joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400119cc
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x140035078]
xor rax, rsp
mov qword [rsp + 0x250], rax
and qword [rsp + 0x20], 0
mov rdi, rcx
cmp qword [rcx + 0x1b8], 0
jne 0x140011a12
mov esi, 1
jmp 0x140011bd3
lea rbx, [rcx + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov rbp, qword [rdi + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
cmp dword [rdi + 0x234], 0
je 0x140011a4d
mov r9d, dword [rdi + 0x1d4]
jmp 0x140011a54
mov r9d, dword [rdi + 0x1d0]
mov rax, qword [rdi + 0x1a8]
lea r8, [0x1400291ac]
mov rdx, qword [rdi + 0x1b8]
lea rcx, [rsp + 0x20]
test rax, rax
cmovne r8, rax
call fcn.140009a10
mov rbx, qword [rsp + 0x20]
mov esi, eax
test eax, eax
js 0x140011ba6
mov rcx, qword [rdi + 0x1f8]
lea rdx, [rsp + 0x40]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
nop dword [rax + rax]
mov rcx, qword [rdi + 0x1f8]
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
nop dword [rax + rax]
test eax, eax
jne 0x140011b05
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edi, 0x80070000
or ecx, edi
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140011afb
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx esi, ax
or esi, edi
test eax, eax
cmovle esi, eax
jmp 0x140011ba6
mov esi, 0x80004005
jmp 0x140011ba6
mov rcx, qword [rdi + 0x1f8]
lea rdx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetClientRect]
nop dword [rax + rax]
mov rcx, qword [rdi + 0x1f8]
lea rdx, [rsp + 0x28]
mov esi, 1
mov r8d, esi
call qword [sym.imp.USER32.dll_InvalidateRect]
nop dword [rax + rax]
mov rcx, qword [rdi + 0x1f8]
call qword [sym.imp.USER32.dll_UpdateWindow]
nop dword [rax + rax]
mov rcx, qword [rdi + 0x1f8]
lea r9d, [rsi + 1]
lea r8, [rsp + 0x28]
mov rdx, rbp
call qword [sym.imp.USER32.dll_MapWindowPoints]
nop dword [rax + rax]
mov r8d, esi
lea rdx, [rsp + 0x28]
mov rcx, rbp
call qword [sym.imp.USER32.dll_InvalidateRect]
nop dword [rax + rax]
mov rcx, rbp
call qword [sym.imp.USER32.dll_UpdateWindow]
nop dword [rax + rax]
mov rcx, qword [rdi + 0x1f8]
mov rdx, rbx
call fcn.14000a090
xor esi, esi
test rbx, rbx
je 0x140011bd3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140012d24
mov eax, esi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140023d70
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001642c
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140035078]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, qword [0x140035688]
lea rax, [rbp - 0x18]
xor ebx, ebx
mov qword [r11 - 0x48], rax
mov dword [rsp + 0x48], ebx
mov r14, rcx
mov dword [rsp + 0x40], ebx
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x38], ebx
mov r9d, 0x220
mov dword [rsp + 0x30], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x28], ebx
mov dl, 2
mov dword [rsp + 0x20], ebx
mov edi, ebx
mov esi, ebx
mov dword [rbp - 0x10], ebx
mov word [rbp - 0xc], 0x500
mov qword [rbp - 0x18], rbx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
je 0x1400164f7
mov rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
xor ecx, ecx
mov dword [rbp - 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
nop dword [rax + rax]
test eax, eax
je 0x1400164d7
mov edi, dword [rbp - 0x20]
jmp 0x1400164e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
nop dword [rax + rax]
jmp 0x140016505
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
test edi, edi
jne 0x140016536
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r8d, 0x1f8
mov rdx, r15
mov rcx, r14
mov ebx, eax
call fcn.140018bfc
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140023d70
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14001ad78
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140035078]
xor rax, rsp
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
lea rdx, [r11 - 0x48]
xor eax, eax
xor edi, edi
movups xmmword [rsp + 0x50], xmm0
mov qword [r11 - 0x28], rax
mov rbp, rcx
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], edi
call fcn.14001b4cc
test eax, eax
je 0x14001add1
cmp dword [rsp + 0x40], edi
sete dil
mov ebx, edi
jmp 0x14001af83
mov qword [rsp + 0x30], rdi
mov r8d, 3
mov dword [rsp + 0x28], 0x20000000
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001ae28
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14001af83
mov rcx, rsi
call fcn.14001ac50
mov ebx, eax
test eax, eax
je 0x14001af74
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x18
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x70000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop dword [rax + rax]
test eax, eax
jne 0x14001ae98
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14001af74
mov ebx, dword [rsp + 0x64]
xor ecx, ecx
add ebx, 0x1ff
mov r8d, 0x3000
and ebx, 0xfffffe00
mov edx, ebx
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x14001ae79
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rdi
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
jne 0x14001af18
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x80310000
jne 0x14001af5d
mov ebx, edi
mov edx, 1
jmp 0x14001af55
mov edx, dword [rsp + 0x44]
xor r8d, r8d
mov rcx, r14
call fcn.140021184
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x14001af47
cmp eax, 1
jne 0x14001af40
mov rcx, rsi
call fcn.14001a930
mov ebx, eax
jmp 0x14001af49
mov ebx, 1
jmp 0x14001af4d
mov ebx, edi
test ebx, ebx
js 0x14001af5d
test ebx, ebx
sete dil
mov edx, edi
mov rcx, rbp
call fcn.14001b5d8
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140023d70
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14001afb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x40
xor ebx, ebx
mov dword [rsp + 0x58], 4
cmp dword [0x1400358fc], ebx
mov dword [rsp + 0x50], ebx
jne 0x14001b034
lea rax, [r11 + 0x10]
mov r9d, 0x20000010
mov qword [r11 - 0x18], rax
lea r8, str.CacheDisable
lea rax, [r11 + 8]
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFveDetect
mov qword [r11 - 0x28], rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, 0xfffffffc
jne 0x14001b034
cmp eax, 1
je 0x14001b034
mov eax, dword [0x140035094]
cmp dword [rsp + 0x50], ebx
mov dword [0x1400358fc], 1
cmovne eax, ebx
mov dword [0x140035094], eax
jmp 0x14001b03a
mov eax, dword [0x140035094]
add rsp, 0x40
pop rbx
ret

Function at 0x14001b4cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rsi
push rdi
push r14
sub rsp, 0x40
xor ebx, ebx
mov dword [rax + 0x18], 4
mov qword [rax + 0x20], rbx
mov r14, rdx
mov dword [rax + 8], ebx
mov rdi, rcx
mov esi, ebx
test rcx, rcx
je 0x14001b58f
test rdx, rdx
je 0x14001b58f
mov dword [rdx], ebx
call fcn.14001afb0
test eax, eax
jne 0x14001b518
lea edi, [rbx + 1]
jmp 0x14001b5b9
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.14001b048
mov rsi, qword [rsp + 0x78]
mov edi, eax
test eax, eax
js 0x14001b594
lea rax, [rsp + 0x70]
mov r9d, 0x10
mov qword [rsp + 0x30], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFveDetectCache
lea rax, [rsp + 0x60]
mov r8, rsi
mov qword [rsp + 0x28], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x14001b580
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14001b594
cmp dword [rsp + 0x60], ebx
je 0x14001b594
mov dword [r14], 1
jmp 0x14001b594
mov edi, 0x80070057
test rsi, rsi
je 0x14001b5b9
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test edi, edi
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14001b5d8
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x58
and qword [rbp + 0x28], 0
xor eax, eax
and qword [rbp + 0x18], 0
mov rbx, rcx
and qword [rbp + 0x30], 0
test edx, edx
setne al
mov dword [rbp + 0x20], eax
test rcx, rcx
je 0x14001b734
call fcn.14001afb0
test eax, eax
je 0x14001b705
lea rdx, [rbp + 0x30]
mov rcx, rbx
call fcn.14001b048
mov rbx, qword [rbp + 0x30]
test eax, eax
js 0x14001b6e0
and qword [rsp + 0x40], 0
lea rax, [rbp + 0x28]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFveDetect
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
and dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b6e0
and qword [rsp + 0x40], 0
lea rax, [rbp + 0x18]
mov rcx, qword [rbp + 0x28]
lea rdx, str.Cache
mov qword [rsp + 0x38], rax
xor r9d, r9d
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b6e0
mov rcx, qword [rbp + 0x18]
lea r9d, [rax + 4]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test rbx, rbx
je 0x14001b705
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14001b71f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rbp + 0x18], 0
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14001b734
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
add rsp, 0x58
pop rbx
pop rbp
ret
Function at 0x14001b890
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140035078]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rdx
mov r14, rcx
xor edx, edx
xor ebx, ebx
call fcn.14001a040
movzx edi, ax
test edi, edi
je 0x14001baa9
cmp edi, 0x7f
je 0x14001baa9
lea r15d, [rbx + 2]
mov ecx, edi
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_IsValidLocale]
nop dword [rax + rax]
test eax, eax
jne 0x14001b927
cmp edi, 4
jne 0x14001b8fd
mov ecx, 0x804
jmp 0x14001b90e
cmp edi, 0x7c04
jne 0x14001baa9
mov ecx, 0x404
mov edx, 1
call qword [sym.imp.KERNEL32.dll_IsValidLocale]
nop dword [rax + rax]
test eax, eax
je 0x14001baa9
mov r9d, 0x20
lea r8, [rsp + 0x40]
mov edx, 0x1004
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax + rax]
test eax, eax
je 0x14001baa9
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov r8, r15
lea rcx, [0x14002bf00]
mov rdx, r14
mov ebp, eax
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14001b9b0
lea rdi, str.INDIAN
test rsi, rsi
je 0x14001ba46
lea rdx, str.Mangal
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14001baa9
jmp 0x14001ba46
mov r8, r15
lea rcx, [0x14002bd3c]
mov rdx, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14001b9d6
lea rdi, str.ARABIC
jmp 0x14001ba46
mov r8, r15
lea rcx, [0x14002be28]
mov rdx, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14001b9fc
lea rdi, str.THAI
jmp 0x14001ba46
mov r8, r15
lea rcx, [0x14002bda8]
mov rdx, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14001ba22
lea rdi, str.HEBREW
jmp 0x14001ba46
mov r8, r15
lea rcx, [0x14002be88]
mov rdx, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14001ba52
lea rdi, str.VIETNAMESE
mov rcx, rdi
call fcn.14001bc14
test al, al
je 0x14001baa9
test ebp, ebp
je 0x14001ba91
cmp ebp, 0xfde9
je 0x14001ba91
mov rcx, rbp
lea rdx, [rsp + 0x20]
mov r8d, r15d
call qword [sym.imp.GDI32.dll_TranslateCharsetInfo]
nop dword [rax + rax]
test eax, eax
je 0x14001baa9
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
nop dword [rax + rax]
test eax, eax
je 0x14001baa9
mov dl, byte [rsp + 0x20]
jmp 0x14001ba98
test rsi, rsi
je 0x14001baa4
mov dl, 1
mov rcx, rsi
call fcn.14001badc
test eax, eax
je 0x14001baa9
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140023d70
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001bc14
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x140035078]
xor rax, rsp
mov qword [rbp + 0x280], rax
and qword [rsp + 0x48], 0
xor bl, bl
and dword [rsp + 0x58], 0
mov rdi, rcx
and dword [rsp + 0x44], 0
mov dword [rsp + 0x54], 4
test rcx, rcx
je 0x14001bdb6
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionLanguagePack
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001bdb6
xor edx, edx
lea rcx, [rsp + 0x68]
mov r8d, 0x114
call sub.msvcrt.dll_memset
mov r8b, 2
mov dword [rsp + 0x60], 0x11c
mov edx, 2
mov dword [rsp + 0x64], 6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
nop dword [rax + rax]
mov edx, 2
lea rcx, [rsp + 0x60]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
nop dword [rax + rax]
test eax, eax
je 0x14001bd63
and dword [rsp + 0x40], 0
lea rcx, [rbp + 0x80]
xor edi, edi
xor edx, edx
mov r8d, 0x200
call sub.msvcrt.dll_memset
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
lea r8, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov edx, edi
and qword [rsp + 0x20], 0
mov dword [rsp + 0x50], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
nop dword [rax + rax]
inc edi
test eax, eax
jne 0x14001bd5a
cmp dword [rsp + 0x40], 4
je 0x14001bd9e
cmp eax, 0x103
jne 0x14001bd0a
jmp 0x14001bda0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x58]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001bda0
cmp dword [rsp + 0x44], 4
jne 0x14001bda0
mov bl, 1
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001bdb6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov al, bl
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.140023d70
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14001d11c
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140035078]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x20]
lea ecx, [r9 + 0x5a]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
js 0x14001d15d
cmp dword [rsp + 0x30], 3
cmovl ecx, dword [rsp + 0x30]
jmp 0x14001d162
mov ecx, 1
mov eax, ecx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140023d70
add rsp, 0x58
ret
Function at 0x14001d5f4
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, rdx
mov ebx, r14d
mov rbp, rcx
mov edi, 0x80
add edi, edi
test rbx, rbx
je 0x14001d645
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ebx, edi
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14001d691
mov r9, rbp
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
nop dword [rax + rax]
mov ecx, eax
jmp 0x14001d694
mov ecx, r14d
lea eax, [rdi - 2]
cmp ecx, eax
jae 0x14001d61e
test rbx, rbx
je 0x14001d6db
test ecx, ecx
jne 0x14001d6ca
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test eax, eax
cmovne rbx, r14
test rbx, rbx
je 0x14001d6db
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x14001d6db
mov dword [rax], edi
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14001d7dc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebp, ebp
mov r14, rdx
mov dword [rsp + 0x50], ebp
mov rsi, rcx
test rcx, rcx
je 0x14001d9dc
test rdx, rdx
je 0x14001d9dc
mov rcx, qword gs:[0x60]
lea edx, [rbp + 8]
lea r8d, [rbp + 0x10]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14001d83e
mov ebx, 0xc0000017
jmp 0x14001d9d1
mov r9d, 0x10
lea rax, [rsp + 0x50]
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rcx, rsi
lea edx, [r9 - 0xf]
call qword [sym.imp.ntdll.dll_NtQueryObject]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x14001d8f6
cmp dword [rsp + 0x50], 0x10
jb 0x14001d9d5
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov edx, 8
mov ebx, dword [rsp + 0x50]
mov r8d, ebx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14001d834
lea rax, [rsp + 0x50]
mov r9d, ebx
mov r8, rdi
mov qword [rsp + 0x20], rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryObject]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x14001d9b3
mov rcx, qword gs:[0x60]
mov edx, 8
movzx r8d, word [rdi]
add r8, 2
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov ecx, ebx
test rax, rax
mov ebx, 0xc0000017
mov r8, rax
cmove ecx, ebx
mov ebx, ecx
test ecx, ecx
js 0x14001d993
movzx r9d, word [rdi]
mov rdx, rax
mov r10, qword [rdi + 8]
shr r9, 1
lea rcx, [r9 + 1]
sub r9, rcx
sub r10, rax
lea rax, [r9 + rcx]
test rax, rax
je 0x14001d96a
movzx eax, word [r10 + rdx]
test ax, ax
je 0x14001d96a
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x14001d94a
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
mov word [rax], bp
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80000005
test rcx, rcx
je 0x14001d993
mov qword [r14], r8
mov r8, rbp
test r8, r8
je 0x14001d9b3
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, ebx
jmp 0x14001d9e1
mov ebx, 0xc0000004
jmp 0x14001d9b3
mov eax, 0xc000000d
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14001dee4
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x140035078]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp qword [0x140035010], 0
jne 0x14001e0a6
xor edi, edi
cmp byte [0x140035944], dil
jne 0x14001e023
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
je 0x14001df63
cmp dword [rsp + 0x54], 6
setb cl
mov byte [0x140035918], cl
ja 0x14001df56
jne 0x14001df5b
cmp dword [rsp + 0x58], 1
jbe 0x14001df5b
mov edi, 1
test cl, cl
jne 0x14001e01c
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14001dfa1
test edi, edi
je 0x14001e015
lea rcx, str.api_ms_win_eventing_provider_l1_1_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14001e015
lea rdx, str.EventWrite
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x140035920], rax
test rax, rax
je 0x14001e015
lea rdx, str.EventRegister
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [section..data], rax
test rax, rax
je 0x14001e007
lea rdx, str.EventUnregister
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x140035910], rax
test rax, rax
jne 0x14001e01c
lea rax, [0x14001dcd0]
mov qword [section..data], rax
mov byte [0x140035918], 1
mov byte [0x140035944], 1
cmp byte [0x140035918], 0
lea rdx, [0x140035010]
jne 0x14001e056
mov rax, qword [section..data]
lea rcx, [0x14002f0a0]
mov r9, rdx
mov r8, rdx
lea rdx, [0x14001db90]
call qword [0x140028b50]
jmp 0x14001e0a6
and qword [rsp + 0x48], 0
lea rax, [0x14002f0a0]
mov qword [rsp + 0x38], rdx
lea rcx, [rsp + 0x40]
and qword [rsp + 0x30], 0
mov r9d, 1
and qword [rsp + 0x28], 0
mov r8, rax
mov qword [rsp + 0x20], rcx
lea rcx, [0x14001da00]
mov qword [0x140035010], rdx
mov qword [rsp + 0x40], rax
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140023d70
mov rbx, qword [rsp + 0x190]
add rsp, 0x180
pop rdi
ret