joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1407c4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407c41df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407c4089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c406f
add dl, dl
jne 0x1407c4096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c40f6
xor eax, eax
add dl, dl
jne 0x1407c40a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c41ad
add dl, dl
jne 0x1407c40b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c40c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c40d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c40dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407c40ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407c407e
mov eax, 1
add dl, dl
jne 0x1407c4106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c4113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c40fb
sub eax, ebx
mov ebx, 1
jne 0x1407c414c
mov ecx, 1
add dl, dl
jne 0x1407c412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407c413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c4123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407c4168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407c4175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c415d
cmp eax, 0x7d00
jae 0x1407c419b
cmp eax, 0x500
jb 0x1407c4196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c407e
cmp eax, 0x7f
ja 0x1407c419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407c41d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407c407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002890
Capabilities:
Delete registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x140002930
mov rbx, qword [rcx]
cmp qword [rdi], 0
je 0x140002909
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop
test rax, rax
je 0x140002929
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
test rax, rax
je 0x140002929
and qword [rsp + 0x28], 0
mov rdx, qword [rdi]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call rax
nop
jmp 0x140002919
cmp dword [rdi + 8], 0
je 0x140002929
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, 1
jmp 0x140002919
cmp byte [0x1400a4b30], 0
jne 0x14000297d
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop
test rax, rax
je 0x140002969
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
mov r10, rax
mov qword [0x1400a4ae0], rax
jmp 0x140002970
mov r10, qword [0x1400a4ae0]
mov eax, 1
mov byte [0x1400a4b30], al
jmp 0x140002984
mov r10, qword [0x1400a4ae0]
mov rdx, rsi
mov rcx, qword [rbx]
test r10, r10
je 0x140002912
xor r9d, r9d
mov r8d, dword [rbx + 8]
call r10
nop
jmp 0x140002919

Function at 0x140002a9c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14009f1b0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r9d, dword [rcx + 8]
xor r14d, r14d
mov rsi, rdx
mov qword [rsp + 0x48], r14
mov r8, rdx
mov qword [rsp + 0x40], r14
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x50], r14
lea rcx, [rsp + 0x40]
call fcn.1400029a0
jmp 0x140002b0e
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140002a9c
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x140002b7c
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], pe_nt_image_headers64
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140002aff
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002b65
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r14
mov rdx, rsi
mov dword [rsp + 0x48], r14d
mov rcx, rdi
call fcn.140002890
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x140002b87
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14004b030
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140003110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14009f1b0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdi
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x70]
call fcn.14004d3c0
mov qword [rsp + 0x70], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1400031af
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1400031af
call fcn.140002694
mov ebx, eax
jmp 0x1400032ba
mov r8, r15
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1400031d0
call fcn.140002694
jmp 0x1400032a9
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400031c6
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14000320b
mov ebx, 0x8007000e
jmp 0x1400032ab
mov ecx, eax
test eax, eax
je 0x14000323d
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1400032f2
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000323d
lea rcx, [rsp + 0x70]
call fcn.140018e48
jmp 0x140003247
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x140003259
cmp qword [rsp + 0x70], rdi
je 0x140003201
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1400031c6
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140003f94
mov ebx, eax
test rsi, rsi
je 0x1400032ba
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1400032d1
lea rcx, [rsp + 0x70]
call fcn.140017cdc
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14004b030
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140002500
int3
Function at 0x140006b4c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r13
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14009f1b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword gs:[0x58]
mov rbx, rdx
mov r13d, 4
mov esi, 0xdff7
mov dword [rbp - 0x20], 0xf72e47f1
mov dword [rbp - 0x1c], 0x93badf9b
mov rdi, qword [rax]
mov dword [rbp - 0x18], 0xd7debfe3
mov dword [rbp - 0x14], 0x89e1a3
mov dword [rbp - 0x10], 0xf76547aa
mov eax, dword [rdi + r13]
cmp dword [0x1400a4f58], eax
jle 0x140006c0b
lea rcx, [0x1400a4f58]
call fcn.14004b24c
cmp dword [0x1400a4f58], 0xffffffff
jne 0x140006c0b
movups xmm0, xmmword [rbp - 0x20]
mov eax, dword [rbp - 0x10]
lea rcx, [0x14007416c]
mov byte [0x1400a512e], 1
movups xmmword [0x1400a5118], xmm0
mov dword [0x1400a5128], eax
mov word [0x1400a512c], si
call fcn.14004b9c0
lea rcx, [0x1400a4f58]
call fcn.14004b1ec
xor esi, esi
lea rdx, [0x1400a5118]
cmp byte [0x1400a512e], sil
je 0x140006c4b
mov r8d, esi
mov cl, r8b
movabs rax, 0xe1d7bf93dff74797
and cl, 7
shl cl, 3
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 0xb
jb 0x140006c20
mov byte [0x1400a512e], sil
mov rcx, rbx
call fcn.140014f80
cmp rax, 0xffffffffffffffff
jne 0x140006dd5
mov eax, dword [rdi + r13]
mov r15d, 0x5791
cmp dword [0x1400a52c0], eax
mov dword [rbp - 0x20], 0x370c57b0
mov dword [rbp - 0x1c], 0x1f3f7b74
mov dword [rbp - 0x18], 0x7febbf5e
mov dword [rbp - 0x14], 0xbee53e
jle 0x140006cd2
lea rcx, [0x1400a52c0]
call fcn.14004b24c
cmp dword [0x1400a52c0], 0xffffffff
jne 0x140006cd2
movups xmm0, xmmword [rbp - 0x20]
lea rcx, [0x14007414c]
mov byte [0x1400a523a], 1
mov word [0x1400a5238], r15w
movups xmmword [0x1400a5228], xmm0
call fcn.14004b9c0
lea rcx, [0x1400a52c0]
call fcn.14004b1ec
cmp byte [0x1400a523a], sil
lea rdx, [0x1400a5228]
movabs r15, 0xe57fbf1f7b375791
je 0x140006d13
mov r8, rsi
mov cl, r8b
mov rax, r15
and cl, 7
shl cl, 3
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 9
jb 0x140006cef
mov byte [0x1400a523a], sil
mov rcx, rbx
call fcn.140014f80
cmp rax, 0xffffffffffffffff
je 0x140006dd1
mov eax, dword [rdi + r13]
mov r12d, 0xbf1f
cmp dword [0x1400a4d04], eax
mov dword [rbp - 0x20], 0x61a957ca
mov dword [rbp - 0x1c], 0x1f260970
jle 0x140006d8c
lea rcx, [0x1400a4d04]
call fcn.14004b24c
cmp dword [0x1400a4d04], 0xffffffff
jne 0x140006d8c
mov rax, qword [rbp - 0x20]
lea rcx, [0x14007412c]
mov qword [0x1400a4cf8], rax
mov byte [0x1400a4d02], 1
mov word [0x1400a4d00], r12w
call fcn.14004b9c0
lea rcx, [0x1400a4d04]
call fcn.14004b1ec
cmp byte [0x1400a4d02], sil
lea rdx, [0x1400a4cf8]
je 0x140006dc3
mov r8, rsi
mov cl, r8b
mov rax, r15
and cl, 7
shl cl, 3
shr rax, cl
xor word [rdx + r8*2], ax
inc r8
cmp r8, 5
jb 0x140006d9f
mov byte [0x1400a4d02], sil
mov rcx, rbx
call fcn.140014f80
cmp rax, 0xffffffffffffffff
jne 0x140006dd5
xor al, al
jmp 0x140006dd7
mov al, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14004b030
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x140006dfc
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14009f1b0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov esi, edx
mov rbx, rcx
mov qword [rbp - 0x31], rcx
movdqa xmm0, xmmword [0x14008cc10]
movdqu xmmword [rbp + 0x27], xmm0
xor r14d, r14d
mov word [rbp + 0x17], r14w
mov ecx, edx
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x140006f5f
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140006f5f
mov ecx, esi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
cmp esi, 0xd
jne 0x140006ea6
test rax, rax
je 0x140006f59
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140006f59
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.140017f74
jmp 0x140006f50
test rdi, rdi
je 0x140006f59
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140006f59
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.14001521c
nop
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 9]
call fcn.140006fb8
mov rsi, rax
lea rax, [rbp + 0x17]
cmp rax, rsi
je 0x140006f0f
lea rcx, [rbp + 0x17]
call fcn.140017f10
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 7
mov word [rsi], r14w
lea rcx, [rbp - 9]
call fcn.140017f10
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x140006f50
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fb0
call fcn.14004b054
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
movups xmm0, xmmword [rbp + 0x17]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x27]
movdqa xmm0, xmmword [0x14008cc10]
movups xmmword [rbx + 0x10], xmm1
movdqu xmmword [rbp + 0x27], xmm0
mov word [rbp + 0x17], r14w
lea rcx, [rbp + 0x17]
call fcn.140017f10
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14004b030
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14005adc4
nop
int3
Function at 0x1400077d0
Capabilities:
Parse url

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rbx, rcx
and dword [rbp - 0x30], 0
lea rdi, [rcx + 0x68]
cmp rdi, rdx
je 0x140007843
mov rsi, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14000780c
mov rdx, qword [rdx]
cmp rsi, qword [rdi + 0x18]
ja 0x140007835
mov r14, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14000781f
mov r14, qword [rdi]
mov qword [rdi + 0x10], rsi
mov r8, rsi
mov rcx, r14
call fcn.14004cf60
mov byte [r14 + rsi], 0
jmp 0x140007843
mov r9, rdx
mov rdx, rsi
mov rcx, rdi
call fcn.14001dd14
mov esi, 0x68
mov r8d, esi
xor edx, edx
mov rcx, rbx
call fcn.14004d3c0
mov dword [rbx], esi
lea r14d, [rsi - 0x67]
mov dword [rbx + 0x10], r14d
mov dword [rbx + 0x20], r14d
mov dword [rbx + 0x30], r14d
mov dword [rbx + 0x40], r14d
mov dword [rbx + 0x50], r14d
mov dword [rbx + 0x60], r14d
cmp qword [rdi + 0x18], 0x10
jb 0x14000787d
mov rdi, qword [rdi]
mov r9, rbx
xor r8d, r8d
mov edx, dword [rbx + 0x78]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x1400079b8
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x1400078e5
mov edi, dword [rbx + 0x20]
movdqa xmm0, xmmword [0x14008cc20]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
lea rcx, [rbp - 0x50]
cmp rdi, 0xf
ja 0x1400078d4
mov qword [rbp - 0x40], rdi
mov r8d, edi
mov rdx, r9
call fcn.14004cf60
mov byte [rbp + rdi - 0x50], 0
jmp 0x1400078dc
mov rdx, rdi
call fcn.14001dd14
lea rax, [rbp - 0x50]
mov esi, r14d
jmp 0x1400078fa
lea rdx, [0x140088655]
lea rcx, [rbp - 0x28]
call fcn.14001521c
mov esi, 2
lea rdi, [rbx + 0x88]
mov rdx, rax
mov rcx, rdi
call fcn.1400150fc
test sil, 2
je 0x140007962
and esi, 0xfffffffd
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x140007951
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000794c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400079d3
call fcn.14004b054
movdqa xmm0, xmmword [0x14008cc20]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
test r14b, sil
je 0x14000799e
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14000799e
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007999
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400079cd
call fcn.14004b054
cmp qword [rdi + 0x18], 0x10
jb 0x1400079a8
mov rdi, qword [rdi]
mov qword [rbx + 0x18], rdi
mov ecx, dword [rbx + 0x98]
mov dword [rbx + 0x20], ecx
mov al, r14b
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14005adc4
nop
call fcn.14005adc4
nop
int3
Function at 0x14000a3d8
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x14009f1b0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea r14, [0x1400a4b88]
and qword [rbp + 0xf], 0
lea rdx, [0x140088655]
lea rcx, [rbp + 0xf]
call fcn.1400149cc
nop
mov ecx, 0x32
mov dword [rbp - 1], ecx
call fcn.14004b9d8
mov rdi, rax
mov ecx, dword [rbp - 1]
call fcn.14004b9d8
mov rsi, rax
mov dword [rbp + 0x17], 1
lea rcx, [rbp + 0x1f]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rbp + 0x1f], 9
je 0x14000a46a
cmp word [rbp + 0x1f], 6
mov r9d, 0x20019
jne 0x14000a470
mov r9d, 0x20119
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x17]
xor r8d, r8d
lea rdx, [0x140088cb8]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000a512
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x17]
xor r8d, r8d
lea rdx, str.EditionID
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000a512
test ebx, ebx
jne 0x14000a512
mov rdx, rdi
lea rcx, [rbp + 0xf]
call fcn.140014dd0
lea rdx, [0x140088cd4]
lea rcx, [rbp + 0xf]
call fcn.140014dd0
mov rdx, rsi
lea rcx, [rbp + 0xf]
call fcn.140014dd0
mov rcx, rdi
call fcn.14004b054
mov rcx, rsi
call fcn.14004b054
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp + 0xf]
mov rcx, r14
call fcn.14001521c
nop
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14000a559
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
nop
mov rax, r14
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14004b030
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000afa0
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x14009f1b0]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov rdi, rcx
mov qword [rsp + 0x50], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
movdqa xmm1, xmmword [0x14008cc20]
movdqu xmmword [rbp - 0x40], xmm1
mov byte [rbp - 0x50], r14b
test rdx, rdx
je 0x14000b19c
test r8d, r8d
je 0x14000b19c
mov qword [rsp + 0x60], 0x80
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
movdqa xmm0, xmmword [0x14008ccf0]
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x30], r14
mov dword [rbp - 0x28], 0x67452301
mov dword [rbp - 0x24], 0xefcdab89
mov dword [rbp - 0x20], 0x98badcfe
mov dword [rbp - 0x1c], 0x10325476
mov r9d, r8d
mov r8, rdx
lea rdx, [rbp - 0x30]
call fcn.14000a588
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x30]
call fcn.14004d3c0
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x60]
call fcn.14000a674
nop
movdqa xmm0, xmmword [0x14008cc20]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], r14b
mov dword [rsp + 0x20], 2
lea edx, [r14 + 0x20]
lea rcx, [rsp + 0x28]
call fcn.14001d0a8
mov qword [rsp + 0x38], r14
mov esi, r14d
movzx ebx, byte [rbp + rsi + 0x30]
mov eax, ebx
shr rax, 4
mov r8b, byte [rbp + rax - 0x60]
mov edx, 1
lea rcx, [rsp + 0x28]
call fcn.140015084
and ebx, 0xf
mov r8b, byte [rbp + rbx - 0x60]
mov edx, 1
lea rcx, [rsp + 0x28]
call fcn.140015084
inc rsi
cmp rsi, 0x10
jb 0x14000b0bc
lea r9, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae r9, qword [rsp + 0x28]
or rsi, 0xffffffffffffffff
inc rsi
cmp byte [r9 + rsi], r14b
jne 0x14000b110
cmp rsi, qword [rbp - 0x38]
ja 0x14000b145
lea rbx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rbx, qword [rbp - 0x50]
mov qword [rbp - 0x40], rsi
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call fcn.14004cf60
mov byte [rbx + rsi], r14b
jmp 0x14000b152
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.14001dd14
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000b18b
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b186
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b1c7
call fcn.14004b054
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rdi + 0x10], xmm1
jmp 0x14000b1a7
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov rax, rdi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14004b030
add rsp, 0x250
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14005adc4
nop
int3
Function at 0x1400118b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x14009f1b0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
mov qword [rbp - 0x11], rcx
xor eax, eax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], rax
lea edx, [rax + 0x64]
lea rcx, [rbp + 0x1f]
call fcn.140014838
nop
movdqa xmm6, xmmword [0x14008ccd0]
mov dword [rbp + 0xf], 0xb285c3e3
mov dword [rbp + 0x13], 0x4745f975
mov dword [rbp + 0x17], 0xf38d97f4
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400a4da4], eax
jle 0x1400119a3
lea rcx, [0x1400a4da4]
call fcn.14004b24c
cmp dword [0x1400a4da4], 0xffffffff
jne 0x1400119a3
mov word [0x1400a4d2c], 0x145
movups xmmword [0x1400a4d10], xmm6
movsd xmm0, qword [rbp + 0xf]
movsd qword [0x1400a4d20], xmm0
mov eax, dword [rbp + 0x17]
mov dword [0x1400a4d28], eax
lea rcx, [0x1400744cc]
call fcn.14004b9c0
lea rcx, [0x1400a4da4]
call fcn.14004b1ec
lea rbx, [0x1400a4d10]
cmp byte [0x1400a4d2d], 0
je 0x1400119dd
xor edx, edx
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0x7d21cb4597bfa7d1
shr rax, cl
xor byte [rdx + rbx], al
inc rdx
cmp rdx, 0x1d
jb 0x1400119b5
mov byte [0x1400a4d2d], 0
movzx eax, word [rbp - 5]
movzx ecx, word [rbp - 7]
movzx r10d, word [rbp - 9]
movzx r11d, word [rbp - 0xb]
movzx r9d, word [rbp - 0xf]
movzx r8d, word [rbp - 0x11]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
mov rdx, rbx
mov rbx, qword [rbp + 0x1f]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdx, rbx
mov rcx, rdi
call fcn.14001521c
nop
test rbx, rbx
je 0x140011a5c
mov rdx, qword [rbp + 0x2f]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x140011a54
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a85
mov rcx, rbx
call fcn.14004b054
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14004b030
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
call fcn.14005adc4
int3