joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003030
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
cmp byte [0x1400bf562], 0
je 0x1400030fc
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0xb
jb 0x140003167
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140003082
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xb
lea r9, str.rsSyncSvc:
lea rcx, [rsp + 0x48]
call fcn.1400027e0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400030fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000315b
call fcn.140062c6c
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140003137
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140003132
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003161
mov rcx, r8
call fcn.140062c6c
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140062b40
add rsp, 0x70
pop rbx
ret
call fcn.14006ef68
nop
call fcn.14006ef68
nop
call fcn.140001480
int3
Function at 0x140004a80
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, qword [rsp + 0x90]
mov rsi, r9
mov rax, qword [rdx + 0x18]
mov rbx, r8
mov rdi, rdx
test r9, r9
jne 0x140004b3b
cmp rax, 8
jb 0x140004ae4
lea rdx, [rax*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140004adf
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004c75
mov rcx, r8
call fcn.140062c6c
xor esi, esi
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140004b34
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004b2f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004c75
mov rcx, r8
call fcn.140062c6c
xor al, al
jmp 0x140004c5b
cmp rax, 8
jb 0x140004b44
mov rdx, qword [rdx]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140004b83
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140004ae4
lea rdx, [rdx*2 + 2]
jmp 0x140004ab7
xor bpl, bpl
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140004b93
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r14
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004bc5
cmp dword [rsp + 0x30], 3
mov eax, 1
movzx ebp, bpl
cmove ebp, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140004c0b
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004c06
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004c75
mov rcx, r8
call fcn.140062c6c
xor esi, esi
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140004c57
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004c52
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004c75
mov rcx, r8
call fcn.140062c6c
movzx eax, bpl
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14006ef68
int3
Function at 0x140004c80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rbx
cmp qword [rdx + 0x18], 8
jb 0x140004cbe
mov rdx, qword [rdx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140004d7c
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140004d25
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004d20
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004ec8
mov rcx, r8
call fcn.140062c6c
xor esi, esi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140004d75
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140004d70
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004ece
mov rcx, r8
call fcn.140062c6c
xor al, al
jmp 0x140004e96
xor bpl, bpl
mov dword [rsp + 0x30], 0x800
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140004d94
mov rdx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004dfb
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x140004dfb
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140004de0
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140002350
mov bpl, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140004e46
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004e41
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004ec8
mov rcx, r8
call fcn.140062c6c
xor esi, esi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140004e92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140004e8d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004ece
mov rcx, r8
call fcn.140062c6c
movzx eax, bpl
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.140062b40
mov rbx, qword [rsp + 0x880]
add rsp, 0x860
pop rdi
pop rsi
pop rbp
ret
call fcn.14006ef68
nop
call fcn.14006ef68
int3
Function at 0x140004ee0
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
cmp qword [rdx + 0x18], 8
mov rbx, r9
mov r14, r8
mov rsi, rdx
jb 0x140004efc
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rbp
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x40], rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140005013
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x140004f6d
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004f68
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005167
mov rcx, r8
call fcn.140062c6c
xor edi, edi
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rdi
mov word [rsi], di
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x140004fbd
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004fb8
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005167
mov rcx, r8
call fcn.140062c6c
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 7
mov word [r14], di
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000500c
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140005007
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005167
mov rcx, r8
call fcn.140062c6c
xor al, al
jmp 0x140005145
cmp qword [rbx + 0x18], 8
mov dil, 1
mov eax, dword [rbx + 0x10]
lea ecx, [rax*2 + 2]
mov rax, rbx
jb 0x14000502d
mov rax, qword [rbx]
cmp qword [r14 + 0x18], 8
mov rdx, r14
jb 0x14000503a
mov rdx, qword [r14]
mov dword [rsp + 0x28], ecx
mov r9d, 1
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
movzx ebp, dil
xor edi, edi
test eax, eax
cmovne ebp, edi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x1400050ac
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400050a7
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005167
mov rcx, r8
call fcn.140062c6c
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 7
mov word [rsi], di
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x1400050f6
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400050f1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005167
mov rcx, r8
call fcn.140062c6c
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 7
mov word [r14], di
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140005141
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000513c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005167
mov rcx, r8
call fcn.140062c6c
movzx eax, bpl
mov rbp, qword [rsp + 0x48]
mov word [rbx], di
mov qword [rbx + 0x10], rdi
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 0x18], 7
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
call fcn.14006ef68
int3
Function at 0x140005170
Capabilities:
Delete registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x48
cmp qword [rdx + 0x18], 8
mov rbx, r8
mov rdi, rdx
jb 0x140005187
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rbp
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x40], rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000524f
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1400051f8
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400051f3
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005329
mov rcx, r8
call fcn.140062c6c
xor esi, esi
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140005248
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140005243
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005329
mov rcx, r8
call fcn.140062c6c
xor al, al
jmp 0x140005309
cmp qword [rbx + 0x18], 8
mov sil, 1
mov rdx, rbx
jb 0x14000525f
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
movzx ebp, sil
xor esi, esi
test eax, eax
cmovne ebp, esi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1400052bb
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400052b6
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005329
mov rcx, r8
call fcn.140062c6c
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140005305
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140005300
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005329
mov rcx, r8
call fcn.140062c6c
movzx eax, bpl
mov rbp, qword [rsp + 0x60]
mov word [rbx], si
mov qword [rbx + 0x10], rsi
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x18], 7
add rsp, 0x48
pop rdi
pop rbx
ret
call fcn.14006ef68
int3
Function at 0x1400069c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x1448
call fcn.140063280
sub rsp, rax
movaps xmmword [rsp + 0x1430], xmm6
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0x1420], rax
call fcn.14003d714
mov dword [rsp + 0x1414], 0xffffffff
mov dword [rsp + 0x94], eax
mov edx, 1
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x94], eax
inc rdx
cmp rdx, 0x270
jb 0x140006a10
mov dword [rsp + 0x90], 0x270
nop dword [rax]
lea rcx, [rsp + 0x90]
call fcn.140009440
mov r8d, eax
mov eax, 0x6680a41
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 9
cmp ecx, 0x419a02
jae 0x140006a40
mov eax, 0x6680a41
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3e7
sub r8d, eax
lea edx, [r8 - 0x7fffffff]
mov r8d, 0x80000000
lea eax, [rdx + r8]
lea ecx, [rdx - 0x80000000]
cmp edx, r8d
cmovae ecx, eax
movd xmm6, ecx
cvtdq2pd xmm6, xmm6
divsd xmm6, qword [0x1400abf90]
xor ecx, ecx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], cx
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 7
lea r8d, [rcx + 6]
lea rdx, str.DBGOUT
lea rcx, [rsp + 0x20]
call fcn.140002350
nop
lea rdx, [0x1400bbcc8]
lea rcx, [rsp + 0x50]
call fcn.1400021c0
nop
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x20]
mov rdx, rax
call fcn.140004c80
mov r11, qword [rsp + 0x88]
mov r10, qword [rsp + 0x70]
test al, al
je 0x140006ba0
lea r9, [rsp + 0x70]
cmp r11, 8
cmovae r9, r10
cmp qword [rsp + 0x80], 3
jne 0x140006ba0
mov edx, 3
lea rax, [0x1400a89b8]
movzx ecx, word [r9]
mov r8d, 0x31
cmp cx, r8w
jb 0x140006ba0
sub r9, rax
cmp cx, r8w
ja 0x140006ba0
cmp rdx, 1
je 0x140006b99
dec rdx
add rax, 2
movzx ecx, word [r9 + rax]
movzx r8d, word [rax]
cmp cx, r8w
jae 0x140006b79
jmp 0x140006ba0
mov byte [0x1400bf562], 1
cmp r11, 8
jb 0x140006bd7
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x140006bcf
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c2f
mov rcx, r10
call fcn.140062c6c
movzx eax, byte [0x1400bf562]
mov byte [0x1400bf560], al
test al, al
jne 0x140006c08
xorps xmm0, xmm0
comisd xmm6, xmm0
jb 0x140006bff
movsd xmm0, qword [0x1400abf70]
comisd xmm0, xmm6
ja 0x140006c08
mov byte [0x1400bf561], 0
jmp 0x140006c0f
mov byte [0x1400bf561], 1
mov rcx, qword [rsp + 0x1420]
xor rcx, rsp
call fcn.140062b40
movaps xmm6, xmmword [rsp + 0x1430]
add rsp, 0x1448
ret
call fcn.14006ef68
int3
Function at 0x140009440
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1400094a1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140009460
mov ecx, dword [r10]
jmp 0x14000958a
cmp ecx, 0x4e0
jb 0x14000958a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400094c0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140009510
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14000a1d0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r11, rcx
mov qword [rsp], rcx
xor r9b, r9b
lea r10, [rsp + 0x30]
mov ebx, 0x10
nop word [rax + rax]
movzx eax, r9b
lea r10, [r10 + 4]
movzx r8d, byte [rax + r11]
lea rdx, [rax + r11]
shl r8d, 8
movzx eax, r9b
add r9b, 4
movzx ecx, byte [rax + r11 + 1]
movzx eax, byte [rdx + 2]
or r8d, ecx
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + 3]
shl r8d, 8
or r8d, eax
mov dword [r10 - 4], r8d
sub rbx, 1
jne 0x14000a220
mov r10b, 0x10
lea r9, [rsp + 0x30]
nop
mov ecx, dword [r9 + 4]
lea r9, [r9 + 4]
mov r8d, ecx
movzx eax, r10b
rol r8d, 0xe
inc r10b
mov edx, dword [rsp + rax*4 + 0x28]
mov eax, ecx
shr ecx, 3
ror eax, 7
xor r8d, eax
mov eax, edx
xor r8d, ecx
rol eax, 0xd
mov ecx, edx
shr edx, 0xa
rol ecx, 0xf
xor ecx, eax
xor ecx, edx
add r8d, ecx
add r8d, dword [r9 + 0x20]
add r8d, dword [r9 - 4]
mov dword [r9 + 0x3c], r8d
cmp r10b, 0x40
jb 0x14000a270
movups xmm0, xmmword [r11 + 0x50]
lea rax, [r11 + 0x50]
xor esi, esi
movups xmm1, xmmword [rax + 0x10]
mov qword [rsp + 8], rax
movups xmmword [rsp + 0x10], xmm0
mov r15d, dword [rsp + 0x18]
lea r13d, [rsi + 0x40]
mov r12d, dword [rsp + 0x14]
mov ebx, dword [rsp + 0x10]
mov r11d, dword [rsp + 0x1c]
movups xmmword [rsp + 0x20], xmm1
mov ebp, dword [rsp + 0x28]
mov r14d, dword [rsp + 0x24]
mov edi, dword [rsp + 0x20]
mov eax, dword [rsp + 0x2c]
nop dword [rax]
nop dword [rax + rax]
mov ecx, edi
lea rsi, [rsi + 4]
rol ecx, 7
mov r10d, edi
ror r10d, 0xb
mov edx, edi
xor r10d, ecx
not edx
and edx, ebp
mov ecx, edi
ror ecx, 6
mov r9d, r12d
xor r10d, ecx
mov r8d, r15d
mov ecx, r14d
and ecx, edi
xor edx, ecx
lea rcx, [0x1400a9040]
add r10d, edx
mov edx, ebx
add r10d, dword [rsi + rcx - 4]
mov ecx, ebx
add r10d, dword [rsp + rsi + 0x2c]
rol ecx, 0xa
add r10d, eax
ror edx, 0xd
mov eax, ebp
xor edx, ecx
mov ebp, r14d
mov ecx, ebx
mov r14d, edi
ror ecx, 2
lea edi, [r11 + r10]
xor edx, ecx
mov r11d, r15d
mov r15d, r12d
and r9d, r11d
mov r12d, ebx
mov ecx, r15d
or ecx, r11d
and ebx, ecx
lea ecx, [r10 + rdx]
or ebx, r9d
add ebx, ecx
sub r13, 1
jne 0x14000a310
lea r8, [rsp + 0x10]
mov dword [rsp + 0x2c], eax
sub r8, qword [rsp]
lea edx, [r13 + 8]
mov rax, qword [rsp + 8]
mov dword [rsp + 0x10], ebx
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x24], r14d
mov dword [rsp + 0x18], r15d
mov dword [rsp + 0x14], r12d
mov dword [rsp + 0x1c], r11d
mov ecx, dword [r8 + rax - 0x50]
add dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x14000a3d1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140062b40
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002f450
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x40], 0x238
xor edx, edx
lea ecx, [rbp + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x14002f528
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x14002f528
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14002f4e3
mov rdx, qword [rdi]
lea rcx, [rsp + 0x6c]
call fcn.140076134
test eax, eax
jne 0x14002f515
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14002f508
mov eax, dword [rsp + 0x48]
mov dword [rdx], eax
add qword [rbx + 8], 4
jmp 0x14002f515
lea r8, [rsp + 0x48]
mov rcx, rbx
call fcn.140036420
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x14002f4d6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14002f56d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14002f568
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002f5a2
mov rcx, r8
call fcn.140062c6c
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140062b40
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
call fcn.14006ef68
int3
Function at 0x140030300
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x2e0
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xd0]
call fcn.1400656a0
mov r9d, 0x200
lea r8, [rsp + 0xd0]
mov edx, 0x5c
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140030386
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
xor r8d, r8d
lea rdx, [0x1400a8628]
mov rcx, rbx
call fcn.140004570
jmp 0x14003044a
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], ax
lea rax, [rsp + 0xd0]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400303b0
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x28]
call fcn.140002350
nop
lea rcx, [rsp + 0x50]
call fcn.140031f50
nop
lea r8, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r8, qword [rsp + 0x28]
mov rax, qword [rsp + 0x38]
lea r9, [r8 + rax*2]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140034140
nop
lea rcx, [rsp + 0x50]
call fcn.140031e60
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14003044a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030445
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030466
call fcn.140062c6c
mov rax, rbx
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140062b40
add rsp, 0x2e0
pop rbx
ret
call fcn.14006ef68
int3

Function at 0x1400317a0
Capabilities:
Get session information
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], ax
xor r8d, r8d
lea rdx, [0x1400a8658]
call fcn.140002350
mov dword [rsp + 0x30], 1
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x14003183f
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x60]
mov r8d, 5
mov edx, eax
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x14003183f
mov rdx, qword [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140031820
mov rcx, rbx
call fcn.140002350
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
nop
mov rax, rbx
add rsp, 0x40
pop rbx
ret