joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401c1100
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1401c110d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401c111d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401c1105
lea eax, [rcx + 1]
jmp 0x1401c112b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1401c113e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401c1124
sub eax, 3
jb 0x1401c115e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1401c11ad
sar eax, 1
movsxd rbp, eax
jb 0x1401c1194
jmp 0x1401c116c
add ebx, ebx
jne 0x1401c116a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401c1194
inc ecx
add ebx, ebx
jne 0x1401c117a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401c1194
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1401c118d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1401c117c
add ecx, 2
jmp 0x1401c1199
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1401c10c2
jmp 0x1401c110d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xed200
mov dl, 0x17
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401c11fd
cmp rsi, rcx
jae 0x1401c1205
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401c11e4
cmp al, 0x8f
ja 0x1401c11e4
cmp byte [rsi - 2], 0xf
je 0x1401c11ea
sub al, 0xe8
cmp al, 1
ja 0x1401c11ce
cmp rsi, rcx
jae 0x1401c1205
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401c11d4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401c1205
lodsb al, byte [rsi]
jmp 0x1401c11e4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1be000]
mov eax, dword [rdi]
or eax, eax
je 0x1401c1262
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1c3df0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401c1212
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1401c125c
mov qword [rbx], rax
add rbx, 8
jmp 0x1401c1232
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1401c129c
cmp al, 0xef
ja 0x1401c128e
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1401c126e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1401c127d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x217]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.1401c131b], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.1401c131b
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401c130b
sub rsp, 0xffffffffffffff80
jmp 0x1400e9f20
Function at 0x1400041c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000420e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000420e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000420e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000420e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000420e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004210
xor al, al
add rsp, 0x28
ret

Function at 0x1400049d0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004a2c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004a2c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004a2c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004a2c
cmp dword [rcx + 0x84], 0xe
jbe 0x140004a2c
cmp dword [rcx + 0xf8], 0
je 0x140004a2c
mov ecx, ebx
call fcn.140004c40
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x140008d60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.140004dc0
cmp dword [rsp + 0x60], 0
jne 0x140004a6f
mov ecx, ebx
call fcn.140004cc0
int3
add rsp, 0x40
pop rbx
ret

Function at 0x140004a80
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
mov dword [rsp + 0x60], 0
xor ecx, ecx
mov dword [rsp + 0x68], 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004ae2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004ae2
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
jne 0x140004ae2
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x140004ae2
cmp dword [rdx + 0x84], 0xe
jbe 0x140004ae2
cmp dword [rdx + 0xf8], 0
je 0x140004ae2
mov ecx, ebx
call fcn.140004c40
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x140008d60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.140004dc0
cmp dword [rsp + 0x60], 0
jne 0x140004b25
mov ecx, ebx
call fcn.140004cc0
int3
add rsp, 0x40
pop rbx
ret
Function at 0x1400054c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x140008678]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1400054fc
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.140004180
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400055b8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x14000561e
test ebx, ebx
jne 0x14000561e
lea ecx, [rax + 2]
call fcn.140004180
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.140003990
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x140011267
Capabilities:
Terminate process

Disassembly:
jmp 0x1400141a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011302
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x140016ef0
push rbp
push rsi
push rdi
sub rsp, 0x3e0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x90
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x3b8], rax
lea rcx, [0x140025066]
call fcn.140011424
mov dword [rbp + 4], 0
mov ecx, dword [rbp + 4]
call fcn.140011118
mov dword [rbp + 4], eax
mov byte [rbp + 0x24], 0x61
mov byte [rbp + 0x48], 0x61
mov byte [rbp + 0x49], 0x62
mov byte [rbp + 0x4a], 0x63
mov byte [rbp + 0x4b], 0x64
mov byte [rbp + 0x4c], 0x65
mov byte [rbp + 0x4d], 0x66
mov byte [rbp + 0x4e], 0x67
mov byte [rbp + 0x4f], 0x68
mov byte [rbp + 0x50], 0x69
mov byte [rbp + 0x51], 0x6a
mov byte [rbp + 0x52], 0x6b
mov byte [rbp + 0x53], 0x6c
mov byte [rbp + 0x54], 0x6d
mov byte [rbp + 0x55], 0x6e
mov byte [rbp + 0x56], 0x6f
mov byte [rbp + 0x57], 0x70
mov byte [rbp + 0x58], 0x71
mov byte [rbp + 0x59], 0x72
mov byte [rbp + 0x5a], 0x73
mov byte [rbp + 0x5b], 0x74
mov byte [rbp + 0x5c], 0x75
mov byte [rbp + 0x5d], 0x76
mov byte [rbp + 0x5e], 0x77
mov byte [rbp + 0x5f], 0x78
mov byte [rbp + 0x60], 0x79
mov byte [rbp + 0x61], 0x7a
mov dword [rbp + 0xcc], 0
mov dword [rbp + 0x12c], 0
lea r8, [rbp + 0x48]
mov edx, dword [rbp + 4]
lea rcx, [rbp + 0xf0]
call fcn.140011492
lea rax, [rbp + 0x310]
lea rcx, [rbp + 0xf0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x40
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x310]
call fcn.140011226
mov dword [rbp + 0x144], 0
jmp 0x140017014
mov eax, dword [rbp + 0x144]
inc eax
mov dword [rbp + 0x144], eax
cmp dword [rbp + 0x144], 0x1a
jge 0x140017037
movsxd rax, dword [rbp + 0x144]
movzx edx, byte [rbp + rax + 0x48]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001135c
jmp 0x140017006
lea rdx, [0x140011041]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x164], 0
jmp 0x140017065
mov eax, dword [rbp + 0x164]
inc eax
mov dword [rbp + 0x164], eax
cmp dword [rbp + 0x164], 0x1a
jge 0x140017099
movsxd rax, dword [rbp + 0x164]
movsx eax, byte [rbp + rax + 0x48]
cmp eax, 0x30
je 0x140017097
movsxd rax, dword [rbp + 0x164]
movzx edx, byte [rbp + rax + 0x48]
lea rcx, [rbp + 0x90]
call fcn.1400114a1
jmp 0x140017057
lea rax, [rbp + 0x370]
lea rcx, [rbp + 0x90]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x40
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x370]
call fcn.140011497
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001bd70]
call fcn.1400113b6
mov eax, edi
mov rcx, qword [rbp + 0x3b8]
xor rcx, rbp
call fcn.140011217
lea rsp, [rbp + 0x3c0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001130c
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400154f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015510
xor al, al
jmp 0x140015591
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015523
xor al, al
jmp 0x140015591
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001554d
xor al, al
jmp 0x140015591
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015561
xor al, al
jmp 0x140015591
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015573
xor al, al
jmp 0x140015591
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001558f
xor al, al
jmp 0x140015591
mov al, 1
add rsp, 0x38
ret
Function at 0x140001100
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x490
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rbx, rdx
mov rdi, rcx
xor esi, esi
lea rcx, [rsp + 0x270]
xor edx, edx
mov qword [rsp + 0x50], rsi
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], rbx
lea r9, str.SystemCurrentControlSetServices_ws
mov rbx, 0xffffffffffffffff
mov dword [rsp + 0x58], esi
mov r8, rbx
mov dword [rsp + 0x5c], esi
mov edx, 0x104
lea rcx, [rsp + 0x270]
call fcn.140001090
lea rax, str.___
mov qword [rsp + 0x28], rdi
lea r9, [0x140005500]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.140001090
lea rax, [rsp + 0x5c]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x270]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000120b
mov edx, eax
lea rcx, str.SetRegistryValues.RegCreateKeyExA:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140001336
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea rdx, str.Type
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140001251
mov edx, eax
lea rcx, str.SetRegistryValues.RegSetValueEx.Type:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140001336
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea rdx, str.ErrorControl
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140001297
mov edx, eax
lea rcx, str.SetRegistryValues.RegSetValueEx.ErrorControl:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140001336
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea rdx, str.Start
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400012da
mov edx, eax
lea rcx, str.SetRegistryValues.RegSetValueEx.Start:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140001336
lea rax, [rsp + 0x60]
nop
cmp word [rax + rbx*2 + 2], si
lea rbx, [rbx + 1]
jne 0x1400012e0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
lea ebx, [rbx*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], ebx
lea rdx, str.ImagePath
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140001331
mov edx, eax
lea rcx, str.SetRegistryValues.RegSetValueEx.ImagePath:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140001336
mov eax, 1
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140003390
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140001360
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r9, str.SystemCurrentControlSetServices_ws
mov qword [rsp + 0x20], rbx
mov edx, 0x104
lea rcx, [rsp + 0x30]
mov r8, 0xffffffffffffffff
call fcn.140001090
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, 0x100
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
je 0x1400013e3
mov edx, eax
lea rcx, str._OpSec__could_not_remove_service_registry_key:__d_n
call fcn.140001010
xor eax, eax
jmp 0x1400013e8
mov eax, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140003390
add rsp, 0x250
pop rbx
ret
Function at 0x140003190
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push rdi
push r14
sub rsp, 0x58
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rcx
mov dword [rsp + 0x40], 0
xor ecx, ecx
mov edx, 0x3e8
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x1400031ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.FindResource
lea rcx, str._____s:__d_n
call fcn.140001010
xor eax, eax
jmp 0x14000335e
mov rdx, rdi
mov qword [rsp + 0x78], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x140003229
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140006468]
lea rcx, str._____s:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140003359
mov rcx, rbx
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
jne 0x140003262
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140006478]
lea rcx, str._____s:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140003354
mov rdx, rdi
mov qword [rsp + 0x80], rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
jne 0x14000329e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.SizeOfResource
lea rcx, str._____s:__d_n
call fcn.140001010
xor eax, eax
jmp 0x14000334c
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400032f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.WriteResourceToDisk.CreateFile
lea rcx, str._____s:__d_n
call fcn.140001010
xor eax, eax
jmp 0x14000334c
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140003335
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.WriteResourceToDisk.WriteFile
lea rcx, str._____s:__d_n
call fcn.140001010
xor eax, eax
jmp 0x14000334c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
mov rbp, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140003390
add rsp, 0x58
pop r14
pop rdi
ret

Function at 0x140003c50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003c9a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003c9a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003c9a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003c9a
cmp dword [rcx + 0x84], 0xe
jbe 0x140003c9a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003c9c
xor al, al
add rsp, 0x28
ret
Function at 0x141461884
Capabilities:
Encode data using xor

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1414618ad
pop rbp
sub rbp, 0x29
sub rbp, 0x1461884
jmp 0x14146190d
sub rsp, 0x20
jmp 0x14146191d
mov rax, 0x1461884
add rax, rbp
add rax, 0xcb
mov rcx, 0x64a
mov rdx, 0xffffffffe2f8a6b2
xor byte [rax], dl
inc rax
dec rcx
jne 0x14146193c
jmp 0x141461953
cli
cmp ebx, dword [rbx + 0x39]
cmp ecx, dword [rsi - 0x54d4d4e]
xor esi, dword [rbx - 0x46]
mov bl, 0xb2
mov dl, 0xfa
mov bl, 0x5b
cli
jne 0x1414619db
mov esp, 0xfab2b2b2
jne 0x1414619e0
invalid
mov dl, 0xb2
mov dl, 0xfa
mov bl, 0x5b
pop rbx
pop rdx
mov bh, 0xb2
mov dl, 0xb2
pop rbx
invalid
Function at 0x401560
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r14, qword [rcx + 0xb000068]
mov r12, qword [rcx + 0xb000058]
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
lea r13, [rcx + 0xa000054]
movzx ebp, byte [rcx + 0xb000060]
test r14, r14
jne 0x4016d0
test bpl, bpl
mov eax, 0
mov ecx, 0xfffffff5
cmove rax, r12
mov qword [rbx + 0xb000068], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx r14d, word [rsp + 0x28]
call fcn.00422820
test al, al
je 0x4015ef
cmp edi, 2
je 0x401720
cmp edi, 3
je 0x401650
cmp edi, 1
je 0x401650
mov r9, rsi
mov r8d, 1
mov rdx, r12
mov rcx, r13
call sub.msvcrt.dll_fwrite
call fcn.00422820
test al, al
je 0x40162e
cmp edi, 2
mov r15, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
je 0x401753
cmp edi, 3
je 0x401784
cmp edi, 1
je 0x401784
test bpl, bpl
jne 0x40168d
mov rcx, rsi
call sub.msvcrt.dll_fflush
nop
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 6
mov rcx, rbx
mov r15, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call r15
mov r9, rsi
mov r8d, 1
mov rdx, r12
mov rcx, r13
call sub.msvcrt.dll_fwrite
call fcn.00422820
test al, al
je 0x40162e
mov edx, r14d
mov rcx, rbx
call r15
test bpl, bpl
je 0x401633
lea rcx, section..rdata
mov r9, rsi
mov r8d, 1
mov edx, 2
call sub.msvcrt.dll_fwrite
cmp edi, 2
jne 0x401633
lea rcx, section..rdata
mov r9, rsi
mov r8d, 1
mov edx, 2
call sub.msvcrt.dll_fwrite
jmp 0x401633
call fcn.00422820
test al, al
je 0x40159e
mov rdx, rsi
mov ecx, 0xd
xor r15d, r15d
call sub.msvcrt.dll_fputc
nop dword [rax]
mov rdx, rsi
mov ecx, 0x20
add r15, 1
call sub.msvcrt.dll_fputc
cmp r14, r15
jne 0x4016f0
mov rdx, rsi
mov ecx, 0xd
call sub.msvcrt.dll_fputc
jmp 0x40159e
mov edx, 0xc
mov rcx, rbx
mov r15, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call r15
mov r9, rsi
mov r8d, 1
mov rdx, r12
mov rcx, r13
call sub.msvcrt.dll_fwrite
call fcn.00422820
test al, al
je 0x40162e
mov edx, r14d
mov rcx, rbx
call r15
test bpl, bpl
je 0x401633
lea rcx, section..rdata
mov r9, rsi
mov r8d, 1
mov edx, 2
call sub.msvcrt.dll_fwrite
jmp 0x4016ac
mov r15, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, r14d
mov rcx, rbx
call r15
jmp 0x401688

Function at 0x4017a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 0xd8]
mov rbx, rcx
cmp byte [rax + 0x52], 0
jne 0x4017e9
mov rsi, qword [rcx + 0xd0]
mov eax, dword [rsi + 0xc]
sub eax, 2
cmp eax, 1
jbe 0x401800
mov r8d, dword [rdx]
lea rdx, str.Driver_temperature_threshold_met_on_GPU__u._Expect_reduced_performance.
mov rcx, rbx
add r8d, 1
call fcn.004032f0
mov eax, dword [rsi + 0xc]
sub eax, 2
cmp eax, 1
jbe 0x4017f0
add rsp, 0x38
pop rbx
pop rsi
ret
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.004224c0
mov qword [rsp + 0x28], rdx
call fcn.00422540
mov rdx, qword [rsp + 0x28]
jmp 0x4017c8