joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005d140
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14005d14d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14005d15d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14005d145
lea eax, [rcx + 1]
jmp 0x14005d16b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14005d17e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14005d164
sub eax, 3
jb 0x14005d19e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14005d1ed
sar eax, 1
movsxd rbp, eax
jb 0x14005d1d4
jmp 0x14005d1ac
add ebx, ebx
jne 0x14005d1aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14005d1d4
inc ecx
add ebx, ebx
jne 0x14005d1ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14005d1d4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14005d1cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14005d1bc
add ecx, 2
jmp 0x14005d1d9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14005d102
jmp 0x14005d14d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x32600
mov dl, 7
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14005d23d
cmp rsi, rcx
jae 0x14005d245
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14005d224
cmp al, 0x8f
ja 0x14005d224
cmp byte [rsi - 2], 0xf
je 0x14005d22a
sub al, 0xe8
cmp al, 1
ja 0x14005d20e
cmp rsi, rcx
jae 0x14005d245
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14005d214
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14005d245
lodsb al, byte [rsi]
jmp 0x14005d224
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x5a000]
mov eax, dword [rdi]
or eax, eax
je 0x14005d2a2
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x5d228]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14005d252
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14005d29c
mov qword [rbx], rax
add rbx, 8
jmp 0x14005d272
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14005d2dc
cmp al, 0xef
ja 0x14005d2ce
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14005d2ae
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14005d2bd
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14005d35b], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14005d35b
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14005d34b
sub rsp, 0xffffffffffffff80
jmp 0x140001125
Function at 0x14000e060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov word [rsp + 0x18], r8w
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rbp, qword [rsp + 0xf0]
mov r11, r9
mov r15, qword [rsp + 0xf8]
xor r9d, r9d
mov rdi, rdx
mov qword [rsp + 0x38], r9
xor edx, edx
mov dword [rsp + 0xd0], r9d
mov r8, qword [rbp + 0x38]
lea rax, [r11 - 0x50]
mov r10d, dword [r15 + 0xd0]
mov r13d, r9d
mov r14, qword [rbp + 0x30]
mov r12d, r10d
mov qword [rsp + 0x50], rax
mov esi, r9d
mov rax, r8
shr r12d, 0x13
div r11
mov dword [r14 + 0x30], r9d
and r12d, 1
mov dword [r14 + 0x6c], r9d
shr r10d, 0x11
and r10d, 1
mov dword [rsp + 0xd8], r9d
sub r8, rdx
mov dword [rsp + 0xf8], r10d
mov qword [rsp + 0x40], r8
lea rbx, [r8 + r14]
mov r8d, 0xffffffff
mov dword [r14 + 0x68], r8d
mov r8d, r9d
mov qword [r14 + 0x50], rcx
mov qword [r14 + 0x58], rcx
mov qword [r14 + 0x60], r9
mov qword [r14 + 0x78], r9
mov qword [r14 + 0x70], 0xffffffffffffffff
mov qword [rsp + 0x48], rbx
Function at 0x14001f3e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
mov r10d, dword [rcx + 0x1d0]
lea rsi, [0x140000000]
mov r8, rcx
test r10d, r10d
jne 0x14001f419
cmp dword [rcx + 0x1d8], r10d
jne 0x14001f419
movzx r9d, byte [rdx]
mov rcx, qword [rcx + 0x90]
mov eax, r9d
movzx r8d, byte [rcx + r9]
jmp 0x14001f53d
movzx r9d, byte [rdx]
mov qword [rsp + 0x10], rbx
mov eax, r9d
mov qword [rsp + 0x18], rdi
test r10d, r10d
je 0x14001f4f1
cmp eax, 0xc0
jb 0x14001f4f1
movzx ecx, byte [rdx + 1]
test al, 0x20
jne 0x14001f45b
movzx edx, cl
and eax, 0x1f
and edx, 0x3f
mov ecx, eax
shl ecx, 6
mov eax, edx
jmp 0x14001f4ef
movzx ebx, byte [rdx + 2]
test al, 0x10
jne 0x14001f47a
movzx edx, cl
and eax, 0xf
mov ecx, eax
and edx, 0x3f
shl ecx, 6
mov eax, edx
or eax, ecx
movzx ecx, bl
jmp 0x14001f4e9
movzx r11d, cl
movzx ecx, bl
and r11d, 0x3f
movzx ebx, byte [rdx + 3]
and ecx, 0x3f
and ebx, 0x3f
test al, 8
jne 0x14001f4a8
and eax, 7
shl eax, 6
or eax, r11d
shl eax, 6
or eax, ecx
shl eax, 6
or eax, ebx
jmp 0x14001f4f1
movzx edi, byte [rdx + 4]
and edi, 0x3f
test al, 4
jne 0x14001f4cd
and eax, 3
shl eax, 6
or eax, r11d
shl eax, 6
or eax, ecx
shl eax, 6
or eax, ebx
shl eax, 6
or eax, edi
jmp 0x14001f4f1
and eax, 1
shl eax, 6
or eax, r11d
shl eax, 6
or eax, ecx
movzx ecx, byte [rdx + 5]
shl eax, 6
or eax, ebx
shl eax, 6
or eax, edi
shl eax, 6
and ecx, 0x3f
or eax, ecx
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov edx, eax
cmp eax, 0x7f
ja 0x14001f510
mov rcx, qword [r8 + 0x90]
movzx r8d, byte [rcx + rdx]
jmp 0x14001f53d
shr rdx, 7
mov ecx, eax
and ecx, 0x7f
movzx edx, word [rsi + rdx*2 + 0x5c570]
shl edx, 7
add edx, ecx
movzx ecx, word [rsi + rdx*2 + 0x60970]
lea rdx, [rcx + rcx*2]
mov r8d, dword [rsi + rdx*4 + 0x58364]
add r8d, eax
xor r8d, eax
cmp eax, 0x7f
ja 0x14001f550
cmp r8d, 0x20
jne 0x14001f550
mov eax, r8d
pop rsi
ret
lea ecx, [r8 - 1]
test r8d, ecx
je 0x14001f55d
xor eax, eax
pop rsi
ret
test r10d, r10d
je 0x14001f594
cmp eax, 0x7f
jbe 0x14001f594
movzx eax, r9b
and eax, 0x3f
movzx eax, byte [rax + rsi + 0x73d40]
test r8b, 0x3f
jne 0x14001f58c
nop dword [rax]
dec eax
shr r8d, 6
test r8b, 0x3f
je 0x14001f580
shl eax, 8
or eax, r8d
pop rsi
ret
mov eax, r8d
pop rsi
ret
Function at 0x140043be0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
test rcx, rcx
je 0x140043cdb
lea rax, [rdx - 1]
cmp rax, 0xffffffffffffdffe
ja 0x140043cdb
cmp rcx, rdx
mov rsi, rdx
mov rdx, r8
cmovbe rsi, rcx
mov ecx, 0x20
add rsi, 0x1fff
and rsi, 0xffffffffffffe000
call fcn.140002000
mov rdi, rax
test rax, rax
je 0x140043cdb
mov qword [rsp + 0x60], rbp
lea rbp, [rbx + 0x1fff]
and rbp, 0xffffffffffffe000
cmp rsi, rbp
ja 0x140043cc1
cmp rsi, 1
jb 0x140043cc1
mov rdx, qword [rax + 0x10]
mov ecx, 0x20
call qword [rax]
mov rbx, rax
test rax, rax
je 0x140043cc1
mov rax, qword [0x14007d6f8]
test rax, rax
jne 0x140043c92
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
dec rax
mov qword [0x14007d6f8], rax
add rbp, rax
mov r9d, 4
not rax
mov r8d, 0x2000
and rbp, rax
xor ecx, ecx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rbx
test rax, rax
jne 0x140043ced
mov rdx, qword [rdi + 0x10]
call qword [rdi + 8]
xor ebx, ebx
mov rbp, qword [rsp + 0x60]
mov qword [rdi + 0x18], rbx
test rbx, rbx
jne 0x140043d20
mov rdx, qword [rdi + 0x10]
mov rcx, rdi
call qword [rdi + 8]
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rdx, [rax + rbp]
mov qword [rbx + 0x18], rax
mov qword [rbx + 8], rdx
mov qword [rbx + 0x10], rdx
sub rdx, rsi
call fcn.140049160
test rax, rax
jne 0x140043d17
mov rdx, rdi
mov rcx, rbx
call fcn.1400489e0
jmp 0x140043cc1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x140043cc3
mov rbx, qword [rsp + 0x68]
mov rax, rdi
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140048860
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
xor eax, eax
lock cmpxchg qword [0x14007d6f0], rdi
jne 0x14004889f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rcx, rax
xor eax, eax
lock cmpxchg qword [0x14007d6f0], rcx
je 0x14004889f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14007d6f0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx - 0x10]
lea rax, [rbx - 0x10]
sub qword [0x14007d708], rcx
mov r9, rax
sub r9, qword [rax + 8]
cmp qword [r9], rdi
jne 0x1400488de
add qword [r9 + 0x20], rcx
lea r8, [r9 + 0x20]
mov rax, qword [r8]
mov qword [rax + r9 + 8], rax
jmp 0x140048909
lea r8, [rax + 0x20]
mov r9, rax
mov qword [r8], rcx
mov rcx, qword [0x14007d700]
mov qword [rax], rdi
mov qword [rbx], rcx
mov qword [rax + 0x18], rdi
test rcx, rcx
je 0x140048902
mov qword [rcx + 0x18], rax
mov qword [0x14007d700], rax
mov rcx, qword [r8]
cmp qword [rcx + r9], rdi
lea rdx, [rcx + r9]
jne 0x140048954
add rcx, qword [rdx + 0x20]
mov qword [r8], rcx
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x140048932
mov rax, qword [rdx + 0x18]
mov qword [rcx + 0x18], rax
mov rcx, qword [rdx + 0x10]
mov rax, qword [rdx + 0x18]
test rax, rax
je 0x140048941
mov qword [rax + 0x10], rcx
jmp 0x140048948
mov qword [0x14007d700], rcx
mov rax, qword [r8]
mov qword [rax + r9 + 8], rax
lea rdx, [rax + r9]
cmp qword [r9 + 8], rdi
jne 0x1400489c0
cmp qword [rdx], 1
jne 0x1400489c0
mov rax, qword [0x14007d708]
mov rdx, qword [0x14007d710]
sub rdx, qword [r8]
lea rcx, [rax + rax*2]
shr rcx, 1
cmp rdx, rcx
jbe 0x1400489c0
mov rcx, qword [r9 + 0x10]
mov qword [0x14007d710], rdx
test rcx, rcx
je 0x140048999
mov rax, qword [r9 + 0x18]
mov qword [rcx + 0x18], rax
mov rcx, qword [r9 + 0x10]
mov rax, qword [r9 + 0x18]
test rax, rax
je 0x1400489a8
mov qword [rax + 0x10], rcx
jmp 0x1400489af
mov qword [0x14007d700], rcx
xor edx, edx
mov r8d, 0x8000
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [0x14007d6f0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmpsd dword [rsi], dword [rdi]
invalid
invalid
invalid
xchg esp, eax
invalid
movsb byte [rdi], byte [rsi]
sub byte es:[0xf24de75c], cl
invalid
out 0x8b, eax
pushfq
pop rdx
sub al, 0xa0
sub al, 0xa0
adc byte [rdi], bl
invalid
cmp al, 0x6d
cdq
mov edx, 0xffff2082
invalid
int3
stosb byte [rdi], al
jne 0x1400c7e40
in al, dx
jl 0x1400c7e3e
int1
invalid
movsd dword [rdi], dword [rsi]
cmp dh, byte [rax + 0x795d3042]
mov al, 0x42
xor byte [rbp + 0x79], bl
lock add byte [rax], al
invalid
Function at 0x140048f70
Capabilities:
Allocate or change rwx memory
Check mutex on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
xor eax, eax
lock cmpxchg qword [0x14007d6f0], rbp
jne 0x140048fb4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rcx, rax
xor eax, eax
lock cmpxchg qword [0x14007d6f0], rcx
je 0x140048fb4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14007d6f0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, 0x30
cmp rbx, rdi
cmovae rdi, rbx
mov rbx, qword [0x14007d700]
add rdi, 0x17
and rdi, 0xfffffffffffffff8
test rbx, rbx
je 0x140048ff8
mov rcx, qword [rbx + 0x20]
cmp rcx, rdi
jae 0x140049042
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140048fe6
lea rbx, [rdi + 0x1000f]
mov qword [rsp + 0x30], rsi
and rbx, 0xffffffffffff0000
mov r9d, 0x40
mov rdx, rbx
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1400490b9
mov rcx, qword [0x14007d6f0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x14004913c
lea rax, [rdi + 0x40]
