joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401105b0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1a8]
sub rsp, 0x2a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x140312ca0]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], send
mov byte [rcx], dil
lea rdx, [0x1402c5a6b]
call fcn.14004a3b0
mov dword [rsp + 0x20], 1
xor edx, edx
mov r8d, SHFlushSFCache
lea rcx, [rbp - 0x80]
call fcn.1400b8c40
lea rdx, [rbp - 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1401106db
movdqa xmm0, xmmword [0x1402c7850]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], di
lea rcx, [rbp - 0x80]
call fcn.1400e2e64
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.14000afb8
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.14012f5e8
mov rdx, rax
mov rcx, rbx
call fcn.14001f6a0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x1401106be
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401106b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140110702
call fcn.1400b5bdc
movdqa xmm0, xmmword [0x1402c7860]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], dil
lea rcx, [rsp + 0x58]
call fcn.140009e68
mov rax, rbx
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400b5860
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1400ca738
int3

Function at 0x140110710
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rdi, edx
mov rbx, rcx
cmp byte [rdi + rcx], 0
jne 0x14011072d
mov eax, 0x1505
jmp 0x14011073d
inc edx
call fcn.140110710
movsx ecx, byte [rdi + rbx]
imul eax, eax, 0x21
xor eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14012b458
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140312ca0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x104
call fcn.1400b8c40
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x30], rax
lea r8, str.CommercialId
lea rax, [rsp + 0x50]
mov r9d, 2
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesDataCollection
and qword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
and qword [rbx + 0x10], 0
lea rdx, [rsp + 0x50]
mov qword [rbx + 0x18], send
mov rcx, rbx
mov byte [rbx], 0
call fcn.14004a3b0
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400b5860
add rsp, 0x170
pop rbx
ret

Function at 0x14012b50c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140312ca0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x104
call fcn.1400b8c40
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x30], rax
lea r8, str.BuildLabEx
lea rax, [rsp + 0x50]
mov r9d, 0x10002
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
and qword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
and qword [rbx + 0x10], 0
lea rdx, [rsp + 0x50]
mov qword [rbx + 0x18], send
mov rcx, rbx
mov byte [rbx], 0
call fcn.14004a3b0
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400b5860
add rsp, 0x170
pop rbx
ret
Function at 0x140152f98
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rdi, rcx
lea rax, vtable.Microsoft::Applications::Events::HttpClient_WinInet.0
mov qword [rcx], rax
add rcx, 0x10
mov edx, 0x102
call fcn.140091c7c
nop
lea rbx, [rdi + 0x60]
mov qword [rsp + 0x58], rbx
and qword [rbx], 0
and qword [rbx + 8], 0
mov rcx, rbx
call fcn.1401256fc
mov qword [rbx], rax
mov byte [rdi + 0x70], 0
mov dword [rsp + 0x20], 0x10000000
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rdi + 8], rax
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1401814b8
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400969d0
or dword [rbx + 0x1384], 0xffffffff
lea r8, [rbx + 8]
mov dword [rbx + 4], eax
mov ecx, 1
mov r9d, 0x26f
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
inc ecx
mov dword [r8], eax
lea r8, [r8 + 4]
sub r9, 1
jne 0x1401814df
movabs rax, 0x3ff0000000000000
mov dword [rbx], 0x270
and qword [rbx + 0x1388], r9
mov qword [rbx + 0x1390], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1402619f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140261a18
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140261a18
xor eax, eax
mov ecx, SHFlushSFCache
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140028974
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c284
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c284
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140028ac4
cmp rax, 0xffffffffffffffff
je 0x140028ac4
xor edi, edi
test rbp, rbp
jle 0x140028a6f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001eb98
mov rbx, rax
test rax, rax
jne 0x1400289fc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140028a65
mov edx, 0x8000
mov ecx, r14d
call fcn.140019be8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001cf60
cmp eax, 0xffffffff
je 0x140028a45
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140028a0c
mov edx, r15d
mov ecx, r14d
call fcn.140019be8
jmp 0x140028a65
cmp byte [rsi + 0x38], dil
je 0x140028a5c
cmp dword [rsi + 0x34], 5
jne 0x140028a5c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140028a65
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001a948
jmp 0x140028ad8
jns 0x140028ad8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c284
cmp rax, 0xffffffffffffffff
jne 0x140028a90
cmp byte [rsi + 0x30], dil
je 0x140028ad8
mov edi, dword [rsi + 0x2c]
jmp 0x140028ad8
mov ecx, r14d
call fcn.14001871c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140028ad8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140028ad8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140028ad1
mov eax, dword [rsi + 0x2c]
jmp 0x140028ad6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c284
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140029bd0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140029bf8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140029bf8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140006000
Capabilities:
Encode data using xor

Disassembly:
xor rcx, rcx
sub rcx, 0xffffffffffffff93
lea rax, [entry0]
movabs rbx, 0x83956ddd0cda8efe
xor qword [rax + 0x27], rbx
sub rax, 0xfffffffffffffff8
loop 0x14000601b
mov dh, 0xbf
adc eax, dword [rsp + rbx*2 - 0x7c]
or eax, 0x9271017c
sbb eax, 0x17c6a82
invalid
Function at 0x1411b7258
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1411b7262
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1411b728b
pop rbp
sub rbp, 0x33
sub rbp, 0x11b7258
sub rsp, 0x20
jmp 0x1411b72aa
mov rax, 0x11b7258
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffdeabf5a4
xor byte [rax], dl
inc rax
dec rcx
jne 0x1411b72c9
jmp 0x1411b72e0
in al, dx
sub eax, 0x982d2f4d
movsb byte [rdi], byte [rsi]
movsb byte [rdi], byte [rsi]
movsb byte [rdi], byte [rsi]
in al, dx
and eax, 0xa4a5ac65
movsb byte [rdi], byte [rsi]
in al, dx
movsd dword [rdi], dword [rsi]
in al, dx
invalid

Function at 0x14074f058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14074f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14074f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14074f06f
add dl, dl
jne 0x14074f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14074f0f6
xor eax, eax
add dl, dl
jne 0x14074f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14074f1ad
add dl, dl
jne 0x14074f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14074f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14074f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14074f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14074f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14074f07e
mov eax, 1
add dl, dl
jne 0x14074f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14074f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14074f0fb
sub eax, ebx
mov ebx, 1
jne 0x14074f14c
mov ecx, 1
add dl, dl
jne 0x14074f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14074f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14074f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14074f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14074f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14074f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14074f15d
cmp eax, 0x7d00
jae 0x14074f19b
cmp eax, 0x500
jb 0x14074f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14074f07e
cmp eax, 0x7f
ja 0x14074f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14074f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14074f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14074f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400011f0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movzx esi, word [rcx]
mov r14, rcx
mov rcx, qword gs:[0x60]
mov rdi, rdx
add si, 2
xor edx, edx
add si, word [0x1400242e0]
movzx r8d, si
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor ebx, ebx
mov qword [rdi + 8], rax
test rax, rax
je 0x140001299
lea rdx, [0x1400242e0]
mov word [rdi], bx
mov rcx, rdi
mov word [rdi + 2], si
call qword [sym.imp.ntdll.dll_RtlCopyUnicodeString]
nop dword [rax + rax]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
nop dword [rax + rax]
movzx edx, word [rdi]
mov rcx, qword [rdi + 8]
shr rdx, 1
mov word [rcx + rdx*2], bx
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov ebx, 0xc000009a
jmp 0x140001280
Function at 0x1400058e3
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, 1
jmp 0x140004e2c
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x10], 0
je 0x140001742
jmp 0x1400026fc

Function at 0x140007019
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400062c3
jmp 0x1400082fd
mov rcx, qword [rsp + 0x70]
call fcn.14000668c
jmp 0x14000580d
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
cmp eax, 0x5c
je 0x140006a48
jmp 0x140002e5d
jmp 0x14000748a
test eax, eax
jne 0x1400082fd
jmp 0x140005c62
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x140002d42
jmp 0x140002ce0
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call fcn.14000409e
jmp 0x140004091
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x140005e0c
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
jmp 0x140001fcb
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x140005210
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x38], rax
jmp 0x14000748a
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x14000614a
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x140002d42
jmp 0x140002ce0
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
sub rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x30], rax
jne 0x140001fcb
jmp 0x140005e0c

Function at 0x140007950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [rax + 6]
cmp dword [rsp + 0x48], eax
jae 0x140005293
jmp 0x140002117
Function at 0x140009fc0
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rdi
mov rax, qword [0x1400236e0]
xor rax, rbp
mov qword [rbp + 0x10], rax
and qword [rbp + 8], 0
lea rax, [rbp]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea rdx, [rbp + 8]
mov ecx, 0xb5
lea edi, [r9 + 8]
mov r8d, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
nop dword [rax + rax]
mov ecx, eax
cmp eax, 0xc0000023
jne 0x14000a0af
mov edx, dword [rbp]
lea rcx, [rdx + 0xf]
cmp rcx, rdx
ja 0x14000a036
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call sub.ntdll.dll___chkstk
sub rsp, rcx
lea rax, [rbp]
mov r8d, edi
mov ecx, 0xb5
mov qword [rsp + 0x28], rax
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x20], edx
mov r9, rbx
lea rdx, [rbp + 8]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
js 0x14000a0af
mov edx, dword [rbx]
xor edi, edi
test dx, dx
je 0x14000a0af
mov r8, rbx
and edx, 0x60000
cmp edx, 0x20000
jne 0x14000a0a1
movzx ecx, word [r8]
call fcn.14000b6a0
mov ecx, eax
test eax, eax
js 0x14000a0af
inc edi
lea r8, [rbx + rdi*4]
mov edx, dword [r8]
test dx, dx
jne 0x14000a084
mov eax, ecx
mov rcx, qword [rbp + 0x10]
xor rcx, rbp
call fcn.14000e4b0
mov rbx, qword [rbp + 0x30]
mov rdi, qword [rbp + 0x38]
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x14000b6a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x40
xor ebp, ebp
mov eax, 0x14c
mov r12d, ebp
cmp cx, ax
jne 0x140010658
xor r15b, r15b
lea rbx, [0x140016030]
mov qword [rsp + 0x60], rdi
nop dword [rax + rax]
lea r14, [rbx + 0x10]
mov rsi, rbx
test r15b, r15b
jne 0x140010668
mov rdx, r14
mov rcx, rsi
call fcn.14000b740
mov edi, eax
test r15b, r15b
jne 0x140010760
test edi, edi
js 0x14000b715
inc ebp
add rbx, 0x20
cmp ebp, 0x4e
jb 0x14000b6e0
mov eax, edi
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
mov r15b, 1
call fcn.140015f34
mov r12, rax
jmp 0x14000b6cf
movzx ecx, word [r12]
mov eax, 0x18
movzx edi, word [rbx + 2]
sub eax, ecx
mov rcx, qword gs:[0x60]
cdq
movzx esi, word [rbx + 0x12]
xor eax, edx
sub eax, edx
xor edx, edx
add ax, ax
mov rcx, qword [rcx + 0x30]
add di, ax
movzx r8d, di
add si, ax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xorps xmm0, xmm0
movzx r8d, si
movups xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x22], di
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
cmp qword [rsp + 0x28], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x32], si
mov qword [rsp + 0x38], rax
je 0x1400107c4
test rax, rax
je 0x1400107a4
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlCopyUnicodeString]
nop dword [rax + rax]
mov rdx, r14
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlCopyUnicodeString]
nop dword [rax + rax]
lea r8, [rsp + 0x20]
mov rdx, r12
lea rcx, [0x140016cb0]
call fcn.140015c90
lea r8, [rsp + 0x30]
mov rdx, r12
lea rcx, [0x140016cb0]
call fcn.140015c90
lea rsi, [rsp + 0x20]
lea r14, [rsp + 0x30]
jmp 0x14000b6f0
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsi + 8]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [r14 + 8]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
nop
jmp 0x14000b706
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, 0xc0000017
jmp 0x14000b717
Function at 0x14000b740
Capabilities:
Delete registry key
Query or enumerate registry key
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1400236e0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, rcx
xor r14d, r14d
mov r8, rcx
mov qword [rbp - 0x29], r14
lea rcx, [rbp - 0x29]
mov qword [rbp - 0x21], r14
mov r9b, 1
mov rdi, rdx
call fcn.14000b8f0
cmp eax, 0xc0000022
je 0x1400107ce
mov qword [rsp + 0xd0], rsi
cmp eax, 0xc0000035
je 0x14000b843
test eax, eax
js 0x140010822
movzx eax, word [rdi]
lea rdx, [0x1400236d0]
mov rcx, qword [rbp - 0x29]
mov r9d, 6
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x29]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test ebx, ebx
js 0x14000b818
xor r9d, r9d
lea rcx, [rbp - 0x21]
mov r8, rdi
call fcn.14000b8f0
mov ebx, eax
test eax, eax
js 0x140010832
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, ebx
mov rsi, qword [rsp + 0xd0]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14000e4b0
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop r14
pop rdi
pop rbp
ret
movups xmm0, xmmword [rbx]
lea rax, [rbp - 0x11]
mov dword [rbp - 1], 0x30
lea r8, [rbp - 1]
mov qword [rbp + 7], r14
movups xmmword [rbp - 0x11], xmm0
mov dword [rbp + 0x17], 0x140
mov edx, 0x3001f
xorps xmm0, xmm0
mov qword [rbp + 0xf], rax
lea rcx, [rbp - 0x29]
movdqu xmmword [rbp + 0x1f], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
nop dword [rax + rax]
test eax, eax
js 0x14000b81a
mov rcx, qword [rbp - 0x29]
lea rax, [rbp - 0x19]
mov r9d, 0xc
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x2f]
lea edx, [r9 - 7]
call qword [sym.imp.ntdll.dll_NtQueryKey]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x29]
mov esi, eax
test eax, eax
js 0x1400107d8
mov eax, dword [rbp + 0x33]
and al, 3
cmp al, 2
je 0x1400107eb
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x14000b7ef
mov eax, 0xc0000022
jmp 0x14000b822
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, esi
jmp 0x14000b81a
call qword [sym.imp.ntdll.dll_NtDeleteKey]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x29]
mov esi, eax
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test esi, esi
js 0x1400107e4
mov r9b, 1
lea rcx, [rbp - 0x29]
mov r8, rbx
call fcn.14000b8f0
nop
jmp 0x14000b7a1
cmp eax, 0xc0000035
jne 0x14000b81a
jmp 0x14000b7ef
cmp eax, 0xc0000035
je 0x140010844
cmp eax, 0xc0000022
jne 0x14000b818
mov ebx, r14d
jmp 0x14000b818
Function at 0x14000c2d8
Capabilities:
Encode data using xor
Hash data with crc32
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400236e0]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rax, [0x140017df8]
mov dword [rbp - 0x48], 0x2e002c
mov qword [rbp - 0x40], rax
lea r9, [rbp - 0x38]
lea rax, [rbp - 0x50]
mov rdi, r8
mov r14, rdx
mov qword [rsp + 0x28], rax
mov esi, ecx
mov dword [rsp + 0x20], 0x24
mov rcx, qword [0x1400245f0]
lea rdx, [rbp - 0x48]
mov r8d, 4
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
test eax, eax
jns 0x140011660
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14000e4b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
cmp dword [rbp - 0x38], 3
jne 0x14001171c
mov r8d, 0x18
cmp dword [rbp - 0x34], r8d
jne 0x14001171c
lea rcx, [rbp - 0x2c]
lea edx, [r8 - 4]
mov al, byte [rbp - 0x30]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140011682
cmp dword [rbp - 0x2c], 3
jne 0x140011712
cmp byte [rbp - 0x24], 1
ja 0x140011712
mov ebx, dword [rbp - 0x30]
xor ecx, ecx
and dword [rbp - 0x30], edx
lea rdx, [rbp - 0x30]
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
mov dword [rbp - 0x30], eax
cmp eax, ebx
jne 0x140011712
movzx edx, byte [rbp - 0x24]
xor r8d, r8d
test dl, dl
je 0x1400116de
movzx ecx, word [rbp + r8*8 - 0x1c]
dec ecx
cmp ecx, 0xfd
ja 0x140011712
inc r8d
cmp r8d, edx
jb 0x1400116c6
xor ecx, ecx
test dl, dl
je 0x1400116f0
cmp dword [rbp + rcx*8 - 0x20], esi
je 0x1400116f0
inc ecx
cmp ecx, edx
jb 0x1400116e4
cmp ecx, edx
jae 0x14001171c
mov ecx, dword [rbp + rcx*8 - 0x1c]
movzx eax, cx
mov dword [r14], eax
test rdi, rdi
je 0x14001170b
shr ecx, 0x10
and ecx, 1
mov dword [rdi], ecx
xor eax, eax
jmp 0x14000c352
mov eax, 0xc000007b
jmp 0x14000c352
mov eax, 0xc0000225
jmp 0x14000c352

Function at 0x14000c48c
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400236e0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, r8
mov dword [rsp + 0x20], 5
mov rdi, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x18
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
js 0x140011726
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000e4b0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov eax, 1
lock xadd dword [0x1400245a0], eax
inc eax
mov ecx, 0x20
cdq
idiv ecx
lea rax, [0x1400243a0]
movsxd rcx, edx
add rcx, rcx
mov dword [rax + rcx*8], 0x10b1
mov dword [rax + rcx*8 + 4], r8d
mov qword [rax + rcx*8 + 8], rdi
mov eax, r8d
jmp 0x14000c4e4