joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b82a
Capabilities:
Hash data using sha1 via x86 extensions

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm9, xmmword [rcx]
movdqa xmm8, xmmword [rcx + 0x10]
movdqa xmm6, xmmword [0x1400781d0]
movdqu xmm5, xmmword [rdx]
movdqu xmm4, xmmword [rdx + 0x10]
movdqu xmm3, xmmword [rdx + 0x20]
movdqu xmm2, xmmword [rdx + 0x30]
pshufb xmm5, xmm6
movdqa xmm7, xmm8
paddd xmm7, xmm5
movdqa xmm1, xmm9
sha1rnds4 xmm1, xmm7, 0
pshufb xmm4, xmm6
movdqa xmm7, xmm9
sha1nexte xmm7, xmm4
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm7, 0
sha1msg1 xmm5, xmm4
pshufb xmm3, xmm6
sha1nexte xmm1, xmm3
movaps xmm7, xmm0
sha1rnds4 xmm7, xmm1, 0
sha1msg1 xmm4, xmm3
pshufb xmm2, xmm6
sha1nexte xmm0, xmm2
pxor xmm5, xmm3
sha1msg2 xmm5, xmm2
movaps xmm1, xmm7
sha1rnds4 xmm1, xmm0, 0
sha1msg1 xmm3, xmm2
sha1nexte xmm7, xmm5
pxor xmm4, xmm2
sha1msg2 xmm4, xmm5
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm7, 0
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm1, xmm4
sha1msg2 xmm3, xmm4
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 1
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm0, xmm3
sha1msg2 xmm2, xmm3
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 1
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm6, xmm2
sha1msg2 xmm5, xmm2
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 1
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm1, xmm5
sha1msg2 xmm4, xmm5
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 1
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm0, xmm4
sha1msg2 xmm3, xmm4
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 1
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm6, xmm3
sha1msg2 xmm2, xmm3
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 2
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm1, xmm2
sha1msg2 xmm5, xmm2
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 2
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm0, xmm5
sha1msg2 xmm4, xmm5
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 2
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm6, xmm4
sha1msg2 xmm3, xmm4
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 2
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm1, xmm3
sha1msg2 xmm2, xmm3
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 2
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm0, xmm2
sha1msg2 xmm5, xmm2
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 3
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm6, xmm5
sha1msg2 xmm4, xmm5
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 3
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm1, xmm4
sha1msg2 xmm3, xmm4
movaps xmm5, xmm0
sha1rnds4 xmm5, xmm1, 3
xorps xmm2, xmm4
sha1nexte xmm0, xmm3
sha1msg2 xmm2, xmm3
movaps xmm1, xmm5
sha1rnds4 xmm1, xmm0, 3
sha1nexte xmm5, xmm2
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm5, 3
paddd xmm0, xmm9
movdqa xmmword [rcx], xmm0
sha1nexte xmm1, xmm8
movaps xmmword [rcx + 0x10], xmm1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140044c32
Capabilities:
Encode data using base64

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x14009b0a0]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor esi, esi
movsx r8d, byte [rcx + rsi]
mov eax, r8d
add al, 0xbf
cmp al, 0x19
ja 0x140044c5c
add r8d, 0xffffffbf
jmp 0x140044ca6
mov eax, r8d
add al, 0x9f
cmp al, 0x19
ja 0x140044c6b
add r8d, 0xffffffb9
jmp 0x140044ca6
mov eax, r8d
add al, 0xd0
cmp al, 9
ja 0x140044c7a
add r8d, 4
jmp 0x140044ca6
cmp r8b, 0x2b
je 0x140044c98
cmp r8b, 0x3d
je 0x140044ca0
cmp r8b, 0x2f
jne 0x140044d48
mov r8d, 0x3f
jmp 0x140044ca6
mov r8d, 0x3e
jmp 0x140044ca6
mov r8d, 0xffffffff
mov dword [rsp + rsi*4 + 0x20], r8d
inc rsi
cmp rsi, 4
jb 0x140044c48
mov eax, dword [rsp + 0x20]
xor esi, esi
cmp eax, 0xffffffff
je 0x140044d4a
mov ecx, dword [rsp + 0x24]
cmp ecx, 0xffffffff
je 0x140044d4a
mov r8d, dword [rsp + 0x28]
mov r9d, dword [rsp + 0x2c]
cmp r8d, 0xffffffff
je 0x140044cf0
mov r10d, 3
cmp r9d, 0xffffffff
jne 0x140044d02
mov r10d, 2
jmp 0x140044cfc
cmp r9d, 0xffffffff
jne 0x140044d4a
mov r10d, 1
mov r9d, 0xffffffff
shl eax, 0x12
shl ecx, 0xc
or eax, ecx
shr eax, 0x10
mov byte [rdx], al
mov esi, 1
cmp r10d, 2
jb 0x140044d4a
shl r8d, 6
mov eax, r8d
and eax, 0xf00
or eax, ecx
mov byte [rdx + 1], ah
mov esi, 2
cmp r10d, 3
jne 0x140044d4a
and r9d, 0x3f
or r9d, r8d
mov byte [rdx + 2], r9b
mov esi, 3
jmp 0x140044d4a
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140050a10
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x140045099
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400450cb
xor r10d, r10d
xor r9d, r9d
mov al, byte [rdx + r10]
xor al, byte [rcx + r10]
movzx eax, al
or r9d, eax
inc r10
cmp r8, r10
jne 0x1400450a4
mov eax, 0x100
sub eax, r9d
cmp eax, 0xff
seta al
ret
mov al, 1
ret
Function at 0x14004803c
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14009b0a0]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [0x14009bf00], 0
je 0x140048063
mov rsi, qword [0x14009bef8]
jmp 0x1400480a8
lea rcx, str.secur32.dll
call fcn.140048177
mov rsi, rax
lea rcx, str.sspicli.dll
call fcn.140048177
test rsi, rsi
je 0x140048098
lea rdx, str.GetUserNameExA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
jmp 0x14004809a
xor esi, esi
mov qword [0x14009bef8], rsi
mov byte [0x14009bf00], 1
test rsi, rsi
je 0x14004810a
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov ecx, 8
xor edx, edx
mov r8, rdi
call rsi
mov ecx, dword [rdi]
mov edx, 1
xor r8d, r8d
call fcn.140008510
mov rsi, rax
mov ecx, 8
mov rdx, rax
mov r8, rdi
call qword [0x14009bef8]
test al, al
je 0x140048102
mov edx, 0x40
mov rcx, rsi
call fcn.1400520b0
test rax, rax
je 0x140048160
mov byte [rax], 0
jmp 0x140048160
mov rcx, rsi
call fcn.14000859b
lea rdx, [rsp + 0x2c]
mov dword [rdx], 0
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x140048127
mov ecx, dword [rsp + 0x2c]
jmp 0x140048134
mov dword [rsp + 0x2c], 0x100
mov ecx, 0x100
mov edx, 1
xor r8d, r8d
call fcn.140008510
mov rsi, rax
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x140048160
mov rcx, rsi
call fcn.14000859b
xor esi, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140050a10
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140048177
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp qword [0x14009bf28], 0
jne 0x1400481f4
mov edx, dword [0x14009bf30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r9d, eax
cmp qword [0x14009bf30], r9
ja 0x1400481f4
lea rdi, [0x14009bf30]
mov rbx, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov rcx, qword [0x14009bf28]
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
mov r8d, 1
mov rdx, rdi
call fcn.1400085a5
mov qword [0x14009bf28], rax
mov edx, dword [0x14009bf30]
mov rcx, rax
call rbx
mov r9d, eax
cmp qword [0x14009bf30], r9
jbe 0x1400481b3
mov rcx, qword [0x14009bf28]
lea rdx, [0x14008bdde]
xor r9d, r9d
mov r8, rsi
call fcn.1400445d0
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
mov rcx, rsi
call fcn.14000859b
mov rax, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14004ae9e
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2a8
mov r14, rcx
mov rax, qword [0x14009b0a0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea rdi, [rsp + 0x50]
mov edx, 0x107
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov rcx, rdi
call fcn.140061f30
mov byte [rsp + rax + 0x52], 0
mov word [rsp + rax + 0x50], 0x2a5c
lea rdx, [rsp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x14004af2f
mov rdi, rax
lea rbx, [rsp + 0x160]
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edx, 0x140
mov rcx, rbx
call r14
mov rcx, rdi
mov rdx, rbx
call rsi
test eax, eax
jne 0x14004af0f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x2c]
mov dword [rcx], eax
mov edx, 4
call r14
lea rcx, [rsp + 0x30]
mov edx, 0x20
call fcn.14004ad58
test al, al
je 0x14004af74
lea rdi, [rsp + 0x30]
mov edx, 0x20
mov rcx, rdi
call r14
mov edx, 0x20
mov rcx, rdi
call fcn.14004857c
mov rcx, r14
call fcn.14004eaa0
