joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140cb16e9
Capabilities:
Encode data using xor

Disassembly:
mov esi, edx
add qword [rsp + 0x10], 0xffffffffffb2d6c4
sub r13d, 0x4f14132c
mov si, r13w
add qword [rsp], 0x1084ff
sub r11b, 7
test dx, 0x4e55
movsx esi, r13w
movzx r11, dl
movzx r13w, si
jb 0x140cb1738
add si, 0x40ce
or r13b, 0x8d
not rdx
lea rdx, [rsi*4 + 0x357e3380]
or rdx, 0xdd04872
lea r11, [r11*4 + 0x3c5d1bf7]
mov rsi, qword [rsp + 0x28]
or dl, 0xbb
not rdx
call fcn.140d9f98f
invalid

Function at 0x140d2eb35
Capabilities:
Encode data using xor

Disassembly:
call fcn.140d9d71c
jae 0x140c581af
call fcn.140c998e3

Function at 0x140d34307
Capabilities:
Encode data using xor

Disassembly:
not r10d
add bp, 0x3346
or bp, 0x48bd
mov ebp, 0x5c416ce
not r10d
lea r11, [r15 + rbp*2 + 0x48d40d7a]
lea rbp, [r11 + r10*4 + 0x3b9c281b]
sub r15b, 0x57
cmovbe ecx, r15d
and ecx, 0x1b513a7b
test cx, 0x1a03
lea r10, [r11 + r9 + 0x790d126c]
not r15b
lea r11, [r15*8 + 0x45de5a22]
mov bp, 0xc4
call fcn.140bda5a0
mov r14d, 0x25ea69ed
movzx r14w, di
not di
call fcn.140bbf1ef
add al, 0xa7
adc ebp, 0x6cdd0c23
mov ah, 0xa
and byte [rcx + rbp*2 + 0x19202a], ch
jns 0x1406f5d88
nop
sub al, 6
push 0xffffffffffffffb4
cmp ebx, dword [rsi]
xchg edi, eax
sub r13b, dl
invalid
invalid
setl dil
movabs r9, 0x73b161646e414cbb
add qword [rsp + 0x20], 0x180e1
sub r9b, 0x91
or r9d, 0x46a7250a
not r9
jb 0x1406f5cc4
call fcn.140d5e76d
movsxd r9, ecx
lea rdi, [rdi + rcx*8 + 0x6da86831]
jno 0x140db4d0b
sub byte [rdx + 0x1bc39f9a], dl
mov ebp, 0xff1c5bf8
and eax, 0x24448148
add qword [rsp], 0xffffffffbf284f77
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.140e92290
and edi, dword [rax - 0xf]
cmc
adc eax, 0xea28bf2a
rol byte [rbp + 0x3e4c5b61], 0x9d
sub eax, 0xe6ca5911
enter 0xffffffffffffcb2f, 0xffffffffffffffd7
shr byte [rdi], cl
and esi, dword [rdi + 0x6ab2ff35]
test dword [rdi + rbx*4 + 0x2b0875], ebp
insb byte [rdi], dx
xor al, byte [rdi + 0x34d75ceb]
mov edx, dword [rbp - 0xee4a1dd]
test byte [rdi + 0x1d039fb], ch
and byte cs:[rax], ah
invalid
mov rcx, qword [rsp + 0x50]
add qword [rsp], 0xffffffffbf40f8c5
lea rdi, [rdi*4 + 0xc615488]
not r9b
not dil
and r9w, 0xcfe
xor dil, r9b
sub edi, r9d
add rdi, rdi
jo 0x140db4d24
add qword [rsp + 0x18], 0xffffffffbf243165
sub rdi, r9
stc
jb 0x140cebf31
and al, 0x66
jmp 0x140db4d47
Function at 0x140d77b04
Capabilities:
Encode data using xor

