joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013ebd8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14013ecaa
test rbx, rbx
je 0x14013ecb0
test r9, r9
je 0x14013ecb6
and qword [r8], 0
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
and qword [rax - 0x18], 0
lea r9, [rax + 0x10]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14013ec93
cmp dword [rsp + 0x48], 3
jne 0x14013ec93
test eax, eax
jne 0x14013ec93
cmp dword [rdi], eax
je 0x14013ec93
mov ecx, dword [rdi]
call fcn.14003d4d0
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rbx], rax
mov rcx, qword [rbp + 8]
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14013ec87
cmp dword [rsp + 0x48], 3
jne 0x14013ec87
test eax, eax
jne 0x14013ec87
mov eax, 1
jmp 0x14013ec95
mov rcx, qword [rbx]
call fcn.14003d514
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.140041498
int3
call fcn.140041498
int3
call fcn.140041498
int3

Function at 0x14013ef70
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x14013ef81
xor eax, eax
jmp 0x14013efaf
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14013efb8
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x14013efc9
xor eax, eax
jmp 0x14013efed
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140190a88
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x140190ab1
mov rdi, qword [rdx + 0x10]
jmp 0x140190b02
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x140190ad2
call fcn.1400533ac
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x140190aec
call fcn.1400533ac
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x140190b02
call fcn.1400533ac
call fcn.14003fef0
cmp qword [rax + 0x68], 0
je 0x140190b1c
mov rdx, rdi
mov rcx, rbp
call fcn.14018fff4
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.140190d80
mov rcx, qword [rbp + 0xe8]
mov rsi, rax
test rcx, rcx
je 0x140190b43
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xe8], 0
test rsi, rsi
je 0x140190b52
mov rdi, rsi
mov qword [rbp + 0xe8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140190ef0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor ebx, ebx
mov qword [rax - 0x18], rbx
mov r14, qword [0x1402f0608]
and qword [rax + 8], rbx
xor esi, esi
mov eax, dword [0x1402e7bd4]
test eax, eax
je 0x140190f3c
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402e7bd4]
test eax, eax
jne 0x140190f45
call fcn.140046e70
test eax, eax
je 0x140190f61
lea rdx, [rsp + 0x40]
mov rcx, qword [0x1402aa860]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140190f6c
xor eax, eax
jmp 0x140190ff0
test r14, r14
jne 0x140190f89
lea rcx, str.CreatePropertySheetPageA
call fcn.1401911ec
test rax, rax
je 0x140190fbb
mov qword [0x1402f0608], rax
mov eax, dword [rdi + 4]
mov ecx, 0x4000
test ecx, eax
jne 0x140190faa
cmp dword [rdi], 0x60
jb 0x140190faa
or eax, ecx
mov dword [rdi + 4], eax
mov rax, qword [0x1402aa860]
mov qword [rdi + 0x58], rax
mov rcx, rdi
call qword [0x1402f0608]
mov rbx, rax
mov qword [rsp + 0x20], rax
xor edi, edi
test rbx, rbx
sete dil
test edi, edi
je 0x140190fd2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140190fd4
xor esi, esi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x140190fed
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140191008
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1402f0610]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1402e7bd4]
test eax, eax
je 0x140191053
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402e7bd4]
test eax, eax
jne 0x14019105c
call fcn.140046e70
test eax, eax
je 0x140191078
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1402aa860]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140191080
xor eax, eax
jmp 0x1401910dd
test rbx, rbx
jne 0x1401910a0
lea rcx, str.DestroyPropertySheetPage
call fcn.1401911ec
mov rbx, rax
test rax, rax
je 0x1401910ab
mov qword [0x1402f0610], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1401910c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401910c2
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401910db
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1401910f4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
or rdi, 0xffffffffffffffff
mov qword [rax - 0x18], rdi
mov rbx, qword [0x1402f0618]
and qword [rax + 0x10], 0
xor esi, esi
mov eax, dword [0x1402e7bd4]
test eax, eax
je 0x140191143
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1402e7bd4]
test eax, eax
jne 0x14019114c
call fcn.140046e70
test eax, eax
je 0x140191168
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1402aa860]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140191172
or rax, 0xffffffffffffffff
jmp 0x1401911d4
test rbx, rbx
jne 0x140191192
lea rcx, str.PropertySheetA
call fcn.1401911ec
mov rbx, rax
test rax, rax
je 0x14019119f
mov qword [0x1402f0618], rax
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
cmp rdi, 0xffffffffffffffff
sete bl
test ebx, ebx
je 0x1401911b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401911b8
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401911d1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1401b9a5c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1401b98c4
Function at 0x1401d4b18
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
call fcn.1401d4d54
xor r10d, r10d
test eax, eax
js 0x1401d4d41
mov eax, dword [rbx + 0xf0]
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x1401d4b9a
lea rdx, [rbx + 8]
lea r8, [rbx + 8]
lea rdx, [rdx + r9*4]
mov eax, dword [rdx - 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
mov ecx, dword [r8 + 4]
mov dword [r8 + 4], eax
sub r9, 4
mov dword [rdx + 4], ecx
lea rdx, [rdx - 0x10]
lea r8, [r8 + 0x10]
cmp r10, r9
jl 0x1401d4b51
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x1401d4d3f
lea r10, [rbx + 2]
lea rdi, [0x140000000]
lea r10, [r10 + 0x10]
inc r11d
mov r9d, dword [r10 - 2]
mov eax, r9d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x252ff0]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0x252ff0]
mov r8d, dword [rdi + rdx*4 + 0x252bf0]
movzx eax, byte [r10]
xor r8d, dword [rdi + rcx*4 + 0x2523f0]
movzx ecx, byte [rdi + rax*4 + 0x252ff0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x2527f0]
movzx ecx, byte [rdi + rax*4 + 0x252ff0]
mov r9d, dword [r10 + 2]
xor r8d, dword [rdi + rcx*4 + 0x251ff0]
mov eax, r9d
mov dword [r10 - 2], r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x252ff0]
movzx eax, byte [r10 + 3]
movzx ecx, byte [rdi + rax*4 + 0x252ff0]
mov r8d, dword [rdi + rdx*4 + 0x252bf0]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x2523f0]
movzx ecx, byte [rdi + rax*4 + 0x252ff0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x2527f0]
movzx ecx, byte [rdi + rax*4 + 0x252ff0]
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x251ff0]
mov eax, r9d
mov dword [r10 + 2], r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x252ff0]
movzx eax, byte [r10 + 7]
movzx ecx, byte [rdi + rax*4 + 0x252ff0]
mov r8d, dword [rdi + rdx*4 + 0x252bf0]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x2523f0]
movzx ecx, byte [rdi + rax*4 + 0x252ff0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x2527f0]
movzx ecx, byte [rdi + rax*4 + 0x252ff0]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x251ff0]
mov r9d, dword [r10 + 0xa]
mov dword [r10 + 6], r8d
movzx edx, byte [rdi + rax*4 + 0x252ff0]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x252ff0]
mov r8d, dword [rdi + rdx*4 + 0x2523f0]
mov eax, r9d
xor r8d, dword [rdi + rcx*4 + 0x2527f0]
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x252ff0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x252bf0]
movzx ecx, byte [rdi + rax*4 + 0x252ff0]
xor r8d, dword [rdi + rcx*4 + 0x251ff0]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1401d4bb8
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401d5f84
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x5c]
call fcn.1401b5480
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1401d8a88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
call fcn.1401dc160
mov rcx, rax
call fcn.1401dc0d4
test rax, rax
je 0x1401d8af6
lea rdx, [rsp + 0x20]
mov rcx, rax
mov word [rsp + 0x20], 0x444d
mov word [rsp + 0x26], 0x7461
mov word [rsp + 0x23], 0x7055
mov byte [rsp + 0x22], 0x35
mov byte [rsp + 0x25], 0x64
mov word [rsp + 0x28], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401d8af6
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401de9ec
Capabilities:
Acquire debug privileges

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, r8
xor ebx, ebx
call fcn.1401dc160
mov rcx, rax
call fcn.1401dc0d4
mov rdi, rax
test rax, rax
je 0x1401dea56
lea rcx, [rsp + 0x30]
call fcn.14002e7d8
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401dea4c
mov r8, rsi
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call rax
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.14002ee9c
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1401df50c
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], r9d
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
jne 0x1401df5a9
cmp dword [rcx + 8], 0xffffffff
jne 0x1401df5a9
lea rdi, [rcx + 0x150]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, rdi
call fcn.1401b55b0
mov cl, byte [rax + rbx + 0x14f]
cmp cl, 0x5c
je 0x1401df576
cmp cl, 0x2f
je 0x1401df576
lea r8, [0x1402598f8]
mov rcx, rdi
call fcn.140033908
lea r9, [rsp + 0x48]
mov edx, esi
mov rcx, rbp
call fcn.1401e0778
test rax, rax
jne 0x1401df590
mov eax, dword [rsp + 0x48]
jmp 0x1401df5ae
mov rcx, rax
call fcn.1401e0144
mov qword [rbx], rax
neg rax
sbb eax, eax
not eax
and eax, 0x200
jmp 0x1401df5ae
mov eax, 0x1000000
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1401e0ed4
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx]
movsx rax, dl
mov r10, rcx
mov r8d, r9d
shr r9d, 8
xor r8, rax
movzx eax, r8b
lea r8, [0x140256e70]
mov edx, dword [r8 + rax*4]
xor edx, r9d
mov dword [rcx], edx
movzx eax, dl
mov edx, dword [rcx + 8]
add eax, dword [rcx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [rcx + 4], eax
movzx eax, byte [r10 + 7]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov eax, dword [r8 + rcx*4]
xor eax, edx
mov dword [r10 + 8], eax
ret
Function at 0x1401e0f30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov r11d, r8d
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x1401e0f4f
xor eax, eax
jmp 0x1401e1060
not r9d
lea rsi, [0x140256e70]
cmp r11d, 8
jb 0x1401e1036
mov rbx, r11
shr rbx, 3
movzx ecx, byte [r10]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r10, 8
add r11d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rsi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rsi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rsi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rsi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rsi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rsi + rax*4]
xor r9d, edx
dec rbx
jne 0x1401e0f6a
test r11d, r11d
je 0x1401e105a
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rsi + rdx*4]
xor r9d, eax
dec r11d
jne 0x1401e103b
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret
Function at 0x140004907
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.1400123e0
mov r15, qword [0x14002048c]
cmp r15, 1
jne 0x1400049d6
push qword [0x14002057c]
pop rcx
call fcn.14000d5b4
mov r15, rax
and r15, r15
jle 0x14000496c
mov rcx, qword [0x14002057c]
call fcn.14000d5bc
mov rcx, qword [0x14002057c]
call fcn.14000d5d0
or rax, rax
je 0x14000496c
mov rbp, qword [0x140020584]
push qword [rbp + 0x10]
pop rcx
call fcn.14000da6c
jmp 0x140004949
push qword [0x14002056c]
pop rcx
call fcn.14000d5b4
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x1400049d6
push 5
push 0
push 1
push qword [0x14002056c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009070
mov rcx, qword [0x14002056c]
call fcn.14000d5bc
mov rcx, qword [0x14002056c]
call fcn.14000d5d0
or rax, rax
je 0x1400049d6
mov rbp, qword [0x140020574]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x1400049b3
mov rax, 1
jmp 0x1400049e2
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006a58
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
in al, dx
invalid
out dx, al
fcom st(2)
invalid
out dx, al
fcom st(2)
invalid
sar bh, cl
invalid
out 0xd5, al
sar bh, cl
invalid
Function at 0x18076df95
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x20], 0x7f27b2ba
mov qword [rsp + 0x48], 0x448139d9
cmp byte [rsp + 0x30], 0x74
setns byte [rsp + 0x38]
add dword [rsp + 0x30], 0x22632a6d
mov qword [rsp + 0x30], 0x57520f41
add byte [rsp + 0x38], 0xfa
call fcn.180d467b4
cdq
xor esp, 0x27
insb byte [rdi], dx
invalid
mov word [rsp + 0x48], 0x4e11
lea rsi, [rsi*4 + 0x59b47fb3]
setno byte [rsp + 0x48]
neg rsi
mov rsi, qword [rsp + 0x50]
add byte [rsp + 0x30], 0xdc
or byte [rsp + 0x38], 0xb9
add qword [rsp + 0x38], 0xf4415b8
and dword [rsp + 0x38], 0x71e67528
cmp dword [rsp + 0x48], 0x60d51a25
jl 0x18076a15e
and al, 0x38
mov ecx, 0x24448148
cmp byte [rax - 0x7ef0bbeb], bh
and al, 0x38
sub byte [rbp - 0x1a], dh
jno 0x18076df4e
jl 0x18076dff3
and rax, 0xf60d51a
mov word [rcx + rax*8 + 0xffff], es
add byte [rax], al
add byte [rax], al
add byte [rax], al
sal byte [rdx + 0x18075], 0
add al, cl
mov dl, 0x75
add byte [rcx], 0
add byte [rax], al
sbb byte [rbx], ch
sbb byte [rax + 1], al
add byte [rcx], 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
xor byte [rax], al
test al, 0x25
dec esi
outsd dx, dword [rsi]
jrcxz 0x18076dfb8
jrcxz 0x18076e04b
fadd st(6)
outsd dx, dword [rsi]
mov word [rdi + rbx + 0x490af473], fs
and esp, eax
mov esi, 0x429a1fd6
jb 0x18076e079
in eax, dx
pop rdx
stc
movabs eax, dword [0x69c0c7fd6dabbc4e]
pop rdx
fsubr dword [0x1df57f975]
invalid
insb byte [rdi], dx
clc
xchg edx, eax
jae 0x18076e06c
or dword [rbp + 9], 0xfffffff5
std
sbb eax, 0x3f2943fa
idiv byte [rdx + rsi*4 - 0x73]
pop rdi
add dword [rdi + riz*4 + 6], esi
jne 0x18076e0a5
invalid
mov al, 0x36
invalid
sti
cli
jns 0x18076e091
stc
mov esp, 0x96972acd
movsb byte [rdi], byte [rsi]
shl byte [rdi], 0x6d
retf
cmp al, byte [rsi*4 + 0x302f1f6d]
jge 0x18076e049
or ebx, ecx
leave
fdivr dword [rcx]
rol byte [rax - 0x56c0cb77], cl
popfq
invalid

Function at 0x18077f607
Capabilities:
Encode data using xor

Disassembly:
jbe fcn.180e3c9b8
mov rsi, qword [rsp + 0x58]
not dil
and qword [rsp + 0x48], 0x4ba738cd
xor qword [rsp + 0x48], 0x28951a7f
and edi, 0x6b7438a5
and dword [rsp + 0x48], 0x42b21dba
sub edi, edi
xor dword [rsp + 0x48], 0x3efb6767
jle 0x18077f635
neg byte [rsp + 0x48]
neg dil
and dword [rsp + 0x48], edi
lea rdi, [rdi*8 + 0x70cc637b]
add qword [rsp + 0x40], 0x7f1ad28f
cmp rdi, 0x27ae4235
setl byte [rsp + 0x48]
neg qword [rsp + 0x48]
sub qword [rsp + 0x48], 0x32c40a97
add qword [rsp + 0x50], 0x7f1c3636
mov rdi, qword [rsp + 0x20]
cmp word [rsp + 0x48], 0x5897
mov dword [rsp + 0x48], 0x30e01c5d
mov qword [rsp + 0x48], 0x3f184c86
setae byte [rsp + 0x48]
neg word [rsp + 0x48]
xor qword [rsp + 0x48], 0x254f42b5
or dword [rsp + 0x48], 0x5ed127fa
call fcn.180e26084
Function at 0x1807aae29
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
call fcn.180e5b0dd
cmp r8d, 0x53417a4a
mov r8b, 0x99
lea r8, [r8 + r8*8 + 0x724f7acb]
lea r8, [r8 + r8*8 + 0x71bc57ee]
mov r8, qword [rsp + 0x60]
lea rsp, [rsp + 0x70]
ret 8
neg rdi
lea rcx, [rcx + 0x4a6647b5]
lea rcx, [rcx + rdi*8 + 0x7d3e7eb9]
sub cx, di
xor dword [rsp], edi
sets r11b
add r11b, byte [rsp + 0x1b]
not dword [rsp + 0x18]
xor r11d, r11d
or dword [rsp + 0x18], 0x60363899
or r11, 0x6ec2360b
push r15
or r9w, bp
add r11, 0x25111a8b
mov bpl, 0xee
mov rbp, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0x5b257f8d
movabs r15, 0x373f03f950cd103a
add r11, 0x1f600cb6
lea r9, [r9*8 + 0x392734b]
sub r15b, 0xc8
lea r15, [r11 + r11 + 0x3d543a17]
movsx r11, r15b
mov r9w, 0x7ac9
mov r15b, 9
xor r11w, 0x5af5
xor r15w, r11w
movsx r11d, r9b
push r9
push r13
push r14
push rbx
push rdx
xor r15d, dword [rsp + 0x24]
mov rdx, r9
and r11b, dl
mov r13, qword [rsp + 0x20]
movsxd r9, dword [rsp + 0x20]
or r11w, 0x198e
xor r11b, r9b
jl 0x1808305a2
call fcn.1808372a2
mov r14d, 0x29ea4434
bswap r14
movzx r14d, r14w
je 0x180e640d8
mov r14w, cx
add qword [rsp + 0x18], 0x7f19b631
or r14b, 0xdf
setne cl
call fcn.180e6034c
loopne 0x1807aae36
pop rdi
cdq
xchg edi, eax
sbb ch, bh
mov eax, dword [rbp + 0x7c]
cwde
pushfq
in eax, 0xf6
invalid
neg rdx
mov byte [rsp + 0x20], dl
test word [rsp + 0x20], dx
movzx r15d, word [rsp + 0x23]
not r11w
jbe 0x180830601
pop rdx
neg r11w
add word [rsp + 0x18], 0xb00
add r15, r11
xor qword [rsp + 0x18], 0x78622353
jb 0x180793d93
xor r15b, r15b
or r11d, dword [rsp + 0x1a]
movzx r11d, r15w
cmp word [rsp + 0x18], 0x3469
movsx r15w, r11b
mov r11w, word [rsp + 0x18]
bswap r11d
movsx r11d, r11b
not r15
mov r15, qword [rsp + 0x20]
not r11w
not r11d
jbe 0x180e498c7
test word [rsp + 0x18], r11w
jbe 0x18078d5d2
test esi, 0x6c375c31
mov di, 0xfc1
ja 0x180d8b6a2
xor dl, r11b
xor word [rsp + 0x48], 0x79b4
mov rdi, qword [rsp + 0x60]
add r11w, word [rsp + 0x43]
cmp qword [rsp + 0x48], rsi
mov sil, byte [rsp + 0x5c]
call fcn.180877d83
xchg ecx, eax
invalid
setge dil
add ebx, 0x24747223
and rdi, 0x70f907c8
cmovo bx, di
movzx di, bx
cmp rdi, 0x5e60599c
lea rbx, [rdi + rbx*2 + 0x29553df6]
mov rbx, qword [rsp + 0x10]
bswap rdi
bswap edi
movsx rdi, dil
not dil
not rdi
not edi
movsx di, dil
call fcn.180790002
call fcn.180d4ce05
fmul qword [rdx + 0x3786564b]
cmc
inc dword [rdi + rdi*8 + 0x37]
cmp dword [rdi + 0x2f], 0x8bdfb3
mov edx, 0x7300d0
invalid
test sil, sil
sete byte [rsp + 0x48]
call fcn.180e607d0
retf 0xec5a
add qword [rsp + 0x10], 0x7f1ae7b2
mov esi, 0x329d7fd6
lea r12, [rsi + r12 + 0x5dd22e0a]
lea rsi, [r12*8 + 0x4377be5]
or ch, byte es:[rsi]
rcr byte [rbp + 0x4a], cl
lea esi, [riz*8 + 0x4377be5]
xor sil, sil
call fcn.180e2a27b
setl bpl
neg rbp
test bp, bp
lea rbp, [rbp + rbp*2 + 0x94013a8]
push r9
push r11
movabs r11, 0x1b8f7a6876422cf1
setl r11b
lea rbp, [rbp*2 + 0x9c97fe8]
mov r9, r11
js 0x180793d30
not r15d
mov r15, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0xffffffffe020a6e3
push rcx
movabs rcx, 0x5a5511b54d094be2
bswap rcx
call fcn.180e6375f
pop rbp
cmp eax, 0x2114c1ae
jl 0x180d9ce58
mov eax, 0x53d706d0
pop rcx
invalid