joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b7b0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, rdx
mov rsi, rcx
xor edx, edx
mov rcx, rax
xor ebx, ebx
call fcn.14000b3ac
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x14001b856
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea rcx, [rsi + 8]
mov edx, eax
mov ebx, eax
call fcn.14000cf94
mov rdx, qword [rsi + 8]
and dword [rsp + 0x50], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov ebx, eax
je 0x14001b84d
mov ecx, dword [rsi + 0x10]
sub ecx, 3
movsxd rdx, ecx
add rdx, qword [rsi + 8]
movzx r8d, byte [rdx + 2]
movzx ecx, byte [rdx + 1]
movzx eax, byte [rdx]
shl r8d, 0x10
shl ecx, 8
mov dword [rsi], 1
add r8d, ecx
add r8d, eax
mov dword [rsi + 0x1c], r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14001c34c
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
and qword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rdx, rax
mov r8d, 0x28
call fcn.14001c48c
test eax, eax
jne 0x14001c390
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x58]
mov edi, eax
jmp 0x14001c430
lea rcx, [rsp + 0x58]
call fcn.14001c44c
test eax, eax
je 0x14001c3c5
mov rcx, qword [rsp + 0x58]
lea rdx, str.LookupPrivilegeValueA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001c3c5
lea r8, [rsp + 0x34]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call rax
mov rdi, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call fcn.14001c44c
mov rbx, qword [rsp + 0x58]
test eax, eax
je 0x14001c41d
lea rdx, str.AdjustTokenPrivileges
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001c41d
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x60]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14001c43e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001cc44
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx ebx, word [rsp + 0x78]
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r8, [rsp + 0x80]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
mov r11d, dword [rsp + 0x84]
movzx eax, word [rsp + 0x82]
movzx esi, r11b
and r11d, 0xff000000
mov r15d, 0x1000
shl esi, 0x10
add esi, r11d
add esi, eax
btr esi, 0x1f
add esi, 0x1c
xor edi, edi
mov r13d, edi
lea r14d, [rsi + 4]
jmp 0x14001cd1f
mov rcx, qword [r12 + 0x20]
xor r8d, r8d
mov r9d, esi
lea edx, [r8 + 4]
and r9d, 0xfffff000
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp rax, rdi
mov rbp, rax
je 0x14001cd24
mov eax, esi
mov ecx, 4
mov edx, esi
and eax, 0xfff
sub ecx, r13d
mov ebx, r15d
sub ebx, eax
mov eax, r13d
cmp ecx, ebx
cmovb ebx, ecx
and edx, 0xfff
lea rcx, [rsp + rax + 0x78]
add rdx, rbp
mov r8d, ebx
call sub.msvcrt.dll_memcpy
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add r13d, ebx
add esi, ebx
cmp esi, r14d
jb 0x14001ccb4
test dword [rsp + 0x78], 0xfff
mov eax, edi
cmove eax, dword [rsp + 0x78]
cmp eax, edi
jne 0x14001cd86
mov rcx, qword [r12 + 0x20]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0xa0000
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r11, rax
mov eax, 0x67
lea rcx, [r11 + 0xc00]
cmp dword [rcx], eax
je 0x14001cd78
add eax, r15d
add edi, 1
add rcx, r15
cmp eax, 0xa0067
jb 0x14001cd64
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
shl edi, 0xc
jmp 0x14001cd88
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001e2ec
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov edi, edx
mov rbx, rcx
jne 0x14001e3a9
lea rcx, str.iphlpapi.dll
call fcn.14000c55c
test rax, rax
mov qword [rbx], rax
je 0x14001e3a9
lea rdx, str.GetTcpTable
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.GetUdpTable
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.SetTcpEntry
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.AllocateAndGetTcpExTableFromStack
mov qword [rbx + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.AllocateAndGetUdpExTableFromStack
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.GetExtendedTcpTable
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.GetExtendedUdpTable
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
test edi, edi
jne 0x14001e451
cmp qword [rbx + 8], 0
jne 0x14001e451
and dword [rbx + 0x10], edi
lea rcx, str.ntdll.dll
call fcn.14000c55c
test rax, rax
mov qword [rbx + 8], rax
je 0x14001e451
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.RtlInitUnicodeString
mov qword [rbx + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.ZwOpenSection
mov qword [rbx + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.ZwOpenFile
mov qword [rbx + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [rbx + 0x70], 0
mov qword [rbx + 0x88], rax
je 0x14001e451
cmp qword [rbx + 0x78], 0
je 0x14001e451
cmp qword [rbx + 0x80], 0
je 0x14001e451
test rax, rax
je 0x14001e451
mov dword [rbx + 0x10], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001e4cc
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
and word [rsp + 0x30], 0
mov rbp, rcx
mov rdi, r8
mov rsi, rdx
lea rcx, [rsp + 0x32]
mov r8d, 0xb6
xor edx, edx
call sub.msvcrt.dll_memset
lea r14d, [rdi + 0xb8]
xor r15d, r15d
cmp edi, r14d
jae 0x14001e60a
mov r13d, 0xfffff000
mov rax, qword [rbp + 0x28]
mov ecx, edi
mov r12d, edi
shr rcx, 0x16
mov eax, dword [rax + rcx*4]
test al, 1
je 0x14001e60a
test al, al
js 0x14001e588
mov rcx, qword [rbp + 0x20]
xor r8d, r8d
and eax, r13d
lea edx, [r8 + 4]
mov r9d, eax
mov qword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, r12
shr rcx, 0xc
and ecx, 0x3ff
mov ebx, dword [rax + rcx*4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test bl, 1
je 0x14001e60a
and ebx, r13d
jmp 0x14001e595
mov ebx, edi
and eax, r13d
and ebx, 0x3ff000
add ebx, eax
mov rcx, qword [rbp + 0x20]
xor r8d, r8d
mov r9d, ebx
lea edx, [r8 + 4]
mov qword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
mov r13, rax
je 0x14001e60a
mov eax, 0xfff
mov ecx, edi
mov r8d, 0xb8
and ecx, eax
sub r8d, r15d
lea ebx, [rax + 1]
sub ebx, ecx
lea rcx, [rsp + r15 + 0x30]
cmp r8d, ebx
cmovb ebx, r8d
and r12, rax
lea rdx, [r13 + r12]
mov r8d, ebx
call sub.msvcrt.dll_memcpy
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add edi, ebx
add r15d, ebx
cmp edi, r14d
mov r13d, 0xfffff000
jb 0x14001e525
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xb8
call sub.msvcrt.dll_memcpy
lea r11, [rsp + 0xf0]
mov rax, rsi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14001e644
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140032058], 0
jne 0x14001e712
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
mov rbx, rax
je 0x14001e712
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f210], rax
je 0x14001e712
lea rdx, str.Module32First
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f200], rax
je 0x14001e712
lea rdx, str.Module32Next
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f1f8], rax
je 0x14001e712
lea rdx, str.Process32First
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f0d8], rax
je 0x14001e712
lea rdx, str.Process32Next
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x140032058]
mov edx, 1
test rax, rax
mov qword [0x14002f1f0], rax
cmovne ecx, edx
mov dword [0x140032058], ecx
add rsp, 0x20
pop rbx
ret
Function at 0x14001e718
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x14003205c], 0
jne 0x14001e7fa
lea rcx, str.psapi.dll
call fcn.14000c55c
test rax, rax
mov rbx, rax
je 0x14001e7fa
lea rdx, str.GetModuleBaseNameA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f228], rax
je 0x14001e7e7
lea rdx, str.EnumProcessModules
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f218], rax
je 0x14001e7e7
lea rdx, str.GetModuleFileNameExA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f208], rax
je 0x14001e7e7
lea rdx, str.EnumProcesses
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14002f360], rax
je 0x14001e7e7
lea rdx, str.GetModuleInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x14003205c]
mov edx, 1
test rax, rax
mov qword [0x14002f220], rax
cmovne ecx, edx
mov dword [0x14003205c], ecx
jmp 0x14001e7ed
mov ecx, dword [0x14003205c]
test ecx, ecx
jne 0x14001e7fa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x20
pop rbx
ret

Function at 0x1400203cc
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x28], 0
mov rbx, rcx
jne 0x140020453
lea rcx, str.advapi32.dll
call fcn.14000c55c
lea rdx, str.OpenTraceA
mov rcx, rax
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x28]
lea rdx, str.ProcessTrace
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x28]
lea rdx, str.ControlTraceA
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x28]
lea rdx, str.StartTraceA
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x28]
lea rdx, str.CloseTraceA
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x20], rax
add rsp, 0x20
pop rbx
ret

Function at 0x140020520
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov rbx, rcx
mov r9, rcx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x140020510]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x820], rax
add rsp, 0x30
pop rbx
ret
Function at 0x140020560
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x1e0
mov rbx, rcx
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0x1b8
call sub.msvcrt.dll_memset
and qword [rsp + 0x20], 0
lea rax, str.NT_Kernel_Logger
mov qword [rsp + 0x28], rax
lea rax, [0x1400204ac]
lea rcx, [0x1400323e0]
mov qword [rsp + 0x1c8], rax
mov dword [rsp + 0x3c], 0x100
call fcn.1400203cc
mov rax, qword [0x1400323e0]
mov edi, 0xffffffff
test rax, rax
je 0x1400205db
lea rcx, [rsp + 0x20]
call rax
jmp 0x1400205de
mov rax, rdi
mov qword [rbx + 0x810], rax
mov eax, eax
cmp rax, rdi
je 0x14002067f
mov qword [0x14002f368], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [rbx + 0x828], 0
lea rcx, [0x1400323e0]
mov ebp, eax
mov dword [rbx + 0x82c], 1
call fcn.1400203cc
mov r11, qword [0x1400323e8]
test r11, r11
je 0x14002063e
xor r9d, r9d
lea rcx, [rbx + 0x810]
xor r8d, r8d
lea edx, [r9 + 1]
call r11
mov edi, eax
and dword [rbx + 0x82c], 0
cmp dword [rbx + 0x828], 0
jne 0x14002067f
test edi, edi
jne 0x14002067f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, 0x3e8
jbe 0x14002067f
mov rcx, rbx
call fcn.1400204cc
mov edx, dword [rbx + 0x830]
mov rcx, rbx
call fcn.140020698
mov rcx, rbx
call fcn.140020520
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140020f08
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x5c], 0
mov rbx, rcx
je 0x140020f1c
or eax, 0xffffffff
jmp 0x140020f7d
cmp dword [rcx + 8], 0
jne 0x140020f6a
call sub.msvcrt.dll__errno
mov edx, 1
mov r8d, 0x4000
and dword [rax], 0
mov r9, qword [rbx + 0x60]
mov rcx, qword [rbx + 0x68]
call sub.msvcrt.dll_fread
test eax, eax
mov dword [rbx + 8], eax
jne 0x140020f63
mov rcx, qword [rbx + 0x60]
mov dword [rbx + 0x5c], 1
call sub.msvcrt.dll_ferror
test eax, eax
je 0x140020f17
or dword [rbx + 0x58], 0xffffffff
jmp 0x140020f17
mov rax, qword [rbx + 0x68]
mov qword [rbx], rax
mov rax, qword [rbx]
add dword [rbx + 8], 0xffffffff
movzx ecx, byte [rax]
add rax, 1
mov qword [rbx], rax
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x140020f84
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 8]
mov ebp, 2
mov rdi, rcx
cmp ebx, ebp
jae 0x140021013
test ebx, ebx
je 0x140020fb6
mov rax, qword [rcx]
mov rcx, qword [rcx + 0x68]
mov al, byte [rax]
mov byte [rcx], al
call sub.msvcrt.dll__errno
mov ecx, ebx
mov edx, 1
and dword [rax], 0
mov r9, qword [rdi + 0x60]
mov eax, 0x4000
sar eax, cl
mov rcx, rbx
add rcx, qword [rdi + 0x68]
movsxd r8, eax
call sub.msvcrt.dll_fread
test eax, eax
mov rbx, rax
jne 0x140020ff7
mov rcx, qword [rdi + 0x60]
call sub.msvcrt.dll_ferror
test eax, eax
je 0x140020ff7
or dword [rdi + 0x58], 0xffffffff
add dword [rdi + 8], ebx
mov ecx, dword [rdi + 8]
mov rax, qword [rdi + 0x68]
cmp ecx, ebp
mov qword [rdi], rax
jae 0x140021013
mov dword [rdi + 0x90], ecx
jmp 0x140021101
mov rax, qword [rdi]
cmp byte [rax], 0x1f
jne 0x1400210f7
cmp byte [rax + 1], 0x8b
jne 0x1400210f7
add dword [rdi + 8], 0xfffffffe
add rax, rbp
mov rcx, rdi
mov qword [rdi], rax
call fcn.140020f08
mov rcx, rdi
mov ebx, eax
call fcn.140020f08
cmp ebx, 8
mov esi, eax
jne 0x1400210ee
test al, 0xe0
jne 0x1400210ee
mov ebx, 6
mov rcx, rdi
call fcn.140020f08
sub rbx, 1
jne 0x14002105d
test sil, 4
je 0x14002109e
mov rcx, rdi
call fcn.140020f08
mov rcx, rdi
mov ebx, eax
call fcn.140020f08
shl eax, 8
add ebx, eax
mov ecx, ebx
add ebx, 0xffffffff
test ecx, ecx
je 0x14002109e
mov rcx, rdi
call fcn.140020f08
cmp eax, 0xffffffff
jne 0x140021088
test sil, 8
je 0x1400210b5
mov rcx, rdi
call fcn.140020f08
test eax, eax
je 0x1400210b5
cmp eax, 0xffffffff
jne 0x1400210a4
test sil, 0x10
je 0x1400210cc
mov rcx, rdi
call fcn.140020f08
test eax, eax
je 0x1400210cc
cmp eax, 0xffffffff
jne 0x1400210bb
test bpl, sil
je 0x1400210df
mov rcx, rdi
call fcn.140020f08
sub rbp, 1
jne 0x1400210d1
mov eax, dword [rdi + 0x5c]
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
mov dword [rdi + 0x58], ecx
jmp 0x140021101
mov dword [rdi + 0x58], 0xfffffffd
jmp 0x140021101
mov dword [rdi + 0x90], 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140023b94
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov eax, dword [0x14002e074]
test eax, eax
je 0x140023cd4
xor r11d, r11d
mov dword [0x14002e074], 0
lea rdx, [0x140028a70]
lea r8d, [r11 + 0xe]
mov al, byte [rdx]
mov ecx, 0x1f
add rdx, 1
sub ecx, eax
mov eax, 1
shl eax, cl
or r11d, eax
sub r8, 1
jne 0x140023bc4
lea rdi, [0x14002fc10]
xor r9d, r9d
mov r10, rdi
mov r8d, r9d
mov ebx, 8
mov edx, r8d
mov ecx, r8d
shr edx, 1
mov eax, edx
mov r8d, edx
xor eax, r11d
and cl, 1
cmovne r8d, eax
sub rbx, 1
jne 0x140023bf6
add r9d, 1
mov dword [r10], r8d
add r10, 4
cmp r9d, 0x100
jl 0x140023bee
lea rdx, [0x140030c10]
mov ebx, 0xff00
mov r8d, dword [rdx - 0x1000]
lea r10, [rdx - 0xc00]
mov r11d, 3
mov ecx, r8d
mov eax, r8d
mov r9d, r8d
shl eax, 0x10
and ecx, ebx
shr r9d, 8
add ecx, eax
mov eax, r9d
and eax, ebx
shl ecx, 8
add ecx, eax
mov eax, r8d
shr eax, 0x18
add ecx, eax
mov dword [rdx], ecx
movzx ecx, r8b
mov r8d, dword [rdi + rcx*4]
xor r8d, r9d
mov ecx, r8d
mov eax, r8d
mov r9d, r8d
shl eax, 0x10
and ecx, ebx
shr r9d, 8
add ecx, eax
mov eax, r9d
mov dword [r10], r8d
and eax, ebx
shl ecx, 8
add r10, 0x400
add ecx, eax
mov eax, r8d
shr eax, 0x18
add ecx, eax
sub r11, 1
mov dword [r10 + 0xc00], ecx
jne 0x140023c6f
lea rax, [0x140031010]
add rdx, 4
cmp rdx, rax
jl 0x140023c33
mov dword [0x14002e070], r11d
jmp 0x140023cde
mov eax, dword [0x14002e070]
test eax, eax
jne 0x140023cd4
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x14003b000
Capabilities:
Parse pe header
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x38
and rsp, 0xfffffffffffffff0
movabs rcx, 0x14003b062
movabs rax, sym.imp.KERNEL32.dll_LoadLibraryA
call qword [rax]
movabs rdx, 0x14003b06b
mov rcx, rax
movabs rax, sym.imp.KERNEL32.dll_GetProcAddress
call qword [rax]
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov r9, rcx
movabs r8, 0x14003b078
mov rdx, rcx
call rax
leave
jmp fcn.140026460
Function at 0x7c5960
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x7c596d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x7c597d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x7c5965
lea eax, [rcx + 1]
jmp 0x7c598b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x7c599e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x7c5984
sub eax, 3
jb 0x7c59be
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x7c5a0d
sar eax, 1
movsxd rbp, eax
jb 0x7c59f4
jmp 0x7c59cc
add ebx, ebx
jne 0x7c59ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x7c59f4
inc ecx
add ebx, ebx
jne 0x7c59da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x7c59f4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x7c59ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x7c59dc
add ecx, 2
jmp 0x7c59f9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.007c5922
jmp 0x7c596d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2d8000
mov dl, 0x2e
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x7c5a59
cmp rsi, rcx
jae 0x7c5a61
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x7c5a40
cmp al, 0x8f
ja 0x7c5a40
cmp byte [rsi - 2], 0xf
je 0x7c5a46
sub al, 0xe8
cmp al, 1
ja 0x7c5a2a
cmp rsi, rcx
jae 0x7c5a61
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x7c5a30
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x7c5a61
lodsb al, byte [rsi]
jmp 0x7c5a40
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x3af000]
mov eax, dword [rdi]
or eax, eax
je 0x7c5abe
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x3e0044]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x7c5a6e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x7c5ab8
mov qword [rbx], rax
add rbx, 8
jmp 0x7c5a8e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x7c5af8
cmp al, 0xef
ja 0x7c5aea
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x7c5aca
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x7c5ad9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x7c5b4c
sub rsp, 0xffffffffffffff80
jmp 0x6cae80
Function at 0x140003440
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov qword [rsp + 0x70], rcx
mov r14, qword [rdx]
add r9, r8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov word [rsp + 0x60], 0
mov dword [rsp + 0x68], 1
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x50]
call fcn.140003000
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x34], 0
movzx eax, byte [0x140230ff1]
mov ecx, 0x800
mov edx, 1
call fcn.140001410
test rax, rax
je 0x14000363e
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0x800
mov qword [rsp + 0x48], 0
mov rdi, qword [rsp + 0x80]
lea r13, [rsp + 0x30]
lea r12, [rsp + 0x34]
mov rsi, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov rbp, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x78], rax
sub rbp, rax
nop dword [rax]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r12
call rsi
cmp eax, 0xea
jne 0x14000353f
mov r8d, dword [rsp + 0x30]
cmp rbp, r8
jae 0x140003500
lea rcx, [rsp + 0x38]
mov rdx, qword [rsp + 0x78]
call fcn.14015e460
mov rbx, qword [rsp + 0x38]
jmp 0x1400034eb
mov r15d, eax
test eax, eax
jne 0x140003573
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
mov rsi, qword [rsp + 0x70]
jbe 0x1400035d8
movabs r15, 0xde00000002
mov rdx, qword [rsp + 0x40]
test rdx, rdx
jne 0x14000358a
jmp 0x140003598
shl r15, 0x20
or r15, 2
mov rsi, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140003598
mov r8d, 1
mov rcx, rbx
call fcn.140001420
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x1400035b6
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140001420
mov qword [rsi + 8], r15
mov qword [rsi], 0
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x60], rcx
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x68], al
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x14000360e
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140001420
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14008cc70
cmp byte [rsp + 0x68], 0xc
je 0x1400035c1
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1400035c1
mov rcx, qword [rsp + 0x50]
mov r8d, 1
call fcn.140001420
jmp 0x1400035c1
mov ecx, 1
mov edx, 0x800
call fcn.1401688d0
ud2