Disassembly:
mov rcx, rsi
not dil
movzx r9d, byte [rsp + 0x38]
mov cx, r9w
bswap esi
push r13
mov r13, r9
not sil
push r12
mov r13, qword [rsp + 8]
not dword [rsp + 0x48]
lea r9, [rsi + r9 + 0x222f0e75]
mov r8, rsi
movabs r12, 0x224b3dae08b778b3
mov r9d, dword [rsp + 0x4a]
not dword [rsp + 0x50]
lea rsi, [rdx + r12*8 + 0x16bd6e70]
mov sil, byte [rsp + 0x57]
lea rdx, [r8 + 0x57a97775]
setg cl
pop r12
lea rdi, [r8*4 + 0x359f18a8]
add edi, dword [rsp + 0x44]
or dword [rsp + 0x40], 0x55722578
mov sil, byte [rsp + 0x4e]
xor qword [rsp + 0x48], 0x736563ce
add cl, byte [rsp + 0x4c]
add qword [rsp + 0x18], 0x16e1a1
bswap edx
or word [rsp + 0x40], 0x12e4
movzx r8w, sil
xor cx, 0x578b
mov rdi, qword [rsp + 0x20]
add qword [rsp + 0x40], 0x223d6331
sub cx, 0x1eaf
js 0x140d77b0a
test rcx, r9
lea rcx, [r9*8 + 0x495c3b8e]
cmovs esi, dword [rsp + 0x41]
mov word [rsp + 0x48], 0x23f3
xor cx, si
cmovne ecx, esi
sub byte [rsp + 0x48], r8b
or dl, byte [rsp + 0x4f]
setns r9b
add qword [rsp + 0x10], 0xffffffffbf32b8fe
mov rcx, qword [rsp + 0x30]
test r8d, r9d
cmovo r8, rdx
sub r9, qword [rsp + 0x40]
lea rsp, [rsp + 0x18]
ret 8

Function at 0x140d7e511
Capabilities:
Encode data using xor

Disassembly:
or byte [rsp + 0x20], 0xf0
cmp dword [rsp + 0x20], 0x1f542417
jo 0x140ceeb9c
or byte [rsp + 0x20], 0xd1
or word [rsp + 0x20], 0x32d4
test qword [rsp + 0x20], 0x4a0728d7
call fcn.140d67961

