joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400046e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, qword [rsp + 0x70]
mov rbx, r9
mov rsi, r8
mov qword [rax - 0x20], rdi
xor ebp, ebp
mov qword [rax - 0x28], rbx
lea r9, [rax - 0x18]
mov dword [rax - 0x18], ebp
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x14000476a
mov edx, dword [rsp + 0x30]
test rdi, rdi
jne 0x140004748
test rbx, rbx
je 0x140004763
mov ecx, 0x8000ffff
jmp 0x14000476a
test rbx, rbx
je 0x140004763
lea eax, [rdx - 1]
cmp eax, 1
ja 0x140004763
cmp dword [rdi], 2
jb 0x140004741
mov eax, dword [rdi]
cmp word [rax + rbx - 2], bp
jmp 0x14000473f
test rsi, rsi
je 0x14000476a
mov dword [rsi], edx
mov rbx, qword [rsp + 0x50]
mov eax, ecx
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140005d44
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov edx, 3
mov dword [rsp + 0x30], 0x201
mov rbx, rcx
call qword [sym.imp.SHLWAPI.dll_UrlIsW]
xor edi, edi
test eax, eax
je 0x140005db0
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x402
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathCreateFromUrlW]
test eax, eax
js 0x140005db0
lea rbx, [rsp + 0x40]
mov dword [rsp + 0x28], 1
lea r8, str._SystemRoot__system32NOTEPAD.EXE
mov r9, rbx
mov qword [rsp + 0x20], rdi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
mov ecx, 0x80004005
cmovle edi, ecx
mov eax, edi
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400070a0
mov rbx, qword [rsp + 0x478]
add rsp, 0x460
pop rdi
ret
Function at 0x140005e08
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor r15d, r15d
mov rsi, r8
mov qword [rbp - 0x10], r15
mov rdi, rdx
mov qword [rbp - 8], r15
mov r14, rcx
mov dword [rbp + 0x48], r15d
mov dword [rbp + 0x30], r15d
test rcx, rcx
je 0x140005e4b
mov eax, r15d
cmp word [rcx], r15w
jne 0x140005e50
mov eax, 1
mov r13d, 0x80070000
test eax, eax
je 0x140005e64
mov ebx, 0x80070057
jmp 0x140005fe3
test rsi, rsi
je 0x140005e5a
lea rax, [rbp - 0x10]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f85
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 8]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.CurVer
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140005f85
mov rcx, qword [rbp - 8]
xor edx, edx
test rdi, rdi
je 0x140005f35
mov eax, dword [rsi]
lea r8, [rbp + 0x48]
add eax, eax
mov r9, rdi
mov dword [rbp + 0x30], eax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.1400046e8
mov ebx, eax
test eax, eax
js 0x140005fe3
mov ecx, dword [rbp + 0x48]
mov edx, r15d
dec ecx
cmp ecx, 1
setbe dl
test edx, edx
jne 0x140005f21
mov ebx, 0x80004005
jmp 0x140005fe3
cmp dword [rbp + 0x30], 2
jbe 0x140005f17
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x140005fe1
lea rax, [rbp + 0x30]
mov dword [rbp + 0x48], r15d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
mov eax, r15d
test ebx, ebx
cmovns eax, dword [rbp + 0x48]
js 0x140005fe3
dec eax
mov ecx, r15d
cmp eax, 1
setbe cl
test ecx, ecx
je 0x140005f17
mov eax, dword [rbp + 0x30]
cmp eax, 2
jbe 0x140005f17
shr eax, 1
jmp 0x140005fe1
lea rdx, str.InfoPath.Document
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140005fe3
test rdi, rdi
je 0x140005fcf
mov edx, dword [rsi]
lea r8, str.InfoPath.Document.1
or r9, 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
cmp eax, 0x50
jne 0x140005fc0
mov ebx, 0x8007007a
jmp 0x140005fe3
lea rcx, str.InfoPath.Document.1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x140005fde
lea rcx, str.InfoPath.Document.1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov ebx, r15d
mov dword [rsi], eax
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14000600b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
mov rax, qword [rbp - 0x10]
test ecx, ecx
cmovns rax, r15
mov qword [rbp - 0x10], rax
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14000601a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x140006038
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x360], rax
xor esi, esi
mov dword [rsp + 0x38], 0x201
mov rdi, r8
mov qword [rsp + 0x40], rsi
mov r8, rcx
mov ecx, esi
mov qword [rsp + 0x30], rcx
test r8, r8
je 0x140006089
mov eax, esi
cmp word [r8], si
jne 0x14000608e
mov eax, 1
test eax, eax
je 0x14000609c
mov ebx, 0x80070057
jmp 0x14000618c
test rdi, rdi
je 0x140006092
mov r9, rdx
mov dword [rdi], esi
mov edx, 2
mov word [rsp + 0x50], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x1e]
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
mov ebx, eax
test eax, eax
js 0x140006187
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140006187
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rcx, [rsp + 0x40]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x140006187
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rsi
lea rdx, str.UseURL
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x3c], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ecx, 0x80070000
cmovle ecx, eax
not ecx
shr ecx, 0x1f
mov dword [rdi], ecx
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400061b5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov rax, qword [rsp + 0x30]
test ecx, ecx
cmovns rax, rsi
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400061c5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.1400070a0
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x470
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006efc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ecx, 1
call fcn.1400074e8
test al, al
je 0x14000704c
xor dil, dil
mov byte [rsp + 0x20], dil
call fcn.1400074ac
mov bl, al
mov ecx, dword [0x14000c6f0]
cmp ecx, 1
je 0x14000705b
test ecx, ecx
jne 0x140006f84
mov dword [0x14000c6f0], 1
lea rdx, [0x140009378]
lea rcx, [0x140009348]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
test eax, eax
je 0x140006f65
mov eax, 0xff
jmp 0x140007041
lea rdx, [0x140009340]
lea rcx, [0x140009330]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x14000c6f0], 2
jmp 0x140006f8c
mov dil, 1
mov byte [rsp + 0x20], dil
mov cl, bl
call fcn.140007664
call fcn.140007800
mov rbx, rax
cmp qword [rax], 0
je 0x140006fbf
mov rcx, rax
call fcn.1400075cc
test al, al
je 0x140006fbf
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [rbx]
call qword [0x140009308]
call fcn.140007808
mov rbx, rax
cmp qword [rax], 0
je 0x140006fe1
mov rcx, rax
call fcn.1400075cc
test al, al
je 0x140006fe1
mov rcx, qword [rbx]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
call fcn.140007964
movzx ebx, ax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
mov r9d, ebx
mov r8, rax
xor edx, edx
lea rcx, [0x140000000]
call section..text
nop
jmp 0x140007006
mov ebx, eax
call fcn.1400079a8
test al, al
je 0x140007061
test dil, dil
jne 0x14000701b
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
xor edx, edx
mov cl, 1
call fcn.140007688
mov eax, ebx
jmp 0x140007041
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 7
call fcn.140007818
nop
jmp 0x14000705a
nop
mov ecx, 7
call fcn.140007818
mov bl, 7
add byte [rax], al
nop
jmp 0x140007068
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub rsp, 0x28
call fcn.140007708
add rsp, 0x28
jmp 0x140006efc

Function at 0x1400079a8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400079f2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400079f2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400079f2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400079f2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400079f2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400079f4
xor al, al
add rsp, 0x28
ret
Function at 0x140007f64
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140007fdc
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140007fdc
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140007fdc
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140007fd0
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140007fee
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140007fbe
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140007fde
Function at 0x100075150
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x100080558], rdi
je 0x1000751b0
cmp rax, rdi
jne 0x1000751a3
mov r12d, 1
jmp 0x1000751b0
mov ecx, 0x3e8
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x100075189
mov eax, dword [0x100080550]
cmp eax, 1
jne 0x1000751c5
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10007522c
mov eax, dword [0x100080550]
cmp eax, ebx
jne 0x100075222
mov dword [0x100080550], 1
lea r13, [0x100001b48]
lea rdi, [0x100001b30]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x100075214
cmp eax, ebx
jne 0x100075214
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x100075209
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1000751f2
cmp eax, ebx
je 0x10007522c
mov eax, 0xff
jmp 0x100075374
mov dword [0x10007f924], 1
mov eax, dword [0x100080550]
cmp eax, 1
jne 0x100075254
lea rdx, [0x100001b28]
lea rcx, [0x100001ab8]
call sub.msvcrt.dll__initterm
mov dword [0x100080550], 2
cmp r12d, ebx
jne 0x100075263
mov rax, rbx
xchg qword [0x100080558], rax
cmp qword [0x100080570], rbx
je 0x10007528b
lea rcx, [0x100080570]
call fcn.1000756ac
cmp eax, ebx
je 0x10007528b
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100080570]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1000752a1
mov eax, 0xff
jmp 0x100075374
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x100075326
cmp word [rcx], bx
je 0x1000752bc
cmp edx, ebx
jne 0x100075326
cmp word [rcx], bx
je 0x1000752d2
cmp word [rcx], 0x20
ja 0x1000752d2
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000752bc
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.1000337b8
mov dword [0x10007f920], eax
cmp dword [0x10007f904], ebx
jne 0x100075310
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10007f924], ebx
jne 0x100075324
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10007f920]
jmp 0x100075374
cmp word [rcx], 0x22
jne 0x100075339
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000752ad
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.1001a9000
add rsp, 0x28
jmp 0x100075150
Function at 0x140002e30
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002e7a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002e7a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002e7a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002e7a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002e7a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002e7c
xor al, al
add rsp, 0x28
ret
Function at 0x140004b90
Capabilities:
Authenticate hmac

Disassembly:
mov rax, qword [rcx + 0x2010]
mov edx, dword [rax + 0x1028]
movzx eax, byte [rcx + 0x3079]
add edx, edx
or edx, eax
add edx, 0xfffffd98
cmp edx, 0xb
ja case.0x140004bc7.617
movsxd rax, edx
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x4c18]
add rcx, rdx
jmp rcx
mov edx, 0x168
mov ecx, 1
jmp 0x140014f98
mov edx, 0x188
mov ecx, 1
jmp 0x140014f98
mov edx, 0x190
mov ecx, 1
jmp 0x140014f98
mov edx, 0x1b0
mov ecx, 1
jmp 0x140014f98
mov edx, 0x1c8
mov ecx, 1
jmp 0x140014f98
xor eax, eax
ret
jmp fcn.1400e56e0
Function at 0x14001775c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14000c8c0
sub rsp, rax
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14001a4ec
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400177ab
mov rax, rbp
jmp 0x1400178b3
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x42a30]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14001c2ec
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x42a30]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400178af
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400178af
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14001c2ec
test rax, rax
js 0x1400178af
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400178af
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400178a1
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400178a1
cmp byte [rcx], 0xd
jne 0x140017887
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140017896
cmp byte [rcx + 1], 0xa
jne 0x140017896
inc rcx
jmp 0x140017896
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x3e350]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140017869
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400178b3
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14000c5c0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140071a93
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0xf685338b
pushf
not eax
add eax, 0x546c83e9
xor eax, 0xc21013
rol eax, 0xfa
popf
pushf
not eax
add eax, 0x70d945fe
xor eax, 0x29fa8183
rol eax, 0x14
popf
pushf
not eax
add eax, 0x57c44036
xor eax, 0x3fd25652
rol eax, 0x56
popf
Function at 0x14008c4b8
Capabilities:
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0xd712244c
pushf
not eax
add eax, 0x2fc5abcf
xor eax, 0xaa9132f
rol eax, 0x4e
popf
pushf
not eax
add eax, 0x10ab927
xor eax, 0x5bdf64a0
rol eax, 0xf7
popf
cmp eax, 0
jne 0x14008c4f5
popf
pop rax
jmp 0x14008c522
cmp eax, 3
jne 0x14008c504
popf
pop rax
jmp 0x14008c7a0
cmp eax, 1
jne 0x14008c513
popf
pop rax
jmp 0x14008c674
cmp eax, 2
jne 0x14008c522
popf
pop rax
jmp 0x14008c730
mov eax, 0x9cd21ce8
pushf
not eax
add eax, 0x56459742
xor eax, 0x65dac9d6
rol eax, 0xb6
popf
pushf
not eax
add eax, 0x751e0740
xor eax, 0x3ea7533a
rol eax, 0x32
popf
pushf
not eax
add eax, 0x7dde5e41
xor eax, 0x5b6c25a4
rol eax, 0xad
popf
pushf
not eax
add eax, 0x38710492
xor eax, 0x47bd33e5
rol eax, 0xc4
popf
call fcn.14009b7ed
sub rsp, rax
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rsp + 0x4020], rax
xor r8d, r8d
xor edx, edx
call fcn.14008fbd5
mov r8d, 0x32ff7f90
pushf
not r8d
add r8d, 0x7fff146a
xor r8d, 0x3386332
rol r8d, 0x70
popf
pushf
not r8d
add r8d, 0xbb8caf7
xor r8d, 0x13cdfb2f
rol r8d, 0xfd
popf
lea rdx, [rsp + 0x20]
mov rcx, rax
jmp 0x14008c5d8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x14008c5df
dec eax
cmp eax, 0xffe
ja 0x14008c62e
push rax
pushf
mov eax, 0x9fb1c27f
pushf
not eax
add eax, 0x4238a14b
xor eax, 0x4a18f9e0
rol eax, 0xd5
popf
pushf
not eax
add eax, 0x2e28e208
xor eax, 0x6cd65217
rol eax, 0xfa
popf
pushf
not eax
add eax, 0x7f91543a
xor eax, 0x2eff55c8
rol eax, 0xd5
popf
jmp 0x14008c4e6
push rax
pushf
mov eax, 0x8f5dacce
pushf
not eax
add eax, 0x1ddb965c
xor eax, 0x61750b36
rol eax, 0x7c
popf
pushf
not eax
add eax, 0xe098332
xor eax, 0x3d28bfc6
rol eax, 0x68
popf
pushf
not eax
add eax, 0x3ad9c7cb
xor eax, 0xa8f0738
rol eax, 0x5b
popf
jmp 0x14008c4e6
mov r8d, 0xb578b3e9
pushf
not r8d
add r8d, 0x13e2161c
xor r8d, 0x447e7e12
rol r8d, 0x57
popf
pushf
not r8d
add r8d, 0x2db416f8
xor r8d, 0x1de70b69
rol r8d, 0x96
popf
lea rdx, [rsp + 0x2020]
lea rcx, [rsp + 0x20]
jmp 0x14008c6ba
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x14008c6c1
dec eax
cmp eax, 0xffe
ja 0x14008c6fd
push rax
pushf
mov eax, 0x7c905b25
pushf
not eax
add eax, 0x2be7c219
xor eax, 0x45a42e1b
rol eax, 0xda
popf
pushf
not eax
add eax, 0x67c683e
xor eax, 0x62d09a1a
rol eax, 0x99
popf
jmp 0x14008c4e6
push rax
pushf
mov eax, 0xb096facf
pushf
not eax
add eax, 0x52222dfb
xor eax, 0x549b0450
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x1c8f715
xor eax, 0x22cbb367
rol eax, 0x3b
popf
jmp 0x14008c4e6
xor r8d, r8d
lea rcx, [rsp + 0x2020]
xor edx, edx
call fcn.14009026d
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140098ae9
add rsp, 0x4038
ret
xor eax, eax
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140098ae9
add rsp, 0x4038
ret
Function at 0x140098716
Capabilities:
Enumerate process modules

Disassembly:
pop r13
pop r12
pop rdi
ret
push rax
pushf
mov eax, 0xda934276
pushf
not eax
add eax, 0x6def1f1
xor eax, 0x5be5f6f5
rol eax, 0x57
popf
pushf
not eax
add eax, 0x22708adb
xor eax, 0x43d8467a
rol eax, 0x4f
popf
pushf
not eax
add eax, 0x39fa7b4
xor eax, 0x2ab077ca
rol eax, 0x50
popf
pushf
not eax
add eax, 0xf73fc18
xor eax, 0x223c5a12
rol eax, 0x48
popf
cmp eax, 0
jne switch.0x14009877a
popf
pop rax
jmp switch.0x14009877a
jmp qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
Function at 0x14009a0ff
Capabilities:
Contain obfuscated stackstrings
Encrypt data using speck
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x3f6d424c
pushf
not eax
add eax, 0x7bc3f481
xor eax, 0x1d7337c6
rol eax, 0xfb
popf
pushf
not eax
add eax, 0x3c74b532
xor eax, 0xb81e89e
rol eax, 0x1d
popf
pushf
not eax
add eax, 0x51186f42
xor eax, 0x1de2b42c
rol eax, 0xd5
popf
pushf
not eax
add eax, 0x505bcaaf
xor eax, 0x6c07a77c
rol eax, 0x2d
popf

Function at 0x1400a42c1
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0xdd9bdb05
pushf
not eax
add eax, 0x2993ed24
xor eax, 0x3a62b5ee
rol eax, 0x5f
popf
pushf
not eax
add eax, 0x59956970
xor eax, 0x20c81577
rol eax, 0x7f
popf
cmp eax, 1
jne 0x1400a42fe
popf
pop rax
jmp 0x1400a43e0
cmp eax, 2
jne 0x1400a430d
popf
pop rax
jmp 0x1400a4448
cmp eax, 0
jne 0x1400a431c
popf
pop rax
jmp 0x1400a431c
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1a6cf9951]
pushf
sub r9, 0x66cc7981
popf
xor ecx, ecx
lea r8, [0x1ba40bb21]
pushf
sub r8, 0x7a3d9b59
popf
lea rdx, [0x1a2a5b10a]
pushf
sub rdx, 0x62a2913a
popf
call fcn.14000dd38
test rax, rax
je 0x1400a43ad
push rax
pushf
mov eax, 0x4645a4c
pushf
not eax
add eax, 0x3150e06b
xor eax, 0x20c063a5
rol eax, 0x3a
popf
pushf
not eax
add eax, 0x77370a75
xor eax, 0x6181fd4e
rol eax, 0x2d
popf
pushf
not eax
add eax, 0x24085a82
xor eax, 0x2e9e3d31
rol eax, 0x4d
popf
jmp 0x1400a42ef
push rax
pushf
mov eax, 0x9280a5bb
pushf
not eax
add eax, 0x401d9267
xor eax, 0x18a6fb4f
rol eax, 0xe0
popf
pushf
not eax
add eax, 0x1a7149ba
xor eax, 0x652731d5
rol eax, 0x6d
popf
jmp 0x1400a42ef
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x14002b4b0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1400a4688
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x31114166
pushf
not eax
add eax, 0x613178ec
xor eax, 0x21edd6de
rol eax, 0x9f
popf
pushf
not eax
add eax, 0x6839ec92
xor eax, 0x3eb8b2ca
rol eax, 0x38
popf
pushf
not eax
add eax, 0x589fcc3
xor eax, 0x6bde15b
rol eax, 0x27
popf
pushf
not eax
add eax, 0x4df90fca
xor eax, 0x42ff7e61
rol eax, 0x51
popf
cmp eax, 1
jne 0x1400a46eb
popf
pop rax
jmp 0x1400a47fb
cmp eax, 0
jne 0x1400a46fa
popf
pop rax
jmp 0x1400a4709
cmp eax, 2
jne 0x1400a4709
popf
pop rax
jmp 0x1400a484d
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x19b529579]
pushf
sub r9, 0x5b4f7581
popf
mov ecx, 0x95b95044
pushf
not ecx
add ecx, 0x25f82d3b
xor ecx, 0x4e47ec59
rol ecx, 0xb6
popf
pushf
not ecx
add ecx, 0x2e230e14
xor ecx, 0x26b6fc7
rol ecx, 0xb
popf
lea r8, [0x1a58a125d]
pushf
sub r8, 0x6586f26d
popf
lea rdx, [0x1be99889e]
pushf
sub rdx, 0x7e9668a6
popf
call fcn.14000dd38
mov ecx, ebx
test rax, rax
je 0x1400a47c8
push rax
pushf
mov eax, 0xd58b16cb
pushf
not eax
add eax, 0x3c9e1bc4
xor eax, 0x71c9fe2c
rol eax, 0xeb
popf
pushf
not eax
add eax, 0x435c77fe
xor eax, 0x2126baef
rol eax, 0x68
popf
pushf
not eax
add eax, 0x1d401616
xor eax, 0x7bd26dcb
rol eax, 0xa7
popf
jmp 0x1400a46dc
push rax
pushf
mov eax, 0x3eb62da4
pushf
not eax
add eax, 0x49da18ae
xor eax, 0xbe9c077
rol eax, 0xc4
popf
pushf
not eax
add eax, 0x13247738
xor eax, 0x481bf57
rol eax, 8
popf
jmp 0x1400a46dc
add rsp, 0x20
pop rbx
jmp qword [0x14002b4b0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]