joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f458
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rcx
mov qword [rbp - 0x29], rcx
xor r15d, r15d
mov dword [rbp - 0x39], r15d
mov dword [rbp - 0x19], 0x5f005f
mov dword [rbp - 0x15], 0x520043
mov dword [rbp - 0x11], 0x40005f
mov dword [rbp - 0xd], 0x410046
mov dword [rbp - 9], 0x4c0049
mov dword [rbp - 5], 0x440045
mov dword [rbp - 1], 0x44005f
mov dword [rbp + 3], 0x57004f
mov dword [rbp + 7], 0x4c004e
mov dword [rbp + 0xb], 0x41004f
mov dword [rbp + 0xf], 0x5f0044
mov dword [rbp + 0x13], 0x450052
mov dword [rbp + 0x17], 0x440041
mov dword [rbp + 0x1b], 0x5f0040
mov dword [rbp + 0x1f], 0x520043
mov dword [rbp + 0x23], 0x5f005f
mov word [rbp + 0x27], r15w
lea rdx, [rbp - 0x19]
call fcn.140001cb0
nop
mov dword [rbp - 0x39], 1
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400b0c90
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140020184
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x50
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rdi, rdx
and qword [rax - 0x28], 0
mov dword [rax - 0x30], 0x80
mov dword [rax - 0x38], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400201f5
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, eax
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x1400201ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x140020282
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and dword [rsp + 0x60], 0
mov rax, qword [rdi]
mov ebx, dword [rax - 0x10]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
or eax, ecx
jge 0x14002022a
xor edx, edx
mov rcx, rdi
call fcn.140001f54
lea r8d, [rbx + rbx]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov rdx, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
sete bl
mov rdx, qword [rdi]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140020280
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, bl
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140020294
Capabilities:
Get file size

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
and dword [rax - 0x20], 0
mov rdi, rdx
mov edx, 0x80000000
xor r9d, r9d
xor r8d, r8d
mov dword [rax - 0x28], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400202d1
xor eax, eax
jmp 0x1400202f5
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov eax, eax
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140020718
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
mov rcx, qword [rcx]
xor edi, edi
mov rsi, rdx
mov qword [rax - 0x18], rdi
mov dword [rax - 0x20], 0x80
lea r8d, [rdi + 2]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rax - 0x28], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400207ae
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rdx, qword [rsi]
mov dword [rsp + 0x50], edi
mov r8d, dword [rdx - 0x10]
lea r9, [rsp + 0x50]
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400207a5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dil, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov al, dil
add rsp, 0x40
pop rdi
ret
Function at 0x140021220
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r10, qword [rcx]
xor r9d, r9d
mov esi, r8d
mov r14, rdx
test r10, r10
jne 0x1400212c0
mov r8d, dword [0x14018cd80]
mov eax, 0x6bca1af3
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 3
jne 0x1400212a8
mov edx, r9d
mov r10d, 8
mov ecx, edx
mov eax, edx
and ecx, 1
sar eax, 1
dec ecx
not ecx
and ecx, r8d
mov edx, ecx
xor edx, eax
dec r10
jne 0x140021279
inc r9d
add r8d, edx
cmp r9d, 0x100
jl 0x140021270
mov dword [0x14018cd80], r8d
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov ecx, r9d
mov r11, r9
mov rax, r10
cmp qword [rax + 0x10], r9
je 0x1400212a8
cmp dword [rax + 8], esi
jne 0x1400212fb
mov rdx, qword [r14]
test rdx, rdx
je 0x14002131d
mov r8, qword [rax]
sub rdx, r8
movzx ebx, word [r8]
movzx edi, word [r8 + rdx]
sub ebx, edi
jne 0x1400212f7
add r8, 2
test edi, edi
jne 0x1400212e2
test ebx, ebx
je 0x14002130f
inc r11
inc ecx
add rax, 0x18
cmp r11, 0x400
jge 0x1400212a8
jmp 0x1400212c9
movsxd rcx, ecx
lea rax, [rcx + rcx*2]
mov rax, qword [r10 + rax*8 + 0x10]
jmp 0x1400212aa
mov ecx, 0x80004005
call fcn.140001874
int3
Function at 0x140025d90
Capabilities:
Get disk size

Disassembly:
push rbx
sub rsp, 0x30
mov r9d, dword [0x14018cd80]
mov r10d, 0x66666667
mov bl, 1
mov r8d, r9d
mov eax, r10d
imul r8d, r9d
imul r8d, r9d
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub r8d, ecx
cmp r8d, 0x12
jne 0x140025e36
lea r8d, [r9 + 1]
mov eax, r10d
xor ebx, ebx
mov ecx, r8d
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp ecx, 9
je 0x140025e36
lea ecx, [r9 + 2]
mov eax, 0x2aaaaaab
imul ecx, r8d
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x16
jne 0x140025e36
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov al, bl
add rsp, 0x30
pop rbx
ret

Function at 0x140034f08
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov r8d, dword [0x14018cd80]
mov ebx, eax
mov eax, 0x6bca1af3
imul r8d, r8d
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x13
sub r8d, edx
cmp r8d, 3
jne 0x140034f54
mov edx, 0xe4
lea rcx, str._d__d_n
lea r8d, [rdx + 1]
call fcn.1400b15a4
movzx ecx, bl
mov eax, 1
cmp ecx, 6
ja 0x140034f6d
jne 0x140034f6b
shr bx, 8
cmp bl, al
ja 0x140034f6d
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140036058
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rdx, qword [rcx]
mov rcx, qword [0x140187d58]
lea rax, [r11 + 8]
mov rsi, r8
mov r9d, 0xf003f
xor r8d, r8d
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
je 0x140036099
xor al, al
jmp 0x1400360fd
mov rax, qword [rsi]
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x40]
cmp dword [rax - 0x10], ebx
jne 0x1400360b3
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
jmp 0x1400360ed
lea rax, [rsp + 0x58]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400360ed
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x58]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete al
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400368a8
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x60
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
xor ebp, ebp
mov qword [rax - 0x20], rbp
mov dword [rax - 0x18], ebp
mov qword [rax - 0x10], rbp
mov dword [rax - 0x40], 0x2001f
mov dword [rax - 0x48], 0x100
mov r8, qword [r8]
mov rdx, r9
lea rcx, [rax - 0x20]
call fcn.140017558
test eax, eax
je 0x14003692d
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
mov r8, qword [rdi]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140017558
test eax, eax
je 0x14003692d
mov dil, bpl
mov rbx, qword [rsp + 0x48]
jmp 0x14003699a
mov rcx, qword [rsi]
mov eax, ebp
test rcx, rcx
setne al
mov rbx, qword [rsp + 0x48]
test eax, eax
jne 0x140036946
lea edi, [rax + 0xd]
jmp 0x14003697a
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bp
jne 0x14003694a
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test rbx, rbx
je 0x140036990
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebp
test edi, edi
sete dil
test rbx, rbx
je 0x1400369ad
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov al, dil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x140036c14
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
mov rax, r9
mov rbx, rdx
mov rdi, rcx
and qword [rbp - 0x20], 0
and dword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov r9d, 0x2001f
mov r8, qword [r8]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140017618
test eax, eax
je 0x140036c68
xor dil, dil
mov rbx, qword [rbp - 0x20]
jmp 0x140036cc5
mov dword [rbp + 0x20], 4
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [rbx]
mov rbx, qword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140036ca7
mov eax, dword [rbp - 0x30]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
test rbx, rbx
je 0x140036cbb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov qword [rbp - 0x20], rbx
and dword [rbp - 0x18], 0
test edi, edi
sete dil
test rbx, rbx
je 0x140036cd8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x20], 0
and dword [rbp - 0x18], 0
mov al, dil
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x140036cf0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
lea rcx, [r11 + 0x18]
mov rax, r9
mov rbx, rdx
mov rdx, qword [r8]
mov qword [r11 - 0x18], rcx
mov rcx, rax
mov r9d, 0x2001f
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140036d2e
xor al, al
jmp 0x140036d6e
mov r8, qword [rbx]
mov rdx, qword [rsi]
mov r9d, 1
mov ecx, dword [r8 - 0x10]
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400373b4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x30
mov rdx, qword [r8]
mov rbx, rcx
mov rax, r9
lea rcx, [rsp + 0x50]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400373ef
xor al, al
jmp 0x140037427
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140037434
Capabilities:
Get disk size
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x7b8]
sub rsp, 0x890
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov r14, rdx
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], r15
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.140035b44
nop
mov r9d, 0x2001f
mov r8, qword [rax]
mov rdx, qword [0x140187d58]
lea rcx, [rsp + 0x48]
call fcn.140017618
test eax, eax
setne bl
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400374c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x1400374d9
mov dil, r15b
mov rbx, qword [rsp + 0x48]
jmp 0x1400375ce
mov eax, dword [0x14018cd80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 4
jne 0x140037518
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov esi, r15d
mov edi, 1
mov word [rbp - 0x80], r15w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp - 0x7e]
call fcn.1400b60d0
mov dword [rsp + 0x40], 0x400
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x80]
mov edx, esi
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add esi, edi
test eax, eax
jne 0x1400375b3
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x68]
call fcn.140001cb0
nop
mov rdx, rax
mov rcx, r14
call fcn.14001886c
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140037520
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140037520
test rbx, rbx
je 0x1400375c9
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], r15d
test rbx, rbx
je 0x1400375e1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], r15d
mov al, dil
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.1400b0c90
mov rbx, qword [rsp + 0x8d0]
add rsp, 0x890
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400397f0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rax - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rbx, rcx
and dword [rax - 0x28], 0
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx esi, al
movzx edx, ax
shr dx, 8
movzx ebp, dl
cmp eax, 0x80000000
jae 0x140039832
mov edi, eax
shr edi, 0x10
cmp esi, 6
jb 0x14003984f
cmp ebp, 2
jb 0x14003984f
mov rcx, rbx
call fcn.140039afc
nop
mov dword [rsp + 0x30], 1
jmp 0x1400398b2
lea rcx, [0x1401849a8]
mov rax, qword [0x1401849a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x20], edi
mov r9d, ebp
mov r8d, esi
lea rdx, str._d._d___d_
lea rcx, [rsp + 0x68]
call fcn.14000f338
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.140002948
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400398b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x14003a638
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x14018d860], al
je 0x14003a665
lea rax, [0x140188b38]
jmp 0x14003a6ed
mov dword [rbp - 0x40], 0x40007
mov dword [rbp - 0x3c], 0x190005
mov r11d, 1
mov dword [rbp - 0x38], 0xf0001
mov dword [rbp - 0x34], 0x110030
mov dword [rbp - 0x30], 0x32000c
mov dword [rbp - 0x2c], 0x30005
mov dword [rbp - 0x28], 0xf0011
mov dword [rbp - 0x24], 0xe0011
mov dword [rbp - 0x20], 0x7002a
mov dword [rbp - 0x1c], 0x1a0006
mov dword [rbp - 0x18], 0x60016
mov dword [rbp - 0x14], 3
lea rdx, [0x140188b38]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
add rax, r11
cmp rax, 0x17
jl 0x14003a6c6
mov byte [0x14018d860], r11b
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x40
pop rbp
ret
Function at 0x14003a700
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov ecx, dword [0x14018cd80]
xor ebx, ebx
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
lea edi, [rbx + 4]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, ecx
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub r8d, eax
cmp r8d, 2
jne 0x14003a798
mov rax, qword [str.pQQPsZXL]
or r8, 0xffffffffffffffff
mov qword [rbp - 0x50], rax
mov al, byte [0x1401208c0]
mov rcx, r8
mov byte [rbp - 0x48], al
lea rax, [rbp - 0x50]
inc rcx
cmp byte [rax + rcx], bl
jne 0x14003a776
mov rax, rdi
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400b0308
mov rcx, rax
call fcn.1400b13b8
cmp byte [0x14018d869], bl
lea rax, [0x1401885d8]
jne 0x14003a824
mov dword [rbp - 0x40], 0x13000f
mov dword [rbp - 0x3c], 0x2a001c
mov dword [rbp - 0x38], 0x50011
mov dword [rbp - 0x34], 0x1d000a
mov dword [rbp - 0x30], 0x80013
mov dword [rbp - 0x2c], 0x50005
mov dword [rbp - 0x28], 0xa0011
mov dword [rbp - 0x24], 0x19003a
mov qword [rbp - 0x20], 0x1d0010
mov dword [rbp - 0x18], 0x360017
mov dword [rbp - 0x14], 0xa001c
mov dword [rbp - 0x10], 0x1b0004
mov word [rbp - 0xc], bx
lea rcx, [0x140187da0]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 0x40]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, 0x1a
jl 0x14003a800
mov byte [0x14018d869], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14003a844
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
cmp byte [0x14018d874], al
je 0x14003a86e
lea rax, [0x140188728]
jmp 0x14003a8d8
mov dword [rbp - 0x30], 0xd0002
mov dword [rbp - 0x2c], 0xd0029
mov dword [rbp - 0x28], 0x1f000d
mov dword [rbp - 0x24], 0xa002c
mov dword [rbp - 0x20], 0x80007
mov dword [rbp - 0x1c], 0x120040
mov dword [rbp - 0x18], 0xa001b
mov dword [rbp - 0x14], 0x560000
mov word [rbp - 0x10], ax
lea rdx, [0x140188728]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
inc rax
cmp rax, 0x10
jl 0x14003a8b1
mov byte [0x14018d874], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x30
pop rbp
ret
Function at 0x14003ab84
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r8d, r8d
cmp byte [0x14018d856], r8b
je 0x14003abb3
lea rax, [0x140188360]
jmp 0x14003ac9b
mov r9d, dword [0x14018cd80]
mov r10d, 4
mov dword [rbp - 0x50], 0x26
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
mov dword [rbp - 0x4c], 0x250018
mov dword [rbp - 0x48], 0x40016
mov dword [rbp - 0x44], 0x24000c
mov dword [rbp - 0x40], 0x90007
imul ecx, eax
imul ecx, r9d
mov eax, 0xb21642c9
mov dword [rbp - 0x3c], 0x140014
mov dword [rbp - 0x38], 0x1d0007
mov dword [rbp - 0x34], 0x40045
mov dword [rbp - 0x30], 0x500013
mov dword [rbp - 0x2c], 0x1b0023
imul ecx
add edx, ecx
mov dword [rbp - 0x28], 0xd0013
mov dword [rbp - 0x24], 0x20038
sar edx, 4
mov dword [rbp - 0x20], 0x1d000a
mov dword [rbp - 0x1c], 0x150003
mov eax, edx
mov dword [rbp - 0x18], 0x550015
mov dword [rbp - 0x14], 0x4e
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
lea edx, [r10 - 3]
cmp ecx, r10d
jne 0x14003ac6e
test r9d, r9d
cmove r9d, edx
mov dword [0x14018cd80], r9d
lea rax, [0x140188360]
lea rcx, [0x140187da0]
movzx ecx, byte [r8 + rcx]
xor cx, word [rbp + r8*2 - 0x50]
mov word [rax + r8*2], cx
add r8, rdx
cmp r8, 0x1f
jl 0x14003ac75
mov byte [0x14018d856], dl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x50
pop rbp
ret

Function at 0x14003acb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x14018d880], al
je 0x14003acdd
lea rax, [0x140188750]
jmp 0x14003ad85
mov dword [rbp - 0x60], 0x90000
mov dword [rbp - 0x5c], 0x1a0000
mov dword [rbp - 0x58], 0x4b0007
mov dword [rbp - 0x54], 0x40009
mov dword [rbp - 0x50], 0x1000a
mov r10d, 1
mov dword [rbp - 0x4c], 0x150003
mov dword [rbp - 0x48], 0x1e0054
mov dword [rbp - 0x44], 0x40017
mov dword [rbp - 0x40], 0x500016
mov dword [rbp - 0x3c], 0x70006
mov dword [rbp - 0x38], 0x1d0052
mov dword [rbp - 0x34], 0x190011
mov dword [rbp - 0x30], 0x60005
mov dword [rbp - 0x2c], 0x6000c
mov dword [rbp - 0x28], 0x60018
mov dword [rbp - 0x24], 0x40000
mov word [rbp - 0x20], ax
lea rdx, [0x140188750]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x60]
mov word [rdx + rax*2], cx
add rax, r10
cmp rax, 0x20
jl 0x14003ad5e
mov byte [0x14018d880], r10b
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x60
pop rbp
ret

Function at 0x14003ad98
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rsp + 8], rax
xor eax, eax
cmp byte [0x14018d86c], al
je 0x14003adbe
lea rax, [0x1401885c0]
jmp 0x14003adfa
mov dword [rsp], 0x4b0039
mov dword [rsp + 4], 0x34
lea rdx, [0x1401885c0]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rsp + rax*2]
mov word [rdx + rax*2], cx
inc rax
cmp rax, 3
jl 0x14003add4
mov byte [0x14018d86c], 1
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x18
ret