joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140bb01f6
Capabilities:
Encode data using base64

Disassembly:
lea rsi, [rsi + rdx + 8]
inc rbx
jg 0x140bfb559
inc ecx
xor dword [rsp + r11 - 0x3c10991e], ebx
lea rdx, [rax + r8 + 0x78afd920]
push r11
mov rbp, qword [rsp + r11 - 0x3c109916]
movsxd rbx, ebx
btr rax, r10
adc r9, rbx
cwd
rol word [rsp + r11*2 - 0x7821323a], 0x82
jb 0x140c07d97
mov r11w, word [rdi + r11 - 0x3c10991e]
ror r10d, 0x86
mov r8w, word [r8 + rdi - 0x7c11323a]
lea rdi, [rdi + rax - 0x66fe]
add r11w, r8w
movsx ebx, dx
mov word [rax + rdi - 0x6700], r11w
shr edx, cl
mov qword [rsp + rax*2 - 0xce00], r9
ret 8
mov qword [rdi + rbx*2 - 0xad008], rax
call fcn.140bd922c
mov rbp, qword [rsp + rdx*4 + 0xc]
inc edx
shr ax, 0xca
movsxd r11, r11d
jb 0x140b9fae2
mov qword [rsp + rdx*2 + 8], r8
adc r9, r11
neg ax
lea rbx, [rdx*4 + 0x520b8a4]
movzx r8d, word [rdx + rsi + 6]
shl word [rsp + rdx*2 + 2], 0x4e
jae 0x140ba701c
mov qword [rsp], rsi
inc bp
ror bp, 0xe2
sal dl, 0x27
push rbx
jnp 0x140b7652f
setnp bpl
movzx ebx, dl
push rdi
mov rbp, r9
or ebx, 0xb312eb8e
inc bx
call fcn.140bf330b
mov edx, 0xf7b60515
mov ebx, edx
mov r11d, dword [rsi + riz]
lea rcx, [rdx + rbx*8 + 0x5c844aa4]
movzx eax, bl
rol bl, cl
xor r11d, ebp
neg ecx
ror dl, 4
not r11d
add eax, eax
mov r10d, 0x5e3edc23
bt rcx, rdx
inc r11d
btc r10d, ecx
rol r11d, 2
movsx r8d, cl
shl r8w, 0x42
lea r11d, [r11 + rax - 0x7314fd2a]
ror r11d, 2
or bl, 0xbe
sal r10w, 0x4f
neg r11d
ror r8w, 0x21
push rbp
btr r10, rax
imul r10w
xchg bx, cx
xor dword [rsp + rax*8], r11d
pop rbp
add r8b, 3
sub eax, edx
movsxd r11, r11d
div r8
add r9, r11
jmp 0x140bf2593
dec r11w
cqo
sal dword [rsp + rax - 0x5910052], 0xc5
shl r10b, 0xc5
xor r11w, 0xf31f
cqo
xchg r10d, ecx
ror r11w, 1
xor di, r11w
ror dword [rsp + rax - 0x5910050], 0xfd
cdq
mov word [rax + r9 - 0x5910053], r11w
movzx r11d, word [rsp + rax*2 - 0xb2200a4]
mov qword [rsp + rax*2 - 0xb2200a6], rbx
ret
sub cl, r8b
mov r10, qword [rdx + rdi - 0x6a034416]
movzx ebx, byte [rdx + rsi - 0x6a034412]
ror ax, 0xa1
shr dx, 0xef
sal al, 0x21
xor bl, bpl
not bl
movsx r11d, cl
idiv rcx
add bl, 0x32
neg rcx
mul rdx
xor bl, 0x12
cbw
btc ax, r11w
call fcn.140bde700
pop rdx
movsxd rbp, ebp
bswap eax
shr dx, 0x82
mov qword [rsp + r8 - 0x65b37a00], 0xffffffffc203f7a7
add rbx, rbp
sub dword [rsp + rax*4 - 0x1647fff8], ecx
movzx r11d, word [rsi + rax*2 - 0xb240005]
imul byte [rsp + rax - 0x591fff8]
adc r10w, 0x6f9f
lea rsi, [rsi + rax - 0x591005a]
setno byte [rsp + rax*4 - 0x1644014b]
dec rdx
mul byte [rsp + rax - 0x5910052]
xor r11w, di
dec r11w
and edx, 0xb31d9833
neg r11w
jmp 0x140bd8c54
xor r8w, bp
cdq
jmp 0x140b6b72b

Function at 0x140bb1271
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
lea rdx, [rbx*8 + 0x67a406b7]
mov qword [rsp + rbx*2 - 0x1e529292], rax
xor bpl, r11b
rol r8w, cl
push rcx
shl r8, cl
mov word [rbx + rdi - 0xf294953], r11w
lea rdi, [rdi + rbx*4 - 0x3ca5252e]
call fcn.140b50ad9
jmp 0x140c01ad2
mov r10d, 0xf91dcf86
shl r10w, 0xaa
movzx dx, byte [r9 + riz]
push r10
mov cl, byte [r9 + riz + 2]
adc r9, 2
call fcn.140b6100c
Function at 0x140bbc01b
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov rdx, qword [rdi + r8 - 0x68d1b870]
adc rax, rcx
mov r11d, 0x172a7c91
cbw
mov r8d, dword [rdx + r8 - 0x68d1b870]
lea rdi, [r11 + rdi - 0x172a7c8d]
mov dword [rdi + r11*4 - 0x5ca9f244], r8d
jmp r9
mov qword [rsp], rbp
xor dword [rsp], ebx
pop rbp
lea rdx, [r8 + 0x7e1ac608]
btc r8d, eax
movsxd rbx, ebx
adc r9, rbx
neg cx
jg 0x140b7e3c3
Function at 0x140bbf969
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], 0x4ba8e13d
rep movsb byte [rdi], byte [rsi]
push qword [rsp + 0x18]
popfq
call fcn.140bbf77b

Function at 0x140bc6b88
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0xffffffffac173635
call fcn.140ba5fb6
Function at 0x140bd02f5
Capabilities:
Encode data using base64

Disassembly:
mov r11, qword ss:[rax + r8 - 0x48148c18]
ror r8w, 0x87
rol ecx, 0xf7
mov qword [r9 + rcx - 0x7c84016f], r11
or r8b, cl
rol r8, 0x1a
movsx edx, cl
lea rsi, [rsi + rdx - 0x73]
lea rax, [rdx*2 + 0x161501b8]
sal cl, 0xa6
xchg ah, al
mov edx, dword [rsi + rdx*4 - 0x1bc]
xor edx, edi
lea r10, [rax + rax*8 - 0x754e0d67]
inc edx
xchg r10d, eax
rol eax, 0x9b
lea rax, [r8*4 - 0x1247cf6b]
rol edx, 1
not edx
bswap edx
xadd r10d, ecx
push rdi
sar cl, 0x67
call fcn.140b56b16
lea r11, [rbx - 0x12ef4551]
add r9, rcx
btr dx, r11w
cdq
mov r8, qword [rdi + rdx*2]
mov r10d, ebx
mov r11, qword [rdx + rdi + 8]
shl dx, 0xd
mov cl, byte [rdi + rax*2 + 0x10]
push rbx
add r10, r10
pop rbx
lea rdi, [rdx + rdi + 0xa]
jb 0x140bc641c
shrd r8, r11, cl
bswap ebx
mov qword [rdi + rdx*4], r8
inc r10d
lea r11, [rbx + r10*4 - 0x6c568267]
add rdx, r9
jmp rdx
call fcn.140c1f5a2
mov r8d, 0x48148c18
lea rcx, [r8*4 - 0x184f5167]
mov rax, qword [r9 + r8 - 0x48148c18]
mov r11d, r8d
jmp 0x140b78ab1

Function at 0x140bd2f69
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
shl edx, 3
add rax, rax
mov qword [rsp], 0xffffffffb1b1b208
shr rax, 0xb8
xor rax, rbp
call fcn.140b63f99
Function at 0x140bdecb7
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + r8 - 0x4a29c00f], rbp
mov r10d, 0x3cb8919e
xor dword [rsp + r8 - 0x4a29c00f], edx
lea rbx, [r11 + r8*4 + 0x4bbd51af]
mov rbp, qword [rsp + r8 - 0x4a29c00f]
mov qword [rsp + rcx - 0x4a29c00e], rbx
mov qword [rsp + rcx - 0x4a29c016], rax
call fcn.140b4ae41

Function at 0x140be22dd
Capabilities:
Encode data using base64

Disassembly:
xor eax, ebp
call fcn.140c16ed8
mov r10d, 0xaeb43c23
mov r8d, r10d
mov eax, r10d
mov r10, qword [rdi + riz]
movzx r11d, r8b
mul rax

Function at 0x140be5c35
Capabilities:
Encode data using base64

Disassembly:
add rcx, rdx
not r11d
adc rdx, 0x2c104939
shr ebp, 0xa1
rol r11d, 1
lea rdx, [rcx*4 + 0x28088a0e]
push rdi
xor dword [rsp + rax], r11d
movsx edi, r10b
pop rdi
xchg r8w, cx
xchg cx, r8w
cdq
movsxd r11, r11d
shl ecx, 0xbc
sub ebp, ebp
adc rbx, r11
rol dx, 0xc5
adc rax, rbx
jmp rax
add r10b, 0xab
ror r10b, 1
inc rcx
add r10b, 0xbe
not r8
xor rbx, rbx
jl 0x140b75f4e
not r10b
pop r8
xor bpl, r10b
sal al, 0xc3
or dl, dh
adc r10, rsp
xor rbx, qword [rdx + r10]
call fcn.140bade15
xor r10b, bpl
mov qword [rsp + rdx*8], rax
xor r10b, 0xb7
inc qword [rsp + rdx*8]
sub r10b, 0x18
neg qword [rsp + rdx]
neg r10b
dec byte [rsp + rdx + 4]
jnp 0x140bd5646
xor word [rsp + rbp + 1], bp
lea rsi, [rsi + rax - 5]
pop rbp
xor r11d, edi
lea r11d, [r11 + rax*4 + 0x48e8f2b]
shl r10b, 0x27
xor dx, dx
adc ecx, eax
xor r11d, 0x9d39b90d
mul eax
mov r8d, ebp
dec r11d
cqo
jmp 0x140bb017b

Function at 0x140be724a
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
btr r8w, dx
mov qword [rsp + rbp*2 - 0x277a], 0xffffffffa39ba1a5
add rbx, r10
not r11
mov r11w, 0x7f
btr r8d, 0x29
bt rbp, rax
jae 0x140c178a8
mov ebx, dword [rsi]
mov r10d, 0x2ea11d31
lea rsi, [rsi + r10*2 - 0x5d423a5e]
xor ebx, ebp
sub ebx, 0x740eab07
movzx r11d, r10w
neg ebx
lea rdx, [r10 + r10*4 + 0x7a982333]
movsx r8d, dx
dec ebx
ror ebx, 1
lea rax, [r8 - 0x1bcc024f]
push rbp
imul rdx, r8
movzx ecx, dx
or r11, 0x4793900f
xor dword [rsp + r10 - 0x2ea11d31], ebx
jmp 0x140be3e40
Function at 0x140bf5def
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
not r10d
ror byte [rsp + r11*4 - 0x1f21d], 0x42
lea rax, [rcx + r11*2 - 0x387a2a4f]
dec ecx
mov qword [rsp + r11*8 - 0x3e448], rdi
xor cl, 5
xor dword [rsp + r11 - 0x7c89], r10d
cwde
cdq
pop rdi
movsxd r10, r10d
add rbx, r10
sal r8, 0x4e
sal ecx, 0x64
ja 0x140b538dd
dec r11d
not r10d
dec cl
lea r10d, [rbp + r10 - 0x70406d71]
and dword [rsp + rdx - 0x487], ecx
imul rdx, rcx
shl word [rsp + r11 - 0x7c87], 0x4f
rol r10d, 3
and word [rsp + r11 - 0x7c84], dx
dec r10d
jmp 0x140b72e53
movsx r11d, cx
sub bpl, 0x21
dec r10w
xor r10w, 0xa218
bts dx, cx
mov qword [rsp + rbp - 0x7c69], 0xffffffffdfabe0b0
sal qword [rsp + rbp - 0x7c69], 0x44
ror r10w, 1
xor di, r10w
ror word [rsp + rbp - 0x7c63], cl
movsx r8d, bp
lea r10, [rsp + r10 + 8]
not ebp
sal ecx, 0x48
rol word [rsp + rcx*4 - 0x1f227ff], 0xce
mov word [r10 + rcx*4 - 0x1f22800], ax
sbb r8, rbp
ror word [rsp + rcx*2 - 0xf913fa], 0xa3
neg r8w
mov r10d, dword [rsi + rcx*4 - 0x1f22806]
sbb qword [rsp + rcx*4 - 0x1f22800], r8
xor r10d, edi
shr dword [rsp + rdx - 0x486], 0xc1
sub ecx, 0x403dbd8e
dec r10d
jmp 0x140be2ea6

