joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021e30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x488
mov rax, qword [0x1400a9538]
xor rax, rsp
mov qword [rsp + 0x470], rax
cmp qword [rcx + 0x18], 0
mov r14, r9
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
je 0x140021f93
test rdx, rdx
je 0x140021f93
xor edx, edx
mov qword [rsp + 0x480], rbx
mov r8d, 0x208
lea rcx, [rsp + 0x260]
call fcn.140024ec0
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.140024ec0
lea rdx, [0x14008e33c]
mov rcx, rdi
mov rbx, rdi
call fcn.140026490
test rax, rax
je 0x140021efe
nop word [rax + rax]
lea rbx, [rax + 2]
mov rcx, rbx
lea rdx, [0x14008e33c]
call fcn.140026490
test rax, rax
jne 0x140021ec0
cmp rbx, rdi
je 0x140021efe
mov r9, rbx
lea rcx, [rsp + 0x260]
sub r9, rdi
mov r8, rdi
sar r9, 1
mov edx, 0x104
dec r9
call fcn.14005e8f0
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
mov r8, rbx
mov edx, 0x104
call fcn.14005e8f0
mov eax, dword [r14]
lea r8, [rsp + 0x50]
mov rcx, qword [rbp + 0x18]
lea rdx, [rsp + 0x260]
mov dword [rsp + 0x40], eax
mov r9d, 0x20
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov rbx, qword [rsp + 0x480]
cmp eax, 0xea
je 0x140021f85
test eax, eax
jne 0x140021f6d
test rsi, rsi
je 0x140021f85
jmp 0x140021f98
cmp eax, 0x57
jne 0x140021f79
mov eax, 2
jmp 0x140021f98
cmp eax, 2
jne 0x140021f93
mov eax, 1
jmp 0x140021f98
mov ecx, dword [rsp + 0x40]
mov eax, 3
mov qword [r14], rcx
jmp 0x140021f98
mov eax, 4
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140023340
add rsp, 0x488
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400220c0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x1400a9538]
xor rax, rsp
mov qword [rsp + 0x460], rax
cmp qword [rcx + 0x18], 0
mov rsi, rdx
mov rbp, rcx
mov dword [rsp + 0x30], r8d
mov edi, 4
je 0x1400221df
cmp dword [rcx + 0x10], 0
jne 0x1400221df
test rdx, rdx
je 0x1400221df
xor edx, edx
mov qword [rsp + 0x4a8], rbx
mov r8d, 0x208
lea rcx, [rsp + 0x250]
call fcn.140024ec0
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.140024ec0
lea rdx, [0x14008e33c]
mov rcx, rsi
mov rbx, rsi
call fcn.140026490
test rax, rax
je 0x14002218f
lea rbx, [rax + 2]
mov rcx, rbx
lea rdx, [0x14008e33c]
call fcn.140026490
test rax, rax
jne 0x140022151
cmp rbx, rsi
je 0x14002218f
mov r9, rbx
lea rcx, [rsp + 0x250]
sub r9, rsi
mov r8, rsi
sar r9, 1
mov edx, 0x104
dec r9
call fcn.14005e8f0
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
mov r8, rbx
mov edx, 0x104
call fcn.14005e8f0
mov rcx, qword [rbp + 0x18]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x40]
mov r9d, edi
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x250]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rbx, qword [rsp + 0x4a8]
xor ecx, ecx
test eax, eax
cmove edi, ecx
mov eax, edi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140023340
add rsp, 0x470
pop rdi
pop rsi
pop rbp
ret
Function at 0x140022200
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x1400a9538]
xor rax, rsp
mov qword [rsp + 0x450], rax
cmp qword [rcx + 0x18], 0
mov r15, r9
mov r14, r8
mov rsi, rdx
mov rbp, rcx
mov ebx, 4
je 0x14002233d
cmp dword [rcx + 0x10], 0
jne 0x14002233d
test rdx, rdx
je 0x14002233d
test r8, r8
je 0x14002233d
test r9, r9
je 0x14002233d
xor edx, edx
mov qword [rsp + 0x468], rdi
mov r8d, 0x208
lea rcx, [rsp + 0x240]
call fcn.140024ec0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140024ec0
lea rdx, [0x14008e33c]
mov rcx, rsi
mov rdi, rsi
call fcn.140026490
test rax, rax
je 0x1400222ee
nop dword [rax + rax]
lea rdi, [rax + 2]
mov rcx, rdi
lea rdx, [0x14008e33c]
call fcn.140026490
test rax, rax
jne 0x1400222b0
cmp rdi, rsi
je 0x1400222ee
mov r9, rdi
lea rcx, [rsp + 0x240]
sub r9, rsi
mov r8, rsi
sar r9, 1
mov edx, 0x104
dec r9
call fcn.14005e8f0
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 0x104
call fcn.14005e8f0
mov rcx, qword [rbp + 0x18]
lea r8, [rsp + 0x30]
mov r9d, 1
mov dword [rsp + 0x28], r15d
lea rdx, [rsp + 0x240]
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdi, qword [rsp + 0x468]
xor ecx, ecx
test eax, eax
cmove ebx, ecx
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140023340
add rsp, 0x470
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret

Function at 0x140022360
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x1400a9538]
xor rax, rsp
mov qword [rsp + 0x450], rax
cmp qword [rcx + 0x18], 0
mov r15, r9
mov r14, r8
mov rsi, rdx
mov rbp, rcx
mov ebx, 4
je 0x14002249d
cmp dword [rcx + 0x10], 0
jne 0x14002249d
test rdx, rdx
je 0x14002249d
test r8, r8
je 0x14002249d
test r9, r9
je 0x14002249d
xor edx, edx
mov qword [rsp + 0x468], rdi
mov r8d, 0x208
lea rcx, [rsp + 0x240]
call fcn.140024ec0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140024ec0
lea rdx, [0x14008e33c]
mov rcx, rsi
mov rdi, rsi
call fcn.140026490
test rax, rax
je 0x14002244e
nop dword [rax + rax]
lea rdi, [rax + 2]
mov rcx, rdi
lea rdx, [0x14008e33c]
call fcn.140026490
test rax, rax
jne 0x140022410
cmp rdi, rsi
je 0x14002244e
mov r9, rdi
lea rcx, [rsp + 0x240]
sub r9, rsi
mov r8, rsi
sar r9, 1
mov edx, 0x104
dec r9
call fcn.14005e8f0
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 0x104
call fcn.14005e8f0
mov rcx, qword [rbp + 0x18]
lea r8, [rsp + 0x30]
mov r9d, 7
mov dword [rsp + 0x28], r15d
lea rdx, [rsp + 0x240]
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rdi, qword [rsp + 0x468]
xor ecx, ecx
test eax, eax
cmove ebx, ecx
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140023340
add rsp, 0x470
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x14003b60c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140048cc8], rbx
je 0x14003b673
cmp rax, rbx
jne 0x14003b666
mov ebx, 1
mov esi, ebx
jmp 0x14003b678
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14003b64b
mov ebx, 1
mov eax, dword [0x140048cd0]
cmp eax, ebx
jne 0x14003b690
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14003b6fc
mov eax, dword [0x140048cd0]
test eax, eax
jne 0x14003b6f1
mov dword [0x140048cd0], ebx
lea r15, [0x14003e288]
lea rdi, [0x14003e270]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14003b6e3
test eax, eax
jne 0x14003b6e7
cmp qword [rdi], r14
je 0x14003b6d8
mov rax, qword [rdi]
mov rcx, qword [0x14003e230]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14003b6ba
test eax, eax
je 0x14003b6f7
mov eax, 0xff
jmp 0x14003b852
mov dword [0x140048284], ebx
mov edi, 0x1f
mov eax, dword [0x140048cd0]
cmp eax, ebx
jne 0x14003b723
lea rdx, [0x14003e268]
lea rcx, [0x14003e238]
call sub.msvcrt.dll__initterm
mov dword [0x140048cd0], 2
test esi, esi
jne 0x14003b731
mov rax, r14
xchg qword [0x140048cc8], rax
cmp qword [0x140048ce8], r14
je 0x14003b764
lea rcx, [0x140048ce8]
call fcn.14003bbf0
test eax, eax
je 0x14003b764
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140048ce8]
mov r9, qword [0x14003e230]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14003b77d
mov eax, 0xff
jmp 0x14003b852
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14003b803
test ax, ax
je 0x14003b798
test edx, edx
jne 0x14003b803
sub ax, bx
cmp ax, di
ja 0x14003b7ae
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14003b798
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001fc0
mov dword [0x140048280], eax
cmp dword [0x1400482a0], r14d
jne 0x14003b7ec
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140048284], r14d
jne 0x14003b801
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140048280]
jmp 0x14003b852
cmp ax, 0x22
jne 0x14003b817
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14003b786
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140174000
add rsp, 0x28
jmp 0x14003b60c
Function at 0x140003e00
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x70], xmm7
mov ebp, edx
mov r14, rcx
test ebp, ebp
je 0x140003f25
lea rcx, [0x140011500]
xor ebx, ebx
movabs rsi, 0xdbaf4383c59f19cf
call fcn.1400098b0
lea rcx, [0x1400114e0]
mov r15, rax
call fcn.1400098b0
movdqa xmm7, xmmword [0x14038e480]
mov r12, rax
movdqa xmm6, xmmword [0x14038e490]
lea rax, [0x14000ed20]
mov qword [rsp + 0x28], rax
cmp byte [r15], 0
mov r13d, ebx
movaps xmmword [rsp + 0x30], xmm7
movzx edi, byte [r14 + rbx]
movaps xmmword [rsp + 0x40], xmm6
mov byte [rsp + 0x50], 0xcf
jne 0x140003ed8
mov rax, qword [rsp + 0x30]
mov byte [r12 + 0x21], 1
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x28]
mov qword [r12], rax
mov rax, qword [rsp + 0x38]
mov qword [r12 + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [r12 + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [r12 + 0x18], rax
mov eax, 0xffffffcf
mov byte [r12 + 0x20], al
mov byte [r15], 1
call fcn.140008ff0
cmp byte [r12 + 0x21], 0
je 0x140003f0c
xor eax, eax
nop word [rax + rax]
mov rcx, rax
mov rdx, rsi
and ecx, 7
shl rcx, 3
shr rdx, cl
xor byte [r12 + rax], dl
add rax, 1
cmp rax, 0x21
jne 0x140003ee8
mov byte [r12 + 0x21], 0
and r13d, 0x1f
xor dil, byte [r12 + r13]
mov byte [r14 + rbx], dil
add rbx, 1
cmp rbp, rbx
jne 0x140003e70
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140007c30
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
xor edx, edx
test rcx, rcx
mov rbx, r8
je 0x140007c64
cmp word [rcx], 0x5a4d
jne 0x140007c64
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140007c64
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007c64
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140007b70
test eax, eax
jne 0x140007c80
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140007be0
test rax, rax
je 0x140007c75
mov rcx, qword [rbx]
lea rdx, [rax + 0x10]
mov r9d, 8
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
call fcn.140008206
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret
Function at 0x140007ea0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Populate syswhispers2 syscall list
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov r10d, dword [0x14038c580]
test r10d, r10d
jne 0x14000807e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x14000808e
xor r9d, r9d
nop dword [rax + rax]
mov rdx, rax
movsxd rax, dword [rax + 0x3c]
mov eax, dword [rdx + rax + 0x88]
test eax, eax
je 0x140007f1f
lea r9, [rdx + rax]
mov eax, dword [r9 + 0xc]
add rax, rdx
mov r8d, dword [rax]
or r8d, 0x20202020
cmp r8d, 0x6c64746e
jne 0x140007f1f
mov eax, dword [rax + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x140007f34
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
test rax, rax
jne 0x140007ee0
test r9, r9
je 0x14000808e
mov eax, dword [r9 + 0x18]
lea r13, [0x14038c584]
xor r11d, r11d
mov edi, dword [r9 + 0x24]
mov r12d, dword [r9 + 0x1c]
lea ecx, [rax - 1]
mov eax, dword [r9 + 0x20]
add rdi, rdx
lea rbx, [rdi + rcx*2]
add r12, rdx
add rax, rdx
lea rsi, [rax + rcx*4]
jmp 0x140007f7c
lea rax, [rbx - 2]
sub rsi, 4
cmp rdi, rbx
je 0x140008000
mov rbx, rax
mov eax, dword [rsi]
add rax, rdx
cmp word [rax], 0x775a
jne 0x140007f68
cmp byte [rax], 0
mov ecx, r11d
lea rbp, [r13 + rcx*8]
je 0x14000809b
cmp byte [rax + 1], 0
mov r8d, 0x39406027
mov ecx, 1
mov r9d, 1
je 0x140007fce
movzx ecx, word [rax + rcx]
mov r14d, r8d
add r9d, 1
ror r14d, 8
add ecx, r14d
xor r8d, ecx
mov ecx, r9d
cmp byte [rax + rcx], 0
jne 0x140007fb0
movzx eax, word [rbx]
mov dword [rbp], r8d
add r11d, 1
cmp r11d, 0x1f4
mov eax, dword [r12 + rax*4]
mov dword [rbp + 4], eax
jne 0x140007f68
mov dword [0x14038c580], 0x1f4
mov r9d, 0x1f3
jmp 0x140008011
lea r9d, [r11 - 1]
cmp r11d, 1
mov dword [0x14038c580], r11d
je 0x14000807e
lea esi, [r11 - 2]
lea rbx, [0x14038c58c]
nop dword [rax]
mov eax, r11d
sub eax, r10d
cmp eax, 1
je 0x140008075
lea rax, [0x14038c584]
mov edx, esi
sub edx, r10d
lea r8, [rbx + rdx*8]
nop dword [rax + rax]
mov edx, dword [rax + 4]
mov ecx, dword [rax + 0xc]
cmp ecx, edx
jae 0x14000806c
movd xmm0, dword [rax]
movd xmm2, edx
movd xmm3, ecx
movd xmm1, dword [rax + 8]
punpckldq xmm0, xmm2
movq qword [rax + 8], xmm0
punpckldq xmm1, xmm3
movq qword [rax], xmm1
add rax, 8
cmp r8, rax
jne 0x140008040
add r10d, 1
cmp r10d, r9d
jb 0x140008020
mov eax, 1
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r8d, 0xd6976eef
jmp 0x140007fce

Function at 0x140008110
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.1400080b0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140009460
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14038f020]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x1400094cf
mov rcx, r9
call fcn.140009330
test eax, eax
je 0x1400094cf
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x1400094cd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x1400094c4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400094cf
add rdx, 0x28
cmp rdx, r9
jne 0x1400094b0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0xd1c528
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd1c6af
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xd1c559
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xd1c53f
add dl, dl
jne 0xd1c566
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xd1c5c6
xor eax, eax
add dl, dl
jne 0xd1c575
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xd1c67d
add dl, dl
jne 0xd1c586
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd1c593
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd1c5a0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd1c5ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xd1c5ba
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xd1c54e
mov eax, 1
add dl, dl
jne 0xd1c5d6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd1c5e3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xd1c5cb
sub eax, ebx
mov ebx, 1
jne 0xd1c61c
mov ecx, 1
add dl, dl
jne 0xd1c5fe
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd1c60b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xd1c5f3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xd1c54e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd1c638
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd1c645
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xd1c62d
cmp eax, 0x7d00
jae 0xd1c66b
cmp eax, 0x500
jb 0xd1c666
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xd1c54e
cmp eax, 0x7f
ja 0xd1c66e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xd1c54e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xd1c6a2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xd1c54e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14008e6ac
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov r11, rdx
mov dword [rsp + 0x40], 4
mov rax, r9
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rdx
mov r10, r8
mov qword [rsp + 0x28], rcx
mov r9d, 0x10010
and qword [rsp + 0x20], 0
mov rcx, r11
mov r8, rax
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
add rsp, 0x58
ret
Function at 0x1400916e4
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r8, str.GlobalMicrosoft.Windows.Setup.Cleanup
xor ecx, ecx
xor edx, edx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
nop dword [rax + rax]
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
cmp eax, 0xb7
jne 0x14009177c
mov eax, dword [rdi + 8]
neg eax
sbb edx, edx
xor ecx, ecx
and edx, 2
call qword [sym.imp.ole32.dll_CoInitializeEx]
nop dword [rax + rax]
test eax, eax
jns 0x140091758
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edi, ebx
call fcn.140091798
mov esi, eax
test eax, eax
jns 0x14009176c
inc edi
cmp edi, 3
jl 0x14009175a
call qword [sym.imp.ole32.dll_CoUninitialize]
nop dword [rax + rax]
mov ebx, esi
jmp 0x140091745
test edx, edx
je 0x140091745
movzx eax, dx
or eax, 0x80070000
test edx, edx
cmovle eax, edx
jmp 0x140091747
Function at 0x140093ab4
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp qword [0x1400c52d0], 0
jne 0x140093c76
xor edi, edi
cmp byte [0x1400c9c44], dil
jne 0x140093bf3
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
je 0x140093b33
cmp dword [rsp + 0x54], 6
setb cl
mov byte [0x1400c9c10], cl
ja 0x140093b26
jne 0x140093b2b
cmp dword [rsp + 0x58], 1
jbe 0x140093b2b
mov edi, 1
test cl, cl
jne 0x140093bec
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140093b71
test edi, edi
je 0x140093be5
lea rcx, str.api_ms_win_eventing_provider_l1_1_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140093be5
lea rdx, str.EventWrite
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x1400c9c18], rax
test rax, rax
je 0x140093be5
lea rdx, [0x1400b7ba8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [section..data], rax
test rax, rax
je 0x140093bd7
lea rdx, [0x1400b7bb8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x1400c9c08], rax
test rax, rax
jne 0x140093bec
lea rax, [0x1400938a0]
mov qword [section..data], rax
mov byte [0x1400c9c10], 1
mov byte [0x1400c9c44], 1
cmp byte [0x1400c9c10], 0
lea rdx, [0x1400c52d0]
jne 0x140093c26
mov rax, qword [section..data]
lea rcx, [0x1400b7bd0]
mov r9, rdx
mov r8, rdx
lea rdx, [0x14008f190]
call qword [str.PN_t_]
jmp 0x140093c76
and qword [rsp + 0x48], 0
lea rax, [0x1400b7bd0]
mov qword [rsp + 0x38], rdx
lea rcx, [rsp + 0x40]
and qword [rsp + 0x30], 0
mov r9d, 1
and qword [rsp + 0x28], 0
mov r8, rax
mov qword [rsp + 0x20], rcx
lea rcx, [0x140093740]
mov qword [0x1400c52d0], rdx
mov qword [rsp + 0x40], rax
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140094220
mov rbx, qword [rsp + 0x190]
add rsp, 0x180
pop rdi
ret
Function at 0x140003250
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000329a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000329a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000329a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000329a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000329a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000329c
xor al, al
add rsp, 0x28
ret
Function at 0x140027de0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b784
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b784
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027f30
cmp rax, 0xffffffffffffffff
je 0x140027f30
xor edi, edi
test rbp, rbp
jle 0x140027edb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001dd70
mov rbx, rax
test rax, rax
jne 0x140027e68
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027ed1
mov edx, 0x8000
mov ecx, r14d
call fcn.140015928
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c460
cmp eax, 0xffffffff
je 0x140027eb1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027e78
mov edx, r15d
mov ecx, r14d
call fcn.140015928
jmp 0x140027ed1
cmp byte [rsi + 0x38], dil
je 0x140027ec8
cmp dword [rsi + 0x34], 5
jne 0x140027ec8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027ed1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019e48
jmp 0x140027f44
jns 0x140027f44
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b784
cmp rax, 0xffffffffffffffff
jne 0x140027efc
cmp byte [rsi + 0x30], dil
je 0x140027f44
mov edi, dword [rsi + 0x2c]
jmp 0x140027f44
mov ecx, r14d
call fcn.140016f28
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027f44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027f44
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027f3d
mov eax, dword [rsi + 0x2c]
jmp 0x140027f42
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b784
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140001210
Capabilities:
Create http request

Disassembly:
push rbx
sub rsp, 0x30
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rbx, rax
test rax, rax
je 0x140001263
or dword [0x140017220], 0x3300
lea r8, [0x140017220]
mov r9d, 4
mov rcx, rax
lea edx, [r9 + 0x1b]
call qword [sym.imp.WININET.dll_InternetSetOptionA]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x14000404c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140003e78