joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100339f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
xor esi, esi
mov dword [rax - 0x28], esi
mov dword [rax + 8], esi
mov rax, qword [rcx]
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_getservbyport]
test eax, eax
jne 0x10033aee
cmp qword [rdi + 0x18], 0xffffffffffffffff
je 0x10033aee
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x78], rbx
mov dword [rdi + 0x74], esi
call fcn.10035ea0
mov rcx, qword [rdi + 8]
mov ebx, eax
call fcn.10036350
mov rcx, qword [rdi + 8]
add rax, rbx
mov qword [rsp + 0x50], rax
call fcn.10035d60
mov rcx, qword [rdi + 8]
mov ebx, eax
call fcn.10035ea0
mov rcx, qword [rdi + 0x18]
sub ebx, eax
lea rax, [rdi + 0x20]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x70]
lea r8d, [rsi + 1]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
mov rbx, qword [rsp + 0x78]
cmp eax, 0xffffffff
setne sil
test esi, esi
mov dword [rdi + 0x70], esi
je 0x10033abb
mov edx, dword [rsp + 0x70]
mov rcx, qword [rdi + 8]
call fcn.10035f40
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [rdi + 0x70], 0
jne 0x10033ae8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x10033ae8
mov dword [rdi + 0x10], 1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, qword [rdi + 0x38]
mov dword [rdi + 0x74], eax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rsp + 0x70]
jmp 0x10033af3
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
add rsp, 0x68
ret
Function at 0x10033ba0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov dword [rax - 0x28], 0
mov rax, qword [rcx]
mov edi, r9d
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
call qword [rax + reloc.WS2_32.dll_getservbyport]
test eax, eax
jne 0x10033cc3
mov rcx, qword [rbx + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x10033cc3
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], 0
lea rsi, [rbx + 0x20]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov r8d, 1
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rbp
call qword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x10033cb3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x10033c53
mov rcx, qword [rbx + 0x38]
mov dword [rsp + 0x40], 0xfffffffe
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x40]
jmp 0x10033cc8
mov rcx, qword [rbx + 0x38]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10033c82
cmp eax, 0x102
jne 0x10033cb3
mov rcx, qword [rbx + 0x38]
mov dword [rsp + 0x40], 0xfffffffc
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x40]
jmp 0x10033cc8
mov rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x44]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
mov ecx, dword [rsp + 0x40]
mov edx, 0xfffffffd
test eax, eax
cmove ecx, edx
mov dword [rsp + 0x40], ecx
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x40]
jmp 0x10033cc8
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x10033cf0
Capabilities:
Send data
Send data on socket

Disassembly:
mov r11, rsp
sub rsp, 0x68
xor eax, eax
test rdx, rdx
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rdi
mov rbx, rcx
mov qword [r11 - 0x18], rdx
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
mov edi, r9d
mov dword [r11 - 0x20], r8d
je 0x10033e2e
test r8d, r8d
je 0x10033e2e
mov rcx, qword [rcx + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x10033e2e
test rcx, rcx
je 0x10033e2e
cmp qword [rbx + 8], rax
jne 0x10033d58
mov eax, 0xfffffffe
mov rdi, qword [r11 + 0x20]
mov rbx, qword [r11 + 0x10]
add rsp, 0x68
ret
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x80], rsi
lea rsi, [rbx + 0x40]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov r8d, 1
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x10033dfd
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x10033dab
mov dword [rbx + 0x10], 1
mov dword [rsp + 0x40], 0xfffffffe
jmp 0x10033dfd
mov rcx, qword [rbx + 0x58]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10033dcc
cmp eax, 0x102
jne 0x10033dfd
mov dword [rsp + 0x40], 0xfffffffc
jmp 0x10033dfd
mov rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x44]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
mov ecx, dword [rsp + 0x40]
mov edx, 0xfffffffd
test eax, eax
cmove ecx, edx
mov dword [rsp + 0x40], ecx
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movsxd rax, dword [rsp + 0x40]
test eax, eax
jle 0x10033e14
add qword [rbx + 0x68], rax
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x78]
mov eax, 0xffffffff
add rsp, 0x68
ret
Function at 0x10035400
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov rax, rsp
sub rsp, 0x88
mov qword [rax + 0x20], rbx
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov rsi, rcx
xor r13d, r13d
mov qword [rax - 0x38], r15
mov ecx, 0x4000
mov r12, r8
mov rdi, rdx
mov r15d, r13d
mov dword [rsp + 0x40], r13d
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rbx, rax
jne 0x10035455
lea eax, [rbx - 1]
jmp 0x10035612
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x80], rbp
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x58], r14
mov ebp, r13d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov r14, rax
jne 0x100354a1
mov eax, 0xfffffffe
jmp 0x10035605
mov rax, qword [rsi]
mov r9d, 0xea60
mov r8d, 0x4000
mov rdx, rbx
mov rcx, rsi
mov r13b, 1
call qword [rax + 0x28]
test eax, eax
mov esi, eax
jle 0x100355c5
test esi, esi
je 0x1003559e
test r13b, r13b
je 0x10035571
lea ecx, [rsi - 3]
xor edi, edi
xor eax, eax
test ecx, ecx
jle 0x1003559e
cmp byte [rax + rbx], 0xd
jne 0x10035501
cmp byte [rax + rbx + 1], 0xa
jne 0x10035501
cmp byte [rax + rbx + 2], 0xd
jne 0x10035501
cmp byte [rax + rbx + 3], 0xa
je 0x1003550f
inc edi
inc rax
cmp edi, ecx
jl 0x100354e6
jmp 0x1003559e
test r12, r12
je 0x10035526
mov ecx, esi
sub ecx, edi
sub ecx, 4
call r12
test eax, eax
js 0x100355d8
sub esi, edi
mov edx, edi
mov rcx, rbx
lea ebp, [rbp + rsi - 4]
call fcn.10035290
test eax, eax
mov r15d, eax
jle 0x100355d8
movsxd rcx, edi
lea r8d, [rsi - 4]
lea r9, [rsp + 0x44]
lea rdx, [rcx + rbx + 4]
mov rcx, r14
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r13b, r13b
jmp 0x1003559e
test r12, r12
je 0x1003557f
mov ecx, esi
call r12
test eax, eax
js 0x100355d8
lea r9, [rsp + 0x44]
mov r8d, esi
mov rdx, rbx
mov rcx, r14
add ebp, esi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x90]
mov r9d, 0xea60
mov r8d, 0x4000
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x28]
test eax, eax
mov esi, eax
jg 0x100354c6
mov rcx, rbx
call fcn.1003aa90
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100355e1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], 0
je 0x10035497
test r15d, r15d
jg 0x100355f8
mov eax, 0xfffffffd
jmp 0x10035605
mov eax, 0xfffffffc
cmp r15d, ebp
cmovne ebp, eax
mov eax, ebp
mov rbp, qword [rsp + 0x80]
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x50]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x88
ret
Function at 0x140006cd0
Capabilities:
Execute command

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rdi, [rsp + 0x78]
movabs rcx, 0x7a5db90d33787107
mov qword [r11 - 0x50], rcx
mov qword [r11 - 0x48], rdi
mov rbx, qword [rdi]
mov rax, rbx
xor rax, rcx
mov qword [r11 - 0x58], rax
mov qword [rdi], 0
cmp byte [0x14005a0d0], 0
je 0x140006d5b
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x78]
mov qword [r11 - 0x38], rcx
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x40], rcx
movups xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0x78]
mov qword [r11 - 0x20], rcx
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x28], rcx
call fcn.1400062f0
nop
jmp 0x140006d75
mov byte [0x14005a0d0], 1
call fcn.140006da0
lea rcx, str.REM_nobody_likes_fucking_windows_telemetry__also_your_hard_bans_are_aids_please_dont_do_this_man_i_have_kids_to_feed_:_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov qword [rdi], rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140025fd0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140007320
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, dword [0x140029f7c]
lea rdi, [rsp + 0x38]
mov rbx, qword [rdi]
xor ecx, ecx
cmp byte [0x140029f7f], cl
mov qword [rdi], rcx
mov dword [rsp + 0x20], eax
je 0x14000740a
cmp dword [0x140030010], 2
jl 0x1400073d8
movdqa xmm3, xmmword [0x14002c560]
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x14002c620]
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x14002c620]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 2
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x14002c590]
psubd xmm3, xmm0
movd xmm0, eax
andps xmm3, xmmword [0x14002c5e0]
packuswb xmm3, xmm3
packuswb xmm3, xmm3
psubb xmm3, xmmword [0x14002c630]
xorps xmm3, xmm0
movd dword [rsp + 0x20], xmm3
jmp 0x14000740a
lea r8, [rsp + 0x20]
nop dword [rax]
mov eax, 0xcccccccd
lea r8, [r8 + 1]
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
add dl, al
movzx eax, cl
add dl, dl
inc ecx
sub al, dl
sub al, 0x75
xor byte [r8 - 1], al
cmp ecx, 4
jl 0x1400073e0
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rdi], rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140025fd0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140007430
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [0x14002ad20]
lea rdi, [rsp + 0x38]
mov rbx, qword [rdi]
xor ecx, ecx
cmp byte [0x14002ad27], cl
mov qword [rdi], rcx
mov qword [rsp + 0x20], rax
je 0x14000758a
cmp dword [0x140030010], 2
jl 0x14000755b
movdqa xmm2, xmmword [0x14002c560]
movdqa xmm4, xmmword [0x14002c620]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 2
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14002c590]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x20]
andps xmm2, xmmword [0x14002c5e0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
psubb xmm2, xmmword [0x14002c630]
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm2, xmmword [0x14002c570]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 2
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14002c590]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x24]
andps xmm2, xmmword [0x14002c5e0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
psubb xmm2, xmmword [0x14002c630]
xorps xmm2, xmm0
movd dword [rsp + 0x24], xmm2
jmp 0x14000758a
lea r8, [rsp + 0x20]
mov eax, 0xcccccccd
lea r8, [r8 + 1]
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
add dl, al
movzx eax, cl
add dl, dl
inc ecx
sub al, dl
sub al, 0x75
xor byte [r8 - 1], al
cmp ecx, 8
jl 0x140007560
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rdi], rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140025fd0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140015410
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 0xf
mov dword [rsp + 0x40], ebp
jbe 0x140015441
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x1400154dd
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x1400154af
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400154aa
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140015579
mov rcx, r8
call fcn.14002602c
mov al, 1
mov byte [rdi], bpl
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], rbp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140025fd0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x14001551d
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140015519
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140015514
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140015579
mov rcx, r8
call fcn.14002602c
xor al, al
jmp 0x1400154b1
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x296b0
mov qword [rsp + 0x20], rbp
lea rdx, [0x1400300b0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140015566
cmp rax, 0xf
jbe 0x140015519
lea rdx, [rax + 1]
jmp 0x1400154f0
cmp rax, 0xf
jbe 0x1400154af
lea rdx, [rax + 1]
jmp 0x140015482
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140015f40
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
sub rsp, 0x278
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbp, r8
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov r9d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400160c7
mov qword [rsp + 0x270], rsi
lea rcx, [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x208
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400160b6
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x140015ff0
test rax, rax
je 0x14001608f
mov qword [rsp + 0x268], rdi
mov rcx, rbx
mov qword [rsp + 0x260], r14
lea r14, str.abcdef012345789
nop dword [rax]
lea rdi, [rsp + 0x40]
lea rdi, [rdi + rcx*2]
movzx ecx, word [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswxdigit]
test eax, eax
je 0x14001605d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x140016045
xor edx, edx
div rcx
movzx eax, word [r14 + rdx*2]
mov word [rdi], ax
inc ebx
lea rdx, [rsp + 0x40]
mov ecx, ebx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140016070
cmp rcx, rax
jb 0x140016020
mov r14, qword [rsp + 0x260]
mov rdi, qword [rsp + 0x268]
mov eax, dword [rsp + 0x38]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x40]
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140025fd0
add rsp, 0x278
pop rbp
pop rbx
ret
Function at 0x1400160f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
mov eax, 0x2058
call fcn.140026f40
sub rsp, rax
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbp, r8
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov r9d, 0xf003f
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016259
mov qword [rsp + 0x2070], rsi
lea rcx, [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x1ffe
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x1ffe
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016248
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x140016225
mov qword [rsp + 0x2088], rdi
mov qword [rsp + 0x2050], r14
lea r14, str.abcdef012345789
nop dword [rax]
mov eax, ebx
lea rdi, [rsp + 0x40]
movzx ecx, word [rdi + rax*2]
lea rdi, [rdi + rax*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswxdigit]
test eax, eax
je 0x14001620b
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x1400161f0
dec rcx
xor edx, edx
div rcx
movzx eax, word [r14 + rdx*2]
mov word [rdi], ax
mov eax, dword [rsp + 0x38]
inc ebx
cmp ebx, eax
jb 0x1400161c0
mov r14, qword [rsp + 0x2050]
mov rdi, qword [rsp + 0x2088]
mov dword [rsp + 0x28], eax
mov r9d, 7
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x2070]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140025fd0
add rsp, 0x2058
pop rbp
pop rbx
ret

Function at 0x140016280
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r8
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
xor r8d, r8d
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016317
xor eax, eax
mov qword [rsp + 0x78], rbx
mov rbx, qword [rsp + 0x30]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x38], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov dword [rsp + 0x3c], eax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140025fd0
add rsp, 0x50
pop rdi
ret
Function at 0x140016330
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
sub rsp, 0x58
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, r8
lea rax, [rsp + 0x38]
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov r9d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016428
mov qword [rsp + 0x88], rsi
lea rax, [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rcx, rsi
xor r8d, r8d
mov qword [rsp + 0x50], rdi
mov rdx, rbp
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016412
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140016412
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x1400163eb
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x1400163dc
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov ecx, dword [rsp + 0x30]
cmp ebx, ecx
jb 0x1400163c6
mov dword [rsp + 0x28], ecx
mov r9d, 3
mov rcx, rsi
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140025fd0
add rsp, 0x58
pop rbp
pop rbx
ret
Function at 0x140023390
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm3, xmmword [0x140029d58]
movdqa xmm0, xmm3
psrldq xmm0, 0xf
movd eax, xmm0
movups xmmword [rsp + 0x20], xmm3
test al, al
je 0x1400235ba
xor ecx, ecx
cmp dword [0x140030010], 2
jl 0x140023587
movdqa xmm5, xmmword [0x14002c620]
movdqa xmm2, xmmword [0x14002c560]
movdqa xmm4, xmmword [0x14002c5e0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
movd eax, xmm3
movdqa xmm3, xmmword [0x14002c5a0]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x14002c590]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 2
movdqa xmm0, xmm1
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x14002c630]
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
psubb xmm2, xmm7
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm2, xmmword [0x14002c570]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 2
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmm6
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rsp + 0x24]
andps xmm2, xmm4
pmuldq xmm1, xmm5
packuswb xmm2, xmm2
packuswb xmm2, xmm2
psubb xmm2, xmm7
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
movd dword [rsp + 0x24], xmm2
movdqa xmm2, xmmword [0x14002c5b0]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 2
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmm6
psubd xmm3, xmm0
punpckldq xmm1, xmm2
movd xmm0, dword [rsp + 0x28]
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
pmuldq xmm1, xmm5
psubb xmm3, xmm7
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
movd dword [rsp + 0x28], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 2
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x50]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x2c]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
psubb xmm2, xmm7
movaps xmm7, xmmword [rsp + 0x40]
xorps xmm2, xmm0
movd dword [rsp + 0x2c], xmm2
jmp 0x1400235ba
lea r8, [rsp + 0x20]
nop dword [rax]
mov eax, 0xcccccccd
lea r8, [r8 + 1]
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
add dl, al
movzx eax, cl
add dl, dl
inc ecx
sub al, dl
sub al, 0x75
xor byte [r8 - 1], al
cmp ecx, 0x10
jl 0x140023590
lea rcx, [rsp + 0x20]
call fcn.140001010
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
call fcn.1400085e0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140025fd0
add rsp, 0x68
ret