Function at 0x140c017be
Capabilities:
Encode data using base64

Disassembly:
call fcn.140bfe525
bswap eax
pop r8
ror rbx, 0x8c
rol eax, 1
push rbp
rol cl, 0x86
call fcn.140bd7ff5
lea rsp, [rsp + 0x18]
jne 0x140becea7
jmp 0x140ba00b7

Function at 0x140c0417b
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
lea r10, [rsp + r10 + 0x10]
shl al, 0x81
mov qword [rsp + r8*2 - 0x251c], rdx
mov ebx, dword [r8 + r10 - 0x128e]
shl byte [rsp + r8*4 - 0x4a33], 0xa3
lea r10, [rcx*8 - 0x236be16b]
mov dword [rax + rdi - 0x44a3d2de], ebx
ja 0x140be103a
ror eax, cl
shl byte [rsp + r8 - 0x128e], 0x63
lea rdi, [rdi + r8*2 - 0x2518]
call fcn.140b62707

Function at 0x140c07da9
Capabilities:
Encode data using base64

Disassembly:
adc byte [rsp + 0x10], 0xa8
ror dword [rsp + 0x12], 0x63
lea rsp, [rsp + 0x20]
mov qword [rbp + riz - 0x10], rsp
call fcn.140b57818

Function at 0x140c0ff1c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x10]
je 0x140c0ac80

Function at 0x140c12ae9
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
add r8w, 0x78b7
mov qword [rsp + r10 - 0x18], 0xffffffffd781c41d
inc qword [rsp + r10 - 0x18]
ror r8w, 1
and dword [rsp + r10 - 0x17], eax
rol word [rsp + r10*2 - 0x2b], 0xc3
movsx edx, r11w
xor r8w, 0x239
mov qword [rsp + r10*4 - 0x60], 0xffffffff97969b8d
push rdx
inc byte [rsp + r10 - 0x11]
Function at 0x140c13dc8
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
mov rbp, r11
mov edi, dword [rsp + 1]
cdqe
and dword [rsp + rax*2 + 3], ebx
mov rsi, rbp
mov rdi, r9
mov edx, eax
call fcn.140c08bdc
push 0x6432e00a
shr qword [rsp], 0x57
mov ecx, dword [rdi]
dec qword [rsp]
push 0x69a2bf24
mov eax, dword [rdi + 4]
push 0xffffffffbdba0321
adc rdi, 4
sal byte [rsp + 0x14], 0xe4
mov r11d, 0x6a0a808d
adc ecx, eax
shr dword [rsp + r11 - 0x6a0a807b], 0x73
sar word [rsp + r11 - 0x6a0a808b], 0x86
movsx r8d, byte [rsp + r11 - 0x6a0a8083]
mov dword [rdi + r11 - 0x6a0a808d], ecx
movsx ecx, word [rsp + r11 - 0x6a0a807b]
mov ebx, r11d
mov edx, dword [r11 + rsi - 0x6a0a808d]
jne 0x140be4460
xor dl, dil
dec dl
ror dl, 1
movsx ebx, bp
lea r10, [rbp + rbp*8 - 0x444b7b47]
not dl
sub dl, 0xa7
xor dil, dl
xchg r10b, bl
mov qword [rsp], 0xffffffff8093a836
movsx eax, word [rsp + 4]
lea rdx, [rsp + rdx + 8]
mov r11, qword [rdx + riz]
jmp 0x140b69b6c

