joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403970
Capabilities:
Write file on windows

Disassembly:
push rdi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rbx, rcx
mov r10, rdx
je 0x403996
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r10
mov r9, rbx
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rdi
jmp 0x40cb98
jmp qword [sym.imp.msvcrt.dll_fflush]

Function at 0x40bba0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x00426ec4]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x40bcb8
mov rax, qword [0x00426ec8]
xor ebx, ebx
add rax, 8
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x40bbec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x40bc9e
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x40bbd0
mov rcx, rsi
call fcn.0040c800
test rax, rax
mov r12, rax
je 0x40bcf0
movsxd rbx, ebx
lea rbx, [rbx + rbx*2]
shl rbx, 3
mov r13, rbx
add r13, qword [0x00426ec8]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.0040c950
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov qword [r13 + 8], rax
mov rax, qword [0x00426ec8]
lea rdx, [rsp + 0x20]
mov rcx, qword [rax + rbx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40bcd3
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x40bc97
sub eax, 4
and eax, 0xfffffffb
je 0x40bc97
add rbx, qword [0x00426ec8]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40bcbf
add dword [0x00426ec4], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x40bbf7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0040bb30
mov rax, qword [0x00426ec8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rbx + 8]
call fcn.0040bb30
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.0040bb30
nop

Function at 0x40c470
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004271a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00427180]
test rbx, rbx
je 0x40c4c4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40c4bb
test rsi, rsi
je 0x40c4bb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40c4a0
lea rcx, [0x004271a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x40c800
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00410290]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
je 0x40c820
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.0040c6e0
test eax, eax
je 0x40c818
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x40c87d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x40c874
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x40c818
add rdx, 0x28
cmp rdx, r9
jne 0x40c860
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x140001170
Capabilities:
Query or enumerate registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xf98]
mov eax, 0x1070
call fcn.140008940
sub rsp, rax
mov rax, qword [0x140016018]
xor rax, rsp
mov qword [rbp + 0xf60], rax
mov r13d, ecx
lea rax, [rsp + 0x38]
xor edi, edi
mov qword [rsp + 0x20], rax
and qword [rsp + 0x38], rdi
lea rdx, [0x14000b670]
mov rcx, 0xffffffff80000002
mov r9d, 0x20019
xor r8d, r8d
xor r14d, r14d
xor r15d, r15d
xor r12d, r12d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x140001343
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
and qword [rsp + 0x40], rdi
lea rdx, [0x14000b688]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x140001345
mov rdi, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
and qword [rsp + 0x48], r12
lea rdx, [0x14000b6a0]
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x140001345
mov r14, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov esi, 0x800
xor edx, edx
mov r8d, esi
call sub.VCRUNTIME140.dll_memset
xor edx, edx
jmp 0x1400012ab
lea rdx, str.11.421.2
inc r12d
lea rcx, [rsp + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
je 0x1400012c4
mov esi, 0x800
lea rcx, [rsp + 0x60]
mov r8d, esi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov edx, r12d
mov r9d, esi
lea r8, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test eax, eax
je 0x14000127c
jmp 0x140001333
and qword [rsp + 0x50], r15
lea rax, [rsp + 0x50]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x140001345
mov r15, qword [rsp + 0x50]
lea r9d, [rax + 4]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], r9d
mov rcx, r15
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], r13d
lea rdx, str.UseNewJavaPlugin
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test r15, r15
je 0x140001345
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r15d, r15d
test r15, r15
je 0x140001345
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140001345
xor ebx, ebx
test r14, r14
je 0x140001353
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
je 0x140001361
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14000136f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rbp + 0xf60]
xor rcx, rsp
call fcn.1400089a0
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400013a8
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerExtensions08B0E5C0_4FCB_11CF_AAA5_00401C608501
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x140002e70
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140002e96
mov r8, rdx
mov rdx, qword [rbx]
call fcn.14000388c
jmp 0x140002efd
cmp byte [0x140016388], 0
jne 0x140002eda
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002eca
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140016380], rax
jmp 0x140002ed1
mov rax, qword [0x140016380]
mov byte [0x140016388], 1
jmp 0x140002ee1
mov rax, qword [0x140016380]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140002ef7
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x140002efd
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000388c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400038ef
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003903
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003903
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x140003908
cmp dword [rcx + 8], 0
je 0x140003903
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140003908
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140003b3c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x140016018]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x60], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140003bc0
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140003bc0
call fcn.140002cbc
mov ebx, eax
jmp 0x140003ccb
mov r8, r15
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140003be1
call fcn.140002cbc
jmp 0x140003cba
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140003bd7
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x140003c1c
mov ebx, 0x8007000e
jmp 0x140003cbc
mov ecx, eax
test eax, eax
je 0x140003c4e
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140003d03
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140003c4e
lea rcx, [rsp + 0x60]
call fcn.140002b5c
jmp 0x140003c58
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x140003c6a
cmp qword [rsp + 0x60], rdi
je 0x140003c12
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140003bd7
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.1400039d0
mov ebx, eax
test rsi, rsi
je 0x140003ccb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x140003ce2
lea rcx, [rsp + 0x60]
call fcn.140002f08
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400089a0
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140002cec
int3
Function at 0x140005228
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140016018]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ebx, ebx
cmp dword [0x140016408], ebx
je 0x140005255
mov eax, dword [0x14001640c]
jmp 0x1400052b6
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
mov eax, 1
jne 0x1400052a8
cmp dword [rsp + 0x24], 6
jne 0x1400052a8
cmp dword [rsp + 0x28], ebx
jne 0x1400052a8
cmp byte [rsp + 0x13a], al
jne 0x1400052a8
cmp word [rsp + 0x134], bx
jne 0x1400052a8
mov ebx, eax
mov dword [0x140016408], eax
mov eax, ebx
mov dword [0x14001640c], ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400089a0
add rsp, 0x150
pop rbx
ret

Function at 0x140005740
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x140016018]
xor rax, rsp
mov qword [rsp + 0x250], rax
movsxd r14, edx
mov rsi, rcx
xor ebx, ebx
mov word [rcx], bx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test eax, eax
js 0x1400057fd
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400021e4
mov rax, qword [rax]
test rax, rax
je 0x1400057aa
mov r8, qword [rax]
jmp 0x1400057ad
mov r8, rbx
mov rdx, r14
mov r9d, 0x104
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea rcx, [rsp + 0x30]
call fcn.140004e58
nop
jmp 0x1400057d2
test edi, edi
setns bl
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400089a0
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop r14
pop rdi
pop rsi
ret
mov edx, eax
lea rcx, str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.140008054
xor edx, edx
mov ecx, edi
call fcn.140009810
int3

Function at 0x14000581c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x140016018]
xor rax, rsp
mov qword [rsp + 0x250], rax
movsxd r14, edx
mov rsi, rcx
xor ebx, ebx
mov word [rcx], bx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test eax, eax
js 0x1400058d9
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400021e4
mov rax, qword [rax]
test rax, rax
je 0x140005886
mov r8, qword [rax]
jmp 0x140005889
mov r8, rbx
mov rdx, r14
mov r9d, 0x104
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea rcx, [rsp + 0x30]
call fcn.140004e58
nop
jmp 0x1400058ae
test edi, edi
setns bl
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400089a0
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop r14
pop rdi
pop rsi
ret
mov edx, eax
lea rcx, str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.140008054
xor edx, edx
mov ecx, edi
call fcn.140009810
int3
Function at 0x1400061e8
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x140016018]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x103
ja 0x140006273
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov r9, rbx
lea r8, [rsp + 0x20]
lea rdx, [0x14000eaa8]
lea rcx, [rsp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x140006275
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400089a0
add rsp, 0x450
pop rbx
ret

Function at 0x140006c40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1050
call fcn.140008940
sub rsp, rax
mov rax, qword [0x140016018]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov r9, rbx
lea r8, str.SOFTWAREClassesCLSID_sInprocServer32
mov edx, 0x400
lea rcx, [rsp + 0x40]
call fcn.140007d44
lea rax, [rsp + 0x38]
neg edi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
sbb rcx, rcx
lea rdx, [rsp + 0x40]
add rcx, 0xffffffff80000002
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
je 0x140006cd6
cmp eax, 2
sete bl
jmp 0x140006d39
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x840]
mov dword [rsp + 0x30], 0x800
lea rdx, [0x14000dcdc]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x140006d10
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140006d3b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x840]
sub rdx, rsi
movzx eax, word [rsi]
movzx ecx, word [rsi + rdx]
sub eax, ecx
jne 0x140006d34
add rsi, 2
test ecx, ecx
jne 0x140006d21
test eax, eax
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400089a0
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140007a30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140016018]
xor rax, rsp
mov qword [rbp + 0x160], rax
lea r8, [0x14000f0c8]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wdupenv_s]
xor ebx, ebx
test eax, eax
jne 0x140007b4d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp qword [0x1400163e0], rbx
je 0x140007a98
lea eax, [rbx + 1]
jmp 0x140007b4f
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x140007b4d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.1400021e4
nop
lea rdx, str.JavaDeployReg.log
lea rcx, [rsp + 0x28]
call fcn.1400021e4
nop
mov ecx, 0x18
call fcn.1400082f0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140007b02
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14000201c
mov rdi, rax
jmp 0x140007b05
mov rdi, rbx
test rdi, rdi
je 0x140007b73
lea rcx, [rsp + 0x20]
call fcn.140004e58
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0x28]
call fcn.140004e58
lea r8, [0x14000e1d4]
mov rdx, qword [rdi]
lea rcx, [0x1400163e0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
test eax, eax
sete bl
lea rcx, [rsp + 0x20]
call fcn.140004e58
mov eax, ebx
jmp 0x140007b4f
xor eax, eax
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400089a0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140009510
int3
Function at 0x140007e50
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xf90]
mov eax, 0x1090
call fcn.140008940
sub rsp, rax
mov rax, qword [0x140016018]
xor rax, rsp
mov qword [rbp + 0xf80], rax
mov rbx, rdx
mov rdi, rcx
mov esi, 0x800
lea rcx, [rbp + 0x780]
mov r8d, esi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
call fcn.140007cf8
mov qword [rsp + 0x30], rbx
lea rdx, [rbp + 0x780]
xor r15d, r15d
or r12, 0xffffffffffffffff
mov qword [rsp + 0x28], r15
mov r9, r12
mov rcx, qword [rax]
mov r8d, 0x400
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsnwprintf_s]
test eax, eax
cmovs eax, r12d
test eax, eax
jns 0x140007eea
mov word [rbp + 0xf7e], r15w
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x40]
call sub.VCRUNTIME140.dll_memset
mov ebx, 0x20
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140007d98
lea r8, [0x140010e1c]
mov edx, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov r8, rsi
lea rcx, [rbp - 0x80]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, r12
inc rax
cmp word [rdi + rax*2], r15w
jne 0x140007f30
cmp rax, 6
jbe 0x140007f5d
add rax, 0xfffffffffffffffa
lea rdx, str.__08x_
lea rcx, [rdi + rax*2]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
mov eax, 1
je 0x140007f60
mov eax, r15d
lea rcx, [rsp + 0x40]
mov r14, r12
inc r14
cmp word [rcx + r14*2], r15w
jne 0x140007f68
test eax, eax
lea rcx, [0x140010e2c]
lea rdi, str.Error:
cmove rdi, rcx
lea rsi, [r14 + r14]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r9, [rbp + 0x780]
mov edx, 0x3ff
mov qword [rsp + 0x38], r9
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x30], rdi
lea r9, str.P:_04d_T:_04d__s_s
mov dword [rsp + 0x28], ebx
sub rdx, r14
add rcx, rsi
mov dword [rsp + 0x20], eax
mov r8, r12
call fcn.140008088
mov rcx, qword [rbp + 0x776]
test eax, eax
movabs rdx, 0x2e002e002e
mov r8, rsi
cmovs rcx, rdx
lea rdx, [rsp + 0x40]
mov qword [rbp + 0x776], rcx
lea rcx, [rbp - 0x80]
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp - 0x80]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], r15w
jne 0x140008006
mov eax, dword [0x140010e5c]
mov dword [rcx], eax
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0xf80]
xor rcx, rsp
call fcn.1400089a0
lea r11, [rsp + 0x1090]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x14000914c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009196
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009196
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009196
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009196
cmp dword [rcx + 0x84], 0xe
jbe 0x140009196
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009198
xor al, al
add rsp, 0x28
ret
Function at 0x140009af4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140009b6c
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140009b6c
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140009b6c
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140009b60
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140009b7e
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140009b4e
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140009b6e