joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140119060
Capabilities:
Hash data using crc32b

Disassembly:
sub rsp, 0x28
cmp byte [0x14063c2b8], 0
jne 0x14011923f
mov ecx, 0x400
call fcn.1402245bc
xor r9d, r9d
xor r10d, r10d
mov r11, rax
mov qword [0x14063c2c0], rax
nop dword [rax + rax]
xor r8d, r8d
mov edx, r9d
lea ecx, [r8 + 7]
nop word [rax + rax]
test dl, 1
je 0x1401190af
mov eax, 1
shl eax, cl
or r8d, eax
dec ecx
shr edx, 1
cmp ecx, 0xffffffff
jg 0x1401190a0
shl r8d, 0x18
mov dword [r10 + r11], r8d
mov r8, qword [0x14063c2c0]
mov edx, dword [r10 + r8]
mov eax, edx
and eax, 0x80000000
neg eax
lea eax, [rdx + rdx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov dword [r10 + r8], ecx
mov r8, qword [0x14063c2c0]
mov edx, dword [r10 + r8]
mov eax, edx
and eax, 0x80000000
neg eax
lea eax, [rdx + rdx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov dword [r10 + r8], ecx
mov r8, qword [0x14063c2c0]
mov edx, dword [r10 + r8]
mov eax, edx
and eax, 0x80000000
neg eax
lea eax, [rdx + rdx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov dword [r10 + r8], ecx
mov r8, qword [0x14063c2c0]
mov edx, dword [r10 + r8]
mov eax, edx
and eax, 0x80000000
neg eax
lea eax, [rdx + rdx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov dword [r10 + r8], ecx
mov r8, qword [0x14063c2c0]
mov edx, dword [r10 + r8]
mov eax, edx
and eax, 0x80000000
neg eax
lea eax, [rdx + rdx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov dword [r10 + r8], ecx
mov r8, qword [0x14063c2c0]
mov edx, dword [r10 + r8]
mov eax, edx
and eax, 0x80000000
neg eax
lea eax, [rdx + rdx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov dword [r10 + r8], ecx
mov r8, qword [0x14063c2c0]
mov edx, dword [r10 + r8]
mov eax, edx
and eax, 0x80000000
neg eax
lea eax, [rdx + rdx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov dword [r10 + r8], ecx
mov r8, qword [0x14063c2c0]
mov edx, dword [r10 + r8]
mov eax, edx
and eax, 0x80000000
neg eax
lea eax, [rdx + rdx]
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
mov dword [r10 + r8], ecx
mov r11, qword [0x14063c2c0]
xor r8d, r8d
mov edx, dword [r10 + r11]
lea ecx, [r8 + 0x1f]
nop word [rax + rax]
test dl, 1
je 0x14011920f
mov eax, 1
shl eax, cl
or r8d, eax
dec ecx
shr edx, 1
cmp ecx, 0xffffffff
jg 0x140119200
inc r9d
mov dword [r10 + r11], r8d
add r10, 4
cmp r9d, 0xff
ja 0x140119238
mov r11, qword [0x14063c2c0]
jmp 0x140119090
mov byte [0x14063c2b8], 1
add rsp, 0x28
ret
Function at 0x140119280
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x430
mov rax, qword [0x140634590]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbp, r8
mov edi, edx
mov rsi, rcx
test edx, edx
jne 0x1401192b0
xor eax, eax
jmp 0x140119407
mov qword [rsp + 0x458], rbx
call fcn.140119060
or ebx, 0xffffffff
test rbp, rbp
jne 0x1401192ef
mov rdx, qword [0x14063c2c0]
nop dword [rax]
movzx eax, byte [rsi]
movzx ecx, bl
inc rsi
xor rcx, rax
mov eax, ebx
mov ebx, dword [rdx + rcx*4]
shr eax, 8
xor ebx, eax
dec edi
jne 0x1401192d0
jmp 0x1401193fb
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x400
call fcn.140361a80
mov r11, qword [0x14063c2c0]
nop dword [rax + rax]
movzx edx, byte [rsi]
movzx ecx, bl
mov eax, ebx
inc dword [rsp + rdx*4 + 0x20]
xor rcx, rdx
shr eax, 8
mov ebx, dword [r11 + rcx*4]
inc rsi
xor ebx, eax
dec edi
jne 0x140119310
mov r9d, dword [rsp + 0x20]
xor r11d, r11d
mov eax, 7
add r9d, dword [rsp + 0x24]
mov r10d, r11d
mov ecx, r11d
add r9d, dword [rsp + 0x28]
mov edx, r11d
mov edi, 0x7f
add r9d, dword [rsp + 0x2c]
add r9d, dword [rsp + 0x30]
add r9d, dword [rsp + 0x34]
add r9d, dword [rsp + 0x38]
nop dword [rax + rax]
add ecx, dword [rsp + rax*4 + 0x20]
add edx, dword [rsp + rax*4 + 0x24]
add rax, 2
cmp rax, rdi
jl 0x140119370
cmp rax, 0x80
jge 0x140119393
mov r10d, dword [rsp + rax*4 + 0x20]
mov edi, 0x80
lea eax, [rdx + rcx]
movsxd rcx, edi
mov r8d, r11d
add r10d, eax
mov edx, r11d
cmp rcx, 0x100
jge 0x1401193eb
mov eax, 0x100
sub rax, rcx
cmp rax, 2
jl 0x1401193d6
nop dword [rax]
add edx, dword [rsp + rcx*4 + 0x20]
add r8d, dword [rsp + rcx*4 + 0x24]
add rcx, 2
cmp rcx, 0xff
jl 0x1401193c0
cmp rcx, 0x100
jge 0x1401193e4
add r9d, dword [rsp + rcx*4 + 0x20]
lea ecx, [r8 + rdx]
add r9d, ecx
shr r10d, 2
cmp r9d, r10d
seta r11b
mov word [rbp], r11w
not ebx
mov eax, ebx
mov rbx, qword [rsp + 0x458]
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.140360fe0
add rsp, 0x430
pop rdi
pop rsi
pop rbp
ret
Function at 0x14011bd70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r11d, r11d
mov edi, edx
mov esi, ecx
mov ebx, r11d
nop dword [rax]
test ebx, ebx
mov eax, edi
cmovne eax, esi
xor r11d, eax
mov edx, r11d
shr edx, 0x18
mov r9d, edx
movzx eax, dl
and al, 0x80
neg al
lea eax, [rdx + rdx]
sbb ecx, ecx
and dl, 1
and ecx, 0x14d
xor ecx, eax
neg dl
mov eax, r9d
movzx r8d, cl
sbb ecx, ecx
shr eax, 1
and ecx, 0xa6
xor ecx, eax
xor ecx, r8d
mov r10d, ecx
shl r10d, 8
xor r10d, r8d
shl r10d, 8
xor r10d, ecx
xor r10d, r11d
shl r10d, 8
xor r10d, r9d
mov edx, r10d
shr edx, 0x18
mov r9d, edx
movzx eax, dl
and al, 0x80
neg al
lea eax, [rdx + rdx]
sbb ecx, ecx
and dl, 1
and ecx, 0x14d
xor ecx, eax
neg dl
mov eax, r9d
movzx r8d, cl
sbb ecx, ecx
shr eax, 1
and ecx, 0xa6
xor ecx, eax
xor ecx, r8d
mov r11d, ecx
shl r11d, 8
xor r11d, r8d
shl r11d, 8
xor r11d, ecx
xor r11d, r10d
shl r11d, 8
xor r11d, r9d
mov edx, r11d
shr edx, 0x18
movzx eax, dl
mov r9d, edx
and al, 0x80
neg al
lea eax, [rdx + rdx]
sbb ecx, ecx
and dl, 1
and ecx, 0x14d
xor ecx, eax
neg dl
mov eax, r9d
movzx r8d, cl
sbb ecx, ecx
shr eax, 1
and ecx, 0xa6
xor ecx, eax
xor ecx, r8d
mov r10d, ecx
shl r10d, 8
xor r10d, r8d
shl r10d, 8
xor r10d, ecx
xor r10d, r11d
shl r10d, 8
xor r10d, r9d
mov edx, r10d
shr edx, 0x18
movzx eax, dl
mov r9d, edx
and al, 0x80
neg al
lea eax, [rdx + rdx]
sbb ecx, ecx
and dl, 1
and ecx, 0x14d
xor ecx, eax
neg dl
mov eax, r9d
movzx r8d, cl
sbb ecx, ecx
shr eax, 1
and ecx, 0xa6
inc ebx
xor ecx, eax
xor ecx, r8d
mov r11d, ecx
shl r11d, 8
xor r11d, r8d
shl r11d, 8
xor r11d, ecx
xor r11d, r10d
shl r11d, 8
xor r11d, r9d
cmp ebx, 2
jl 0x14011bd90
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov eax, r11d
ret
Function at 0x14015f080
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx + 0x10], 0x12345678
mov dword [rcx + 0x14], 0x23456789
mov dword [rcx + 0x18], 0x34567890
add rcx, 0x20
xor esi, esi
call fcn.140067c00
test eax, eax
jle 0x14015f128
mov qword [rsp + 0x30], rbp
lea rbp, [0x14062a6a0]
lea rcx, [rbx + 0x20]
mov edx, esi
call fcn.14006a190
mov edx, dword [rbx + 0x10]
inc esi
movsx ecx, al
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbp + rax*4]
xor ecx, edx
mov edx, dword [rbx + 0x18]
movzx eax, cl
mov dword [rbx + 0x10], ecx
add eax, dword [rbx + 0x14]
imul eax, eax, 0x8088405
inc eax
mov ecx, eax
mov dword [rbx + 0x14], eax
mov eax, edx
shr ecx, 0x18
shr edx, 8
xor rcx, rax
movzx eax, cl
lea rcx, [rbx + 0x20]
mov eax, dword [rbp + rax*4]
xor eax, edx
mov dword [rbx + 0x18], eax
call fcn.140067c00
cmp esi, eax
jl 0x14015f0c2
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14015f4e0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
sub rsp, 8
mov r11, rdx
mov r10, rcx
test r8d, r8d
je 0x14015f58f
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdi
lea rdi, [0x14062a6a0]
mov ebx, r8d
nop word [rax + rax]
movsx ecx, byte [r11]
mov r8d, dword [r10 + 0x18]
mov edx, dword [r10 + 0x10]
mov eax, edx
shr edx, 8
mov r9d, r8d
xor rcx, rax
and r9d, 0xfffd
inc r11
movzx eax, cl
or r9d, 2
mov ecx, dword [rdi + rax*4]
xor ecx, edx
movzx eax, cl
mov dword [r10 + 0x10], ecx
add eax, dword [r10 + 0x14]
imul eax, eax, 0x8088405
inc eax
mov ecx, eax
mov dword [r10 + 0x14], eax
mov eax, r8d
shr ecx, 0x18
shr r8d, 8
xor rcx, rax
movzx eax, cl
mov eax, dword [rdi + rax*4]
xor eax, r8d
mov dword [r10 + 0x18], eax
mov eax, r9d
xor eax, 1
imul eax, r9d
sar eax, 8
xor byte [r11 - 1], al
dec rbx
jne 0x14015f510
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
add rsp, 8
ret
Function at 0x14015f5a0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov ebp, edx
mov rdx, r9
mov rsi, r8
mov rbx, rcx
call fcn.14015f080
xor edi, edi
lea r12, [0x14062a6a0]
call fcn.14036427c
mov r8d, dword [rbx + 0x18]
mov edx, dword [rbx + 0x10]
mov ecx, eax
movzx eax, al
mov r9d, r8d
sar ecx, 6
test cl, cl
movzx r10d, cl
cmove r10d, eax
mov eax, edx
shr edx, 8
and r9d, 0xfffd
movsx ecx, r10b
inc rdi
xor rcx, rax
or r9d, 2
movzx eax, cl
mov ecx, dword [r12 + rax*4]
xor ecx, edx
movzx eax, cl
mov dword [rbx + 0x10], ecx
add eax, dword [rbx + 0x14]
imul eax, eax, 0x8088405
inc eax
mov ecx, eax
mov dword [rbx + 0x14], eax
mov eax, r8d
shr ecx, 0x18
shr r8d, 8
xor rcx, rax
movzx eax, cl
mov eax, dword [r12 + rax*4]
xor eax, r8d
mov dword [rbx + 0x18], eax
mov eax, r9d
xor eax, 1
imul eax, r9d
sar eax, 8
xor al, r10b
mov byte [rdi + rsi - 1], al
cmp rdi, 0xa
jl 0x14015f5d3
mov r8d, dword [rbx + 0x18]
mov edx, dword [rbx + 0x10]
mov rdi, qword [rsp + 0x48]
mov eax, edx
shr edx, 8
mov r10d, ebp
sar r10d, 0x10
mov r9d, r8d
sar ebp, 0x18
and r9d, 0xfffd
movsx ecx, r10b
xor rcx, rax
or r9d, 2
movzx eax, cl
mov ecx, dword [r12 + rax*4]
xor ecx, edx
mov dword [rbx + 0x10], ecx
movzx eax, cl
add eax, dword [rbx + 0x14]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x14], eax
mov ecx, eax
mov eax, r8d
shr ecx, 0x18
shr r8d, 8
xor rcx, rax
movzx eax, cl
movsx ecx, bpl
mov eax, dword [r12 + rax*4]
xor eax, r8d
mov dword [rbx + 0x18], eax
mov eax, r9d
xor eax, 1
imul eax, r9d
sar eax, 8
xor al, r10b
mov byte [rsi + 0xa], al
mov r8d, dword [rbx + 0x18]
mov edx, dword [rbx + 0x10]
mov eax, edx
shr edx, 8
mov r9d, r8d
xor rcx, rax
and r9d, 0xfffd
movzx eax, cl
or r9d, 2
mov ecx, dword [r12 + rax*4]
xor ecx, edx
mov dword [rbx + 0x10], ecx
movzx eax, cl
add eax, dword [rbx + 0x14]
imul eax, eax, 0x8088405
inc eax
mov ecx, eax
mov dword [rbx + 0x14], eax
mov eax, r8d
shr ecx, 0x18
shr r8d, 8
xor rcx, rax
movzx eax, cl
mov eax, dword [r12 + rax*4]
xor eax, r8d
mov dword [rbx + 0x18], eax
mov rbx, qword [rsp + 0x30]
mov eax, r9d
xor eax, 1
imul eax, r9d
sar eax, 8
xor al, bpl
mov rbp, qword [rsp + 0x38]
mov byte [rsi + 0xb], al
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r12
ret
Function at 0x140161160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [r8 + 0xa8]
mov rdi, r8
mov esi, edx
mov rbp, rcx
cmp eax, 0xffffffff
je 0x14016120a
mov qword [rsp + 0x30], rbx
cmp eax, 0x40
jbe 0x1401611a7
lea rcx, [r8 + 0x40]
mov rdx, r8
call fcn.1400d3ae0
mov dword [rdi + 0xa8], socket
mov ecx, dword [rdi + 0xa8]
mov r8d, 0x40
xor edx, edx
sub r8d, ecx
add rcx, rdi
call fcn.140361a80
mov r11, rdi
mov eax, reloc.WS2_32.dll_recv
nop dword [rax + rax]
xor dword [r11], 0x36363636
add r11, 4
dec rax
jne 0x1401611d0
lea rcx, [rdi + 0x40]
call fcn.1400d2e00
lea rcx, [rdi + 0x40]
mov r8d, 0x40
mov rdx, rdi
call fcn.1400d32f0
mov rbx, qword [rsp + 0x30]
mov dword [rdi + 0xa8], 0xffffffff
test esi, esi
je 0x14016121d
lea rcx, [rdi + 0x40]
mov r8d, esi
mov rdx, rbp
call fcn.1400d32f0
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140161230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140634590]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp dword [r8 + 0xa8], 0xffffffff
mov rbx, r8
mov edi, edx
mov rbp, rcx
je 0x140161266
xor edx, edx
xor ecx, ecx
call fcn.140161160
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x40]
call fcn.1400d3ae0
mov r11, rbx
mov eax, reloc.WS2_32.dll_recv
nop dword [rax]
xor dword [r11], 0x6a6a6a6a
add r11, 4
dec rax
jne 0x140161280
lea rcx, [rbx + 0x40]
call fcn.1400d2e00
lea rcx, [rbx + 0x40]
mov r8d, 0x40
mov rdx, rbx
call fcn.1400d32f0
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x40]
mov r8d, socket
call fcn.1400d32f0
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x40]
call fcn.1400d3ae0
test edi, edi
je 0x1401612e1
lea rdx, [rsp + 0x20]
mov r8, rdi
mov rcx, rbp
call fcn.14035fcd0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140360fe0
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140186700
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov ebp, r9d
mov rdi, r8
mov rbx, rdx
xor r12d, r12d
mov dword [rax - 0x58], r12d
cmp byte [rcx + 0xa0], r12b
je 0x140186763
mov qword [rdx + 0x18], 7
mov qword [rdx + 0x10], r12
mov word [rdx], r12w
lea r8d, [r12 + 0x26]
lea rdx, str.RegistryW::CreateValue:_read_only_mode
mov rcx, rbx
call fcn.140002220
nop
jmp 0x14018686f
lea rsi, [rcx + 0x38]
mov rcx, rsi
call fcn.14019f0c0
test al, al
jne 0x14018679e
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
mov r8d, gethostbyname
lea rdx, str.CRegistryW::CreateValue_failed_to_get_key_handle_
mov rcx, rbx
call fcn.140002220
nop
jmp 0x14018686f
cmp qword [rdi + 0x18], 8
jb 0x1401867a8
mov rdi, qword [rdi]
mov rcx, rsi
call fcn.14005c830
mov rcx, rax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, ebp
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
je 0x14018684c
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r12
mov word [rsp + 0x40], r12w
mov r8d, 0x36
lea rdx, str.CRegistryW::CreateValue:_Failed_to_call_RegSetValueExW
lea rcx, [rsp + 0x40]
call fcn.140002220
nop
mov r8d, edi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14019e810
mov dword [rsp + 0x30], 1
cmp qword [rsp + 0x58], 8
jb 0x140186836
mov rcx, qword [rsp + 0x40]
call fcn.140224608
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r12
mov word [rsp + 0x40], r12w
jmp 0x140186877
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
xor r8d, r8d
lea rdx, [0x1405369f8]
mov rcx, rbx
call fcn.140002220
nop
mov dword [rsp + 0x30], 1
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140362090
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1403620a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1403620aa
xor eax, eax
test eax, eax
je 0x1403620ba
mov ecx, eax
call fcn.140366620
or eax, 0xffffffff
jmp 0x1403620bc
xor eax, eax
add rsp, 0x28
ret

Function at 0x1403651e0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140365050

Function at 0x14036dd37
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140634590]
jne 0x140360ffa
rol rcx, 0x10
test cx, 0xffff
jne 0x140360ff6
repz ret
ror rcx, 0x10
jmp 0x14036dc90
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14064cdc0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14064ceb8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14036dd15
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14064cdc0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14036dd37
mov rax, qword [rsp + 0x88]
mov qword [0x14064ceb8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14064ce58], rax
mov rax, qword [0x14064ceb8]
mov qword [0x14064cd30], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14064ce40], rax
mov dword [0x14064cd20], 0xc0000409
mov dword [0x14064cd24], 1
mov rax, qword [0x140634590]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140634598]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14064cdb8], eax
mov ecx, 1
call fcn.14037da90
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14052f218]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14064cdb8], 0
jne 0x14036ddbe
mov ecx, 1
call fcn.14037da90
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14037fe44
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140634590]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14036b36c
xor ebx, ebx
cmp qword [0x14064dda8], rbx
mov rdi, rax
jne 0x14037ff57
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14038002e
lea rdx, [0x140532068]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14038002e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x140532058]
mov rcx, rsi
mov qword [0x14064dda8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x140532040]
mov rcx, rsi
mov qword [0x14064ddb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14064ddb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14064ddc8], rax
test rax, rax
je 0x14037ff4e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14064ddc0], rax
jmp 0x14037ff5e
mov rax, qword [0x14064ddc0]
jmp 0x14037ff65
mov rax, qword [0x14064ddc0]
mov r11, qword [0x14064ddc8]
cmp rax, rdi
je 0x14037ffcc
cmp r11, rdi
je 0x14037ffcc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14064ddc8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14037ffcc
test rax, rax
je 0x14037ffcc
call rsi
test rax, rax
je 0x14037ffc6
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14037ffc6
test byte [rsp + 0x40], 1
jne 0x14037ffcc
bts ebp, 0x15
jmp 0x14038000c
mov rcx, qword [0x14064ddb0]
cmp rcx, rdi
je 0x14038000c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14038000c
call rax
mov rbx, rax
test rax, rax
je 0x14038000c
mov rcx, qword [0x14064ddb8]
cmp rcx, rdi
je 0x14038000c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14038000c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14064dda8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14038002e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140380030
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140360fe0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140006da0
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp byte [rcx], 0x26
jne 0x140006e59
mov rsi, rdx
add rcx, 1
lea rdx, [0x140103c69]
lea r8, [rsp + 0x38]
lea r9, [rsp + 0x34]
call fcn.140006e80
cmp eax, 2
jne 0x140006e59
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x140006e50
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x58], 0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x60], rdx
mov rcx, rsi
call fcn.1400423d0
test al, al
je 0x140006e71
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
setne sil
jmp 0x140006e5b
xor esi, esi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400ba340
mov eax, esi
add rsp, 0x78
pop rdi
pop rsi
ret
lea rcx, str.Serialised_configuration_data_was_invalid
call fcn.140006000
int3
Function at 0x1400229f0
Capabilities:
Hide graphical window

Disassembly:
push rsi
sub rsp, 0x30
mov rcx, qword [0x14012af18]
mov qword [rsp + 0x20], 0
lea r9, [fcn.140022a40]
mov edx, 0x6f
xor r8d, r8d
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov rsi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov rcx, rsi
add rsp, 0x30
pop rsi
jmp qword [sym.imp.USER32.dll_DestroyWindow]

Function at 0x14002cb00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov rbx, rdx
mov edi, ecx
cmp qword [0x14012d520], 0
jne 0x14002cb4d
lea rcx, [0x14002cd60]
call fcn.140044a20
mov qword [0x14012d520], rax
lea rcx, [0x14002cdc0]
call fcn.140044a20
mov qword [0x14012d528], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012d518], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012d518], eax
test edi, edi
mov esi, 1
cmovne esi, edi
add esi, eax
mov ecx, 1
mov edx, 0x18
xor r8d, r8d
call fcn.1400434f0
mov rdi, rax
mov qword [rax], rbx
mov qword [rax + 8], r14
mov dword [rax + 0x10], esi
mov eax, dword [0x14012d518]
mov dword [rdi + 0x14], eax
mov rcx, qword [0x14012d520]
mov rdx, rdi
call fcn.140044b00
cmp rdi, rax
je 0x14002cbab
mov rcx, rdi
call fcn.140043590
jmp 0x14002cbbb
mov rdx, qword [rdi + 8]
mov rcx, qword [0x14012d528]
call fcn.140044b00
mov rcx, qword [0x14012d520]
xor edx, edx
call fcn.140045270
cmp rax, rdi
jne 0x14002cbd6
mov ecx, dword [rdi + 0x10]
call fcn.140007000
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140030520
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2a8
mov r14, rcx
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov edx, 0x107
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov rcx, rdi
call fcn.1400cffd0
mov word [rsp + rax + 0x50], 0x2a5c
mov byte [rsp + rax + 0x52], 0
lea rdx, [rsp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x1400305c0
mov rdi, rax
lea rbx, [rsp + 0x160]
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileA]
nop word cs:[rax + rax]
nop dword [rax + rax]
mov rcx, rbx
mov edx, 0x140
call r14
mov rcx, rdi
mov rdx, rbx
call rsi
test eax, eax
jne 0x1400305a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
mov edx, 4
call r14
lea rcx, [rsp + 0x30]
mov edx, 0x20
call fcn.1400303d0
test al, al
je 0x140030607
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov edx, 0x20
call r14
mov edx, 0x20
mov rcx, rdi
call fcn.140078e50
mov rcx, r14
call fcn.14003d990
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400ba340
nop
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop r14
ret