joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015bd0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140021578], 0
jne 0x140015cb2
lea rcx, str.psapi.dll
call fcn.14000ab14
test rax, rax
mov rbx, rax
je 0x140015cb2
lea rdx, str.GetModuleBaseNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140020bd8], rax
je 0x140015c9f
lea rdx, str.EnumProcessModules
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140020bc8], rax
je 0x140015c9f
lea rdx, str.GetModuleFileNameExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140020bb8], rax
je 0x140015c9f
lea rdx, str.EnumProcesses
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140020e08], rax
je 0x140015c9f
lea rdx, str.GetModuleInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x140021578]
mov edx, 1
test rax, rax
mov qword [0x140020bd0], rax
cmovne ecx, edx
mov dword [0x140021578], ecx
jmp 0x140015ca5
mov ecx, dword [0x140021578]
test ecx, ecx
jne 0x140015cb2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x20
pop rbx
ret
Function at 0x140016114
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x6c0
mov rdi, rcx
mov rcx, qword [rcx + 0x50]
xor r12d, r12d
cmp rcx, r12
je 0x14001613d
call sub.msvcrt.dll_free
xor edx, edx
mov qword [rdi + 0x50], r12
mov dword [rdi + 0x60], r12d
lea ecx, [rdx + 2]
mov dword [rdi + 0x58], r12d
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rcx, [rsp + 0x484]
xor edx, edx
mov r8d, 0x234
mov rbp, rax
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x480]
mov rcx, rbp
mov dword [rsp + 0x480], 0x238
call sub.KERNEL32.dll_Process32FirstW
jmp 0x14001635b
mov r8d, dword [rsp + 0x488]
mov eax, dword [rsp + 0x4a0]
xor edx, edx
mov ecx, 0x410
mov word [rsp + 0x34], r12w
mov dword [rsp + 0x244], r12d
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x240], eax
mov dword [rsp + 0x248], r12d
mov dword [rsp + 0x24c], r12d
mov dword [rsp + 0x250], r12d
mov dword [rsp + 0x254], r12d
mov dword [rsp + 0x258], r12d
mov dword [rsp + 0x25c], r12d
mov dword [rsp + 0x260], r12d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, r12
mov rbx, rax
jne 0x14001622e
call fcn.14000a2c4
cmp dword [rax + 4], 5
jbe 0x14001634d
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, r12
mov rbx, rax
je 0x14001634d
lea rcx, [rsp + 0x272]
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x270], r12w
call sub.msvcrt.dll_memset
mov rcx, rdi
call fcn.140016398
mov r11, qword [rdi + 0x28]
cmp r11, r12
je 0x140016273
lea r8, [rsp + 0x270]
mov r9d, 0x104
xor edx, edx
mov rcx, rbx
call r11
movzx eax, word [rsp + 0x270]
cmp ax, r12w
je 0x140016287
cmp ax, 0x3f
jne 0x1400162f3
cmp dword [0x140021fa4], r12d
mov dword [rsp + 0x6e0], 0x104
jne 0x1400162d0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, r12
je 0x1400162d0
lea rdx, str.QueryFullProcessImageNameW
mov rcx, rax
mov dword [0x140021fa4], 1
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140021fa8], rax
jmp 0x1400162d7
mov rax, qword [0x140021fa8]
cmp rax, r12
je 0x1400162f3
lea r9, [rsp + 0x6e0]
lea r8, [rsp + 0x270]
xor edx, edx
mov rcx, rbx
call rax
cmp word [rsp + 0x272], 0x3a
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x34]
jne 0x140016312
call fcn.14001916a
jmp 0x140016317
call fcn.140015cb8
lea rax, [rsp + 0x25c]
lea r9, [rsp + 0x254]
lea r8, [rsp + 0x24c]
lea rdx, [rsp + 0x244]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140016074
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x30]
lea rcx, [rdi + 0x50]
call fcn.140016438
lea rdx, [rsp + 0x480]
mov rcx, rbp
call sub.KERNEL32.dll_Process32NextW
cmp eax, r12d
jne 0x14001618b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140016398
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
jne 0x140016432
lea rcx, str.psapi.dll
call fcn.14000ab14
lea rdx, str.GetModuleBaseNameW
mov rcx, rax
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.EnumProcessModules
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.EnumProcessModulesEx
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.GetModuleFileNameExW
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.EnumProcesses
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.GetModuleInformation
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x20], rax
add rsp, 0x20
pop rbx
ret

Function at 0x140017140
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rsi
push rdi
mov eax, 0x20030
call fcn.140019520
sub rsp, rax
test ecx, ecx
mov r10, r9
mov rdi, r8
mov rsi, rdx
je 0x1400171ca
cmp qword [rsp + 0x20060], 0
je 0x1400171ac
mov rcx, qword [rsp + 0x20060]
mov dx, 0x22
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x1400171ac
mov r9, qword [rsp + 0x20060]
and word [rsp + 0x30], 0
lea r8, str.__s_
lea rcx, [rsp + 0x30]
mov edx, 0xfffe
call sub.msvcrt.dll__snwprintf
lea r8, [rsp + 0x30]
jmp 0x1400171b4
mov r8, qword [rsp + 0x20060]
mov r9, qword [rsp + 0x20070]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x1400171f9
mov rax, qword [rsp + 0x20070]
mov r9, qword [rsp + 0x20060]
mov r8, r10
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x20068]
mov rdx, rdi
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rsi, qword [rsp + 0x20040]
add rsp, 0x20030
pop rdi
ret
Function at 0x14001720c
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x4040
call fcn.140019520
sub rsp, rax
mov rsi, rdx
xor edx, edx
mov rdi, r8
test ecx, ecx
mov rbx, r9
lea r8d, [rax - 0x40]
lea rcx, [rsp + 0x32]
je 0x140017280
call sub.msvcrt.dll_memset
mov r11, qword [rsp + 0x4070]
and word [rsp + 0x30], 0
mov edx, dword [r11]
test edx, edx
je 0x140017263
lea r8, [rsp + 0x30]
mov rcx, rbx
call fcn.14000a7f0
mov r9, qword [rsp + 0x4078]
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edi, eax
jmp 0x1400172e6
and word [rsp + 0x30], 0
call sub.msvcrt.dll_memset
mov r11, qword [rsp + 0x4078]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x30]
lea r8, [0x14001a8d0]
mov rdx, rdi
mov rcx, rsi
mov dword [rsp + 0x20], 0x2000
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor edi, edi
lea rcx, [rsp + 0x30]
test eax, eax
setne dil
call sub.msvcrt.dll_wcslen
test eax, eax
je 0x1400172e6
mov rdx, qword [rsp + 0x4070]
lea rcx, [rsp + 0x30]
mov r9d, eax
mov r8, rbx
call fcn.14000a8a8
lea r11, [rsp + 0x4040]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140017300
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x220
test ecx, ecx
mov eax, r9d
mov rdi, r8
mov rsi, rdx
je 0x14001736c
mov rax, qword [rsp + 0x250]
and word [rsp + 0x20], 0
lea rcx, [rsp + 0x22]
mov ebx, dword [rax]
xor edx, edx
mov r8d, 0x1fc
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
mov r8d, 0xa
mov ecx, ebx
call sub.msvcrt.dll__itow
mov r9, qword [rsp + 0x258]
mov rdx, rdi
mov r8, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x14001738d
mov r9, qword [rsp + 0x258]
mov r8d, eax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rcx, qword [rsp + 0x250]
mov dword [rcx], eax
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400173a4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
lea eax, [r9 + r9]
mov rbx, r8
lea r9, [r11 - 0x18]
mov dword [rsp + 0x68], eax
lea rax, [r11 + 0x20]
xor r8d, r8d
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400173ec
cmp dword [rsp + 0x68], 2
jb 0x1400173e8
mov ecx, dword [rsp + 0x68]
shr rcx, 1
and word [rbx + rcx*2], ax
jmp 0x1400173ec
and word [rbx], 0
add rsp, 0x40
pop rbx
ret
Function at 0x1400177d4
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov rdi, rcx
mov rcx, qword [rcx]
cmp rcx, rbp
mov rsi, rdx
mov ebx, ebp
je 0x140017802
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rdi], rbp
xor edx, edx
mov rcx, rsi
call fcn.140009ab0
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x140017866
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov dword [rdi + 8], ecx
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r8d, dword [rdi + 8]
lea r9, [rsp + 0x40]
mov rdx, rax
mov rcx, rsi
mov qword [rdi], rax
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebp
mov ebx, eax
je 0x14001785d
mov rcx, qword [rdi]
cmp dword [rcx], 0x66676572
cmovne ebx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140017f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
cmp qword [rcx], 0
mov rbx, rcx
je 0x140017f99
mov eax, 1
jmp 0x140018034
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rbx], rax
je 0x140018032
xor ecx, ecx
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x20], 0x4e
mov qword [rsp + 0x29], rcx
mov qword [rsp + 0x21], rcx
mov byte [rsp + 0x30], cl
mov word [rsp + 0x31], cx
mov byte [rsp + 0x33], cl
mov rcx, rax
mov byte [rsp + 0x21], 0x74
mov byte [rsp + 0x2b], 0x65
mov byte [rsp + 0x2c], 0x61
mov byte [rsp + 0x26], 0x74
mov byte [rsp + 0x27], 0x65
mov byte [rsp + 0x22], 0x43
mov byte [rsp + 0x2a], 0x72
mov byte [rsp + 0x2d], 0x64
mov byte [rsp + 0x23], 0x72
mov byte [rsp + 0x2e], 0x45
mov byte [rsp + 0x2f], 0x78
mov byte [rsp + 0x24], 0x65
mov byte [rsp + 0x25], 0x61
mov byte [rsp + 0x28], 0x54
mov byte [rsp + 0x29], 0x68
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 8], rax
jmp 0x140017f8f
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x14001803c
Capabilities:
Check os version
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x200
mov rbx, rcx
lea rcx, [rax - 0x128]
mov rsi, rdx
mov dword [rax - 0x128], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0xe4], 6
jb 0x14001816e
mov rcx, rbx
call fcn.140017f80
mov rdi, qword [rbx + 8]
xor ebx, ebx
cmp rdi, rbx
jne 0x140018094
xor eax, eax
jmp 0x1400181a6
xor edx, edx
lea rcx, [rsp + 0x88]
lea r8d, [rdx + 0x40]
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x68]
mov r9, rsi
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0xd0]
xor r8d, r8d
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x80]
mov edx, 0x1fffff
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x230]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x80], 0x48
mov qword [rsp + 0x88], 0x10003
mov qword [rsp + 0x90], InitCommonControls
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xa8], 0x10004
mov qword [rsp + 0xb0], 8
mov qword [rsp + 0x60], rbx
call rdi
cmp eax, ebx
cmove rbx, qword [rsp + 0x60]
mov rax, rbx
jmp 0x1400181a6
mov rax, qword [rsp + 0x248]
mov r9, qword [rsp + 0x230]
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x238]
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140018344
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x280
xor ebx, ebx
mov edi, edx
mov rsi, rcx
cmp qword [0x140021588], rbx
jne 0x140018397
lea rcx, str.shell32.dll
call fcn.14000ab14
cmp rax, rbx
mov qword [0x140021588], rax
je 0x140018397
lea rdx, str.SHGetSpecialFolderPathW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140021580], rax
jmp 0x14001839e
mov rax, qword [0x140021580]
cmp rax, rbx
je 0x1400183d3
call fcn.14000a2c4
cmp dword [rax + 0x10], 1
jne 0x1400183bd
cmp edi, 0x19
je 0x1400183d3
cmp edi, 0x17
je 0x1400183d3
cmp edi, 0x16
je 0x1400183d3
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
xor ecx, ecx
call qword [0x140021580]
jmp 0x14001847a
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], bx
call sub.msvcrt.dll_memset
cmp edi, 0x19
je 0x140018400
cmp edi, 0x17
je 0x140018400
cmp edi, 0x16
mov rcx, 0xffffffff80000001
jne 0x140018407
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x2a0]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x140018465
lea rdx, [rsp + 0x30]
mov ecx, edi
call fcn.140018298
mov rcx, qword [rsp + 0x2a0]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x30]
mov r9d, 0x104
call fcn.1400173a4
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.14001916a
cmp word [rsi], bx
setne bl
mov eax, ebx
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140018e90
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rdi, rcx
lea rbp, [rcx + 0x18]
xor ecx, ecx
mov word [rbp], cx
mov word [rdi + 0xa18], cx
mov word [rdi + 0xc18], cx
mov word [rdi + 0xe18], cx
lea r12, [rdi + 0x218]
lea r13, [rdi + 0x418]
mov word [r12], cx
mov word [r13], cx
lea r14, [rdi + 0x618]
mov word [r14], cx
lea r15, [rdi + 0x818]
mov rbx, rdx
mov word [r15], cx
mov ecx, r8d
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r8d, dword [rsp + 0x2b0]
xor edx, edx
mov r9, rax
mov rcx, rbx
mov rsi, rax
call sub.VERSION.dll_GetFileVersionInfoW
lea r9, [rsp + 0x2b0]
lea r8, [rsp + 0x2a0]
lea rdx, [0x14001b178]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140018f6d
mov rcx, qword [rsp + 0x2a0]
mov eax, dword [rcx + 0x30]
mov dword [rdi + 4], eax
mov eax, dword [rcx + 8]
mov dword [rdi], eax
mov eax, dword [rcx + 0x14]
mov dword [rdi + 0xc], eax
mov eax, dword [rcx + 0x10]
mov dword [rdi + 8], eax
mov eax, dword [rcx + 0x24]
mov dword [rdi + 0x10], eax
mov eax, dword [rcx + 0x28]
mov dword [rdi + 0x14], eax
lea r9, [rsp + 0x2b0]
lea r8, [rsp + 0x2b8]
lea rdx, str.VarFileInfoTranslation
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140018fdf
mov rax, qword [rsp + 0x2b8]
lea r8, str._4.4X_4.4X
mov edx, 0x14
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll__snwprintf
lea r11, [rsp + 0x60]
lea r9, [0x14001a8d0]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r11
call fcn.140018dd0
test eax, eax
jne 0x140018ff0
lea rdx, str.040904E4
lea rcx, [rsp + 0x30]
call fcn.14001916a
lea r9, [0x14001c7d8]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call fcn.140018dd0
lea r9, [0x14001c7f0]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r12
call fcn.140018dd0
lea r9, [0x14001c810]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r13
call fcn.140018dd0
lea r9, [0x14001c828]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r14
call fcn.140018dd0
lea r9, [0x14001c848]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r15
call fcn.140018dd0
lea r11, [rdi + 0xa18]
lea r9, [0x14001c860]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r11
call fcn.140018dd0
lea r11, [rdi + 0xc18]
lea r9, [0x14001c880]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r11
call fcn.140018dd0
lea r11, [rdi + 0xe18]
lea r9, str.OriginalFileName
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r11
call fcn.140018dd0
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rbx, qword [rsp + 0x2a8]
mov eax, 1
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140019210
Capabilities:
Parse pe header
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [0x140000000], 0x5a4d
je 0x14001924c
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x140000000]
jmp 0x1400192da
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x140019270
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x1400192da
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x1400192b7
cmp ecx, 0x20b
je 0x14001928f
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x1400192da
cmp dword [rax + 0x84], 0xe
ja 0x1400192a3
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x1400192da
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x1400192da
cmp dword [rax + 0x74], 0xe
ja 0x1400192c8
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x1400192da
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x140021fd0], 0xffffffffffffffff
mov qword [0x140021fd8], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x1400203fc]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x1400203f8]
mov dword [rcx], eax
call fcn.1400194e0
cmp dword [section..data], 0
jne 0x140019334
lea rcx, [fcn.1400194e0]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x14001a840]
lea rcx, [0x14001a838]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x1400203f4]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x1400203f0]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___wgetmainargs]
lea rdx, [0x14001a830]
lea rcx, [0x14001a7e0]
call sub.msvcrt.dll__initterm
mov r8, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [r8], 0
jne 0x1400193a9
mov eax, 0xff
jmp 0x140019479
mov r8, qword [r8]
mov qword [rsp + 0x30], r8
cmp word [r8], 0x22
jne 0x1400193f0
nop
nop
add r8, 2
mov qword [rsp + 0x30], r8
movzx eax, word [r8]
test ax, ax
je 0x1400193da
cmp ax, 0x22
je 0x1400193da
jmp 0x1400193c0
cmp word [r8], 0x22
jne 0x140019402
add r8, 2
mov qword [rsp + 0x30], r8
jmp 0x140019402
cmp word [r8], 0x20
jbe 0x140019402
add r8, 2
mov qword [rsp + 0x30], r8
jmp 0x1400193f0
movzx eax, word [r8]
test ax, ax
je 0x14001941c
cmp ax, 0x20
ja 0x14001941c
add r8, 2
mov qword [rsp + 0x30], r8
jmp 0x140019402
test byte [rsp + 0x8c], 1
je 0x140019431
movzx r9d, word [rsp + 0x90]
jmp 0x140019437
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.140015138
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x140019453
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x140019477
mov eax, edi
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
movsb byte [rdi], byte [rsi]
out dx, eax
wait
invalid