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140050a10
nop
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14004af9a
Capabilities:
Get memory capacity

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rax, qword [0x14009b0a0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rsi, [rsp + 0x78]
mov qword [rsi], rax
mov ecx, 9
mov r8d, 8
mov rdx, rsi
call fcn.140038024
call qword [sym.imp.USER32.dll_GetCapture]
mov qword [rsi], rax
mov ecx, 0xa
mov r8d, 8
mov rdx, rsi
call fcn.140038024
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov qword [rsi], rax
mov ecx, 0xb
mov r8d, 8
mov rdx, rsi
call fcn.140038024
mov ecx, 0x1cbf
call qword [sym.imp.USER32.dll_GetQueueStatus]
lea rdx, [rsp + 0x74]
mov dword [rdx], eax
mov ecx, 0xc
mov r8d, 4
call fcn.140038024
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0xd
mov r8d, 8
mov rdx, rsi
call fcn.140038024
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, 6
mov r8d, 0x38
mov rdx, rsi
call fcn.140038024
lea rsi, [rsp + 0x98]
lea r14, [rsp + 0x90]
lea rdi, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x20], rsi
lea rbx, [rsp + 0x80]
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov ecx, 0xe
mov r8d, 0x20
mov rdx, rbx
call fcn.140038024
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov ecx, 0xf
mov r8d, 0x20
mov rdx, rbx
call fcn.140038024
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140050a10
nop
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14004b1d8
Capabilities:
Compare security identifiers

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x14009b0a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rdx, str..pipe_
mov r8d, 9
call fcn.140061ff0
test eax, eax
je 0x14004b229
lea rcx, str.strncmp_pipename___.pipe___9___0
lea rdx, str..._windows_winnpc.c
mov r8d, 0x18
call fcn.14005e2f0
lea rcx, [rdi + 9]
mov edx, 0x5c
call fcn.1400520b0
test rax, rax
je 0x14004b255
lea rcx, str.strchr_pipename__9_____NULL
lea rdx, str..._windows_winnpc.c
mov r8d, 0x19
call fcn.14005e2f0
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
mov rcx, rdi
call rsi
cmp rax, 0xffffffffffffffff
jne 0x14004b2cc
call r15
cmp eax, 0xe7
jne 0x14004b33b
xor edx, edx
mov rcx, rdi
call r12
test eax, eax
jne 0x14004b26a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140048290
lea rdx, str.Error_waiting_for_named_pipe__s:__s
jmp 0x14004b34f
mov rbx, rax
call fcn.14004d258
test rax, rax
je 0x14004b35f
mov rsi, rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x48]
mov edx, 6
mov r8d, 1
mov rcx, rbx
call qword [0x14009c870]
test eax, eax
je 0x14004b3a8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140048290
lea rdx, str.Unable_to_get_named_pipe_security_information:__s
jmp 0x14004b37c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140048290
lea rdx, str.Unable_to_open_named_pipe__s:__s
mov rcx, r14
mov r8, rdi
mov r9, rax
call fcn.140006384
jmp 0x14004b387
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140048290
lea rdx, str.Unable_to_get_user_SID:__s
mov rcx, r14
mov r8, rax
call fcn.140006384
mov rsi, rax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140050a10
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x14004b3dd
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [rsp + 0x20], 1
xor r8d, r8d
mov rcx, rbx
mov rdx, rbx
mov r9, r14
call fcn.140047a1c
jmp 0x14004b387
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, str.Owner_of_named_pipe__s_is_not_us
mov rcx, r14
mov r8, rdi
jmp 0x14004b382
Function at 0x14004b559
Capabilities:
Create pipe

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x14009b0a0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
movaps xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov dword [rax], 0x18
mov rcx, qword [rcx]
mov qword [rax + 8], rcx
xor ebx, ebx
mov dword [rax + 0x10], ebx
movzx edx, dl
shl edx, 0x13
or edx, 0x40000003
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov eax, 0x1000
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov r8d, 8
mov r9d, 0xff
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rsi + 0x18], rax
cmp rax, 0xffffffffffffffff
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140050a10
mov eax, ebx
add rsp, 0x68
pop rbx
pop rsi
ret

Function at 0x14004b5f6
Capabilities:
Connect pipe

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov edi, edx
mov rsi, rcx
lea rbx, [rcx + 0x20]
mov r15, qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [0x14004b778]
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, 1
jne 0x14004b654
mov rcx, qword [rsi + 0x18]
mov rdx, rbx
call r15
test eax, eax
jne 0x14004b656
call r12
test eax, eax
je 0x14004b656
mov ebp, eax
cmp eax, 0x217
je 0x14004b656
jmp 0x14004b6e1
xor edi, edi
mov rbp, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x48]
mov rax, qword [rcx]
mov rdx, r14
mov r8, rbp
call qword [rax + 0x20]
test eax, eax
je 0x14004b674
mov rcx, rbp
call r13
xor edx, edx
mov rcx, rsi
call fcn.14004b559
test al, al
jne 0x14004b62b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, ebp
call fcn.140048290
lea rcx, str.Error_while_listening_to_named_pipe:__s
mov rdx, rax
call fcn.14004451d
mov rdi, rax
mov rcx, qword [rsi + 0x10]
call fcn.14004939b
mov rcx, qword [rsi + 0x48]
mov rbx, qword [rcx]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdi
mov edx, 1
xor r9d, r9d
mov r8, rax
call qword [rbx]
mov rcx, rdi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14000859b
cmp ebp, 0x3e5
jne 0x14004b68a
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14004e3e3
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x14009b0a0]
xor rax, rsp
mov qword [rsp + 0x38], rax
test rcx, rcx
je 0x14004e4bb
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rcx]
lea r15, [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
xor esi, esi
lea r9, [rsp + 0x34]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14004e4bd
cmp dword [rsp + 0x34], 1
jne 0x14004e4bd
mov r14d, dword [rsp + 0x30]
inc r14d
mov edx, 1
xor r8d, r8d
mov rcx, r14
call fcn.140008510
mov rsi, rax
mov rcx, qword [rbx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14004e4b3
cmp dword [rsp + 0x34], 1
jne 0x14004e4b3
mov eax, dword [rsp + 0x30]
cmp eax, r14d
jb 0x14004e4ab
lea rcx, str.size___allocsize
lea rdx, str..._windows_winstore.c
mov r8d, 0x92
call fcn.14005e2f0
mov eax, dword [rsp + 0x30]
mov eax, eax
mov byte [rsi + rax], 0
jmp 0x14004e4bd
mov rcx, rsi
call fcn.14000859b
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140050a10
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14004e4d9
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov esi, r8d
mov rax, qword [0x14009b0a0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x3c], 4
test rcx, rcx
je 0x14004e53c
mov rcx, qword [rcx]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14004e53c
mov eax, dword [rsp + 0x3c]
xor eax, 4
mov ecx, dword [rsp + 0x44]
xor ecx, 4
or ecx, eax
jne 0x14004e53c
mov esi, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140050a10
mov eax, esi
add rsp, 0x50
pop rsi
ret

Function at 0x14004eaa0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x440
mov rsi, rcx
mov rax, qword [0x14009b0a0]
xor rax, rsp
mov qword [rsp + 0x438], rax
mov ecx, 1
call fcn.14004eb6a
cmp rax, 0xffffffffffffffff
je 0x14004eb4a
mov rdi, rax
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004eb41
mov edx, dword [rsp + 0x2c]
test edx, edx
je 0x14004eb41
lea rbx, [rsp + 0x30]
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call rsi
mov qword [rsp + 0x20], 0
mov r8d, 0x400
mov rcx, rdi
mov rdx, rbx
mov r9, r14
call r15
test eax, eax
je 0x14004eb41
mov edx, dword [rsp + 0x2c]
test edx, edx
jne 0x14004eb15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x438]
xor rcx, rsp
call fcn.140050a10
nop
add rsp, 0x440
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14004ee3c
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
mov rdi, rcx
mov rax, qword [0x14009b0a0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 2
call fcn.14004eb6a
cmp rax, 0xffffffffffffffff
je 0x14004ee90
mov rbx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rcx, rax
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140050a10
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x14004eea6
Capabilities:
Check if file exists
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, r8
mov rdi, rcx
test edx, edx
je 0x14004ef05
xor eax, eax
xor ecx, ecx
cmp edx, 2
setne al
sete cl
lea r8d, [rax + rax*2]
mov eax, 0x40000000
mov edx, 0x80000000
cmove edx, eax
mov eax, ecx
shl eax, 7
xor ecx, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
setne al
jmp 0x14004ef45
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14004ef3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14004ef3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140048290
lea rcx, str.Unable_to_delete__s:__s
mov rdx, rdi
mov r8, rax
call fcn.140045722
mov qword [rsi], 0xffffffffffffffff
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x14005b970
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14005bab8
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14005bb28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005bb28
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005bb28
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005bb28
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005bb28
cmp dword [rcx + 0x84], 0xe
jbe 0x14005bb28
cmp dword [rcx + 0xf8], esi
je 0x14005bb28
mov ecx, r14d
call fcn.14005b9f4
mov ecx, 2
call fcn.1400649d0
nop
cmp byte [0x14009cf7c], 0
jne 0x14005bbf2
mov r15d, 1
mov eax, r15d
xchg dword [0x14009cf78], eax
test ebx, ebx
jne 0x14005bb9b
mov rdi, qword [0x14009b0a0]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14009cf70]
cmp rcx, rax
je 0x14005bb92
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [section..00cfg]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14009d098]
jmp 0x14005bba7
cmp ebx, r15d
jne 0x14005bbad
lea rcx, [0x14009d0b0]
call fcn.14005d34c
nop
test ebx, ebx
jne 0x14005bbc4
lea rdx, [0x140096d10]
lea rcx, [0x140096cf0]
call fcn.14005daec
lea rdx, [0x140096d20]
lea rcx, [0x140096d18]
call fcn.14005daec
movzx eax, byte [0x14009cf7c]
test esi, esi
cmove eax, r15d
mov byte [0x14009cf7c], al
jmp 0x14005bbf2
mov ecx, 2
call fcn.1400649ec
test esi, esi
jne 0x14005bc09
mov ecx, r14d
call fcn.14005ba60
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x140061f30
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x140061f4d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140061fa8
test al, 7
jne 0x140061f40
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140061f61
mov rdx, qword [rax - 8]
test dl, dl
je 0x140061fd2
test dh, dh
je 0x140061fcc
shr rdx, 0x10
test dl, dl
je 0x140061fc6
test dh, dh
je 0x140061fc0
shr rdx, 0x10
test dl, dl
je 0x140061fba
test dh, dh
je 0x140061fb4
shr edx, 0x10
test dl, dl
je 0x140061fae
test dh, dh
jne 0x140061f61
lea rax, [rcx + rax - 1]
ret
lea rax, [rcx + rax - 2]
ret
lea rax, [rcx + rax - 3]
ret
lea rax, [rcx + rax - 4]
ret
lea rax, [rcx + rax - 5]
ret
lea rax, [rcx + rax - 6]
ret
lea rax, [rcx + rax - 7]
ret
lea rax, [rcx + rax - 8]
ret
Function at 0x14006b088
Capabilities:
Create thread
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.14006464c
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x14006b0db
test rbx, rbx
je 0x14006b0cc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x14006b0db
mov edi, 4
jmp 0x14006b184
call fcn.14006445c
test al, al
jne 0x14006b0f8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x14006b184
test bpl, bpl
je 0x14006b15b
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x14006b1a4]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14006b184
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x14006b155
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14006b184
mov edi, dword [rsp + 0x44]
jmp 0x14006b14d
call fcn.140064578
test al, al
jne 0x14006b16c
bts esi, 0x15
xor ecx, ecx
jmp 0x14006b174
call fcn.1400644e8
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.1400643d4
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret