joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002eec8
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, r9
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
test r9, r9
je 0x14002eef1
and dword [r9], 0
and qword [rsp + 0x70], 0
lea r8, [rsp + 0x70]
mov edx, 0x1001
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileW]
test eax, eax
je 0x14002ef25
lea rdx, str.open_file_failed
mov r8d, recvfrom
mov rcx, rsi
call fcn.1400043ec
jmp 0x14002ef86
and qword [rsp + 0x30], 0
mov rdx, qword [rsp + 0x70]
and qword [rsp + 0x28], 0
and dword [rsp + 0x68], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8, rsi
mov rcx, rbp
call fcn.14002e9e4
mov sil, al
test rbx, rbx
je 0x14002ef5f
mov ecx, dword [rsp + 0x68]
mov dword [rbx], ecx
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx]
call qword [rdx + recvfrom]
test sil, sil
je 0x14002ef7d
cmp dword [rsp + 0x68], 0xc8
jne 0x14002ef7d
mov al, 1
jmp 0x14002ef88
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14002efa0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x14007e090]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rsi, r8
mov rbp, rdx
mov r12, rcx
xor r13d, r13d
mov edi, r13d
mov dword [rsp + 0x20], r13d
mov rcx, r8
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea r14d, [r13 + 0xf]
or r15, 0xffffffffffffffff
cmp eax, r13d
jne 0x14002f067
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r13
mov byte [rsp + 0x30], r13b
xor eax, eax
mov rcx, r15
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.1400043ec
nop
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.140001208
lea edi, [r13 + 3]
cmp qword [rax + 0x20], 8
jb 0x14002f054
mov rcx, qword [rax + 8]
jmp 0x14002f058
lea rcx, [rax + 8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, r13d
jne 0x14002f067
mov bl, 1
jmp 0x14002f06a
mov bl, r13b
test dil, 2
je 0x14002f099
and edi, 0xfffffffd
cmp qword [rsp + 0x70], 8
jb 0x14002f085
mov rcx, qword [rsp + 0x58]
call fcn.140042a98
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r13
mov word [rsp + 0x58], r13w
test dil, 1
je 0x14002f0b1
cmp qword [rsp + 0x48], 0x10
jb 0x14002f0b1
mov rcx, qword [rsp + 0x30]
call fcn.140042a98
cmp bl, r13b
je 0x14002f0bd
xor al, al
jmp 0x14002f171
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xa0], r13
mov byte [rsp + 0x90], r13b
mov qword [rsp + 0xd0], r14
mov qword [rsp + 0xc8], r13
mov byte [rsp + 0xb8], r13b
mov qword [rsp + 0xf8], r14
mov qword [rsp + 0xf0], r13
mov byte [rsp + 0xe0], r13b
xor eax, eax
mov rcx, r15
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x88]
call fcn.1400043ec
mov byte [rsp + 0x80], 1
xor eax, eax
mov rcx, r15
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0xd8]
call fcn.1400043ec
lea rcx, [r12 + 0x58]
lea rdx, [rsp + 0x80]
call fcn.1400303b4
nop
lea rcx, [rsp + 0x80]
call fcn.14002f3a0
mov al, 1
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140042a40
mov rbx, qword [rsp + 0x178]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140031ffc
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x14007e090]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
mov qword [r11 - 0x30], rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
mov dword [rsp + 0x20], ebx
lea r8, [0x140083900]
lea rdx, str._hs__d._d
lea rcx, [rsp + 0x38]
call fcn.140013c28
nop
xor ebx, ebx
cmp edi, ebx
je 0x1400320d4
lea r9, [rsi + 8]
mov r8, rbp
lea rdx, str.dispatching_message__hs_to__hs
lea rcx, [rsp + 0x60]
call fcn.140013c28
lea r9, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae r9, qword [rsp + 0x68]
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
mov dword [rsp + 0x20], ebx
lea rdx, [0x140083a10]
mov rcx, 0xffffffff80000002
call fcn.140013dc8
cmp qword [rsp + 0x80], 8
jb 0x1400320fa
mov rcx, qword [rsp + 0x68]
call fcn.140042a98
jmp 0x1400320fa
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
lea rdx, [0x140083a10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
nop
cmp qword [rsp + 0x58], 8
jb 0x14003210c
mov rcx, qword [rsp + 0x40]
call fcn.140042a98
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
lea rcx, [rsi + 0x110]
call fcn.14000d2a4
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140042a40
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400358c4
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x14007e090]
xor rax, rsp
mov qword [rsp + 0xa8], rax
and dword [rsp + 0x20], 0
and dword [rsp + 0x48], 0
and dword [rsp + 0x44], 0
mov rbx, rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
mov dword [rsp + 0x40], 0xc3d2e1f0
call fcn.14003dae4
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x90]
call fcn.14003dba0
and qword [rbx + 0x18], 0
mov qword [rbx + 0x20], recvfrom
lea rdx, [rsp + 0x90]
mov r8d, socket
mov rcx, rbx
mov byte [rbx + 8], 0
call fcn.1400043ec
mov rax, rbx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140042a40
add rsp, 0xb0
pop rbx
ret

Function at 0x140035b94
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha1

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x178
mov rax, qword [0x14007e090]
xor rax, rsp
mov qword [rsp + 0x160], rax
and dword [rsp + 0x20], 0
mov rsi, rdx
xor edx, edx
mov ebp, r8d
mov rdi, rcx
lea r8d, [rdx + 0x3f]
lea rcx, [rsp + 0x31]
mov rbx, r9
mov byte [rsp + 0x30], 0
call fcn.1400452b0
mov rax, qword [rbx]
xor edx, edx
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 8]
lea r9d, [rdx + 0x40]
mov qword [rsp + 0x38], rax
mov r8, r9
mov cl, byte [rsp + rdx + 0x30]
inc rdx
mov al, cl
xor cl, 0x5c
xor al, 0x36
sub r8, 1
mov byte [rsp + rdx + 0x11f], cl
mov byte [rsp + rdx + 0x8f], al
jne 0x140035bf2
and dword [rsp + 0x48], r8d
and dword [rsp + 0x44], r8d
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
mov ebx, 0xc3d2e1f0
mov r8d, r9d
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
mov dword [rsp + 0x40], ebx
call fcn.14003dae4
lea rcx, [rsp + 0x30]
mov r8d, ebp
mov rdx, rsi
call fcn.14003dae4
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x108]
call fcn.14003dba0
xor esi, esi
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x90]
lea r8d, [rsi + 0x40]
mov dword [rsp + 0x90], 0x67452301
mov dword [rsp + 0x94], 0xefcdab89
mov dword [rsp + 0x98], 0x98badcfe
mov dword [rsp + 0x9c], 0x10325476
mov dword [rsp + 0xa0], ebx
mov dword [rsp + 0xa8], esi
mov dword [rsp + 0xa4], esi
call fcn.14003dae4
lea ebx, [rsi + 0x14]
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x90]
mov r8d, ebx
call fcn.14003dae4
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xf0]
call fcn.14003dba0
mov qword [rdi + 0x20], recvfrom
mov qword [rdi + 0x18], rsi
lea rdx, [rsp + 0xf0]
mov r8, rbx
mov rcx, rdi
mov byte [rdi + 8], sil
call fcn.1400043ec
mov rax, rdi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140042a40
add rsp, 0x178
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140035d4c
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha256

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x178
mov rax, qword [0x14007e090]
xor rax, rsp
mov qword [rsp + 0x160], rax
and dword [rsp + 0x20], 0
mov rsi, rdx
xor edx, edx
mov ebp, r8d
mov rdi, rcx
lea r8d, [rdx + 0x3f]
lea rcx, [rsp + 0xa1]
mov rbx, r9
mov byte [rsp + 0xa0], 0
call fcn.1400452b0
mov r8d, dword [rsp + 0x1c0]
lea rcx, [rsp + 0xa0]
mov rdx, rbx
call fcn.140044e20
xor r11d, r11d
lea r8d, [r11 + 0x40]
mov rdx, r8
mov cl, byte [rsp + r11 + 0xa0]
inc r11
mov al, cl
xor cl, 0x5c
xor al, 0x36
sub rdx, 1
mov byte [rsp + r11 + 0x11f], cl
mov byte [rsp + r11 + 0xdf], al
jne 0x140035db8
and dword [rsp + 0x70], edx
and qword [rsp + 0x78], rdx
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xe0]
mov ebx, 0x5be0cd19
mov dword [rsp + 0x80], 0x6a09e667
mov dword [rsp + 0x84], 0xbb67ae85
mov dword [rsp + 0x88], 0x3c6ef372
mov dword [rsp + 0x8c], 0xa54ff53a
mov dword [rsp + 0x90], 0x510e527f
mov dword [rsp + 0x94], 0x9b05688c
mov dword [rsp + 0x98], 0x1f83d9ab
mov dword [rsp + 0x9c], ebx
call fcn.14003de98
lea rcx, [rsp + 0x30]
mov r8d, ebp
mov rdx, rsi
call fcn.14003de98
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.14003def8
xor esi, esi
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x30]
lea r8d, [rsi + 0x40]
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], rsi
mov dword [rsp + 0x80], 0x6a09e667
mov dword [rsp + 0x84], 0xbb67ae85
mov dword [rsp + 0x88], 0x3c6ef372
mov dword [rsp + 0x8c], 0xa54ff53a
mov dword [rsp + 0x90], 0x510e527f
mov dword [rsp + 0x94], 0x9b05688c
mov dword [rsp + 0x98], 0x1f83d9ab
mov dword [rsp + 0x9c], ebx
call fcn.14003de98
lea ebx, [rsi + 0x20]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x30]
mov r8d, ebx
call fcn.14003de98
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.14003def8
mov qword [rdi + 0x20], recvfrom
mov qword [rdi + 0x18], rsi
lea rdx, [rsp + 0xa0]
mov r8, rbx
mov rcx, rdi
mov byte [rdi + 8], sil
call fcn.1400043ec
mov rax, rdi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140042a40
add rsp, 0x178
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140036710
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor eax, eax
xor esi, esi
mov rbp, r8
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov eax, dword [rcx + 0x10]
shl eax, 2
mov r10, rdx
mov rbx, rcx
cmp eax, esi
mov r9d, esi
jle 0x14003677e
mov eax, r9d
inc r9d
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [r10]
inc r10
mov byte [rcx + rdx*4], al
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp r9d, eax
jl 0x14003674a
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.140036884
mov edi, dword [rbx + 0x18]
lea r14, [0x14007fff0]
jmp 0x1400367d9
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x140036798
add r11, 4
sub r8, 1
jne 0x140036795
mov edx, edi
mov rcx, rbx
call fcn.140036884
mov rcx, rbx
call fcn.1400369c4
mov rcx, rbx
dec edi
call fcn.14003693c
cmp edi, 1
mov r11, rbx
mov r8d, 4
jge 0x140036795
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x1400367f4
add r11, 4
sub r8, 1
jne 0x1400367f1
xor edx, edx
mov rcx, rbx
call fcn.140036884
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp eax, esi
jle 0x140036868
mov eax, esi
inc esi
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [rcx + rdx*4]
mov byte [rbp], al
mov eax, dword [rbx + 0x10]
inc rbp
shl eax, 2
cmp esi, eax
jl 0x140036837
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140036884
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
mov r11d, 4
add rax, rax
mov r10, r11
lea rdx, [rcx + rax*8 + 0x3c]
xor r8d, r8d
mov r9, rdx
mov al, byte [r9]
add r9, r11
xor byte [rcx + r8], al
inc r8
cmp r8, r11
jl 0x14003689e
inc rdx
add rcx, r11
sub r10, 1
jne 0x140036898
repz ret
Function at 0x140037240
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x14007e090]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r9
mov r12, r8
mov rdi, rdx
mov rbx, rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
mov rdx, qword [rdx + 0x18]
test dl, 0xf
je 0x1400372b2
mov qword [rcx + 0x20], recvfrom
mov qword [rcx + 0x18], r13
mov byte [rcx + 8], r13b
xor r8d, r8d
lea rdx, [0x1400667d2]
call fcn.1400043ec
mov rax, rbx
jmp 0x1400374a4
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.140021934
nop
mov rbp, qword [rdi + 0x18]
mov r15d, recvfrom
cmp qword [rdi + 0x20], r15
jb 0x1400372d6
mov rdi, qword [rdi + 8]
jmp 0x1400372da
add rdi, 8
lea rsi, [rsp + 0x48]
cmp qword [rsp + 0x60], r15
cmovae rsi, qword [rsp + 0x48]
cmp rbp, r15
jb 0x140037346
shr rbp, 4
cmp qword [r12 + 0x20], r15
jb 0x140037301
mov r8, qword [r12 + 8]
jmp 0x140037306
lea r8, [r12 + 8]
mov byte [rsp + 0x20], 0
mov r9d, dword [r12 + 0x18]
mov rdx, rsi
mov rcx, rdi
call fcn.140036f58
mov r11, rsi
sub r14, rsi
mov rcx, r15
mov al, byte [r14 + r11]
xor byte [r11], al
inc r11
sub rcx, 1
jne 0x140037324
mov r14, rdi
add rdi, r15
add rsi, r15
sub rbp, 1
jne 0x1400372f3
xor r13d, r13d
mov r9, qword [rsp + 0x58]
cmp r9, r15
jae 0x14003738c
mov qword [rbx + 0x20], recvfrom
mov qword [rbx + 0x18], r13
mov byte [rbx + 8], r13b
xor r8d, r8d
lea rdx, [0x1400667d2]
mov rcx, rbx
call fcn.1400043ec
nop
cmp qword [rsp + 0x60], r15
jb 0x140037384
mov rcx, qword [rsp + 0x48]
call fcn.140042a98
mov rax, rbx
jmp 0x1400374a4
lea rdi, [r9 - 1]
cmp r9, rdi
ja 0x14003739f
call fcn.1400429a4
mov r9, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], r15
cmovae rax, qword [rsp + 0x48]
mov dil, byte [rax + rdi]
cmp dil, r15b
jbe 0x1400373f4
mov qword [rbx + 0x20], recvfrom
mov qword [rbx + 0x18], r13
mov byte [rbx + 8], r13b
xor r8d, r8d
lea rdx, [0x1400667d2]
mov rcx, rbx
call fcn.1400043ec
nop
cmp qword [rsp + 0x60], r15
jb 0x1400373ec
mov rcx, qword [rsp + 0x48]
call fcn.140042a98
mov rax, rbx
jmp 0x1400374a4
mov bpl, r13b
cmp dil, r13b
jbe 0x140037478
movzx r12d, dil
movzx eax, bpl
mov rsi, r9
sub rsi, rax
dec rsi
cmp r9, rsi
ja 0x14003741c
call fcn.1400429a4
mov r9, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], r15
cmovae rax, qword [rsp + 0x48]
movsx eax, byte [rax + rsi]
cmp eax, r12d
jne 0x14003743f
inc bpl
cmp bpl, dil
jb 0x140037400
jmp 0x140037478
mov qword [rbx + 0x20], recvfrom
mov qword [rbx + 0x18], r13
mov byte [rbx + 8], r13b
xor r8d, r8d
lea rdx, [0x1400667d2]
mov rcx, rbx
call fcn.1400043ec
nop
cmp qword [rsp + 0x60], r15
jb 0x140037473
mov rcx, qword [rsp + 0x48]
call fcn.140042a98
mov rax, rbx
jmp 0x1400374a4
movzx eax, dil
sub r9, rax
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14000f838
nop
cmp qword [rsp + 0x60], r15
jb 0x1400374a1
mov rcx, qword [rsp + 0x48]
call fcn.140042a98
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140042a40
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400374cc
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x14007e090]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, rdx
mov rbx, rcx
and dword [rsp + 0x20], 0
xor esi, esi
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r13, rcx
mov qword [r11 - 0x38], 0xf
mov qword [r11 - 0x40], rax
mov byte [rsp + 0x38], al
je 0x1400376be
lea rdi, [0x140067b80]
movsx rax, byte [r12 + rsi]
mov cl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x140037552
cmp cl, r14b
je 0x14003753d
cmp cl, r14b
je 0x1400376be
movsx rax, byte [r12 + rsi]
mov bpl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x140037571
cmp bpl, r14b
je 0x14003755b
cmp bpl, r14b
je 0x1400376be
mov r8b, bpl
sar r8b, 4
and r8b, 3
shl cl, 2
or r8b, cl
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.140014ef8
jmp 0x1400375a3
lea rdi, [0x140067b80]
mov al, byte [r12 + rsi]
inc rsi
cmp al, 0x3d
je 0x140037682
movsx rax, al
mov dil, byte [rax + rdi]
cmp rsi, r13
jae 0x1400375c4
cmp dil, r14b
je 0x14003759c
cmp dil, r14b
je 0x1400376be
mov r8b, dil
sar r8b, 2
and r8b, 0xf
shl bpl, 4
or r8b, bpl
mov ebp, 1
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.140014ef8
lea rdx, [0x140067b80]
mov al, byte [r12 + rsi]
add rsi, rbp
cmp al, 0x3d
je 0x140037646
movsx rax, al
mov cl, byte [rax + rdx]
cmp rsi, r13
jae 0x140037614
cmp cl, r14b
je 0x1400375f8
cmp cl, r14b
je 0x1400376be
shl dil, 6
or dil, cl
mov r8b, dil
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.140014ef8
cmp rsi, r13
lea rdi, [0x140067b80]
jb 0x14003753d
jmp 0x1400376be
mov qword [rbx + 0x20], recvfrom
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140003f28
nop
cmp qword [rsp + 0x50], 0x10
jb 0x14003767d
mov rcx, qword [rsp + 0x38]
call fcn.140042a98
mov rax, rbx
jmp 0x1400376f8
mov qword [rbx + 0x20], recvfrom
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140003f28
nop
cmp qword [rsp + 0x50], 0x10
jb 0x1400376b9
mov rcx, qword [rsp + 0x38]
call fcn.140042a98
mov rax, rbx
jmp 0x1400376f8
mov qword [rbx + 0x20], recvfrom
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140003f28
nop
cmp qword [rsp + 0x50], 0x10
jb 0x1400376f5
mov rcx, qword [rsp + 0x38]
call fcn.140042a98
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140042a40
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140038600
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x104
lea rdx, [0x140083c40]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8, [0x140083c40]
lea rdx, str.Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, 8
call fcn.140042afc
xor ebx, ebx
cmp rax, rbx
je 0x140038674
lea rcx, [rsp + 0x50]
mov qword [rax], rcx
jmp 0x140038677
mov rax, rbx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.140037ac8
cmp eax, ebx
jne 0x1400386b5
lea rcx, [rsp + 0x50]
call fcn.14000184c
xor eax, eax
jmp 0x140038767
lea rcx, [rsp + 0x50]
call fcn.140038488
cmp qword [0x140084308], rbx
jne 0x1400386cd
jmp 0x14003875b
mov rbp, qword [0x140084300]
mov rsi, qword [rbp]
mov qword [rsp + 0x30], rsi
mov rax, qword [0x1400842d0]
mov rdi, rax
mov qword [rsp + 0x28], rax
cmp rdi, rbx
je 0x1400386f6
cmp rdi, rax
je 0x1400386fb
call fcn.140042ffc
cmp rsi, rbp
je 0x140038756
cmp rdi, rbx
jne 0x14003870f
call fcn.140042ffc
mov r11, rbx
jmp 0x140038712
mov r11, qword [rdi]
cmp rsi, qword [r11 + 0x30]
jne 0x14003871d
call fcn.140042ffc
lea r8, [rsi + 0x40]
lea rdx, [rsp + 0x38]
lea rcx, [0x140084260]
call fcn.1400060c8
lea rcx, [rsp + 0x28]
call fcn.140004db8
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
mov rbp, qword [0x140084300]
mov rax, qword [0x1400842d0]
jmp 0x1400386ec
mov ebx, 1
lea rcx, [rsp + 0x50]
call fcn.14000184c
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14003dcbc
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov r9, rcx
lea r8, [rsp + 0x10]
mov r10d, recvfrom
lea rcx, [rdx + 1]
movzx eax, byte [rcx]
movzx edx, byte [rcx - 1]
add rcx, 4
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 3]
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 2]
shl edx, 8
or edx, eax
mov dword [r8], edx
add r8, 4
sub r10, 1
jne 0x14003dce5
lea r10, [rsp + 0x48]
mov r11d, 0x30
mov ecx, dword [r10 - 0x34]
mov edx, dword [r10]
add r10, 4
mov r8d, ecx
mov eax, ecx
shr ecx, 3
rol r8d, 0xe
ror eax, 7
xor r8d, eax
mov eax, edx
xor r8d, ecx
mov ecx, edx
shr edx, 0xa
rol ecx, 0xf
rol eax, 0xd
xor ecx, eax
xor ecx, edx
add r8d, ecx
add r8d, dword [r10 - 0x3c]
add r8d, dword [r10 - 0x18]
sub r11, 1
mov dword [r10 + 4], r8d
jne 0x14003dd1f
mov edi, dword [r9 + 0x5c]
mov r14d, dword [r9 + 0x50]
mov r10d, dword [r9 + 0x54]
mov r11d, dword [r9 + 0x58]
mov r15d, dword [r9 + 0x60]
mov ebx, dword [r9 + 0x64]
mov ebp, dword [r9 + 0x6c]
mov dword [rsp + 0x150], edi
mov edi, dword [r9 + 0x68]
mov esi, dword [rsp + 0x150]
xor r12d, r12d
lea r13d, [r12 + 0x40]
mov eax, r15d
mov r8d, r15d
mov ecx, r15d
ror r8d, 0xb
rol eax, 7
not ecx
xor r8d, eax
and ecx, edi
mov eax, r15d
ror eax, 6
mov edx, r14d
xor r8d, eax
mov eax, ebx
and eax, r15d
xor ecx, eax
lea rax, [0x140067a30]
add r8d, ecx
mov ecx, r10d
add r8d, dword [r12 + rax]
xor ecx, r14d
mov eax, r14d
add r8d, dword [rsp + r12 + 0x10]
and ecx, r11d
add r12, 4
add r8d, ebp
ror edx, 0xd
rol eax, 0xa
xor edx, eax
mov eax, r14d
mov ebp, edi
ror eax, 2
mov edi, ebx
mov ebx, r15d
xor edx, eax
mov eax, r10d
lea r15d, [r8 + rsi]
and eax, r14d
mov esi, r11d
mov r11d, r10d
xor ecx, eax
mov r10d, r14d
add edx, ecx
sub r13, 1
lea r14d, [rdx + r8]
jne 0x14003dd9b
mov eax, dword [r9 + 0x50]
add eax, r14d
mov dword [r9 + 0x50], eax
mov eax, r10d
add eax, dword [r9 + 0x54]
mov dword [r9 + 0x54], eax
mov eax, r11d
add eax, dword [r9 + 0x58]
mov dword [r9 + 0x58], eax
mov eax, dword [r9 + 0x5c]
add eax, esi
mov dword [r9 + 0x5c], eax
mov eax, dword [r9 + 0x60]
add eax, r15d
mov dword [r9 + 0x60], eax
mov eax, ebx
mov rbx, qword [rsp + 0x158]
add eax, dword [r9 + 0x64]
mov dword [r9 + 0x64], eax
mov eax, edi
add eax, dword [r9 + 0x68]
mov dword [r9 + 0x68], eax
mov eax, ebp
add eax, dword [r9 + 0x6c]
mov dword [r9 + 0x6c], eax
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret