joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f4c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x14004ae08]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000f557
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000f557
call fcn.14000daf0
mov ebx, eax
jmp 0x14000f67c
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14000f578
call fcn.14000daf0
jmp 0x14000f66b
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14000f59b
call fcn.14000daf0
jmp 0x14000f66b
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14000f5bd
mov ebx, 0x8007000e
jmp 0x14000f66d
mov ecx, eax
test eax, eax
je 0x14000f5f2
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14000f6b4
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000f5f2
lea rcx, [rsp + 0x60]
call fcn.14000d940
jmp 0x14000f5fc
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x14000f60f
cmp qword [rsp + 0x60], 0
jne 0x14000f61e
mov ebx, 0x8007000e
jmp 0x14000f66d
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14000f648
call fcn.14000daf0
jmp 0x14000f66b
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.14000efd0
mov ebx, eax
test rdi, rdi
je 0x14000f67c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x14000f693
lea rcx, [rsp + 0x60]
call fcn.14000dfe0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140027b30
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.14000db20
int3
Function at 0x14001a010
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x14004ae08]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea r8, str.zOutlookIMUtil.dll
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t____cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [reloc.Cmmlib.dll___4__CStringT__W_Cmm__QEAAAEAV01_AEBV01__Z]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64_void_const___ptr64]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14001a0d6
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov rcx, rax
xor edx, edx
call fcn.1400045a0
test eax, eax
je 0x14001a0d6
mov ebx, 1
jmp 0x14001a0d8
xor ebx, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov eax, ebx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140027b30
add rsp, 0x290
pop rbx
ret
Function at 0x14001a700
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x480
mov rax, qword [0x14004ae08]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor ebx, ebx
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsOUTLOOK.EXE
mov r9d, 0x2001f
mov qword [rsp + 0x38], rbx
mov rdx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rbx
call fcn.14000e940
test eax, eax
jne 0x14001a7e2
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x410
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x4c]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x48], 0x410
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140035fd4]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001a7e2
mov eax, dword [rsp + 0x4c]
dec eax
cmp eax, 1
ja 0x14001a7e2
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x14001a7c1
test al, 1
jne 0x14001a7e2
shr rax, 1
cmp word [rsp + rax*2 + 0x5e], bx
je 0x14001a7c6
jmp 0x14001a7e2
mov word [rsp + 0x60], bx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x14001a7e2
cmp dword [rsp + 0x50], 6
sete bl
cmp qword [rsp + 0x30], 0
je 0x14001a7f5
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140027b30
add rsp, 0x480
pop rbx
ret
Function at 0x14001b0e0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x14004ae08]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea r8, str.zOutlookIMUtil.dll
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t____cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [reloc.Cmmlib.dll___4__CStringT__W_Cmm__QEAAAEAV01_AEBV01__Z]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64_void_const___ptr64]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14001b1b9
mov rcx, rdi
call fcn.14001a010
test eax, eax
je 0x14001b1b9
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov rdx, rax
mov ebx, 1
mov r8d, ebx
mov rcx, rdi
call fcn.14001a9f0
jmp 0x14001b1bb
xor ebx, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov eax, ebx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140027b30
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret
Function at 0x14001b270
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x14004ae08]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rdx, [rbp + 0x27]
call fcn.140019430
nop
lea rcx, [rbp + 0x27]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
test eax, eax
je 0x14001b2af
xor ebx, ebx
jmp 0x14001b39d
lea rdx, [0x140035fd4]
lea rcx, [rbp - 1]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x27]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov r8, rax
lea rdx, [0x140036708]
lea rcx, [rbp - 1]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::Format_wchar_t_const____ptr64____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
mov dword [rbp - 0x79], 0x70
mov dword [rbp - 0x75], 0x240
xor ebx, ebx
mov qword [rbp - 0x71], rbx
lea rax, str.open
mov qword [rbp - 0x69], rax
lea rax, str.msiexec.exe
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x51], rbx
mov dword [rbp - 0x49], 5
mov qword [rbp - 0x41], rbx
lea rcx, [rbp - 1]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov qword [rbp - 0x59], rax
lea rcx, [rbp - 0x79]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rcx, qword [rbp - 0x11]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001b392
mov dword [rbp - 9], ebx
mov edx, 0x927c0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 9]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp - 0x11]
cmp rcx, 0xffffffffffffffff
je 0x14001b38d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x11], rbx
mov ebx, 1
lea rcx, [rbp - 1]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x27]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140027b30
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rbp
ret
Function at 0x14001d4c0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14004ae08]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call fcn.140017340
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140017420
cmp qword [rsp + 0x20], 0
jne 0x14001d4ff
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0x20]
call fcn.14001d4b0
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x40]
mov rcx, rdx
call qword [case.0x14001d058.0]
call fcn.140017340
mov rcx, rax
call fcn.140016270
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14001d940
Capabilities:
Delete registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [0x14004ae08]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, r8
test rcx, rcx
je 0x14001d9e3
test rdx, rdx
je 0x14001d9e3
test r8, r8
je 0x14001d9e3
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x40], rdi
or r9d, 0x2001f
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edi, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d9b4
mov rcx, qword [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
cmovne edi, ebx
mov ebx, edi
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
test rcx, rcx
je 0x14001d9c9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140027b30
add rsp, 0x50
pop rsi
ret
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140027b30
add rsp, 0x50
pop rsi
ret
Function at 0x14001da00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x14004ae08]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rcx
mov rsi, r9
mov rcx, r9
mov rdi, r8
mov r14, rdx
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::Empty_void____ptr64]
mov edx, 0x800
mov rcx, rsi
call qword [sym.imp.Cmmlib.dll_public:_wchar_t____ptr64___cdecl_Cmm::CStringT_wchar_t_::GetBuffer_unsigned_long_long_unsigned___int64_____ptr64]
mov r15, rax
test rax, rax
je 0x14001db15
mov qword [rsp + 0x58], rbx
test rbp, rbp
je 0x14001db03
test r14, r14
je 0x14001db03
test rdi, rdi
je 0x14001db03
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
mov r9d, dword [rsp + 0xb0]
lea rax, [rsp + 0x30]
or r9d, 0x20019
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, rbp
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001daef
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], eax
xor r8d, r8d
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 0x1000
mov qword [rsp + 0x28], rax
mov rdx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001daef
cmp dword [rsp + 0x38], ebx
je 0x14001daf1
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001db05
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001db05
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::ReleaseBuffer_void____ptr64]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140027b30
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001db30
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14004ae08]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12d, dword [rsp + 0xd0]
mov rdi, r9
mov r15, r8
mov rsi, rdx
mov r14, rcx
test rcx, rcx
je 0x14001dc7b
test rdx, rdx
je 0x14001dc7b
test r8, r8
je 0x14001dc7b
mov qword [rsp + 0x78], rbx
lea rax, [rsp + 0x50]
xor ebx, ebx
mov qword [rsp + 0x70], rbp
mov r9d, r12d
mov qword [rsp + 0x50], rbx
or r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea ebp, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001dc08
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x40], rax
or r12d, 0xf003f
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov rdx, rsi
mov dword [rsp + 0x28], r12d
mov rcx, r14
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rcx, rbx
mov qword [rsp + 0x50], rcx
test rcx, rcx
je 0x14001dc62
mov rcx, rdi
mov rsi, rbx
mov r14d, ebx
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
test eax, eax
jne 0x14001dc38
mov rcx, rdi
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64_void_const___ptr64]
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.Cmmlib.dll_public:_unsigned_long_long_unsigned___int64____cdecl_Cmm::CStringT_wchar_t_::GetLength_void_const___ptr64]
lea r14d, [rax*2 + 2]
mov rcx, qword [rsp + 0x50]
mov r9d, ebp
mov dword [rsp + 0x28], r14d
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
cmovne ebp, ebx
mov ebx, ebp
mov rbp, qword [rsp + 0x70]
test rcx, rcx
je 0x14001dc72
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
jmp 0x14001dc7d
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140027b30
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14001dca0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r14
sub rsp, 0x98
mov rax, qword [0x14004ae08]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14d, dword [rsp + 0xe0]
mov rbp, r8
mov dword [r11 - 0x58], r9d
mov rdi, rdx
mov rsi, rcx
test rcx, rcx
je 0x14001ddcd
test rdx, rdx
je 0x14001ddcd
test r8, r8
je 0x14001ddcd
mov qword [r11 - 0x28], rbx
lea rax, [r11 - 0x68]
xor ebx, ebx
mov qword [r11 - 0x30], r15
mov r9d, r14d
mov qword [r11 - 0x68], rbx
or r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea r15d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001dd77
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x40], rax
or r14d, 0xf003f
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov dword [rsp + 0x28], r14d
mov rcx, rsi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rcx, rbx
mov qword [rsp + 0x50], rcx
test rcx, rcx
jne 0x14001dd7c
jmp 0x14001ddae
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
cmovne r15d, ebx
mov ebx, r15d
mov r15, qword [rsp + 0x88]
test rcx, rcx
je 0x14001ddc1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
jmp 0x14001ddcf
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140027b30
add rsp, 0x98
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400233b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rdi
push r15
sub rsp, 0x68
mov rax, qword [0x14004ae08]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rdi, [rcx + 0x178]
mov r15, rdx
mov rcx, rdi
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
test eax, eax
jne 0x140023528
mov rcx, rdi
mov qword [rsp + 0x58], rsi
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64_void_const___ptr64]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rcx, rax
mov dword [rsp + 0x28], 0x10000000
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140023523
mov qword [rsp + 0x90], rbx
xor edx, edx
mov qword [rsp + 0x60], rbp
mov rcx, rax
mov qword [rsp + 0x50], r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
test eax, eax
je 0x140023508
mov edx, ebp
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x140023508
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rax
test rax, rax
jne 0x140023494
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140023511
xor eax, eax
lea r9, [rsp + 0x40]
mov rdi, rdx
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov r8d, ebp
rep stosb byte [rdi], al
mov rcx, rsi
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
test eax, eax
jne 0x1400234d9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140023511
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov r8, r15
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
je 0x140023511
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140023511
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140027b30
add rsp, 0x68
pop r15
pop rdi
ret
Function at 0x1400272b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x14004ae08]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x68], rsi
mov rbp, rcx
mov rsi, qword [0x14004ac00]
xor r14d, r14d
mov rcx, qword [0x14004ac08]
mov ebx, 1
cmp rsi, rcx
jae 0x140027384
test ebx, ebx
js 0x140027384
mov rdi, qword [rsi]
test rdi, rdi
je 0x140027377
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x30], r14
test rax, rax
jne 0x140027316
mov ebx, r14d
jmp 0x140027377
mov rcx, qword [rdi + 0x18]
lea r8, [rsp + 0x30]
lea rdx, [0x14002e320]
call qword [case.0x14001d058.0]
mov ebx, eax
test eax, eax
js 0x140027359
mov rax, qword [rdi + 0x20]
mov r9d, 5
mov rdx, qword [rsp + 0x30]
add rax, 8
mov rcx, qword [rdi]
mov qword [rsp + 0x20], rax
lea r8d, [r9 - 1]
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140027370
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001d058.0]
mov rcx, qword [0x14004ac08]
add rsi, 8
cmp rsi, rcx
jb 0x1400272f3
mov rsi, qword [rsp + 0x68]
test ebx, ebx
js 0x140027450
jne 0x14002744c
cmp byte [rbp + 0x60], r14b
je 0x140027436
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x50], rax
test rax, rax
je 0x140027427
lea rax, [rsp + 0x30]
mov r9, rbp
mov qword [rsp + 0x28], rax
lea r8, [0x140026c20]
xor edx, edx
mov dword [rsp + 0x20], r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x1400273f3
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x50], r14
test rdi, rdi
je 0x140027427
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
mov ebx, eax
test eax, eax
jns 0x14002741c
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [rbp + 0x58]
mov rcx, rdi
add edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002743e
mov rcx, rbp
mov ebx, 0x80004005
call fcn.140027470
jmp 0x140027450
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
mov ebx, eax
test ebx, ebx
jns 0x140027450
mov rcx, rbp
call fcn.140027470
jmp 0x140027450
mov byte [rbp + 0x60], r14b
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140027b30
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
pop rbx
test al, 0xde
mov edx, dword [rdi]
invalid
Function at 0x140177f29
Capabilities:
Encode data using xor

Disassembly:
add rbp, 0xc
xor r11d, r11d
test rax, rax
lea rsp, [rsp + 8]
je 0x140143b0b
mov r10d, 0xc12fb2d
lea r9, [0x14015b770]
movzx r10d, byte [rcx]
push 0xfffffffffa02af0e
neg byte [rsp + 6]
push 0xffffffffacaade13
xor r10d, r11d
push 0xffffffffba997ea1
and r10d, 0xff
mov r10d, dword [r9 + r10*4]
shr r11d, 8
xor r11d, r10d
inc rcx
xor r11d, 0xb61baa27
dec rax
lea rsp, [rsp + 0x18]
jne 0x140143ac7
jmp 0x1401688ee
not r11d
jmp 0x14016c67d
jmp 0x14014d2b5
mov rcx, qword [rbp + riz]
mov qword [rsp], 0x3b826613
mov rax, qword [rbp + 8]
jmp 0x140143aa2