joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400672e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rsi, rcx
mov ecx, dword [0x1400a9140]
test ecx, ecx
je 0x1400673f8
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140067315
cmp qword [rax + 8], 0
jne 0x1400673f2
mov ecx, dword [0x1400a9140]
test ecx, ecx
je 0x14006741a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140067437
test rax, rax
jne 0x14006739b
mov qword [rbp - 0x10], 0
lea rax, sym.std::sys::thread_local::os_local::destroy_value::h7e7befca05c88b99
mov qword [rbp - 0x18], rax
mov rax, qword [0x140643dc8]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x14006745a
mov rcx, qword [rbp - 8]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400a9140]
test ecx, ecx
je 0x140067441
dec ecx
mov rdx, rax
mov rdi, rax
call fcn.1400a64dc
mov rax, rdi
test rsi, rsi
je 0x1400673b5
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
je 0x1400673b7
mov rcx, qword [rsi + 8]
jmp 0x1400673b7
xor ecx, ecx
mov r8, qword [rax + 8]
mov rdx, qword [rax + 0x10]
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x10], rdx
mov qword [rax + 8], 1
mov qword [rax + 0x10], rcx
test r8, r8
je 0x1400673f2
test rdx, rdx
je 0x1400673f2
lock dec qword [rdx]
jne 0x1400673f2
lea rcx, [rbp - 0x10]
mov rsi, rax
call sym.alloc::sync::Arc_T_A_::drop_slow::hf2a241d43703bb56
mov rax, rsi
add rax, 0x10
jmp 0x140067439
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e7befca05c88b99
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::haa087f69fbeb5f15
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14006730a
jmp 0x140067315
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e7befca05c88b99
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::haa087f69fbeb5f15
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140067334
xor eax, eax
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h7e7befca05c88b99
mov rdi, rax
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::haa087f69fbeb5f15
mov ecx, eax
mov rax, rdi
jmp 0x14006738d
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::hac6683127b8aa11c
ud2
Function at 0x14006a860
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
test rdx, rdx
je 0x14006a87a
mov r8d, edx
and r8d, 3
cmp rdx, 4
jae 0x14006a87e
xor eax, eax
jmp 0x14006a8f5
xor eax, eax
pop rbp
ret
and rdx, 0xfffffffffffffffc
xor eax, eax
nop word cs:[rax + rax]
shl eax, 4
movzx r9d, byte [rcx]
add r9d, eax
mov eax, r9d
shr eax, 0x18
and eax, 0xfffffff0
xor eax, r9d
shl eax, 4
movzx r9d, byte [rcx + 1]
add r9d, eax
mov eax, r9d
shr eax, 0x18
and eax, 0xfffffff0
xor eax, r9d
shl eax, 4
movzx r9d, byte [rcx + 2]
add r9d, eax
mov eax, r9d
shr eax, 0x18
and eax, 0xfffffff0
xor eax, r9d
shl eax, 4
movzx r9d, byte [rcx + 3]
add rcx, 4
add r9d, eax
mov eax, r9d
shr eax, 0x18
and eax, 0xfffffff0
xor eax, r9d
add rdx, 0xfffffffffffffffc
jne 0x14006a890
test r8, r8
je 0x14006a91f
xor edx, edx
nop dword [rax]
shl eax, 4
movzx r9d, byte [rcx + rdx]
add r9d, eax
mov eax, r9d
shr eax, 0x18
and eax, 0xfffffff0
xor eax, r9d
inc rdx
cmp r8, rdx
jne 0x14006a900
and eax, 0xfffffff
pop rbp
ret

Function at 0x14006a930
Capabilities:
Hash data using djb2

Disassembly:
push rbp
mov rbp, rsp
test rdx, rdx
je 0x14006a950
mov r8d, edx
and r8d, 7
cmp rdx, 8
jae 0x14006a957
mov eax, 0x1505
jmp 0x14006a9dd
mov eax, 0x1505
pop rbp
ret
and rdx, 0xfffffffffffffff8
mov eax, 0x1505
mov r9d, eax
shl r9d, 5
add r9d, eax
movzx eax, byte [rcx]
add eax, r9d
movzx r9d, byte [rcx + 1]
add r9d, eax
shl eax, 5
add r9d, eax
movzx eax, byte [rcx + 2]
add eax, r9d
shl r9d, 5
add eax, r9d
movzx r9d, byte [rcx + 3]
add r9d, eax
shl eax, 5
add r9d, eax
movzx eax, byte [rcx + 4]
add eax, r9d
shl r9d, 5
add eax, r9d
movzx r9d, byte [rcx + 5]
add r9d, eax
shl eax, 5
add r9d, eax
movzx r10d, byte [rcx + 6]
add r10d, r9d
shl r9d, 5
add r10d, r9d
movzx eax, byte [rcx + 7]
add eax, r10d
shl r10d, 5
add rcx, 8
add eax, r10d
add rdx, 0xfffffffffffffff8
jne 0x14006a960
test r8, r8
je 0x14006aa09
xor edx, edx
nop word cs:[rax + rax]
mov r9d, eax
shl r9d, 5
add r9d, eax
movzx eax, byte [rcx + rdx]
add eax, r9d
inc rdx
cmp r8, rdx
jne 0x14006a9f0
pop rbp
ret
Function at 0x140099730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x1400997ba
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1400997b0
cmp r11, r10
ja 0x140099836
cmp r10, rdx
ja 0x140099848
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x1400997b2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140099790
jmp 0x140099817
ja 0x1400997ba
mov r11, r10
cmp rax, r8
jne 0x140099757
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14009981b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400997f0
mov r8, r10
sub ecx, r9d
jns 0x14009980e
jmp 0x14009981d
cmp r10, rdx
je 0x14009982a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14009981d
xor al, 1
cmp r8, rdx
jne 0x1400997d0
jmp 0x14009981d
xor eax, eax
jmp 0x14009981d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, [0x140638b80]
call sym.core::option::unwrap_failed::h511674c62460528b
lea r8, [0x140638b98]
mov rcx, r11
mov rdx, r10
call sym.core::slice::index::slice_index_order_fail::hf943cfe51be07c4a
lea r8, [0x140638b98]
mov rcx, r10
call sym.core::slice::index::slice_end_index_len_fail::ha4157f6c56c31a58
int3
Function at 0x1400a02e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
movzx eax, byte [rcx]
mov ecx, dword [rdx + 0x34]
test cl, 0x10
jne 0x1400a0342
test cl, 0x20
jne 0x1400a0384
mov r8d, eax
sar r8b, 7
mov ecx, eax
xor cl, r8b
sub cl, r8b
cmp cl, 0x64
jb 0x1400a03f5
add cl, cl
add cl, 0x38
movzx ecx, cl
lea r8, [0x14063800e]
movzx ecx, word [rcx + r8]
mov word [rbp - 0x23], cx
mov r8d, 0x24
mov cl, 1
jmp 0x1400a0400
lea r9, [rbp + 0x38]
xor r8d, r8d
mov ecx, eax
nop dword [rax + rax]
mov r10d, eax
and r10b, 0xf
shr cl, 4
lea r11d, [r10 + 0x30]
lea esi, [r10 + 0x57]
cmp r10b, 0xa
movzx r10d, r11b
movzx r11d, sil
cmovb r11d, r10d
mov byte [r9 - 1], r11b
dec r9
inc r8
cmp al, 0x10
mov eax, ecx
jae 0x1400a0350
jmp 0x1400a03c2
lea r9, [rbp + 0x38]
xor r8d, r8d
mov ecx, eax
nop dword [rax]
mov r10d, eax
and r10b, 0xf
shr cl, 4
lea r11d, [r10 + 0x30]
lea esi, [r10 + 0x37]
cmp r10b, 0xa
movzx r10d, r11b
movzx r11d, sil
cmovb r11d, r10d
mov byte [r9 - 1], r11b
dec r9
inc r8
cmp al, 0x10
mov eax, ecx
jae 0x1400a0390
mov ecx, pe_nt_image_headers64
sub rcx, r8
cmp rcx, 0x81
jae 0x1400a0461
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r9
lea r8, [0x14063800c]
mov r9d, 2
mov rcx, rdx
mov dl, 1
jmp 0x1400a0451
mov r8d, 0x26
cmp cl, 0xa
jae 0x1400a040a
or cl, 0x30
mov byte [rbp + r8 - 0x48], cl
jmp 0x1400a0423
movzx ecx, cl
lea r8, [0x14063800e]
movzx ecx, word [r8 + rcx*2]
mov word [rbp - 0x23], cx
mov r8d, 0x25
lea rcx, [r8 + rbp]
add rcx, 0xffffffffffffffb8
mov r9d, 0x27
sub r9, r8
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rcx
not al
shr al, 7
mov r8d, 1
mov rcx, rdx
mov edx, eax
xor r9d, r9d
call sym.core::fmt::Formatter::pad_integral::hd7d09bba8c9ff4c9
nop
add rsp, 0xb8
pop rsi
pop rbp
ret
lea r8, str.librarycore_src_fmt_num.rs
mov edx, pe_nt_image_headers64
call sym.core::slice::index::slice_start_index_len_fail::hc4490513dd7cd116
int3
Function at 0x1400a7330
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x1400a8002
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1406582c8]
test eax, eax
je 0x1400a809a
lea rax, [0x1406582a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1406582d0]
mov qword [rbp - 8], rax
jmp 0x1400a807e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400a8072
cmp qword [rbp - 0x10], 0
je 0x1400a8072
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400a8038
lea rax, [0x1406582a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400a809b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400a81a0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400a81c8
mov eax, 0
jmp 0x1400a8216
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400a81f1
mov eax, 0
jmp 0x1400a8216
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400a8211
mov eax, 0
jmp 0x1400a8216
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1400a821c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400a829a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400a8291
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400a8291
mov rax, qword [rbp - 8]
jmp 0x1400a82af
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400a8264
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1800020f0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002122
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002122
nop word cs:[rax + rax]
jmp 0x180002120
mov rax, qword gs:[0x60]
mov r10, qword [rax + 0x18]
add r10, 0x10
mov eax, dword [0x180020a78]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a74], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r11, [rcx - 1]
xor eax, eax
mov r14, r10
mov r14, qword [r14]
cmp r14, r10
je 0x18000221b
mov rsi, r11
test r8b, r8b
je 0x180002200
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002190
sub rsi, rcx
je 0x180002212
test r9b, r9b
je 0x180002210
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop word [rax + rax]
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x1800021f0
test ebp, ebp
jne 0x1800021f0
add rbx, 1
cmp rsi, rbx
jne 0x1800021b0
jmp 0x180002217
test ebp, ebp
jne 0x18000217c
jmp 0x180002217
jmp 0x180002200
jmp 0x180002210
test r9b, r9b
je 0x180002230
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002230
Function at 0x140002390
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Terminate process
Terminate thread

Disassembly:
test rcx, rcx
jne 0x140002399
lea eax, [rcx - 1]
ret
jmp 0x1400064b0
jmp 0x14001e590
push rbx
push rsi
sub rsp, 0x38
mov rsi, rcx
mov byte [rsp + 0x58], 0
mov ecx, 0x28
call fcn.1400462e4
mov rbx, rax
test rax, rax
je 0x14001e6cc
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
xor ecx, ecx
mov qword [rbx], rsi
mov rdi, rax
mov dword [rbx + 0x10], ecx
lea rax, [rsp + 0x58]
mov qword [rbx + 0x18], rcx
mov qword [rbx + 8], rax
lea r8, [0x14001d320]
lea rax, [rsp + 0x60]
mov qword [rbx + 0x20], rdi
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
je 0x14001e6bf
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001e6a8
xor edx, edx
mov qword [rsp + 0x50], rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov r8d, dword [0x140062020]
mov edx, 1
mov ecx, 0x100001
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbp, qword [rbx + 0x18]
test rdi, rdi
je 0x14001e683
mov edx, 0x64
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001e683
mov rcx, rbp
call fcn.1400462d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
movzx eax, byte [0x1400821f0]
mov rbp, qword [rsp + 0x50]
test al, al
je 0x14001e6a8
lea r8, [0x140085150]
xor ecx, ecx
lea rdx, [0x140083028]
call fcn.14000f2e0
test rdi, rdi
je 0x14001e6b6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1400462d0
mov rdi, qword [rsp + 0x30]
movsx eax, byte [rsp + 0x58]
add rsp, 0x38
pop rsi
pop rbx
ret
Function at 0x1400034f0
Capabilities:
Query or enumerate registry value

Disassembly:
movzx eax, byte [section.jkl.bss]
test al, al
jne 0x140003501
mov eax, 0xffffffff
ret
jmp 0x140009a90
push rbx
push rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rbx, rcx
mov qword [rcx], rsi
lea rcx, [0x140083520]
mov qword [rsp + 0x68], rsi
call fcn.14000c1c0
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140011c30
mov rdx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140009b90
lea rcx, [0x140083570]
mov dword [rsp + 0x58], 4
call fcn.14000c020
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov rdi, rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140009b7d
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x140009b7d
lea edx, [rsi + 1]
call fcn.1400462ec
lea rcx, [rsp + 0x50]
mov qword [rbx], rax
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x140009b7d
mov rcx, qword [rbx]
call fcn.1400462d0
lea eax, [rsi - 1]
mov qword [rbx], rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.1400462d0
mov rcx, qword [rsp + 0x68]
call fcn.1400462d0
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400037a0
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1400037b7
lea eax, [rcx + 2]
add rsp, 0x20
pop rbx
ret
mov rax, qword [0x140062008]
test rax, rax
jne 0x1400037d7
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140062008], rax
mov rax, qword [0x140062008]
test rax, rax
je 0x14000388d
mov rcx, qword [0x140062008]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x14000388d
movzx eax, byte [0x140082090]
test al, al
je 0x140003824
mov rcx, qword [0x140062008]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, 0x70
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
mov qword [rsp + 0x30], rdi
call fcn.140002010
mov edi, eax
test eax, eax
jne 0x140003873
mov rcx, rbx
call fcn.1400010b0
call fcn.140006d50
call fcn.140011280
mov r8d, eax
mov eax, 0x1b4e81b5
mul r8d
shr edx, 6
imul ecx, edx, 0x258
sub r8d, ecx
mov dword [0x140062004], r8d
call fcn.14000efc0
mov byte [section.jkl.bss], 1
mov rcx, qword [0x140062008]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov eax, reloc.OLEAUT32.dll_SafeArrayDestroy
add rsp, 0x20
pop rbx
ret
Function at 0x140008b10
Capabilities:
Set registry value

Disassembly:
movzx ecx, byte [0x1400820b4]
jmp 0x1400138e0
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x30
movzx ebp, cl
lea rcx, [0x140083bd0]
call fcn.140027c80
mov rdi, rax
test rax, rax
jne 0x14001390c
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
xor ecx, ecx
mov qword [rsp + 0x50], rsi
xor sil, sil
call fcn.14000cbd0
mov rbx, rax
test rax, rax
je 0x140013985
xor ecx, ecx
mov dword [rsp + 0x28], 4
test bpl, bpl
lea rax, [rsp + 0x48]
mov r9d, 4
mov qword [rsp + 0x20], rax
setne cl
mov rdx, rbx
mov dword [rsp + 0x48], ecx
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x140013962
add r8, r8
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
mov sil, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x40]
movzx eax, sil
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140008bc0
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
jmp 0x1400139b0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov esi, ecx
lea rcx, [0x140083c00]
call fcn.140027c80
mov rdi, rax
test rax, rax
je 0x140013a52
xor ecx, ecx
call fcn.14000cbd0
mov rbx, rax
test rax, rax
je 0x140013a52
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], esi
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x140013a20
add r8, r8
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor al, al
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000c020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov word [rsp + 0x39], 0x1b09
mov byte [rsp + 0x38], SafeArrayDestroy
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14000c050
movsxd rbx, eax
mov r14d, 1
mov edx, r14d
mov rsi, rbx
lea rcx, [rbx + 1]
call fcn.1400462ec
mov r9, rax
test rax, rax
je 0x14000c1aa
dec rbx
test rsi, rsi
je 0x14000c0d0
lea r10, [rax + rbx]
sub rdi, r9
movabs r11, 0xaaaaaaaaaaaaaaab
nop word [rax + rax]
mov rcx, rbx
lea r10, [r10 - 1]
mov r8, rbx
mov rax, r11
mul rbx
dec rbx
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rcx, rax
movzx eax, byte [rsp + rcx + 0x38]
xor al, byte [rdi + r10 + 1]
mov byte [r10 + 1], al
test r8, r8
jne 0x14000c0a0
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x14000c0e0
test rax, rax
je 0x14000c1a7
sub r14, r9
mov r8, r9
neg r8
mov rdx, r9
nop
cmp byte [rdx], 0x5c
jne 0x14000c183
movzx ecx, byte [rdx + 1]
lea eax, [rcx - 0x6e]
test al, 0xf9
jne 0x14000c183
cmp cl, 0x70
je 0x14000c183
lea rax, [r8 + rdx]
test rax, rax
je 0x14000c183
cmp byte [rdx - 1], 0x5c
je 0x14000c183
cmp cl, 0x6e
jne 0x14000c12e
mov byte [rdx], 0xa
jmp 0x14000c140
cmp cl, 0x74
jne 0x14000c138
mov byte [rdx], 9
jmp 0x14000c140
cmp cl, 0x72
jne 0x14000c140
mov byte [rdx], SafeArrayDestroy
lea rcx, [r14 + rdx]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x14000c150
cmp rcx, rax
jae 0x14000c183
nop
movzx eax, byte [rcx + r9 + 1]
mov byte [rcx + r9], al
inc rcx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r9 + rax], 0
jne 0x14000c174
cmp rcx, rax
jb 0x14000c160
inc rdx
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [r9 + rcx], 0
jne 0x14000c190
lea rax, [r8 + rdx]
cmp rax, rcx
jb 0x14000c100
mov rax, r9
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000d4b0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x40]
mov eax, 1
test ecx, ecx
cmovne eax, ecx
add rsp, 0x58
ret

Function at 0x14000d680
Capabilities:
Get hostname

Disassembly:
sub rsp, 0x28
xor edx, edx
mov dword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14000d719
mov ecx, eax
mov qword [rsp + 0x20], rbx
add rcx, rcx
call fcn.1400462e4
mov rbx, rax
test rax, rax
je 0x14000d702
lea r8, [rsp + 0x30]
mov rdx, rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x14000d70c
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14000d6e0
add r8, r8
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000e260
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetPhysicallyInstalledSystemMemory]
test eax, eax
je 0x14000e282
mov rcx, qword [rsp + 0x70]
call fcn.140025a10
add rsp, 0x68
ret
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], MsiGetPropertyW
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x14000e2ac
mov rcx, qword [rsp + 0x28]
shr rcx, 0xa
call fcn.140025a10
add rsp, 0x68
ret
xor eax, eax
add rsp, 0x68
ret
Function at 0x140011280
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140062010]
test rax, rax
jne 0x1400112c7
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140062010], rax
mov dword [0x14006201c], 0
test rax, rax
jne 0x1400112c7
mov dword [0x14006201c], 1
mov eax, 1
add rsp, 0x28
ret
mov edx, 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400112ec
mov eax, dword [0x14006201c]
inc eax
mov dword [0x14006201c], eax
add rsp, 0x28
ret
lea rcx, [0x140062018]
mov qword [rsp + 0x20], rbx
call fcn.14004f3a4
mov rcx, qword [0x140062010]
mov ebx, dword [0x140062018]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, ebx
mov eax, 0x20005
mul ebx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0xe
imul ecx, ecx, 0x7fff
sub ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret