joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140109f00
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r10, rcx
mov rbx, r8
cmp edx, 0x80
je 0x140109f96
mov eax, 1
cmp edx, 0x100
jne 0x14010a1b6
lea rdi, [rsp + 0x20]
mov rdx, rcx
lea rbp, [rsp + 0x30]
mov dword [r8 + 0xf0], 0xe
mov rcx, rdi
mov esi, 2
lea r12, [rsp + 0x40]
lea r13, [0x1401b7ac0]
call dbg.aes_nohw_compact_block
mov r8d, 0x10
mov rcx, rbx
mov rdx, rdi
call sym.OPENSSL_memcpy.isra.0_1
lea rdx, [r10 + 0x10]
mov rcx, rbp
call dbg.aes_nohw_compact_block
lea rcx, [rbx + 0x10]
mov rdx, rbp
add rbx, 0x20
mov r8d, 0x10
call sym.OPENSSL_memcpy.isra.0_1
jmp 0x14010a08a
lea rdi, [rsp + 0x30]
mov rdx, rcx
lea rsi, [rbx + 0x10]
mov dword [r8 + 0xf0], 0xa
mov rcx, rdi
lea rbp, [0x1401b7ac0]
lea r12, [rsp + 0x40]
call dbg.aes_nohw_compact_block
mov rcx, rbx
mov r8d, 0x10
mov rdx, rdi
call sym.OPENSSL_memcpy.isra.0_1
add rbx, 0xb0
mov rdx, rdi
mov rcx, r12
inc rbp
call dbg.aes_nohw_sub_block
mov r8b, byte [rbp - 1]
mov rcx, qword [rsp + 0x40]
call dbg.aes_nohw_rotate_rows_down
mov rdx, r8
shr r8, 4
and edx, 0xf
shr rax, 0x30
xor rax, qword [rsp + 0x30]
and r8d, 0xf
xor rax, rdx
mov rdx, rax
mov rcx, rax
shl rcx, 0x10
shl rdx, 0x20
xor rdx, rcx
mov rcx, qword [rsp + 0x48]
xor rdx, rax
shl rax, 0x30
xor rax, rdx
mov qword [rsp + 0x30], rax
call dbg.aes_nohw_rotate_rows_down
shr rax, 0x30
xor rax, qword [rsp + 0x38]
xor rax, r8
mov r8d, 0x10
mov rdx, rax
mov rcx, rax
shl rcx, 0x20
shl rdx, 0x10
xor rdx, rcx
mov rcx, rsi
add rsi, 0x10
xor rdx, rax
shl rax, 0x30
xor rax, rdx
mov rdx, rdi
mov qword [rsp + 0x38], rax
call sym.OPENSSL_memcpy.isra.0_1
cmp rbx, rsi
jne 0x140109fd9
xor eax, eax
jmp 0x14010a1b6
mov rdx, rbp
mov rcx, r12
lea r14, [rbx + 0x20]
call dbg.aes_nohw_sub_block
mov rax, rsi
mov rcx, qword [rsp + 0x40]
shr rax, 1
mov r8b, byte [r13 + rax - 1]
call dbg.aes_nohw_rotate_rows_down
mov rdx, r8
shr rax, 0x30
xor rax, qword [rsp + 0x20]
and edx, 0xf
shr r8, 4
xor rax, rdx
and r8d, 0xf
mov rdx, rax
mov rcx, rax
shl rcx, 0x10
shl rdx, 0x20
xor rdx, rcx
mov rcx, qword [rsp + 0x48]
xor rdx, rax
shl rax, 0x30
xor rax, rdx
mov qword [rsp + 0x20], rax
call dbg.aes_nohw_rotate_rows_down
shr rax, 0x30
xor rax, qword [rsp + 0x28]
xor rax, r8
mov r8d, 0x10
mov rdx, rax
mov rcx, rax
shl rcx, 0x20
shl rdx, 0x10
xor rdx, rcx
mov rcx, rbx
xor rdx, rax
shl rax, 0x30
xor rax, rdx
mov rdx, rdi
mov qword [rsp + 0x28], rax
call sym.OPENSSL_memcpy.isra.0_1
cmp rsi, 0xe
je 0x14010a083
mov rdx, rdi
mov rcx, r12
add rsi, 2
call dbg.aes_nohw_sub_block
movzx eax, word [rsp + 0x46]
xor rax, qword [rsp + 0x30]
mov r8d, 0x10
mov rdx, rax
mov rcx, rax
shl rcx, 0x20
shl rdx, 0x10
xor rdx, rcx
xor rdx, rax
shl rax, 0x30
xor rax, rdx
mov qword [rsp + 0x30], rax
movzx eax, word [rsp + 0x4e]
xor rax, qword [rsp + 0x38]
mov rdx, rax
mov rcx, rax
shl rcx, 0x20
shl rdx, 0x10
xor rdx, rcx
lea rcx, [rbx + 0x10]
mov rbx, r14
xor rdx, rax
shl rax, 0x30
xor rax, rdx
mov rdx, rbp
mov qword [rsp + 0x38], rax
call sym.OPENSSL_memcpy.isra.0_1
jmp 0x14010a08a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14010a1d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov ebx, 1
mov r9d, 0x40
xor eax, eax
mov r8d, 1
shl rbx, 0x3f
mov rdx, r8
mov r11, rcx
shr rax, 1
and edx, 1
neg rdx
and r11, rdx
and rdx, rbx
mov r10, r11
add rax, rdx
xor r10, r8
and r8, r11
shr r10, 1
add r8, r10
dec r9
jne 0x14010a1e8
pop rbx
ret

Function at 0x14010b020
Capabilities:
Encrypt data using curve25519

Disassembly:
mov al, byte [rcx + 0x1f]
and byte [rcx], 0xf8
and eax, 0x7f
or eax, 0x40
mov byte [rcx + 0x1f], al
ret
Function at 0x14010d8e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x178
movsx r10, r8b
mov eax, r8d
mov r9d, r8d
mov rsi, rcx
mov rbx, r10
lea rdi, [rsp + 0x99]
mov ecx, 0x5f
mov r8d, 1
sar rbx, 0x3f
and eax, ebx
add eax, eax
sub r9d, eax
xor eax, eax
rep stosb byte [rdi], al
mov rax, r10
dec r10
movzx r9d, r9b
not rax
and rax, r10
lea r10, [rsp + 0x98]
sar rax, 0x3f
and eax, 1
mov byte [rsp + 0x98], al
mov byte [rsp + 0xb8], al
movsxd rax, edx
lea rdx, [0x1401dd000]
imul rax, rax, 0x300
add rax, rdx
mov rcx, r9
xor rcx, r8
mov rdx, rcx
dec rcx
not rdx
and rdx, rcx
xor ecx, ecx
sar rdx, 0x3f
mov r11b, byte [rax + rcx]
and r11d, edx
xor byte [r10 + rcx], r11b
inc rcx
cmp rcx, 0x60
jne 0x14010d97e
inc r8
add rax, 0x60
cmp r8, 9
jne 0x14010d966
lea rbp, [rsp + 0x20]
mov rdx, r10
lea r13, [rsp + 0x48]
neg rbx
mov rcx, rbp
lea r15, [rsp + 0x70]
lea r12, [rsi + 0x28]
call dbg.fiat_25519_from_bytes
mov rcx, r13
lea rdx, [rsp + 0xb8]
lea rdi, [rsi + 0x50]
call dbg.fiat_25519_from_bytes
lea rdx, [rsp + 0xd8]
mov rcx, r15
lea r14, [rsp + 0xf8]
call dbg.fiat_25519_from_bytes
mov rdx, rbp
mov rcx, rsi
call dbg.fe_limbs_copy
mov rdx, r13
mov rcx, r12
call dbg.fe_limbs_copy
mov rdx, r15
mov rcx, rdi
call dbg.fe_limbs_copy
mov rdx, r13
mov rcx, r14
lea r13, [rsp + 0x120]
call dbg.fe_limbs_copy
mov rdx, rbp
mov rcx, r13
lea rbp, [rsp + 0x148]
call dbg.fe_limbs_copy
mov rdx, r15
mov rcx, rbp
call dbg.fiat_25519_opp
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call dbg.fe_cmov
mov r8, rbx
mov rdx, r13
mov rcx, r12
call dbg.fe_cmov
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call dbg.fe_cmov
nop
add rsp, 0x178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x409fc7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x00419040]
jne 0x408d1a
rol rcx, 0x10
test cx, 0xffff
jne 0x408d16
repz ret
ror rcx, 0x10
jmp 0x409f20
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0041a2e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x0041a3d8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x409fa5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0041a2e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x409fc7
mov rax, qword [rsp + 0x88]
mov qword [0x0041a3d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0041a378], rax
mov rax, qword [0x0041a3d8]
mov qword [0x0041a250], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0041a360], rax
mov dword [0x0041a240], 0xc0000409
mov dword [0x0041a244], 1
mov rax, qword [0x00419040]
mov qword [rsp + 0x68], rax
mov rax, qword [0x00419048]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x0041a2d8], eax
mov ecx, 1
call fcn.0040aa60
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x004132d8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x0041a2d8], 0
jne 0x40a04e
mov ecx, 1
call fcn.0040aa60
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x40fa90
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.0040aae0
xor ebx, ebx
cmp qword [0x0041afc8], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x40fbc1
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x40faf3
xor eax, eax
jmp 0x40fca1
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40faec
mov rcx, rax
call fcn.0040aa70
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x0041afc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040aa70
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x0041afd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040aa70
lea rcx, [rsp + 0x30]
mov qword [0x0041afd8], rax
call fcn.0040c990
test eax, eax
je 0x40fb77
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00409220
cmp dword [rsp + 0x30], 2
jne 0x40fbc1
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040aa70
test rax, rax
mov qword [0x0041afe8], rax
je 0x40fbc1
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040aa70
mov qword [0x0041afe0], rax
mov rcx, qword [0x0041afe0]
cmp rcx, rsi
je 0x40fc53
cmp qword [0x0041afe8], rsi
je 0x40fc53
call fcn.0040ab40
call rax
test rax, rax
mov rbp, rax
je 0x40fc1e
mov rcx, qword [0x0041afe8]
call fcn.0040ab40
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x40fc1e
test byte [rsp + 0x48], 1
jne 0x40fc53
lea rcx, [rsp + 0x34]
call fcn.0040c9e0
test eax, eax
je 0x40fc40
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00409220
cmp dword [rsp + 0x34], 4
jb 0x40fc4d
bts edi, 0x15
jmp 0x40fc87
bts edi, 0x12
jmp 0x40fc87
mov rcx, qword [0x0041afd0]
cmp rcx, rsi
je 0x40fc87
call fcn.0040ab40
call rax
test rax, rax
mov rbx, rax
je 0x40fc87
mov rcx, qword [0x0041afd8]
cmp rcx, rsi
je 0x40fc87
call fcn.0040ab40
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0041afc8]
call fcn.0040ab40
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x140055c10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
je 0x140055c4e
add rcx, 0x28
cmp qword [rcx + 0x18], 7
jbe 0x140055c2e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140055c44
shr eax, 4
and al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.140055810
int3
xor r9d, r9d
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
mov r8d, 0x9f
lea rcx, str.__path.empty__
call fcn.140052560
Function at 0x1400561f6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd rax, dword [rcx + 0x3c]
mov esi, edx
xor edx, edx
mov r8d, dword [rax + rcx + 0x88]
mov r9, rcx
add r8, rcx
mov r10d, dword [r8 + 0x20]
mov r11d, dword [r8 + 0x1c]
mov ebx, dword [rax + 0x1c]
mov ebx, dword [r8 + 0x24]
mov edi, dword [r8 + 0x18]
add r10, rcx
add r11, rcx
add rbx, rcx
test edi, edi
je 0x140056267
mov ecx, dword [r10]
add rcx, r9
xor r8d, r8d
jmp 0x140056252
movzx eax, al
inc rcx
or eax, 0x60
add r8d, eax
add r8d, r8d
mov al, byte [rcx]
test al, al
jne 0x140056243
cmp r8d, esi
je 0x140056279
inc edx
add r10, 4
cmp edx, edi
jb 0x140056238
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
movzx ecx, word [rbx + rdx*2]
mov eax, dword [r11 + rcx*4]
add rax, r9
jmp 0x140056269
Function at 0x140011217
Capabilities:
Terminate process

Disassembly:
jmp 0x1400134a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112a3
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns
Start tcp server

Disassembly:
jmp 0x140011d00
push rbp
push rdi
sub rsp, 0x4a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xc2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x478], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.1400113b6
nop
lea rdx, [rbp + 0x10]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rbp + 0x1c4], eax
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x208], 0
mov r8d, 0x30
xor edx, edx
lea rcx, [rbp + 0x228]
call fcn.1400112f8
nop
mov dword [rbp + 0x22c], 2
mov dword [rbp + 0x230], 1
mov dword [rbp + 0x234], 6
mov dword [rbp + 0x228], 1
lea r9, [rbp + 0x208]
lea r8, [rbp + 0x228]
lea rdx, str.8126
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [rbp + 0x1c4], eax
mov r8d, 0x30
mov rax, qword [rbp + 0x208]
mov rdx, qword [rax + 0x20]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_bind]
mov dword [rbp + 0x1c4], eax
mov edx, 5
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_listen]
mov dword [rbp + 0x1c4], eax
mov dword [rbp + 0x2a4], reloc.WS2_32.dll_recv
lea rcx, str.waiting_for_connection..._n
call fcn.1400111b3
nop
lea r8, [rbp + 0x2a4]
lea rdx, [rbp + 0x278]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rbp + 0x2c8], rax
mov ecx, dword [rbp + 0x27c]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov qword [rbp + 0x2e8], rax
mov rdx, qword [rbp + 0x2e8]
lea rcx, str.connection_from__s_accepted__n
call fcn.1400111b3
nop
mov rcx, qword [rbp + 0x2c8]
call fcn.1400113d9
nop
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_closesocket]
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001aee0]
call fcn.14001134d
mov eax, edi
mov rcx, qword [rbp + 0x478]
xor rcx, rbp
call fcn.1400111cc
lea rsp, [rbp + 0x488]
pop rdi
pop rbp
ret
Function at 0x1400112ad
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400147f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014810
xor al, al
jmp 0x140014891
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014823
xor al, al
jmp 0x140014891
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001484d
xor al, al
jmp 0x140014891
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014861
xor al, al
jmp 0x140014891
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014873
xor al, al
jmp 0x140014891
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001488f
xor al, al
jmp 0x140014891
mov al, 1
add rsp, 0x38
ret
Function at 0x1400126e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113e3
movzx eax, al
test eax, eax
jne 0x140012700
mov ecx, 7
call fcn.14001135c
nop
mov byte [rsp + 0x20], 0
call fcn.140011370
mov byte [rsp + 0x21], al
cmp dword [0x141351b98], 1
jne 0x140012724
mov ecx, 7
call fcn.14001135c
nop
jmp 0x14001277c
cmp dword [0x141351b98], 0
jne 0x140012777
mov dword [0x141351b98], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111b8
test eax, eax
je 0x140012758
mov eax, 0xff
jmp 0x140012881
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011366
mov dword [0x141351b98], 2
jmp 0x14001277c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011343
call fcn.1400112d0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400127d9
mov rcx, qword [rsp + 0x30]
call fcn.140011168
movzx eax, al
test eax, eax
je 0x1400127d9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x141358020]
nop
call fcn.140011307
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001280d
mov rcx, qword [rsp + 0x38]
call fcn.140011168
movzx eax, al
test eax, eax
je 0x14001280d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001139d
nop
call fcn.140012930
mov dword [rsp + 0x28], eax
call fcn.1400112ad
movzx eax, al
test eax, eax
jne 0x14001282c
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001283b
call fcn.1400113a7
nop
xor edx, edx
mov cl, 1
call fcn.140011159
mov eax, dword [rsp + 0x28]
jmp 0x140012881
add rsp, 0x68
ret
Function at 0x180007034
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r13d, ecx
xor bpl, bpl
lea rdx, [rsp + 0x30]
lea rcx, [0x180162940]
call fcn.180008024
nop
lea rdx, [0x18010d534]
lea rcx, [rsp + 0x40]
call fcn.180007f64
nop
mov rdi, qword [rsp + 0x40]
mov r8, rdi
mov edx, dword [rdi - 8]
lea rcx, [rsp + 0x30]
call fcn.180008324
nop
lea rcx, [rdi - 0xc]
lea r15, [0x18015f758]
or r14d, 0xffffffff
cmp rcx, r15
je 0x1800070d5
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
test eax, eax
jg 0x1800070d5
call fcn.1800d1434
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
test byte [rsp + 0x50], 0x10
je 0x180007218
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x28]
call fcn.1800041c0
nop
lea rdi, [0x18010d3c4]
mov rbx, qword [rsp + 0x28]
mov rsi, rbx
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x1800071fc
lea rdi, [0x18010d50c]
mov rsi, rbx
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x1800071fc
cmp dword [rbx - 8], 0
jl 0x1800071de
lea rdx, [0x18010d3c4]
mov rcx, rbx
call fcn.1800d1f00
test rax, rax
je 0x1800071de
sub rax, rbx
sar rax, 1
test eax, eax
js 0x1800071de
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.180007f08
and dword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
lea rdx, [0x18010d52c]
mov rcx, qword [rsp + 0x38]
call fcn.1800d2014
mov edx, dword [rsp + 0x20]
test edx, edx
je 0x1800071a8
movzx ebp, bpl
mov eax, 1
cmp edx, r13d
cmovg ebp, eax
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff4
cmp rcx, r15
je 0x1800071de
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
test eax, eax
jg 0x1800071d9
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
mov rbx, qword [rsp + 0x28]
jmp 0x1800071de
mov rbx, qword [rsp + 0x28]
lea rcx, [rbx - 0xc]
cmp rcx, r15
je 0x180007218
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
test eax, eax
jg 0x180007218
call fcn.1800d1434
jmp 0x180007218
lea rcx, [rbx - 0xc]
cmp rcx, r15
je 0x180007218
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
test eax, eax
jg 0x180007218
call fcn.1800d1434
lea rdx, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800070e8
movzx edi, bpl
mov rcx, qword [rsp + 0x30]
add rcx, 0xfffffffffffffff4
cmp rcx, r15
je 0x180007253
mov edx, r14d
lock xadd dword [rcx], edx
add edx, r14d
test edx, edx
jg 0x180007253
call fcn.1800d1434
mov eax, edi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1800d12b0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180008578
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov rsi, r8
lea rax, [r11 - 0x28]
mov rdi, r9
mov rdx, qword [rsi]
mov ebx, 0xf003f
mov rbp, 0xffffffff80000001
xor r8d, r8d
mov r9d, ebx
mov rcx, rbp
mov qword [r11 - 0x58], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18000865c
mov rdx, qword [rsi]
and dword [rsp + 0x90], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x28], ebx
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18000865c
mov rcx, qword [rsi]
lea rbp, [0x18015f758]
or ebx, 0xffffffff
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x180008631
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180008631
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1800d1434
mov rcx, qword [rdi]
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x180008655
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x180008655
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.1800d1434
xor eax, eax
jmp 0x1800086f6
mov eax, dword [rsp + 0xa8]
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsi]
xor r12d, r12d
test ebx, ebx
lea rbp, [0x18015f758]
sete r12b
add rcx, 0xfffffffffffffff4
or ebx, 0xffffffff
cmp rcx, rbp
je 0x1800086cf
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x1800086cf
mov rcx, qword [rsi]
sub rcx, 0xc
call fcn.1800d1434
mov rax, qword [rdi]
add rax, 0xfffffffffffffff4
cmp rax, rbp
je 0x1800086f3
mov ecx, ebx
lock xadd dword [rax], ecx
add ecx, ebx
test ecx, ecx
jg 0x1800086f3
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.1800d1434
mov eax, r12d
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret