joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005204
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rax, r8
movabs rcx, 0xcbf29ce484222325
mov rdi, rdx
xor r10d, r10d
movzx r8d, byte [rax + r10 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, r8
inc r10
imul rcx, rdx
cmp r10, 0x10
jb 0x140005224
mov r8, qword [r9 + 0x30]
mov rdx, qword [r9 + 0x18]
and r8, rcx
add r8, r8
cmp qword [rdx + r8*8 + 8], rax
jne 0x14000527c
cmp qword [rdx + r8*8], rax
jne 0x140005271
mov rcx, qword [r9 + 8]
mov qword [rdx + r8*8], rcx
mov rdx, qword [r9 + 0x18]
mov rcx, qword [r9 + 8]
jmp 0x140005275
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
jmp 0x140005289
cmp qword [rdx + r8*8], rax
jne 0x140005289
mov rcx, qword [rax]
mov qword [rdx + r8*8], rcx
mov rcx, qword [rax + 8]
mov edx, 1
mov rbx, qword [rax]
mov qword [rcx], rbx
mov r8, qword [rax]
mov rcx, qword [rax + 8]
mov qword [r8 + 8], rcx
lea r8d, [rdx + 0x27]
dec qword [r9 + 0x10]
mov rcx, rax
call fcn.1400020a4
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140005350
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, qword [r8]
mov r14, rcx
mov rcx, rbx
mov r13, r8
mov r12, rdx
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
xor ecx, ecx
mov edx, eax
movabs r9, 0xcbf29ce484222325
test eax, eax
je 0x1400053b0
movzx eax, byte [rcx + rbx]
movabs r8, 0x100000001b3
xor r9, rax
inc rcx
imul r9, r8
cmp rcx, rdx
jb 0x140005393
mov r15, qword [r14 + 0x30]
mov rbx, qword [r14 + 0x18]
and r15, r9
add r15, r15
mov rbx, qword [rbx + r15*8]
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 8]
cmp qword [rcx + r15*8], rax
je 0x1400053d8
mov rax, qword [rcx + r15*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140005464
mov rsi, qword [r13]
mov rbp, qword [rbx + 0x10]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov rcx, rbp
mov edi, eax
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r9d, edi
mov dword [rsp + 0x20], 1
mov edx, eax
mov r8, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
cmp eax, 2
je 0x140005420
mov rbx, qword [rbx]
jmp 0x1400053c2
mov rsi, qword [rbx + 0x10]
mov rbp, qword [r13]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov rcx, rbp
mov edi, eax
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r9d, edi
mov dword [rsp + 0x20], 1
mov edx, eax
mov r8, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
cmp eax, 2
je 0x14000545e
mov rbx, qword [r14 + 8]
mov qword [r12], rbx
jmp 0x14000546c
mov rax, qword [r14 + 8]
mov qword [r12], rax
mov rbx, qword [rsp + 0x60]
mov rax, r12
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400055d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rax, r8
movabs rcx, 0xcbf29ce484222325
mov rdi, rdx
xor r10d, r10d
movzx r8d, byte [rax + r10 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, r8
inc r10
imul rcx, rdx
cmp r10, 0x10
jb 0x1400055f4
mov r8, qword [r9 + 0x30]
mov rdx, qword [r9 + 0x18]
and r8, rcx
add r8, r8
cmp qword [rdx + r8*8 + 8], rax
jne 0x14000564c
cmp qword [rdx + r8*8], rax
jne 0x140005641
mov rcx, qword [r9 + 8]
mov qword [rdx + r8*8], rcx
mov rdx, qword [r9 + 0x18]
mov rcx, qword [r9 + 8]
jmp 0x140005645
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
jmp 0x140005659
cmp qword [rdx + r8*8], rax
jne 0x140005659
mov rcx, qword [rax]
mov qword [rdx + r8*8], rcx
mov rcx, qword [rax + 8]
mov edx, 1
mov rbx, qword [rax]
mov qword [rcx], rbx
mov r8, qword [rax]
mov rcx, qword [rax + 8]
mov qword [r8 + 8], rcx
lea r8d, [rdx + 0x1f]
dec qword [r9 + 0x10]
mov rcx, rax
call fcn.1400020a4
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140005b70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 0x10
jb 0x140005ba8
mov r8, qword [r9 + 0x30]
and r8, rcx
add r8, r8
mov rdi, qword [r9 + 0x18]
mov rax, qword [rdi + r8*8]
cmp rax, qword [r9 + 8]
jne 0x140005be5
mov rdi, qword [r9 + 8]
jmp 0x140005c3f
mov rdi, qword [rdi + r8*8 + 8]
mov rdi, qword [rdi]
jmp 0x140005c3f
mov rdi, qword [rdi + 8]
mov rcx, qword [r10]
cmp rcx, qword [rdi + 0x10]
jne 0x140005c3f
mov rcx, qword [r10 + 8]
cmp rcx, qword [rdi + 0x18]
jne 0x140005c3f
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov edx, 1
lea r8d, [rdx + 0x1f]
mov rcx, rbx
call fcn.1400020a4
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140005cd8
cmp rdi, rax
jne 0x140005bef
mov rax, qword [rbx]
cmp rdi, rax
je 0x140005c79
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x140005c96
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140005cc5
cmp rax, rdi
jne 0x140005ca1
mov qword [rdx + r8*8], rbx
jmp 0x140005cc5
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140005cc5
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.140005fc8
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140006100
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, qword [r8 + 0x10]
mov rsi, rcx
mov rcx, rdi
mov rbx, r8
mov r14, rdx
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
xor r8d, r8d
mov r9d, eax
movabs rcx, 0xcbf29ce484222325
test eax, eax
je 0x14000615d
movzx eax, byte [r8 + rdi]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rdx
cmp r8, r9
jb 0x14000613f
mov rdx, qword [rsi + 0x30]
and rdx, rcx
mov rcx, qword [rsi + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x140006195
cmp qword [rcx + rdx*8], rbx
jne 0x14000618a
mov rax, qword [rsi + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 8]
jmp 0x14000618e
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400061a2
cmp qword [rcx + rdx*8], rbx
jne 0x1400061a2
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400061d1
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14000dbe8]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x1f]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rsi, qword [rsp + 0x38]
mov qword [r14], rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400062b8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov rbx, r9
mov r11, r8
mov r10, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + r8]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r9
cmp r9, 0x10
jb 0x1400062ef
mov r8, qword [rsi + 0x30]
and r8, rcx
add r8, r8
mov rdi, qword [rsi + 0x18]
mov rax, qword [rdi + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14000632c
mov rdi, qword [rsi + 8]
jmp 0x140006334
mov rdi, qword [rdi + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, rax
je 0x140006395
mov rdi, qword [rdi + 8]
mov rcx, qword [r11]
cmp rcx, qword [rdi + 0x10]
jne 0x14000638b
mov rcx, qword [r11 + 8]
cmp rcx, qword [rdi + 0x18]
jne 0x14000638b
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov edx, 1
lea r8d, [rdx + 0x27]
mov rcx, rbx
call fcn.1400020a4
mov rax, qword [rsp + 0x78]
mov qword [rax], rdi
mov byte [rax + 8], 0
jmp 0x1400064c3
cmp rdi, rax
jne 0x140006339
mov r10, qword [rsp + 0x78]
mov qword [rsp + 0x28], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400063cf
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x1400063ec
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14000641b
cmp rax, rdi
jne 0x1400063f7
mov qword [rdx + r8*8], rbx
jmp 0x14000641b
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14000641b
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14000ea4c]
test rax, rax
jns 0x14000643c
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14000644d
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1400064b8
cmp rdx, 0x200
jae 0x140006465
shl rdx, 3
jmp 0x140006477
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140006477
add rdx, rdx
mov rcx, rsi
call fcn.140005544
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1400064b3
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1400062b8
cmp rdi, qword [rsp + 0x20]
jne 0x140006491
mov r10, qword [rsp + 0x78]
mov qword [r10], rbx
mov byte [r10 + 8], 1
mov rax, r10
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140007c40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov r10, rdx
mov rbx, rcx
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + rdx]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 4
jb 0x140007c5d
mov rcx, qword [rbx + 0x30]
and rcx, r8
mov r8, qword [rbx + 0x18]
mov rax, rcx
add rax, rax
lea r9, [rcx + rcx]
mov rcx, qword [rbx + 8]
mov rax, qword [r8 + rax*8]
cmp qword [r8 + r9*8], rcx
jne 0x140007ca4
mov rdx, rcx
jmp 0x140007cac
mov rdx, qword [r8 + r9*8 + 8]
mov rdx, qword [rdx]
cmp rax, rdx
je 0x140007cca
mov edx, dword [r10]
cmp dword [rax + 0x10], edx
je 0x140007cbe
mov rax, qword [rax]
jmp 0x140007c99
mov edx, dword [rax + 0x10]
cmp dword [r10], edx
cmovne rax, rcx
jmp 0x140007ccd
mov rax, rcx
cmp rax, rcx
jne 0x140007d47
mov rdi, qword [rcx]
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x20], rax
mov r8, qword [rdi + 8]
call fcn.1400091b0
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x140007d18
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rdi + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbx + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140008d58
mov rax, qword [rsp + 0x30]
add rax, 0x18
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140008d58
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov r9, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x140008d8e
mov r8, qword [rsi + 0x30]
and r8, rcx
add r8, r8
mov rdi, qword [rsi + 0x18]
mov rax, qword [rdi + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140008dcb
mov rdi, qword [rsi + 8]
jmp 0x140008dd3
mov rdi, qword [rdi + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, rax
je 0x140008e42
mov ecx, dword [r10]
mov rdi, qword [rdi + 8]
cmp ecx, dword [rdi + 0x10]
je 0x140008deb
cmp rdi, rax
jne 0x140008ddb
jmp 0x140008e42
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x140008e20
inc rdx
mov r8d, 2
mov rcx, qword [rbx + 0x18]
call fcn.1400020a4
mov edx, 1
lea r8d, [rdx + 0x37]
mov rcx, rbx
call fcn.1400020a4
mov rax, qword [rsp + 0x78]
mov qword [rax], rdi
mov byte [rax + 8], 0
jmp 0x140008f70
mov qword [rsp + 0x28], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x140008e7c
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140008e99
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140008ec8
cmp rax, rdi
jne 0x140008ea4
mov qword [rdx + r8*8], rbx
jmp 0x140008ec8
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140008ec8
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14000ea4c]
test rax, rax
jns 0x140008ee9
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x140008efa
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140008f65
cmp rdx, 0x200
jae 0x140008f12
shl rdx, 3
jmp 0x140008f24
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140008f24
add rdx, rdx
mov rcx, rsi
call fcn.140005544
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140008f60
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140008d58
cmp rdi, qword [rsp + 0x20]
jne 0x140008f3e
mov r9, qword [rsp + 0x78]
mov qword [r9], rbx
mov byte [r9 + 8], 1
mov rax, r9
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
and eax, 0xdc7398ff
pop rdi
mov esi, 0xb8505df9
invalid
Function at 0x1400111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x140014ec0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011262
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012bd0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012bf0
xor al, al
jmp 0x140012c71
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012c03
xor al, al
jmp 0x140012c71
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012c2d
xor al, al
jmp 0x140012c71
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012c41
xor al, al
jmp 0x140012c71
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012c53
xor al, al
jmp 0x140012c71
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012c6f
xor al, al
jmp 0x140012c71
mov al, 1
add rsp, 0x38
ret
Function at 0x117cc
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x100
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0xf0], rax
and qword [rsp + 0x30], 0
and dword [rsp + 0x20], 0
mov bpl, cl
lea r8, [rsp + 0x20]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [rsp + 0x20], 0x203a
jbe 0x1182f
xor al, al
jmp 0x119aa
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x24]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov edi, dword [rsp + 0x24]
mov eax, dword [rsp + 0x28]
and eax, 0xf
shl edi, 4
or edi, eax
call fcn.00034b08
mov r14, rax
test rax, rax
je 0x11828
test bpl, bpl
je 0x1189e
lea rcx, [0x0003b8c0]
call fcn.000315c0
test rax, rax
je 0x11828
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x11828
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and dword [0x0004d1dc], 0
xor esi, esi
cmp dword [0x0004b8ac], esi
jle 0x1198d
lea rbx, [0x0004c3e0]
cmp dword [rbx], 0
je 0x118de
movzx ecx, byte [rbx]
movzx eax, byte [rbx + 1]
test ecx, ecx
je 0x118d2
cmp edi, ecx
jb 0x1197b
test eax, eax
je 0x118de
cmp edi, eax
ja 0x1197b
mov edx, dword [rbx - 0x20]
mov r12, qword [rbx - 0x18]
mov r13, qword [rbx - 0x10]
mov r9b, 1
mov rcx, r14
mov r8b, r9b
call fcn.00034ca8
test rax, rax
je 0x11921
mov r8, r12
mov rdx, r13
mov rcx, rax
call fcn.0002bf9c
test al, al
je 0x11921
mov rax, qword [rbx - 8]
or qword [0x0004d1e0], rax
inc dword [0x0004d1dc]
jmp 0x1197b
xor edx, edx
lea rcx, [rsp + 0x81]
mov byte [rsp + 0x80], 0
lea r8d, [rdx + 0x63]
call fcn.0003b290
mov r9d, dword [rbx - 0x20]
lea r8, [0x0003b8e0]
lea rcx, [rsp + 0x80]
mov edx, 0x64
call fcn.0001110c
call fcn.0003b1a0
lea r9, [rsp + 0x80]
mov r8d, eax
xor edx, edx
mov ecx, 0x8000100a
call fcn.00035fd0
inc dword [0x0004d1c4]
inc esi
add rbx, 0x28
cmp esi, dword [0x0004b8ac]
jl 0x118ba
test bpl, bpl
je 0x119a8
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, 1
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.0003ac70
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x15a6c
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
cmp dword [rcx], 1
mov rdi, rcx
mov byte [rcx + 0x403], 0
mov byte [rcx + 0x203], 0
jne 0x15bc5
mov al, byte [rcx + 0x204]
cmp al, 0x31
je 0x15ab0
cmp al, 0x32
je 0x15ab0
cmp al, 0x30
jne 0x15c0f
lea r8, [0x0003b9a0]
lea rdx, [0x0003b9c0]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
lea r8, [0x0003ba40]
lea rdx, [0x0003ba70]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
mov dl, byte [rdi + 0x204]
cmp dl, 0x31
jne 0x15b73
call fcn.0001e67c
mov rbx, rax
test rax, rax
je 0x15b69
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x15b69
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r10, qword [rsp + 0x38]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r10
lea r8, [0x0003b9a0]
repne scasw ax, word [rdi]
lea rdx, [0x0003b9c0]
mov r9d, 1
not rcx
lea eax, [rcx + rcx]
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r10
call qword [sym.imp.ntoskrnl.exe_RtlWriteRegistryValue]
cmp qword [rbx + 8], 0
mov edi, eax
je 0x15b5a
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov rcx, rbx
call fcn.000365f0
mov eax, edi
jmp 0x15c14
mov eax, 0xc0000001
jmp 0x15c14
cmp dl, 0x32
jne 0x15bc1
and qword [rsp + 0x50], 0
lea rdx, [0x0003ba70]
lea rcx, [rsp + 0x50]
mov r8d, 0xf003f
call fcn.00026d58
mov edi, eax
test eax, eax
js 0x15b62
mov rcx, qword [rsp + 0x50]
lea rdx, [0x0003ba40]
mov r8d, 1
call fcn.00026ddc
mov rcx, qword [rsp + 0x50]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x15b62
xor eax, eax
jmp 0x15c14
cmp dword [rcx], 2
jne 0x15c0f
xor ebx, ebx
lea rsi, str.StartOskLauncher
mov rdx, qword [rsi]
lea rcx, [rdi + 4]
call qword [sym.imp.ntoskrnl.exe__stricmp]
test eax, eax
je 0x15bf6
inc ebx
add rsi, 8
cmp ebx, 0xa
jb 0x15bd3
mov eax, 0xc0000022
jmp 0x15c14
lea r8, [rdi + 0x204]
lea rdx, [rdi + 4]
lea rcx, [0x0003ba70]
call fcn.0001e57c
jmp 0x15c14
mov eax, 0xc000000d
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret