joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001dec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e36
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e36
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e36
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e36
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e36
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e38
xor al, al
add rsp, 0x28
ret

Function at 0x100411cb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
lea rcx, [0x100412270]
call 0x100411cb0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call 0x100411cd0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call 0x100411ce0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call 0x100411cf0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
add rsp, 0x28
jmp 0x100411d00
invalid
cdq
stosb byte [rdi], al
cdq
movabs byte [0x9da695a2999787a8], al
movabs dword [0x86a6999a99983b34], eax
cdq
xchg ebp, eax
cmpsd dword [rsi], dword [rdi]
movabs dword [0xa89598a4a93b34a2], eax
cdq
jge 0x100411c5b
xor al, 0x43
cmpsb byte [rsi], byte [rdi]
cdq
stosb byte [rdi], al
popfq
cmpsd dword [rsi], dword [rdi]
popfq
movabs dword [0x34a69996a1a982a2], eax
cmp ebx, dword [rbp - 0x5966575e]
xchg ebp, eax
xchg edi, eax
test al, 0x9d
stosb byte [rdi], al
cdq
xor al, 0x41
cdq
cmpsb byte [rsi], byte [rdi]
cmpsb byte [rsi], byte [rdi]
movabs dword [0x43bb349998a377a6], eax
stosd dword [rdi], eax
test eax, 0x9daa9978
xchg edi, eax
cdq
popfq
cwde
xor al, 0x43
test eax, 0xa89598a4
cdq
xchg dword [rdi - 0x596a5d67], edx
popfq
movabs dword [0xa09a3b3499a4ad88], eax
popfq
wait
pushfq
test al, 0x7d
js 0x100411d4b
xor eax, 0x9a89a934
jg 0x100411c9e
imul esp, dword [rcx - 0x56765879], 0x6c
ja 0x100411d91
test eax, 0x6265626a
invalid
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
invalid
xor al, 0x64
xor al, 0x61
xor al, 0x64
xor al, 0x64
xor al, 0x64
xor al, 0x64
xor al, 0x61
xor al, 0x64
xor al, 0x64
xor al, 0x64
xor al, 0x64
xor al, 0x64
xor al, 0x64
xor al, 0x64
xor al, 0x64
xor al, 0x64
xor al, 0x64
xor al, 0x64
xor al, 0x64
xor al, 0x34
xor al, 0x61
xor al, 0x64
xor al, 0x64
xor al, 6
xor eax, 0x3435f447
xor al, 0x34
add byte [rdi + 0x34], al
xor al, 0x70
xor al, 0x34
std
adc al, 0x2f
adc dword [0xcf762beb], edi
wait
stosb byte [rdi], al
nop
fstp xword [rcx]
jnp 0x100411dc0
fdiv dword [rdi + 0x6ced379d]
test eax, 0x3f340f99
cmp dword [rsp + rsi], esi
xor al, 0x34
xor al, 0x34
xor al, 0x34
mov ah, 0x34
xor al, 3
adc dword [rbp - 0x36], esp
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
jl 0x100411e47
xor al, 0x35
xor al, 0x6f
xor al, 0x6f
xor al, 0x81
popfq
xchg edi, eax
cmpsb byte [rsi], byte [rdi]
movabs dword [0xa29d8b62a89aa3a7], eax
cwde
movabs dword [0xa89598a48962a7ab], eax
cdq
invalid
sti
invalid
Function at 0x140002044
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp byte [0x140007113], 0
je 0x14000205e
test cl, cl
je 0x1400021cc
lea rax, [rbp - 0x10]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCInstaller_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400021c5
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400021c5
and dword [rbp + 0x20], eax
and dword [rbp + 0x18], eax
cmp byte [0x140007113], al
mov dword [rbp + 0x28], 4
jne 0x1400020e8
lea rax, [rbp + 0x28]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
lea rdx, str.bIsSingleClientApp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400020e8
cmp dword [rbp + 0x20], 4
jne 0x1400020e8
cmp dword [rbp + 0x18], eax
setne byte [0x140007111]
cmp byte [0x140007111], 0
je 0x1400021bb
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and dword [rbp + 0x18], 0
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.bIsSCAcroAppInstalled
lea rax, [rbp + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002137
cmp dword [rbp + 0x20], 4
jne 0x140002137
cmp dword [rbp + 0x18], eax
setne byte [0x140007110]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and dword [rbp + 0x18], 0
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.SCAPackageLevel
lea rax, [rbp + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000217d
mov eax, dword [0x140007008]
cmp dword [rbp + 0x20], 4
cmove eax, dword [rbp + 0x18]
mov dword [0x140007008], eax
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
xor r8d, r8d
lea rdx, str.IsAcrInstalledInRdrMode
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400021bb
cmp dword [rbp + 0x20], 4
jne 0x1400021bb
cmp dword [rbp + 0x18], eax
setne byte [0x140007112]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x140007113], 1
add rsp, 0x40
pop rbp
ret