joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000444e
Capabilities:
Print debug messages

Disassembly:
jmp 0x140178500
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1402645b8]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140178526
jmp 0x1401785a3
mov rcx, qword [rbp + 0x30]
call fcn.140003783
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14017853f
jmp 0x1401785a3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14017855c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140001ff0
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140002680
test eax, eax
jne 0x1401785a3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140003aad
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x1400048f9
Capabilities:
Set environment variable

Disassembly:
jmp 0x140162170
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x140004c41
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400517e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140051800
xor al, al
jmp 0x140051881
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140051813
xor al, al
jmp 0x140051881
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14005183d
xor al, al
jmp 0x140051881
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140051851
xor al, al
jmp 0x140051881
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140051863
xor al, al
jmp 0x140051881
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14005187f
xor al, al
jmp 0x140051881
mov al, 1
add rsp, 0x38
ret
Function at 0x140005538
Capabilities:
Terminate process

Disassembly:
jmp 0x1400cb2d0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1400cb2fe
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1400061d6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14000626c
Capabilities:
Print debug messages

Disassembly:
jmp 0x140150e20
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400063f7
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400c7970
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400c72c0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400c79b9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140288020]
jmp 0x1400c79c8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x14000652d
Capabilities:
Set environment variable

Disassembly:
jmp 0x140180600
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140003076
lea rcx, [rsp + 0x48]
call fcn.140003076
call fcn.140003f35
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140002d15
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14018066f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140003611
lea rcx, [rsp + 0x78]
call fcn.140003611
mov eax, dword [rsp + 0x24]
jmp 0x140180700
call fcn.140003f35
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140002d15
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1401806b6
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140003611
lea rcx, [rsp + 0x78]
call fcn.140003611
mov eax, dword [rsp + 0x2c]
jmp 0x140180700
lea rcx, [rsp + 0x48]
call fcn.140002f77
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140002f77
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140003611
lea rcx, [rsp + 0x78]
call fcn.140003611
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x1400065c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140193fb0
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
sub rsp, 0x48
movzx eax, word [rsp + 0x58]
movd xmm0, eax
movdqa xmmword [rsp + 0x20], xmm0
pshuflw xmm0, xmmword [rsp + 0x20], 0
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x20]
pshufd xmm0, xmm0, 0
movdqa xmmword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x50]
and rax, 0xfff
cmp rax, 0xff0
ja 0x1401940c1
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pxor xmm0, xmmword [rsp + 0x10]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pcmpeqw xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x30]
pcmpeqw xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
por xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pmovmskb eax, xmm0
mov dword [rsp], eax
cmp dword [rsp], 0
je 0x1401940b1
mov eax, dword [rsp]
bsf eax, eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x1401940a1
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
jmp 0x1401940aa
mov qword [rsp + 8], 0
mov rax, qword [rsp + 8]
jmp 0x1401940fc
mov rax, qword [rsp + 0x50]
add rax, 0x10
mov qword [rsp + 0x50], rax
jmp 0x1401940f7
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x1401940d9
mov rax, qword [rsp + 0x50]
jmp 0x1401940fc
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
test eax, eax
jne 0x1401940e9
xor eax, eax
jmp 0x1401940fc
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x140193feb
add rsp, 0x48
ret
Function at 0x14003c0c0
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14003c0c0
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x20]
mov qword [rsp], rax
mov rax, 0x3c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x14003c0d5
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x40], r8
mov byte [rbp], 0
mov byte [rbp + 1], 0
mov byte [rbp], 1
mov qword [rbp + 8], 0
mov rax, qword [rbp + 8]
mov rdx, qword [rbp + 0x40]
cmp rax, rdx
jae 0x14003c15e
mov rax, qword [rbp + 8]
add rax, qword [rbp + 0x38]
movzx eax, byte [rax]
movzx eax, al
xor qword [rbp + 0x30], rax
movabs rax, 0x100000001b3
imul rax, qword [rbp + 0x30]
mov qword [rbp + 0x30], rax
mov byte [rbp], 1
mov eax, 1
add rax, qword [rbp + 8]
mov qword [rbp + 8], rax
jmp 0x14003c119
mov byte [rbp + 1], 1
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x14018aa50
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140001ff0
sub rsp, rax
mov rax, qword [0x1402645b8]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140268bb0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14018ac42
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14018ab96
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14018ab96
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14018ab7b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14018ab18
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14018ac02
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14018ac61
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14018ac3d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14018ac61
jmp 0x14018aaee
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140003aad
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14018ad10
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140001ff0
sub rsp, rax
mov rax, qword [0x1402645b8]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140268bb0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14018af1d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14018ae69
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14018ae69
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14018ae49
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14018add8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14018aedd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14018af3c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x14018af18
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14018af3c
jmp 0x14018adae
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140003aad
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140004f80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword ss:[rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006c040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r8, qword [rcx + 8]
mov rdx, qword [rcx]
lea rcx, [rsp + 0x20]
call fcn.140006c60
lea r8, [rsp + 0x20]
mov r10, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
cmp rsi, 7
cmova r8, r10
movabs rdx, 0xcbf29ce484222325
mov r11, qword [rsp + 0x30]
lea r9, [r11 + r11]
mov ecx, ebx
test r9, r9
je 0x140005014
movabs rdi, 0x100000001b3
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, rdi
inc rcx
cmp rcx, r9
jb 0x140005000
mov rcx, qword [0x14006f920]
and rcx, rdx
add rcx, rcx
mov rax, qword [0x14006f908]
mov r9, qword [rax + rcx*8 + 8]
cmp r9, qword [0x14006f8f8]
je 0x140005089
mov rdi, qword [rax + rcx*8]
nop word [rax + rax]
lea rax, [r9 + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140005052
mov rax, qword [rax]
lea r8, ds:[rsp + 0x20]
cmp rsi, 7
cmova r8, r10
cmp r11, rcx
jne 0x1400050d7
mov rdx, r11
test r11, r11
je 0x140005086
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x1400050d7
add rax, 2
sub rdx, 1
jne 0x140005070
mov rbx, r9
mov rax, qword [0x14006f8f8]
test rbx, rbx
cmovne rax, rbx
cmp rax, qword [0x14006f8f8]
setne bl
cmp rsi, 7
jbe 0x1400050ed
lea rdx, [rsi*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x1400050e5
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400050e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp r9, rdi
je 0x140005089
mov r9, qword [r9 + 8]
jmp 0x140005040
mov rcx, r10
call fcn.1400493f0
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400493d0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140005120
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
xor r14d, r14d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005288
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14000527d
mov ebp, r14d
cmp dword [rsp + 0xb8], r14d
jbe 0x14000527d
lea r15, [r14 - 1]
mov eax, 0x100
mov dword [rsp + 0xb0], eax
mov qword [rsp + 0x68], r14
mov rsi, r14
nop dword [rax + rax]
mov ecx, eax
mov eax, 2
mul rcx
mov rdi, rax
cmovo rdi, r15
mov rcx, rdi
call fcn.14004943c
mov rbx, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword ds:[rsp + 0x68], rbx
test rsi, rsi
je 0x14000520d
mov rcx, rsi
call fcn.1400493f0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xb0]
mov r8, rbx
mov edx, ebp
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rsi, rbx
cmp eax, 0xea
jne 0x140005250
mov eax, dword [rsp + 0xb0]
jmp 0x1400051d0
test eax, eax
jne 0x140005266
mov rdx, rbx
mov rcx, qword [rsp + 0x60]
call fcn.1400052a0
nop
mov rcx, rbx
call fcn.1400493f0
inc ebp
cmp ebp, dword [rsp + 0xb8]
jb 0x1400051b4
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000b2c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14006c040]
xor rax, rsp
mov qword [rsp + 0x60], rax
test cl, cl
jne 0x14000b326
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._System_Scanner__Running_checks_to_detect_event_log_bypasses..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a60
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000b4b0
lea rax, ds:[rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.File
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b4a5
mov ecx, dword [rsp + 0x30]
shr rcx, 1
mov eax, 2
mul rcx
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.14004943c
mov rdi, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.File
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop word [rax + rax]
test eax, eax
jne 0x14000b498
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14000b402
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140006c60
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
lea rdx, str._SystemRoot_System32WinevtLogsSystem.evtx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000b453
lea rdx, str.____Event_log_bypass_detected._Ban_the_user._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b4e0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14000b498
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b493
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b493
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400493f0
mov rcx, rdi
call fcn.1400493f0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400493d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
movzx ecx, dl
jmp 0x14000b2c0
Function at 0x14000f360
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000f388
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000f3ae
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000f3b0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000f411
test ecx, ecx
jle 0x14000f3e9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000f411
cmp qword [rdi + 0x80], 0
je 0x14000f411
lfence
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x14000f440
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rbp, rdx
mov rsi, rcx
test r8, r8
jg 0x14000f471
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x14000f492
lfence
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14000f4ae
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000f4b0
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000f4ec
mov qword [rsp + 0x38], rdi
cmp rax, r14
mov rdi, r14
mov rcx, rbp
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add rbp, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000f580
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000f527
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000f55e
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add rbp, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000f580
cmp rbx, rax
ja 0x14000f530
nop
test rbx, rbx
je 0x14000f580
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub r14, rbx
mov rax, r14
lfence
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret