joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rdi, [rdi + 0x64]
sub rsp, 0xe8
mov r9, rsi
lea rsi, [rsp + 0x64]
not qword [rdi - 0x5c]
not qword [rdi - 0x54]
not qword [rdi - 0x24]
not qword [rdi - 4]
not qword [rdi + 0x24]
not qword [rdi + 0x3c]
lea r15, reloc.WS2_32.dll_accept
mov qword [rsi + 0x74], rcx
cmp rdx, rcx
jb 0x14001d700
shr rcx, 3
lea r8, [rdi - 0x64]
mov rax, qword [r9]
lea r9, [r9 + 8]
xor rax, qword [r8]
lea r8, [r8 + 8]
sub rdx, 8
mov qword [r8 - 8], rax
sub rcx, 1
jne 0x14001d6c6
mov qword [rsi + 0x64], r9
mov qword [rsi + 0x6c], rdx
call fcn.14001d300
mov r9, qword [rsi + 0x64]
mov rdx, qword [rsi + 0x6c]
mov rcx, qword [rsi + 0x74]
jmp 0x14001d6b9
mov rax, rdx
not qword [rdi - 0x5c]
not qword [rdi - 0x54]
not qword [rdi - 0x24]
not qword [rdi - 4]
not qword [rdi + 0x24]
not qword [rdi + 0x3c]
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x1400213a0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
lea rcx, [rsp + 0x28]
sub rcx, 8
lea r8, [0x140025c10]
lea rdx, [rsp + 0x30]
call fcn.140028f10
call fcn.140021c20
mov rcx, qword [rsp + 0x30]
mov rdx, rax
call fcn.14002a080
mov qword [rsp + 0x30], rax
lea rdx, [0x1401a4e20]
mov rcx, qword [rax]
call fcn.140029f60
test eax, eax
jne 0x1400213ff
call fcn.140021c20
mov rcx, rax
mov edx, 0x1ff
call fcn.1401717e0
add rsp, 0x28
ret
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call fcn.14002cc20
mov rcx, qword [rsp + 0x30]
mov edx, 0x5c
mov rcx, qword [rcx]
call fcn.14017beb4
mov rbx, rax
mov byte [rax], 0
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call fcn.14017679c
mov byte [rbx], 0x5c
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call fcn.14017679c
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x14002c1e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov rbx, rcx
mov r13d, 0x10000
mov ecx, r13d
mov rdi, rdx
call fcn.140176114
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r14, rax
or r12d, 0xffffffff
call fcn.140172570
test eax, eax
jne 0x14002c2e0
lea rdx, [0x1401a9384]
mov qword [rsp + 0xa0], r15
mov rcx, rbx
call fcn.140171cf0
mov r15, rax
test rax, rax
je 0x14002c2d8
lea rdx, [0x1401a951c]
mov qword [rsp + 0x90], rbp
mov rcx, rdi
call fcn.140171cf0
mov rbp, rax
test rax, rax
je 0x14002c2bb
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x98], rsi
test rbx, rbx
je 0x14002c2b0
cmp rbx, r13
mov esi, ebx
mov r9, r15
mov edx, 1
cmovg esi, r13d
mov rcx, r14
movsxd rdi, esi
mov r8, rdi
call fcn.140176c20
cmp eax, esi
jne 0x14002c2b3
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, r14
call fcn.14017e464
cmp eax, esi
jne 0x14002c2b3
sub rbx, rdi
jne 0x14002c271
xor r12d, r12d
mov rsi, qword [rsp + 0x98]
mov rcx, r15
call fcn.14017e080
test rbp, rbp
je 0x14002c2d0
mov rcx, rbp
call fcn.14017e080
mov rbp, qword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov rcx, r14
call fcn.14017610c
mov eax, r12d
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret

Function at 0x14002c6a0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x68]
sub rcx, 8
lea r8, [fcn.14002ac10]
lea rdx, [rsp + 0x70]
call fcn.140028f10
mov qword [rsp + 0x70], rax
mov rax, qword [0x140278f70]
test rax, rax
jne 0x14002c812
lea rcx, str.TEMP
mov qword [rsp + 0x60], rbx
call fcn.1401711e0
test rax, rax
jne 0x14002c7a0
lea rcx, [0x1401a93c0]
call fcn.1401711e0
test rax, rax
jne 0x14002c7a0
mov rcx, qword [rsp + 0x70]
call fcn.14002ac90
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, eax
test eax, eax
je 0x14002c754
mov rcx, qword [rsp + 0x70]
mov edx, eax
call fcn.14002acc0
mov rdx, qword [rsp + 0x70]
mov ecx, ebx
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rdx, qword [rsp + 0x70]
lea rcx, [0x140278f70]
mov rdx, qword [rdx]
call fcn.14002a260
jmp 0x14002c7af
lea rcx, [0x1401a93c8]
call fcn.1401711e0
test rax, rax
je 0x14002c817
movzx ecx, byte [rax]
lea rdx, [0x140231b10]
test byte [rdx + rcx*2], 4
je 0x14002c817
cmp byte [rax + 1], 0x3a
jne 0x14002c817
movsx r8d, cl
lea rdx, str._c:_Temp
lea rcx, [0x140278f70]
call fcn.14002a130
jmp 0x14002c7af
mov rdx, rax
lea rcx, [0x140278f70]
call fcn.14002a080
mov rcx, qword [0x140278f70]
lea rdx, [rsp + 0x20]
call fcn.140172570
test eax, eax
jne 0x14002c7d9
movzx eax, word [rsp + 0x26]
test eax, eax
je 0x14002c7d9
and eax, 0xf000
cmp eax, 0x4000
je 0x14002c806
mov r8, qword [0x140278f70]
lea rdx, str.creating_temp_directory__s
mov ecx, 0x3e0004
call fcn.14002d250
mov rcx, qword [0x140278f70]
mov edx, 0x1ff
call fcn.1401717e0
test eax, eax
jne 0x14002c829
mov rax, qword [0x140278f70]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rdx, str.failed_to_get_temp_directory
mov ecx, 0x3e0000
call fcn.14002d720
int3
lea rdx, str.failed_to_create_temp_directory
mov ecx, 0x3e0000
call fcn.14002d720
int3
Function at 0x1400433d0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r14
sub rsp, 0x2c0
mov r14, r8
lea rcx, [rsp + 0x2d8]
mov rbx, rdx
lea r8, [0x140046710]
sub rcx, 8
lea rdx, [rsp + 0x30]
mov rdi, r9
call fcn.140028f10
xor edx, edx
mov qword [rsp + 0x30], rax
lea rcx, [0x1401ab5f0]
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x68], rcx
lea rcx, [0x1401ab5f8]
mov qword [rsp + 0x70], rcx
lea rcx, str.except
mov qword [rsp + 0x78], rcx
xor ecx, ecx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x38], rcx
test rbx, rbx
je 0x140043600
mov qword [rsp + 0x2e0], rbp
mov rax, rbx
mov qword [rsp + 0x2b8], rsi
mov ebp, edx
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2a8], r13
mov qword [rsp + 0x2a0], r15
cmp dword [rax], 0
mov esi, edx
jbe 0x1400435c1
mov r15, qword [rsp + rbp + 0x48]
lea r12, [rsp + 0x90]
cmp rax, rdi
lea r13, [rsp + 0x90]
lea rcx, [rsp + 0x90]
cmovne r12, rdx
cmp rax, r14
lea r14, [rax + 8]
cmovne r13, rdx
cmp rax, rbx
cmovne rcx, rdx
mov qword [rsp + 0x40], rcx
nop word [rax + rax]
movsxd rdi, dword [r14]
lea rax, [rsp + 0x38]
mov rdx, rcx
mov qword [rsp + 0x98], rdi
mov ecx, 1
mov qword [rsp + 0x20], rax
mov r9, r12
mov dword [rsp + 0x90], 1
mov r8, r13
call qword [sym.imp.WS2_32.dll_select]
movsxd rcx, eax
call fcn.140171070
test eax, eax
jns 0x140043593
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov edx, dword [0x14027dfd0]
xor eax, eax
mov r8, qword [0x14027e020]
xor ebx, ebx
test edx, edx
jle 0x140043558
mov rcx, qword [r8 + rax*8]
test rcx, rcx
je 0x140043558
cmp dword [rcx + 0x70], edi
je 0x140043558
inc ebx
inc rax
cmp ebx, edx
jl 0x140043541
cmp ebx, edx
je 0x140043563
cmp qword [r8 + rax*8], 0
jne 0x140043566
or ebx, 0xffffffff
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_LeaveCriticalSection
mov r8, qword [rsp + rbp + 0x68]
lea rdx, str._s__d__osfd_d_vfd_d_
mov rcx, qword [rsp + 0x30]
mov r9d, esi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call fcn.140029d80
mov rcx, qword [rsp + 0x40]
inc esi
add r14, 8
cmp esi, dword [r15]
jb 0x1400434e0
mov rbx, qword [rsp + 0x2e8]
xor edx, edx
mov rdi, qword [rsp + 0x2f8]
mov r14, qword [rsp + 0x2f0]
mov rax, qword [rsp + rbp + 0x50]
add rbp, 8
test rax, rax
jne 0x140043494
mov rax, qword [rsp + 0x30]
mov r15, qword [rsp + 0x2a0]
mov r13, qword [rsp + 0x2a8]
mov r12, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov rbp, qword [rsp + 0x2e0]
lea rdx, [0x1401ab620]
mov rcx, rax
call fcn.14002a810
mov r8, qword [rsp + 0x30]
lea rdx, str.vsock_select__:_a_member_of_fd_set_was_invalid:__s
mov ecx, 0x4b0000
mov r8, qword [r8]
call fcn.14002d720
int3
Function at 0x140172b60
Capabilities:
Timestomp file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
or edi, 0xffffffff
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x100
mov dword [rsp + 0x28], 0x2000080
lea r8d, [rdi + 4]
mov dword [rsp + 0x20], 3
call fcn.140173df0
mov rcx, rax
call fcn.1401710c0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140172c0b
test rbx, rbx
jne 0x140172bcb
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
jmp 0x140172be6
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140173ec0
lea rcx, [rbx + 8]
lea rdx, [rsp + 0x78]
call fcn.140173ec0
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileTime]
movsxd rcx, eax
call fcn.140171070
test rax, rax
cmovne edi, esi
lea rcx, [rsp + 0x40]
call fcn.140173db0
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140173470
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov r8d, ecx
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
call fcn.1401710c0
mov rsi, rax
test rax, rax
jne 0x1401734b4
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x14017350d
cmp edi, 9
je 0x1401734ec
cmp edi, 0x16
je 0x1401734ec
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x1401734e1
call fcn.1401760e4
mov dword [rax], reloc.WS2_32.dll_shutdown
or ebx, 0xffffffff
jmp 0x14017350d
or edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movsxd rcx, eax
call fcn.140171070
mov ecx, ebx
or ebx, 0xffffffff
test rax, rax
cmove ecx, ebx
mov ebx, ecx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401737e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x58]
mov rdx, rcx
mov ecx, 0x3380
add rcx, 0x20
add rcx, qword [rax]
call fcn.140173c30
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140175dfc
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x1402327d0]
xor ecx, ecx
lea r8, [0x1402327c8]
lea rdx, [0x1402327d0]
call fcn.140175c24
mov rbx, rax
test rax, rax
je 0x140175e3c
mov rcx, rax
call fcn.1401746ac
mov rcx, rdi
call rbx
jmp 0x140175e42
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140175ea4
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140232808]
mov edi, ecx
lea rdx, [0x140232808]
mov ecx, 3
lea r8, [0x140232800]
call fcn.140175c24
mov rsi, rax
test rax, rax
je 0x140175ef0
mov rcx, rax
call fcn.1401746ac
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x140175efb
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1401763c4
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140176198
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140176198
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140176198
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140176198
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140176198
cmp dword [rcx + 0x84], 0xe
jbe 0x140176198
cmp dword [rcx + 0xf8], esi
je 0x140176198
mov ecx, r14d
call fcn.1401762e0
mov ecx, 2
call fcn.14018dcec
nop
cmp byte [0x14027ca80], 0
jne 0x140176262
mov r15d, 1
mov eax, r15d
xchg dword [0x14027ca70], eax
test ebx, ebx
jne 0x14017620b
mov rdi, qword [0x140274dd0]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14027ca78]
cmp rcx, rax
je 0x140176202
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [0x1401a4890]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14027d138]
jmp 0x140176217
cmp ebx, r15d
jne 0x14017621d
lea rcx, [0x14027d150]
call fcn.14018d07c
nop
test ebx, ebx
jne 0x140176234
lea rdx, [0x1401a4c60]
lea rcx, [0x1401a4c40]
call fcn.14018ca60
lea rdx, [0x1401a4db0]
lea rcx, [0x1401a4c68]
call fcn.14018ca60
movzx eax, byte [0x14027ca80]
test esi, esi
cmove eax, r15d
mov byte [0x14027ca80], al
jmp 0x140176262
mov ecx, 2
call fcn.14018dd40
test esi, esi
jne 0x140176279
mov ecx, r14d
call fcn.140176294
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140176128
Function at 0x14005c080
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 0x15], 0
mov rbx, rcx
je 0x14005c0a6
xor eax, eax
lea r8d, [rax - 0x51]
xor byte [rax + rdx], r8b
inc rax
cmp rax, 0x14
jb 0x14005c091
mov byte [rdx + 0x15], 0
call fcn.14005bdd0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14005c0c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 0x17], 0
mov rbx, rcx
je 0x14005c0e6
xor eax, eax
lea r8d, [rax - 0x51]
xor byte [rax + rdx], r8b
inc rax
cmp rax, 0x16
jb 0x14005c0d1
mov byte [rdx + 0x17], 0
call fcn.14005bdd0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14005c100
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 0xf], 0
mov rbx, rcx
je 0x14005c126
xor eax, eax
lea r8d, [rax - 0x51]
xor byte [rax + rdx], r8b
inc rax
cmp rax, 0xe
jb 0x14005c111
mov byte [rdx + 0xf], 0
call fcn.14005bdd0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14006d020
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140401ac0]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, str.Intel_R__Core_TM__i5_650___2.70GHz
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rax, str.Intel_R__Core_TM__i3_7400___2.20GHz
mov qword [rsp + 0x38], rax
lea rax, str.Intel_R__Core_TM__i7_10700G___2.60GHz
mov qword [rsp + 0x40], rax
lea rax, str.Intel_R__Core_TM__i7_2670QW___2.10GHz
mov qword [rsp + 0x48], rax
call fcn.14023fba0
mov rcx, rax
call fcn.1402387a0
call fcn.140238774
and eax, 0x80000003
jge 0x14006d087
dec eax
or eax, 0xfffffffc
inc eax
mov rbx, qword [rsp + rax*8 + 0x30]
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], 0
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x14006d0c3
mov rcx, qword [rsp + 0x50]
lea rdx, str.ProcessorNameString
inc eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Success..__n
lea rcx, [0x140412ac0]
call fcn.14005bdd0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140222c70
add rsp, 0x60
pop rbx
ret
Function at 0x14006daf0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140401ac0]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov dword [rsp + 0x20], pe_nt_image_headers64
mov rdi, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14006db62
nop dword [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call fcn.1402403a4
mov rcx, rbx
test eax, eax
je 0x14006db8e
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14006db40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140222c70
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14006db6d

Function at 0x14006dc90
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140401ac0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be103180000
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.14007bec0
mov rbx, rax
mov edx, 8
lea rcx, [rsp + 0x30]
call fcn.14007bec0
mov rcx, rax
cmp qword [rbx + 0x18], 0xf
jbe 0x14006dd06
mov rbx, qword [rbx]
cmp qword [rax + 0x18], 0xf
jbe 0x14006dd10
mov rcx, qword [rax]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x14006dd17
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.NetworkAdress
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14006dd85
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006dd80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006de19
call fcn.140222bac
movdqa xmm0, xmmword [0x14026eb10]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14006ddd1
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ddcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006de13
call fcn.140222bac
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Success..__n
lea rcx, [0x140412ac0]
call fcn.14005bdd0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140222c70
add rsp, 0x80
pop rbx
ret
call fcn.140238238
nop
call fcn.140238238
nop
int3
Function at 0x140071270
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1400712d1
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140071290
mov ecx, dword [r9]
jmp 0x1400713b8
cmp ecx, 0x4e0
jb 0x1400713b8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400712f0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140071340
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140073730
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x140073753
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x51]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x140073740
mov byte [rcx + 4], 0
mov rax, rcx
ret

Function at 0x140073760
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x140073783
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x51]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x16
jb 0x140073770
mov byte [rcx + 0x17], 0
mov rax, rcx
ret

Function at 0x140073790
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x34], 0
je 0x1400737b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x51]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x33
jb 0x1400737a0
mov byte [rcx + 0x34], 0
mov rax, rcx
ret
Function at 0x1400810a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, rdx
mov rsi, rcx
xor r15d, r15d
mov r8d, dword [0x140413360]
mov rax, qword gs:[0x58]
mov rdi, qword [rax + r8*8]
mov eax, 0x13a8
mov eax, dword [rax + rdi]
cmp dword [0x14040da10], eax
jg 0x1400812be
mov r14d, 0x1398
mov eax, dword [r14 + rdi]
mov r13d, reloc.WS2_32.dll_recv
test al, 1
jne 0x140081159
or eax, 1
mov dword [r14 + rdi], eax
call fcn.1402223f8
mov r9d, r13d
add r9, rdi
mov dword [r9 + 0x1384], 0xffffffff
mov dword [r9 + 4], eax
mov edx, 1
lea r8, [r9 + 8]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [r8], eax
inc rdx
lea r8, [r8 + 4]
cmp rdx, 0x270
jb 0x140081130
mov dword [r9], 0x270
mov eax, dword [r14 + rdi]
mov r12d, 0x13a0
mov ebx, r12d
test al, 2
jne 0x140081182
or eax, 2
mov dword [r14 + rdi], eax
mov dword [rdi + r12], r15d
mov eax, dword [0x14040da00]
dec eax
mov dword [rdi + r12 + 4], eax
mov edx, reloc.WLDAP32.dll_Ordinal_32
test rbp, rbp
cmovne rdx, rbp
xor r8d, r8d
mov rcx, rsi
call fcn.140067750
mov rcx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400811ae
mov rcx, qword [rsi]
mov rdx, rcx
mov ebx, r12d
jmp 0x1400811b1
mov rdx, rsi
mov r15, rcx
mov r12, qword [rsi + 0x10]
add r12, rdx
cmp rcx, r12
je 0x14008129e
lea rbp, [rdi + rbx]
mov eax, r13d
add rax, rdi
mov qword [rsp + 0x60], rax
mov r13d, 0x80000000
nop dword [rax]
mov edx, dword [rbp + 4]
mov ecx, dword [rbp]
lea eax, [rcx - 0x80000000]
lea r14d, [rcx + r13]
cmp ecx, r13d
cmovae r14d, eax
lea eax, [rdx - 0x80000000]
lea ecx, [rdx + r13]
cmp edx, r13d
cmovae ecx, eax
sub ecx, r14d
cmp ecx, 0xffffffff
jne 0x14008121d
lea rcx, [rsp + 0x60]
call fcn.140071270
mov ecx, eax
jmp 0x14008125c
lea ebx, [rcx + 1]
mov edi, ebx
lea rcx, [rsp + 0x60]
call fcn.140071270
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jae 0x140081258
mov eax, ebx
neg eax
xor edx, edx
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x140081258
lea rcx, [rsp + 0x60]
call fcn.140071270
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x140081244
shr rcx, 0x20
lea edx, [r14 + rcx]
lea eax, [rdx - 0x80000000]
lea r8d, [rdx + r13]
cmp edx, r13d
cmovae r8d, eax
lea rcx, [0x14040d9f0]
cmp qword [0x14040da08], 0xf
cmova rcx, qword [0x14040d9f0]
movsxd rax, r8d
movzx ecx, byte [rax + rcx]
mov byte [r15], cl
inc r15
cmp r15, r12
jne 0x1400811e0
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x14040da10]
call fcn.140223250
cmp dword [0x14040da10], 0xffffffff
jne 0x1400810f2
mov r8d, Ordinal_35
lea rdx, str.0123456789abcdefghjklmnoprstuvqyzA
lea rcx, [0x14040d9f0]
call fcn.14005ccb0
lea rcx, [0x1402679f0]
call fcn.140222ef4
nop
lea rcx, [0x14040da10]
call fcn.1402231e4
jmp 0x1400810f2