Function at 0x140d9b90b
Capabilities:
Encode data using xor

Disassembly:
lea rdi, [rbp*4 + 0x49e625b]
not edi
call fcn.140d5522d
invalid

Function at 0x140d9d731
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub qword [rsp + 0x28], 0x27f47c9
movsx r12d, cl
or dword [rsp + 0x68], 0x3b420510
and qword [rsp + 0x60], 0x28fe2e2a
add qword [rsp + 0x38], 0xffffffffbf40d2b0
test word [rsp + 0x28], 0x28ff
mov word [rsp + 0x28], 0x9bc
call fcn.140ceae1a
rcr byte [rax - 0x6c432d22], 1
rcl byte [rdx]
sub esp, dword [rcx - 0x58ed1465]
out 0x6b, al
invalid
sub qword [rsp + 0x78], 0x38930c36
jg 0x1406ed2e4
ja 0x140bd09ef
or word [rsp + 0x80], 0x5ee1
not word [rsp + 0x80]
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x40], 0x6b3906a6
test r12w, 0x2874
mov byte [rsp + 0x60], 0x26
not dword [rsp + 0x80]
not qword [rsp + 0x40]
jle 0x1406ed0fe
add byte [rsp + 0x60], r12b
or r12d, 0x54515622
mov r12, qword [rsp + 0x88]
xor word [rsp + 0x78], 0x3d0a
sub dword [rsp + 0x40], 0x5a853d05
add dword [rsp + 0x40], 0x345e175d
xor word [rsp + 0x40], 0x5ec5
add qword [rsp + 0x38], 0xffffffffbf912d05
add dword [rsp + 0x60], 0x2c8772b4
not byte [rsp + 0x80]
test byte [rsp + 0x78], 0x36
Function at 0x140e92290
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edx, esi
dec edx
clc
rol edx, 1
cmp r12w, r9w
add edx, 0x7803545b
clc
test r13, 0x368d1a22
bswap edx
cmp r15b, 0x70
push rsi
xor dword [rsp], edx
and esi, edi
pop rsi
movsxd rdx, edx
test r9b, 0xda
cmp r12b, r14b
add r10, rdx
jmp 0x140e99c2d
push rdi
movsxd rax, r14d
movzx ebx, dx
lahf
pushfq
push r8
mov dh, dh
rdtsc
cbw
movabs r8, 0
lahf
movzx r10, r11w
movsx ax, r14b
push r8
movzx edx, dx
cwde
mov rbx, qword [rsp + 0x90]
rdtsc
inc ebx
setbe dl
movzx dx, bl
sub si, r8w
xor ebx, 0x72926342
or r9w, r15w
not ebx
sete al
ror dx, 0x4b
bts r10w, bx
sub ebx, 0x7d0f70f4
ror ebx, 2
lea rbx, [rbx + r8]
xor dl, sil
bts r10d, r15d
movabs rax, 0x100000000
movzx rdx, bx
mov sil, spl
lea rbx, [rbx + rax]
mov r9, rsp
shrd dx, r10w, 0xf4
movsxd rsi, r14d
sub rsp, 0x180
and rsp, 0xfffffffffffffff0
bsf dx, bp
mov rsi, rbx
shrd r10w, r13w, 0x62
movabs rax, 0
sub rsi, rax
sal r10b, cl
shr dl, 0x61
lea r10, [0x140e5a0f2]
sub edx, 0xcc630cf
mov edx, dword [rbx]
stc
test dil, r9b
add rbx, 4
jmp 0x140dd4be5
push r15
push rax
push r13
cwde
not al
push rbp
not eax
xchg al, al
push rbx
mov ah, 0xde
cdqe
push rsi
push r14
push r9
movsx r9d, bx
movzx bx, r10b
push r10
mov sil, bl
movsx eax, ax
movsx r10w, sil
push r11
cmovno r10w, r15w
movzx eax, r13w
push rdx
push r12
xchg sil, r10b
rdtsc
movzx edx, bx
push rcx
cmovns r10w, cx
jmp 0x140e5a035
push r10
ret
Function at 0x14000d5a0
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r13
push r15
mov eax, 0x1070
call fcn.14005c450
sub rsp, rax
mov rax, qword [0x1400a3c40]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rdx, qword [rsp + 0x10b0]
xor ebp, ebp
mov qword [rsp + 0x38], r9
mov r15, r8
mov qword [rsp + 0x30], rdx
mov r13, rcx
test r8, r8
jne 0x14000d5ec
mov rdx, rbp
jmp 0x14000d6fa
mov r9d, 0x1000
lea rdx, [rsp + 0x40]
call fcn.14000c430
test al, al
je 0x14000d5e4
mov qword [rsp + 0x1068], rsi
lea rdx, [0x140091858]
mov qword [rsp + 0x1060], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1058], r12
mov qword [rsp + 0x1050], r14
nop
inc rdi
cmp byte [rdx + rdi], bpl
jne 0x14000d630
movsxd rax, dword [rsp + 0x7c]
lea rcx, [rsp + 0x40]
add rcx, rax
mov qword [rsp + 0x1098], rbx
mov esi, ebp
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r14d, word [rcx + 6]
add r12, rax
test r14d, r14d
je 0x14000d6cf
nop word [rax + rax]
mov eax, esi
mov r8, rdi
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call fcn.14005e600
test eax, eax
jne 0x14000d69e
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x14000d690
cmp rdi, rax
je 0x14000d6ae
inc esi
cmp esi, r14d
jae 0x14000d6cf
lea rdx, [0x140091858]
jmp 0x14000d670
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x14000d6cf
mov ecx, dword [rbx + 8]
mov edx, eax
lea rax, [rsp + 0x40]
add rax, rdx
je 0x14000d6cf
test ecx, ecx
je 0x14000d6cf
mov ebp, ecx
add rdx, r15
jmp 0x14000d6d2
mov rdx, rbp
mov rbx, qword [rsp + 0x1098]
mov rdi, qword [rsp + 0x1060]
mov rsi, qword [rsp + 0x1068]
mov r12, qword [rsp + 0x1058]
mov r14, qword [rsp + 0x1050]
mov rax, qword [rsp + 0x30]
mov rcx, r13
mov r9, qword [rsp + 0x38]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call fcn.14000d490
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14005b700
add rsp, 0x1070
pop r15
pop r13
pop rbp
ret
Function at 0x14000e2a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14000e2c2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000e33c
mov rdi, r14
mov rcx, rbx
call fcn.14000f690
test rax, rax
jle 0x14000e314
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14005df70
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000e32c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14000e334
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14000e2d6
sub r14, rdi
jmp 0x14000e429
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14000e353
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000e355
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000e38a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14005df70
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000e426
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x14000e3c5
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x14000e401
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140028538
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x14000e43f
cmp rbp, rax
ja 0x14000e3d1
mov r8, rdi
test rdi, rdi
je 0x14000e426
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140028538
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x14000e429
Function at 0x14000e870
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400a3c40]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000e89d
xor eax, eax
jmp 0x14000e9e3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000e8d7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14000e8d7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14000e9e3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000e9d6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000e91a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000e929
movsx ecx, dil
jmp 0x14000e97d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x14000e997
sub eax, 1
je 0x14000e997
cmp eax, 2
jne 0x14000e9d6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.14002710c
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000e9db
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14000e9c4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.140027c64
cmp rsi, rax
jne 0x14000e9d6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14000e9db
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14005b700
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400128e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, 0x5a4d
xor edi, edi
mov rbx, r8
mov rsi, rcx
cmp word [rdx], ax
je 0x140012921
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov rdx, qword [r8 + 0x18]
cmp rdx, 0x10
jb 0x1400129d0
mov rcx, qword [r8]
jmp 0x1400129a7
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140012939
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
jmp 0x14001290b
movzx eax, word [rcx + 0x14]
lea r14, [rcx + 0x18]
movzx r11d, word [rcx + 6]
add r14, rax
movzx r9d, di
cmp di, r11w
jae 0x140012993
mov rbp, qword [r8 + 0x18]
mov r8, rbx
cmp rbp, 0x10
jb 0x140012963
mov r8, qword [rbx]
movzx r10d, r9w
lea rax, [r10 + r10*4]
lea rcx, [r14 + rax*8]
sub r8, rcx
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x140012985
inc rcx
test eax, eax
jne 0x140012972
test edx, edx
je 0x1400129f5
inc r9w
cmp r9w, r11w
jb 0x140012957
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400129d0
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400129cb
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140012a0e
mov rcx, r8
call fcn.14005bc54
mov byte [rbx], 0
mov rax, rsi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], send
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
lea rax, [r10 + r10*4]
lea rcx, [r14 + rax*8]
mov eax, dword [r14 + rax*8 + 8]
mov qword [rsi], rax
mov eax, dword [rcx + 0xc]
mov qword [rsi + 8], rax
jmp 0x14001299a
call fcn.140026f88
int3
Function at 0x140018c30
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400a3c40]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140018d48
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140018d48
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor edx, edx
mov qword [rsp + 0x50], rdx
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
jne 0x140018ca8
mov qword [rdi], rdx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
jmp 0x140018d55
lea rbx, [rsi + rcx]
mov ebp, dword [rax + rsi + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x48]
cmp rbx, rbp
jae 0x140018d36
mov r8d, dword [rbx + 4]
test r8d, r8d
je 0x140018d36
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r8 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, rdx
je 0x140018d0f
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rsp + 0x48]
add rcx, 0x18
mov qword [rsp + 0x48], rcx
jmp 0x140018d26
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.140019270
mov rcx, qword [rsp + 0x48]
mov eax, dword [rbx + 4]
add rbx, rax
mov rdx, qword [rsp + 0x50]
cmp rbx, rbp
jb 0x140018cc0
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
jmp 0x140018d55
xor edx, edx
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005b700
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140019cf0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1400a3c40]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x140019ef5
mov rcx, qword [rbx + 0x10]
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
sub rax, rcx
cmp rax, 0x34
jb 0x140019f20
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140019d61
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x34
lea r9, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x1f]
call fcn.140010e90
nop
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 8
cmovae rdx, qword [rbp + 0x1f]
lea rcx, [rbp + 0x3f]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbx + 0x10]
sub rdi, rax
cmp rdi, 0x22
jb 0x140019f26
cmp qword [rbx + 0x18], 8
jb 0x140019db8
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0x22
lea r9, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 1]
call fcn.140010e90
nop
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
lea r8, [rbp - 9]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x140019e07
cmp eax, 2
sete bl
jmp 0x140019e64
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x3f]
call rax
lea rdx, [rbp - 1]
mov rcx, 0xffffffff80000002
test eax, eax
je 0x140019e4a
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor bl, bl
jmp 0x140019e64
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
je 0x140019e62
xor bl, bl
jmp 0x140019e64
mov bl, 1
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x140019ea4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019e9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019f2c
call fcn.14005bc54
xor eax, eax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], 7
mov word [rbp - 1], ax
mov rdx, qword [rbp + 0x37]
cmp rdx, 8
jb 0x140019ef2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019eed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019f1a
call fcn.14005bc54
movzx eax, bl
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14005b700
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140026f88
int3
call fcn.1400017b0
nop
call fcn.1400017b0
nop
call fcn.140026f88
int3
Function at 0x140019f40
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1400a3c40]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rcx
xor ebp, ebp
mov ebx, ebp
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140019fd4
test rbx, rbx
je 0x140019f9c
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140019f86
test eax, eax
jns 0x14001a013
test rbx, rbx
je 0x140019fee
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14005b700
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
test rbx, rbx
je 0x140019fee
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x140019fdd
nop
mov esi, edi
imul rax, rsi, 0x128
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
lea rdx, [rbx + 0x30]
add rdx, rcx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], send
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14001a052
lea rcx, [rsp + 0x28]
call fcn.140003650
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x14001a073
mov rdx, qword [r14]
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
call fcn.140027fe0
test eax, eax
je 0x14001a0d5
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14001a0c6
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a0c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a133
call fcn.14005bc54
inc edi
cmp edi, dword [rbx]
jb 0x14001a020
jmp 0x140019fdd
imul rax, rsi, 0x128
mov rdi, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14001a12b
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a126
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a133
call fcn.14005bc54
mov rax, rdi
jmp 0x140019ff0
call fcn.140026f88
int3
Function at 0x14001cf30
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push r12
push r15
sub rsp, 0x10
mov r11d, dword [rdx + 0xb0]
mov r15, r8
mov rsi, rdx
mov r12, rcx
test r11d, r11d
je 0x14001d0ac
movzx eax, word [rdx + 0x14]
lea r9, [rdx + 0x18]
movzx r8d, word [rdx + 6]
add r9, rax
xor r10d, r10d
test r8d, r8d
je 0x14001d0ac
nop
mov edx, dword [r9 + 0xc]
cmp r11d, edx
jb 0x14001cf84
mov ecx, dword [r9 + 8]
add ecx, edx
cmp r11d, ecx
jb 0x14001cf9a
inc r10d
add r9, 0x28
cmp r10d, r8d
jl 0x14001cf70
add rsp, 0x10
pop r15
pop r12
pop rsi
ret
sub r11d, edx
mov qword [rsp], r14
mov r14d, dword [r9 + 0x14]
mov eax, r11d
add rax, r12
add r14, rax
je 0x14001d0a8
mov qword [rsp + 0x38], rbp
xor ebp, ebp
cmp dword [rsi + 0xb4], ebp
jbe 0x14001d0a3
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 8], r13
mov r13d, 0xf000
nop dword [rax]
mov edi, dword [r14 + 4]
lea rdx, [rsi + 0x18]
movzx eax, word [rsi + 0x14]
lea r10, [r14 + 8]
movzx ebx, word [rsi + 6]
sub rdi, 8
mov r11d, dword [r14]
add rdx, rax
shr rdi, 1
xor r9d, r9d
test ebx, ebx
je 0x14001d035
nop dword [rax + rax]
mov r8d, dword [rdx + 0xc]
cmp r11d, r8d
jb 0x14001d029
mov eax, dword [rdx + 8]
lea ecx, [r8 + rax]
cmp r11d, ecx
jb 0x14001d0b6
inc r9d
add rdx, 0x28
cmp r9d, ebx
jl 0x14001d010
xor r8d, r8d
xor edx, edx
test rdi, rdi
je 0x14001d081
mov r9d, 0xa000
nop word [rax + rax]
movzx eax, word [r10]
movzx ecx, ax
and cx, r13w
cmp cx, r9w
jne 0x14001d074
and eax, 0xfff
lea rcx, [rax + r8]
mov rax, r15
sub rax, qword [rsi + 0x30]
add qword [rcx], rax
inc edx
add r10, 2
mov eax, edx
cmp rax, rdi
jb 0x14001d050
add ebp, dword [r14 + 4]
mov r14, r10
cmp ebp, dword [rsi + 0xb4]
jb 0x14001cfe0
mov r13, qword [rsp + 8]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov r14, qword [rsp]
add rsp, 0x10
pop r15
pop r12
pop rsi
ret
sub r11d, r8d
mov r8d, dword [rdx + 0x14]
mov eax, r11d
add rax, r12
add r8, rax
jmp 0x14001d038