joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004b768
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x48
xor r11d, r11d
mov r8, rcx
mov edx, r11d
cmp word [rcx], r11w
je 0x18004b785
inc rdx
cmp word [rcx + rdx*2], r11w
jne 0x18004b77b
movabs r9, 0xcbf29ce484222325
mov r10, r11
test rdx, rdx
je 0x18004b7cf
movzx eax, word [r8 + r10*2]
movzx ecx, word [r8 + r10*2]
sub ax, 0x41
add cx, 0x20
cmp ax, 0x19
cmova cx, word [r8 + r10*2]
inc r10
movzx eax, cx
movabs rcx, 0x100000001b3
imul r9, rcx
xor r9, rax
cmp r10, rdx
jb 0x18004b797
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], r11
lea rcx, [0x18004b758]
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x20], r9
call fcn.18004b8a0
neg al
sbb rax, rax
and rax, qword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x18004b918
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
call fcn.18004c5d0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov ebx, dword [rcx + r8 + 0x88]
add rbx, r8
cmp rbx, r8
je 0x18004b9bc
mov r10d, dword [rbx + 0x18]
test r10d, r10d
je 0x18004b9bc
mov esi, dword [rbx + 0x20]
dec r10d
mov edi, 0xc70b8260
lea rcx, [rsi + r10*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov r11b, byte [r9]
inc r9
test r11b, r11b
je 0x18004b9b7
movsx ecx, r11b
sub r11b, 0x41
mov edx, ecx
or edx, 0x20
cmp r11b, 0x19
mov r11b, byte [r9]
cmova edx, ecx
inc r9
xor edx, edi
imul edi, edx, 0x1000193
test r11b, r11b
jne 0x18004b988
cmp edi, 0x504529d3
je 0x18004b9c1
test r10d, r10d
jne 0x18004b96a
mov rax, qword [rax]
jmp 0x18004b946
mov ecx, dword [rbx + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov ecx, 0x7530
add rax, r8
call rax
movabs rdx, 0xadb7c07d78635309
movabs rcx, 0x739fc0609f73094e
mov qword [rbp - 0x40], rdx
movabs rax, 0xfcf7a11c98329542
mov qword [rbp - 0x60], rax
movabs rax, 0xfe640947794fa82b
mov qword [rbp - 0x58], rax
movabs rax, 0x8dae48bf81a9d10a
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rbp - 0x50], rax
movabs rax, 0xd5f6617a8aa2b98a
mov qword [rbp - 0x48], rax
movabs rax, 0xfc92a17198539505
movdqa xmm1, xmmword [rbp - 0x50]
mov qword [rbp - 0x30], rax
movabs rax, 0xfe010934793ca86a
mov qword [rbp - 0x28], rax
movabs rax, 0x8dd748d381cbd167
xorps xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x20], rax
movabs rax, 0xd59a61168ac6b9a4
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x10], rdx
xor edx, edx
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x60]
xorps xmm0, xmmword [rbp - 0x10]
mov qword [rbp - 0x18], rax
xorps xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmmword [rbp - 0x40], xmm0
call fcn.18004b768
mov qword [0x1800cf380], rax
call fcn.18008474c
test al, al
je 0x18004bac1
lea rcx, [rbp + 0x28]
call fcn.18007cdcc
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18005550c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r10d, r10d
mov rsi, r8
mov rbx, rdx
test rdx, rdx
je 0x180055598
mov rdi, qword [rsp + 0x28]
mov r11d, r10d
cmp byte [rdi], r10b
je 0x18005553f
inc r11
cmp byte [r11 + rdi], r10b
jne 0x180055536
movabs r8, 0xcbf29ce484222325
test r11, r11
je 0x180055586
mov dl, byte [r10 + rdi]
mov al, byte [r10 + rdi]
sub dl, 0x41
add al, 0x20
movzx ecx, al
cmp dl, 0x19
movzx eax, byte [r10 + rdi]
cmova ecx, eax
inc r10
movsx rdx, cl
movabs rcx, 0x100000001b3
imul r8, rcx
xor r8, rdx
cmp r10, r11
jb 0x18005554e
cmp r8, qword [rbx]
jne 0x180055598
mov qword [rbx + 0x10], rsi
mov al, 1
mov word [rbx + 8], r9w
jmp 0x18005559a
xor al, al
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x180055600
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, rdx
mov r13, r8
xor edx, edx
mov rdi, rcx
test r12, r12
je 0x1800556c9
test rcx, rcx
je 0x1800556c9
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800556c9
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x1800556c9
test rax, rax
je 0x1800556c9
add rax, 0x88
je 0x1800556c9
mov ebx, dword [rax]
add rbx, rcx
je 0x1800556c9
cmp dword [rbx + 0x1c], edx
je 0x1800556c9
cmp dword [rbx + 0x20], edx
je 0x1800556c9
cmp dword [rbx + 0x24], edx
je 0x1800556c9
mov r14d, dword [rbx + 0x1c]
mov esi, edx
mov ebp, dword [rbx + 0x20]
add r14, rcx
mov r15d, dword [rbx + 0x24]
add rbp, rcx
add r15, rcx
cmp dword [rbx + 0x18], edx
jbe 0x1800556c9
mov ecx, esi
movzx r8d, word [r15 + rcx*2]
cmp dword [r14 + r8*4], edx
je 0x1800556c2
cmp dword [rbp + rcx*4], edx
je 0x1800556c2
mov r9d, dword [rbp + rcx*4]
mov rcx, r13
mov edx, dword [r14 + r8*4]
add r9, rdi
add rdx, rdi
call r12
xor edx, edx
test al, al
jne 0x1800556e8
inc esi
cmp esi, dword [rbx + 0x18]
jb 0x180055694
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov al, 1
jmp 0x1800556cb
Function at 0x18005bdd8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r10d, r10d
mov r11, rcx
test r9b, r9b
je 0x18005be22
test r8, r8
je 0x18005be45
movabs r9, 0x100000001b3
movzx eax, word [rdx + r10*2]
movzx ecx, word [rdx + r10*2]
sub ax, 0x41
add cx, 0x20
cmp ax, 0x19
cmova cx, word [rdx + r10*2]
inc r10
imul r11, r9
movzx eax, cx
xor r11, rax
cmp r10, r8
jb 0x18005bdf2
jmp 0x18005be45
test r8, r8
je 0x18005be45
movabs r9, 0x100000001b3
movzx ecx, word [rdx + r10*2]
inc r10
imul r11, r9
xor r11, rcx
cmp r10, r8
jb 0x18005be31
mov rax, r11
ret
Function at 0x18009a420
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rcx - 0x10000]
mov rsi, rcx
movabs rcx, 0x7ffffffeffff
mov rbx, rdx
cmp rax, rcx
ja 0x18009a53b
movabs rax, 0x7d6f1175f14b427f
xor r9d, r9d
mov qword [r11 - 0x28], rax
movabs rax, 0xc3c9c7fedf446077
mov qword [r11 - 0x20], rax
movabs rax, 0xa1d7e33882f2d3d
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0xc3c9c7fedf201216
mov qword [rsp + 0x38], rax
xorps xmm0, xmmword [rsp + 0x30]
movq rax, xmm0
movdqa xmmword [rsp + 0x20], xmm0
test al, al
je 0x18009a4b2
inc r9
cmp byte [rsp + r9 + 0x20], 0
jne 0x18009a4a7
xor r10d, r10d
movabs rdi, 0xcbf29ce484222325
test r9, r9
je 0x18009a4f8
movzx edx, byte [rsp + r10 + 0x20]
lea eax, [rdx + 0x20]
movzx ecx, al
lea r8d, [rdx - 0x41]
cmp r8b, 0x19
cmova ecx, edx
inc r10
movsx rax, cl
movabs rcx, 0x100000001b3
imul rdi, rcx
xor rdi, rax
cmp r10, r9
jb 0x18009a4c4
mov rax, qword [0x1800d62e8]
test rax, rax
jne 0x18009a51f
call fcn.18004b6dc
mov rcx, rax
lea rdx, str.PlayerEyes
call fcn.180025d84
mov qword [0x1800d62e8], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.18004ac10
mov rdx, rsi
mov rcx, rbx
mov r8, qword [rax]
call r8
jmp 0x18009a54c
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, rbx
call fcn.18009dc6c
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x18009a560
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rcx - 0x10000]
mov rsi, rcx
movabs rcx, 0x7ffffffeffff
mov rbx, rdx
cmp rax, rcx
ja 0x18009a67b
movabs rax, 0x627a1761f14b427f
xor r9d, r9d
mov qword [r11 - 0x28], rax
movabs rax, 0xc3c9c7fedf201262
mov qword [r11 - 0x20], rax
movabs rax, 0xa1d7e33882f2d3d
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0xc3c9c7fedf201216
mov qword [rsp + 0x38], rax
xorps xmm0, xmmword [rsp + 0x30]
movq rax, xmm0
movdqa xmmword [rsp + 0x20], xmm0
test al, al
je 0x18009a5f2
inc r9
cmp byte [rsp + r9 + 0x20], 0
jne 0x18009a5e7
xor r10d, r10d
movabs rdi, 0xcbf29ce484222325
test r9, r9
je 0x18009a638
movzx edx, byte [rsp + r10 + 0x20]
lea eax, [rdx + 0x20]
movzx ecx, al
lea r8d, [rdx - 0x41]
cmp r8b, 0x19
cmova ecx, edx
inc r10
movsx rax, cl
movabs rcx, 0x100000001b3
imul rdi, rcx
xor rdi, rax
cmp r10, r9
jb 0x18009a604
mov rax, qword [0x1800d62e8]
test rax, rax
jne 0x18009a65f
call fcn.18004b6dc
mov rcx, rax
lea rdx, str.PlayerEyes
call fcn.180025d84
mov qword [0x1800d62e8], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.18004ac10
mov rdx, rsi
mov rcx, rbx
mov r8, qword [rax]
call r8
jmp 0x18009a68c
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, rbx
call fcn.18009dc6c
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18009b698
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rcx - 0x10000]
mov rsi, rcx
movabs rcx, 0x7ffffffeffff
mov rbx, rdx
cmp rax, rcx
ja 0x18009b7b3
movabs rax, 0x7d6f1175ec4e4875
xor r9d, r9d
mov qword [r11 - 0x28], rax
movabs rax, 0xc3c9c7fedf446077
mov qword [r11 - 0x20], rax
movabs rax, 0xa1d7e33882f2d3d
movdqa xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0xc3c9c7fedf201216
mov qword [rsp + 0x38], rax
xorps xmm0, xmmword [rsp + 0x30]
movq rax, xmm0
movdqa xmmword [rsp + 0x20], xmm0
test al, al
je 0x18009b72a
inc r9
cmp byte [rsp + r9 + 0x20], 0
jne 0x18009b71f
xor r10d, r10d
movabs rdi, 0xcbf29ce484222325
test r9, r9
je 0x18009b770
movzx edx, byte [rsp + r10 + 0x20]
lea eax, [rdx + 0x20]
movzx ecx, al
lea r8d, [rdx - 0x41]
cmp r8b, 0x19
cmova ecx, edx
inc r10
movsx rax, cl
movabs rcx, 0x100000001b3
imul rdi, rcx
xor rdi, rax
cmp r10, r9
jb 0x18009b73c
mov rax, qword [0x1800d62e8]
test rax, rax
jne 0x18009b797
call fcn.18004b6dc
mov rcx, rax
lea rdx, str.PlayerEyes
call fcn.180025d84
mov qword [0x1800d62e8], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.18004ac10
mov rdx, rsi
mov rcx, rbx
mov r8, qword [rax]
call r8
jmp 0x18009b7c4
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, rbx
call fcn.18009dc6c
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x18009fa9c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
lea rax, [rcx - 0x10000]
movabs rdx, 0x7ffffffeffff
cmp rax, rdx
ja 0x18009fb25
mov rax, qword [rcx]
xor r9d, r9d
test rax, rax
je 0x18009fb25
mov rbx, qword [rax + 0x10]
mov r10d, r9d
cmp byte [rbx], r9b
je 0x18009fad7
inc r10
cmp byte [r10 + rbx], r9b
jne 0x18009face
movabs r11, 0xcbf29ce484222325
test r10, r10
je 0x18009fb20
mov al, byte [r9 + rbx]
movzx ecx, byte [r9 + rbx]
add al, 0x20
mov r8b, byte [r9 + rbx]
sub r8b, 0x41
movzx edx, al
cmp r8b, 0x19
movabs rax, 0x100000001b3
cmova edx, ecx
inc r9
imul r11, rax
movsx rcx, dl
xor r11, rcx
cmp r9, r10
jb 0x18009fae6
mov rax, r11
jmp 0x18009fb27
xor eax, eax
mov rbx, qword [rsp + 8]
ret
Function at 0x14001128f
Capabilities:
Terminate process

Disassembly:
jmp 0x140014040
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14001132a
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400153c0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400153e0
xor al, al
jmp 0x140015461
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400153f3
xor al, al
jmp 0x140015461
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001541d
xor al, al
jmp 0x140015461
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015431
xor al, al
jmp 0x140015461
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015443
xor al, al
jmp 0x140015461
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001545f
xor al, al
jmp 0x140015461
mov al, 1
add rsp, 0x38
ret
Function at 0x1400027d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x14002b028]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov qword [rsp + 0x68], rcx
xor edi, edi
mov rcx, qword [rcx + 0x10]
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14000280a
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x140022835]
lea rcx, [rsp + 0x48]
call fcn.14000e880
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.140001c30
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000287b
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002876
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002876
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
lea rcx, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, qword [rsp + 0x88]
cmp eax, 0xffffffff
jne 0x140002965
cmp rdx, 8
jb 0x1400028e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a3d
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024850]
movdqu xmmword [rsp + 0x80], xmm0
mov word [rsp + 0x70], di
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140002933
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000292e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002a44
mov rcx, r8
call fcn.14001e2dc
xor al, al
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rdi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14001e280
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
test al, 0x10
je 0x1400029fd
cmp rdx, 8
jb 0x1400029aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a3d
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024850]
movdqu xmmword [rsp + 0x80], xmm0
mov word [rsp + 0x70], di
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400029f6
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400029f1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002a44
mov rcx, r8
call fcn.14001e2dc
mov al, 1
jmp 0x140002935
cmp rdx, 8
jb 0x1400028e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140003a00
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14002b028]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov qword [rsp + 0x68], rcx
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0xe
jb 0x140003bde
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140003a4b
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xe
lea r9, str.taskkill__PID
lea rcx, [rsp + 0x48]
call fcn.14000e880
nop
mov r8d, 3
lea rdx, [0x14002285c]
lea rcx, [rsp + 0x48]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x80], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140003b02
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003afd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003afd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
lea rcx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x140003b5f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rsp + 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140003bab
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140003ba6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003bd7
mov rcx, r8
call fcn.14001e2dc
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14001e280
add rsp, 0xa0
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001280
nop
int3
Function at 0x140005bb0
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14002b028]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov qword [rsp + 0x68], rcx
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x28
jb 0x140005d8e
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140005bfb
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x28
lea r9, str.netsh_advfirewall_set_allprofiles_state
lea rcx, [rsp + 0x48]
call fcn.14000e880
nop
mov r8d, 0xa
lea rdx, str.__nul_2_1
lea rcx, [rsp + 0x48]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x80], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140005cb2
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005cad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005cad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
lea rcx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x140005d0f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rsp + 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140005d5b
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140005d56
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005d87
mov rcx, r8
call fcn.14001e2dc
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14001e280
add rsp, 0xa0
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001280
nop
int3
Function at 0x1400087c0
Capabilities:
Disable system restore features via registry on windows
Execute command
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x14002b028]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov qword [rbp - 1], rcx
cmp qword [rcx + 0x18], 0x10
jb 0x1400087f1
mov rcx, qword [rcx]
mov r8, qword [rbx + 0x10]
cmp r8, 7
jne 0x140008983
lea rdx, str.DISABLE
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140008983
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
mov qword [rbp + 0x37], 1
mov qword [rbp + 0x3f], 0xf
mov word [rbp + 0x27], 0x26
mov qword [rsp + 0x30], 1
lea rax, [rbp + 0x27]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4c
lea r9, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_NTSystemRestore___f___nul
lea rcx, [rbp - 0x21]
call fcn.14000e880
nop
mov r8d, 0x6d
lea rdx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_NTSystemRestore___v__DisableSR___t_REG_DWORD__d_1__f___nul
lea rcx, [rbp - 0x21]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 7], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x17], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x1400088e1
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400088dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400088dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rcx, qword [rbp + 7]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140008933
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000892e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000892e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 7], 0
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140008983
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000897d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000897d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400089b9
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400089b4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400089e9
mov rcx, r8
call fcn.14001e2dc
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14001e280
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3