joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005d280
Capabilities:
Get common file path
Get installed programs
Get program files directory
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x1400ce568]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r9d, dword [0x1400d0cac]
xor r14d, r14d
mov rdi, rdx
mov rsi, rcx
test r9d, r9d
jne 0x14005d2fd
mov dword [0x1400d0cac], 0x20019
mov dword [rsp + 0x30], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14005d2f6
cmp dword [rsp + 0x30], r14d
je 0x14005d2f6
mov r9d, dword [0x1400d0cac]
bts r9d, 8
mov dword [0x1400d0cac], r9d
jmp 0x14005d2fd
mov r9d, dword [0x1400d0cac]
test rsi, rsi
je 0x14005d4d8
test rdi, rdi
je 0x14005d4d8
lea rax, [rsp + 0x38]
mov qword [rsp + 0x298], rbp
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallB2FE1952_0186_46C3_BAEC_A80AA35AC5B8_Display.NView
mov qword [rsp + 0x38], r14
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005d3bb
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x1400a69b8]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov qword [rsp + 0x290], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
mov ebx, eax
sete bpl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x290]
jne 0x14005d3bb
movzx eax, bpl
mov rbp, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14006fd90
add rsp, 0x260
pop r14
pop rdi
pop rsi
ret
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.1400725e0
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
shr rdi, 1
mov r9d, 0x7ffffffe
lea rax, [rdi - 1]
cmp rax, r9
ja 0x14005d438
sub r9, rdi
lea r8, [rsp + 0x40]
sub r8, rsi
mov rdx, rdi
mov rcx, rsi
lea rax, [r9 + rdx]
test rax, rax
je 0x14005d424
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14005d424
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14005d404
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov rcx, rdi
mov word [rax], r14w
jmp 0x14005d45a
test rdi, rdi
je 0x14005d4d1
mov word [rsi], r14w
cmp rdi, 0x7fffffff
ja 0x14005d4d1
mov rcx, rdi
test rdi, rdi
je 0x14005d470
mov rax, rsi
nop dword [rax]
cmp word [rax], r14w
je 0x14005d470
add rax, 2
sub rcx, 1
jne 0x14005d460
mov rax, rdi
sub rax, rcx
test rcx, rcx
cmove rax, r14
je 0x14005d4d1
mov rdx, rdi
lea rcx, [rsi + rax*2]
sub rdx, rax
je 0x14005d4c2
sub rax, rdi
lea r9, [0x1400a4608]
add rax, 0x7ffffffe
add rax, rdx
sub r9, rcx
test rax, rax
je 0x14005d4c2
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x14005d4c2
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x14005d4a1
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r14w
mov al, 1
jmp 0x14005d397
xor al, al
jmp 0x14005d39f
Function at 0x140067a60
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1400ce568]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r14, rcx
xor r15d, r15d
mov rax, rdx
mov dword [rsp + 0x50], r15d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x40], rcx
lea rdx, str.DisplayConfig
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov rcx, rax
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r9d, 0x123
lea r8, str.D:uworkspace_nViewBranchBuilder_3S_sw_nview_v200_nViewDisplayControlDisplayConfig.cpp
mov ecx, eax
lea rdx, str.DisplayConfig::saveToRegistry
call fcn.140059c60
test eax, eax
jne 0x140067c13
mov rcx, qword [rsp + 0x60]
lea rbp, [r14 + 8]
mov dword [rsp + 0x28], 4
lea r9d, [r15 + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
lea rdx, str.pathInfoCount
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, r15d
cmp dword [rbp], r15d
jbe 0x140067c0f
nop
mov r8d, esi
mov qword [rsp + 0x58], r15
lea rdx, str.pathInfo_d
lea rcx, [rsp + 0x70]
call fcn.140066310
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x70]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r9d, 0x12f
lea r8, str.D:uworkspace_nViewBranchBuilder_3S_sw_nview_v200_nViewDisplayControlDisplayConfig.cpp
mov ecx, eax
lea rdx, str.DisplayConfig::saveToRegistry
call fcn.140059c60
test eax, eax
jne 0x140067c13
mov rdx, qword [rsp + 0x58]
mov eax, esi
imul rdi, rax, 0x38
mov rcx, qword [rdi + r14 + 0x28]
call fcn.140069a10
mov rcx, qword [rsp + 0x58]
lea rbx, [r14 + 0x18]
add rbx, rdi
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea rdx, str.targetInfoCount
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8, qword [rsp + 0x58]
mov edx, dword [rbx]
mov rcx, qword [rdi + r14 + 0x20]
call fcn.140068890
