joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140065b50
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140035ac0
lea rcx, [rsp + 0x48]
call fcn.140035ac0
call fcn.14003ee30
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1400359b0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140065bbf
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140035b50
lea rcx, [rsp + 0x78]
call fcn.140035b50
mov eax, dword [rsp + 0x24]
jmp 0x140065c50
call fcn.14003ee30
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1400359b0
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140065c06
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140035b50
lea rcx, [rsp + 0x78]
call fcn.140035b50
mov eax, dword [rsp + 0x2c]
jmp 0x140065c50
lea rcx, [rsp + 0x48]
call fcn.140035e80
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140035e80
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140035b50
lea rcx, [rsp + 0x78]
call fcn.140035b50
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x14001a530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push r13
push r14
sub rsp, 0xb8
mov r13, rcx
movsxd rax, r9d
xor ecx, ecx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0xe8], ecx
mov r14, rdx
test r9d, r9d
jle 0x14001a792
mov qword [r11 + 8], rbx
lea rbx, [r8 + 0x20]
mov qword [r11 + 0x10], rbp
movzx ebp, byte [r13 + 0x24]
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x18], rdi
mov edi, 0x100
mov qword [r11 - 0x20], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movaps xmmword [r11 - 0x58], xmm8
movzx r11d, byte [r13 + 0x20]
movss xmm8, dword [0x1400401f0]
nop word [rax + rax]
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14001a5fa
movsxd r10, dword [r14 + 0x24]
mov r9, qword [r14 + 8]
movsx ecx, di
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, di
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
movd xmm0, eax
jmp 0x14001a619
movsxd rdx, dword [r14 + 0x1c]
xorps xmm6, xmm8
mov rax, qword [r14 + 8]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
xor edi, edi
mov byte [rbx], r11b
mov byte [rbx + 1], bpl
divss xmm6, xmm0
cmp dword [rbx - 0x10], edi
jle 0x14001a730
mov r15, qword [rsp + 0xf0]
mov rax, r12
shl rax, 4
add r15, 6
xor esi, esi
add r15, rax
nop word [rax + rax]
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x14001a660
mov edx, dword [rbx - 0x1c]
add edx, edi
jmp 0x14001a663
mov edx, dword [rax + rsi]
mov eax, dword [r13 + 0x24]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rcx, r14
cvtsi2ss xmm3, rax
mov eax, dword [r13 + 0x20]
cvtsi2ss xmm2, rax
mulss xmm3, xmm6
mulss xmm2, xmm6
call fcn.140015860
mov edx, eax
mov rcx, r14
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.140018190
movzx ecx, word [r13 + 0x1c]
inc r12
movzx r11d, word [r13 + 0x20]
movzx eax, cx
sub ax, word [rsp + 0x50]
dec cx
movzx ebp, word [r13 + 0x24]
dec ax
add ax, r11w
inc edi
add ax, word [rsp + 0x54]
add rsi, 4
mov word [r15 - 2], ax
movzx eax, bp
sub ax, word [rsp + 0x58]
add ax, cx
mov ecx, dword [rsp + 0xe8]
add ax, word [rsp + 0x5c]
inc ecx
mov word [r15], ax
add r15, 0x10
mov dword [rsp + 0xe8], ecx
cmp edi, dword [rbx - 0x10]
jl 0x14001a650
jmp 0x14001a737
mov ecx, dword [rsp + 0xe8]
add rbx, 0x28
mov edi, 0x100
sub qword [rsp + 0x60], 1
jne 0x14001a5b0
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
mov eax, ecx
add rsp, 0xb8
pop r14
pop r13
ret
Function at 0x140032460
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140047040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebx, r8d
mov rdi, rdx
xor edx, edx
cmp ecx, 0x7b
ja 0x140032494
movsxd rax, ecx
lea rdx, [0x140047210]
mov rdx, qword [rdx + rax*8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x14003fcf0]
movdqu xmmword [rsp + 0x48], xmm1
mov byte [rsp + 0x38], 0
test rdx, rdx
jne 0x1400324c3
mov r8d, 0xa
lea rdx, str.Select_Key
jmp 0x1400324da
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400324d0
lea rcx, [rsp + 0x38]
call fcn.140037b10
cmp ebx, 1
jne 0x140032500
mov r8d, 9
lea rdx, str.Press_Key
lea rcx, [rsp + 0x38]
call fcn.140037b10
mov dword [rsp + 0x30], 0x42fa0000
mov dword [rsp + 0x34], 0x41c80000
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
call fcn.1400247a0
test al, al
je 0x140032551
test ebx, ebx
jne 0x140032551
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140032591
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003258c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003258c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140039124
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140038d10
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140039a40
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140039a8a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140039a8a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140039a8a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140039a8a
cmp dword [rcx + 0x84], 0xe
jbe 0x140039a8a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140039a8c
xor al, al
add rsp, 0x28
ret
Function at 0x1400010a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
cpuid
mov eax, 1
cpuid
movabs r9, 0xb2d05e00
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
fldpi
frndint
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, r9
jb 0x1400010c8
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0x12345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x1400010f3
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x1400010ec
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret

Function at 0x140003000
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14012e928]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
lea rdi, [0x1401312e0]
mov qword [rsp + 0x28], rdi
mov rcx, rdi
call 0x140037120
test eax, eax
jne 0x140003055
mov rax, qword [0x140131330]
nop
test rax, rax
je 0x140002eec
xor ebx, ebx
jmp 0x14000302d
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x140002f04
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400029d0
nop
mov r8d, 0x13
lea rdx, [0x1400ed8f0]
lea rcx, [rsp + 0x30]
call fcn.1400032d0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
call qword [0x1400ec180]
mov rbx, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140002f8a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000304f
call 0x14006e080
movdqa xmm0, xmmword [0x1400ed8e0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
xchg qword [0x140131330], rbx
mov rax, qword [0x140131330]
nop
test rax, rax
jne 0x140002fb6
lea ebx, [rax + 0x23]
jmp 0x14000302d
mov rcx, qword [0x140131330]
nop
lea rdx, [0x1400ed908]
call qword [0x1400ec188]
test rax, rax
je 0x140002ff3
xor ebx, ebx
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x20]
call qword [0x1400ec4a8]
mov rax, qword [rsp + 0x20]
mov qword [0x140131338], rax
test rax, rax
jne 0x140002ffa
mov ebx, 5
jmp 0x14000302d
mov rcx, qword [rax + 0x28]
mov qword [rax - 0x77], rcx
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
xor esi, esi
mov rbx, r8
mov r13, rdx
and dword [rbp + 0x7f], esi
and dword [r8], esi
mov r12d, ecx
test r9d, r9d
je 0x140003039
or edi, edi
adc eax, 0x5ff4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
jmp 0x14000303c
mov r8d, ecx
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140003148
and qword [rbp + 0x77], rsi
lea r8, [rbp + 0x77]
mov edx, 0x2000000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
invalid
invalid
invalid
Function at 0x140003198
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, r9
mov rsi, r8
mov r13, rdx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r12d, r12d
test rax, rax
jne 0x1400031d9
mov eax, 0x5e2e
jmp 0x1400033e3
mov rcx, rax
call fcn.14000316c
mov rbx, rax
test rax, rax
je 0x1400033de
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test eax, eax
jle 0x1400033de
lea ecx, [rax + 3]
movsxd rcx, ecx
add rcx, rcx
call fcn.1400036d8
mov qword [rsi], rax
test rax, rax
jne 0x140003220
mov eax, 0x5e30
jmp 0x1400033e3
mov ecx, 0x20
lea r8d, [rdi + 1]
mov rdx, rbx
mov word [rax], cx
mov rcx, qword [rsi]
add rcx, 2
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, qword [rsi]
lea rdx, [0x1400092a0]
call fcn.14000352c
mov rcx, qword [rsi]
lea rdx, [0x1400092b8]
mov r15, rax
call fcn.14000352c
mov qword [r14], rax
test r15, r15
je 0x1400033d6
test rax, rax
je 0x1400033d6
mov rcx, qword [rsi]
lea rdx, [0x1400092e0]
call fcn.14000352c
mov rcx, qword [rsi]
lea rdx, [0x140009308]
mov rbp, rax
call fcn.14000352c
mov rcx, qword [rsi]
lea rdx, [0x140009328]
mov rdi, rax
call fcn.14000352c
mov rcx, qword [rsi]
lea rdx, str.__IMP64RETRNPID
mov rbx, rax
call fcn.14000352c
mov rcx, qword [rsp + 0x80]
test rax, rax
mov edx, r12d
setne dl
mov dword [rcx], edx
test rbp, rbp
jne 0x1400032d5
mov dword [r13], r12d
lea rcx, str.__IMP64WAITFOREND
mov word [rbp], r12w
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rbp, [rbp + rcx*2]
mov rcx, qword [rsi]
call fcn.14000368c
mov eax, 0x5e2f

Function at 0x140003ff4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140003e64

Function at 0x140006cc8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14000cde0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140005038
xor ebx, ebx
cmp qword [0x14000d950], rbx
mov rdi, rax
jne 0x140006ddb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140006eb2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
test eax, eax
mov rax, qword [0x14000d968]
Function at 0x1400085a7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000cde0]
jne 0x14000711a
rol rcx, 0x10
test cx, 0xffff
jne 0x140007116
repz ret
ror rcx, 0x10
jmp 0x140008500
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000da30]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14000db28]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140008585
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000da30]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400085a7
mov rax, qword [rsp + 0x88]
mov qword [0x14000db28], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000dac8], rax
mov rax, qword [0x14000db28]
mov qword [0x14000d9a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000dab0], rax
mov dword [0x14000d990], 0xc0000409
mov dword [0x14000d994], 1
mov rax, qword [0x14000cde0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000cde8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000da28], eax
mov ecx, 1
call fcn.140007414
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000ace0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000da28], 0
jne 0x14000862e
mov ecx, 1
call fcn.140007414
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140001220
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x248
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
je 0x140001292
mov edx, eax
lea rcx, str._OpsdfadfSec__couasdfsadfld_nasdfot_remsadfasfdove_servsadfasdfice_regisasdfsadftry_ksadfey:__d_n
call fcn.1400011c0
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140001ac0
add rsp, 0x248
ret
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140001ac0
add rsp, 0x248
ret
Function at 0x1400012b0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x6b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
xorps xmm0, xmm0
lea rcx, [rsp + 0x490]
xor edx, edx
mov r8d, 0x208
movups xmmword [rsp + 0x60], xmm0
call sub.VCRUNTIME140.dll_memset
xor ebx, ebx
lea rcx, [rsp + 0x280]
xor edx, edx
mov qword [rsp + 0x50], rbx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x5c]
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x280]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x5c], ebx
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000136e
lea rcx, str.SetRegdfistrsdfyValues.RegCreatsdfsdeKeyExA:__d_n
jmp 0x140001476
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea rdx, str.Type
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400013ab
lea rcx, str.SetasfdRegistrasdfyValues.RegasfSetVasdfalueEx.Type:__d_n
jmp 0x140001476
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea rdx, str.ErrorControl
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400013e8
lea rcx, str.SetRegistryValues.RegSetValueEx.ErrorControl:__d_n
jmp 0x140001476
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea rdx, str.Start
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140001422
lea rcx, str.SetRegistryasfdValues.RegSetVaasfdlueEx.Start:__d_n
jmp 0x140001476
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
nop
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x140001430
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.ImagePath
lea rax, [rsp + 0x70]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140001490
lea rcx, str.SetRegistrasfdyValues.RegSetVaasfdlueEx.ImaasdfgePath:__d_n
mov edx, eax
call fcn.1400011c0
lea rcx, str.NtUnlosdfadDriasfver.SetsadfRegisadfstryKeasdfyValusadfes
call fcn.1400011c0
mov eax, 0xffffffff
jmp 0x1400014d7
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x60]
call qword [0x1400056a0]
lea rcx, [rsp + 0x60]
call qword [0x140005688]
test eax, eax
je 0x1400014d2
cmp eax, 0xc000010e
je 0x1400014d2
cmp eax, 0xc0000035
je 0x1400014d2
mov edx, eax
lea rcx, str.NtadsfLoaasdfdDrisadfver:__x_n
call fcn.1400011c0
xor eax, eax
jmp 0x1400014d7
mov eax, 1
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.140001ac0
add rsp, 0x6b0
pop rbx
ret
Function at 0x140002380
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400023ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400023ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400023ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400023ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400023ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400023cc
xor al, al
add rsp, 0x28
ret
Function at 0x1400066c0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14000f960], rbx
je 0x140006727
cmp rax, rbx
jne 0x14000671a
mov ebx, 1
mov esi, ebx
jmp 0x14000672c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400066ff
mov ebx, 1
mov eax, dword [0x14000f968]
cmp eax, ebx
jne 0x140006744
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x1400067b0
mov eax, dword [0x14000f968]
test eax, eax
jne 0x1400067a5
mov dword [0x14000f968], ebx
lea r15, [0x1400089b8]
lea rdi, [0x1400089a0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x140006797
test eax, eax
jne 0x14000679b
cmp qword [rdi], r14
je 0x14000678c
mov rax, qword [rdi]
mov rcx, qword [0x140008920]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000676e
test eax, eax
je 0x1400067ab
mov eax, 0xff
jmp 0x140006906
mov dword [0x14000d3e4], ebx
mov edi, 0x1f
mov eax, dword [0x14000f968]
cmp eax, ebx
jne 0x1400067d7
lea rdx, [0x140008998]
lea rcx, [0x140008928]
call sub.msvcrt.dll__initterm
mov dword [0x14000f968], 2
test esi, esi
jne 0x1400067e5
mov rax, r14
xchg qword [0x14000f960], rax
cmp qword [0x14000f970], r14
je 0x140006818
lea rcx, [0x14000f970]
call fcn.140006b30
test eax, eax
je 0x140006818
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000f970]
mov r9, qword [0x140008920]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140006831
mov eax, 0xff
jmp 0x140006906
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x1400068b7
test ax, ax
je 0x14000684c
test edx, edx
jne 0x1400068b7
sub ax, bx
cmp ax, di
ja 0x140006862
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000684c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400013dc
mov dword [0x14000d3e0], eax
cmp dword [0x14000d400], r14d
jne 0x1400068a0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000d3e4], r14d
jne 0x1400068b5
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000d3e0]
jmp 0x140006906
cmp ax, 0x22
jne 0x1400068cb
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000683a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140197000
add rsp, 0x28
jmp 0x1400066c0
Function at 0x140001400
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14000fe58], eax
jle 0x14000157f
lea rcx, [0x14000fe58]
call fcn.140006d98
cmp dword [0x14000fe58], 0xffffffff
jne 0x14000157f
xor edx, edx
lea rcx, [0x14000eac8]
mov r8d, 0x1388
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov qword [0x14000eac0], 0
movdqa xmmword [0x14000eab0], xmm0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov r9, rax
cmp rbx, 0x989680
jne 0x14000148a
imul rax, r9, 0x64
jmp 0x140001507
cmp rbx, 0x16e3600
jne 0x1400014e9
movabs r10, 0xb2f4fc0794908cf3
mov rax, r10
imul r9
mov rax, r10
lea r8, [r9 + rdx]
sar r8, 0x18
mov rcx, r8
shr rcx, 0x3f
add r8, rcx
imul rcx, r8, 0x16e3600
sub r9, rcx
imul rcx, r9, 0x3b9aca00
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, r8, 0x3b9aca00
add rax, rdx
jmp 0x140001507
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
mov r8, rax
mov dword [0x14000fe4c], 0xffffffff
mov dword [0x14000eacc], eax
lea rbx, [0x14000eab0]
mov edx, 1
nop word [rax + rax]
mov eax, r8d
shr eax, 0x1e
xor eax, r8d
imul r8d, eax, 0x6c078965
add r8d, edx
mov dword [rbx + rdx*4 + 0x1c], r8d
inc rdx
cmp rdx, 0x270
jb 0x140001530
lea rcx, [0x140008360]
mov dword [0x14000eac8], 0x270
call fcn.140007074
lea rcx, [0x14000fe58]
call fcn.140006d2c
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x14000eab0]
add rsp, 0x20
pop rbx
ret

Function at 0x140001590
Capabilities:
Encode data using xor

Disassembly:
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, qword [rcx + 8]
mov r15, rcx
mov rdi, qword [rcx]
cmp rdi, r14
je 0x140001605
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
cmp byte [rdi + 0x14], 0
je 0x1400015ed
cmp qword [rdi + 8], 0
mov rbp, qword [rdi]
jbe 0x1400015ed
mov rsi, rbp
nop dword [rax + rax]
lea rcx, [r15 + 0x18]
call fcn.140006b10
shr eax, 0x18
xor byte [rsi], al
inc rsi
mov rax, rsi
sub rax, rbp
cmp rax, qword [rdi + 8]
jb 0x1400015d0
add rdi, 0x18
cmp rdi, r14
jne 0x1400015b8
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret