joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d8530
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
cmp qword [rcx + 0x330], rbp
mov dword [rsp + 0x30], ebp
je 0x1400d85a0
mov rcx, qword [rcx + 0x308]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x330]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1400d8593
cmp dword [rsp + 0x30], 0x103
jne 0x1400d8593
mov rcx, qword [rbx + 0x330]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x330]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x180]
mov qword [rbx + 0x330], rbp
test rcx, rcx
je 0x1400d85c0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x180], rbp
mov rcx, qword [rbx + 0x178]
test rcx, rcx
je 0x1400d85eb
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rbx + 0x178]
test rcx, rcx
je 0x1400d85eb
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x178], rbp
mov rdi, qword [rbx + 0x310]
test rdi, rdi
je 0x1400d8626
mov rcx, rdi
call fcn.1401280d0
cmp dword [rdi + 0xa4], ebp
jne 0x1400d8617
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400d8617
call fcn.14013c754
mov qword [rdi], rbp
mov rcx, rdi
call fcn.14013c754
mov qword [rbx + 0x310], rbp
mov rax, qword [rbx + 0x338]
lea rdi, [0x14019bd68]
mov ecx, 1
mov rsi, rax
repe cmpsw word [rsi], word [rdi]
je 0x1400d864a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x14022c3b0]
mov dword [rbx + 0x16c], ebp
test rcx, rcx
je 0x1400d866a
mov rax, qword [rcx]
xor r8d, r8d
mov edx, 0x21020223
call qword [rax + 0x58]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400e08c0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x40
cmp qword [rcx + 0x40], 0
mov rsi, rcx
jne 0x1400e08e8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x40], rax
cmp qword [rsi + 0x48], 0
jne 0x1400e0903
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x48], rax
lea rcx, [0x1400e0510]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call fcn.14014a4fc
test rax, rax
mov rbp, rax
je 0x1400e0991
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
mov dword [rsp + 0x30], 2
lea r9, [rsi + 0x38]
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov dword [rsi + 0x50], 1
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
Function at 0x1400ec5a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
test rdx, rdx
mov rsi, r9
mov rdi, r8
jne 0x1400ec5e1
mov rdx, qword [r8]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ec5d4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
test r9, r9
je 0x1400ec5b5
mov r9d, dword [rsp + 0x70]
xor eax, eax
xor r8d, r8d
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x38]
or r9d, 1
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ec6e8
mov rdx, qword [rdi]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ec6a9
cmp dword [rsp + 0x34], 4
jne 0x1400ec6a9
test rbx, rbx
mov eax, dword [rsp + 0x58]
mov dword [rsi], eax
je 0x1400ec675
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ec694
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
test rbx, rbx
je 0x1400ec6b7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ec6d6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x40
pop rdi
ret
mov rdx, qword [rdi]
jmp 0x1400ec5b8
Function at 0x1400ec6f0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push r13
sub rsp, 0x40
test rdx, rdx
mov r13d, r9d
mov rbx, r8
mov rbp, rdx
jne 0x1400ec731
mov rdx, qword [r8]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ec726
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
add rsp, 0x40
pop r13
pop rbp
pop rbx
ret
mov rdx, qword [r8]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rdi
lea rdi, [0x14019bd68]
mov ecx, 1
mov rsi, rdx
repe cmpsw word [rsi], word [rdi]
jne 0x1400ec775
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ec76e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x1400ec8d1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x78], r12
mov r12d, dword [rsp + 0x80]
mov r9d, r12d
xor edi, edi
xor r8d, r8d
mov rdx, rbp
mov rcx, 0xffffffff80000002
or r9d, 0x2001f
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ec7b9
mov rdi, qword [rsp + 0x30]
xor esi, esi
test eax, eax
sete sil
test rdi, rdi
je 0x1400ec7cf
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1400ec7e9
mov r8d, r12d
mov rdx, rbp
mov rcx, 0xffffffff80000002
call fcn.1400ed440
test eax, eax
je 0x1400ec861
lea rax, [rsp + 0x38]
or r12d, 2
xor r8d, r8d
mov rdx, rbp
mov rcx, 0xffffffff80000002
mov r9d, r12d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ec8ab
mov rdi, qword [rsp + 0x38]
mov rdx, qword [rbx]
lea rax, [rsp + 0x68]
mov rcx, rdi
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x68], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400ec877
test rdi, rdi
je 0x1400ec861
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jmp 0x1400ec8bf
test rdi, rdi
je 0x1400ec885
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ec8a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x1400ec8cc
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ec8ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop rbp
pop rbx
ret
Function at 0x1400eca00
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov edi, r8d
mov rbx, rcx
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x38]
call fcn.1400ed270
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ecb08
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400ecacf
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ecabb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ecacb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400ecb2c
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ecaf1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ecb01
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1400ecb2c
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ecb2a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400ecc70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov edi, r8d
mov rbx, rcx
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.1400ed270
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ecdcf
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ecd2f
cmp dword [rsp + 0x34], 4
jne 0x1400ecd2f
cmp dword [rsp + 0x88], edi
je 0x1400ecd96
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400ecd96
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ecd82
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400ecd92
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400ecdf3
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ecdb8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400ecdc8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1400ecdf3
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ecdf1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1400ed0a0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov edi, r8d
mov rbx, rcx
test rcx, rcx
jne 0x1400ed0ce
xor eax, eax
jmp 0x1400ed231
xor esi, esi
mov qword [rsp + 0x50], rsi
lea rcx, [rsp + 0x58]
call fcn.1400ed270
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ed115
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x50], rcx
jmp 0x1400ed16a
mov qword [rsp + 0x68], rsi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400ed20d
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x90], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400ed1d4
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ed1c0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400ed1d0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400ed231
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ed1f6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400ed206
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1400ed231
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400ed22f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400ed910
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x10080
call fcn.140180a70
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x100b8], rbx
mov rax, qword [0x14020e318]
xor rax, rsp
mov qword [rsp + 0x10070], rax
mov r13, r9
mov r12, r8
mov rbp, rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x60], r9
xor ebx, ebx
mov dword [rsp + 0x34], ebx
mov qword [rsp + 0x48], rbx
call fcn.14013e120
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x1400ed98a
mov ecx, 0x80004005
call fcn.140001c70
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
lea rdx, [0x14019bd68]
or rsi, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x1400ed9cb
movzx edi, dx
mov ecx, edi
call fcn.14014c5c0
test rax, rax
je 0x1400ed9e6
mov r8d, edi
mov rdx, rax
mov rcx, rbp
call fcn.140005140
jmp 0x1400ed9e6
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbp
call fcn.1400038f0
nop
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400edaae
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x30], 0xfffe
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [r13]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400edaae
mov eax, dword [rsp + 0x38]
cmp eax, 1
je 0x1400eda6c
cmp eax, 2
jne 0x1400edaae
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400eda85
test al, 1
jne 0x1400edaae
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], 0
je 0x1400eda8c
jmp 0x1400edaae
mov word [rsp + 0x70], 0
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x70]
mov rcx, rbp
call fcn.1400038f0
nop
test rbx, rbx
je 0x1400edabd
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400edadd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400edafa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rbp
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.14015b6f0
mov rbx, qword [rsp + 0x100b8]
add rsp, 0x10080
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f00d0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push rbp
push r12
push r13
push r14
sub rsp, 0x58
xor r14d, r14d
mov r13, rcx
mov rcx, qword [rcx]
test rcx, rcx
mov rbp, r9
mov r12, rdx
mov dword [rsp + 0x80], r14d
jne 0x1400f0109
mov eax, 0xc0000008
add rsp, 0x58
pop r14
pop r13
pop r12
pop rbp
ret
test rdx, rdx
mov qword [rsp + 0x90], rsi
je 0x1400f0239
test r9, r9
je 0x1400f0239
mov rsi, qword [rsp + 0xa0]
test rsi, rsi
je 0x1400f0239
mov dword [rsp + 0x48], 2
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
lea r8d, [r9 + 0xc]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
js 0x1400f01ca
mov qword [rsp + 0x88], rbx
mov ebx, dword [rsp + 0x80]
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
jne 0x1400f01de
mov ebx, 0xc0000017
test rdi, rdi
je 0x1400f01bb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x90]
add rsp, 0x58
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [r13]
mov dword [rsp + 0x48], 2
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x80]
xor r9d, r9d
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rdi
lea r8d, [r9 + 0xc]
mov rdx, r12
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
mov ebx, eax
js 0x1400f01a2
mov ecx, dword [rsp + 0x80]
mov qword [rbp], rdi
mov dword [rsi], ecx
jmp 0x1400f01bd
mov eax, 0xc000000d
jmp 0x1400f01ca
Function at 0x1400f0a40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0xa4], edi
je 0x1400f0a64
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
add rcx, 0xa8
mov qword [rsp + 0x40], rsi
call fcn.1400f1250
test eax, eax
jns 0x1400f0a90
mov rsi, qword [rsp + 0x40]
mov edi, 0x80004005
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rbx + 0xd8], rax
je 0x1400f0b64
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rbx + 0xc8], rax
je 0x1400f0b64
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rbx + 0xd0], rax
je 0x1400f0b64
lea r8, [0x1400f0b80]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 0xc0], rax
je 0x1400f0b64
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x1400f0b64
mov rax, qword [rcx]
mov rdx, qword [rbx + 0xd0]
call qword [rax + 0x18]
test eax, eax
js 0x1400f0b64
mov dword [rbx + 0xe8], 1
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x1400f0b64
mov r8, qword [rcx]
mov rdx, qword [rbx + 0xc8]
call qword [r8 + 0x30]
test eax, eax
js 0x1400f0b64
mov dword [rbx + 0xec], 1
mov rsi, qword [rsp + 0x40]
mov dword [rbx + 0xa4], 1
mov rbx, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1400f1460
Capabilities:
Resume thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0x40], r8
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rcx
call fcn.140148d4c
nop
lea rax, [0x1401b4ba8]
mov qword [rbx], rax
lea rax, [0x1401b4c58]
mov qword [rbx + 0x40], rax
call fcn.14013e120
mov rcx, rax
xor esi, esi
mov eax, esi
test rcx, rcx
setne al
test eax, eax
jne 0x1400f14cd
mov ecx, 0x80004005
call fcn.140001c70
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x48], rax
lea r12, [rbx + 0x60]
mov qword [r12], rsi
mov qword [rbx + 0x68], rsi
mov qword [rbx + 0x70], rsi
mov qword [rbx + 0x78], rsi
lea rdi, [rbx + 0x80]
mov esi, 4
nop
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi], rax
add rdi, 8
sub rsi, 1
jne 0x1400f1500
test rbp, rbp
jne 0x1400f1526
xor ecx, ecx
jmp 0x1400f1539
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
mov rdx, rbp
lea rcx, [rbx + 0x48]
call fcn.1400038f0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx]
mov dword [rbx + 0x50], eax
mov eax, dword [rcx + 4]
mov dword [rbx + 0x54], eax
mov eax, dword [rcx + 8]
mov dword [rbx + 0x58], eax
mov eax, dword [rcx + 0xc]
mov dword [rbx + 0x5c], eax
mov qword [rsp + 0x20], r12
lea r9, [0x1401ad298]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1401ad288]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400f1635
mov rcx, qword [r12]
mov rax, qword [rcx]
lea rdx, [rbx + 0x40]
call qword [rax + 0x30]
test eax, eax
js 0x1400f1635
xor ebp, ebp
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x1400f1cd0]
call fcn.14014a4fc
mov rsi, rax
test rax, rax
je 0x1400f1635
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
lea r9, [rbx + 0x78]
mov r8, rdi
mov rdx, qword [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsi + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call fcn.1400f1bb0
test eax, eax
je 0x1400f1635
mov rcx, rbx
call fcn.1400f1bb0
test eax, eax
je 0x1400f1635
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x1400f1635
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
mov rax, rbx
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret