - 5]
jmp 0x14001dd70
call fcn.140003340
sub rax, 0xffffffffffffff80
cmp qword [rax + 0x18], 8
jb 0x14001dcec
mov rax, qword [rax]
mov r8d, 0xf01ff
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14001dd14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [rbx - 8]
jmp 0x14001dd70
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14001dd2d
cmp dword [rsp + 0x2c], 1
je 0x14001dd49
lea r8, [rsp + 0x48]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14001dd49
lea edi, [rax - 9]
jmp 0x14001dd5c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov ecx, 0xfffffff6
test eax, eax
cmove edi, ecx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003cd70
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14001e360
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14001e3c1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14001e380
mov ecx, dword [r10]
jmp 0x14001e4aa
cmp ecx, 0x4e0
jb 0x14001e4aa
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001e3e0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001e430
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400289c0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rax, qword [0x1400920a0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, r8
mov r12, rdx
mov qword [rbp - 0x69], rdx
mov qword [rbp - 0x69], r8
xor r13d, r13d
mov ebx, r13d
mov dword [rbp - 0x19], ebx
mov qword [rbp - 0x11], r13
mov dword [rbp - 9], 0x6a09e667
mov dword [rbp - 5], 0xbb67ae85
mov dword [rbp - 1], 0x3c6ef372
mov dword [rbp + 3], 0xa54ff53a
mov dword [rbp + 7], 0x510e527f
mov dword [rbp + 0xb], 0x9b05688c
mov dword [rbp + 0xf], 0x1f83d9ab
mov dword [rbp + 0x13], 0x5be0cd19
mov r15, r8
cmp qword [r8 + 0x18], 8
jb 0x140028a4a
mov r15, qword [r8]
mov r14, qword [r8 + 0x10]
add r14, r14
mov rdi, r13
je 0x140028a97
nop word [rax + rax]
mov ecx, ebx
movzx eax, byte [rdi + r15]
mov byte [rbp + rcx - 0x59], al
mov ebx, dword [rbp - 0x19]
inc ebx
mov dword [rbp - 0x19], ebx
cmp ebx, 0x40
jne 0x140028a8f
lea rcx, [rbp - 0x59]
call fcn.1400164b0
add qword [rbp - 0x11], 0x200
mov ebx, r13d
mov dword [rbp - 0x19], ebx
inc rdi
cmp rdi, r14
jb 0x140028a60
mov ecx, 0x20
call fcn.14003d02c
mov rdi, rax
mov eax, ebx
mov byte [rbp + rax - 0x59], 0x80
inc rax
mov ecx, 0x38
mov r8d, 0x40
cmp ebx, ecx
cmovb r8d, ecx
cmp rax, r8
jae 0x140028ad5
sub r8, rax
lea rcx, [rbp - 0x59]
add rcx, rax
xor edx, edx
call fcn.14003f8d0
mov eax, dword [rbp - 0x19]
cmp eax, 0x38
jb 0x140028afe
lea rcx, [rbp - 0x59]
call fcn.1400164b0
xorps xmm2, xmm2
xor eax, eax
movups xmmword [rbp - 0x59], xmm2
movups xmmword [rbp - 0x49], xmm2
movups xmmword [rbp - 0x39], xmm2
mov qword [rbp - 0x29], rax
mov eax, dword [rbp - 0x19]
lea edx, [rax*8]
add rdx, qword [rbp - 0x11]
mov qword [rbp - 0x11], rdx
movzx eax, dl
mov byte [rbp - 0x1a], dl
mov rax, rdx
shr rax, 8
mov byte [rbp - 0x1b], al
mov rax, rdx
shr rax, 0x10
mov byte [rbp - 0x1c], al
mov rax, rdx
shr rax, 0x18
mov byte [rbp - 0x1d], al
mov rax, rdx
shr rax, 0x20
mov byte [rbp - 0x1e], al
mov rax, rdx
shr rax, 0x28
mov byte [rbp - 0x1f], al
mov rax, rdx
shr rax, 0x30
mov byte [rbp - 0x20], al
shr rdx, 0x38
mov byte [rbp - 0x21], dl
lea rcx, [rbp - 0x59]
call fcn.1400164b0
xor bl, bl
xor al, al
movzx r11d, bl
mov r10d, 3
sub r10d, r11d
shl r10d, 3
lea r9, [rbp - 9]
nop dword [rax + rax]
mov r8d, dword [r9]
mov ecx, r10d
shr r8d, cl
movzx ecx, al
lea edx, [r11 + rcx*4]
mov byte [rdx + rdi], r8b
inc al
lea r9, [r9 + 4]
cmp al, 8
jb 0x140028b80
inc bl
cmp bl, 4
jb 0x140028b61
mov rdx, rdi
mov rcx, r12
call fcn.140016700
mov rcx, rdi
call fcn.14003cd90
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x140028bf4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140028bef
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140028c2e
mov rcx, r8
call fcn.14003cd90
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], 7
mov word [rsi], r13w
mov rax, r12
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14003cd70
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14004f8c4
int3
Function at 0x14002e330
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x1400958ea], 0
mov rbx, rcx
je 0x14002e352
cmp qword [rcx + 0x18], 8
jb 0x14002e34c
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14002e38d
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14002e388
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002e3a4
mov rcx, r8
call fcn.14003cd90
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
add rsp, 0x20
pop rbx
ret
call fcn.14004f8c4
int3
Function at 0x140030850
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x1400920a0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x40], 0x238
xor edx, edx
lea ecx, [rbp + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x140030928
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x140030928
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400308e3
mov rdx, qword [rdi]
lea rcx, [rsp + 0x6c]
call fcn.140050a3c
test eax, eax
jne 0x140030915
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140030908
mov eax, dword [rsp + 0x48]
mov dword [rdx], eax
add qword [rbx + 8], 4
jmp 0x140030915
lea r8, [rsp + 0x48]
mov rcx, rbx
call fcn.140035030
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x1400308d6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14003096d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140030968
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400309a2
mov rcx, r8
call fcn.14003cd90
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14003cd70
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
call fcn.14004f8c4
int3