joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64b800
Capabilities:
Query environment variable

Disassembly:
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.00693bc0
sub rsp, rax
test rcx, rcx
mov qword [rsp + 0x58], rdi
mov rdi, rcx
jne 0x64b844
lea r9, [0x007694a8]
lea edx, [rax + 0x32]
lea ecx, [rax - 0x12]
lea r8d, [rax + 0xb]
mov dword [rsp + 0x20], 0x165
call fcn.005ad900
xor eax, eax
mov rdi, qword [rsp + 0x58]
add rsp, 0x38
ret
mov edx, reloc.WLDAP32.dll_Ordinal_30
lea r8, [0x007694c8]
mov r9d, 0x168
lea ecx, [rdx - 0x15]
mov qword [rsp + 0x48], rbx
call fcn.005cc5d0
mov rbx, qword [0x00775dc0]
test rbx, rbx
je 0x64b8d2
nop
mov r8, qword [rbx]
mov rax, rdi
sub r8, rdi
nop
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x64b893
inc rax
test ecx, ecx
jne 0x64b880
test edx, edx
je 0x64b8a5
mov rbx, qword [rbx + 0xd0]
test rbx, rbx
jne 0x64b870
jmp 0x64b8d2
test byte [rbx + 0xa8], 4
je 0x64b8cc
call fcn.00620700
test rax, rax
mov rcx, rax
jne 0x64b8bf
xor ebx, ebx
jmp 0x64b8d2
mov rdx, rbx
call fcn.0064b740
mov rbx, rcx
jmp 0x64b8d2
inc dword [rbx + 0xac]
mov edx, reloc.WLDAP32.dll_Ordinal_30
lea r8, [0x007694e8]
mov r9d, 0x182
lea ecx, [rdx - 0x14]
call fcn.005cc5d0
test rbx, rbx
je 0x64b903
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x38
ret
lea r8, [0x00769508]
mov rax, rdi
sub r8, rdi
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x64b923
inc rax
test ecx, ecx
jne 0x64b910
test edx, edx
mov qword [rsp + 0x50], rsi
je 0x64ba02
lea rcx, str.OPENSSL_ENGINES
call sub.msvcrt.dll_getenv
lea rsi, str._usr_local_ssl_lib_engines
lea rcx, str.dynamic
test rax, rax
cmovne rsi, rax
call fcn.0064b800
test rax, rax
mov rbx, rax
je 0x64ba02
lea rdx, [0x00769548]
xor r9d, r9d
mov r8, rdi
mov rcx, rax
call fcn.00675460
test eax, eax
je 0x64ba02
lea r8, [0x0076954c]
lea rdx, str.DIR_LOAD
xor r9d, r9d
mov rcx, rbx
call fcn.00675460
test eax, eax
je 0x64ba02
lea rdx, str.DIR_ADD
xor r9d, r9d
mov r8, rsi
mov rcx, rbx
call fcn.00675460
test eax, eax
je 0x64ba02
lea r8, [0x00769568]
lea rdx, str.LIST_ADD
xor r9d, r9d
mov rcx, rbx
call fcn.00675460
test eax, eax
je 0x64ba02
lea rdx, str.LOAD
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call fcn.00675460
test eax, eax
je 0x64ba02
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x38
ret
mov rcx, rbx
call fcn.006208b0
mov edx, 0x6a
lea r9, [0x00769588]
lea ecx, [rdx - 0x44]
lea r8d, [rdx + 0xa]
mov dword [rsp + 0x20], 0x1a2
call fcn.005ad900
lea rdx, [0x007695a4]
mov r8, rdi
mov ecx, 2
call fcn.005ae0b0
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x38
ret
Function at 0x659920
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x48
call fcn.00693bc0
sub rsp, rax
test r8, r8
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rbx, rdx
mov rsi, rcx
mov rdi, r8
jne 0x659960
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
test rcx, rcx
je 0x6599f8
test rdx, rdx
je 0x6599b8
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], r8
call fcn.005cd300
test rax, rax
jne 0x6599e0
lea rdx, [0x0076b3d8]
sub rdx, rbx
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x6599a7
inc rbx
test eax, eax
jne 0x659995
test ecx, ecx
jne 0x6599b8
mov rcx, rdi
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x659a00
mov rcx, qword [rsi + 0x10]
lea rax, str.default
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdi
call fcn.005cd300
test rax, rax
je 0x65994a
mov rax, qword [rax + 0x10]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
mov rcx, r8
call sub.msvcrt.dll_getenv
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x67b750
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xe8
call fcn.00693bc0
sub rsp, rax
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0xb0], rax
test r8, r8
mov qword [rsp + 0xe0], rbp
mov rbp, rdx
je 0x67b93f
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xc0], r13
lea rsi, [r8 - 1]
mov qword [rsp + 0x108], rbx
lea r12, [rcx + 0xc]
shr rsi, 3
lea r13, [rcx + 0x14]
mov qword [rsp + 0xd0], rdi
inc rsi
nop
nop
movzx eax, byte [rbp + 1]
movzx ebx, byte [rbp]
movzx edi, byte [rbp + 4]
shl eax, 8
mov rcx, r12
add rbp, 8
or ebx, eax
movzx eax, byte [rbp - 6]
shl eax, 0x10
or ebx, eax
movzx eax, byte [rbp - 5]
shl eax, 0x18
or ebx, eax
movzx eax, byte [rbp - 3]
shl eax, 8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
or edi, eax
movzx eax, byte [rbp - 2]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbp - 1]
and byte [r12], 0xdf
and byte [r13], 0xbf
or byte [r12], 0x40
or byte [r13], 0x20
shl eax, 0x18
or edi, eax
mov dword [rsp + 0x2c], edi
mov dword [rsp + 0x24], edi
call fcn.005ca8c0
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.005ca980
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.0061e7e0
mov rcx, r13
call fcn.005ca8c0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.005ca980
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
mov r8d, 1
call fcn.0061e7e0
mov r11d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2c]
xor r11d, ebx
xor ebx, dword [rsp + 0x20]
xor edx, edi
xor edi, dword [rsp + 0x24]
mov byte [r12], bl
mov eax, ebx
shr eax, 8
mov byte [r12 + 1], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
mov byte [r12 + 2], al
mov byte [r12 + 3], bl
mov byte [r12 + 4], dl
mov eax, edx
shr eax, 8
mov byte [r12 + 5], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
mov byte [r12 + 6], al
mov byte [r12 + 7], dl
mov byte [r13], r11b
mov eax, r11d
shr eax, 8
mov byte [r13 + 1], al
mov eax, r11d
shr eax, 0x10
shr r11d, 0x18
mov byte [r13 + 2], al
mov byte [r13 + 3], r11b
mov byte [r13 + 4], dil
mov eax, edi
shr eax, 8
mov byte [r13 + 5], al
mov eax, edi
shr edi, 0x18
shr eax, 0x10
dec rsi
mov byte [r13 + 6], al
mov byte [r13 + 7], dil
jne 0x67b7c0
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x108]
mov rbp, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xb0]
call fcn.00693b90
add rsp, 0xe8
ret
Function at 0x67e420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x88
call fcn.00693bc0
sub rsp, rax
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rbp
movzx r10d, byte [rax]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
lea rdi, [rax + 1]
mov esi, r8d
movzx eax, byte [rdi]
movzx r8d, byte [rdi + 3]
shl r10d, 0x18
shl eax, 0x10
mov qword [rsp + 0x60], r12
mov rbp, rcx
movzx ecx, byte [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 1]
shl eax, 8
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rsp + 0x58], r13
or r10d, eax
movzx eax, byte [rdi + 4]
mov r12, rdx
shl eax, 0x10
lea rdx, [rdi + 5]
mov qword [rsp + 0x50], r14
mov r14, qword [rsp + 0xb8]
or r8d, eax
movzx eax, byte [rdx + 1]
mov ebx, dword [r14]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
xor r13d, r13d
mov byte [rsp + 0x30], al
mov eax, r10d
mov qword [rsp + 0x48], r15
shr eax, 0x10
mov r15, r9
mov dword [rsp + 0x20], r10d
mov byte [rsp + 0x31], al
mov eax, r10d
mov dword [rsp + 0x24], r8d
shr eax, 8
mov byte [rsp + 0x33], r10b
mov byte [rsp + 0x37], r8b
mov byte [rsp + 0x32], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x34], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x35], al
mov eax, r8d
shr eax, 8
test esi, esi
mov byte [rsp + 0x36], al
je 0x67e60a
movzx edx, r8b
movzx r9d, r10b
dec esi
test ebx, ebx
jne 0x67e5a4
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.0067d0b0
mov r10d, dword [rsp + 0x20]
mov r8d, dword [rsp + 0x24]
mov eax, r10d
mov r9b, r10b
mov byte [rsp + 0x33], r10b
shr eax, 0x18
mov dl, r8b
mov byte [rsp + 0x37], r8b
mov byte [rsp + 0x30], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x32], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x34], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x35], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rsp + 0x36], al
movsxd rax, ebx
inc r12
inc rbp
movzx ecx, byte [rsp + rax + 0x30]
xor cl, byte [rbp - 1]
inc ebx
mov byte [r12 - 1], cl
and ebx, 7
test esi, esi
jne 0x67e538
test r13d, r13d
je 0x67e60a
mov rcx, qword [rsp + 0x28]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov r15, qword [rsp + 0x48]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov dword [r14], ebx
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
call fcn.00693b90
add rsp, 0x88
ret
Function at 0x680cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x88
call fcn.00693bc0
sub rsp, rax
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rbp
movzx r10d, byte [rax]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
lea rdi, [rax + 1]
mov esi, r8d
movzx eax, byte [rdi]
movzx r8d, byte [rdi + 3]
shl r10d, 0x18
shl eax, 0x10
mov qword [rsp + 0x60], r12
mov rbp, rcx
movzx ecx, byte [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 1]
shl eax, 8
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rsp + 0x58], r13
or r10d, eax
movzx eax, byte [rdi + 4]
mov r12, rdx
shl eax, 0x10
lea rdx, [rdi + 5]
mov qword [rsp + 0x50], r14
mov r14, qword [rsp + 0xb8]
or r8d, eax
movzx eax, byte [rdx + 1]
mov ebx, dword [r14]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
xor r13d, r13d
mov byte [rsp + 0x30], al
mov eax, r10d
mov qword [rsp + 0x48], r15
shr eax, 0x10
mov r15, r9
mov dword [rsp + 0x20], r10d
mov byte [rsp + 0x31], al
mov eax, r10d
mov dword [rsp + 0x24], r8d
shr eax, 8
mov byte [rsp + 0x33], r10b
mov byte [rsp + 0x37], r8b
mov byte [rsp + 0x32], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x34], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x35], al
mov eax, r8d
shr eax, 8
test esi, esi
mov byte [rsp + 0x36], al
je 0x680eda
movzx edx, r8b
movzx r9d, r10b
dec esi
test ebx, ebx
jne 0x680e74
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.0067fb60
mov r10d, dword [rsp + 0x20]
mov r8d, dword [rsp + 0x24]
mov eax, r10d
mov r9b, r10b
mov byte [rsp + 0x33], r10b
shr eax, 0x18
mov dl, r8b
mov byte [rsp + 0x37], r8b
mov byte [rsp + 0x30], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x32], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x34], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x35], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rsp + 0x36], al
movsxd rax, ebx
inc r12
inc rbp
movzx ecx, byte [rsp + rax + 0x30]
xor cl, byte [rbp - 1]
inc ebx
mov byte [r12 - 1], cl
and ebx, 7
test esi, esi
jne 0x680e08
test r13d, r13d
je 0x680eda
mov rcx, qword [rsp + 0x28]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov r15, qword [rsp + 0x48]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov dword [r14], ebx
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
call fcn.00693b90
add rsp, 0x88
ret
Function at 0x680f20
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.00693bc0
sub rsp, rax
mov qword [rsp + 0x48], rbx
mov ebx, edx
mov qword [rsp + 0x50], rsi
mov rsi, r8
lea rdx, [0x006d9510]
mov r8d, 0x1048
mov qword [rsp + 0x58], rdi
mov rdi, rcx
call sub.msvcrt.dll_memcpy
mov eax, 0x48
mov rdx, rsi
cmp ebx, eax
cmovg ebx, eax
movsxd r8, ebx
add r8, rsi
xor ebx, ebx
mov r9, rbx
nop
movzx ecx, byte [rdx]
inc rdx
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
xor dword [rdi + r9*4], ecx
inc r9
cmp r9, 0x12
jl 0x680f70
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x24], ebx
mov rsi, rbx
nop
nop
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.0067fb60
mov eax, dword [rsp + 0x20]
add rsi, 2
cmp rsi, 0x12
mov dword [rdi + rsi*4 - 8], eax
mov eax, dword [rsp + 0x24]
mov dword [rdi + rsi*4 - 4], eax
jl 0x680fd0
mov rsi, qword [rsp + 0x50]
nop
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.0067fb60
mov eax, dword [rsp + 0x20]
add rbx, 2
cmp rbx, 0x400
mov dword [rdi + rbx*4 + 0x40], eax
mov eax, dword [rsp + 0x24]
mov dword [rdi + rbx*4 + 0x44], eax
jl 0x681000
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x691680
Capabilities:
Parse pe header
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [0x00400000], 0x5a4d
je 0x6916bc
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x00400000]
jmp 0x69174a
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x6916e0
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x69174a
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x691727
cmp ecx, 0x20b
je 0x6916ff
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x69174a
cmp dword [rax + 0x84], 0xe
ja 0x691713
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x69174a
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x69174a
cmp dword [rax + 0x74], 0xe
ja 0x691738
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x69174a
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x00775ff8], 0xffffffffffffffff
mov qword [0x00776000], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x00775fd4]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x00775fd0]
mov dword [rcx], eax
call fcn.00691f20
cmp dword [reloc.WS2_32.dll_accept], 0
jne 0x6917a4
lea rcx, [0x00691f10]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x00696428]
lea rcx, [0x00696420]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x00775fcc]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x00775fc8]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___wgetmainargs]
lea rdx, [0x00696418]
lea rcx, [0x006963b0]
call sub.msvcrt.dll__initterm
mov r8, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [r8], 0
jne 0x691819
mov eax, 0xff
jmp 0x6918e9
mov r8, qword [r8]
mov qword [rsp + 0x30], r8
cmp word [r8], 0x22
jne 0x691860
nop
nop
add r8, 2
mov qword [rsp + 0x30], r8
movzx eax, word [r8]
test ax, ax
je 0x69184a
cmp ax, 0x22
je 0x69184a
jmp 0x691830
cmp word [r8], 0x22
jne 0x691872
add r8, 2
mov qword [rsp + 0x30], r8
jmp 0x691872
cmp word [r8], 0x20
jbe 0x691872
add r8, 2
mov qword [rsp + 0x30], r8
jmp 0x691860
movzx eax, word [r8]
test ax, ax
je 0x69188c
cmp ax, 0x20
ja 0x69188c
add r8, 2
mov qword [rsp + 0x30], r8
jmp 0x691872
test byte [rsp + 0x8c], 1
je 0x6918a1
movzx r9d, word [rsp + 0x90]
jmp 0x6918a7
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.00693ab8
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x6918c3
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x6918e7
mov eax, edi
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x140756058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407561df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140756089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14075606f
add dl, dl
jne 0x140756096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407560f6
xor eax, eax
add dl, dl
jne 0x1407560a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407561ad
add dl, dl
jne 0x1407560b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407560c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407560d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407560dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407560ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14075607e
mov eax, 1
add dl, dl
jne 0x140756106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140756113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407560fb
sub eax, ebx
mov ebx, 1
jne 0x14075614c
mov ecx, 1
add dl, dl
jne 0x14075612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14075613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140756123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140756168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140756175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14075615d
cmp eax, 0x7d00
jae 0x14075619b
cmp eax, 0x500
jb 0x140756196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075607e
cmp eax, 0x7f
ja 0x14075619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407561d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14075607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1416b4058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1416b41df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1416b4089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416b406f
add dl, dl
jne 0x1416b4096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416b40f6
xor eax, eax
add dl, dl
jne 0x1416b40a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416b41ad
add dl, dl
jne 0x1416b40b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416b40c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416b40d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416b40dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1416b40ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1416b407e
mov eax, 1
add dl, dl
jne 0x1416b4106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416b4113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416b40fb
sub eax, ebx
mov ebx, 1
jne 0x1416b414c
mov ecx, 1
add dl, dl
jne 0x1416b412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1416b413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416b4123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1416b407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1416b4168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1416b4175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416b415d
cmp eax, 0x7d00
jae 0x1416b419b
cmp eax, 0x500
jb 0x1416b4196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1416b407e
cmp eax, 0x7f
ja 0x1416b419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1416b407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1416b41d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1416b407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400017d0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetControlCMFConfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000183c
mov rcx, qword [rsp + 0x40]
lea rdx, str.SYSTEM_LP
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, 1
add rsp, 0x38
ret

Function at 0x140001850
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rbx
sub rsp, 0x30
mov dword [rax - 0x10], 1
lea rdx, [rax + 0x20]
xor ebx, ebx
mov dword [rax - 0x18], 1
lea rcx, [rax + 0x10]
mov qword [rax + 0x10], rbx
call fcn.140001900
test eax, eax
je 0x1400018ec
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEM
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400018d6
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
nop dword [rax + rax]
test eax, eax
jne 0x1400018d6
lea ebx, [rax + 1]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400018ec
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140003b0e
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
je 0x140002670
jmp 0x140006c5b
mov rcx, qword [rsp + 0x70]
call fcn.140007331
jmp 0x140004cca
test eax, eax
jne 0x1400058c9
jmp 0x140005419
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x140006c5b
jmp 0x140002670
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140004e76
jmp 0x1400058c9
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x140003b77
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
jmp 0x140003852
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call fcn.1400082a6
jmp 0x140002ebe
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x14000245e
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x1400034c2
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
sub rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x30], rax
jne 0x140003852
jmp 0x1400034c2
jmp 0x140003823
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
cmp eax, 0x5c
je 0x140008af0
jmp 0x140006763
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x38], rax
jmp 0x140003823