cmp rcx, rax
jbe 0x140049060
sub rcx, rdi
mov qword [rbx + 0x20], rcx
add rbx, rcx
mov qword [rbx + 8], rcx
mov qword [rbx + rdi + 8], rdi
jmp 0x14004908e
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x140049075
mov rax, qword [rbx + 0x18]
mov qword [rdx + 0x18], rax
mov rdx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x140049084
mov qword [rax + 0x10], rdx
jmp 0x14004908b
mov qword [0x14007d700], rdx
mov rdi, rcx
add qword [0x14007d708], rdi
mov qword [rbx], rdi
mov rcx, qword [0x14007d6f0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rbx + 0x10]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
sub rbx, 0x10
mov qword [rax + 8], rbp
add qword [0x14007d710], rbx
lea rax, [rdi + 0x40]
cmp rbx, rax
jbe 0x140049112
mov rcx, qword [0x14007d700]
lea rax, [rsi + rdi]
add qword [0x14007d708], rdi
sub rbx, rdi
mov qword [rsi], rdi
mov qword [rax + 8], rdi
mov qword [rax], rbp
mov qword [rax + 0x20], rbx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rbp
test rcx, rcx
je 0x140049105
mov qword [rcx + 0x18], rax
mov qword [0x14007d700], rax
lea rcx, [rbx + rax]
jmp 0x140049120
add qword [0x14007d708], rbx
lea rcx, [rsi + rbx]
mov qword [rsi], rbx
mov qword [rcx], 1
mov qword [rcx + 8], rbx
mov rcx, qword [0x14007d6f0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsi + 0x10]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140049160
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
cmp rdx, qword [rcx + 0x18]
jb 0x1400491d5
cmp rdx, qword [rcx + 8]
jae 0x1400491d5
mov rax, qword [0x14007d6f8]
test rax, rax
jne 0x1400491a1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
dec rax
mov qword [0x14007d6f8], rax
mov r10, qword [rdi + 0x10]
not rax
mov rcx, rax
and r10, rax
and rcx, rbx
cmp rcx, r10
je 0x1400491fb
jae 0x1400491e2
sub r10, rcx
mov r9d, 4
mov rdx, r10
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1400491fb
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
sub rcx, r10
mov r8d, 0x4000
mov rdx, rcx
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x1400491d5
mov qword [rdi + 0x10], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x2fc4d8ae0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d94e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fc108]
test eax, eax
je 0x2fc4d957a
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fc110]
mov qword [rbp - 8], rax
jmp 0x2fc4d955e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d9552
cmp qword [rbp - 0x10], 0
je 0x2fc4d9552
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d9518
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d957b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d9680
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d96a8
mov eax, 0
jmp 0x2fc4d96f6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d96d1
mov eax, 0
jmp 0x2fc4d96f6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d96f1
mov eax, 0
jmp 0x2fc4d96f6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d96fc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d977a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d9771
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d9771
mov rax, qword [rbp - 8]
jmp 0x2fc4d978f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d9744
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140003444
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x140031f88]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, rcx
mov rdi, rdx
mov rcx, rdx
mov ebx, 0x3f2
call qword [sym.imp.msvcrt.dll_wcslen]
nop dword [rax + rax]
test rax, rax
je 0x140003558
lea rax, [rsp + 0x48]
mov r9d, 0x1000a
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140003558
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x800
call fcn.14001afe6
and qword [rsp + 0x38], 0
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
and qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rsp + 0x48]
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0x400
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x103
je 0x14000352d
test eax, eax
jne 0x140003527
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
call fcn.140003444
mov ebx, eax
test ebx, ebx
je 0x1400034ba
jmp 0x140003547
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.14001af60
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140003588
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rcx
mov rsi, r8
mov rcx, rdx
mov rdi, rdx
mov ebx, 0x3f2
call qword [sym.imp.msvcrt.dll_wcslen]
nop dword [rax + rax]
test rax, rax
je 0x140003616
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov r9d, 0x10002
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140003616
mov rcx, qword [rsp + 0x58]
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000c2a8
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x378]
sub rsp, 0x470
mov rax, qword [0x140031f88]
xor rax, rsp
mov qword [rbp + 0x360], rax
cmp qword [rcx + 0x50], 0
mov rsi, rcx
mov ebx, 1
jne 0x14000c466
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x20a
call fcn.14001afe6
mov edi, 0x105
lea rcx, [rbp + 0x150]
mov edx, edi
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov r11d, eax
cmp eax, edi
jb 0x14000c329
mov ebx, 0x8000ffff
jmp 0x14000c466
lea r9, [rbp + 0x150]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14000a170
mov ebx, eax
test eax, eax
js 0x14000c466
cmp word [rsp + r11*2 + 0x40], 0x5c
je 0x14000c38a
lea r8, [rsp + 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14000a0fc
mov ebx, eax
test eax, eax
js 0x14000c38a
mov rax, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov rdx, rdi
lea r9, [0x140021b58]
sub rdx, rax
lea rcx, [rcx + rax*2]
call fcn.14000a170
mov ebx, eax
test ebx, ebx
js 0x14000c466
lea r8, [rsp + 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14000a0fc
mov ebx, eax
test eax, eax
js 0x14000c3cc
mov rax, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
sub rdi, rax
lea r9, str.PSAPI.DLL
mov rdx, rdi
lea rcx, [rcx + rax*2]
call fcn.14000a170
mov ebx, eax
test ebx, ebx
js 0x14000c466
xor r8d, r8d
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
mov qword [rsi + 0x50], rax
test rax, rax
jne 0x14000c3fa
mov ebx, 0x80070485
jmp 0x14000c466
lea rdx, str.EnumProcesses
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rsi + 0x50]
lea rdx, str.EnumProcessModules
mov qword [rsi + 0x58], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rsi + 0x50]
lea rdx, str.GetModuleBaseNameW
mov qword [rsi + 0x60], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
cmp qword [rsi + 0x58], 0
mov qword [rsi + 0x68], rax
je 0x14000c461
cmp qword [rsi + 0x60], 0
je 0x14000c461
test rax, rax
je 0x14000c461
xor ebx, ebx
jmp 0x14000c466
mov ebx, 0x8007007f
cmp qword [rsi + 0x78], 0
jne 0x14000c48c
xor edx, edx
lea rcx, str.loadperf.dll
mov r8d, 0x800
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
mov qword [rsi + 0x78], rax
mov eax, ebx
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.14001af60
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret