joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140042590
Capabilities:
Encode data using xor
Execute command
Log keystrokes via polling
Set console window title

Disassembly:
sub rsp, 0x48
lea rcx, str.Orea_Rust_External
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, str.color_3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Welcome_To_Chams_Rust_External_n
call fcn.140043420
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_Status:_Undetected_n_n
call fcn.140043420
call fcn.14003f100
movdqa xmm0, xmmword [0x14004ceb0]
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
lea ecx, [rax + 0x2c]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x10
jb 0x1400425f0
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x31], 0
call fcn.14003ee30
mov rax, qword [0x1400550b8]
mov ecx, 0x3e8
mov qword [0x140055c38], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.UnityPlayer_Module_Base___0x
call fcn.140043420
lea rdx, [0x14003e860]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [0x140055c30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, str.____n
call fcn.140043420
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Assembly_Module_Base___0x
call fcn.140043420
lea rdx, [0x14003e860]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [0x140055c38]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, str.____n
call fcn.140043420
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14004c1d8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140042700
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400426e0
nop dword [rax + rax]
call fcn.140040570
jmp 0x140042700
Function at 0x140044b4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140044b96
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140044b96
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140044b96
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140044b96
cmp dword [rcx + 0x84], 0xe
jbe 0x140044b96
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140044b98
xor al, al
add rsp, 0x28
ret

Function at 0x180c40bbf
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror r8d, 3
test r13b, r13b
cmp bl, 0xca
cmc
bswap r8d
stc
sub r8d, 0x78d64831
ror r8d, 1
cmp r12, 0x4cb04cb8
sub r8d, 0x2e24689e
cmc
clc
push rdi
or dil, 0x4f
xor dword [rsp], r8d
rol dil, cl
pop rdi
cmp spl, r12b
movsxd r8, r8d
cmp r10b, 0x25
cmc
add r10, r8
push r10
ret
xor r8d, edi
cmc
stc
not r8d
jmp 0x180b46fe7
push rsi
push rax
cbw
cdqe
movzx rsi, bp
push rdx
xchg al, dl
push rbp
movsx dx, sil
not rax
xchg rdx, rax
push r13
movzx esi, r12w
movsx rax, di
not dl
push rdi
movzx rdx, r8w
push r10
cwd
movsx rdx, cx
rdtsc
push r15
rdtsc
push r12
xchg dx, r10w
jmp 0x180c4dd29
push r11
cwd
not r10w
push rbx
rdtsc
xchg r10b, r11b
movzx rax, bx
push r8
movsx rsi, ax
push r14
movzx esi, si
push r9
cqo
push rcx
pushfq
cdq
bswap r11w
inc r11d
movabs rdx, 0
push rdx
stc
mov r11, qword [rsp + 0x90]
rcl sil, 0x2c
cmc
sal ah, 0x5a
xor r11d, 0x422425f
lahf
dec r11d
btc r10, r10
rol r11d, 2
shr edi, cl
adc r10b, r10b
neg r11d
rcr al, cl
movzx edi, si
rcl si, cl
not r11d
cmovge rax, rdi
rol dil, cl
ror r11d, 1
or r10, 0x75786934
movzx eax, r10w
xor edi, 0x63cf342a
add r11, rdx
movsx ax, bpl
shl ah, 0xf3
movabs rax, 0x100000000
ror sil, 0x5d
neg di
lea r11, [r11 + rax]
mov rsi, rsp
bsf r8, r11
sub rsp, 0x180
mov r10d, r14d
and rsp, 0xfffffffffffffff0
xadd dil, r8b
movsx cx, sil
mov rdi, r11
test r15d, 0x8892552
rcr r8b, cl
movabs rcx, 0
inc r8b
rcl r8b, 0xd2
and r8w, 0x102a
sub rdi, rcx
rcr r8w, cl
xor r10, 0x5fb0145e
lea r10, [0x180c4de24]
bsr r8d, r11d
sub r11, 4
btc r8d, r12d
bswap r8w
mov r8d, dword [r11]
cmp r8, 0x6317662e
jmp 0x180be1844
Function at 0x21fada0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x21fadad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x21fadbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x21fada5
lea eax, [rcx + 1]
jmp 0x21fadcb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x21fadde
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x21fadc4
sub eax, 3