Function at 0x140c1c947
Capabilities:
Parse pe header

Disassembly:
rol bpl, 1
call fcn.140be872f
mov r10d, 0x2d340731
mov ecx, r10d
movzx ebp, cx
mov r10, qword [r9 + r10*2 - 0x5a680e62]
mov rax, qword gs:[r10 + rbp - 0x731]
mov r8d, 0xe1afe79f
movzx r11d, bp
lea rdx, [rbp + r8 + 0x5b1944ba]
mov qword [r9 + rcx - 0x2d340731], rax
xadd r11b, r8b
js 0x140bb1244
mov edx, 0x54a9ce1b
lea rsi, [rsi + rdx - 0x54a9ce1f]
mov eax, dword [rsi + rdx - 0x54a9ce1b]
movsx ecx, dl
push rcx
xor eax, edi
jmp 0x140b758e0

Function at 0x140c1dc9a
Capabilities:
Encode data using base64

Disassembly:
lea r11d, [r11 + rcx*2 - 0x60bc05e3]
mov qword [rsp + rcx*2 - 0x40], rdi
xor bpl, al
ror r10, 0x4f
push rbp
xor dword [rsp + r8 - 0x5a8ac418], r11d
btc r10, rcx
mov rdi, qword [rsp + rcx - 0x18]
movsxd r11, r11d
mov qword [rsp + r8 - 0x5a8ac418], rbp
adc rbx, r11
movzx edx, byte [r8 + rsi - 0x5a8ac425]
sal word [rsp + rcx - 0x18], 0x66
xadd r8, rax
xor dl, dil
mov r11d, r8d
xadd qword [rsp + rbp*4 - 0x68000144], r10
sbb bp, word [rsp + r8 - 0x5a8b0092]
xor dl, 0xbb
sub dl, 8
rol dl, 1
dec dl
not word [rsp + r8 - 0x5a8b008e]
sar byte [rsp + r8 - 0x5a8b008d], 0xa4
shr ax, 0x6a
neg dl
not bp
xor dil, dl
xadd byte [rsp + r8 - 0x5a8b0091], al
sar ebp, 7
rol r10b, 0x84
lea rdx, [rsp + rdx + 0x10]
cwde
neg r11b
mov r8b, byte [rdx + r8 - 0x5a8b0093]
ror cl, 0x81
neg dword [rsp + rcx - 0xf]
mov word [r9 + rcx*4 - 0x42], r8w
sbb byte [rsp + rcx*2 - 0x1d], 0x37
movzx r8d, r11w
sal r10d, 0x81
mov r8b, byte [rsi + rbp*2 - 0x680404]
not r10w
lea rsi, [rcx + rsi - 0x16]
jne 0x140c1eaba
not r11d
lea r11d, [r11 + rcx*2 - 0x342fa0e7]
cwde
bswap r11d
mov r10d, ecx
mov qword [rsp + r8 - 0x5a8ac420], 0xffffffffcb939434
dec r11d
or dword [rsp + r8 - 0x5a8ac41f], r10d
and rbp, 0x3f143232
neg r11d
jmp 0x140bc00c9
Function at 0x140c1f428
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
cwd
je fcn.140badb97
mov r8d, 0xda45622
mov r10, qword [r9 + r8*2 - 0x1b48ac44]
lea rbp, [r8 + r8*4 + 0x1ca62cbf]
movzx edx, bp
mov bp, word [r9 + rdx*2 - 0x1b6ca]
push r8
and dword [rsp + r8 - 0xda45620], edx
xor word [rsp + r8 - 0xda4561c], dx
lea r9, [r8 + r9 - 0xda45618]
movzx ecx, r8b
mov word [r10 + r8*4 - 0x36915888], bp
xadd word [rsp + r8*2 - 0x1b48ac3f], dx
jne 0x140bfff0b
lea rsi, [rsi + r8*2 - 0x1b48ac48]
mov ecx, dword [r8 + rsi - 0xda45622]
movsx eax, byte [rsp + r8*2 - 0x1b48ac42]
or edx, r8d
xor ecx, edi
sub ecx, 0xfcb5031a
btr r8d, 7
mov ebp, 0x7dbacf0f
sbb dword [rsp + r8*4 - 0x36915885], ebp
rol ecx, 1
not ecx
movsx r10d, al
pop r8
rol r10d, 3
inc ecx
inc rbp
sar r10b, 0x81
mul r10w
neg ecx
sar edx, 0x93
xor ebp, ebp
movsx r11d, r10b
push rdi
add ax, bp
sub dl, dh
cmovbe r11, r10
xor dword [rsp + rdx*8 - 0xd98], ecx
not r11d
sal r8w, 0xf
rol r10b, 0x25
pop rdi
movsxd rcx, ecx
adc rbx, rcx
or r8, rbp
adc rbp, rbx
jmp rbp
sub edx, r8d
mov qword [rsp + r8], rdi
shl ebp, 0xc
mul bp
shr r11w, 0x2e
xor dword [rsp + rbp], ecx
cbw
btc r11, 0xb8
pop rdi
mov dword [r9 + rbp*2 - 0xc], ecx
lea r9, [r9 + rbp - 0xc]
neg dl
jle 0x140ba4ed6

Function at 0x140c1f5a2
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
ror qword [rsp + 0x40], 0x9a
xor ebx, 0x50aae79c
push 0xffffffff993636b7
dec rcx
lea rsp, [rsp + 0x50]
jne 0x140b82e0b
mov r9d, 0x450197ab
pop r9
Function at 0x140002280
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x1400af848], rbx
je 0x1400022e7
cmp rax, rbx
jne 0x1400022da
mov ebx, 1
mov esi, ebx
jmp 0x1400022ec
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400022bf
mov ebx, 1
mov eax, dword [0x1400af850]
cmp eax, ebx
jne 0x140002304
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000237a
mov eax, dword [0x1400af850]
test eax, eax
jne 0x14000236f
mov dword [0x1400af850], ebx
lea r15, [0x14006eba0]
lea rdi, [0x14006eb88]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x140002361
test eax, eax
jne 0x140002365
cmp qword [rdi], r14
je 0x140002356
movabs r10, 0xd30527475e523070
mov rax, qword [rdi]
mov rcx, qword [0x14006eaa8]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000232e
test eax, eax
je 0x140002375
mov eax, 0xff
jmp 0x1400024da
mov dword [0x1400ae9f0], ebx
mov edi, 0x1f
mov eax, dword [0x1400af850]
cmp eax, ebx
jne 0x1400023a1
lea rdx, [0x14006eb80]
lea rcx, [0x14006eab8]
call sub.msvcrt.dll__initterm
mov dword [0x1400af850], 2
test esi, esi
jne 0x1400023af
mov rax, r14
xchg qword [0x1400af848], rax
cmp qword [0x1400af868], r14
je 0x1400023ec
lea rcx, [0x1400af868]
call fcn.140002b50
test eax, eax
je 0x1400023ec
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400af868]
mov r9, qword [0x14006eaa8]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140002405
mov eax, 0xff
jmp 0x1400024da
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000248b
test ax, ax
je 0x140002420
test edx, edx
jne 0x14000248b
sub ax, bx
cmp ax, di
ja 0x140002436
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x140002420
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140010b18
mov dword [0x1400ae9ec], eax
cmp dword [0x1400aea10], r14d
jne 0x140002474
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400ae9f0], r14d
jne 0x140002489
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400ae9ec]
jmp 0x1400024da
cmp ax, 0x22
jne 0x14000249f
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000240e
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140144000
add rsp, 0x28
jmp 0x140002280
Function at 0x140002a3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140002a88
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002a80
cmp dword [rcx + 0x3c], edx
jl 0x140002a80
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002a80
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140002a88
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140008430
Capabilities:
Block operations on executable memory pages using arbitrary code guard

Disassembly:
push rsi
sub rsp, 0x30
mov esi, 4
mov dword [rsp + 0x40], 1
mov r8d, esi
lea rdx, [rsp + 0x40]
lea ecx, [rsi - 2]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov r8d, esi
mov dword [rsp + 0x48], 1
lea rdx, [rsp + 0x48]
lea ecx, [rsi + 5]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov r8d, esi
mov dword [rsp + 0x50], 3
lea rdx, [rsp + 0x50]
lea ecx, [rsi + 6]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
lea ecx, [rsi + 4]
mov r8d, esi
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov r8d, esi
mov dword [rsp + 0x20], 2
lea rdx, [rsp + 0x20]
lea ecx, [rsi + 9]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
add rsp, 0x30
pop rsi
ret

Function at 0x1400086cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x60
xor ebx, ebx
lea rax, [r11 + 8]
mov qword [r11 - 0x20], rbx
mov rbp, rdx
mov qword [r11 - 0x28], rbx
xor r9d, r9d
mov qword [r11 - 0x30], rbx
xor r8d, r8d
mov qword [r11 - 0x38], rbx
xor edx, edx
mov qword [r11 - 0x40], rax
mov rcx, rbp
mov qword [r11 - 0x48], rbx
mov qword [r11 - 0x50], rbx
mov qword [r11 - 0x58], rbx
mov dword [r11 + 8], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x1400087b6
lea esi, [rbx + 1]
cmp dword [rsp + 0x80], esi
jne 0x1400087a8
mov ecx, 0x2000
mov dword [rsp + 0x90], 0x1000
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400087b6
mov qword [rsp + 0x38], rbx
lea r9, [rsp + 0x90]
mov qword [rsp + 0x30], rbx
mov r8, rax
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140008793
cmp word [rdi], bx
jne 0x140008795
mov esi, ebx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov eax, esi
jmp 0x1400087b8
cmp dword [rsp + 0x80], ebx
seta bl
mov eax, ebx
jmp 0x1400087b8
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c7b8
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400ae458]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14000c8e2
mov ebx, r14d
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000c84f
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ebx, eax
mov qword [rsp + 0x48], r14
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
test ebx, ebx
jne 0x14000c8e2
jmp 0x14000c87d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000c7b8
mov ebx, eax
test eax, eax
jne 0x14000c8e2
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], pe_nt_image_headers64
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x14000c863
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000c8d5
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rsp + 0x48], r14
mov rdx, rsi
mov rcx, rdi
call fcn.140008288
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000c8fd
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rsp + 0x48], r14
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140002530
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000fbd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp word [rdx], 0
mov r14, rdx
mov rdi, rcx
jne 0x14000fbfd
mov rax, rcx
jmp 0x14000fc9e
movzx eax, word [rcx]
jmp 0x14000fc93
mov rbx, rdi
mov rsi, r14
test ax, ax
je 0x14000fc78
cmp word [rsi], 0
je 0x14000fcba
movzx ecx, word [rbx]
movzx eax, word [rsi]
cmp ecx, eax
jne 0x14000fc78
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
nop dword [rax + rax]
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.USER32.dll_CharNextW]
nop dword [rax + rax]
sub rax, rsi
mov rcx, rbp
sub rcx, rbx
xor rax, rcx
test rax, 0xfffffffffffffffe
jne 0x14000fc78
jmp 0x14000fc6d
add rbx, 2
add rsi, 2
movzx ecx, word [rsi]
movzx eax, word [rbx]
cmp eax, ecx
je 0x14000fc72
cmp rbx, rbp
jb 0x14000fc5b
cmp word [rbx], 0
jne 0x14000fc10
cmp word [rsi], 0
je 0x14000fcba
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextW]
nop dword [rax + rax]
mov rdi, rax
movzx eax, word [rax]
test ax, ax
jne 0x14000fc05
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x14000fc9e