joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011113
Capabilities:
Set registry value

Disassembly:
jmp 0x140015210
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x14002c19a]
call fcn.1400114d3
nop
lea r9, [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call fcn.1400112c6
test eax, eax
jne 0x140015269
jmp 0x1400152fb
mov rcx, qword [rbp + 0xe0]
call fcn.14001113b
mov rcx, qword [rbp + 0xf0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0xc4
mov r9d, 0xc0
mov r8, qword [rbp + 0xe8]
mov rdx, rax
lea rcx, str._ws_ws_n_c_c__ws___
call fcn.140011235
nop
mov rcx, qword [rbp + 0xf0]
call fcn.1400110aa
nop
mov eax, dword [rbp + 0xf8]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rdx, qword [rbp + 0xf0]
lea rcx, str._ws_n_n
call fcn.140011235
nop
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400111ae
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x1400159a0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [0x140026080]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x14002c19a]
call fcn.1400114d3
nop
mov qword [rbp + 8], 0
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140015a4e
mov rcx, qword [rbp + 0x180]
call fcn.14001113b
mov r8, qword [rbp + 0x188]
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x140015bad
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x44], 0
lea rax, [rbp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140015aba
mov rcx, qword [rbp + 0x28]
call fcn.14001113b
mov r8, qword [rbp + 0x190]
mov rdx, rax
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.140011235
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140015bad
mov eax, dword [rbp + 0x44]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140015aed
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.140011235
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140015bad
mov dword [rbp + 0x84], 0
jmp 0x140015b07
mov eax, dword [rbp + 0x84]
inc eax
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0x44]
cmp dword [rbp + 0x84], eax
jae 0x140015b37
call qword [sym.imp.ucrtbased.dll_rand]
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov ecx, dword [rbp + 0x84]
mov rdx, qword [rbp + 0x68]
mov byte [rdx + rcx], al
jmp 0x140015af9
mov eax, dword [rbp + 0x44]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ucrtbased.dll_free]
nop
mov rcx, qword [rbp + 0x28]
call fcn.14001113b
mov ecx, dword [rbp + 0x44]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 0xc4
mov r9d, 0xc0
mov r8, qword [rbp + 0x190]
mov rdx, rax
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
call fcn.140011235
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x1400224a0]
call fcn.14001142e
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.140011253
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x140011230
Capabilities:
Delete registry key

Disassembly:
jmp 0x140015740
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
mov rax, qword [0x140026080]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x14002c19a]
call fcn.1400114d3
nop
mov qword [rbp + 8], 0
lea r8, [rbp + 8]
mov rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0x3fd
jne 0x140015808
mov qword [rsp + 0x40], 0
lea rax, [rbp + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x140015836
mov rcx, qword [rbp + 0x120]
call fcn.14001113b
mov r8, qword [rbp + 0x130]
mov rdx, rax
lea rcx, str.Failed_to_create_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x1400158fc
mov r8, qword [rbp + 8]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegCopyTreeW]
test eax, eax
jne 0x1400158ce
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0x1400158a9
mov rcx, qword [rbp + 0x120]
call fcn.14001113b
