joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045d7c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov bpl, dl
mov ebx, r15d
mov r14, rcx
or rdi, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140045ed6
mov r8d, 0x104
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
nop dword [rax + rax]
test eax, eax
je 0x140045e91
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140045e91
mov r8d, 0x104
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
test eax, eax
je 0x140045e91
inc rdi
cmp word [rbx + rdi*2], r15w
jne 0x140045e3a
dec edi
cmp word [rbx + rdi*2], 0x5c
jne 0x140045e52
mov word [rbx + rdi*2], r15w
neg bpl
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov rcx, rbx
sbb edx, edx
mov dword [rsp + 0x20], 3
xor r9d, r9d
and edx, 0xc0000000
add edx, 0x80000000
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test rbx, rbx
je 0x140045ed6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x60]
mov rax, rdi
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140045f64
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x4e0
mov rax, qword [0x14007b108]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
xor ebx, ebx
mov r15, rdx
mov rbp, rcx
mov rsi, rcx
mov edi, ebx
lea r14d, [rbx + 0x5c]
mov edx, r14d
lea rcx, [rsi + 2]
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x1400460f5
inc edi
cmp edi, 2
jb 0x140045f9a
mov edi, 0x104
lea r8, str._GlobalRoot
mov edx, edi
lea rcx, [rsp + 0xb0]
add rsi, 2
call fcn.1400035ec
mov r9, rsi
lea rcx, [rsp + 0xb0]
sub r9, rbp
mov r8, rbp
sar r9, 1
call fcn.140018924
mov r8d, 0x32
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
test eax, eax
je 0x14004605b
lea r9, [rsp + 0x30]
mov r8d, edi
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
test eax, eax
je 0x140046054
cmp word [rsp + 0x2c0], bx
je 0x140046054
lea rdi, [rsp + 0x2c0]
jmp 0x140046063
lea rdi, [rsp + 0x40]
jmp 0x140046063
lea rdi, [rsp + 0xb0]
or rcx, 0xffffffffffffffff
mov rax, rcx
inc rax
cmp word [rdi + rax*2], bx
jne 0x14004606a
test rax, rax
je 0x140046085
cmp word [rdi + rax*2 - 2], r14w
jne 0x140046085
mov word [rdi + rax*2 - 2], bx
mov rax, rcx
inc rax
cmp word [rdi + rax*2], bx
jne 0x140046088
inc rcx
cmp word [rsi + rcx*2], bx
jne 0x140046091
add rax, rcx
lea r14, [rax*2 + 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
jne 0x1400460d4
mov ebx, 0x8007000e
jmp 0x1400460f1
mov r9, rdi
mov qword [rsp + 0x20], rsi
lea r8, str._ws_ws
mov rdx, r14
mov rcx, rbp
call fcn.140045ac4
mov qword [r15], rbp
mov eax, ebx
jmp 0x1400460fa
mov eax, 0x80070057
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.140068870
mov rbx, qword [rsp + 0x520]
add rsp, 0x4e0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140046da0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, ebx
test rcx, rcx
je 0x140046e46
cmp bx, word [rcx]
je 0x140046e46
xor edx, edx
call fcn.1400472a8
mov rsi, rax
test rax, rax
je 0x140046e42
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140046df1
test al, 0x10
je 0x140046df1
lea edi, [rbx + 1]
jmp 0x140046e14
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
mov ecx, 0x10b
cmove eax, ecx
mov ecx, 3
cmp eax, 2
cmove eax, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, edi
jmp 0x140046e59
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140046e70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
test rcx, rcx
je 0x140046f15
cmp bx, word [rcx]
je 0x140046f15
xor edx, edx
call fcn.1400472a8
mov rsi, rax
test rax, rax
je 0x140046ef5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140046ec5
and eax, 0x10
sete bl
neg eax
sbb edi, edi
and edi, 2
jmp 0x140046ed3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x140046f03
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebx
jmp 0x140046f28
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400487ec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
xor ebx, ebx
xor edx, edx
call fcn.1400472a8
mov rsi, rax
test rax, rax
je 0x14004887e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebp, eax
cmp edi, 0xffffffff
je 0x140048846
lea eax, [rbx + 1]
bt edi, 0xa
jb 0x140048848
mov eax, ebx
test ebp, ebp
mov dword [r14], eax
sete bl
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140049128
Capabilities:
Delete file
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov rsi, rcx
mov ebp, r14d
mov edi, r14d
test rcx, rcx
je 0x140046d6a
cmp r14w, word [rcx]
je 0x140046d6a
xor edx, edx
call fcn.1400472a8
mov rbx, rax
test rax, rax
je 0x140046d06
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop dword [rax + rax]
test eax, eax
jne 0x140046ccc
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, rbx
lea r8, str.WdsRemoveDirectory:_Unable_to_clear_attributes_on___s___GLE__0x_x
lea rcx, [0x14007ba68]
mov dword [rsp + 0x20], eax
mov edx, 0x3000000
mov edi, eax
call fcn.140046248
xor edx, edx
mov rcx, rbx
call fcn.1400466c4
mov ebp, eax
test eax, eax
jne 0x140046d33
test edi, edi
jne 0x140046cee
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, rbx
lea r8, str.WdsRemoveDirectory:_Unable_to_remove_directory___s___GLE__0x_x
jmp 0x140046d1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, rsi
lea r8, str.WdsRemoveDirectory:_Unable_to_prepare_path___s___GLE__0x_x
mov edi, eax
mov edx, 0x3000000
mov dword [rsp + 0x20], eax
lea rcx, [0x14007ba68]
call fcn.140046248
test rbx, rbx
je 0x140046d58
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebp
jmp 0x140046d7d
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
sub rsp, 0x28
test rcx, rcx
jne 0x14004914a
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
add rsp, 0x28
ret
test dl, 1
je 0x14004915d
mov edx, 1
add rsp, 0x28
jmp fcn.1400466c4
add rsp, 0x28
jmp 0x140046c40
Function at 0x14004df9c
Capabilities:
Get number of processors

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xb8
mov rax, qword [0x14007b108]
xor rax, rsp
mov qword [rbp - 1], rax
mov rdi, qword [rbp + 0x77]
mov r12, r8
mov r15, qword [rbp + 0x7f]
lea r8, [rbp - 0x79]
mov rsi, r9
mov r13, rdx
mov r14, rcx
call fcn.14004ded0
mov ebx, eax
test eax, eax
js 0x14004e17e
cmp r12, qword [rbp - 0x79]
jb 0x14004dffa
mov ebx, 0x80070057
jmp 0x14004e17e
lea r9, [rbp - 0x19]
mov r8d, 0x2000
mov rdx, r13
mov rcx, r14
call fcn.14004da44
xor r13d, r13d
mov ebx, eax
test eax, eax
js 0x14004e17e
cmp dword [rbp - 0x19], 3
jne 0x14004e179
cmp dword [rbp - 9], 0xffffffff
je 0x14004e179
mov rcx, qword [r14]
lea r9, [rbp - 0x29]
movups xmm0, xmmword [rbp - 0x11]
mov r8d, r12d
lea rdx, [rbp - 0x69]
mov rax, qword [rcx]
movdqu xmmword [rbp - 0x69], xmm0
mov rax, qword [rax + 0xc0]
call qword [0x14006c9d0]
test eax, eax
js 0x14004e15b
test rsi, rsi
je 0x14004e09e
lea r9, [rbp - 0x59]
mov qword [rsi], r13
mov r8d, 0x2007
lea rdx, [rbp - 0x29]
mov rcx, r14
call fcn.14004da44
mov ebx, eax
test eax, eax
js 0x14004e0e3
cmp dword [rbp - 0x59], 1
jne 0x14004e099
mov rcx, qword [rbp - 0x51]
mov rdx, rsi
call fcn.14004a5b8
mov ebx, eax
jmp 0x14004e09e
mov ebx, 0x8007000d
test ebx, ebx
js 0x14004e0e3
test rdi, rdi
je 0x14004e0eb
lea r9, [rbp - 0x41]
mov qword [rdi], r13
mov r8d, 0x2009
lea rdx, [rbp - 0x29]
mov rcx, r14
call fcn.14004da44
mov ebx, eax
test eax, eax
js 0x14004e103
cmp dword [rbp - 0x41], 1
jne 0x14004e0dc
mov rcx, qword [rbp - 0x39]
mov rdx, rdi
call fcn.14004a5b8
mov ebx, eax
jmp 0x14004e0eb
mov ebx, 0x8007000d
jmp 0x14004e0eb
test rdi, rdi
je 0x14004e0eb
mov qword [rdi], r13
test ebx, ebx
js 0x14004e103
test r15, r15
je 0x14004e17e
movups xmm0, xmmword [rbp - 0x29]
movdqu xmmword [r15], xmm0
jmp 0x14004e17e
test rsi, rsi
je 0x14004e12e
mov r8, qword [rsi]
test r8, r8
je 0x14004e12e
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov qword [rsi], r13
test rdi, rdi
je 0x14004e17e
mov r8, qword [rdi]
test r8, r8
je 0x14004e17e
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov qword [rdi], r13
jmp 0x14004e17e
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14004e17e
mov ebx, 0x8007000d
mov eax, ebx
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140068870
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14005fb70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rdi, rcx
test rbx, rbx
je 0x14005fbee
xor ecx, ecx
cmp qword [rbx + 8], rcx
jbe 0x14005fbaf
xor edx, edx
mov rax, qword [rbx + 0x10]
lea rdx, [rdx + 0x90]
inc rcx
and qword [rdx + rax - 0x68], 0
and qword [rdx + rax - 0x80], 0
cmp rcx, qword [rbx + 8]
jb 0x14005fb8f
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x18]
and qword [rbx + 0x10], 0
test rcx, rcx
je 0x14005fbe1
call fcn.1400602e8
and qword [rbx + 0x18], 0
mov rcx, rbx
call fcn.140068fd4
and qword [rdi], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400602e8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
cmp qword [rcx + 8], rdx
jbe 0x14006031b
xor ecx, ecx
mov rax, qword [rbx + 0x10]
lea rcx, [rcx + 0x90]
inc rdx
and qword [rcx + rax - 0x68], 0
and qword [rcx + rax - 0x80], 0
cmp rdx, qword [rbx + 8]
jb 0x1400602fb
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x18]
and qword [rbx + 0x10], 0
test rcx, rcx
je 0x140060352
mov edx, 1
call fcn.1400602e8
and qword [rbx + 0x18], 0
mov rcx, rbx
call fcn.140068fd4
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140068234
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
xor r9d, r9d
mov esi, edx
mov r10d, edx
mov rbx, rcx
shr r10d, 4
mov r11, r8
mov edi, r9d
movabs rbp, 0x87c37b91114253d5
movabs r14, 0x4cf5ad432745937f
test r10d, r10d
je 0x1400682cd
lea edx, [rdi + rdi]
inc edi
mov rcx, qword [rbx + rdx*8]
lea eax, [rdx + 1]
mov rax, qword [rbx + rax*8]
imul rax, r14
imul rcx, rbp
rol rax, 0x21
imul rax, rbp
rol rcx, 0x1f
xor rax, r11
imul rcx, r14
rol rax, 0x1f
xor rcx, r8
add rax, 0xb41def1
rol rcx, 0x1b
add rcx, r11
lea r8, [rcx*4 + 0x52dce729]
add r8, rcx
add rax, r8
lea r11, [rax + rax*4]
cmp edi, r10d
jb 0x140068277
shl r10d, 4
mov eax, esi
mov ecx, r10d
and eax, 0xf
add rcx, rbx
cmp eax, 8
ja 0x14006832b
je 0x1400683a8
sub eax, 1
je 0x1400683f3
sub eax, 1
je 0x1400683e8
sub eax, 1
je 0x1400683dd
sub eax, 1
je 0x1400683d2
sub eax, 1
je 0x1400683c7
sub eax, 1
je 0x1400683bc
cmp eax, 1
je 0x1400683b1
jmp 0x140068408
sub eax, 9
je 0x140068392
sub eax, 1
je 0x140068387
sub eax, 1
je 0x14006837c
sub eax, 1
je 0x140068371
sub eax, 1
je 0x140068366
sub eax, 1
je 0x14006835b
cmp eax, 1
jne 0x140068408
movzx r9d, byte [rcx + 0xe]
shl r9, 0x30
movzx eax, byte [rcx + 0xd]
shl rax, 0x28
xor r9, rax
movzx eax, byte [rcx + 0xc]
shl rax, 0x20
xor r9, rax
movzx eax, byte [rcx + 0xb]
shl rax, 0x18
xor r9, rax
movzx eax, byte [rcx + 0xa]
shl rax, 0x10
xor r9, rax
movzx eax, byte [rcx + 9]
shl rax, 8
xor r9, rax
movzx eax, byte [rcx + 8]
xor rax, r9
imul rax, r14
rol rax, 0x21
imul rax, rbp
xor r11, rax
movzx r9d, byte [rcx + 7]
shl r9, 0x38
movzx eax, byte [rcx + 6]
shl rax, 0x30
xor r9, rax
movzx eax, byte [rcx + 5]
shl rax, 0x28
xor r9, rax
movzx eax, byte [rcx + 4]
shl rax, 0x20
xor r9, rax
movzx eax, byte [rcx + 3]
shl rax, 0x18
xor r9, rax
movzx eax, byte [rcx + 2]
shl rax, 0x10
xor r9, rax
movzx eax, byte [rcx + 1]
shl rax, 8
xor r9, rax
movzx eax, byte [rcx]
xor rax, r9
imul rax, rbp
rol rax, 0x1f
imul rax, r14
xor r8, rax
mov rbx, qword [rsp + 0x10]
xor r11, rsi
mov rbp, qword [rsp + 0x18]
movabs rdx, 0xff51afd7ed558ccd
mov rdi, qword [rsp + 0x28]
mov rax, rsi
mov rsi, qword [rsp + 0x20]
xor rax, r8
add rax, r11
mov rcx, rax
add r11, rax
shr rcx, 0x21
xor rcx, rax
mov rax, r11
imul rcx, rdx
shr rax, 0x21
mov r8, rcx
xor rax, r11
imul rax, rdx
shr r8, 0x21
xor r8, rcx
mov rdx, rax
shr rdx, 0x21
movabs rcx, 0xc4ceb9fe1a85ec53
xor rdx, rax
imul rdx, rcx
imul r8, rcx
mov rax, rdx
shr rax, 0x21
xor rdx, rax
mov rcx, r8
shr rcx, 0x21
xor rcx, r8
add rcx, rdx
lea rax, [rdx + rcx]
xor rax, rcx
pop r14
ret

Function at 0x14006890c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140068958
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140068950
cmp dword [rcx + 0x3c], edx
jl 0x140068950
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140068950
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140068958
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400037d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1400a60a0]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, Ordinal_301
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x130
cmp rdi, 0xffffffffffffffff
je 0x140003892
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140003892
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140003889
cmp qword [rbx + 0x18], 0x10
mov r8, rbx
jb 0x140003851
mov r8, qword [rbx]
lea rax, [rsp + 0x4c]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140003873
inc rax
test ecx, ecx
jne 0x140003860
mov rcx, rdi
test edx, edx
je 0x1400038b5
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140003844
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140081890
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x28], 0
setne al
jmp 0x140003894

Function at 0x1400038d0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1400a60a0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
lea rdx, str.ComputerHKEY_CLASSES_ROOTSAPI_OneCore.SpGramCompBackEnd.1CLSID
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 0x20106
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140003963
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea rdx, str.IsBanned
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x58], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140081890
add rsp, 0x78
ret
Function at 0x1400052b0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2260
call fcn.1400825c0
sub rsp, rax
mov rax, qword [0x1400a60a0]
xor rax, rsp
mov qword [rsp + 0x2250], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x20]
mov r8d, 0x2000
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400053c3
mov esi, dword [rsp + 0x20]
shr rsi, 3
test rsi, rsi
je 0x1400053c3
xor edi, edi
nop dword [rax]
mov rbx, qword [rsp + rdi*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x104
lea r8, [rsp + 0x2030]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x14000537d
lea rdx, str.C:WindowsSystem32_
lea rcx, [rsp + 0x2030]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsstr]
test rax, rax
jne 0x1400053b7
lea rdx, str.C:WindowsSysWow64_
lea rcx, [rsp + 0x2030]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsstr]
test rax, rax
jne 0x1400053b7
mov rdx, qword [rsp + rdi*8 + 0x30]
lea r8, [rsp + 0x2140]
mov r9d, 0x104
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x1400053b7
lea rdx, str..dll
lea rcx, [rsp + 0x2140]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400053ee
inc rdi
cmp rdi, rsi
jl 0x140005320
xor al, al
mov rcx, qword [rsp + 0x2250]
xor rcx, rsp
call fcn.140081890
lea r11, [rsp + 0x2260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1400038d0
mov al, 1
jmp 0x1400053c5
Function at 0x1400059a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
lea r14d, [rbp + 4]
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r15d, reloc.WS2_32.dll_sendto
mov eax, dword [r15 + rsi]
mov r12d, Ordinal_50
test al, 1
jne 0x140005a39
or eax, 1
mov dword [r15 + rsi], eax
mov ebx, r12d
add rbx, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
lea ecx, [rbp + 1]
lea r8, [rbx + 8]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140005a11
mov dword [rbx], 0x270
mov eax, dword [r15 + rsi]
mov ecx, Ordinal_27
test al, 2
jne 0x140005a5a
or eax, 2
mov dword [r15 + rsi], eax
mov qword [rsi + rcx], rbp
mov qword [rsi + rcx + 8], reloc.WS2_32.dll_ntohs
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
lea r15, [rsi + rcx]
mov ebx, r12d
add rbx, rsi
lea r12, str.0123456789ABCDEF
nop dword [rax + rax]
dec r14
mov qword [rsp + 0x28], rbx
mov rbp, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, rbp
cmp rdx, 0xffffffffffffffff
jne 0x140005ac5
mov rcx, rbx
call fcn.1400204a0
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.1400204a0
mov eax, eax
or rsi, rax
jmp 0x140005ad5
inc rdx
lea rcx, [rsp + 0x28]
call fcn.1400202b0
mov rsi, rax
lea rax, [rsi + rbp]
movzx r9d, byte [rax + r12]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140005b0a
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x140005aff
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140005b19
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.14001edd0
test r14, r14
jne 0x140005a90
mov rax, rdi
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret