joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b65c0
Capabilities:
Compute adler32 checksum

Disassembly:
mov r8d, r8d
jmp 0x1400b65d0
mov r9d, ecx
mov r10, rdx
shr r9d, 0x10
movzx ecx, cx
cmp r8, 1
jne 0x1400b6614
movzx edx, byte [rdx]
add edx, ecx
cmp edx, 0xfff1
lea r8d, [rdx - 0xfff1]
cmovb r8d, edx
lea eax, [r8 + r9]
cmp eax, 0xfff1
lea ecx, [rax - 0xfff1]
cmovb ecx, eax
shl ecx, 0x10
or ecx, r8d
mov eax, ecx
ret
test rdx, rdx
jne 0x1400b661f
mov eax, 1
ret
cmp r8, 0x10
jae 0x1400b666c
test r8, r8
je 0x1400b6643
nop word [rax + rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
add ecx, eax
add r9d, ecx
sub r8, 1
jne 0x1400b6630
cmp ecx, 0xfff1
lea r8d, [rcx - 0xfff1]
mov eax, 0x80078071
cmovb r8d, ecx
mul r9d
shr edx, 0xf
imul eax, edx, 0xf
add eax, r9d
shl eax, 0x10
or eax, r8d
ret
cmp r8, 0x15b0
jb 0x1400b6747
mov r11, r8
movabs rax, 0x79baa6bb6398b6f7
mul r8
sub r11, rdx
shr r11, 1
add r11, rdx
shr r11, 0xc
imul rax, r11, 0xffffffffffffea50
add r8, rax
mov edx, 0x2b6
nop word [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add r10, 8
add ecx, eax
add r9d, ecx
add edx, 0xffffffff
jne 0x1400b66b0
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
sub r11, 1
jne 0x1400b66a0
test r8, r8
je 0x1400b67f9
cmp r8, 8
jb 0x1400b67c0
mov rdx, r8
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r8, rax
nop word [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add r10, 8
add ecx, eax
add r9d, ecx
sub rdx, 1
jne 0x1400b6760
test r8, r8
je 0x1400b67d3
nop
movzx eax, byte [r10]
lea r10, [r10 + 1]
add ecx, eax
add r9d, ecx
sub r8, 1
jne 0x1400b67c0
mov eax, 0x80078071
mul ecx
mov eax, 0x80078071
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mul r9d
shr edx, 0xf
imul edx, edx, 0xffff000f
add r9d, edx
shl r9d, 0x10
or r9d, ecx
mov eax, r9d
ret
Function at 0x1400bf6f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400bf73e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400bf73e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400bf73e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400bf73e
cmp dword [rcx + 0x84], 0xe
jbe 0x1400bf73e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400bf740
xor al, al
add rsp, 0x28
ret

Function at 0x1400c2e80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400c2ea8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400c2ea8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1400ddfc0
Capabilities:
Parse credit card information

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov dword [rbp + 0x10], ecx
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
call fcn.1400d72a0
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x2d
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x27
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x2b
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x2c
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x2e
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x2f
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x3a
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x3f
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x3d
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x21
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x2a
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x23
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x40
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x24
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x5f
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x28
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x29
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x3b
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
cmp ecx, 0x25
je 0x1400de0f8
mov ecx, dword [rbp + 0x10]
movzx ecx, cx
call fcn.1400d77b0
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
movzx eax, al
add rsp, 0x30
pop rbp
ret
mov eax, 1
add rsp, 0x30
pop rbp
ret
Function at 0x1401a34f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x54], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x5c], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x4c], r8d
mov r9, qword [rbp + 0x28]
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140016840
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x90]
call fcn.140016890
mov dword [rbp - 0x44], ebx
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.1401a35b1
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140311690
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
push rdi
sub rsp, 0x68
lea rbp, [rsp + 0x70]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
movabs rax, 0xcdcdcdcdcdcdcdcd
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x38]
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0xffffffff
je 0x1403116d5
mov eax, dword [rbp - 0xc]
add rsp, 0x68
pop rdi
pop rbp
ret
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x30]
mov rcx, qword [rbp + 0x10]
mov r9d, 4
call fcn.14048c7c0
mov dword [rbp - 0x3c], eax
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x1c], eax
cmp dword [rbp - 0x1c], 0
je 0x140311730
mov ecx, dword [rbp - 0x1c]
call fcn.14048c700
mov dword [rbp - 0x40], eax
mov ecx, dword [rbp - 0x40]
mov dword [rbp - 0x34], ecx
mov ecx, dword [rbp - 0x34]
lea rdx, [0x140942e38]
call fcn.14041b310
mov qword [rbp - 0x48], rax
mov rcx, qword [rbp - 0x48]
call fcn.1400169a0
xor eax, eax
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x18]
and eax, 0x30
test eax, eax
jne 0x14031174a
mov eax, dword [rbp - 0x20]
or eax, 0x40000000
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x18]
and eax, 2
test eax, eax
je 0x14031175f
mov eax, dword [rbp - 0x20]
or eax, 0x80000000
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x18]
and eax, 0x800
test eax, eax
je 0x140311776
mov eax, dword [rbp - 0x20]
or eax, 0x10000000
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x18]
and eax, 4
test eax, eax
je 0x14031178b
mov eax, dword [rbp - 0x20]
or eax, 0x8000000
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x18]
and eax, 0x1000
test eax, eax
je 0x1403117a2
mov eax, dword [rbp - 0x20]
or eax, 0x4000000
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x18]
and eax, 8
test eax, eax
je 0x1403117b7
mov eax, dword [rbp - 0x20]
or eax, 0x20000000
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x20]
mov dword [rbp - 0x38], eax
mov rax, qword [rbp + 0x10]
mov ecx, dword [rbp - 0x20]
mov dword [rax + 0x38], ecx
mov eax, dword [rbp - 0x38]
add rsp, 0x68
pop rdi
pop rbp
ret

Function at 0x140489880
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x50], rcx
lea rcx, [rbp - 0x78]
call fcn.140016840
mov rcx, qword [rbp - 0x50]
call sub.KERNEL32.dll_DeleteFileW
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.140016890
mov dword [rbp - 0x44], ebx
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.1404898fc
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14048a340
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x54], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x5c], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x4c], r8d
mov r9, qword [rbp + 0x28]
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140016840
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
lea rcx, [rbp - 0x90]
call fcn.140016890
mov dword [rbp - 0x44], ebx
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.14048a401
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14048a430
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x54], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x5c], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x4c], r8d
mov r9, qword [rbp + 0x28]
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140016840
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
lea rcx, [rbp - 0x90]
call fcn.140016890
mov dword [rbp - 0x44], ebx
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.14048a4f1
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14048ac50
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x54], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x5c], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x4c], r8d
mov r9, qword [rbp + 0x28]
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140016840
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x90]
call fcn.140016890
mov dword [rbp - 0x44], ebx
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.14048ad11
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14048ad40
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x54], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x5c], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x4c], r8d
mov r9, qword [rbp + 0x28]
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140016840
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x90]
call fcn.140016890
mov dword [rbp - 0x44], ebx
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.14048ae01
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14048ae30
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x54], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x5c], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x4c], r8d
mov r9, qword [rbp + 0x28]
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140016840
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x90]
call fcn.140016890
mov dword [rbp - 0x44], ebx
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.14048aef1
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14048c010
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x40]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp + 0x48]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x54], rcx
mov edx, dword [rbp + 0x18]
mov dword [rbp - 0x4c], edx
mov r8, qword [rbp + 0x20]
mov qword [rbp - 0x5c], r8
mov r9, qword [rbp + 0x28]
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140016840
mov rcx, qword [rbp - 0x54]
mov edx, dword [rbp - 0x4c]
mov r8, qword [rbp - 0x5c]
mov r9, qword [rbp - 0x64]
call sub.ADVAPI32.dll_RegEnumKeyExW
mov ebx, eax
lea rcx, [rbp - 0x90]
call fcn.140016890
mov dword [rbp - 0x44], ebx
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.14048c0e8
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14048c1f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x50], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x58], rdx
mov r8, qword [rbp + 0x20]
mov qword [rbp - 0x60], r8
mov r9, qword [rbp + 0x28]
mov qword [rbp - 0x68], r9
lea rcx, [rbp - 0x90]
call fcn.140016840
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x90]
call fcn.140016890
mov dword [rbp - 0x44], ebx
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.14048c2ba
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14048c2e0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov dword [rbp + 0x28], r9d
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x58], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x60], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x4c], r8d
mov r9d, dword [rbp + 0x28]
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.140016840
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8d, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.bcrypt.dll_BCryptGenRandom
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.140016890
mov dword [rbp - 0x44], ebx
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.14048c392
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400012d7
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1401eb790]
mov dword [rax], 1
mov rax, qword [0x1401eb7a0]
mov dword [rax], 1
mov rax, qword [0x1401eb7b0]
mov dword [rax], 1
mov rax, qword [0x1401eb700]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140001328
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140001354
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000137a
cmp eax, 0x20b
je 0x1400013a1
jmp 0x1400013d0
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000138d
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x1400013d5
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x1400013bc
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x1400013d5
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140002f00
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov eax, dword [0x1401d52b0]
mov ecx, dword [0x1401d52b4]
xor ecx, 0x615b7547
sub eax, ecx
mov ecx, 0xc7eb3d7a
xor edx, edx
div ecx
add eax, 0xf283265
mov r8d, 0x20e6791a
xor r8d, 0x8c05d0d9
mov ecx, 0x7338e15e
xor ecx, 0x8cc71ea1
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x7a725bc7
xor r8d, 0x858da438
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xace3a9c3
or eax, 0xace3a9c3
imul eax, edx
add eax, ecx
mov ecx, 0xe3f61c23
xor ecx, 0xd27bec89
cmp eax, ecx
jb 0x1400030a5
mov edx, dword [0x1401d52b8]
mov eax, dword [0x1401d52bc]
sub edx, eax
mov r8d, edx
add r8d, 0xc8a0d06b
mov ecx, r8d
and ecx, 0x4802a86b
xor r8d, 0xb7fd5794
mov eax, edx
mov edx, r8d
lea eax, [rax + rdx - 0x375f2f95]
sub eax, ecx
imul eax, eax, 0x12499214
mov dword [rbp - 0x14], eax
mov eax, 0x10
mov qword [rbp - 0x28], rax
call fcn.1401d4340
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rcx, rsp
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov rax, qword [0x1401e21a8]
mov qword [rcx], rax
mov rax, qword [0x1401e21b0]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140007830
add rsp, 0x20
mov rcx, rax
mov eax, dword [rbp - 0x14]
mov qword [rbp - 0x10], rcx
mov qword [0x1401f7068], rcx
cmp rcx, 0
sete cl
mov byte [rbp - 1], cl
cmp eax, 0x275026c5
jbe 0x140002f89
mov rax, qword [rbp - 0x10]
mov cl, byte [rbp - 1]
test cl, 1
mov qword [rbp - 0x30], rax
jne 0x140003050
jmp 0x140003081
mov rcx, qword [rbp - 0x20]
mov rax, qword [0x1401e21b8]
mov qword [rcx], rax
mov rax, qword [0x1401e21c0]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140007970
add rsp, 0x20
mov rax, qword [0x1401f7068]
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x30]
lea rdx, str.CreateThread
sub rsp, 0x20
call fcn.140007ab0
add rsp, 0x20
mov qword [0x1401f7070], rax
mov rsp, rbp
pop rbp
ret
fimul word [rbx - 0x241603ff]
invalid