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, dword [rbp]
jb 0x140067b30
mov al, 1
jmp 0x140067c15
xor al, al
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14006fd90
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006add0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x1400ce568]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov rdi, rdx
mov rsi, rcx
call fcn.14006a7b0
xor r15d, r15d
mov dword [rsp + 0x40], 0x50
mov r14, rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r8, [rbp + 0x240]
mov qword [rsp + 0x30], r15
mov rcx, rdi
mov qword [rsp + 0x28], r15
mov ebx, r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14006af55
mov r9d, 0xf003f
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x240]
mov rcx, rdi
call fcn.14005a990
test eax, eax
jne 0x14006af13
xor edx, edx
mov dword [rsp + 0x68], r15d
mov r8d, 0xa0
mov qword [rsp + 0x70], r15
lea rcx, [rbp + 0x1a0]
mov qword [rbp + 0x188], r15
mov qword [rbp + 0x190], r15
mov dword [rsp + 0x78], r15d
mov word [rsp + 0x7c], r15w
mov dword [rbp + 0x184], r15d
call fcn.1400725e0
mov rcx, qword [rsp + 0x48]
lea r8, [rbp + 0x1a0]
mov r9d, 0xa0
lea rdx, str.Action
call fcn.14005acc0
lea rdx, [rbp + 0x1a0]
mov rcx, r14
call fcn.14006a690
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x14006af08
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.14006af80
test al, al
je 0x14006af08
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.14006aa40
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 0x50
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], r15
lea r8, [rbp + 0x240]
inc ebx
mov qword [rsp + 0x28], r15
mov edx, ebx
mov qword [rsp + 0x20], r15
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14006ae50
mov al, 1
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.14006fd90
mov rbx, qword [rsp + 0x430]
add rsp, 0x3f0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006ca40
Capabilities:
Enumerate gui resources

Disassembly:
test rcx, rcx
je 0x14006cbb9
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rbx, r8
mov ebp, edx
mov rdi, rcx
test edx, edx
jne 0x14006ca9b
call fcn.14006cd00
cmp rax, rdi
je 0x14006ca89
test rax, rax
je 0x14006cba5
mov rdi, rax
mov qword [rsp + 0x60], rax
mov rcx, rdi
call fcn.14006cf20
mov ecx, 1
test al, al
cmove ebp, ecx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov rcx, qword [rsp + 0x20]
call fcn.14006d1b0
mov dword [rsp + 0x2c], eax
mov rdx, qword [rsp + 0x38]
cmp rdx, qword [rsp + 0x40]
je 0x14006cae3
mov qword [rdx], rdi
add qword [rsp + 0x38], 8
jmp 0x14006caf2
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.14002c110
test ebp, ebp
jne 0x14006caff
lea rcx, [0x14006c5a0]
jmp 0x14006cb19
cmp ebp, 1
jne 0x14006cb0d
lea rcx, [0x14006c500]
jmp 0x14006cb19
cmp ebp, 2
jne 0x14006cb24
lea rcx, [0x14006c480]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
sub rax, rcx
sar rax, 3
test eax, eax
jle 0x14006cb8f
mov rdi, rsi
nop dword [rax]
mov rcx, qword [rdi + rcx]
call fcn.14006cef0
test al, al
jne 0x14006cb74
mov r8, qword [rsp + 0x30]
add r8, rdi
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14006cb6c
mov rax, qword [r8]
mov qword [rdx], rax
add qword [rbx + 8], 8
jmp 0x14006cb74
mov rcx, rbx
call fcn.14002c110
inc esi
add rdi, 8
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
sub rax, rcx
sar rax, 3
cmp esi, eax
jl 0x14006cb40
test rcx, rcx
je 0x14006cba5
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
call fcn.140006f30
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14006cbc0
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
push rbp
push r12
push r13
push r14
sub rsp, 0x20
mov r14, rcx
mov rdx, rcx
lea rcx, [0x14006c620]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [r14 + 8]
xor r13d, r13d
mov rbx, qword [r14]
xor r12b, r12b
sub rax, rbx
mov ebp, r13d
sar rax, 3
test eax, eax
jle 0x14006ccef
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], r15
mov r15d, r13d
mov qword [rsp + 0x58], rdi
mov rcx, qword [r15 + rbx]
mov edx, 4
call qword [sym.imp.USER32.dll_GetWindow]
test rax, rax
je 0x14006cc53
mov rdi, qword [r14]
mov rbx, qword [r14 + 8]
mov rcx, rdi
cmp rdi, rbx
je 0x14006cc42
cmp qword [rcx], rax
je 0x14006cc42
add rcx, 8
cmp rcx, rbx
jne 0x14006cc34
call fcn.140006c60
cmp rax, rbx
je 0x14006cc53
mov qword [r15 + rdi], r13
mov r12b, 1
mov rsi, qword [r14 + 8]
inc ebp
mov rbx, qword [r14]
mov rax, rsi
sub rax, rbx
add r15, 8
sar rax, 3
cmp ebp, eax
jl 0x14006cc11
mov r15, qword [rsp + 0x60]
test r12b, r12b
je 0x14006cce5
cmp rbx, rsi
je 0x14006ccc2
nop dword [rax]
mov rcx, qword [rbx]
call fcn.14006d0b0
test al, al
jne 0x14006cc95
add rbx, 8
cmp rbx, rsi
jne 0x14006cc80
cmp rbx, rsi
je 0x14006ccc2
lea rdi, [rbx + 8]
cmp rdi, rsi
je 0x14006ccc2
mov rbp, qword [rdi]
mov rcx, rbp
call fcn.14006d0b0
test al, al
jne 0x14006ccb9
mov qword [rbx], rbp
add rbx, 8
add rdi, 8
cmp rdi, rsi
jne 0x14006cca3
mov rdi, qword [r14 + 8]
mov rcx, rbx
call fcn.140006c60
cmp rax, rdi
je 0x14006cce5
mov r8, rax
mov rdx, rdi
mov rcx, rdi
call fcn.140037110
mov qword [r14 + 8], rax
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret

Function at 0x14006d0c0
Capabilities:
Enumerate gui resources

Disassembly:
mov dword [rcx + 0x10], edx
mov rdx, rcx
mov qword [rcx + 0x18], r8
mov qword [rcx + 0x20], r9
lea rcx, [0x14006d150]
jmp qword [sym.imp.USER32.dll_EnumWindows]

Function at 0x140088b8c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400889b8
Function at 0x14008ea40
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14008e766
call fcn.14007c9f0
mov dword [rax], 0x16
call fcn.14007696c
jmp 0x14008e8b1
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14008e8b1
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14008e8b1
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14008e795
lock or dword [rcx + 0x14], 0x10
jmp 0x14008e8b1
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14008e7a9
call fcn.14008ee04
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x14008e7b9
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14008e7bc
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14008d61c
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1400980ec
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14008e89f
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14008e84d
mov rcx, rbx
call fcn.14008d61c
cmp eax, 0xffffffff
je 0x14008e838
mov rcx, rbx
call fcn.14008d61c
cmp eax, 0xfffffffe
je 0x14008e838
mov rcx, rbx
call fcn.14008d61c
movsxd rdi, eax
lea r14, [0x1400d2110]
mov rcx, rbx
sar rdi, 6
call fcn.14008d61c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14008e83f
lea rdx, [0x1400ce930]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14008e84d
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14008e871
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14008e871
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14008e871
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14008e88f
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14008e89a
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x14008e8b6
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14008e730
Function at 0x14000116c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r9b, r9b
movzx r11d, cl
shl r11d, 2
mov rbx, r8
movzx r8d, r9b
xor r10b, r10b
add r8d, r11d
shl r8d, 2
movzx eax, r10b
inc r10b
add eax, r8d
mov cl, byte [rax + rbx]
xor byte [rdx], cl
inc rdx
cmp r10b, 4
jb 0x14000118d
inc r9b
cmp r9b, 4
jb 0x14000117f
mov rbx, qword [rsp + 8]
ret

Function at 0x1400011b4
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov r8, rdx
mov rdx, rcx
mov rbx, rcx
xor ecx, ecx
call fcn.14000116c
mov dil, 1
lea r14, [rbx + 2]
mov r12d, 4
mov rdx, rbx
mov r8, r12
mov rcx, rdx
mov r9, r12
movzx eax, byte [rcx]
lea r10, str.cw
mov al, byte [rax + r10]
mov byte [rcx], al
add rcx, r12
sub r9, 1
jne 0x1400011fd
inc rdx
sub r8, 1
jne 0x1400011f7
mov al, byte [rbx + 5]
mov cl, byte [rbx + 1]
mov byte [rbx + 1], al
mov al, byte [rbx + 9]
mov byte [rbx + 5], al
mov al, byte [rbx + 0xd]
mov byte [rbx + 9], al
mov al, byte [rbx + 0xa]
mov byte [rbx + 0xd], cl
mov cl, byte [r14]
mov byte [r14], al
mov al, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
mov cl, byte [rbx + 6]
mov byte [rbx + 6], al
mov al, byte [rbx + 0xf]
mov byte [rbx + 0xe], cl
mov cl, byte [rbx + 3]
mov byte [rbx + 3], al
mov al, byte [rbx + 0xb]
mov byte [rbx + 0xf], al
mov al, byte [rbx + 7]
mov byte [rbx + 0xb], al
mov byte [rbx + 7], cl
cmp dil, 0xa
je 0x14000132c
mov r15, r14
mov rbp, r12
mov r11b, byte [r15 - 2]
mov r8b, byte [r15 - 1]
mov dl, r11b
mov r9b, byte [r15]
xor dl, r8b
xor r9b, byte [r15 + 1]
mov al, dl
shr al, 7
add dl, dl
movzx eax, al
mov r10b, r9b
imul ecx, eax, 0x1b
xor r10b, r11b
xor r10b, r8b
xor cl, dl
mov dl, byte [r15]
xor cl, r11b
xor dl, r8b
