joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008d4b7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400e71f0]
jne 0x14008106a
rol rcx, 0x10
test cx, 0xffff
jne 0x140081066
repz ret
ror rcx, 0x10
jmp 0x14008d410
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400ee040]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400ee138]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14008d495
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400ee040]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14008d4b7
mov rax, qword [rsp + 0x88]
mov qword [0x1400ee138], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400ee0d8], rax
mov rax, qword [0x1400ee138]
mov qword [0x1400edfb0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400ee0c0], rax
mov dword [0x1400edfa0], 0xc0000409
mov dword [0x1400edfa4], 1
mov rax, qword [0x1400e71f0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400e71f8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400ee038], eax
mov ecx, 1
call fcn.140094cc0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400aefe8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400ee038], 0
jne 0x14008d53e
mov ecx, 1
call fcn.140094cc0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140099950
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.140089940
xor ebx, ebx
cmp qword [0x1400ee860], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x140099a7c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x140099b8f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140099b8f
mov rcx, rax
call fcn.140089870
lea rdx, [0x1400af2b0]
mov rcx, rsi
mov qword [0x1400ee860], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140089870
lea rdx, [0x1400af298]
mov rcx, rsi
mov qword [0x1400ee868], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140089870
lea rcx, [rsp + 0x98]
mov qword [0x1400ee870], rax
call fcn.1400865b0
test eax, eax
je 0x140099a2f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.1400836e0
cmp dword [rsp + 0x98], 2
jne 0x140099a7c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140089870
test rax, rax
mov qword [0x1400ee880], rax
je 0x140099a7c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140089870
mov qword [0x1400ee878], rax
mov rcx, qword [0x1400ee878]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x140099b28
cmp qword [0x1400ee880], rbp
je 0x140099b28
call fcn.140089a30
mov rcx, qword [0x1400ee880]
mov rsi, rax
call fcn.140089a30
test rsi, rsi
mov r12, rax
je 0x140099b28
test rax, rax
je 0x140099b28
call rsi
test rax, rax
je 0x140099af3
lea rcx, [rsp + 0x34]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140099af3
test byte [rsp + 0x40], 1
jne 0x140099b28
lea rcx, [rsp + 0x30]
call fcn.140086600
test eax, eax
je 0x140099b15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.1400836e0
cmp dword [rsp + 0x30], 4
jb 0x140099b22
bts edi, 0x15
jmp 0x140099b66
bts edi, 0x12
jmp 0x140099b66
mov rcx, qword [0x1400ee868]
cmp rcx, rbp
je 0x140099b66
call fcn.140089a30
test rax, rax
je 0x140099b66
call rax
test rax, rax
mov rbx, rax
je 0x140099b66
mov rcx, qword [0x1400ee870]
cmp rcx, rbp
je 0x140099b66
call fcn.140089a30
test rax, rax
je 0x140099b66
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400ee860]
call fcn.140089a30
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x140099b8f
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140099b91
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009b110
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14009b157
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140081050
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.14009cbc0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140081050
add rsp, 0x38
ret

Function at 0x14009f310
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
mov rbp, rdx
xor edi, edi
xor edx, edx
lea r8d, [rdi + 1]
mov esi, ecx
call fcn.14009ab70
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x14009f4b4
lea r8d, [rdi + 2]
xor edx, edx
mov ecx, esi
call fcn.14009ab70
cmp rax, 0xffffffffffffffff
je 0x14009f4b4
mov qword [rsp + 0x40], rbx
mov rbx, rbp
mov qword [rsp + 0x50], r14
sub rbx, rax
test rbx, rbx
jle 0x14009f433
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r14d, 0x1000
lea edx, [rdi + 8]
mov rcx, rax
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbp, rax
jne 0x14009f3b9
call fcn.140085bc0
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.140085bc0
mov eax, dword [rax]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov edx, 0x8000
mov ecx, esi
mov qword [rsp + 0x48], r12
call fcn.14009f4d0
mov r12d, eax
nop
mov r8d, ebx
cmp rbx, r14
mov rdx, rbp
cmovge r8d, r14d
mov ecx, esi
call fcn.140098b00
cmp eax, 0xffffffff
je 0x14009f3f5
cdqe
sub rbx, rax
test rbx, rbx
jg 0x14009f3d0
jmp 0x14009f40e
call fcn.140085bf0
cmp dword [rax], 5
jne 0x14009f40a
call fcn.140085bc0
mov dword [rax], 0xd
or rdi, 0xffffffffffffffff
mov edx, r12d
mov ecx, esi
call fcn.14009f4d0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x48]
jmp 0x14009f48c
test rbx, rbx
jns 0x14009f496
xor r8d, r8d
mov rdx, rbp
mov ecx, esi
call fcn.14009ab70
cmp rax, 0xffffffffffffffff
je 0x14009f39a
mov ecx, esi
call fcn.140086aa0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb rdi, rdi
neg rdi
sub rdi, 1
cmp rdi, 0xffffffffffffffff
jne 0x14009f496
call fcn.140085bc0
mov dword [rax], 0xd
call fcn.140085bf0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
cmp rdi, 0xffffffffffffffff
je 0x14009f39a
xor r8d, r8d
mov rdx, r13
mov ecx, esi
call fcn.14009ab70
cmp rax, 0xffffffffffffffff
je 0x14009f39a
xor eax, eax
jmp 0x14009f3a1
call fcn.140085bc0
mov rbp, qword [rsp + 0x58]
mov eax, dword [rax]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
Function at 0x1400a22fc
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.140080d50
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x140000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.140080d50
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x1400a238f
cmp dword [rsp + 0x24], 5
jb 0x1400a23a9
jmp 0x1400a23a5
cmp dword [rsp + 0x30], esi
jne 0x1400a23a9
cmp dword [rsp + 0x24], 4
ja 0x1400a23a5
jne 0x1400a23a9
cmp dword [rsp + 0x28], 0
jbe 0x1400a23a9
mov byte [rbx + 0x18], sil
lea rax, [0x1400b05f0]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.1400a21bc
movzx ecx, byte [0x1400e8b00]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x1400e8b00], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140002da2
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x140007046
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
jmp 0x140008b13
Function at 0x140003188
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [rsp + 0x24], 0
jmp 0x140008a78
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x20000000
test eax, eax
je 0x1400028af
jmp 0x140005982
mov eax, 1
jmp 0x140004404
cmp qword [rsp + 0x38], 0
je 0x140005c85
jmp 0x140003741
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x10], 0
je 0x140002d78
jmp 0x140006478
mov r8d, 0x4000
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x38]
call qword [rax + 8]
jmp 0x140003950
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x80000000
test eax, eax
jne 0x140007074
jmp 0x1400046a6
mov r8d, 0x4000
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [0x14007eefb]
jmp 0x140003950
mov eax, 1
jmp 0x140004404
mov rax, qword [rsp + 0x98]
cmp dword [rax + 0x1c], 0
jne 0x1400076cb
jmp 0x140008c18
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0x40]
mov qword [rsp + 0x70], rax
xor edx, edx
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rsp + 0x70]
div rcx
mov rax, rdx
test rax, rax
je 0x1400076cb
jmp 0x140004113
add byte [rax], al
jmp 0x140003950
mov eax, dword [rsp + 0x20]
bts eax, 9
mov dword [rsp + 0x20], eax
mov eax, 1
jmp 0x140004404
mov dword [rsp + 0x2c], 0
jmp 0x140004e27
mov dword [rsp + 0x64], 0x80
mov dword [rsp + 0x68], 0x20
and byte [rax], al
add byte [rax], al
mov dword [rsp + 0x6c], 0x40
movsxd rax, dword [rsp + 0x40]
imul rax, rax, 0x10
lea rax, [rsp + rax + 0x50]
movsxd rcx, dword [rsp + 0x44]
lea rax, [rax + rcx*8]
movsxd rcx, dword [rsp + 0x48]
jmp 0x1400072df
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x54], 8
mov dword [rsp + 0x58], 2
mov dword [rsp + 0x5c], 4
mov dword [rsp + 0x60], 0x10
jmp 0x140004754
mov dword [rsp + 0x24], 1
jmp 0x140008a78
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x98]
mov rcx, qword [rcx + 8]
cmp qword [rax], rcx
jne 0x1400042bb
jmp 0x140003be1
mov dword [rsp + 0x28], 1
jmp 0x14000383b
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x2000000
test eax, eax
jne 0x1400061ba
jmp 0x140002cd8
mov dword [rsp + 0x2c], 1
jmp 0x140004e27
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x4000000
test eax, eax
jne 0x140004114
jmp 0x140002f85
cmp qword [rsp + 0x38], 0
jne 0x1400035db
jmp 0x1400038c1
mov dword [rsp + 0x28], 0
jmp 0x14000383b
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x40000000
test eax, eax
je 0x1400087d1
jmp 0x140006337
mov rax, qword [rsp + 0x90]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
mov ecx, dword [rcx + 0x40]
cmp dword [rax + 0x38], ecx
je 0x1400076cb
jmp 0x1400040ae
Function at 0x14000767e
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx]
movzx ecx, word [rcx + 0x14]
lea rax, [rax + rcx + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 0
jmp 0x140007394
jmp 0x140008a18
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x88]
jmp 0x140006f85
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x24], eax
jl 0x140003586
jmp 0x140003b73
Function at 0x140009d18
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140098070]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x28]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov eax, ecx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008d590
add rsp, 0x78
ret

Function at 0x140009ff8
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x1d8
mov rax, qword [0x140098070]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov r14, r9
lea r8d, [rdx + 0x40]
call sub.ntdll.dll_memset
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x158
call sub.ntdll.dll_memset
xor r9d, r9d
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x14000a0c6
xor r9d, r9d
lea rdx, [rsp + 0x60]
mov r8d, 0x158
lea ecx, [r9 + 2]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x14000a0c6
mov ecx, dword [rsp + 0x28]
test rdi, rdi
je 0x14000a090
mov dword [rdi], ecx
test rsi, rsi
je 0x14000a09f
mov eax, dword [rsp + 0x8c]
mov qword [rsi], rax
test rbx, rbx
je 0x14000a0ab
mov eax, dword [rsp + 0x2c]
mov qword [rbx], rax
test r14, r14
je 0x14000a0c2
mov rax, qword [rsp + 0x48]
xor edx, edx
sub rax, qword [rsp + 0x40]
div rcx
mov qword [r14], rax
mov al, 1
jmp 0x14000a0c8
xor al, al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14008d590
add rsp, 0x1d8
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140015b20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov rsi, rcx
movzx ecx, word [rcx + 0x1c]
movzx r11d, r15w
mov r14, r9
mov ebp, r8d
mov r10d, 0x20
movzx eax, word [rsi + 0x1a]
sub r10w, cx
and ax, dx
shr edx, cl
xor r11w, ax
test r10w, r10w
jg 0x140015b52
mov rdi, qword [rsi + 0x10]
movzx ebx, r11w
add rbx, rbx
mov rcx, qword [rdi + rbx*8 + 8]
test rcx, rcx
jne 0x140015bab
movzx ecx, word [rsi + 0x1e]
shl rcx, 2
call fcn.1400040dc
mov qword [rdi + rbx*8 + 8], rax
mov rcx, rax
test rax, rax
je 0x140015bcf
mov dword [rdi + rbx*8], r15d
movzx r8d, word [rsi + 0x1e]
mov dword [rdi + rbx*8 + 4], r8d
mov eax, r15d
jmp 0x140015bb3
mov eax, dword [rdi + rbx*8]
mov r8d, dword [rdi + rbx*8 + 4]
cmp eax, r8d
jne 0x140015be3
movzx edx, word [rsi + 0x1e]
add edx, r8d
shl edx, 2
call fcn.140004314
mov rcx, rax
test rax, rax
jne 0x140015bd3
xor al, al
jmp 0x140015bfd
mov qword [rdi + rbx*8 + 8], rax
movzx eax, word [rsi + 0x1e]
add dword [rdi + rbx*8 + 4], eax
mov eax, dword [rdi + rbx*8]
mov dword [rcx + rax*4], ebp
mov al, 1
mov rcx, qword [rdi + rbx*8 + 8]
inc dword [rdi + rbx*8]
mov edx, dword [rdi + rbx*8]
mov qword [r14], rcx
mov rcx, qword [rsp + 0x60]
mov dword [rcx], edx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400359c0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x140098070]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, qword [rsp + 0x2a0]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x208
call sub.ntdll.dll_memset
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, str.REGISTRYMACHINESYSTEMCurrentControlSetControlSession_Manager
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x104
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, str.Session_Manager
call qword [sym.imp.ntdll.dll_RtlGetPersistedStateLocation]
nop dword [rax + rax]
test eax, eax
js 0x140035a64
mov eax, dword [rsp + 0x2a8]
lea r8, str.BootExecute
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x50]
mov r9d, 7
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14008d590
add rsp, 0x270
pop rbx
ret
Function at 0x14003bcc8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov r10, rcx
mov rdi, r8
lea rcx, [rbp - 0x39]
mov r14b, dl
call fcn.14001eabc
and qword [rsp + 0x20], 0
lea rdx, [rbp - 0x39]
mov r9d, 0x80
lea r8, [rbp + 0x7f]
mov rcx, r10
call fcn.14002c038
test al, al
je 0x14003be19
cmp qword [rbp + 0x2f], 0
je 0x14003bd2c
lea rcx, str.UNTFS:_Log_File__DATA_attribute_is_resident._n
jmp 0x14003be0d
and qword [rsp + 0x28], 0
lea rax, [rbp - 0x59]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x55]
lea rcx, [rbp - 0x39]
call fcn.14002035c
test al, al
je 0x14003be06
cmp dword [rbp - 0x59], 4
jne 0x14003be06
mov esi, 1
test r14b, r14b
jne 0x14003bda3
and qword [rsp + 0x28], 0
lea rax, [rbp - 0x59]
lea r9d, [rsi + 3]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x55], 0x444b4843
lea rdx, [rbp - 0x55]
lea rcx, [rbp - 0x39]
call fcn.140020890
test al, al
je 0x14003be19
cmp dword [rbp - 0x59], 4
je 0x14003be1c
jmp 0x14003be19
call fcn.140009d18
mov r14d, eax
test eax, eax
je 0x14003be19
lea rcx, [r14 + 0x10]
cmp qword [rbp + 0x27], rcx
jb 0x14003be19
and dword [rbp - 0x4d], 0
mov qword [rbp - 0x49], rdi
xor edi, edi
mov dword [rbp - 0x51], 0x444b4843
and qword [rsp + 0x28], 0
lea rax, [rbp - 0x59]
mov r8d, edi
mov qword [rsp + 0x20], rax
imul r8d, r14d
lea rdx, [rbp - 0x51]
mov r9d, 0x10
lea rcx, [rbp - 0x39]
call fcn.140020890
test al, al
je 0x14003be19
cmp dword [rbp - 0x59], 0x10
jne 0x14003be19
add edi, esi
cmp edi, 2
jb 0x14003bdca
jmp 0x14003be1c
lea rcx, str.UNTFS:_Cant_read_log_file_signature._n
call qword [sym.imp.ntdll.dll_DbgPrint]
nop dword [rax + rax]
xor sil, sil
lea rcx, [rbp - 0x39]
call fcn.14001eb6c
lea r11, [rsp + 0xe0]
mov al, sil
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14003d3f8
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov r8d, 1
add rdx, 0x40
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
lea rdx, [rdi + 0x41]
mov r8d, 1
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
mov r8d, 4
lea rdx, [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
mov r8d, 8
mov rdx, rdi
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
movzx r8d, byte [rdi + 0x40]
lea rdx, [rdi + 0x42]
add r8d, r8d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x38]
mov dword [rsi], eax
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003d4a4
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rdx, rcx
mov ebx, 0x18
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
cmp byte [0x14009b641], 2
jb 0x14003d4e4
test dword [rdi + 0x30], 0x400
jne 0x14003d4e9
mov ebx, 0x16
lea rdx, [rdi + 0x20]
mov r8d, ebx
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
mov dword [rsi], eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14007de80
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rsp + 0x50]
mov rbx, r8
test eax, eax
je 0x14007deb7
cmp eax, 2
jne 0x14007debc
cmp r9d, 4
jne 0x14007debc
mov r8d, edx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
nop dword [rax + rax]
cmp eax, dword [rbx]
sete al
jmp 0x14007dec2
test r9d, r9d
je 0x14007dec0
xor al, al
jmp 0x14007dec2
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400020e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002132
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002132
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002132
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002132
cmp dword [rcx + 0x84], 0xe
jbe 0x140002132
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002134
xor al, al
add rsp, 0x28
ret