joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140096730
Capabilities:
Encode data using xor
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1401fa010]
xor rax, rsp
mov qword [rbp + 0x20], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], 0
lea rdx, [rsp + 0x50]
call fcn.140095e30
mov r15, qword [rbp - 0x10]
test al, al
je 0x1400968df
mov dword [rbp + 0x10], 0xacb6a6ff
mov word [rbp + 0x14], 0xa1
mov byte [rbp + 0x16], 1
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 0x2f]
xor byte [rbp + rcx + 0x10], al
inc rcx
cmp rcx, 5
jb 0x1400967a0
mov byte [rbp + 0x16], 0
mov rbx, r15
mov rdi, qword [rbp - 8]
cmp r15, rdi
je 0x1400967e3
mov r12, qword [rbx]
mov r8d, 8
lea rdx, [rbp + 0x10]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400967e6
add rbx, 8
cmp rbx, rdi
jne 0x1400967c0
xor r12d, r12d
mov dword [rbp + 0x18], 0xb5b7a0ff
mov dword [rbp + 0x1c], 0x100b7a1
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 0x2f]
xor byte [rbp + rcx + 0x18], al
inc rcx
cmp rcx, 6
jb 0x140096800
mov byte [rbp + 0x1f], 0
mov rbx, r15
cmp r15, rdi
je 0x140096843
nop dword [rax]
mov r14, qword [rbx]
mov r8d, 8
lea rdx, [rbp + 0x18]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x140096846
add rbx, 8
cmp rbx, rdi
jne 0x140096820
xor r14d, r14d
mov dword [rbp + 0x10], 0xa0b2b6ff
mov word [rbp + 0x14], 0xb4
mov byte [rbp + 0x16], 1
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0x2f]
xor byte [rbp + rcx + 0x10], al
inc rcx
cmp rcx, 5
jb 0x140096860
mov byte [rbp + 0x16], 0
mov rbx, r15
cmp r15, rdi
je 0x1400968a3
nop dword [rax]
mov rsi, qword [rbx]
mov r8d, 8
lea rdx, [rbp + 0x10]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400968a5
add rbx, 8
cmp rbx, rdi
jne 0x140096880
xor esi, esi
test r12, r12
je 0x1400968df
cmp r12, r14
jae 0x1400968df
cmp r14, rsi
jae 0x1400968df
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov eax, dword [r14 + 0xc]
mov rcx, qword [rsp + 0x48]
div ecx
test edx, edx
jne 0x1400968df
xor edx, edx
mov eax, dword [rsi + 0xc]
div ecx
test edx, edx
jne 0x1400968df
mov bl, 1
jmp 0x1400968e1
xor bl, bl
test r15, r15
je 0x140096921
mov rdx, qword [rbp]
sub rdx, r15
and rdx, 0xfffffffffffffff8
mov rax, r15
cmp rdx, 0x1000
jb 0x140096919
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140096919
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.140097ab4
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140097a50
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140096950
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1401fa010]
xor rax, rsp
mov qword [rbp + 0x20], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], 0
lea rdx, [rsp + 0x20]
call fcn.140095e30
mov r15, qword [rbp - 0x40]
test al, al
je 0x140096b17
mov dword [rbp - 0x20], 0xacb6a6ff
mov word [rbp - 0x1c], 0xa1
mov byte [rbp - 0x1a], 1
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 0x2f]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 5
jb 0x1400969c0
mov byte [rbp - 0x1a], 0
mov rbx, r15
mov rdi, qword [rbp - 0x38]
cmp r15, rdi
je 0x140096a03
mov r14, qword [rbx]
mov r8d, 8
lea rdx, [rbp - 0x20]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x140096a06
add rbx, 8
cmp rbx, rdi
jne 0x1400969e0
xor r14d, r14d
mov dword [rbp - 0x18], 0xb5b7a0ff
mov dword [rbp - 0x14], 0x100b7a1
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 0x2f]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 6
jb 0x140096a20
mov byte [rbp - 0x11], 0
mov rbx, r15
cmp r15, rdi
je 0x140096a63
nop dword [rax]
mov rsi, qword [rbx]
mov r8d, 8
lea rdx, [rbp - 0x18]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x140096a65
add rbx, 8
cmp rbx, rdi
jne 0x140096a40
xor esi, esi
test r14, r14
je 0x140096b17
cmp r14, rsi
jae 0x140096b17
mov dword [rbp - 0x10], 1
mov dword [rbp - 0xc], 2
mov dword [rbp - 8], 4
mov dword [rbp - 4], 8
mov dword [rbp], 0x10
mov dword [rbp + 4], 0x20
mov dword [rbp + 8], 0x40
mov dword [rbp + 0xc], 0x80
mov dword [rbp + 0x10], pe_nt_image_headers64
mov dword [rbp + 0x14], 0x200
mov dword [rbp + 0x18], 0x400
mov dword [rbp + 0x1c], 0x80000000
lea rdi, [rbp - 0x10]
mov r13, qword [rsp + 0x38]
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [r14 + 8]
add r8d, 0x1000
mov r9d, dword [rdi]
mov rdx, qword [r13 + 0x18]
call fcn.140096b80
mov r8d, dword [rsi + 8]
mov edx, dword [rsi + 0xc]
add rdx, qword [r13 + 0x18]
mov r9d, dword [rdi]
call fcn.140096b80
add rdi, 4
lea rax, [rbp + 0x20]
cmp rdi, rax
jne 0x140096ae0
test r15, r15
je 0x140096b57
mov rdx, qword [rbp - 0x30]
sub rdx, r15
and rdx, 0xfffffffffffffff8
mov rax, r15
cmp rdx, 0x1000
jb 0x140096b4f
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140096b4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.140097ab4
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140097a50
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x140096b80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1401fa010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x30], ebx
mov edi, r9d
mov qword [rsp + 0x38], r8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword gs:[0x58]
mov rsi, rax
mov eax, 0x10
mov rdx, qword [rcx]
mov ecx, dword [rax + rdx]
cmp dword [0x1401fb8e8], ecx
jle 0x140096c4a
lea rcx, [0x1401fb8e8]
call fcn.140097b98
cmp dword [0x1401fb8e8], 0xffffffff
jne 0x140096c4a
movdqa xmm0, xmmword [0x1401e98c0]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0x8d8c8592
mov dword [rsp + 0x5c], 0x1009d91
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx - 0x31]
xor byte [rsp + rbx + 0x48], al
inc rbx
cmp rbx, 0x16
jb 0x140096c10
mov rcx, qword [0x1401fb6f8]
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x5f], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1401fb8e8]
mov qword [0x1401fb8d8], rax
call fcn.140097b2c
mov rax, qword [0x1401fb8d8]
test rax, rax
je 0x140096c74
lea rcx, [rsp + 0x30]
mov r9d, edi
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x38]
mov rcx, rsi
lea rdx, [rsp + 0x40]
call rax
jmp 0x140096c7f
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140097a50
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x140096d80
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140096e04
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14009cc80]
cmp byte [rcx + rax], 0
je 0x140096e04
dec r8
sub rdx, 1
jne 0x140096dea
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400975c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140096e94
mov ebx, eax
test eax, eax
jne 0x1400975f8
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x14009765b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140097652
test al, 0x10
je 0x140097652
bt eax, 0xa
jae 0x14009764b
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.14009766c
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140097647
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140097647
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
test edi, edi
jne 0x140097652
and dword [rsp + 0x3c], 0
jmp 0x140097657
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140098690
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400986da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400986da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400986da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400986da
cmp dword [rcx + 0x84], 0xe
jbe 0x1400986da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400986dc
xor al, al
add rsp, 0x28
ret
Function at 0x14063d810
Capabilities:
Encode data using xor

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14063d839
pop rbp
sub rbp, 0x29
sub rbp, 0x63d810
jmp 0x14063d899
sub rsp, 0x20
jmp 0x14063d8a9
mov rax, 0x63d810
add rax, rbp
add rax, 0xcb
mov rcx, 0x64a
mov rdx, 0x295966c8
xor byte [rax], dl
inc rax
dec rcx
jne 0x14063d8c8
jmp 0x14063d8df
add byte [rcx + 0x21], 0x43
hlt
Function at 0x140001045
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x140001063
mov rcx, rdi
call fcn.1400084e0
mov r8, rax
jmp 0x140001066
xor r8d, r8d
mov edx, 1
mov rcx, rdi
mov r9, rsi
call fcn.140007c08
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140007a10

Function at 0x140003495
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x408
mov rsi, rcx
mov ecx, 2
call fcn.140004eac
mov rdi, rax
lea rcx, str.could_not_load:
mov edx, 1
mov r8d, 0x10
mov r9, rax
call fcn.140007c08
mov rcx, rdi
call fcn.140007a10
test rsi, rsi
je 0x1400034de
cmp qword [rsi], 0
jne 0x1400034e7
lea rdi, [0x14001ac20]
jmp 0x1400034eb
lea rdi, [rsi + 0x10]
mov ecx, 2
call fcn.140004eac
mov rbx, rax
mov rcx, rdi
call fcn.1400084e0
mov edx, 1
mov rcx, rdi
mov r8, rax
mov r9, rbx
call fcn.140007c08
mov rcx, rbx
call fcn.140007a10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0xc1
jne 0x140003559
mov ecx, 2
call fcn.140004eac
mov rbx, rax
lea rcx, str._n_bad_format__library_may_be_wrong_architecture_
mov edx, 1
mov r8d, 0x30
mov r9, rax
call fcn.140007c08
mov rcx, rbx
call fcn.140007a10
lea r14, [rsp + 0x30]
xor ebx, ebx
mov r8d, 0x3d8
mov rcx, r14
xor edx, edx
call fcn.140013dc0
movups xmm0, xmmword [str.could_not_load:]
movaps xmmword [r14 - 0x10], xmm0
test rsi, rsi
je 0x140003595
mov rax, qword [rsi]
mov ebx, 0x3d7
cmp rax, rbx
cmovl rbx, rax
test rax, rax
jne 0x14000359e
lea rsi, [0x14001ac20]
jmp 0x1400035a2
add rsi, 0x10
mov rcx, r14
mov rdx, rsi
mov r8, rbx
call fcn.140014180
cmp edi, 0xc1
jne 0x1400035ea
cmp rbx, 0x3a7
jg 0x1400035ea
movups xmm0, xmmword [0x14001ab03]
lea rax, [rsp + 0x20]
movups xmmword [rbx + rax + 0x30], xmm0
movups xmm0, xmmword [0x14001aaf3]
movups xmmword [rbx + rax + 0x20], xmm0
movups xmm0, xmmword [str._n_bad_format__library_may_be_wrong_architecture_]
movups xmmword [rbx + rax + 0x10], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 2
call fcn.140004eac
lea rdx, [0x14001ac1f]
mov rcx, rax
call fcn.140001045
mov ecx, 1
call fcn.14000670c
int3

Function at 0x140004600
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000464a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000464a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000464a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000464a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000464a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000464c
xor al, al
add rsp, 0x28
ret
Function at 0x14000670c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140006854
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400068c4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400068c4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400068c4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400068c4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400068c4
cmp dword [rcx + 0x84], 0xe
jbe 0x1400068c4
cmp dword [rcx + 0xf8], esi
je 0x1400068c4
mov ecx, r14d
call fcn.140006790
mov ecx, 2
call fcn.140009ac0
nop
cmp byte [0x14001fabc], 0
jne 0x14000698e
mov r15d, 1
mov eax, r15d
xchg dword [0x14001fab8], eax
test ebx, ebx
jne 0x140006937
mov rdi, qword [0x14001f040]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14001fab0]
cmp rcx, rax
je 0x14000692e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [section..00cfg]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14001fbd8]
jmp 0x140006943
cmp ebx, r15d
jne 0x140006949
lea rcx, [0x14001fbf0]
call fcn.140006ea0
nop
test ebx, ebx
jne 0x140006960
lea rdx, [0x14001d470]
lea rcx, [0x14001d450]
call fcn.140007560
lea rdx, [0x14001d480]
lea rcx, [0x14001d478]
call fcn.140007560
movzx eax, byte [0x14001fabc]
test esi, esi
cmove eax, r15d
mov byte [0x14001fabc], al
jmp 0x14000698e
mov ecx, 2
call fcn.140009adc
test esi, esi
jne 0x1400069a5
mov ecx, r14d
call fcn.1400067fc
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x1400085b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400085d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400085d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400037b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x68], rdx
xor r15d, r15d
mov dword [rsp + 0x68], r15d
cmp qword [r8 + 0x18], 8
jb 0x1400037f5
mov r8, qword [r8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor edx, edx
lea r9d, [rdx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140003969
xorps xmm0, xmm0
xor eax, eax
mov ecx, dword [rsp + 0x68]
mov esi, ecx
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rax
test ecx, ecx
je 0x1400038ab
cmp rcx, 0x1000
jb 0x140003875
add rcx, 0x27
cmp rcx, rsi
jbe 0x14000398e
call fcn.140015a50
mov rcx, rax
test rax, rax
je 0x14000386e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000387a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015a50
mov qword [rsp + 0x70], rax
lea rbp, [rax + rsi]
mov qword [rsp + 0x80], rbp
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x78], rbp
mov ecx, dword [rsp + 0x68]
mov rax, qword [rsp + 0x80]
jmp 0x1400038b0
mov rbp, qword [rsp + 0x78]
test ecx, ecx
jne 0x1400038c2
mov rcx, qword [rsp + 0x70]
mov qword [rbx], rcx
mov qword [rbx + 8], rbp
jmp 0x140003916
cmp qword [rdi + 0x18], 8
jb 0x1400038cc
mov rdi, qword [rdi]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, 8
mov r8, rdi
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140003944
mov rax, qword [rsp + 0x70]
mov qword [rbx], rax
mov rax, qword [rsp + 0x78]
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x80]
mov qword [rbx + 0x10], rax
mov rax, rbx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140015a30
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea r8, str.Cannot_get_binary_data:_RegGetValueW_failed.
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1400039a0
lea rdx, [0x14004f340]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea r8, str.Cannot_get_size_of_binary_data:_RegGetValueW_failed.
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1400039a0
lea rdx, [0x14004f340]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
call fcn.140001350
int3
Function at 0x140005c80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140005cb4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140005ca0
ret

Function at 0x1400066e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebx, ebx
lea r8, [0x140019210]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rsi, qword [rsp + 0x20]
test rsi, rsi
jne 0x140006724
lea eax, [rbx - 3]
jmp 0x1400067d6
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
je 0x140006741
mov ebx, 0xfffffffd
jmp 0x1400067c9
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
test eax, eax
js 0x140006737
je 0x1400067c9
movsxd rbx, eax
lea rdx, [0x140018870]
mov qword [rsp + 0x40], rdi
lea rcx, [rbx + 1]
call fcn.140015f88
mov rdi, rax
test rax, rax
jne 0x140006775
lea ebx, [rax - 2]
jmp 0x1400067c4
xor r8d, r8d
mov byte [rbx + rax], 0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov r9, rsi
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbx
je 0x1400067af
mov rcx, rdi
call fcn.140015ce4
mov ebx, 0xfffffffd
jmp 0x1400067c4
mov r8, rax
mov rdx, rdi
call fcn.140008bc0
mov rcx, rdi
mov ebx, eax
call fcn.140015ce4
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140015a30
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
Function at 0x140012bd0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r14, rcx
xor edx, edx
lea ecx, [rdx + 2]
lea r15, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
xor edx, edx
mov r8d, 0x12c
lea rcx, [rsp + 0x44]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x130
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140012d27
xor r13d, r13d
nop dword [rax]
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], 0xf
lea rax, [rsp + 0x6c]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140012c70
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.140003db0
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x140012c96
mov rdx, qword [r14]
lea rcx, [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
cmp rsi, 0x10
setae bpl
mov rbx, qword [rsp + 0x20]
cmovae rcx, rbx
mov r8, qword [rsp + 0x30]
cmp r8, qword [r14 + 0x10]
jne 0x140012cca
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140012cca
mov dil, 1
jmp 0x140012ccd
xor dil, dil
test bpl, bpl
je 0x140012cff
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140012cf7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012d1b
mov rcx, rbx
call fcn.140015ce4
test dil, dil
jne 0x140012d22
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140012d27
jmp 0x140012c50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r15d, dword [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140015a30
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140014a00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140014a30
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140014a58
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140014a5a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140014ab3
test ecx, ecx
jle 0x140014a93
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140014ab3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140014ab3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
insd dword [rdi], dx
invalid