xor r11b, byte [r15 + 1]
xor cl, r10b
mov byte [r15 - 2], cl
mov al, dl
shr al, 7
add dl, dl
movzx eax, al
imul ecx, eax, 0x1b
mov al, r9b
shr al, 7
add r9b, r9b
movzx eax, al
xor cl, dl
xor cl, r8b
xor cl, r10b
mov byte [r15 - 1], cl
imul ecx, eax, 0x1b
mov al, r11b
shr al, 7
add r11b, r11b
movzx eax, al
xor cl, r9b
xor cl, byte [r15]
xor cl, r10b
mov byte [r15], cl
imul ecx, eax, 0x1b
xor cl, r11b
xor cl, byte [r15 + 1]
xor cl, r10b
mov byte [r15 + 1], cl
add r15, r12
sub rbp, 1
jne 0x140001277
mov r8, rsi
mov rdx, rbx
mov cl, dil
call fcn.14000116c
inc dil
jmp 0x1400011f1
mov r8, rsi
mov rdx, rbx
mov cl, 0xa
call fcn.14000116c
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140005edc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
xor eax, eax
lea rcx, [rbp - 0x19]
mov rbx, rdx
mov qword [rbp - 0x29], rax
xorps xmm0, xmm0
xor edx, edx
movups xmmword [rbp - 0x39], xmm0
lea r8d, [rax + 0x68]
call sub.VCRUNTIME140.dll_memset
lea rax, str.winsta0default
mov dword [rbp - 0x19], 0x68
mov rcx, rbx
mov qword [rbp - 9], rax
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
and qword [rbp + 0x67], 0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x77]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, 1
jne 0x140005f63
mov rdx, qword [rbp + 0x77]
lea rcx, [rbp + 0x67]
xor r8d, r8d
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x19]
xor edx, edx
mov qword [rsp + 0x40], rax
mov rcx, rbx
and qword [rsp + 0x38], 0
mov rax, qword [rbp + 0x67]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x628
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140005fc6
mov rcx, qword [rbp - 0x39]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xf8]
add rsp, 0xe0
pop rbp
ret
Function at 0x1400083f0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x14000842d
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.14000858c
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14000852c
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14000858c
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x1400084a0
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.140006b34
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x14000856b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000856b
call fcn.14000756c
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x140008552
mov rcx, r14
call fcn.14000756c
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140052a50
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140052a5d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140052a6d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140052a55
lea eax, [rcx + 1]
jmp 0x140052a7b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140052a8e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140052a74
sub eax, 3
jb 0x140052aae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140052afd
sar eax, 1
movsxd rbp, eax
jb 0x140052ae4
jmp 0x140052abc
add ebx, ebx
jne 0x140052aba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140052ae4
inc ecx
add ebx, ebx
jne 0x140052aca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140052ae4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140052add
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140052acc
add ecx, 2
jmp 0x140052ae9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140052a12
jmp 0x140052a5d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1b400
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140052b49
cmp rsi, rcx
jae 0x140052b51
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140052b30
cmp al, 0x8f
ja 0x140052b30
cmp byte [rsi - 2], 0xf
je 0x140052b36
sub al, 0xe8
cmp al, 1
ja 0x140052b1a
cmp rsi, rcx
jae 0x140052b51
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140052b20
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140052b51
lodsb al, byte [rsi]
jmp 0x140052b30
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x50000]
mov eax, dword [rdi]
or eax, eax
je 0x140052bba
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x7a920]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140052b5e
jns 0x140052b93
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140052b9d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140052bb4
mov qword [rbx], rax
add rbx, 8
jmp 0x140052b7e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140052c12
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0