joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005e3c0
Capabilities:
Decode data using base64 via winapi
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x120
mov rax, qword [0x1400a2320]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov r14b, cl
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
xor r15d, r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x78], r15
movdqa xmm0, xmmword [0x1400889c0]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r15w
call fcn.140041b80
mov r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x2b8]
lea rdx, [rsp + 0x48]
mov rcx, r8
call qword [case.0x140024ad2.8]
lea edi, [r15 + 0x64]
test eax, eax
js 0x140048f28
mov dword [rsp + 0x40], r15d
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
sub rax, rcx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, 0x40000001
mov edx, eax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov ebx, eax
test eax, eax
setne sil
xorps xmm0, xmm0
mov edx, dword [rsp + 0x40]
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
lea rcx, [rsp + 0x60]
call fcn.14002fc00
nop
test ebx, ebx
je 0x140048e73
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
sub rax, rcx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9, qword [rsp + 0x60]
mov r8d, 0x40000001
mov edx, eax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
setne sil
mov r8, rdi
xor edx, edx
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
test sil, sil
je 0x140048ede
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
mov r8d, 1
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x140048ede
call fcn.140041b80
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x138]
mov r8b, r14b
mov dl, byte [rbp - 0x60]
mov rcx, r9
call qword [case.0x140024ad2.8]
mov edi, eax
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x140048f28
mov rcx, qword [rsp + 0x70]
sub rcx, r8
sar rcx, 1
lea rdx, [rcx + rcx]
mov rax, r8
cmp rdx, 0x1000
jb 0x140048f1f
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048f1f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.140063320
nop
lea rcx, [rsp + 0x78]
call fcn.1400048e8
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140048f72
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048f6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048f6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063320
mov eax, edi
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140063300
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov cl, dl
jmp 0x140048d68
Function at 0x14005e4e0
Capabilities:
Persist via run registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov rax, qword [0x1400a2320]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rcx
xor esi, esi
mov byte [rcx], sil
mov qword [rbp + 0x27], rsi
movdqa xmm0, xmmword [0x1400889c0]
movdqu xmmword [rbp + 0x37], xmm0
mov word [rbp + 0x27], si
lea rcx, [rbp + 0x27]
call fcn.140045698
mov ebx, eax
test eax, eax
js 0x140042d68
mov qword [rbp + 7], rsi
movdqa xmm0, xmmword [0x1400889c0]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], si
mov qword [rbp - 0x19], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 9], xmm0
lea r8d, [rsi + 8]
lea rdx, [0x14007dc30]
lea rcx, [rbp - 0x19]
call fcn.1400047b0
nop
mov qword [rbp - 0x39], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
lea r8d, [rsi + 0x2d]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea rcx, [rbp - 0x39]
call fcn.1400047b0
nop
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x39]
mov rcx, 0xffffffff80000001
call fcn.140047edc
mov ebx, eax
lea rcx, [rbp - 0x39]
call fcn.1400048e8
nop
lea rcx, [rbp - 0x19]
call fcn.1400048e8
lea rdx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rdx, qword [rbp + 0x27]
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rcx, qword [rbp + 7]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140042d5e
mov byte [rdi], 1
lea rcx, [rbp + 7]
call fcn.1400048e8
nop
lea rcx, [rbp + 0x27]
call fcn.1400048e8
mov eax, ebx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140063300
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov byte [rcx], 0
jmp 0x140042c50
mov rcx, rdx
jmp 0x14004a300

Function at 0x14005e530
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400a2320]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor edi, edi
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x60], edi
lea eax, [rdi + 4]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x64], eax
jb 0x14004a7a3
mov rcx, qword [rcx]
mov r8, rcx
lea rdx, str.SoftwareMicrosoftOneDriveAccounts
lea rcx, [rsp + 0x40]
call fcn.14003f868
cmp qword [rax + 0x18], 8
jb 0x14004a7c1
mov rax, qword [rax]
lea rcx, [rsp + 0x64]
mov r9d, 0x10
mov qword [rsp + 0x30], rcx
lea r8, str.IsGoSov
lea rcx, [rsp + 0x60]
mov rdx, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea rcx, [rsp + 0x40]
mov ebx, eax
call fcn.1400048e8
test ebx, ebx
jne 0x14004a815
cmp dword [rsp + 0x60], 1
sete dil
mov al, dil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140063300
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
mov rcx, rdx
jmp 0x14004a76c
Function at 0x14005e660
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400a2320]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
lea rax, [rsp + 0x60]
lea rdx, str.SoftwareClasses
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
lea edi, [rbx + 1]
mov r9d, edi
lea r8d, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004bc1f
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x58], rbx
xor r9d, r9d
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x48], rbx
xor edx, edx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14004bc14
cmp dword [rsp + 0x68], ebx
jne 0x14004bc14
cmp dword [rsp + 0x6c], edi
jne 0x14004bc14
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rbx
lea r8, str.SymbolicLinkValue
mov qword [rsp + 0x28], rbx
mov r9d, 0x1000ffff
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14004bc14
cmp dword [rsp + 0x70], 6
movzx ebx, bl
cmove ebx, edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140063300
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
jmp 0x14004bb34

Function at 0x14005e6e0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1400a2320]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, r9
mov rbx, r8
mov dword [rbp - 0x59], ecx
and qword [rbp - 0x19], 0
mov rcx, qword [rdx + 0x38]
test rcx, rcx
je 0x14004d651
mov rax, qword [rcx]
lea rdx, [rbp - 0x51]
mov rax, qword [rax]
call qword [case.0x140024ad2.8]
mov qword [rbp - 0x19], rax
and qword [rbp - 0x11], 0
and qword [rbp - 1], 0
and qword [rbp + 7], 0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x14004d66e
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.140010404
nop
and qword [rbp + 0xf], 0
and qword [rbp + 0x1f], 0
and qword [rbp + 0x27], 0
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x14004d698
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rbp + 0xf]
call fcn.140010404
and dword [rbp + 0x2f], 0
lea rdx, [rbp - 0x59]
lea rcx, [0x14004d2f0]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x14004d6c7
cmp dword [rbp + 0x2f], 0
jbe 0x14004d6c7
mov bl, 1
jmp 0x14004d6c9
xor bl, bl
lea rcx, [rbp + 0xf]
call fcn.1400048e8
lea rcx, [rbp - 0x11]
call fcn.1400048e8
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14004d6fb
mov rax, qword [rcx]
lea rdx, [rbp - 0x51]
cmp rcx, rdx
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x140024ad2.8]
mov al, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140063300
add rsp, 0xc0
pop rdi
pop rbx
pop rbp
ret
mov rax, r9
mov r10, r8
mov r9, qword [rsp + 0x28]
mov ecx, edx
mov r8, rax
mov rdx, r10
jmp 0x14004d608
Function at 0x14005e820
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a2320]
xor rax, rsp
mov qword [rsp + 0x38], rax
neg byte [rsp + 0x80]
mov rsi, r9
mov rbx, r8
sbb r9d, r9d
and r9d, 0xfffe00fc
add r9d, 0x20006
cmp qword [rdx + 0x18], 8
jb 0x14004e567
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x14004e5c3
cmp qword [rbx + 0x10], 0
jne 0x14004e58b
xor ebx, ebx
jmp 0x14004e595
cmp qword [rbx + 0x18], 8
jb 0x14004e595
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x30]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140063300
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
push rbx
mov al, byte [rsp + 0x38]
mov r10, r9
mov r9, qword [rsp + 0x30]
mov r11, r8
mov rcx, rdx
mov byte [rsp + 0x30], al
mov r8, r10
mov rdx, r11
pop rbx
jmp 0x14004e528

Function at 0x14005e850
Capabilities:
Set registry value

Disassembly:
push rbx
mov al, byte [rsp + 0x38]
mov r10, r9
mov r9, qword [rsp + 0x30]
mov r11, r8
mov rcx, rdx
mov byte [rsp + 0x30], al
mov r8, r10
mov rdx, r11
pop rbx
jmp fcn.14004e5e8
Function at 0x14005e9b0
Capabilities:
Persist via run registry key

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1400a2320]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [0x1400a2198]
lea rdx, [rsp + 0x40]
and qword [rsp + 0x40], 0
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x28], rdx
xor r9d, r9d
mov rdx, 0xffffffff80000001
mov dword [rsp + 0x20], 0xf003f
mov rax, qword [rcx]
mov rax, qword [rax + 0x108]
call qword [case.0x140024ad2.8]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140043434
mov rcx, qword [0x1400a2198]
lea r8, [0x14007dc30]
mov rdx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x478]
call qword [case.0x140024ad2.8]
mov rcx, qword [0x1400a2198]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
mov rdx, qword [rcx]
cmovle ebx, eax
mov rax, qword [rdx + 0x100]
mov rdx, qword [rsp + 0x40]
call qword [case.0x140024ad2.8]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140063300
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400a2320]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
mov qword [rsp + 0x40], rdi
movdqa xmm0, xmmword [0x1400889c0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
lea rcx, [rsp + 0x40]
call fcn.140045698
mov ebx, eax
test eax, eax
js 0x14004dddd
mov rcx, qword [0x1400a2198]
mov rax, qword [rcx]
mov r10, qword [rax + 0xd0]
mov eax, dword [rsp + 0x50]
lea eax, [rax*2 + 2]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 1
lea r9, [0x14007dc30]
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, 0xffffffff80000001
mov rax, r10
call qword [case.0x140024ad2.8]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rcx, [rsp + 0x40]
call fcn.1400048e8
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140063300
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
test cl, cl
jne 0x14004dd30
jmp 0x140043380
mov cl, dl
jmp 0x14004f694
Function at 0x14005f4c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1400a2320]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xa0]
xor ebp, ebp
add eax, eax
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x3c], eax
mov rsi, r9
mov qword [rsp + 0x30], rbp
mov rdi, r8
test rdx, rdx
je 0x14005f579
cmp word [rdx], bp
je 0x14005f579
test r8, r8
je 0x14005f579
cmp word [r8], bp
je 0x14005f579
test r9, r9
je 0x14005f579
lea rax, [rsp + 0x30]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14005f565
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x14005f565
cmp dword [rsp + 0x38], 1
lea eax, [rbp + 0xd]
cmovne ebx, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14005f575
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14005f57e
mov eax, 0x57
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140063300
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14005f594
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400a2320]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, qword [rsp + 0xb0]
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov rsi, r9
mov r10, rdx
mov r11, rcx
test rdx, rdx
je 0x14005f6a7
cmp word [rdx], r14w
je 0x14005f6a7
test r9, r9
je 0x14005f6a7
cmp word [r9], r14w
je 0x14005f6a7
test rdi, rdi
je 0x14005f6a7
cmp word [rdi], r14w
je 0x14005f6a7
mov edx, 0x7fffffff
mov rax, rdi
mov ecx, edx
cmp word [rax], r14w
je 0x14005f61a
add rax, 2
sub rcx, 1
jne 0x14005f60a
sub rdx, rcx
mov rax, rcx
neg rax
sbb rbp, rbp
and rbp, rdx
test rcx, rcx
jne 0x14005f633
lea ebx, [rcx + 0x57]
jmp 0x14005f6a3
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r8
mov rdx, r10
mov dword [rsp + 0x28], 0x20106
xor r8d, r8d
mov rcx, r11
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x14005f693
mov rcx, qword [rsp + 0x50]
lea eax, [rbp*2 + 2]
mov dword [rsp + 0x28], eax
lea r9d, [rbx + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14005f6a3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14005f6ac
mov eax, 0x57
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140063300
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005f7e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1400a2320]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov bl, r8b
mov rsi, rdx
mov r14, rcx
xor edi, edi
mov dword [rbp - 0x80], edi
mov qword [rcx], rdi
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memset
lea edx, [rdi + 1]
lea rcx, [rbp - 0x70]
call fcn.140023460
nop
test bl, bl
je 0x14005f851
lea rdx, str.Wow6432Node_
lea rcx, [rbp - 0x70]
call fcn.1400147c8
lea rdx, str.CLSID_
lea rcx, [rbp - 0x70]
call fcn.1400147c8
mov rcx, rax
mov rdx, rsi
call fcn.1400147c8
mov rcx, rax
lea rdx, str.LocalServer32
call fcn.1400147c8
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x68]
call fcn.140014670
nop
mov ebx, 5
mov dword [rbp - 0x80], ebx
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rsi, 0xffffffff80000000
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14005f90f
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140014670
mov ebx, 0xf
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov sil, dil
jne 0x14005f912
mov sil, 1
test bl, 2
je 0x14005f925
and ebx, 0xfffffffd
lea rcx, [rsp + 0x40]
call fcn.1400048e8
nop
test bl, 1
je 0x14005f934
lea rcx, [rsp + 0x60]
call fcn.1400048e8
test sil, sil
je 0x14005f9c5
mov dword [rbp - 0x80], edi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14005f9ba
mov ecx, dword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14005f9ba
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14005f9b1
mov qword [r14], rbx
mov dil, 1
jmp 0x14005f9ba
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp + 0x18]
call fcn.1400233e8
lea rcx, [rbp + 0x18]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
mov al, dil
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140063300
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140060770
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + rcx]
movabs r9, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r9
cmp r8, 2
jb 0x14006077d
mov rax, rdx
ret

Function at 0x140063930
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
mov r11, qword [r14 + 0x10]
add r14, 0x18
mov r15, qword [r14]
mov r12, r15
add r12, 0x10
mov r14, qword [r12]
push rax
mov r12, qword [r14 + 0x30]
cmp r12, 0
je 0x14006398a
mov r15, qword [r14 + 0x60]
mov rax, qword [r15]
and eax, 0xdf00df
mov r15, qword [r15 + 0xb]
add r15d, eax
shr r15d, 2
sub r15d, 0xc914cd2
cmp r15, 0
je 0x140063992
mov r14, qword [r14]
jmp 0x14006395b
mov r14d, dword [r12 + 0x3c]
add r14, r12
add r14, 0x10
mov r15d, dword [r14 + 0x78]
add r15, r12
push r10
mov eax, dword [r15 + 0x20]
add rax, r12
mov r10d, dword [rax]
add r10, r12
mov r14d, dword [r10 + 0xb]
sub r14d, 0x746365
cmp r14d, 0
jne 0x1400639c7
jmp 0x1400639d5
inc rax
inc rax
inc rax
inc rax
jmp 0x1400639ae
mov r14d, dword [r15 + 0x20]
sub rax, r14
sub rax, r12
shr eax, 1
mov r14d, dword [r15 + 0x24]
add r14, rax
add r14, r12
mov eax, dword [r14]
mov r14d, dword [r15 + 0x1c]
shl eax, 0x10
shr eax, 0xe
add r14, r12
add r14, rax
mov eax, dword [r14]
add rax, r12
mov r14d, 0x116000
add r14, r11
push r12
push r11
push r14
push r10
push r10
push rax
mov rcx, r14
mov r9, rsp
mov r8d, 0x40
mov edx, 0xb8000
call rax
pop r15
pop r10
pop r10
pop r14
pop r11
mov r12d, 0x7b02
push rax
movabs r15, 0x3ae00
mov eax, 0x17
imul r12, rax
movabs rax, 0x1ee3
add rax, r11
add r12, rax
call fcn.140063a8c
mov r12d, 0xeea11
movabs r14, 0x156000
add r12, r11
mov r15d, 0x3b30
add r14, r11
call fcn.140063a8c
pop rax
jmp 0x140063ab2
nop
ret
mov r12d, 0x8000000
mov r15d, 0x4db
movabs r14, 0x116000
mov eax, 3
imul r15d, eax
add r15d, 0x16f
add r14, r11
sub r14, r15
mov r15, r14
sub r15, r12
mov r12d, 0xf3611
add r12, r11
mov eax, dword [r12]
xor eax, 0x322346ca
dec eax
cmp eax, 0
je 0x140063b0f
add rax, r14
mov r10, qword [rax]
add r10, r15
mov qword [rax], r10
add r12, 4
jmp 0x140063aed
sub rsp, 0x28
movabs r14, 0x42a7
mov r12d, 0x29b9
add r12, 0x13312c
add r12, r14
add r12, r11
push r12
dec r10
lea r15d, [eax]
jmp 0x140063ab0

Function at 0x140064408
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140064452
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140064452
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140064452
mov eax, SHFlushSFCache
cmp word [rcx + 0x18], ax
jne 0x140064452
cmp dword [rcx + 0x84], 0xe
jbe 0x140064452
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140064454
xor al, al
add rsp, 0x28
ret
Function at 0x14062e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14062e1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14062e089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14062e06f
add dl, dl
jne 0x14062e096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14062e0f6
xor eax, eax
add dl, dl
jne 0x14062e0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14062e1ad
add dl, dl
jne 0x14062e0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14062e0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14062e0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14062e0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14062e0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14062e07e
mov eax, 1
add dl, dl
jne 0x14062e106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14062e113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14062e0fb
sub eax, ebx
mov ebx, 1
jne 0x14062e14c
mov ecx, 1
add dl, dl
jne 0x14062e12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14062e13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14062e123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14062e07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14062e168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14062e175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14062e15d
cmp eax, 0x7d00
jae 0x14062e19b
cmp eax, 0x500
jb 0x14062e196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14062e07e
cmp eax, 0x7f
ja 0x14062e19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14062e07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14062e1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14062e07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20