jb 0x21fadfe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x21fae4d
sar eax, 1
movsxd rbp, eax
jb 0x21fae34
jmp 0x21fae0c
add ebx, ebx
jne 0x21fae0a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x21fae34
inc ecx
add ebx, ebx
jne 0x21fae1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x21fae34
call r11
adc ecx, ecx
add ebx, ebx
jne 0x21fae2d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x21fae1c
add ecx, 2
jmp 0x21fae39
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.021fad62
jmp 0x21fadad
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1de0000]
mov eax, dword [rdi]
or eax, eax
je 0x21faea9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1dfa000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x21fae59
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x21faea3
mov qword [rbx], rax
add rbx, 8
jmp 0x21fae79
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x21faeed
cmp al, 0xef
ja 0x21faed5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x21faeb5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x21faec4
mov eax, dword [rdi]
add rdi, 4
jmp 0x21faec4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x21faf41
sub rsp, 0xffffffffffffff80
jmp 0x465cc0
Function at 0x14000116c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx eax, byte [rdx]
mov r10, rcx
mov r8, qword [rsp + 0x88]
xor r9d, r9d
shl eax, 0x18
mov dword [rsp + 0x38], eax
movzx eax, word [rdx + 1]
mov dword [rsp + 0x3c], eax
mov rax, qword [rdx + 3]
add rdx, 0xb
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov qword [r8], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], r8
movzx ecx, word [rax]
mov dword [r8 + 8], ecx
lea rcx, str.ETW0
mov qword [r8 + 0x10], rdx
mov dword [r8 + 0xc], 2
movzx eax, word [rdx]
lea rdx, [rsp + 0x38]
mov dword [r8 + 0x18], eax
lea rax, [0x14019addd]
sub eax, ecx
mov dword [r8 + 0x1c], 1
mov rcx, qword [r10 + 0x20]
xor r8d, r8d
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_EventWriteTransfer]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14010fb20
add rsp, 0x58
ret
Function at 0x140004390
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
lea rax, [rsp + 0x30]
mov qword [r8], r15
lea rdx, [rsp + 0x30]
sub rcx, rax
mov r14, r8
mov r9d, 0x104
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x140004401
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140004401
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x1400043df
test r9, r9
lea rax, [rdx - 2]
lea r8, [0x14017a278]
cmovne rax, rdx
lea rcx, [rsp + 0x30]
mov word [rax], r15w
call fcn.140002980
mov ebx, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov rdi, rax
test rax, rax
jne 0x14000446b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140004540
mov edx, 0xc0
mov rcx, qword [rbp + 0x168]
lea r8, [0x14017a21c]
call fcn.140004168
mov esi, eax
jmp 0x140004543
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r15d
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call fcn.14000423c
mov esi, eax
test eax, eax
jns 0x1400044a8
mov rcx, qword [rbp + 0x168]
lea r8, [0x14017a21c]
mov r9d, eax
mov edx, 0xc6
call fcn.140004134
jmp 0x140004543
lea r8, [0x14017a280]
lea rcx, [rsp + 0x30]
call fcn.140002980
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov rbx, rax
test rax, rax
jne 0x1400044da
mov edx, 0xcc
jmp 0x140004451
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000423c
mov esi, eax
test eax, eax
jns 0x14000451b
mov rcx, qword [rbp + 0x168]
lea r8, [0x14017a21c]
mov r9d, eax
mov edx, 0xce
call fcn.140004134
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14000459c
jmp 0x140004543
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400045b5
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
mov esi, r15d
test rdi, rdi
je 0x140004555
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140004583
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14010fb20
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [rbp + 0x168]
lea r8, str.internal_sdkincwilopensourcewil_resource.h
mov edx, 0x8f0
call fcn.140004188
int3
mov rcx, qword [rbp + 0x168]
lea r8, str.internal_sdkincwilopensourcewil_resource.h
mov edx, 0x8f0
call fcn.140004188
int3
mov rcx, qword [rbp + 0x168]
lea r8, str.internal_sdkincwilopensourcewil_resource.h
mov edx, 0x8f0
call fcn.140004188
int3
Function at 0x14000773c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov edi, dword [0x1401d51f0]
lea eax, [rdx + rdx]
and edi, 0x3fffffff
mov dword [0x1401d5214], 1
and dword [0x1401d5208], 0
lea r14, [0x1401d5090]
mov esi, edx
mov dword [0x1401d5218], eax
mov rcx, qword [0x1401d51f8]
lea rdx, [0x1401d5200]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x1400077cf
mov rax, qword [0x1401d5090]
cmp rax, r14
je 0x1400077cf
test byte [rax + 0x1c], 1
je 0x1400077cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1401d5090]
lea r8, [0x14017abb8]
mov r9d, eax
mov edx, 0x20
mov rcx, qword [rcx + 0x10]
call fcn.140005acc
mov rcx, qword [0x1401d5228]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000783d
mov ebx, dword [0x1401d51f0]
and ebx, 0x3fffffff
cmp ebx, edi
jb 0x140007830
mov rcx, qword [0x1401d5090]
cmp rcx, r14
je 0x14000781c
test byte [rcx + 0x1c], 1
je 0x14000781c
mov rcx, qword [rcx + 0x10]
lea r8, [0x14017abb8]
mov edx, 0x21
call fcn.140005aa8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
inc dword [0x1401d5214]
mov edi, ebx
jmp 0x140007780
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14000785c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
sub rsp, 0x20
xor edi, edi
mov dword [0x1401d5200], 0x10
mov rbx, rdx
mov qword [0x1401d5204], 2
xor r9d, r9d
mov qword [0x1401d520c], rdi
xor r8d, r8d
mov qword [0x1401d5214], rdi
lea esi, [rdi + 1]
xor ecx, ecx
mov edx, esi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1401d5228], rax
lea rbp, [0x1401d5090]
test rax, rax
jne 0x1400078fe
mov rax, qword [0x1401d5090]
cmp rax, rbp
je 0x1400078f7
test byte [rax + 0x1c], sil
je 0x1400078f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [rdi + 0x18]
mov rcx, qword [0x1401d5090]
lea r8, [0x14017abb8]
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.140005acc
mov ebx, edi
jmp 0x1400079e2
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1401d5220], rax
test rax, rax
jne 0x140007939
mov rax, qword [0x1401d5090]
cmp rax, rbp
je 0x1400078f7
test byte [rax + 0x1c], sil
je 0x1400078f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x19
jmp 0x1400078dd
xor r8d, r8d
lea rdx, [0x140006ea0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
mov qword [0x1401d51f8], rax
test rax, rax
jne 0x14000797a
mov rax, qword [0x1401d5090]
cmp rax, rbp
je 0x1400078f7
test byte [rax + 0x1c], sil
je 0x1400078f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x1a
jmp 0x1400078dd
call fcn.1400074dc
mov ebx, eax
call fcn.140006fd4
test eax, eax
je 0x140007991
call fcn.1400075f8
jmp 0x140007998
mov edx, esi
call fcn.1400073cc
call fcn.140007274
mov edx, eax
call fcn.14000773c
mov rcx, qword [0x1401d51e8]
mov qword [0x1401d51e8], rdi
mov qword [rsp + 0x40], rcx
test rcx, rcx
je 0x1400079e2
mov eax, dword [rcx + 8]
cmp eax, esi
jne 0x1400079c8
mov dword [rcx + 8], edi
jmp 0x1400079d4
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, esi
jg 0x1400079e2
mov rax, qword [rcx]
mov edx, esi
mov rax, qword [rax]
call qword [case.0x1400b5e20.0]
mov rax, qword [0x1401d5220]
test rax, rax
je 0x1400079fe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401d5220], rdi
mov rax, qword [0x1401d5228]
test rax, rax
je 0x140007a1a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401d5228], rdi
test ebx, ebx
je 0x140007a87
mov rcx, qword [0x1401d51f8]
lea rdx, [0x1401d5200]
mov qword [0x1401d5204], rsi
mov qword [0x1401d5214], rdi
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x140007a87
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x1401d5090]
cmp rcx, rbp
je 0x140007a76
test byte [rcx + 0x1c], sil
je 0x140007a76
mov rcx, qword [rcx + 0x10]
lea r8, [0x14017abb8]
mov edx, 0x22
mov r9d, eax
call fcn.140005acc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400090a0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rbp + 0x170], rax
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x60]
and qword [rsp + 0x50], 0
mov rdi, rcx
mov rcx, qword [rcx]
mov r9d, 0x2001f
and qword [rsp + 0x58], 0
xor r8d, r8d
and qword [rsp + 0x60], 0
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400091a5
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000911e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
test ebx, ebx
jne 0x1400091a5
jmp 0x140009148
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1400090a0
mov ebx, eax
test eax, eax
jne 0x1400091a5
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x70]
and qword [rsp + 0x28], 0
xor edx, edx
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14000912e
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140009198
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
mov rdx, rsi
mov rcx, rdi
call fcn.140009208
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400091b5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14010fb20
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009de4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r14, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140009e58
call fcn.1400085bc
mov ebx, eax
jmp 0x140009f82
xor r9d, r9d
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rdi, rax
test rax, rax
jne 0x140009e7c
call fcn.1400085bc
jmp 0x140009f76
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140009e72
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x140009ece
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x140009ec4
lea rcx, [rsp + 0x70]
call fcn.140008558
nop
mov eax, 0x8007000e
jmp 0x140009f9b
mov ecx, eax
test eax, eax
je 0x140009f05
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140009fbf
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140009f05
lea rcx, [rsp + 0x70]
call fcn.140008588
mov rax, qword [rsp + 0x70]
jmp 0x140009f0f
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x140009f26
test rax, rax
jne 0x140009f32
mov ebx, 0x8007000e
jmp 0x140009f78
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140009e72
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140009c24
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x140009f99
lea rcx, [rsp + 0x70]
call fcn.140008558
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14010fb20
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80070057
call fcn.140008fcc
int3
Function at 0x14001fe4c
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
mov qword [rbp - 9], rcx
mov r14, qword [rdx + 8]
mov rbx, qword [rdx]
xor esi, esi
cmp rbx, r14
jne 0x14001fea5
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
jmp 0x14001ff6f
sub r14d, ebx
lea rax, [rbp - 0x19]
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rsi
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x40000001
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov rcx, qword [rbp + 0x5f]
test eax, eax
je 0x14001ffa8
movdqa xmm0, xmmword [0x14017fbb0]
movdqu xmmword [rbp + 0x27], xmm0
mov word [rbp + 0x17], si
lea rax, [rbp - 0x19]
mov qword [rbp - 9], rax
mov edx, dword [rbp - 0x19]
lea rax, [rbp + 0x17]
mov qword [rbp - 0x11], rax
lea rcx, [rbp + 0x17]
call fcn.140021b90
nop
mov r9, qword [rbp - 0x11]
cmp qword [r9 + 0x18], 8
jb 0x14001ff1a
mov r9, qword [r9]
mov rax, qword [rbp - 9]
mov qword [rsp + 0x20], rax
mov r8d, 0x40000001
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov rcx, qword [rbp + 0x5f]
test eax, eax
je 0x14001ff96
lea rcx, [rbp - 0x11]
call fcn.1400219e8
movups xmm0, xmmword [rbp + 0x17]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp + 0x27]
movups xmmword [rdi + 0x10], xmm1
movdqa xmm0, xmmword [0x14017fbb0]
movdqu xmmword [rbp + 0x27], xmm0
mov word [rbp + 0x17], si
lea rcx, [rbp + 0x17]
call fcn.140006970
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14010fb20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
lea r8, str.onecore_amcore_smartscreencommoncore_src_string_algo.h
mov edx, 0x4d
call fcn.1400290d4
nop
lea r8, str.onecore_amcore_smartscreencommoncore_src_string_algo.h
mov edx, 0x4a
call fcn.1400290d4
int3