joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1407ed058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407ed1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407ed089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407ed06f
add dl, dl
jne 0x1407ed096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407ed0f6
xor eax, eax
add dl, dl
jne 0x1407ed0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407ed1ad
add dl, dl
jne 0x1407ed0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ed0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ed0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ed0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407ed0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407ed07e
mov eax, 1
add dl, dl
jne 0x1407ed106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407ed113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407ed0fb
sub eax, ebx
mov ebx, 1
jne 0x1407ed14c
mov ecx, 1
add dl, dl
jne 0x1407ed12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407ed13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407ed123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407ed07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407ed168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407ed175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407ed15d
cmp eax, 0x7d00
jae 0x1407ed19b
cmp eax, 0x500
jb 0x1407ed196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407ed07e
cmp eax, 0x7f
ja 0x1407ed19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407ed07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407ed1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407ed07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140018150
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140152c30], rbx
je 0x1400181b7
cmp rax, rbx
jne 0x1400181aa
mov edi, 1
mov esi, edi
jmp 0x1400181bc
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14001818f
mov edi, 1
mov eax, dword [0x140152c38]
cmp eax, edi
jne 0x1400181d4
mov ebx, 0x1f
mov ecx, ebx
call fcn.1401f0000
jmp 0x14001824a
mov eax, dword [0x140152c38]
test eax, eax
jne 0x14001823f
mov dword [0x140152c38], edi
lea r15, [0x1400f67a8]
lea rbx, [0x1400f6790]
mov qword [rsp + 0x30], rbx
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rbx, r15
jae 0x140018231
test eax, eax
jne 0x140018235
cmp qword [rbx], r14
je 0x140018226
movabs r10, 0xd30527475e523070
mov rax, qword [rbx]
mov rcx, qword [0x1400f66b0]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x1400181fe
test eax, eax
je 0x140018245
mov eax, 0xff
jmp 0x1400183ab
mov dword [0x1401525dc], edi
mov ebx, 0x1f
mov eax, dword [0x140152c38]
cmp eax, edi
jne 0x140018271
lea rdx, [0x1400f6788]
lea rcx, [0x1400f66c8]
call sub.msvcrt.dll__initterm
mov dword [0x140152c38], 2
test esi, esi
jne 0x14001827f
mov rax, r14
xchg qword [0x140152c30], rax
cmp qword [0x140152c50], r14
je 0x1400182bc
lea rcx, [0x140152c50]
call fcn.140018c10
test eax, eax
je 0x1400182bc
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140152c50]
mov r9, qword [0x1400f66b0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x1400182d5
mov eax, 0xff
jmp 0x1400183ab
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14001835c
test ax, ax
je 0x1400182f0
test edx, edx
jne 0x14001835c
sub ax, di
cmp ax, bx
ja 0x140018306
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400182f0
test byte [rsp + 0x7c], dil
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140015d34
mov dword [0x1401525d8], eax
cmp dword [0x1401525f8], r14d
jne 0x140018345
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1401525dc], r14d
jne 0x14001835a
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1401525d8]
jmp 0x1400183ab
cmp ax, 0x22
jne 0x140018370
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400182de
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140018ca4
add rsp, 0x28
jmp 0x140018150
Function at 0x140018afc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140018b48
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140018b40
cmp dword [rcx + 0x3c], edx
jl 0x140018b40
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140018b40
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140018b48
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140018c70
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140018c98
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140018c98
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14001a944
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
and qword [rcx + 0x18], 0
mov rbx, rcx
and qword [rcx + 0x20], 0
xor edx, edx
and qword [rcx + 0x28], 0
mov r8d, 0x800
and qword [rcx + 0x30], 0
and qword [rcx + 0x38], 0
mov byte [rcx + 0x10], 0
lea rcx, str.amsi.dll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
mov qword [rbx], rax
test rax, rax
je 0x14001aa70
lea rdx, str.AmsiInitialize
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbx]
lea rdx, str.AmsiUninitialize
mov qword [rbx + 0x18], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbx]
lea rdx, str.AmsiScanBuffer
mov qword [rbx + 0x28], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbx]
lea rdx, str.AmsiOpenSession
mov qword [rbx + 0x20], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbx]
lea rdx, str.AmsiCloseSession
mov qword [rbx + 0x30], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
cmp qword [rbx + 0x18], 0
mov qword [rbx + 0x38], rax
je 0x14001aa5b
cmp qword [rbx + 0x20], 0
je 0x14001aa5b
cmp qword [rbx + 0x28], 0
je 0x14001aa5b
cmp qword [rbx + 0x30], 0
je 0x14001aa5b
test rax, rax
je 0x14001aa5b
lea rdx, [rbx + 8]
movabs r10, 0xec093f3d52532070
mov rax, qword [rbx + 0x18]
lea rcx, str.VSSAMSI
call qword [0x1400f66b0]
test eax, eax
js 0x14001aa5b
mov byte [rbx + 0x10], 1
cmp byte [rbx + 0x10], 0
jne 0x14001aa70
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400c3050
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x810]
sub rsp, 0x910
mov rax, qword [0x140152408]
xor rax, rsp
mov qword [rbp + 0x800], rax
mov r15, rcx
call qword [sym.imp.VssTrace.DLL_Ordinal_11]
nop dword [rax + rax]
cmp eax, dword [r15 + 4]
je 0x1400c31d8
mov rdx, qword [r15 + 0x28]
lea r8, [rsp + 0x50]
mov ecx, dword [r15 + 0x24]
xor r12d, r12d
mov dword [rsp + 0x50], r12d
mov dword [r15 + 4], eax
call qword [sym.imp.VssTrace.DLL_Ordinal_8]
nop dword [rax + rax]
test eax, eax
je 0x1400c30ca
mov eax, dword [rsp + 0x50]
jmp 0x1400c30e6
mov rcx, qword [r15 + 0x60]
test rcx, rcx
je 0x1400c30da
call fcn.14001a4d0
jmp 0x1400c30e6
call qword [sym.imp.VssTrace.DLL_Ordinal_6]
nop dword [rax + rax]
mov dword [r15], eax
mov eax, dword [r15 + 4]
cmp dword [0x140152420], eax
je 0x1400c31d8
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x800
call sub.msvcrt.dll_memset
lea rdx, [rbp]
call fcn.1400bf570
mov ebx, dword [r15 + 4]
mov edi, dword [0x140152420]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
nop dword [rax + rax]
mov r14, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
mov r12d, 0x78
mov dword [rsp + 0x70], 0x24f
mov esi, eax
mov dword [rsp + 0x74], reloc.VssTrace.DLL_Ordinal_11
lea rax, str.base_stor_vssmodules_trace_fntracer.cpp
mov dword [rsp + 0x78], 0xff
mov qword [rsp + 0x58], rax
lea rcx, [rbp - 0x80]
lea rax, str.CVssFunctionTracer::UpdateLocalIsTracingEnabledFlag
mov dword [rbp - 8], 0x1000000
mov qword [rsp + 0x60], rax
mov r8d, r12d
lea rax, str.TRCTRCC
xor edx, edx
mov qword [rsp + 0x68], rax
call sub.msvcrt.dll_memset
mov dword [rsp + 0x48], ebx
lea rax, [rbp]
mov dword [rsp + 0x40], edi
lea r8, str.TRACING_STARTED
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x30], r14
lea rax, str.Tracing_started_or_updated._PID_d__CommandLine__s___UserName__s_._SQN__d_____d_
mov dword [rsp + 0x28], esi
mov r9d, r12d
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.140007d70
mov eax, dword [r15 + 4]
mov dword [0x140152420], eax
mov rcx, qword [rbp + 0x800]
xor rcx, rsp
call fcn.140018410
lea r11, [rsp + 0x910]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140003910
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140023010]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWARERESOURCEMAPSystem_ResourcesPhysical_Memory
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rsp + 0x78]
mov ecx, eax
call fcn.140017ef0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x38]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0
jmp 0x140003a07
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x30], eax
jae 0x140003a43
mov rax, qword [rsp + 0x40]
add rax, 8
mov r9, rax
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [0x140023dd0]
call fcn.140007d20
mov rax, qword [rsp + 0x40]
add rax, 0x14
mov qword [rsp + 0x40], rax
jmp 0x1400039fd
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.140017b4c
cmp qword [rsp + 0x50], 0
jne 0x140003a6a
mov qword [rsp + 0x60], 0
jmp 0x140003a7d
mov qword [rsp + 0x38], 0x8123
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140017af0
add rsp, 0xa8
ret
Function at 0x140003ab0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x140023010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x28]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000004
jne 0x140003b56
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x50]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x28]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
jmp 0x140003afa
cmp dword [rsp + 0x30], 0
jge 0x140003b77
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140003c6d
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x140003b95
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x140003c58
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 8]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x128
mov rdx, qword [rsp + 0x38]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140006240
lea rcx, [rsp + 0x58]
call fcn.140006080
mov rdx, qword [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140003c49
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x58]
call fcn.140006210
mov rax, qword [rsp + 0x48]
jmp 0x140003c6d
lea rcx, [rsp + 0x58]
call fcn.140006210
jmp 0x140003b8b
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140017af0
add rsp, 0x88
ret
Function at 0x140004aa0
Capabilities:
Load ntoskrnl

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
mov rax, qword [0x140023010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, [0x140023c38]
call fcn.140005a80
test rax, rax
jne 0x140004ae6
movzx eax, word [0x140023c4c]
test eax, eax
jne 0x140004ae6
cmp qword [0x140023da8], 0
je 0x140004aeb
jmp 0x140004ccb
mov r8b, 1
mov rdx, qword [str.NtShutdownSystem]
lea rcx, [0x14001a970]
call fcn.140003c90
mov dword [0x140023db0], eax
xor edx, edx
mov eax, dword [0x140023db0]
mov ecx, 0x1000
div ecx
mov eax, edx
mov word [0x140023c4c], ax
mov r8d, 1
xor edx, edx
lea rcx, [0x14001a980]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x140023da8], rax
mov edx, 0x18
lea rcx, [rsp + 0x98]
call fcn.1400023b0
lea rcx, [rsp + 0x98]
call fcn.140002360
nop
lea rax, [0x140023dd0]
mov qword [rsp + 0x38], rax
mov edx, 8
lea rcx, [rsp + 0x90]
call fcn.1400023b0
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x38]
call fcn.140005e60
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x38]
call fcn.140005e30
jmp 0x140004bac
lea rcx, [rsp + 0x90]
call fcn.140005db0
movzx edx, byte [rsp + 0x88]
lea rcx, [rsp + 0x90]
call fcn.140005df0
movzx eax, al
test eax, eax
je 0x140004c61
lea rcx, [rsp + 0x90]
call fcn.140005dd0
lea rcx, [rsp + 0xb0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x48], rax
lea rax, [0x140004d20]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.140008d60
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x98]
call fcn.140004cf0
nop
lea rcx, [rsp + 0x78]
call fcn.1400036a0
jmp 0x140004b9f
lea rax, [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.140003250
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x40]
call fcn.140005a50
mov qword [rsp + 0x68], rax
jmp 0x140004c9c
mov rax, qword [rsp + 0x30]
add rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x30], rax
je 0x140004cbe
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.140003760
jmp 0x140004c8e
lea rcx, [rsp + 0x98]
call fcn.140005a60
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140017af0
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x14000b410
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140023010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.1400023b0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.14000c840
nop
lea rax, [0x14000c8e0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.140003250
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14000b4d4
lea rcx, [rsp + 0x40]
call fcn.14000bc10
jmp 0x14000b4ec
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x40]
call fcn.14000bc40
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140017af0
add rsp, 0x58
ret
Function at 0x14000dfa0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140023010]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWARERESOURCEMAPSystem_ResourcesPhysical_Memory
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rsp + 0x78]
mov ecx, eax
call fcn.140017ef0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x38]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0
jmp 0x14000e097
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x30], eax
jae 0x14000e0d3
mov rax, qword [rsp + 0x40]
add rax, 8
mov r9, rax
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [0x140023de8]
call fcn.140007d20
mov rax, qword [rsp + 0x40]
add rax, 0x14
mov qword [rsp + 0x40], rax
jmp 0x14000e08d
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.140017b4c
cmp qword [rsp + 0x50], 0
jne 0x14000e0fa
mov qword [rsp + 0x60], 0
jmp 0x14000e10d
mov qword [rsp + 0x38], 0x8123
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140017af0
add rsp, 0xa8
ret
Function at 0x14000f620
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140023010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x140023ed0], eax
jle 0x14000f697
lea rcx, [0x140023ed0]
call fcn.140017c28
cmp dword [0x140023ed0], 0xffffffff
jne 0x14000f697
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [0x140023eb0]
call fcn.140006240
lea rcx, [0x140019970]
call fcn.140017ed8
nop
lea rcx, [0x140023ed0]
call fcn.140017bbc
lea rcx, [0x140023eb0]
call fcn.140006080
lea r8, [rsp + 0x38]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x60]
call fcn.140006080
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x14000f702
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14000f702
mov dword [rsp + 0x20], 1
jmp 0x14000f70a
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140017af0
add rsp, 0x58
ret