joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031c20
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [0x14013dae8], 0
mov rdi, rdx
jne 0x140031c69
lea rcx, [0x140031b70]
call fcn.1400a3fb0
lea rcx, [0x140031b50]
mov qword [0x14013dae8], rax
call fcn.1400a3fb0
mov qword [0x14013daf0], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14013daf8], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14013dae8]
xor edx, edx
mov dword [0x14013daf8], eax
call fcn.1400a3ef0
mov rbx, rax
test rax, rax
je 0x140031d0a
nop dword [rax + rax]
mov rdx, qword [rbx + 8]
xor r8d, r8d
mov rcx, qword [0x14013daf0]
call fcn.1400a3a70
test rax, rax
jne 0x140031cb8
mov rcx, qword [0x14013dae8]
xor edx, edx
call fcn.1400a3360
jmp 0x140031cec
mov r8d, dword [rbx + 0x10]
mov edx, r8d
sub edx, dword [rbx + 0x14]
mov eax, dword [0x14013daf8]
add edx, 0xa
sub eax, dword [rbx + 0x14]
add eax, 0xa
cmp eax, edx
jbe 0x140031d17
mov rcx, qword [0x14013dae8]
xor edx, edx
call fcn.1400a3360
mov edx, dword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call qword [rbx]
mov rcx, rbx
call fcn.1400a62e0
mov rcx, qword [0x14013dae8]
xor edx, edx
call fcn.1400a3ef0
mov rbx, rax
test rax, rax
jne 0x140031c90
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov al, 1
mov dword [rdi], r8d
add rsp, 0x20
pop rdi
ret

Function at 0x140031d30
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [0x14013dae8], 0
mov rsi, r8
mov rbp, rdx
mov ebx, ecx
jne 0x140031d88
lea rcx, [0x140031b70]
call fcn.1400a3fb0
lea rcx, [0x140031b50]
mov qword [0x14013dae8], rax
call fcn.1400a3fb0
mov qword [0x14013daf0], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14013daf8], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add ebx, eax
mov dword [0x14013daf8], eax
cmp ebx, eax
jne 0x140031d9d
lea ebx, [rax + 1]
xor r8d, r8d
lea edx, [r8 + 0x18]
lea ecx, [rdx - 0x17]
call fcn.1400a64d0
mov ecx, dword [0x14013daf8]
mov rdx, rax
mov rdi, rax
mov dword [rax + 0x14], ecx
mov rcx, qword [0x14013dae8]
mov qword [rax], rbp
mov qword [rax + 8], rsi
mov dword [rax + 0x10], ebx
call fcn.1400a2c80
cmp rdi, rax
je 0x140031de0
mov rcx, rdi
call fcn.1400a62e0
jmp 0x140031df0
mov rdx, qword [rdi + 8]
mov rcx, qword [0x14013daf0]
call fcn.1400a2c80
mov rcx, qword [0x14013dae8]
xor edx, edx
call fcn.1400a3ef0
cmp rax, rdi
jne 0x140031e0b
mov ecx, dword [rax + 0x10]
call fcn.14000b1d0
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400320c0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2c0
mov rax, qword [0x14013b4f8]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdi, rcx
mov edx, 0x107
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rsp + 0x1a0]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140032100
movzx eax, word [0x1400c158c]
lea rdx, [rsp + 0x40]
mov word [rcx], ax
movzx eax, byte [0x1400c158e]
mov byte [rcx + 2], al
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140032167
nop word [rax + rax]
mov edx, 0x140
lea rcx, [rsp + 0x40]
call rdi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140032140
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 4
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], eax
call rdi
cmp qword [0x14013db40], 0
jne 0x14003222e
lea rcx, str.advapi32.dll
call fcn.1400a4240
mov qword [0x14013db40], rax
test rax, rax
je 0x1400321bf
lea rdx, str.CryptAcquireContextA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rax, qword [0x14013db40]
jmp 0x1400321c1
xor ecx, ecx
mov qword [0x14013db28], rcx
test rax, rax
je 0x1400321e9
lea rdx, str.CryptGenRandom
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rax, qword [0x14013db40]
jmp 0x1400321eb
xor ecx, ecx
mov qword [0x14013db30], rcx
test rax, rax
je 0x14003221e
lea rdx, str.CryptReleaseContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14013db40], 0
mov qword [0x14013db38], rax
je 0x1400322bb
jmp 0x140032235
mov qword [0x14013db38], 0
jmp 0x1400322bb
mov rax, qword [0x14013db38]
mov r10, qword [0x14013db28]
test r10, r10
je 0x1400322bb
cmp qword [0x14013db30], 0
je 0x1400322bb
test rax, rax
je 0x1400322bb
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
call r10
test eax, eax
je 0x1400322bb
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x180]
mov edx, 0x20
call qword [0x14013db30]
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov ebx, eax
call qword [0x14013db38]
test ebx, ebx
je 0x1400322bb
mov edx, 0x20
lea rcx, [rsp + 0x180]
call rdi
mov edx, 0x20
lea rcx, [rsp + 0x180]
call fcn.1400abcc0
mov rcx, rdi
call fcn.14006ad30
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400b0530
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x2c0
pop rdi
ret
Function at 0x1400322f0
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0xb8
mov rax, qword [0x14013b4f8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea ecx, [r8 + 1]
call fcn.140032520
call qword [sym.imp.USER32.dll_GetCapture]
mov r8d, 8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea ecx, [r8 + 2]
call fcn.140032520
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov r8d, 8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea ecx, [r8 + 3]
call fcn.140032520
mov ecx, 0x1cbf
call qword [sym.imp.USER32.dll_GetQueueStatus]
mov r8d, 4
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], eax
lea ecx, [r8 + 8]
call fcn.140032520
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r8d, 8
lea rdx, [rsp + 0x40]
lea ecx, [r8 + 5]
call fcn.140032520
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov r8d, 0x38
lea rdx, [rsp + 0x48]
lea ecx, [r8 - 0x32]
call fcn.140032520
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea r9, [rsp + 0x90]
lea rax, [rsp + 0x98]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov r8d, 0x20
lea rdx, [rsp + 0x80]
lea ecx, [r8 - 0x12]
call fcn.140032520
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x90]
lea rax, [rsp + 0x98]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov r8d, 0x20
lea rdx, [rsp + 0x80]
lea ecx, [r8 - 0x11]
call fcn.140032520
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400b0530
add rsp, 0xb8
ret
Function at 0x140036be0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rsi, rdx
mov qword [rcx + 8], 0
mov rbx, rcx
mov r14d, 1
test r8, r8
je 0x140036c4f
xor ecx, ecx
sub r8, rcx
mov r9, rsi
add rcx, qword [rbx]
mov rdx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
jne 0x140036ca8
test rdi, rdi
je 0x140036c4f
mov rcx, qword [rbx + 8]
add rcx, rdi
mov qword [rbx + 8], rcx
mov r8, qword [rbx + 0x10]
cmp rcx, r8
jb 0x140036c14
mov rax, qword [rbx + 0x10]
xor edi, edi
cmp qword [rbx + 8], rax
jne 0x140036c6b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
cmp eax, 0xffffffff
cmovne edi, r14d
mov rcx, qword [rbx]
mov eax, edi
mov rdx, qword [rbx + 8]
add rbx, 0x18
mov qword [rbx], rcx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 8], 0
mov dword [rbx + 0x18], 0
mov qword [rbx + 0x20], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov eax, 2
jmp 0x140036c92
Function at 0x140055950
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x14013b4f8]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14, r9
mov qword [rsp + 0x40], r8
mov r13, rdx
mov qword [rsp + 0x38], 0
mov rsi, rcx
xor edi, edi
call fcn.1400aea90
lea rdx, [rsp + 0x38]
mov rcx, rax
mov r15, rax
call fcn.14006ff30
mov rbp, rax
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140055b3b
mov rcx, rsi
call fcn.1400a6ba0
mov r8, qword [rsi + 0x10]
xor ebx, ebx
test r8, r8
je 0x140055a06
xor ecx, ecx
nop dword [rax]
mov rdx, qword [rsi]
lea r9, [rsp + 0x30]
add rdx, rcx
mov qword [rsp + 0x20], rdi
mov rcx, rbp
sub r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140055b3b
add ebx, dword [rsp + 0x30]
mov rax, qword [rsi + 0x10]
mov ecx, ebx
mov r8d, eax
cmp rcx, rax
jb 0x1400559d0
test r14, r14
jne 0x140055add
call fcn.1400a6d30
mov rdi, rax
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140055b3b
mov r8d, dword [rsp + 0x30]
lea rcx, [rdi + 0x18]
lea rdx, [rsp + 0x50]
call fcn.1400a2290
mov r8, qword [rdi + 0x10]
cmp r8, 4
jb 0x140055a20
mov rcx, qword [rdi + 8]
movzx eax, byte [rcx + 1]
movzx edx, byte [rcx]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 3]
shl edx, 8
or edx, eax
cmp edx, 0x40000
ja 0x140055b3b
lea ebx, [rdx + 4]
movsxd rax, ebx
cmp r8, rax
jb 0x140055a20
test ebx, ebx
je 0x140055a20
cmp ebx, 0xffffffff
je 0x140055b3b
mov rcx, rdi
call fcn.1400a6df0
mov rcx, qword [rsp + 0x38]
xor edi, edi
mov qword [r13], rax
mov rax, qword [rsp + 0x40]
mov dword [rax], ebx
call fcn.1400a62e0
mov rcx, r15
call fcn.1400a62e0
jmp 0x140055b66
xor r8d, r8d
lea edx, [r8 + 0x28]
lea ecx, [rdx - 0x27]
call fcn.1400a64d0
xor r9d, r9d
lea rdx, [0x140055880]
mov r8, rax
mov rcx, rbp
mov rbx, rax
call fcn.1400707b0
mov qword [rbx], rax
mov qword [rbx + 8], rbp
call fcn.1400a6d30
mov rcx, qword [rsp + 0x4c0]
mov qword [rbx + 0x20], rcx
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], r14
mov rcx, qword [rsp + 0x38]
call fcn.1400a62e0
mov rcx, r15
call fcn.1400a62e0
mov rax, rbx
jmp 0x140055b7e
mov rax, qword [rsp + 0x40]
mov qword [r13], 0
mov dword [rax], 0
mov rcx, qword [rsp + 0x38]
call fcn.1400a62e0
mov rcx, r15
call fcn.1400a62e0
cmp r12, 0xffffffffffffffff
je 0x140055b6f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x140055b7c
mov rcx, rdi
call fcn.1400a6c00
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400b0530
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140061f30
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x20
mov edx, 0x3a
mov rbx, rcx
call fcn.1400a8630
cmp byte [rax], 0
je 0x140061f55
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.1400aa5f0
mov edx, 0x3b
mov rcx, rbx
call fcn.1400a8210
test al, al
je 0x140061f70
add rsp, 0x20
pop rbx
jmp fcn.1400abb70
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140069e60
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x14013b4f8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ebp, ecx
lea r9, str.SoftwareSimonTathamPuTTY
xor edi, edi
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x20], rdi
mov r8, 0xffffffff80000001
call fcn.1400aa060
mov rbx, rax
test rax, rax
je 0x140069ef2
lea rdx, str.RandSeedFile
mov rcx, rax
call fcn.1400a9e40
mov rcx, rbx
mov rsi, rax
call sub.ADVAPI32.dll_RegCloseKey
test rsi, rsi
je 0x140069ef2
lea r8, [rsp + 0x30]
mov edx, ebp
mov rcx, rsi
call fcn.14006b3a0
mov rcx, rsi
movzx ebx, al
call fcn.1400a62e0
test bl, bl
jne 0x14006a0d0
cmp byte [0x14013dc18], dil
jne 0x140069f36
lea rcx, str.shell32.dll
call fcn.1400a4240
mov qword [0x14013dc20], rax
test rax, rax
je 0x140069f26
lea rdx, str.SHGetFolderPathA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [0x14013dc28], rdi
mov byte [0x14013dc18], 1
jmp 0x140069f3d
mov rdi, qword [0x14013dc28]
test rdi, rdi
je 0x140069ff4
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1c]
call rdi
test eax, eax
js 0x140069f9b
xor r8d, r8d
lea rdx, str.PUTTY.RND
lea rcx, [rsp + 0x40]
call fcn.1400a6570
lea r8, [rsp + 0x30]
mov edx, ebp
mov rcx, rax
mov rdi, rax
call fcn.14006b3a0
mov rcx, rdi
movzx ebx, al
call fcn.1400a62e0
test bl, bl
jne 0x14006a0d0
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [0x14013dc28]
test eax, eax
js 0x140069ff4
xor r8d, r8d
lea rdx, str.PUTTY.RND
lea rcx, [rsp + 0x40]
call fcn.1400a6570
lea r8, [rsp + 0x30]
mov edx, ebp
mov rcx, rax
mov rdi, rax
call fcn.14006b3a0
mov rcx, rdi
movzx ebx, al
call fcn.1400a62e0
test bl, bl
jne 0x14006a0d0
mov r8d, 0x104
lea rdx, [rsp + 0x150]
lea rcx, str.HOMEDRIVE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov r8d, 0x104
lea rdx, [rsp + 0x40]
lea rcx, str.HOMEPATH
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test ebx, ebx
jne 0x14006a036
mov byte [rsp + 0x150], bl
jmp 0x14006a03e
cmp ebx, 0x104
jae 0x14006a084
dec eax
cmp eax, 0x102
ja 0x14006a084
xor r9d, r9d
lea r8, str.PUTTY.RND
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x150]
call fcn.1400a6570
lea r8, [rsp + 0x30]
mov edx, ebp
mov rcx, rax
mov rdi, rax
call fcn.14006b3a0
mov rcx, rdi
movzx ebx, al
call fcn.1400a62e0
test bl, bl
jne 0x14006a0d0
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, 0x104
jae 0x14006a0d7
xor r8d, r8d
lea rdx, str.PUTTY.RND
lea rcx, [rsp + 0x40]
call fcn.1400a6570
lea r8, [rsp + 0x30]
mov edx, ebp
mov rcx, rax
mov rdi, rax
call fcn.14006b3a0
mov rcx, rdi
movzx ebx, al
call fcn.1400a62e0
test bl, bl
je 0x14006a0d7
mov rax, qword [rsp + 0x30]
jmp 0x14006a0de
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400b0530
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14006a3f0
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x30
xor ecx, ecx
call fcn.140069e60
call fcn.140023270
lea r9, str.SoftwareSimonTathamPuTTY
mov qword [rsp + 0x20], 0
mov edx, 1
xor ecx, ecx
mov r8, 0xffffffff80000001
call fcn.1400aa060
mov rbx, rax
test rax, rax
je 0x14006a43d
mov rcx, rax
call fcn.14006afd0
mov rcx, rbx
call sub.ADVAPI32.dll_RegCloseKey
lea r9, str.SoftwareSimonTatham
mov qword [rsp + 0x20], 0
mov edx, 1
xor ecx, ecx
mov r8, 0xffffffff80000001
call fcn.1400aa060
mov rbx, rax
test rax, rax
je 0x14006a4f3
lea rdx, [0x1400b3a6c]
mov qword [rsp + 0x40], rdi
mov rcx, rax
call sub.ADVAPI32.dll_RegDeleteKeyA
xor edx, edx
mov rcx, rbx
call fcn.1400a9c20
mov rcx, rbx
mov rdi, rax
call sub.ADVAPI32.dll_RegCloseKey
test rdi, rdi
je 0x14006a4ac
mov rcx, rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp fcn.1400a62e0
lea r9, str.Software
mov qword [rsp + 0x20], 0
mov edx, 1
xor ecx, ecx
mov r8, 0xffffffff80000001
call fcn.1400aa060
mov rbx, rax
test rax, rax
je 0x14006a4ee
lea rdx, str.SimonTatham
mov rcx, rax
call sub.ADVAPI32.dll_RegDeleteKeyA
mov rcx, rbx
call sub.ADVAPI32.dll_RegCloseKey
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x14006a550
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x20], 0
xor ecx, ecx
lea r9, str.SoftwareSimonTathamPuTTYSessions
mov edx, 1
mov r8, 0xffffffff80000001
call fcn.1400aa060
mov rdi, rax
test rax, rax
je 0x14006a5c8
mov qword [rsp + 0x40], rbx
call fcn.1400a6c40
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call fcn.1400aee20
mov rdx, qword [rbx]
mov rcx, rdi
call sub.ADVAPI32.dll_RegDeleteKeyA
mov rcx, rbx
call fcn.1400a6c00
mov rcx, rdi
call sub.ADVAPI32.dll_RegCloseKey
mov rcx, rsi
call fcn.1400235b0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14006a760
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x20], 0
xor ecx, ecx
lea r9, str.SoftwareSimonTathamPuTTYSshHostCAs
mov edx, 1
mov r8, 0xffffffff80000001
call fcn.1400aa060
mov rdi, rax
test rax, rax
je 0x14006a7c8
mov qword [rsp + 0x40], rbx
call fcn.1400a6c40
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call fcn.1400aee20
mov rdx, qword [rbx]
mov rcx, rdi
call sub.ADVAPI32.dll_RegDeleteKeyA
mov rcx, rbx
call fcn.1400a6c00
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x14006ad30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x14013b4f8]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
mov ecx, 1
call fcn.140069e60
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14006add3
mov qword [rsp + 0x468], rsi
lea r9, [rsp + 0x30]
xor esi, esi
lea rdx, [rsp + 0x40]
mov r8d, 0x400
mov qword [rsp + 0x20], rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14006adc2
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x14006adc2
lea rcx, [rsp + 0x40]
call rdi
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
mov r8d, 0x400
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14006ad91
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400b0530
mov rbx, qword [rsp + 0x470]
add rsp, 0x450
pop rdi
ret

Function at 0x14006afc0
Capabilities:
Query or enumerate registry value

Disassembly:
test rcx, rcx
jne 0x14006afc8
xor eax, eax
ret
mov rcx, qword [rcx]
jmp fcn.1400a9e40

Function at 0x14006afd0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edx, edx
mov rsi, rcx
call fcn.1400a9c20
mov rdi, rax
test rax, rax
je 0x14006b05e
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
xor ebp, ebp
nop dword [rax + rax]
mov r9, rdi
mov qword [rsp + 0x20], rbp
mov r8, rsi
mov edx, 1
xor ecx, ecx
call fcn.1400aa060
mov rbx, rax
test rax, rax
je 0x14006b02f
mov rcx, rax
call fcn.14006afd0
mov rcx, rbx
call sub.ADVAPI32.dll_RegCloseKey
mov rdx, rdi
mov rcx, rsi
call sub.ADVAPI32.dll_RegDeleteKeyA
mov rcx, rdi
call fcn.1400a62e0
xor edx, edx
mov rcx, rsi
call fcn.1400a9c20
mov rdi, rax
test rax, rax
jne 0x14006b000
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14006b3a0
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
test edx, edx
jne 0x14006b3fc
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14006b3e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14006b3e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400a42b0
mov r8, rax
lea rcx, str.Unable_to_delete__s:__s
mov rdx, rbx
call fcn.14000a430
mov qword [rdi], 0xffffffffffffffff
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
xor r11d, r11d
mov eax, 0x80
cmp edx, 2
mov qword [rsp + 0x30], r11
mov ecx, r11d
mov r8d, 3
cmove ecx, eax
mov r10d, 0x40000000
mov eax, r11d
mov dword [rsp + 0x28], ecx
setne al
mov rcx, rbx
add eax, 2
cmp edx, 2
mov dword [rsp + 0x20], eax
mov edx, 0x80000000
cmove r8d, r11d
cmove edx, r10d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, qword [rsp + 0x50]
cmp rax, 0xffffffffffffffff
mov qword [rdi], rax
setne al
add rsp, 0x40
pop rdi
ret
Function at 0x14006b460
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov edi, edx
mov ecx, 2
call fcn.140069e60
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14006b4ad
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14006b4c0
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x14006b4d0
mov r8, qword [r8]
mov rcx, qword [rcx]
jmp fcn.1400aa1d0
ret

Function at 0x14006b600
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x14006b60d
mov rcx, qword [rcx]
jmp fcn.1400aa160
ret

Function at 0x14006b610
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x14006b61d
mov rcx, qword [rcx]
jmp fcn.1400aa1d0
ret
Function at 0x14006fc70
Capabilities:
Create pipe
Create process on windows
Create reverse shell

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rbx, rdx
mov dword [rsp + 0x70], 0x18
mov rdi, rcx
mov dword [rbp - 0x80], 1
xor esi, esi
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x78], rsi
xor r9d, r9d
lea r8, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14006fcea
xor r9d, r9d
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14006fd0b
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400a42b0
mov rdx, rax
lea rcx, str.Unable_to_create_pipes_for_proxy_command:__s
call fcn.1400a6690
jmp 0x14006fe69
xor r9d, r9d
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14006fd4d
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
jmp 0x14006fce4
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, qword [rbp + 0x48]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14006fd87
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rsp + 0x50]
xorps xmm0, xmm0
mov qword [rbp - 0x10], rax
mov rcx, rbx
mov rax, qword [rbp + 0x40]
mov qword [rbp - 8], rax
mov rax, qword [rsp + 0x60]
mov qword [rbp], rax
mov dword [rbp - 0x60], 0x68
mov qword [rbp - 0x58], rsi
movdqa xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x24], 0x100
mov word [rbp - 0x1e], si
mov qword [rbp - 0x18], rsi
call fcn.1400aa5f0
mov rbx, rax
xor r9d, r9d
lea rax, [rbp - 0x78]
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov rdx, rbx
lea rax, [rbp - 0x60]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, rbx
call fcn.1400a62e0
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14006fe4c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9, qword [rsp + 0x68]
mov rcx, rdi
mov r8, qword [rbp + 0x48]
mov rdx, qword [rsp + 0x58]
mov byte [rsp + 0x20], sil
call fcn.140074990
xor eax, eax
mov rbx, qword [rsp + 0x130]
add rsp, 0x110
pop rdi
pop rsi
pop rbp
ret