joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14177c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14177c1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14177c089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14177c06f
add dl, dl
jne 0x14177c096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14177c0f6
xor eax, eax
add dl, dl
jne 0x14177c0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14177c1ad
add dl, dl
jne 0x14177c0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14177c0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14177c0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14177c0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14177c0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14177c07e
mov eax, 1
add dl, dl
jne 0x14177c106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14177c113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14177c0fb
sub eax, ebx
mov ebx, 1
jne 0x14177c14c
mov ecx, 1
add dl, dl
jne 0x14177c12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14177c13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14177c123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14177c07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14177c168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14177c175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14177c15d
cmp eax, 0x7d00
jae 0x14177c19b
cmp eax, 0x500
jb 0x14177c196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14177c07e
cmp eax, 0x7f
ja 0x14177c19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14177c07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14177c1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14177c07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001fa0
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x300
mov rax, qword [0x14003f0a0]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001ff8
mov dword [rsp + 0xb0], 0x238
lea rdx, [rsp + 0xb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140002010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400020ee
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0xdc]
lea rcx, [rsp + 0x20]
call fcn.1400033e0
nop
mov edx, dword [rsp + 0xb8]
lea rcx, [0x14003f010]
call fcn.140002110
mov rcx, rax
mov dl, 9
call fcn.140004cf0
mov rcx, rax
mov edx, dword [rsp + 0xd0]
call fcn.140002110
mov rcx, rax
mov dl, 9
call fcn.140004cf0
mov rcx, rax
mov rdx, qword [rsp + 0x20]
call fcn.140004a80
mov rcx, rax
mov dl, 0xa
call fcn.140004cf0
nop
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
cmp rcx, rax
je 0x1400020ca
call fcn.140010290
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.140008900
add rsp, 0x300
pop rbx
ret
Function at 0x140007208
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140007235
xor eax, eax
jmp 0x140007332
cmp qword [rcx + 0x68], 0
je 0x140007246
call fcn.140007350
jmp 0x140007332
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x14000725d
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000725f
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140007294
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14000a6b0
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov r8, rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000732c
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x1400072cf
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x140007307
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.14001137c
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x14000734b
cmp rbp, r15
ja 0x1400072dd
mov r8, rbx
test rbx, rbx
je 0x14000732c
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.14001137c
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
sub rdi, rbp
jmp 0x14000732f

Function at 0x140015e58
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140015c84
Function at 0x180005820
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1800058c4
mov ebx, eax
test eax, eax
jne 0x180005850
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x1800058ac
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800058a3
test al, 0x10
je 0x1800058a3
bt eax, 0xa
jae 0x18000589c
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.180005238
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x180005898
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1800058bc
test edi, edi
jne 0x1800058a3
and dword [rsp + 0x3c], 0
jmp 0x1800058a8
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.180009298
int3

Function at 0x180005914
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180005998
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180014d00]
cmp byte [rcx + rax], 0
je 0x180005998
dec r8
sub rdx, 1
jne 0x18000597e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1800092d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800092f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800092f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18000e824
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000e854
xor eax, eax
jmp 0x18000e917
mov rbp, rbx
cmp word [rax], si
je 0x18000e879
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000e860
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000e85c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000e744
movsxd r14, eax
test eax, eax
jne 0x18000e8b7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000e84d
mov rcx, r14
call fcn.18000e9e0
mov rdi, rax
test rax, rax
jne 0x18000e8d0
xor ecx, ecx
call fcn.18000ad18
jmp 0x18000e8ac
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000e744
test eax, eax
jne 0x18000e901
mov rcx, rdi
call fcn.18000ad18
jmp 0x18000e90b
xor ecx, ecx
call fcn.18000ad18
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140b63058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140b631df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b63089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b6306f
add dl, dl
jne 0x140b63096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b630f6
xor eax, eax
add dl, dl
jne 0x140b630a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b631ad
add dl, dl
jne 0x140b630b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b630c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b630d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b630dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b630ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b6307e
mov eax, 1
add dl, dl
jne 0x140b63106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b63113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b630fb
sub eax, ebx
mov ebx, 1
jne 0x140b6314c
mov ecx, 1
add dl, dl
jne 0x140b6312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b6313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b63123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b6307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b63168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b63175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b6315d
cmp eax, 0x7d00
jae 0x140b6319b
cmp eax, 0x500
jb 0x140b63196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b6307e
cmp eax, 0x7f
ja 0x140b6319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b6307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b631d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b6307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001d080
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbx, r9
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x14001d0dd
test rdx, rdx
je 0x14001d0dd
test rbx, rbx
je 0x14001d0dd
mov dword [r9], 0
test r8d, r8d
je 0x14001d0d9
call fcn.1401af2d8
mov r8d, edi
mov r9, rbp
mov edx, 1
mov rcx, rsi
call fcn.1401af970
cmp eax, edi
jne 0x14001d0dd
mov dword [rbx], eax
xor eax, eax
jmp 0x14001d0e2
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14001d930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov esi, edx
movsx eax, sil
mov rdi, r9
mov rdx, rcx
movd xmm6, eax
punpcklbw xmm6, xmm6
punpcklwd xmm6, xmm6
pshufd xmm6, xmm6, 0
test rcx, rcx
je 0x14001dae3
test r9, r9
je 0x14001dae3
movsxd rbx, dword [rsp + 0x70]
test ebx, ebx
jle 0x14001dae3
mov r14, qword [rsp + 0x78]
test r14, r14
je 0x14001dae3
mov r15, qword [rsp + 0x80]
test r15, r15
je 0x14001dae3
cmp qword [r14], 0
jne 0x14001dae3
lea ebp, [rbx + 0x50]
mov ecx, ebp
call qword [rdx + 0x10]
mov r10, rax
test rax, rax
je 0x14001dae3
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov r11d, r12d
cmp ebx, 0x10
jb 0x14001da8f
lea r9, [rax + 0x50]
lea r8d, [rbx - 1]
lea ecx, [r8 + 0x50]
movsxd rcx, ecx
add rcx, rax
movsxd rax, r8d
add rax, rdi
cmp r9, rax
ja 0x14001da00
cmp rcx, rdi
jae 0x14001da8f
mov ecx, ebx
and ecx, 0x8000000f
jge 0x14001da11
dec ecx
or ecx, 0xfffffff0
inc ecx
movdqa xmm5, xmmword [0x1402494d0]
mov eax, ebx
sub eax, ecx
mov r8, rdi
mov rcx, 0xffffffffffffffb0
movsxd rdx, eax
sub r8, r10
xorps xmm4, xmm4
sub rcx, r10
nop dword [rax]
nop word [rax + rax]
movdqu xmm3, xmmword [r8 + r9 - 0x50]
add r11d, 0x10
movdqu xmm0, xmmword [r9]
lea r9, [r9 + 0x10]
movdqa xmm2, xmm3
lea rax, [rcx + r9]
pxor xmm3, xmm6
pcmpeqb xmm2, xmm4
pandn xmm2, xmm5
pand xmm3, xmm2
movdqa xmm1, xmm2
pandn xmm1, xmm0
por xmm3, xmm1
pand xmm3, xmm2
pandn xmm2, xmm4
por xmm3, xmm2
movdqu xmmword [r9 - 0x10], xmm3
cmp rax, rdx
jl 0x14001da40
movsxd rcx, r11d
mov r9, rbx
cmp rcx, rbx
jge 0x14001dad4
lea rax, [r10 + 0x50]
sub rdi, r10
add rax, rcx
sub r9, rcx
nop word [rax + rax]
movzx r8d, byte [rax + rdi - 0x50]
lea rax, [rax + 1]
movzx ecx, sil
xor cl, r8b
test r8b, r8b
movzx edx, cl
cmove edx, r12d
mov byte [rax - 1], dl
sub r9, 1
jne 0x14001dab0
mov r12, qword [rsp + 0x50]
xor eax, eax
mov qword [r14], r10
mov dword [r15], ebp
jmp 0x14001dae8
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14003b5c0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x10], eax
xor ecx, ecx
call fcn.1401b23dc
mov qword [rbx + 8], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x14003b76b
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x38]
call fcn.140035240
nop
cmp qword [rbp - 0x28], 0
jne 0x14003b66b
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14003b664
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b65f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b798
call fcn.140183134
xor ebx, ebx
jmp 0x14003b75b
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rcx, qword [rbp - 0x38]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14003b71f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp - 0x18], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x18]
lea r8d, [rbx + 8]
lea rdx, [rbp - 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14003b75b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b756
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b792
jmp 0x14003b756
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14003b75b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b756
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b78c
call fcn.140183134
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], bx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401836e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140195f1c
int3
call fcn.140195f1c
int3
call fcn.140195f1c
int3
Function at 0x14003e4f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rdx
mov r8, rcx
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003e68b
mov dword [rsp + 0x50], 0x2d2d4352
mov dword [rsp + 0x54], 0xf7babac9
mov dword [rsp + 0x58], 0x61726f43
mov dword [rsp + 0x5c], 0x776f7242
mov dword [rsp + 0x60], 0x2d756e45
mov dword [rsp + 0x64], 0x61746144
mov dword [rsp + 0x68], 0x37313630
mov dword [rsp + 0x6c], 0x30313032
movdqa xmm2, xmmword [0x140249480]
xor eax, eax
mov ecx, 1
movd xmm3, ecx
lea rcx, [rsp + 0x50]
nop dword [rax]
nop dword [rax + rax]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movdqu xmm0, xmmword [rcx]
pslld xmm0, xmm3
paddd xmm1, xmm0
movdqu xmmword [rcx], xmm1
add eax, 4
lea rcx, [rcx + 0x10]
cmp eax, 8
jl 0x14003e590
mov rax, qword [rdx]
mov qword [rdx + 8], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov rdx, qword [r8]
mov rax, qword [r8 + 8]
sub rax, rdx
test rdx, rdx
je 0x14003e643
lea r9, [rsp + 0x38]
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.14004cde0
mov rbx, qword [rsp + 0x38]
test al, al
je 0x14003e643
cmp rbx, qword [rsp + 0x40]
je 0x14003e643
mov rdx, rdi
mov ecx, 0xa
call fcn.14004bd70
mov ecx, dword [rsp + 0x40]
sub ecx, ebx
mov rdx, rdi
call fcn.14004bd70
mov r9, qword [rsp + 0x40]
mov r8, rbx
mov rdx, qword [rdi + 8]
mov rcx, rdi
call fcn.14003eb10
nop
test rbx, rbx
je 0x14003e68b
mov rdx, qword [rsp + 0x48]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14003e671
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003e6a9
mov rcx, rbx
call fcn.140183134
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401836e0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
call fcn.140195f1c
int3
Function at 0x14003e6b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx]
mov r10, rcx
mov rcx, qword [rcx + 8]
mov rdi, r8
mov rbx, rdx
cmp rax, rcx
je 0x14003e8b5
mov rdx, qword [rdx]
sub rcx, rax
cmp rdx, rcx
jae 0x14003e8b5
lea rax, [rdx + 5]
cmp rax, rcx
ja 0x14003e8b5
lea r8, [rdx + 1]
mov qword [rbx], r8
mov rax, qword [r10]
cmp byte [rdx + rax], 2
jne 0x14003e8b5
lea rcx, [r8 + 1]
mov qword [rbx], rcx
lea rdx, [rcx + 1]
mov rax, qword [r10]
movzx r9d, byte [rax + r8]
lea r8, [rdx + 1]
mov qword [rbx], rdx
mov rax, qword [r10]
shl r9d, 0x18
movzx ecx, byte [rcx + rax]
mov qword [rbx], r8
mov rax, qword [r10]
shl ecx, 0x10
or r9d, ecx
movzx ecx, byte [rax + rdx]
lea rdx, [r8 + 1]
mov qword [rbx], rdx
mov r11, qword [r10]
shl ecx, 8
or r9d, ecx
movzx eax, byte [r11 + r8]
or r9d, eax
cmp r9d, 0xa
jne 0x14003e8b5
mov rcx, qword [r10 + 8]
lea rax, [rdx + 5]
sub rcx, r11
cmp rax, rcx
ja 0x14003e8b5
lea r8, [rdx + 1]
mov qword [rbx], r8
mov rax, qword [r10]
cmp byte [rdx + rax], 2
jne 0x14003e8b5
lea rcx, [r8 + 1]
mov qword [rbx], rcx
lea rdx, [rcx + 1]
mov rax, qword [r10]
movzx r11d, byte [rax + r8]
lea r8, [rdx + 1]
mov qword [rbx], rdx
mov rax, qword [r10]
shl r11d, 0x18
movzx ecx, byte [rax + rcx]
mov qword [rbx], r8
mov rax, qword [r10]
shl ecx, 0x10
or r11d, ecx
movzx ecx, byte [rax + rdx]
shl ecx, 8
or r11d, ecx
lea rcx, [r8 + 1]
mov qword [rbx], rcx
mov rdx, qword [r10]
movzx eax, byte [rdx + r8]
or r11d, eax
mov rax, qword [r10 + 8]
sub rax, rcx
mov esi, r11d
sub rax, rdx
cmp rsi, rax
ja 0x14003e8b5
movdqa xmm2, xmmword [0x140249480]
mov ecx, 1
mov dword [rsp + 0x20], 0x2d2d4352
xor eax, eax
mov dword [rsp + 0x24], 0xf7babac9
mov dword [rsp + 0x28], 0x61726f43
movd xmm3, ecx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x2c], 0x776f7242
mov dword [rsp + 0x30], 0x2d756e45
mov dword [rsp + 0x34], 0x61746144
mov dword [rsp + 0x38], 0x37313630
mov dword [rsp + 0x3c], 0x30313032
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
lea rcx, [rcx + 0x10]
movd xmm1, eax
add eax, 4
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
pslld xmm0, xmm3
paddd xmm1, xmm0
movdqu xmmword [rcx - 0x10], xmm1
cmp eax, 8
jl 0x14003e850
mov rax, qword [rdi]
mov qword [rdi + 8], rax
mov rcx, qword [rbx]
mov rax, qword [r10]
lea rdx, [rcx + rax]
test rdx, rdx
jne 0x14003e89a
xor al, al
add rcx, rsi
mov qword [rbx], rcx
jmp 0x14003e8b7
mov r9, rdi
lea rcx, [rsp + 0x20]
mov r8d, r11d
call fcn.14004d250
mov rcx, qword [rbx]
add rcx, rsi
mov qword [rbx], rcx
jmp 0x14003e8b7
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401836e0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140096d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
je 0x140096f32
lea rdx, [0x14023e600]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.RegQueryValueExW
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rdx, [0x14023e628]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test r15, r15
je 0x140096f32
test r14, r14
je 0x140096f32
test rax, rax
je 0x140096f32
mov dword [rbp - 9], 0x65004b
mov dword [rbp - 5], 0x620079
mov dword [rbp - 1], 0x61006f
mov dword [rbp + 3], 0x640072
mov dword [rbp + 7], 0x4c0020
mov dword [rbp + 0xb], 0x790061
mov dword [rbp + 0xf], 0x75006f
mov dword [rbp + 0x13], 0x5c0074
mov dword [rbp + 0x17], 0x720050
mov dword [rbp + 0x1b], 0x6c0065
mov dword [rbp + 0x1f], 0x61006f
mov dword [rbp + 0x23], 0x64
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x19], rdi
mov edx, 0x20019
lea rcx, [rbp - 0x29]
call fcn.1400d4e50
mov rcx, rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 9]
call r15
test eax, eax
jne 0x140096efa
xor eax, eax
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], rax
mov dword [rbp + 0x37], eax
mov dword [rbp - 0x11], 0x14
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1402408dc]
mov rcx, qword [rbp - 0x19]
call r14
test eax, eax
jne 0x140096ef4
xor edx, edx
lea r8d, [rdi + 0x10]
lea rcx, [rbp + 0x27]
call fcn.1401b2cb0
mov edi, eax
mov rcx, qword [rbp - 0x19]
call rbx
mov rbx, qword [rbp - 0x29]
test rbx, rbx
je 0x140096f10
lea rcx, [rbp - 0x29]
call fcn.1400d5030
mov rbx, qword [rbp - 0x29]
test edi, edi
je 0x140096f20
mov edx, edi
mov rcx, rsi
call fcn.140096f60
mov edi, eax
test rbx, rbx
je 0x140096f2e
lea rcx, [rbp - 0x29]
call fcn.1400d5030
mov eax, edi
jmp 0x140096f34
xor eax, eax
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1401836e0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret