joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004c24
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
mov edx, 0xa1e47bc1
mov r8d, 0xd64c8aa7
mov ecx, 0x309b40ce
call fcn.1400010f0
lea r8, [0x140129d88]
lea rcx, [rsp + 0x40]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
xor esi, esi
mov rcx, 0xffffffff80000001
mov word [rdi], si
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140004cfa
mov edx, 0xcffa7424
mov ecx, 0x5e854f11
mov r8d, 0xb852854b
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], InitCommonControls
call fcn.1400010f0
mov rcx, qword [rsp + 0x38]
mov rdx, rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140004cf7
cmp dword [rsp + 0x30], 1
je 0x140004cfa
mov word [rdi], si
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140004d20
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
mov edx, 0xef99a7c0
mov r8d, 0x983156a6
mov ecx, 0x7ee69ce1
call fcn.1400010f0
lea r8, [0x140129d88]
lea rcx, [rsp + 0x40]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
xor ecx, ecx
test eax, eax
jne 0x140004e07
test rdi, rdi
je 0x140004dd9
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], cx
jne 0x140004d92
mov edx, 0xd334b8fc
mov ecx, 0x424b83b3
mov r8d, 0xa49c4993
lea ebx, [rax*2 + 2]
call fcn.1400010f0
mov rcx, qword [rsp + 0x30]
mov rdx, rax
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140004dfc
mov edx, 0x6dc619d1
mov ecx, 0xfcb922aa
mov r8d, 0x1a6ee8be
call fcn.1400010f0
mov rcx, qword [rsp + 0x30]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x140005614
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, ecx
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.14000d8c0
cmp eax, 1
jne 0x140005677
mov edx, 0x7039055f
mov r8d, 0x1e21bad5
mov ecx, 0xa1e22271
mov dword [rsp + 0x48], ebx
call fcn.1400014e0
lea rcx, [rsp + 0x48]
mov r9d, 4
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x140005680
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14000d8c0
cmp eax, 1
jne 0x1400056e3
mov edx, 0xcfd2c89a
mov r8d, 0xa1ca7717
mov ecx, 0x1e09efe4
call fcn.1400014e0
mov rcx, qword [rsp + 0x40]
mov r9d, 0xb
mov rdx, rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret

Function at 0x1400056e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov bl, dl
mov rdi, rcx
test dl, dl
jne 0x140005738
mov ecx, 1
call fcn.140025730
test eax, eax
jle 0x14000580d
mov ecx, eax
call fcn.140005614
movabs r8, 0x2000600050007
lea rdx, [0x140129d88]
lea rcx, [rsp + 0x50]
call fcn.1400247e8
nop
test bl, bl
jne 0x1400057d3
and qword [rsp + 0x40], 0
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.14000d8c0
cmp eax, 1
jne 0x1400057c9
mov dword [rsp + 0x34], InitCommonControls
mov dword [rsp + 0x30], 8
mov edx, 0xdd2fa1e1
mov ecx, 0xcf48675
mov r8d, 0xb3371e6c
call fcn.1400014e0
mov rdx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rsp + 0x58], rax
mov r8, rdi
lea rdx, str.https:__www.xreveal.com_update_xreveal.txt
lea rcx, [rsp + 0x50]
call fcn.1400248b4
nop
lea rcx, [rsp + 0x50]
call fcn.140024864
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140007fb0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0x40
mov rdx, rdi
shl eax, 0x10
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
mov rcx, rdi
movsxd rbx, eax
call fcn.140007f54
test ebx, ebx
jle 0x140007ff3
mov eax, 0x2b
mov word [rdi + rbx*2], ax
inc ebx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140008000
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov esi, r8d
mov edi, edx
mov rbx, rcx
test r8d, r8d
jne 0x140008036
test edx, edx
jne 0x140008036
mov word [rcx], r14w
jmp 0x1400080f8
test sil, 2
je 0x140008050
mov rdx, rcx
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call fcn.140007fb0
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
mov ebp, 1
test bpl, sil
je 0x14000806c
lea ecx, [rbp + 0xf]
mov rdx, rbx
call fcn.140007fb0
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
test sil, 4
je 0x140008086
mov rdx, rbx
mov ecx, 0x12
call fcn.140007fb0
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
lea eax, [rdi - 0x30]
cmp eax, 9
jbe 0x1400080e9
lea eax, [rdi - 0x41]
cmp eax, 0x19
jbe 0x1400080e9
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp edi, 0x2e
ja 0x1400080b5
movabs rdx, 0x71fe00000000
bt rdx, rdi
jb 0x1400080c5
cmp edi, 0xbc
je 0x1400080c5
cmp edi, 0xbe
jne 0x1400080c9
bts eax, 8
shl eax, 0x10
mov r8d, 0x40
mov rdx, rbx
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
mov rcx, rbx
mov ebp, eax
call fcn.140007f54
jmp 0x1400080f1
mov word [rbx], di
mov word [rbx + 2], r14w
movsxd rcx, ebp
lea rbx, [rbx + rcx*2]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x140008600
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
movzx r14d, dx
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetMessagePos]
xor edx, edx
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x50], 0x50
lea r8d, [rdx + 0x48]
mov ebx, eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x54], 0x43
call fcn.1400ebf40
lea rax, [rbp - 0x60]
mov qword [rbp - 0x78], rax
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov edx, 0x2480c2bd
mov ecx, 0x20fef4c1
mov r8d, 0x9eb2732c
mov rdi, rax
call fcn.140001288
lea rdx, [rbp - 0x60]
sub rdx, rax
xor r15d, r15d
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000868f
lea r9, [rsp + 0x50]
mov r8d, 1
or edx, 0xffffffff
mov rcx, rdi
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x5c], r15d
call qword [sym.imp.USER32.dll_InsertMenuItemW]
movsx r9d, word [rsp + 0x42]
mov qword [rsp + 0x30], r15
movsx r8d, bx
mov edx, 0x180
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_DestroyMenu]
cmp ebx, 1
jne 0x1400087aa
mov edx, 0xb08b6086
mov ecx, 0xb4f5563c
mov r8d, 0xab9d102
call fcn.140001288
lea rdx, [rbp - 0x60]
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000871a
lea rcx, [rbp - 0x50]
call fcn.1400319b0
mov edx, 0xa81ee654
mov ecx, 0xac60d0da
mov r8d, 0x122c57d2
movzx ebx, r14w
mov rdi, rax
call fcn.140001288
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0xa1035462
mov ecx, 0xa57d6280
mov r8d, 0x1b31e5e6
call fcn.140001288
mov edx, 0xb9790ca9
mov ecx, 0xbd073a3f
mov r8d, 0x34bbd21
mov rbx, rax
call fcn.140001288
lea r9, [rbp - 0x60]
mov r8, rbx
xor ecx, ecx
mov rdx, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x310]
add rsp, 0x2d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400087d0
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x58]
sub rsp, 0x150
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov esi, ecx
mov edx, 0x76c8c3f4
mov r8d, 0xa891a7d9
mov ecx, 0x1b749036
call fcn.140001390
lea rdx, [rsp + 0x40]
sub rdx, rax
xor r14d, r14d
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000881f
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], r14w
jne 0x14000883b
lea rdi, [rsp + 0x40]
mov edx, 0x6e400604
mov ecx, 0x3fc55aa
mov r8d, 0xb0196210
lea rdi, [rdi + rax*2]
call fcn.140001390
sub rdi, rax
movzx ecx, word [rax]
mov word [rdi + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140008866
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
test esi, esi
je 0x140008960
lea r8, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140008966
lea rdx, [rsp + 0x40]
mov r8d, pe_nt_image_headers64
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x40]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400088b8
mov rcx, qword [rsp + 0x30]
lea eax, [rax*2 + 2]
mov edi, 1
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov r9d, edi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [rdi + 0x5b]
lea rcx, [rsp + 0x40]
call fcn.1400e9f08
test rax, rax
je 0x140008953
mov word [rax + 2], r14w
lea rax, [rsp + 0x40]
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x14000890b
mov edx, 0x925548bd
mov ecx, 0xffe91bf9
mov r8d, 0x4c0c2ca0
lea ebx, [rbx*2 + 2]
call fcn.140001390
mov rcx, qword [rsp + 0x30]
mov rdx, rax
lea rax, [rsp + 0x40]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140008966
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140008990
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov edx, 0x6eeecc43
mov ecx, 0x3529f4b
mov r8d, 0xb0b7a815
xor ebx, ebx
call fcn.140001390
lea r9d, [rbx + 1]
mov rdx, rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400089e2
xor eax, eax
jmp 0x140008abb
mov edx, 0xbaa70783
mov ecx, 0xd71b5529
mov r8d, 0x64fe6396
call fcn.140001390
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
mov rdx, rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008aae
cmp dword [rsp + 0x40], ebx
jbe 0x140008aae
mov edx, dword [rsp + 0x40]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, 0x921d8636
mov ecx, 0xffa1d470
mov r8d, 0x4c44e223
mov rdi, rax
call fcn.140001390
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
mov rdx, rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008aae
jmp 0x140008aa2
lea rdx, [0x140129d88]
mov rcx, rdi
call fcn.1400e9a18
test eax, eax
je 0x140008aa9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rdi, [rdi + rax*2]
cmp word [rdi], bx
jne 0x140008a7e
jmp 0x140008aae
mov ebx, 1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140008ac8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov edx, 0x9eb6dce7
mov ecx, 0xf30a8e85
mov r8d, 0x40efb8e7
xor ebx, ebx
call fcn.140001390
lea r8, [0x140129d88]
lea rcx, [rbp + 0x160]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x6fecbeba
mov ecx, 0x250ecaa
mov r8d, 0xb1b5da87
call fcn.140001390
lea r8, [0x140129d88]
lea rcx, [rsp + 0x50]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rsp + 0x40]
lea edi, [rbx + 1]
lea rdx, [rsp + 0x50]
mov r9d, edi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008c3d
mov edx, 0xd14370f5
mov ecx, 0xbcff2129
mov r8d, 0xf1a14e7
mov dword [rsp + 0x30], 0x208
call fcn.140001390
mov rcx, qword [rsp + 0x40]
mov rdx, rax
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008c32
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x50]
call fcn.1400e9a18
test eax, eax
jne 0x140008c32
mov edx, 0x272f2b5f
mov ecx, 0x4a937aa9
mov r8d, 0xf9764f41
mov dword [rsp + 0x30], 4
call fcn.140001390
mov rcx, qword [rsp + 0x40]
mov rdx, rax
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008c32
cmp dword [rsp + 0x34], 4
jne 0x140008c32
cmp dword [rsp + 0x38], 3
cmove ebx, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140008c64
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x158]
sub rsp, 0x250
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov ebx, ecx
mov edx, 0xf824213d
mov r8d, 0x267d4500
mov ecx, 0x959870bd
call fcn.140001390
lea rsi, [0x140129d88]
lea rcx, [rsp + 0x40]
mov rdx, rax
mov r8, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
xor edi, edi
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
test ebx, ebx
je 0x140008e6c
lea r8, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x140008cee
xor eax, eax
jmp 0x140008e7a
mov edx, 0x8763a919
mov ecx, 0xeadff855
mov r8d, 0x593acd19
call fcn.140001390
lea rcx, [rsp + 0x40]
mov r8, rsi
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0xd8f401c
mov ecx, 0x6033111e
mov r8d, 0xd3d6240e
lea ebx, [rax*2 + 2]
call fcn.140001390
mov rcx, qword [rsp + 0x38]
mov r9d, 2
mov rdx, rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0xef686fce
mov ecx, 0x82d43eda
mov r8d, 0x31310bda
lea ebx, [rax*2 + 2]
call fcn.140001390
mov rcx, qword [rsp + 0x38]
mov edi, 1
mov r9d, edi
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, 0xd5e70d3f
mov ecx, 0xb85b5c0d
mov r8d, 0xbbe692a
mov dword [rsp + 0x30], edi
call fcn.140001390
mov rcx, qword [rsp + 0x38]
lea ebx, [rdi + 3]
mov rdx, rax
lea rax, [rsp + 0x30]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, 0x93f23f72
mov ecx, 0xfe4e6fbc
mov r8d, 0x4dab5b6c
mov dword [rsp + 0x30], 3
call fcn.140001390
mov rcx, qword [rsp + 0x38]
mov r9d, ebx
mov rdx, rax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, 0x16d3e851
mov ecx, 0x7b6fb889
mov r8d, 0xc88a8c4c
mov dword [rsp + 0x30], edi
call fcn.140001390
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x38]
mov rdx, rax
mov r9d, ebx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140008e78
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
sete dil
mov eax, edi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140008f94
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15d, ecx
xor edi, edi
mov edx, 0xe64e3b1a
mov ecx, 0x8bf26bfe
mov r8d, 0x38175f4c
mov dword [rbp + 0x58], edi
call fcn.140001390
lea r9d, [rdi + 3]
xor r8d, r8d
mov rdx, rax
lea rax, [rbp - 0x10]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140008ff2
xor eax, eax
jmp 0x140009188
mov edx, 0x85a7b45c
mov ecx, 0xe81be45a
mov r8d, 0x5bfed049
call fcn.140001390
mov rcx, qword [rbp - 0x10]
lea r9, [rbp + 0x50]
mov rdx, rax
lea rax, [rbp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r12d, 2
test eax, eax
je 0x14000903b
mov eax, r12d
mov dword [rbp + 0x48], eax
jmp 0x140009048
cmp dword [rbp + 0x50], 7
jne 0x14000917c
mov eax, dword [rbp + 0x48]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, 8
mov rcx, rax
mov r8d, ebx
mov edx, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, 0xd7ddec9b
mov ecx, 0xba61bcb9
mov r8d, 0x984888e
mov r14, rax
call fcn.140001390
mov rcx, qword [rbp - 0x10]
lea r9, [rbp + 0x50]
mov rdx, rax
lea rax, [rbp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x48]
test eax, eax
cmovne ecx, r12d
mov dword [rbp + 0x48], ecx
lea rcx, [0x140129d88]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, dword [rbp + 0x48]
lea rbx, [rax*2 + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, r14
mov ecx, r15d
mov rsi, rax
lea rax, [rbp + 0x58]
mov r8, rsi
mov qword [rsp + 0x20], rax
call fcn.140008ea4
cmp dword [rbp + 0x58], edi
jbe 0x14000912d
mov edx, 0x64eaa844
mov ecx, 0x956f87a
mov r8d, 0xbab3cc51
lea ebx, [rax + rax]
call fcn.140001390
mov rcx, qword [rbp - 0x10]
mov rdx, rax
mov r9d, 7
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x14000914f
mov edx, 0xfc86014b
mov ecx, 0x913a5691
mov r8d, 0x22df655e
call fcn.140001390
mov rcx, qword [rbp - 0x10]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, 1
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140009198
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, 0xa8212918
mov ecx, 0xc59d7eee
mov eax, eax
mov r8d, 0x76784d09
lea rbx, [rbx + rax*2]
mov eax, 0x5c
mov word [rbx], ax
add rbx, 2
call fcn.140001390
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400091dc
lea rcx, str.xreveal.sys
sub rbx, rcx
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rbx + rcx + 0xe], ax
test ax, ax
jne 0x1400091f6
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140009214
Capabilities:
Copy file
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x550], rax
lea rdx, [rsp + 0x20]
mov ebx, ecx
call fcn.140009198
xor edi, edi
mov edx, edi
movzx eax, word [rsp + rdx + 0x20]
lea rdx, [rdx + 2]
mov word [rbp + rdx + 0x12e], ax
test ax, ax
jne 0x14000924f
lea rcx, [rbp + 0x130]
mov edx, 0x2e
call fcn.1400e9f08
mov dword [rax + 2], 0x6d0074
mov dword [rax + 6], 0x70
test ebx, ebx
je 0x140009326
lea rdx, [rbp + 0x340]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x340]
mov edx, 0x5c
call fcn.1400e9f08
mov rbx, rax
test rax, rax
je 0x14000933e
add rbx, 2
lea rdx, str.xreveal.sys
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
test rbx, rbx
je 0x14000933e
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x340]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14000933e
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x340]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x14000933e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x550]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret