joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012cbc
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x140088e00]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, qword [rsp + 0xc0]
lea rax, [r11 - 0x48]
and dword [rsp + 0x50], 0
lea r14d, [r8 - 0x114]
mov dword [rsp + 0x48], 1
mov r15, r9
mov qword [r11 - 0x58], rax
mov rsi, rcx
and dword [rsp + 0x38], 0
xor r9d, r9d
and qword [r11 - 0x68], 0
mov r8d, r14d
and dword [rsp + 0x28], 0
mov rbp, rdx
mov rcx, qword [rcx]
mov ebx, 0x80004005
and qword [r11 - 0x78], 0
call sub.bcrypt.dll_BCryptDecrypt
test eax, eax
jne 0x140012dab
mov eax, dword [rsp + 0x50]
cmp dword [rdi], eax
jb 0x140012da7
mov r8d, r14d
mov rdx, rbp
mov rcx, rsi
call fcn.140012ba0
test eax, eax
js 0x140012dab
lfence
mov r8d, dword [rsi + 0x34]
lea rcx, [rbp + 0x14]
mov rdx, qword [rsi + 0x28]
mov eax, r14d
add rcx, rax
call fcn.14002f480
test eax, eax
jne 0x140012dab
lfence
mov eax, dword [rdi]
xor r9d, r9d
mov rcx, qword [rsi]
mov r8d, r14d
mov dword [rsp + 0x48], 1
mov rdx, rbp
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], r15
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call sub.bcrypt.dll_BCryptDecrypt
test eax, eax
jne 0x140012dab
jmp 0x140012da9
mov dword [rdi], eax
xor ebx, ebx
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002ab60
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140012dc8
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x140088e00]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, qword [rsp + 0xc0]
lea rax, [r11 - 0x48]
and dword [rsp + 0x50], 0
mov rbp, r9
mov dword [rsp + 0x48], 1
mov rsi, rcx
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [r11 - 0x58], rax
mov r15d, r8d
and dword [rsp + 0x38], 0
mov r14, rdx
and qword [r11 - 0x68], 0
mov ebx, 0x80004005
and dword [rsp + 0x28], 0
and qword [r11 - 0x78], 0
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
jne 0x140012f1c
mov eax, dword [rsp + 0x50]
mov ecx, dword [rdi]
add eax, 0x114
mov dword [rsp + 0x50], eax
cmp ecx, eax
jb 0x140012f18
mov dword [rsp + 0x48], 1
xor r9d, r9d
mov qword [rsp + 0x40], rdi
mov r8d, r15d
mov dword [rsp + 0x38], ecx
mov rdx, r14
mov rcx, qword [rsi]
mov qword [rsp + 0x30], rbp
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
jne 0x140012f1c
mov r8d, dword [rdi]
mov rdx, rbp
mov rcx, rsi
call fcn.140012ba0
test eax, eax
js 0x140012f1c
lfence
mov ebx, dword [rdi]
xor edx, edx
add rbx, rbp
mov ebp, VarUI4FromDisp
mov r8d, ebp
mov rcx, rbx
call fcn.14002e400
cmp dword [rsi + 0x38], 1
jne 0x140012ec7
mov dword [rbx + 4], 1
jmp 0x140012ed4
cmp dword [rsi + 0x38], 2
jne 0x140012ed4
mov dword [rbx + 4], 3
mov r8d, dword [rsi + 0x34]
lea rcx, [rbx + 0x14]
mov rdx, qword [rsi + 0x28]
test r8, r8
je 0x140012f0e
test rcx, rcx
je 0x140012efe
lfence
test rdx, rdx
je 0x140012ef9
call fcn.14002f580
jmp 0x140012f0e
call fcn.14002e400
call fcn.140033f84
mov dword [rax], 0x16
call fcn.140033e18
mov eax, dword [rsi + 0x34]
mov dword [rbx + 0x10], eax
add dword [rdi], ebp
jmp 0x140012f1a
mov dword [rdi], eax
xor ebx, ebx
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002ab60
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140018414
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140088e00]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
xor eax, eax
mov qword [rbp - 0x18], rax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
and qword [rbp - 0x18], rax
lea rdx, [rbp - 0x28]
call fcn.140018148
mov rbx, qword [rbp - 0x28]
cmp rbx, qword [rbp - 0x20]
je 0x1400185aa
or esi, 0xffffffff
mov rcx, qword [rbx]
sub rcx, 0x18
call fcn.140013574
add rax, 0x18
mov qword [rbp - 0x50], rax
and qword [rbp - 0x30], 0
lea rdx, [rbp - 0x38]
mov rcx, rdi
call fcn.1400182cc
nop
lea r8, [0x140068cd4]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140013360
nop
lea r8, [rbp - 0x50]
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.1400176a8
nop
lea r8, [0x14008c660]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400176a8
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400184f0
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140064a18]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140018519
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140064a18]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140018541
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140064a18]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140018574
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140064a18]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14001859c
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140064a18]
add rbx, 8
cmp rbx, qword [rbp - 0x20]
jne 0x140018468
lea rcx, [rbp - 0x28]
call fcn.140018778
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002ab60
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400185d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140088e00]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
call fcn.1400183bc
test eax, eax
je 0x140018690
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEvent]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [rsp + 0x30], 0
mov edi, eax
jmp 0x14001866d
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x30], 0
je 0x140018688
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140018662
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0xffffffff
jb 0x14001861a
cmp dword [rsp + 0x30], 0
je 0x140018688
mov eax, 1
jmp 0x140018692
mov rcx, rbx
call fcn.140017764
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14002ab60
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x14001cce0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140088e00]
xor rax, rsp
mov qword [rbp + 0x160], rax
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareIntelDisplayigfxcui
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ce15
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001ce15
and dword [rsp + 0x40], eax
lea r9, [rsp + 0x3c]
mov eax, 4
lea rdx, str.AGSDevMode
mov dword [rsp + 0x38], eax
xor r8d, r8d
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001cd98
cmp dword [rsp + 0x40], 1
jne 0x14001cd98
mov dword [rbx + 0x7c], 1
cmp dword [rbx + 0x7c], 0
je 0x14001ce0a
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.14002e400
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x38], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AGSDevModePlatform
mov dword [rsp + 0x3c], 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001ce0a
lea rcx, [rbx + 0x80]
lea r8, [rsp + 0x50]
lea rdx, [0x140069204]
call fcn.14001ca54
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14002ab60
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rbp
ret

Function at 0x14001ce38
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140088e00]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
lea rdx, str.SoftwareIntelDisplayigfxcui
xor ecx, ecx
call fcn.14001cf14
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x34], 1
test rax, rax
je 0x14001ce9a
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x34]
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea rdx, str.InstPath
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, [0x140067a94]
mov rcx, rbx
call fcn.1400406fc
test eax, eax
jne 0x14001cebb
mov edx, 0x400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14002ab60
add rsp, 0x40
pop rbx
ret
Function at 0x14001cf14
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140088e00]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x50], 0
mov edi, 0x20019
cmp ecx, 1
mov r14, rdx
lea eax, [rdi + 6]
cmove edi, eax
call fcn.14001d4f8
test al, al
je 0x14001cf62
movups xmm0, xmmword [0x140068d28]
jmp 0x14001cf69
movups xmm0, xmmword [0x140068d38]
mov r9d, 2
lea rcx, [rbp - 0x38]
xor r8d, r8d
xor edx, edx
movdqu xmmword [rbp - 0x38], xmm0
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001d039
xor esi, esi
mov dword [rbp - 0x28], 0x20
xor edx, edx
jmp 0x14001d01b
xor r9d, r9d
mov dword [rsp + 0x28], edi
lea rdx, [rbp - 0x28]
mov dword [rsp + 0x20], 2
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov qword [rbp - 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x14001d012
and dword [rbp - 0x40], 0
lea rcx, [rbp - 0x44]
and dword [rbp - 0x48], 0
lea r9, [rbp - 0x40]
mov qword [rsp + 0x28], rcx
lea rdx, str.Inst
lea rcx, [rbp - 0x48]
mov dword [rbp - 0x44], 4
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d008
cmp dword [rbp - 0x48], eax
jne 0x14001d030
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x50], 0
inc esi
mov edx, esi
lea r8, [rbp - 0x28]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x14001cf9d
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov rax, qword [rbp - 0x50]
test rax, rax
jne 0x14001d06a
test r14, r14
je 0x14001d06a
lea rax, [rbp - 0x50]
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rax, qword [rbp - 0x50]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002ab60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001d090
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x140088e00]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov qword [rbp - 0x11], rdx
and dword [rbp - 0x21], 0
call fcn.14000c274
mov rcx, rax
test rax, rax
je 0x14001d2c1
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [0x140064a18]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x39]
call fcn.14000b810
nop
mov ecx, 0x400
call fcn.14002abbc
mov rdi, rax
lea r13, [fcn.140006ef0]
mov qword [rsp + 0x20], r13
lea r9, [0x140013f80]
mov r12d, 8
mov r8d, r12d
mov edx, r12d
lea rcx, [rbp - 9]
call fcn.14002a63c
nop
test rdi, rdi
je 0x14001d23f
mov r8d, 0x200
mov rdx, rdi
lea rcx, str._USERPROFILE_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
call fcn.1400344b4
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp - 0x39]
call fcn.140010c98
mov rax, qword [rbp - 0x39]
cmp dword [rax - 0x10], 0
jle 0x14001d237
and dword [rbp - 0x31], 0
xor esi, esi
and qword [rbp - 0x29], rsi
lea r9, [rbp - 0x31]
lea r8, [0x140068cd4]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x39]
call fcn.1400160e0
nop
lea rdx, [0x140067a94]
mov rcx, qword [rbp - 0x29]
call fcn.1400406fc
test eax, eax
je 0x14001d20f
movsxd rax, esi
lea rcx, [rbp - 9]
lea rcx, [rcx + rax*8]
inc esi
lea rdx, [rbp - 0x29]
call fcn.1400132d8
lea r9, [rbp - 0x31]
lea r8, [0x140068cd4]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.1400160e0
nop
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.1400132d8
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001d195
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140064a18]
jmp 0x14001d195
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001d237
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140064a18]
mov rcx, rdi
call fcn.14002a134
mov rcx, qword [rbp + 7]
add rcx, 0xffffffffffffffe8
call fcn.140013574
add rax, 0x18
mov qword [rbx], rax
mov dword [rbp - 0x21], 1
mov r9, r13
mov r8, r12
mov rdx, r12
lea rcx, [rbp - 9]
call fcn.14002a064
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001d295
lfence
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [0x140064a18]
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14002ab60
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140009a24
int3
Function at 0x14001d2cc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rdx
and dword [rsp + 0x20], 0
xor eax, eax
mov qword [rdx], rax
call fcn.14000c274
mov rcx, rax
test rax, rax
je 0x14001d36e
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [0x140064a18]
add rax, 0x18
mov qword [rbx], rax
mov rcx, rbx
call fcn.14000b810
nop
mov dword [rsp + 0x20], 1
mov ecx, 0x400
call fcn.14002abbc
mov rdi, rax
test rax, rax
je 0x14001d360
mov r8d, 0x200
mov rdx, rax
lea rcx, str._USERPROFILE_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
call fcn.1400344b4
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.140010c98
mov rcx, rdi
call fcn.14002a134
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x80004005
call fcn.140009a24
int3

Function at 0x14001d4f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140088e00]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
lea rcx, [0x140068d28]
xor r8d, r8d
xor edx, edx
lea esi, [rbx + 2]
mov r9d, esi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14001d5eb
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], 0x20
xor edx, edx
mov rcx, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x14001d5e2
lea ebp, [rbx + 1]
mov dword [rsp + 0x28], 0x20019
mov r8d, ebp
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov rsi, rax
test rax, rax
je 0x14001d5e2
lea rax, [rsp + 0x34]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Inst
mov dword [rsp + 0x30], ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d5d9
cmp dword [rsp + 0x30], ebx
movzx eax, bl
cmovne eax, ebp
mov bl, al
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov al, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002ab60
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001e6dc
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140088e00]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
call fcn.14001d4b4
test eax, eax
je 0x14001e794
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEvent]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [rsp + 0x30], 0
mov edi, eax
jmp 0x14001e771
mov rcx, qword [rbx + 0x38]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x30], 0
je 0x14001e78c
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001e766
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0xffffffff
jb 0x14001e71e
cmp dword [rsp + 0x30], 0
je 0x14001e78c
mov eax, 1
jmp 0x14001e796
mov rcx, rbx
call fcn.14001b2c8
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14002ab60
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x14001fe20
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x140088e00]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, r8
mov rsi, rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rbx
lea r8, [0x140069180]
lea rcx, [rsp + 0x20]
call fcn.140013360
lea rdx, [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or rbp, 0xffffffffffffffff
mov ecx, ebp
lock xadd dword [rdx + 0x10], ecx
add ecx, ebp
test ecx, ecx
jg 0x14001fea0
lfence
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [0x140064a18]
cmp rdi, rbp
je 0x14001fed5
mov rax, qword [rbx]
cmp dword [rax - 0x10], 0
jle 0x14001fed5
lea rdx, [rsp + 0x6c]
mov rcx, qword [rbx]
call fcn.1400407f8
test eax, eax
je 0x14001ff53
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001feae
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
test eax, eax
jg 0x14001ff07
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140064a18]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
test eax, eax
jg 0x14001ff2e
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140064a18]
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14002ab60
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x2a0
pop rdi
pop rsi
pop rbp
ret
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
test eax, eax
jg 0x14001ff7b
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140064a18]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
test eax, eax
jg 0x14001ffa2
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140064a18]
mov eax, 1
jmp 0x14001ff30
Function at 0x140021090
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1400210b0
xor eax, eax
jmp 0x14002119c
cmp qword [rcx + 0x68], 0
je 0x1400210c4
lfence
call fcn.1400211b0
jmp 0x14002119c
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400210db
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400210dd
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002110f
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14002f580
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140021193
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140021146
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14002116f
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140040e14
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140021193
cmp rsi, rbx
ja 0x14002114d
test rsi, rsi
je 0x140021193
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140040e14
sub rsi, rax
sub rbp, rsi
mov rax, rbp
lfence
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret