joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013f8c0
Capabilities:
Enumerate network shares

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rbx, rdx
mov r12, rcx
xor r13d, r13d
mov dword [rbp + 0x50], r13d
mov dword [rbp + 0x58], r13d
mov dword [rbp - 0x3c], r13d
mov dword [rbp - 0x40], r13d
mov rdi, qword [rbp + 0x50]
mov rcx, r12
call fcn.140094f50
mov rcx, rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp - 0x38]
mov edx, 1
call sub.NETAPI32.dll_NetShareEnum
mov r15d, eax
test eax, eax
je 0x14013f943
cmp eax, 0xea
jne 0x14013fa5a
mov rsi, qword [rbp - 0x38]
mov r14d, 1
cmp dword [rbp + 0x58], r14d
jb 0x14013fa5a
test rbx, rbx
je 0x14013fa49
cmp dword [rsi + 8], 0
jne 0x14013fa49
mov r8, 0xffffffffffffffff
mov rdx, qword [rsi]
lea rcx, [rbp - 0x18]
call fcn.14008e230
nop
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rcx, qword [rax + 8]
mov qword [rbp - 0x28], rcx
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x20], rcx
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov eax, dword [rbp + 0x50]
or eax, 5
mov dword [rbp + 0x50], eax
test al, 2
je 0x14013f9cd
and dword [rbp + 0x50], 0xfffffffd
test rdi, rdi
je 0x14013f9cd
mov eax, 0xffffffff
lock xadd dword [rdi], eax
cmp eax, 1
jne 0x14013f9cd
mov rcx, rdi
call fcn.14021b810
nop
mov eax, dword [rbp + 0x50]
test al, 1
je 0x14013f9f9
and dword [rbp + 0x50], 0xfffffffe
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14013f9f9
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14013f9f9
mov rcx, qword [rbp - 0x18]
call fcn.14021b810
nop
lea r8, [rbp - 0x30]
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.14003b060
mov rax, qword [rbx]
test rax, rax
je 0x14013fa18
mov eax, dword [rax]
cmp eax, 1
jle 0x14013fa29
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14003a8f0
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14013fa49
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14013fa49
mov rcx, qword [rbp - 0x30]
call fcn.14021b810
add rsi, 0x18
inc r14d
cmp r14d, dword [rbp + 0x58]
jbe 0x14013f957
mov rcx, qword [rbp - 0x38]
call sub.NETAPI32.dll_NetApiBufferFree
cmp r15d, 0xea
je 0x14013f8f7
test r15d, r15d
sete al
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140144170
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r9d, r9d
mov r10, rcx
sub r10, r8
mov r11d, r9d
cmp rdx, 0x20
jb 0x1401441f3
mov qword [rsp + 0x10], rbx
lea rbx, [r8 + 0x10]
mov qword [rsp], rdi
mov edi, reloc.SHLWAPI.dll_SHCreateThread
sub rdi, r8
nop dword [rax + rax]
movdqu xmm0, xmmword [rbx + r10 - 0x10]
add r11, 0x20
movdqu xmm2, xmmword [rbx + r10]
lea rbx, [rbx + 0x20]
movdqa xmm1, xmm0
lea rax, [rdi + rbx]
psrlw xmm0, 8
psllw xmm1, 8
xorps xmm1, xmm0
movdqa xmm0, xmm2
psllw xmm0, 8
psrlw xmm2, 8
xorps xmm0, xmm2
movdqu xmmword [rbx - 0x20], xmm0
movdqu xmmword [rbx - 0x30], xmm1
cmp rax, rdx
jbe 0x1401441a0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
lea rax, [r11 + 0x10]
cmp rax, rdx
ja 0x14014421c
movdqu xmm0, xmmword [r11 + rcx]
movdqa xmm1, xmm0
psrlw xmm0, 8
psllw xmm1, 8
xorps xmm1, xmm0
movdqu xmmword [r11 + r8], xmm1
mov r11, rax
cmp r11, rdx
jae 0x14014424a
lea rax, [r11 + r8]
cmp r9, 0x10
jae 0x14014424a
movzx ecx, word [r10 + rax]
add r9, 2
ror cx, 8
mov word [rax], cx
add rax, 2
mov rcx, rax
sub rcx, r8
cmp rcx, rdx
jb 0x140144225
mov rax, rdx
add rsp, 8
ret
Function at 0x14014a400
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0xd4], 1
je 0x1401371d9
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400f4a60.0]
mov dword [rbx + 0xd4], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14014a400
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x28]
mov rcx, qword [rcx + 0xa8]
test rcx, rcx
jne 0x14014a50f
cmp dword [rsi + 0xd0], 0xffffffff
jne 0x14014a58e
mov rcx, qword [rsi + 0xb0]
cmp rcx, 0xffffffffffffffff
je 0x14014a585
xor r12d, r12d
mov edi, r12d
mov rbx, r8
mov r8d, 0x2000000
cmp rbx, r8
cmovl r8d, ebp
mov qword [rax - 0x58], r12
lea r9, [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14014a4d2
nop word [rax + rax]
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x14014a4ca
add rdi, rax
sub rbx, rax
cmp rdi, rbp
jge 0x14014a4ca
mov r8d, 0x2000000
cmp rbx, r8
cmovl r8d, ebx
lea rdx, [rdi + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x80]
mov rcx, qword [rsi + 0xb0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14014a480
test rdi, rdi
je 0x14014a4d2
mov rax, rdi
jmp 0x14014a59c
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140110100
nop
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.140134c80
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14014a585
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jmp 0x14014a579
call fcn.14022bc08
mov ecx, eax
call fcn.14022ba04
cmp rax, 0xffffffffffffffff
je 0x14014a58e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
add eax, 0xfffffffe
cmp eax, 1
ja 0x14014a58e
mov rcx, qword [rsi + 0xa8]
call fcn.1402298c0
test eax, eax
je 0x14014a58e
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.1401102e0
nop
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.140134c80
nop
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14014a585
mov ecx, 0xffffffff
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14014a585
mov rcx, qword [rsp + 0x30]
call fcn.14021b810
mov rax, 0xffffffffffffffff
jmp 0x14014a59c
mov r8, rbp
mov rdx, r14
mov rcx, rsi
call fcn.140137200
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14014a830
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
and dword [rbx + 0x70], 0xfdffffff
cmp dword [rbx + 0xd4], 2
je 0x140137d10
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400f4a60.0]
mov dword [rbx + 0xd4], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14014a830
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x28]
cmp qword [rcx + 0xa8], 0
jne 0x14014a94b
cmp dword [rcx + 0xd0], 0xffffffff
jne 0x14014a94b
mov rcx, qword [rcx + 0xb0]
cmp rcx, 0xffffffffffffffff
je 0x14014a942
xor r12d, r12d
mov edi, r12d
mov rbx, r8
mov r8d, 0x2000000
cmp rbx, r8
cmovl r8d, ebp
mov qword [rax - 0x58], r12
lea r9, [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14014a8ff
nop dword [rax + rax]
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x14014a8fa
add rdi, rax
sub rbx, rax
cmp rdi, rbp
jge 0x14014a8fa
mov r8d, 0x2000000
cmp rbx, r8
cmovl r8d, ebx
lea rdx, [rdi + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x80]
mov rcx, qword [rsi + 0xb0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14014a8b0
test rdi, rdi
je 0x14014a8ff
mov rax, rdi
jmp 0x14014a950
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140110100
nop
mov r8, rax
mov edx, 2
mov rcx, r15
call fcn.140134c80
nop
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14014a942
mov ecx, 0xffffffff
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14014a942
mov rcx, qword [rsp + 0x30]
call fcn.14021b810
mov rax, 0xffffffffffffffff
jmp 0x14014a950
call fcn.140137d30
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14014aea0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rcx + 8]
mov rdi, qword [rax + 0xb0]
cmp rdi, 0xffffffffffffffff
jne 0x14014aff4
cmp dword [rax + 0xd0], edi
jne 0x14014afc5
cmp qword [rax + 0xa8], 0
jne 0x14014afc5
lea rdi, [rax + 0x30]
mov rcx, rdi
call fcn.140135420
test al, al
jne 0x14014b05c
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140134f10
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140042ea0
nop
mov edi, 0xffffffff
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14014af3d
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14014af3d
mov rcx, qword [rsp + 0x30]
call fcn.14021b810
mov edx, 3
lea rcx, [rsp + 0x20]
call fcn.140043210
test al, al
je 0x14014afb6
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.140044160
movzx esi, al
test al, al
jne 0x14014afa3
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x20]
call fcn.140047a20
nop
mov r8, rax
mov edx, SHCreateThread
mov rcx, rbx
call fcn.140134c80
nop
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14014afa3
lock xadd dword [rax], edi
cmp edi, 1
jne 0x14014afa3
mov rcx, qword [rsp + 0x48]
call fcn.14021b810
nop
lea rcx, [rsp + 0x20]
call fcn.140042f80
movzx eax, sil
jmp 0x14014b05e
lea rcx, [rsp + 0x20]
call fcn.140042f80
jmp 0x14014b05c
cmp rdi, 0xffffffffffffffff
jne 0x14014aff4
mov rcx, qword [rax + 0xa8]
test rcx, rcx
je 0x14014afde
call fcn.14022bc08
jmp 0x14014afe4
mov eax, dword [rax + 0xd0]
mov ecx, eax
call fcn.14022ba04
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14014b05c
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x30]
call qword [case.0x1400f4a60.0]
mov rbp, rax
mov rax, qword [rbx]
mov rdx, rsi
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1400f4a60.0]
test al, al
je 0x14014b049
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14014b049
mov rax, qword [rbx]
cmp rbp, rsi
cmovl rsi, rbp
mov rdx, rsi
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1400f4a60.0]
mov al, 1
jmp 0x14014b05e
mov rax, qword [rbx]
mov rdx, rbp
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1400f4a60.0]
xor al, al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140155cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov r13, rcx
mov rdi, qword [rdx]
mov rax, qword [rdx + 8]
movzx ebp, byte [rdi + rax]
mov byte [rdi + rax], 0xff
mov esi, ebp
shl rsi, 5
mov rax, qword [rdi + 0x80]
mov rcx, qword [rsi + rax + 0x18]
test rcx, rcx
je 0x140155d56
nop word [rax + rax]
mov rbx, qword [rcx + 8]
mov edx, reloc.SHLWAPI.dll_SHCreateThread
call fcn.140214360
mov rcx, rbx
test rbx, rbx
jne 0x140155d40
mov rcx, qword [rdi + 0x80]
movzx eax, byte [rdi + 0x89]
mov byte [rsi + rcx], al
mov byte [rdi + 0x89], bpl
dec qword [r13 + 8]
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x20], xmm0
movabs rbp, 0xe38e38e38e38e39
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
inc rsi
mov qword [rsp + 0x28], rsi
cmp rsi, 0x80
jne 0x140155ddf
xor esi, esi
mov qword [rsp + 0x28], rsi
add rbx, 0x90
mov rcx, rbx
sub rcx, qword [r13 + 0x20]
mov rax, rbp
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [r13 + 0x10]
shr rax, 7
cmp rdx, rax
cmove rbx, qword [r13 + 0x20]
mov qword [rsp + 0x20], rbx
movzx edx, byte [rsi + rbx]
cmp rdx, 0xff
je 0x140155f38
shl rdx, 5
add rdx, qword [rbx + 0x80]
mov r10, qword [r13 + 0x10]
movsxd rcx, dword [rdx]
shl rcx, 4
movsxd rax, dword [rdx + 4]
add rcx, rax
add rcx, qword [rdx + 8]
xor rcx, qword [r13 + 0x18]
lea rax, [r10 - 1]
and rcx, rax
mov r9, qword [r13 + 0x20]
mov rax, rcx
shr rax, 7
lea r8, [rax + rax*8]
shl r8, 4
add r8, r9
and ecx, 0x7f
cmp r8, rbx
jne 0x140155e43
cmp rcx, rsi
je 0x140155d90
cmp r8, qword [r14]
jne 0x140155e4e
cmp rcx, qword [r14 + 8]
je 0x140155e8e
inc rcx
cmp rcx, 0x80
jne 0x140155e35
xor ecx, ecx
add r8, 0x90
mov rdx, r8
sub rdx, r9
mov rax, rbp
imul rdx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r10
shr rax, 7
cmp rdx, rax
jne 0x140155e35
mov r8, r9
jmp 0x140155e35
mov rdi, qword [r14]
cmp rbx, rdi
jne 0x140155eb3
mov rcx, qword [r14 + 8]
movzx eax, byte [rdi + rsi]
mov byte [rdi + rcx], al
mov byte [rdi + rsi], 0xff
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [r14], xmm0
jmp 0x140155d90
mov r15, qword [r14 + 8]
movzx eax, byte [rdi + 0x88]
cmp byte [rdi + 0x89], al
jne 0x140155ece
mov rcx, rdi
call fcn.1400bf190
movzx eax, byte [rdi + 0x89]
mov byte [r15 + rdi], al
movzx r8d, byte [rdi + 0x89]
shl r8, 5
add r8, qword [rdi + 0x80]
movzx eax, byte [r8]
mov byte [rdi + 0x89], al
movzx edx, byte [rsi + rbx]
mov byte [rsi + rbx], 0xff
mov ecx, edx
shl rcx, 5
add rcx, qword [rbx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [r8], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [r8 + 0x10], xmm1
movzx eax, byte [rbx + 0x89]
mov byte [rcx], al
mov byte [rbx + 0x89], dl
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [r14], xmm0
jmp 0x140155d90
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
Function at 0x140159ae0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rdi, rcx
lea rax, vtable.QWinSettingsPrivate.0
mov qword [rcx], rax
xor r15d, r15d
cmp byte [rcx + 0x100], r15b
je 0x140159c3c
cmp qword [rcx + 0xf8], r15
je 0x140159c3c
mov rbx, qword [rcx + 0xf0]
mov rcx, rbx
call fcn.14015b940
test rax, rax
je 0x140159c3c
cmp byte [rbx + 0x28], r15b
jne 0x140159c3c
mov rcx, rbx
call fcn.14015b940
test rax, rax
je 0x140159c3c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
lea rcx, [rsp + 0x38]
call fcn.140094f50
mov rsi, rax
cmp qword [rdi + 0xf8], r15
je 0x140159b9d
mov rbx, qword [rdi + 0xf0]
mov rcx, rbx
call fcn.14015b940
test rax, rax
je 0x140159b9d
cmp byte [rbx + 0x28], r15b
jne 0x140159b9d
mov rcx, rbx
call fcn.14015b940
jmp 0x140159ba0
mov rax, r15
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
test eax, eax
je 0x140159c1a
mov rdx, qword [rdi + 0xf0]
mov r8, qword [rdx + 0x10]
mov qword [rsp + 0x20], r8
mov rcx, qword [rdx + 0x18]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rdx + 0x20]
mov qword [rsp + 0x30], rcx
test r8, r8
je 0x140159bdd
lock inc dword [r8]
lea rcx, [rsp + 0x20]
call fcn.140094f50
mov r8, rax
lea rdx, str.QSettings:_Failed_to_delete_key___ls_
mov ecx, ebx
call fcn.14010c580
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140159c1a
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140159c1a
mov rcx, qword [rsp + 0x20]
call fcn.14021b810
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140159c3c
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140159c3c
mov rcx, qword [rsp + 0x38]
call fcn.14021b810
mov ebx, r15d
cmp qword [rdi + 0xf8], rbx
jle 0x140159ca5
mov r14, r15
nop dword [rax + rax]
mov rax, qword [rdi + 0xe8]
test rax, rax
je 0x140159c63
mov eax, dword [rax]
cmp eax, 1
jle 0x140159c77
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rdi + 0xe8]
call fcn.14015cc70
mov rbp, qword [rdi + 0xf0]
mov rcx, qword [rbp + r14 + 8]
test rcx, rcx
je 0x140159c8e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + r14 + 8], r15
inc ebx
add r14, 0x30
movsxd rax, ebx
cmp rax, qword [rdi + 0xf8]
jl 0x140159c50
mov rcx, qword [rdi + 0xe8]
test rcx, rcx
je 0x140159d15
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140159d15
mov rbx, qword [rdi + 0xf0]
mov rax, qword [rdi + 0xf8]
lea rsi, [rax + rax*2]
shl rsi, 4
add rsi, rbx
cmp rbx, rsi
je 0x140159d09
nop dword [rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140159d00
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140159d00
mov rcx, qword [rbx + 0x10]
call fcn.14021b810
add rbx, 0x30
cmp rbx, rsi
jne 0x140159ce0
mov rcx, qword [rdi + 0xe8]
call fcn.14021b810
mov rcx, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
jmp fcn.1400bdac0
Function at 0x14015b2f0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov r15d, edx
mov rbp, rcx
mov r8d, 2
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14015a490
nop
xor r12d, r12d
mov edi, r12d
cmp qword [rsp + 0x58], rdi
jle 0x14015b453
mov r14d, r15d
or r14d, 0x2001f
mov esi, r12d
nop
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx + rsi]
mov qword [rsp + 0x30], rdx
mov rax, qword [rcx + rsi + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + rsi + 0x10]
mov qword [rsp + 0x40], rax
test rdx, rdx
je 0x14015b36a
lock inc dword [rdx]
mov qword [rsp + 0xa0], r12
lea rcx, [rsp + 0x30]
call fcn.140094f50
mov rdx, rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, r14d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14015b3dc
mov rbx, qword [rsp + 0xa0]
test rbx, rbx
je 0x14015b3dc
mov edx, r15d
mov rcx, rbx
call fcn.14015b2f0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x30]
call fcn.140094f50
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
test eax, eax
jne 0x14015b414
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14015b3fe
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14015b3fe
mov rcx, qword [rsp + 0x30]
call fcn.14021b810
inc edi
add rsi, 0x18
movsxd rax, edi
cmp rax, qword [rsp + 0x58]
jl 0x14015b340
jmp 0x14015b453
lea rcx, [rsp + 0x30]
call fcn.140094f50
mov r8, rax
lea rdx, str.QSettings:_RegDeleteKey_failed_on_subkey___ls_
mov ecx, ebx
call fcn.14010c580
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14015b453
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14015b453
mov rcx, qword [rsp + 0x30]
call fcn.14021b810
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14015b4b3
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14015b4b3
mov rax, qword [rsp + 0x58]
lea rcx, [rax + rax*2]
mov rbx, qword [rsp + 0x50]
lea rdi, [rbx + rcx*8]
cmp rbx, rdi
je 0x14015b4a9
mov rcx, qword [rbx]
test rcx, rcx
je 0x14015b4a0
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14015b4a0
mov rcx, qword [rbx]
call fcn.14021b810
add rbx, 0x18
cmp rbx, rdi
jne 0x14015b482
mov rcx, qword [rsp + 0x48]
call fcn.14021b810
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1401848b0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x14037da00]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp qword [rdx + 0x10], 2
mov rbx, rdx
mov rdi, rcx
jl 0x140184a97
mov rax, qword [rdx + 8]
movzx ecx, word [rax]
lea eax, [rcx - 0x41]
cmp eax, 0x39
ja 0x1401848f7
lea eax, [rcx - 0x5b]
cmp eax, 5
ja 0x14018490d
cmp ecx, 0x7f
jbe 0x140184a97
call fcn.14008ece0
test al, al
je 0x140184a97
mov rax, qword [rbx + 8]
cmp word [rax + 2], 0x3a
jne 0x140184a97
movzx ecx, word [rax]
call fcn.140093dd0
test ax, ax
je 0x140184a97
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rdi + 0x20]
cmp rcx, rdx
je 0x140184953
nop word [rax + rax]
cmp word [rcx + 8], ax
je 0x140184a97
add rcx, 0x10
cmp rcx, rdx
jne 0x140184940
movups xmm0, xmmword [str..A:_]
lea rcx, [rsp + 0x90]
mov word [rsp + 0x48], ax
movups xmmword [rsp + 0x88], xmm0
mov word [rsp + 0x90], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x140184a97
xor ebx, ebx
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0x30], rbx
lea edx, [rax + 0x7e]
mov dword [rsp + 0x28], 0x2000000
lea r8d, [rax + 5]
xor r9d, r9d
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1401849df
lea rdx, [rsp + 0x88]
lea rcx, str.CreateFile__ls_failed.
call fcn.14010c830
jmp 0x140184a8f
xorps xmm0, xmm0
mov qword [rsp + 0x58], rbx
xorps xmm1, xmm1
mov dword [rsp + 0x50], 0x38
mov cl, 1
mov dword [rsp + 0x54], 6
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], rsi
movdqu xmmword [rsp + 0x78], xmm1
call fcn.140104590
mov rcx, rax
mov rax, qword [rax + 0x70]
test rax, rax
jne 0x140184a23
call fcn.1400edfe0
mov rcx, rax
call fcn.1401952d0
mov rcx, rax
lea rdx, [rsp + 0x50]
xor r8d, r8d
call qword [sym.imp.USER32.dll_RegisterDeviceNotificationW]
mov rcx, rsi
mov qword [rsp + 0x40], rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
jne 0x140184a68
lea rdx, [rsp + 0x88]
lea rcx, str.RegisterDeviceNotification__ls_failed.
call fcn.14010c830
jmp 0x140184a8f
mov rdx, qword [rdi + 0x28]
lea rcx, [rdi + 0x20]
cmp rdx, qword [rdi + 0x30]
je 0x140184a85
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdx], xmm0
add qword [rdi + 0x28], 0x10
jmp 0x140184a8f
lea r8, [rsp + 0x40]
call fcn.140182470
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140214340
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
ret
Function at 0x14019daf0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14019db51
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14019db10
mov ecx, dword [r9]
jmp 0x14019dc3b
cmp ecx, 0x4e0
jb 0x14019dc3b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14019db70
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14019dbc0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14019dd90
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
sub rdi, rdx
sar rdi, 2
xor ebp, ebp
mov esi, ebp
mov rax, qword [0x140387240]
bt rax, 0xb
jae 0x14019ddcf
mov rdx, rdi
mov rcx, r14
call fcn.14019e520
mov rsi, rax
cmp rsi, rdi
je 0x14019de39
mov rbx, rdi
sub rbx, rsi
shl rbx, 2
lea rcx, [r14 + rsi*4]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
cmovne rbp, rbx
mov rax, rbp
cqo
and edx, 3
add rax, rdx
sar rax, 2
add rsi, rax
cmp rsi, rdi
je 0x14019de39
lea rbx, [r14 + rsi*4]
sub rdi, rsi
lea rdi, [rbx + rdi*4]
cmp rbx, rdi
je 0x14019de39
nop word [rax + rax]
lea rcx, [rsp + 0x48]
call fcn.14022c104
mov eax, dword [rsp + 0x48]
mov dword [rbx], eax
add rbx, 4
cmp rbx, rdi
jne 0x14019de20
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret