joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b82a0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b83f4
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x20]
nop
call fcn.005b76c0
mov qword [rsp + 0x10], 0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x88]
xor eax, eax
jmp 0x5b8344
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x5b8395
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
mov rdi, rdx
shl rdx, 3
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x48]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x18], rdx
xor ecx, ecx
jmp 0x5b83c0
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movzx r8d, byte [rbx + rsi]
or r8d, edx
mov byte [rbx + rsi], r8b
inc rcx
nop dword [rax + rax]
cmp rcx, 8
jge 0x5b833e
movzx edx, byte [rsp + rcx + 0x18]
lea rsi, [rdi + rcx]
cmp rsi, 0x20
jge 0x5b833e
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x5b83ac
mov rax, rsi
mov ecx, 0x20
call fcn.00462b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00460460
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005b82a0
Function at 0x5f5d40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5f5e15
movdqa xmm0, xmmword [0x0073a7d0]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5f5d81
movdqa xmm0, xmmword [0x0073a7e0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5f5e97
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5f5e6b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0073a068]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0073ac40]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x603740
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6038ef
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x603767
inc rcx
cmp rbx, rcx
jle 0x6038e1
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x603764
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.00505720
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x008b1f58]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005ff7e0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x6038d0
test rdx, rdx
je 0x6038c1
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ec0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x60388b
xor eax, eax
lea rbx, [0x00739e50]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006b383a]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044cf60
jmp 0x6038b2
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x006b3780]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044ce80
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
nop
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
nop
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460460
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00603740
Function at 0x1400010c0
Capabilities:
Accept command line arguments
Extract resource via kernel32 functions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400010e4
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsi], 0
lea rax, str.AFE6A462_C574_4B8A_AF43_4CC60DF4563B
mov qword [rsi + 8], rax
xor eax, eax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x16], rax
mov byte [rsi + 0x1e], 1
mov qword [rsi + 0x20], rax
mov edx, 1
mov r8d, 0xa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140001165
mov r14, rax
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140001165
mov rbx, rax
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x140001165
mov edi, eax
and eax, 1
jne 0x140001165
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140001165
and edi, 0xfffffffe
cmp word [rdi + rax - 2], 0
jne 0x140001165
mov qword [rsi + 0x20], rax
lea rdi, [rsp + 0x34]
mov dword [rdi], 0
mov qword [rsp + 0x20], 2
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallBrave
lea r8, str.ChromeInstallerCleanup
mov rcx, 0xffffffff80000001
mov r9, rdi
call fcn.140003d00
cmp word [rdi], 0x30
setne cl
xor al, 1
or al, cl
mov byte [rsi + 0x1e], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rsi
mov rdx, rax
call fcn.1400011c0
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400011c0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov qword [rcx + 0x10], rdx
lea rbx, [rcx + 0x18]
mov rcx, rdx
mov rdx, rbx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
mov qword [rsi], rax
test rax, rax
je 0x140001259
cmp dword [rbx], 2
jl 0x14000121d
mov ebp, 1
lea r14, str.__system_level
mov r13, qword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea r15, str.__chrome_beta
lea r12, str.__chrome_dev
jmp 0x1400012a2
cmp byte [rsi + 0x1c], 0
jne 0x140001259
xor eax, eax
lea rbx, [rsp + 0x22]
mov word [rbx + 4], ax
mov word [rbx], ax
lea rcx, str.BraveSoftwareUpdateIsMachine
mov rdx, rbx
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 1
sete al
cmp word [rbx], 0x31
sete cl
and cl, al
mov byte [rsi + 0x1c], cl
test rdi, rdi
setne al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.CB2150F2_595F_4633_891A_E39720CE0531
jmp 0x14000128f
lea rax, str.C6CB981E_DB30_4876_8639_109F8933582C
jmp 0x14000128f
mov byte [rsi + 0x1c], 1
jmp 0x140001293
lea rax, str.103BD053_949B_43A8_9120_2E424887DE11
mov qword [rsi + 8], rax
inc rbp
movsxd rax, dword [rbx]
cmp rbp, rax
jge 0x14000121d
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
mov rdx, r14
call r13
test eax, eax
je 0x140001282
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
mov rdx, r15
call r13
test eax, eax
je 0x140001288
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
mov rdx, r12
call r13
test eax, eax
je 0x140001270
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
lea rdx, str.__chrome_sxs
call r13
test eax, eax
je 0x140001279
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
lea rdx, str.__cleanup
call r13
test eax, eax
je 0x140001318
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
lea rdx, str.__chrome_frame
call r13
test eax, eax
jne 0x140001293
mov byte [rsi + 0x1d], 1
jmp 0x140001293
Function at 0x140001ac0
Capabilities:
Self delete using alternate data streams

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rdi, rcx
mov dword [rdx], 1
mov r15, qword [sym.imp.KERNEL32.dll_CreateFileW]
xorps xmm6, xmm6
lea rbx, [rsp + 0x40]
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001b2a
mov rcx, r14
call r13
mov eax, dword [rsi]
cmp eax, 0x64
je 0x140001c86
inc eax
mov dword [rsi], eax
mov rax, qword [0x1400070b8]
test rax, rax
je 0x140001b88
mov rcx, qword [0x1400070c0]
call qword [0x140009008]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0x10000
mov r8d, 7
xor r9d, r9d
call r15
cmp rax, 0xffffffffffffffff
je 0x140001ba6
mov r14, rax
mov byte [rsp + 0x40], 1
mov rcx, rax
mov edx, 4
mov r8, rbx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x140001b95
mov rcx, r14
call r13
jmp 0x140001b2a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001b2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov rcx, r14
call r13
jmp 0x140001baf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov ebp, r12d
and ebp, 0xfffffffe
cmp ebp, 2
je 0x140001c86
cmp r12d, 0x91
je 0x140001b02
cmp r12d, 0x20
je 0x140001b02
cmp r12d, 5
jne 0x140001c86
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0x180
mov r8d, 7
xor r9d, r9d
call r15
cmp rax, 0xffffffffffffffff
je 0x140001b02
mov r14, rax
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x60], 0
mov rcx, rax
xor edx, edx
mov r8, rbx
mov r9d, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
je 0x140001afc
mov eax, dword [rsp + 0x60]
test al, 1
je 0x140001afc
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 0x28
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
mov r12d, eax
mov rcx, r14
call r13
test r12d, r12d
jne 0x140001b2a
jmp 0x140001b02
cmp ebp, 2
sete al
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140002120
Capabilities:
Create process on windows
Get file attributes

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov edi, r9d
mov rbx, rdx
mov rsi, rcx
xorps xmm0, xmm0
lea rax, [rsp + 0x80]
movaps xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x60], rcx
movaps xmmword [rax + 0x50], xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x20], xmm0
movaps xmmword [rax + 0x10], xmm0
mov dword [rax], 0x68
lea rdx, [rsp + 0x60]
mov qword [rdx + 0x10], rcx
movaps xmmword [rdx], xmm0
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, r8
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140002210
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x5c], 0
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400021e9
mov edi, 0x6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], edi
mov dword [rsi + 4], eax
mov rax, rsi
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400021ca
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edi, dword [rsp + 0x5c]
jmp 0x1400021d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp ebp, 3
je 0x140002239
cmp ebp, 2
je 0x1400021d5
mov eax, dword [rsp + 0x138]
mov dword [rsi], eax
mov dword [rsi + 4], ebp
jmp 0x1400021da
mov ecx, dword [rsp + 0x130]
mov dword [rsi], ecx
jmp 0x1400021d7
Function at 0x140002f80
Capabilities:
Get disk information

Disassembly:
push rsi
push rdi
sub rsp, 0x2a8
mov rsi, rdx
mov qword [rdx], 0
xor eax, eax
lea rdx, [rsp + 0x4e]
mov word [rdx + 0x208], ax
mov word [rdx], ax
mov dword [rsp + 0x40], 0
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x14000307f
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0
lea rcx, [rsp + 0x4e]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x14000307f
test byte [rsp + 0x40], 8
mov dil, 1
je 0x140003082
lea rcx, [rsp + 0x40]
mov qword [rcx], 0
call fcn.140002ea0
xor edi, edi
test al, al
je 0x140003082
lea rcx, [rsp + 0x4e]
mov word [rcx + 0x258], di
mov word [rcx], di
lea r8, str.D:PAI_A__FA___BA__A_OIIOCI_GA___BA__A__FA___SY__A_OIIOCI_GA___SY__A_OIIOCI_GA___CO__A__FA___
mov edx, 0x12c
call fcn.1400037b0
test al, al
je 0x140003072
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x4e]
mov edx, 0x12c
call fcn.1400037b0
test al, al
je 0x140003070
lea r8, [0x140005616]
lea rcx, [rsp + 0x4e]
mov edx, 0x12c
call fcn.1400037b0
test al, al
jne 0x14000308e
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140003082
mov dil, 1
mov eax, edi
add rsp, 0x2a8
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x4e]
mov edx, 1
mov r8, rsi
xor r9d, r9d
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
setne dil
jmp 0x140003072
Function at 0x1400030b0
Capabilities:
Create directory
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, r8
mov rdi, rdx
mov r15, rcx
mov qword [r8], 0x6c
mov edx, 0x104
mov rcx, rdi
mov r8, r15
call fcn.140003770
test al, al
je 0x140003117
lea r8, [0x1400056f2]
mov ebx, 0x104
mov edx, 0x104
mov rcx, rdi
call fcn.1400037b0
test al, al
je 0x140003117
mov edx, 0x104
mov rcx, rdi
call fcn.140003740
sub rbx, rax
cmp rbx, 0xb
jae 0x14000312a
xor eax, eax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x38]
movaps xmmword [rdx - 8], xmm0
mov qword [rdx + 8], 0
mov dword [rdx - 8], 0x18
mov rcx, r15
call fcn.140002f80
test al, al
jne 0x140003167
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 0x75
mov qword [rsi], rax
jmp 0x140003117
mov qword [rsi], 0x6d
lea r15, [rdi + r14*2]
mov rbp, r14
add rbp, 5
mov r13d, 0xfffffff6
lea r12, [rsp + 0x2c]
jmp 0x1400031fb
lea r8, [0x140005624]
mov edx, 0x104
mov rcx, rdi
call fcn.1400037b0
mov qword [rsi], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400031b1
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [rsi], 0
sete al
jmp 0x140003119
mov word [rdi + r14*2 + 0xa], 0
mov edx, 0x104
mov rcx, rdi
lea r8, str..tmp
call fcn.1400037b0
mov rdx, qword [rsp + 0x38]
test rdx, rdx
lea rax, [rsp + 0x30]
cmovne rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140003186
inc r13d
je 0x1400031a1
mov rcx, r12
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
mov edx, 4
mov rcx, r12
mov r8, r15
mov r9, rbx
call fcn.1400036e0
cmp rbp, 0x103
ja 0x1400031c4
jmp 0x1400031bc
Function at 0x140003a20
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x248
mov rbx, rdx
mov rsi, rcx
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140003b2b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140003b2b
mov rdi, rax
lea r14, [rsp + 0x30]
mov rcx, r14
call fcn.140001cb0
mov rcx, r14
mov rdx, rbx
call fcn.140001d10
test al, al
je 0x140003b1d
mov rdx, qword [rsi]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov sil, 1
test eax, eax
je 0x140003b1f
mov r13d, eax
xor ebp, ebp
mov ebx, 0x800000
mov r14, qword [sym.imp.KERNEL32.dll_WriteFile]
mov r15, r13
sub r15, rbp
cmp r15, rbx
cmovae r15, rbx
mov dword [rsp + 0x2c], 0
lea r12, [rdi + rbp]
lea rcx, [rsp + 0x30]
call fcn.140001e80
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r12
mov r8d, r15d
lea r9, [rsp + 0x2c]
call r14
test eax, eax
je 0x140003af8
add rbp, r15
cmp rbp, r13
jb 0x140003aad
jmp 0x140003b1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.140001dc0
mov rcx, rdi
call fcn.140001cd0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
lea rcx, [rsp + 0x30]
call fcn.140001cd0
jmp 0x140003b2d
xor esi, esi
mov eax, esi
add rsp, 0x248
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140003b80
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, r9
mov rsi, r8
lea r9, [rsp + 0x34]
mov dword [r9], 0
lea eax, [rdi + rdi]
lea r8, [rsp + 0x30]
mov dword [r8], eax
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140003bc4
add rsp, 0x38
pop rdi
pop rsi
ret
mov eax, 0x32
cmp dword [rsp + 0x34], 1
jne 0x140003bbd
mov ecx, dword [rsp + 0x30]
cmp rcx, 2
jb 0x140003bf8
mov eax, ecx
and eax, 0xfffffffe
cmp word [rax + rsi - 2], 0
je 0x140003bfd
shr rcx, 1
mov eax, 0xea
cmp rcx, rdi
jae 0x140003bbd
lea rsi, [rsi + rcx*2]
mov word [rsi], 0
xor eax, eax
jmp 0x140003bbd

Function at 0x140003c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea r9, [rsp + 0x34]
mov dword [r9], 0
lea rax, [rsp + 0x30]
mov dword [rax], 4
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140003c4a
add rsp, 0x38
ret
mov eax, 0x32
cmp dword [rsp + 0x34], 4
jne 0x140003c45
xor ecx, ecx
cmp dword [rsp + 0x30], 4
mov eax, 0xe8
cmove eax, ecx
jmp 0x140003c45
Function at 0x140003c70
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140003cc0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret

Function at 0x140003d00
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, r9
mov rdi, r8
lea rax, [rsp + 0x38]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
xor ebx, ebx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003d75
mov rbx, qword [rsp + 0x80]
lea r9, [rsp + 0x34]
mov dword [r9], 0
lea eax, [rbx + rbx]
lea rdx, [rsp + 0x30]
mov dword [rdx], eax
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140003d8f
test eax, eax
sete bl
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140003d85
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov eax, 0x32
cmp dword [rsp + 0x34], 1
jne 0x140003d70
mov ecx, dword [rsp + 0x30]
cmp rcx, 2
jb 0x140003dbe
mov edx, ecx
and edx, 0xfffffffe
cmp word [rdx + rsi - 2], 0
je 0x140003dc3
shr rcx, 1
cmp rcx, rbx
jae 0x140003d70
lea rsi, [rsi + rcx*2]
mov word [rsi], 0
xor eax, eax
jmp 0x140003d70

Function at 0x140003f10
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140003f88
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140003f88
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140003f88
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140003f7c
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140003f9a
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140003f6a
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140003f8a
Function at 0x1419a1d98
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs r11, 0
setnp dl
cdq
push r11
movzx ax, r8b
cmovo di, bx
cwd
mov rsi, qword [rsp + 0x90]
rdtsc
bswap bp
dec bpl
not esi
rdtsc
cmovo ax, r14w
movsx di, r10b
bswap esi
not rdi
inc esi
rcr r8, 0x60
cmc
movzx edi, bp
rol esi, 1
rdtsc
inc esi
not esi
lahf
ror rdx, cl
rdtsc
ror esi, 1
adc r8b, 0x96
add rsi, r11
lahf
rdtsc
movabs rdx, 0x100000000
btc r8w, 0xf6
movzx ebp, dx
add rsi, rdx
xor r8, 0x2d4f19c6
cbw
rcl dil, cl
mov rdi, rsp
bsf r8w, r14w
sub rsp, 0x180
test si, r11w
and rsp, 0xfffffffffffffff0
or ah, 0x45
mov r8, rsi
rol rbp, 0xc3
movabs rax, 0
bts r11d, esp
btr r11w, bx
sub r8, rax
lea rbp, [0x1418804c2]
sbb r11b, 0x98
sub rsi, 4
and r11w, 0x20f0
btr r11d, esi
shld r11, rbx, 0x82
mov r11d, dword [rsi]
test ebx, r11d
xor r11d, r8d
test rsi, rdi
test al, 0x21
neg r11d
ror r11d, 2
test r12b, 0xc7
neg r11d
jmp 0x141948a40
push rcx
jmp 0x1418fe4e0
push rsi
mov esi, r15d
push rax
movsx si, bpl
lahf
cwde
push r13
movsx eax, r9w
push r9
push r12
push r11
push r14
pushfq
dec al
bswap esi
movsx eax, r9w
push rbp
movsx si, r8b
xchg r11d, r11d
movsx esi, sp
push rdi
movzx si, dil
jmp 0x1419a3a34
jmp rbp
push r8
mov bp, 0x65d7
jmp 0x141880404
dec r11d
push r8
xor dword [rsp], r11d
adc r8b, 0x6c
movsx r8w, bl
pop r8
movsxd r11, r11d
jmp 0x1419ace10
push r10
jmp 0x14188d388
push rbx
dec dil
movsxd rax, r15d
push rdx
movzx rsi, bx
dec di
push r15
dec r11b
jmp 0x1419176aa
add rbp, r11
jmp 0x14190008a