mov rcx, qword [rbp + 0x130]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0xc4
mov r9d, 0xc0
mov r8, qword [rbp + 0x128]
mov rdx, rax
lea rcx, str._ws_ws_n_c_c_renamed_to__ws_n_n
call fcn.140011235
nop
jmp 0x1400158cc
mov rcx, qword [rbp + 0x120]
call fcn.14001113b
mov r8, qword [rbp + 0x128]
mov rdx, rax
lea rcx, str.Failed_to_delete_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x1400158f1
mov rcx, qword [rbp + 0x120]
call fcn.14001113b
mov r8, qword [rbp + 0x128]
mov rdx, rax
lea rcx, str.Failed_to_copy_key:__ws_ws_n_n
call fcn.140011235
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x50]
lea rdx, [0x140022520]
call fcn.14001142e
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.140011253
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400112b7
Capabilities:
Terminate process

Disassembly:
jmp 0x140017a00
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400112bc
Capabilities:
Set registry value

Disassembly:
jmp 0x140016170
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x26e8
call fcn.1400110c8
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x82e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2708]
mov rax, qword [0x140026080]
xor rax, rbp
mov qword [rbp + 0x26a8], rax
lea rcx, [0x14002c19a]
call fcn.1400114d3
nop
mov qword [rbp + 8], 0
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rbp + 0x26d8]
mov rcx, qword [rbp + 0x26d0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140016224
mov rcx, qword [rbp + 0x26d0]
call fcn.14001113b
mov r8, qword [rbp + 0x26d8]
mov rdx, rax
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140011235
nop
jmp 0x140016381
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ffe
rep stosb byte [rdi], al
mov dword [rbp + 0x2064], 0x1ffe
lea r9, [rbp + 0x2064]
lea r8, [rbp + 0x50]
mov rdx, qword [rbp + 0x26e0]
mov rcx, qword [rbp + 0x28]
call fcn.1400112c6
test eax, eax
jne 0x140016275
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140016381
mov dword [rbp + 0x2084], 0
jmp 0x14001628f
mov eax, dword [rbp + 0x2084]
inc eax
mov dword [rbp + 0x2084], eax
mov eax, dword [rbp + 0x2064]
cmp dword [rbp + 0x2084], eax
jae 0x140016310
mov eax, dword [rbp + 0x2084]
mov dx, 0x80
movzx ecx, word [rbp + rax*2 + 0x50]
call qword [sym.imp.ucrtbased.dll_iswctype]
test eax, eax
je 0x14001630b
call qword [sym.imp.ucrtbased.dll_rand]
cdqe
mov qword [rbp + 0x2698], rax
lea rcx, str.abcdef012345789
call qword [sym.imp.ucrtbased.dll_wcslen]
dec rax
mov qword [rbp + 0x26a0], rax
xor edx, edx
mov rcx, qword [rbp + 0x2698]
mov rax, rcx
mov rcx, qword [rbp + 0x26a0]
div rcx
mov rax, rdx
lea rcx, str.abcdef012345789
mov edx, dword [rbp + 0x2084]
movzx eax, word [rcx + rax*2]
mov word [rbp + rdx*2 + 0x50], ax
jmp 0x140016281
mov eax, dword [rbp + 0x2064]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rbp + 0x26e0]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rcx, qword [rbp + 0x28]
call fcn.14001113b
mov ecx, dword [rbp + 0x2064]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 0xc4
mov r9d, 0xc0
mov r8, qword [rbp + 0x26e0]
mov rdx, rax
lea rcx, str._ws_ws_n_c_c_multi_string_of_length__d_n_n
call fcn.140011235
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x140022250]
call fcn.14001142e
mov rcx, qword [rbp + 0x26a8]
xor rcx, rbp
call fcn.140011253
lea rsp, [rbp + 0x26b8]
pop rdi
pop rbp
ret
Function at 0x1400112c6
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140015140
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x14002c19a]
call fcn.1400114d3
nop
mov rax, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0xf0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400151ac
mov eax, 1
jmp 0x1400151d1
mov rcx, qword [rbp + 0xe0]
call fcn.14001113b
mov r8, qword [rbp + 0xe8]
mov rdx, rax
lea rcx, str.Failed_to_read:__ws_ws_n_n
call fcn.140011235
nop
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x140011357
Capabilities:
Delete registry key

Disassembly:
jmp 0x1400147c0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, [0x14002c19a]
call fcn.1400114d3
nop
mov rdx, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 2
jne 0x140014806
jmp 0x140014862
cmp dword [rbp + 4], 0
jne 0x14001483f
mov rcx, qword [rbp + 0x100]
call fcn.14001113b
mov dword [rsp + 0x20], 0xc4
mov r9d, 0xc0
mov r8, qword [rbp + 0x108]
mov rdx, rax
lea rcx, str._ws_ws_n_c_c_deleted_n_n
call fcn.140011235
nop
jmp 0x140014862
mov rcx, qword [rbp + 0x100]
call fcn.14001113b
mov r8, qword [rbp + 0x108]
mov rdx, rax
lea rcx, str.Failed_to_delete_value:__ws_ws_n_n
call fcn.140011235
nop
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140011361
Capabilities:
Parse pe header

Disassembly:
jmp 0x140018d50
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140018d70
xor al, al
jmp 0x140018df1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018d83
xor al, al
jmp 0x140018df1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140018dad
xor al, al
jmp 0x140018df1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018dc1
xor al, al
jmp 0x140018df1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018dd3
xor al, al
jmp 0x140018df1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140018def
xor al, al
jmp 0x140018df1
mov al, 1
add rsp, 0x38
ret
Function at 0x140016c40
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001150a
movzx eax, al
test eax, eax
jne 0x140016c60
mov ecx, 7
call fcn.14001143d
nop
mov byte [rsp + 0x20], 0
call fcn.14001145b
mov byte [rsp + 0x21], al
cmp dword [0x140026b58], 1
jne 0x140016c84
mov ecx, 7
call fcn.14001143d
nop
jmp 0x140016cdc
cmp dword [0x140026b58], 0
jne 0x140016cd7
mov dword [0x140026b58], 1
lea rdx, [0x14001e660]
lea rcx, [0x14001e330]
call fcn.14001123a
test eax, eax
je 0x140016cb8
mov eax, 0xff
jmp 0x140016de1
lea rdx, [0x14001e220]
lea rcx, [section..rdata]
call fcn.14001144c
mov dword [0x140026b58], 2
jmp 0x140016cdc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001141f
call fcn.140011384
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140016d39
mov rcx, qword [rsp + 0x30]
call fcn.1400111cc
movzx eax, al
test eax, eax
je 0x140016d39
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14002d020]
nop
call fcn.1400113cf
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140016d6d
mov rcx, qword [rsp + 0x38]
call fcn.1400111cc
movzx eax, al
test eax, eax
je 0x140016d6d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400114b5
nop
call fcn.140016e90
mov dword [rsp + 0x28], eax
call fcn.140011361
movzx eax, al
test eax, eax
jne 0x140016d8c
mov ecx, dword [rsp + 0x28]
call fcn.140011064
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140016d9b
call fcn.1400114c4
nop
xor edx, edx
mov cl, 1
call fcn.1400111b3
mov eax, dword [rsp + 0x28]
jmp 0x140016de1
add rsp, 0x68
ret
Function at 0x141805058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1418051df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141805089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14180506f
add dl, dl
jne 0x141805096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418050f6
xor eax, eax
add dl, dl
jne 0x1418050a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418051ad
add dl, dl
jne 0x1418050b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418050c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418050d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418050dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1418050ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14180507e
mov eax, 1
add dl, dl
jne 0x141805106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141805113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1418050fb
sub eax, ebx
mov ebx, 1
jne 0x14180514c
mov ecx, 1
add dl, dl
jne 0x14180512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14180513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141805123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14180507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141805168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141805175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14180515d
cmp eax, 0x7d00
jae 0x14180519b
cmp eax, 0x500
jb 0x141805196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14180507e
cmp eax, 0x7f
ja 0x14180519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14180507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1418051d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14180507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140028bcc
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0xf023e15c
fidivr word [rdx + 0x334e0ce3]
scasb al, byte [rdi]
lahf
ret
jns 0x140028b3b
mov qword [r8 + riz - 0x6bb782ae], rsi
stosd dword [rdi], eax
xor al, 0x5b
or dword [rbp - 0x2419f8e], esp
and dh, byte [rcx]
jmp 0x103704d75
add bh, ah
jp 0x140028b9b
insb byte [rdi], dx
xchg esp, eax
add dword [rdx - 0x5d], ebx
invalid
mov eax, 0xe31ef385
js 0x140028c45
pop rsi
sal esp, 0xc5
out dx, eax
cli
xchg edx, eax
sub al, 0x94
jp 0x140028bb7
out 0x4b, al
cld
ret 0x63a2
jae 0x140028c72
add eax, 0x967d6df3
mov al, 0xa5
xor ebx, esp
fistp dword [rax]
mov ah, 0xab
mov ecx, 0xf2bc8bd4
bnd jl 0x140028c4e
adc edi, dword [rcx - 0x4a]
sub eax, 0xc1526293
invalid
invalid

Function at 0x140037bb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
mov ax, 0x32f7
mov byte [rsp + 0x147], 0xae
mov word [rsp + 0x12c], 0x1167
mov cl, byte [rsp + 0x137]
mov dword [rsp + 0x128], 0x741644b9
mov edx, dword [rsp + 0x130]
mov r8d, 0x605994ab
sub r8d, edx
mov dword [rsp + 0x130], r8d
mov qword [rsp + 0x120], 0x23120ab9
mov r9, qword [rsp + 0x138]
lea r10, [rsp + 0xe0]
mov r11, r9
add r11, 0x34397cfe
mov qword [rsp + 0x138], r11
lea r11, [rsp + 0x60]
mov r8d, edx
add r8d, r8d
mov dword [rsp + 0x130], r8d
mov byte [rsp + 0x137], 0x3c
mov bl, byte [rsp + 0x147]
mov sil, bl
xor sil, 0xc0
mov byte [rsp + 0xe0], sil
mov r8d, edx
imul r8d, r8d
mov dword [rsp + 0x130], r8d
movzx r8d, word [rsp + 0x12e]
mov di, r8w
mov sil, 0x22
sub sil, bl
mov ebp, r8d
or ebp, 0x5de8
mov r14w, bp
mov word [rsp + 0x12e], r14w
mov byte [rsp + 0xe1], sil
mov r15, r9
xor r15, 0x7aa1e670
mov qword [rsp + 0x138], r15
xor bl, 0xca
mov byte [rsp + 0xe2], bl
mov bl, byte [rsp + 0x147]
add byte [rcx + 0x1302494], cl
add byte [rax], al
Function at 0x140038500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
mov al, 0xab
mov r8b, 0xdc
mov r9b, 0xe6
mov r10b, 0xe5
mov word [rsp + 0x176], 0xc0f5
mov r11d, dword [rsp + 0x180]
mov esi, r11d
or esi, 0x5f4a7257
mov dword [rsp + 0x180], esi
mov byte [rsp + 0x175], 0x81
mov dword [rsp + 0x170], 0x346af2d6
mov qword [rsp + 0x168], 0x6d91295d
mov esi, dword [rsp + 0x170]
mov edi, 0x98c63043
sub edi, esi
mov rbx, qword [rsp + 0x178]
mov r14, rbx
add r14, r14
mov qword [rsp + 0x178], r14
mov dword [rsp + 0x148], edi
add esi, 0x16601f1b
mov edi, r11d
or edi, 0x7851e42
mov bp, word [rsp + 0x184]
mov dword [rsp + 0x180], edi
mov dword [rsp + 0x124], esi
lea r14, [rsp + 0xb0]
mov qword [rsp + 0x178], 0x298e4c46
movaps xmm0, xmmword [0x1400420f0]
movaps xmmword [rsp + 0xb0], xmm0
mov r15b, byte [rsp + 0x175]
mov r12b, r15b
xor r12b, 0xe5
mov byte [rsp + 0xc0], r12b
sub r10b, byte [rsp + 0x175]
mov r13, rbx
imul r13, r13
mov qword [rsp + 0x178], r13
mov byte [rsp + 0xc1], r10b
mov r10b, byte [rsp + 0x175]
xor r10b, 0xf3
mov byte [rsp + 0xc2], r10b
sub r9b, byte [rsp + 0x175]
mov byte [rsp + 0xc3], r9b
mov r9b, r15b
xor r9b, 0xbd
mov r10b, byte [rsp + 0x175]
mov byte [rsp + 0x187], r9b
add r10b, 0xf2
mov byte [rsp + 0xc4], r10b
mov r9b, byte [rsp + 0x175]
add r9b, 0xf2
mov byte [rsp + 0xc5], r9b
mov r9w, bp
xor r9w, 0xffff
mov word [rsp + 0x184], r9w
mov esi, r11d
and esi, 0x1aeaca12
mov dword [rsp + 0x180], esi
sub r8b, r15b
mov r10b, byte [rsp + 0x175]
mov byte [rsp + 0x187], r8b
mov r13, rbx
xor r13, 0xffffffffffffffff
xor r10b, 0x81
mov qword [rsp + 0x178], r13
mov byte [rsp + 0xc6], r10b
mov byte [rsp + 0x187], r15b
mov r9w, bp
xor r9w, 0x9576
mov word [rsp + 0x184], r9w
sub al, byte [rsp + 0x175]
mov byte [rsp + 0xc7], al
mov al, r15b
and al, 0x73
mov byte [rsp + 0x187], al
mov qword [rsp + 0xd0], 0
cmp rdx, 0
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x46], bp
mov qword [rsp + 0x38], r14
mov byte [rsp + 0x37], r15b
mov dword [rsp + 0x30], r11d
je 0x140038f6f
jmp 0x140038868
call fcn.140037bb0
mov cx, 0xccce
xor edx, edx
mov r8d, edx
mov r9b, byte [rsp + 0x37]
and r9b, 0x78
mov byte [rsp + 0x187], r9b
mov r10, rax
mov edx, dword [rsp + 0x170]
xor edx, 0x346ab786
mov qword [rsp + 0xe0], r10
mov r11d, dword [rsp + 0x30]
add r11d, 0x28f647cb
mov dword [rsp + 0x180], r11d
add dword [rax], eax
add byte [rbx + rcx*4 - 0x6c], cl
and al, 0xe0
add byte [rax], al
add byte [rax + 0x63], cl
cmp al, 0x4c
mov esi, edx
add rsi, rax
mov r11d, dword [r10 + rax]
mov byte [rsp + 0x187], 0x60
cmp r11d, edx
cmove r8, rsi
mov r9b, byte [rsp + 0x37]
or r9b, 0x51
mov byte [rsp + 0x187], r9b
mov edx, dword [r8 + 0x88]
mov eax, edx
mov word [rsp + 0x184], 0xff67
mov r8, qword [rsp + 0xe0]
mov di, word [rsp + 0x46]
xor di, 0x287e
mov word [rsp + 0x184], di
add r8, rax
mov edx, dword [rsp + 0x170]
mov rax, qword [rsp + 0xd0]
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140039260
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x118
lea rax, [rsp + 0x90]
mov r8d, 0x414a02e3
mov dword [rsp + 0x114], 0x3cc719d6
mov r9, qword [rsp + 0x100]
mov word [rsp + 0xfe], 0x8d7e
mov r10d, dword [rsp + 0x110]
mov dword [rsp + 0x110], 0xdad4f069
mov byte [rsp + 0xfd], 0xb2
mov dword [rsp + 0x110], r10d
mov qword [rsp + 0xf0], 0x3c7005e5
sub r8d, dword [rsp + 0x114]
mov dword [rsp + 0xdc], r8d
mov r11, r9
xor r11, r11
mov qword [rsp + 0x100], r11
mov r8d, dword [rsp + 0xdc]
mov esi, r10d
and esi, esi
mov dword [rsp + 0x110], esi
mov esi, r10d
or esi, 0x52ce3d14
mov dword [rsp + 0x110], esi
mov esi, dword [rsp + 0x114]
add esi, 0xe9f9f1b0
mov bl, byte [rsp + 0x10f]
mov dil, 0x76
mov qword [rsp + 0x80], rax
mov al, bl
mul dil
mov byte [rsp + 0x10f], al
mov qword [rsp + 0xe8], 0
cmp esi, r8d
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x6f], bl
mov dword [rsp + 0x68], r10d
mov qword [rsp + 0x60], r9
jb 0x140039643
mov al, 0x1e
mov cx, 0x456e
mov dl, 0x27
mov r8b, 0x15
mov r9b, 0xf3
mov r10b, 0x13
mov r11b, byte [rsp + 0x6f]
xor r11b, 0xff
mov byte [rsp + 0x10f], r11b
mov r11b, byte [rsp + 0xfd]
add r11b, 0xa4
mov rsi, qword [rsp + 0x80]
add byte [rax + rcx*4 + 0x1e], al

Function at 0x14003b22c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov cl, byte [rsp + 0x3e]
xor r9b, 0xd
mov byte [rsp + 0x5f], r8b
mov r10w, word [rsp + 0x40]
or r10w, r10w
mov word [rsp + 0x56], r10w
mov r8b, byte [rsp + 0x3f]
cmp r8b, r9b
mov qword [rsp + 0x30], rax
jae 0x14003b272
xor eax, eax
mov ecx, eax
call fcn.140041af0
xor edx, edx
mov ecx, edx
mov dword [rsp + 0x2c], eax
mov rax, rcx
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
add rsp, 0x60
pop rbx
jmp fcn.140038500