joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180051860
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.180066160
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x18008ebb0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x180051a52
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1800519a6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1800519a6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x18005198b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x180051928
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180051a12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x180051a71
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x180051a4d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x180051a71
jmp 0x1800518fe
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.18000c3e0
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x180051a90
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.180066160
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x18008ebb0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x180051c9d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x180051be9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x180051be9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x180051bc9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x180051b58
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180051c5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x180051cbc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x180051c98
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x180051cbc
jmp 0x180051b2e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.18000c3e0
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x180065988
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x180065a00
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x180065a00
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x180065a00
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1800659f4
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x180065a12
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1800659e2
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x180065a02
Function at 0x180066e00
Capabilities:
Check if file exists
Create thread
Get file attributes
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
cmp qword [rsp + 0x70], 0
jne 0x180066e21
mov eax, 1
jmp 0x180066fa6
mov rcx, qword [rsp + 0x78]
call fcn.180030820
test rax, rax
jne 0x180066e47
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 2
jmp 0x180066fa6
mov rcx, qword [rsp + 0x78]
call fcn.180030820
cmp rax, 0x104
jbe 0x180066e6e
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 3
jmp 0x180066fa6
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180066e93
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 7
jmp 0x180066fa6
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.LoadLibraryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x78]
call fcn.180030820
lea rax, [rax + rax + 2]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x180066f04
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 4
jmp 0x180066fa6
mov rcx, qword [rsp + 0x78]
call fcn.180030820
lea rax, [rax + rax + 2]
mov qword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x180066f4a
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 5
jmp 0x180066fa6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x180066f99
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 6
jmp 0x180066fa6
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x60
pop rdi
ret
Function at 0x180066fc0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x4f0
lea rdi, [rsp + 0x30]
mov ecx, 0x130
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x500]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x4e8], rax
lea rax, [rsp + 0x268]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
lea r8, [rsp + 0x500]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call fcn.180009020
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x278], rax
cmp qword [rsp + 0x278], 0xffffffffffffffff
jne 0x180067046
xor eax, eax
jmp 0x1800670f8
mov dword [rsp + 0x290], 0x238
lea rdx, [rsp + 0x290]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [rsp + 0x4d4], eax
cmp dword [rsp + 0x4d4], 0
je 0x1800670e8
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x2bc]
call fcn.180030870
test eax, eax
jne 0x1800670c9
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x298]
call fcn.180067130
mov qword [rsp + 0x4d8], rax
cmp qword [rsp + 0x4d8], 0
jne 0x1800670bf
xor eax, eax
jmp 0x1800670f8
mov rax, qword [rsp + 0x4d8]
jmp 0x1800670f8
lea rdx, [rsp + 0x290]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [rsp + 0x4d4], eax
jmp 0x18006706e
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180083fa0]
call fcn.180067af0
mov rax, rdi
mov rcx, qword [rsp + 0x4e8]
xor rcx, rsp
call fcn.18000c3e0
add rsp, 0x4f0
pop rdi
ret
Function at 0x4722e0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [0x00474220]
nop
cmp word [0x00400000], 0x5a4d
je 0x47231d
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x00400000]
jmp 0x4723ab
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x472341
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x4723ab
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x472388
cmp ecx, 0x20b
je 0x472360
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x4723ab
cmp dword [rax + 0x84], 0xe
ja 0x472374
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x4723ab
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x4723ab
cmp dword [rax + 0x74], 0xe
ja 0x472399
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x4723ab
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [0x00474638]
mov qword [0x0049f328], 0xffffffffffffffff
mov qword [0x0049f330], 0xffffffffffffffff
mov rcx, qword [0x00474640]
mov eax, dword [0x0049cd84]
mov dword [rcx], eax
mov rcx, qword [0x00474648]
mov eax, dword [0x0049cd80]
mov dword [rcx], eax
call fcn.00472590
cmp dword [0x0049c720], 0
jne 0x472405
lea rcx, [fcn.00472590]
call qword [0x00474650]
lea rdx, [0x00474700]
lea rcx, [0x004746f8]
call fcn.00472584
mov r11d, dword [0x0049cd7c]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x0049cd78]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [0x00474628]
lea rdx, [0x004746f0]
lea rcx, [0x00474698]
call fcn.00472584
mov r11, qword [0x00474600]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x4724a6
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x472496
cmp al, 0x22
je 0x472496
jmp 0x472480
cmp byte [r8], 0x22
jne 0x4724b6
inc r8
mov qword [rsp + 0x30], r8
jmp 0x4724b6
cmp byte [r8], 0x20
jbe 0x4724b6
inc r8
mov qword [rsp + 0x30], r8
jmp 0x4724a6
movzx eax, byte [r8]
test al, al
je 0x4724cc
cmp al, 0x20
ja 0x4724cc
inc r8
mov qword [rsp + 0x30], r8
jmp 0x4724b6
test byte [rsp + 0x8c], 1
je 0x4724e1
movzx r9d, word [rsp + 0x90]
jmp 0x4724e7
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call 0x53f000
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x472503
mov ecx, eax
call qword [0x004745f8]
call qword [0x004745f0]
jmp 0x472527
mov eax, edi
jmp 0x472530
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x14000d7c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x14000d8e0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x14000d820
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x14000d820
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x14000d820

Function at 0x14001baf0
Capabilities:
Set registry value

Disassembly:
xor r8d, r8d
test edx, edx
cmovg r8d, edx
lea rdx, str.PWALauncherResult
jmp 0x14004de40
push rsi
sub rsp, 0x40
mov rax, qword [0x1400e8040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], r8d
mov rcx, qword [rcx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008cf80
mov eax, esi
add rsp, 0x40
pop rsi
ret
Function at 0x1400249b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x40
jb 0x140024aae
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x1400cbfb0]
nop dword [rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm3
pclmulqdq xmm7, xmm4, 0
movdqa xmm8, xmm2
pclmulqdq xmm8, xmm4, 0
movdqa xmm9, xmm1
pclmulqdq xmm9, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm1, xmm5, 0x11
movdqu xmm10, xmmword [rcx]
pxor xmm10, xmm6
pxor xmm0, xmm10
movdqu xmm6, xmmword [rcx + 0x10]
pxor xmm6, xmm7
pxor xmm3, xmm6
movdqu xmm6, xmmword [rcx + 0x20]
pxor xmm6, xmm8
pxor xmm2, xmm6
movdqu xmm6, xmmword [rcx + 0x30]
pxor xmm6, xmm9
pxor xmm1, xmm6
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x3f
ja 0x140024a20
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
pmovzxdq xmm3, qword [0x1400cbfd0]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp rdx, 0x10
jb 0x140024b4a
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add rcx, 0x10
add rdx, 0xfffffffffffffff0
cmp rdx, 0xf
ja 0x140024b20
pmovzxdq xmm1, qword [0x1400cbfd0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
pxor xmm3, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm3, 3
pclmulqdq xmm0, xmmword [0x1400cbfc0], 0x10
pblendw xmm0, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm3
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140025860
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x140025887
mov r15, rbx
jmp 0x14002597e
mov r12, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r12
jbe 0x1400258e6
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x1400258d2
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.1400bc060
mov r14, qword [rsi + 8]
add r15, rbx
mov qword [rsi + 0x10], r15
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x14002597e
mov rax, rbx
sub rax, r12
sar rax, 2
cmp rbx, r12
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x14002599e
lea rcx, [r13*8]
call fcn.14008bb48
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rbx
mov r15, rcx
sub rdx, r14
je 0x14002594b
xor r15d, r15d
mov r8, rcx
add r8, r15
je 0x14002596b
mov r9, qword [r14 + r15]
mov qword [r8], r9
add r15, 8
cmp rdx, r15
jne 0x140025930
add r15, rcx
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
nop
cmp rbx, r14
je 0x14002596d
add rbx, 0xfffffffffffffff8
jne 0x140025960
ud2
test r12, r12
je 0x14002597e
mov rcx, r12
call fcn.14008bb84
mov r15, qword [rsi + 0x10]
test r15, r15
je 0x14002596b
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14001bab0
int3
Function at 0x14003b470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, qword [rsp + 0x70]
jmp 0x14003b498
add rax, 2
mov qword [rcx + 0x18], rax
mov rcx, qword [rbx]
mov bpl, 1
test rcx, rcx
je 0x14003b4fa
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x14003b4e0
movzx eax, word [rax]
cmp ax, 0xffff
je 0x14003b4f3
mov rcx, qword [rbx]
test rcx, rcx
sete bpl
test rdi, rdi
jne 0x14003b501
mov edi, 0
test bpl, bpl
je 0x14003b533
jmp 0x14003b59b
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x1400ddbf8]
cmp ax, 0xffff
jne 0x14003b4b6
mov qword [rbx], 0
xor ecx, ecx
test rdi, rdi
je 0x14003b4c5
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x14003b510
movzx eax, word [rax]
jmp 0x14003b523
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x1400ddbf8]
mov rcx, qword [rbx]
cmp ax, 0xffff
sete al
jne 0x14003b52e
xor edi, edi
cmp bpl, al
je 0x14003b59b
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x14003b550
movzx r8d, word [rax]
jmp 0x14003b560
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x1400ddbf8]
mov r8d, eax
mov rax, qword [r14]
mov rax, qword [rax + 0x18]
mov rcx, r14
mov dx, 8
call qword [0x1400ddbf8]
mov rcx, qword [rbx]
test al, al
je 0x14003b59b
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
jne 0x14003b490
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1400ddbf8]
jmp 0x14003b498
mov bpl, 1
test rcx, rcx
je 0x14003b5be
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x14003b5d2
movzx eax, word [rax]
cmp ax, 0xffff
je 0x14003b5e5
cmp qword [rbx], 0
sete bpl
test rdi, rdi
je 0x14003b5f1
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x14003b5f8
movzx eax, word [rax]
jmp 0x14003b608
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x1400ddbf8]
cmp ax, 0xffff
jne 0x14003b5b6
mov qword [rbx], 0
test rdi, rdi
jne 0x14003b5c3
test bpl, bpl
jne 0x14003b614
jmp 0x14003b617
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x1400ddbf8]
cmp ax, 0xffff
sete al
xor bpl, al
jne 0x14003b617
or byte [rsi], 2
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14004dc90
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1400e8040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], 0
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14004dd0b
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x14004dd0b
cmp dword [rsp + 0x38], 4
jne 0x14004dd0b
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008cf80
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret