joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140142690
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov r12, rdx
mov rdx, rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [r12], ax
jne 0x1401428b2
movsxd rax, dword [r12 + 0x3c]
cmp dword [rax + r12], 0x4550
jne 0x1401428b2
mov ecx, dword [rax + r12 + 0x90]
test ecx, ecx
jne 0x140142701
mov qword [rdx], r8
mov qword [rdx + 8], r8
mov qword [rdx + 0x10], r8
jmp 0x1401428bd
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x49], xmm0
mov rbx, r8
mov qword [rbp - 0x39], rbx
lea r13, [r12 + rcx]
mov r14, qword [rbp - 0x41]
cmp dword [r13 + 0x10], 0
je 0x1401428a1
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r8
mov qword [rbp + reloc.WS2_32.dll_ntohs], 0xf
mov byte [rbp - 9], 0
movdqu xmmword [rbp + 0x17], xmm0
mov r15, r8
mov qword [rbp + 0x27], r8
mov edx, dword [r13 + 0xc]
add rdx, r12
movups xmmword [rbp - 0x31], xmm0
mov qword [rbp - 0x21], r8
mov qword [rbp - 0x19], r8
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140142760
lea rcx, [rbp - 0x31]
call fcn.14013ab10
movups xmm0, xmmword [rbp - 0x31]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rbp - 0x21]
movups xmmword [rbp + 7], xmm1
mov esi, dword [r13 + 0x10]
add rsi, r12
mov edi, dword [r13]
add rdi, r12
mov rax, qword [rdi]
test rax, rax
je 0x140142843
mov rbx, qword [rbp + 0x1f]
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
mov qword [rbp - 0x21], 0
mov qword [rbp - 0x19], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x31], 0
lea rdx, [r12 + 2]
add rdx, rax
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1401427d0
lea rcx, [rbp - 0x31]
call fcn.140136400
mov qword [rbp - 0x11], rsi
cmp rbx, r15
je 0x14014280a
lea rdx, [rbp - 0x31]
mov rcx, rbx
call fcn.140135eb0
mov rax, qword [rbp - 0x11]
mov qword [rbx + 0x20], rax
add rbx, 0x28
mov qword [rbp + 0x1f], rbx
jmp 0x140142822
lea r8, [rbp - 0x31]
mov rdx, rbx
lea rcx, [rbp + 0x17]
call fcn.140142d70
mov r15, qword [rbp + 0x27]
mov rbx, qword [rbp + 0x1f]
add rdi, 8
add rsi, 8
lea rcx, [rbp - 0x31]
call fcn.1401362c0
mov rax, qword [rdi]
test rax, rax
jne 0x1401427a1
mov rbx, qword [rbp - 0x39]
cmp r14, rbx
je 0x14014285e
lea rdx, [rbp - 9]
mov rcx, r14
call fcn.1401431c0
add r14, 0x38
mov qword [rbp - 0x41], r14
jmp 0x140142876
lea r8, [rbp - 9]
mov rdx, r14
lea rcx, [rbp - 0x49]
call fcn.140142910
mov r14, qword [rbp - 0x41]
mov rbx, qword [rbp - 0x39]
add r13, 0x14
lea rcx, [rbp + 0x17]
call fcn.140142410
lea rcx, [rbp - 9]
call fcn.1401362c0
cmp dword [r13 + 0x10], 0
mov r8d, 0
jne 0x140142723
mov rdx, qword [rbp + 0x67]
mov rax, qword [rbp - 0x49]
mov qword [rdx], rax
mov qword [rdx + 8], r14
mov qword [rdx + 0x10], rbx
jmp 0x1401428bd
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1401435a0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rbx, rcx
lea rcx, [0x140445790]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x140143743
mov rcx, qword [rbx + 0x10]
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
sub rax, rcx
cmp rax, 0x34
jb 0x14014375e
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1401435f9
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_gethostbyname
lea r9, str.RegistryMachineSystemCurrentControlSetServices_
mov r8, rbx
movzx edx, byte [rsp + 0xa8]
lea rcx, [rsp + 0x70]
call fcn.140140a10
nop
lea rdx, [rsp + 0x70]
cmp qword [rsp + 0x88], 7
cmova rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbx + 0x10]
sub rdi, rcx
cmp rdi, 0x22
jb 0x140143758
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140143666
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x22
lea r9, str.SYSTEMCurrentControlSetServices_
mov r8, rbx
movzx edx, byte [rsp + 0xa8]
lea rcx, [rsp + 0x50]
call fcn.140140a10
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea r8, [rsp + 0xa8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1401436c8
cmp eax, 2
sete bl
jmp 0x14014372b
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x40]
call rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
test eax, eax
je 0x140143713
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor bl, bl
jmp 0x14014372b
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x14014370f
mov bl, 1
lea rcx, [rsp + 0x50]
call fcn.14013ec20
nop
lea rcx, [rsp + 0x70]
call fcn.14013ec20
movzx eax, bl
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1401346f0
nop
call fcn.1401346f0
int3
Function at 0x140143770
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x40
xor edx, edx
lea r9, [rsp + 0x68]
mov rsi, rcx
xor r14d, r14d
xor r8d, r8d
mov dword [rsp + 0x68], r14d
mov ebx, r14d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1401437ef
test rbx, rbx
je 0x1401437b7
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x68]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x68]
mov rdx, rax
mov ecx, reloc.WS2_32.dll_inet_addr
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1401437a1
test eax, eax
jns 0x140143814
test rbx, rbx
je 0x140143819
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x40
pop r14
pop rsi
pop rbx
ret
test rbx, rbx
jne 0x140143824
xor eax, eax
add rsp, 0x40
pop r14
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x70], rdi
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x1401438f3
nop word [rax + rax]
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x20], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x30], r14
add rdx, rcx
mov qword [rsp + 0x38], r14
add rdx, rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x140143875
lea rcx, [rsp + 0x20]
call fcn.14013ab10
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140143895
mov rdx, qword [rsi]
cmp qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x20]
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140143919
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1401438e9
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401438e4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140143962
call fcn.1401c7190
inc edi
cmp edi, dword [rbx]
jb 0x140143840
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14014396e
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140143969
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140143969
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401c7190
mov rax, rdi
jmp 0x140143906
Function at 0x140143c40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x13e0
call fcn.14038d7d0
sub rsp, rax
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea ecx, [rdi + 0x40]
call fcn.1401c714c
mov rsi, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], reloc.WS2_32.dll_gethostbyname
mov qword [rsp + 0x40], 0x3f
movups xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140445af0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140445b00]
movups xmmword [rax + 0x20], xmm0
mov ecx, dword [0x140445b10]
mov dword [rax + 0x30], ecx
mov byte [rax + 0x34], dil
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea edx, [rdi + 1]
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x54], eax
inc rdx
cmp rdx, 0x270
jb 0x140143ce0
mov dword [rsp + 0x50], 0x270
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
mov edi, 0x20
nop dword [rax]
lea rcx, [rsp + 0x50]
call fcn.14014de30
mov ecx, eax
imul rax, rcx, 0x34
cmp eax, 0x2f
ja 0x140143d5a
lea rcx, [rsp + 0x50]
call fcn.14014de30
mov ecx, eax
imul rax, rcx, 0x34
cmp eax, 0x30
jb 0x140143d45
shr rax, 0x20
movsxd rcx, eax
movzx r9d, byte [rcx + rsi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140143d92
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x140143d87
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140143d9a
mov rcx, rbx
call fcn.14013a9a0
sub rdi, 1
jne 0x140143d30
lea edx, [rdi + 0x40]
mov rcx, rsi
call fcn.1401c7190
mov rax, rbx
lea r11, [rsp + 0x13e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140144e50
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140144eb4
nop dword [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x140144ed0
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140144e90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x140147220
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140147294
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140147294
nop word [rax + rax]
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rbx
test eax, eax
je 0x1401472b0
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140147270
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret

Function at 0x1401472d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [0x1404e9ce8]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
mov edx, 0x100
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
test eax, eax
je 0x140147319
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14014de30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14014de91
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14014de50
mov ecx, dword [r9]
jmp 0x14014df7b
cmp ecx, 0x4e0
jb 0x14014df7b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14014deb0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14014df00
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140153660
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x30
cmp qword [0x1404e9bc0], 0xf
lea rdx, [0x1404e9ba8]
mov rdi, rcx
mov rcx, 0xffffffff80000001
cmova rdx, qword [0x1404e9ba8]
call fcn.1401537b0
cmp qword [rdi + 0x18], 0xf
mov rsi, rax
mov rdx, rdi
jbe 0x1401536a9
mov rdx, qword [rdi]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.1401362c0
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140153700
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [0x1404e9bc0], 0xf
mov rsi, rdx
mov rdi, rcx
lea rdx, [0x1404e9ba8]
cmova rdx, qword [0x1404e9ba8]
mov rcx, 0xffffffff80000001
call fcn.1401537b0
cmp qword [rsi + 0x18], 0xf
mov rbp, rax
mov eax, dword [rsi + 0x10]
mov rcx, rsi
jbe 0x140153750
mov rcx, qword [rsi]
cmp qword [rdi + 0x18], 0xf
mov rdx, rdi
jbe 0x14015375d
mov rdx, qword [rdi]
mov dword [rsp + 0x28], eax
mov r9d, 1
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.1401362c0
mov rcx, rsi
call fcn.1401362c0
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1401541e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140154371
mov r15, qword [rsp + 0x60]
lea r8d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r9d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x140154371
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r8w, dx
jae 0x14015427b
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x140154398
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140154292
mov eax, ecx
add cx, r11w
cmp cx, r9w
ja 0x140154292
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x1401542a5
movzx r9d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x1401542f2
mov r9d, eax
cmp eax, 0x800
jae 0x1401542bf
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov r11d, r8d
jmp 0x1401542f2
cmp eax, 0x10000
jae 0x1401542d9
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov r11d, r10d
jmp 0x1401542f2
shr r9d, 0x12
mov r10d, 3
movzx r11d, sil
or r9b, 0xf0
xor r11d, 1
add r11d, r11d
lea r8d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r8d
cmp rdx, rcx
jl 0x140154371
add qword [r14], 2
test sil, sil
jne 0x140154313
cmp r10d, 3
jae 0x14015431f
mov rcx, qword [rbx]
mov r8d, r11d
mov byte [rcx], r9b
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jle 0x14015434e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jg 0x140154330
shr eax, 0xa
mov r8d, 1
test sil, sil
mov ecx, r8d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x14015422f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x14015437f
Function at 0x140155e20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
movups xmm0, xmmword [str.vEgYZRTqTW_2rz]
movzx eax, byte [0x140447fb0]
xor ecx, ecx
cmp dword [0x14047f088], 2
movups xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x48], al
movsd xmm0, qword [0x140447fa8]
movsd qword [rsp + 0x40], xmm0
jl 0x140155f99
movdqa xmm0, xmmword [0x14044a880]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x14044a760]
movdqa xmm4, xmmword [0x14044a900]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x14044a780]
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14044a7f0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14044a7f0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x140155e90
movaps xmm6, xmmword [rsp + 0x50]
cmp ecx, 0x19
jge 0x140155fdd
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0x19
jl 0x140155fb0
mov rcx, qword [0x1404e9b98]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140155ff6
call rax
mov rcx, qword [0x1404e9b98]
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x48], al
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x68
ret
Function at 0x1401676e0
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x80
xor eax, eax
mov dword [rsp + 0x38], 0xa
mov qword [r11 - 0x58], rax
lea r9, [r11 + 0x10]
mov rbx, rcx
mov qword [r11 - 0x60], rax
xor edx, edx
mov qword [r11 - 0x68], rax
lea r8d, [rax + 0xc]
lea rcx, [0x140447324]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [rsp + 0x98]
lea rdx, [rsp + 0x40]
mov r9d, reloc.WS2_32.dll_recv
lea r8d, [r9 + 0x30]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa_s]
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140167743
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140136400
add rsp, 0x80
pop rbx
ret
Function at 0x1401c0de0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1401c0e81
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x18
jne 0x1401c0e6a
nop dword [rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1401c0e81
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x18
je 0x1401c0e40
xor eax, eax
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
test rbx, rbx
je 0x1401c0e6a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32First]
mov edi, eax
nop word [rax + rax]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x1401c0ec6
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32Next]
mov edi, eax
test eax, eax
jne 0x1401c0ea0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1401c0e6a
mov rax, qword [rsp + 0x48]
jmp 0x1401c0e6c