joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001aea0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor eax, eax
test eax, eax
jne 0x14001aeae
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x14001aee0
mov r8, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x10]
call fcn.14001e460
jmp 0x14001af63
movzx eax, byte [0x140048cb8]
test eax, eax
jne 0x14001af25
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14001af1e
lea rdx, str.RegDeleteKeyExW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140048cb0], rax
mov byte [0x140048cb8], 1
cmp qword [0x140048cb0], 0
je 0x14001af50
xor r9d, r9d
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 8]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [0x140048cb0]
jmp 0x14001af63
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rsp, 0x38
ret

Function at 0x14001af70
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor eax, eax
test eax, eax
jne 0x14001af7e
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add rsp, 0x28
ret

Function at 0x14001dfa0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x14001dfb3
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14001e001
mov eax, dword [rsp + 0x30]
jmp 0x14001e011
cmp dword [rsp + 0x38], 4
je 0x14001e00f
mov eax, 0xd
jmp 0x14001e011
xor eax, eax
add rsp, 0x48
ret
Function at 0x14001e0d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
cmp qword [rsp + 0x78], 0
je 0x14001e0fa
mov dword [rsp + 0x34], 1
jmp 0x14001e102
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x40], eax
xor eax, eax
test eax, eax
jne 0x14001e10a
cmp dword [rsp + 0x40], 0
jne 0x14001e121
mov ecx, 0x80004005
call fcn.140018b50
xor eax, eax
test eax, eax
jne 0x14001e0e8
mov dword [rsp + 0x38], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x14001e2db
cmp qword [rsp + 0x68], 0
je 0x14001e2db
mov rax, qword [rsp + 0x78]
cmp dword [rax], 0
jbe 0x14001e2c7
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jbe 0x14001e2aa
cmp dword [rsp + 0x30], 2
jbe 0x14001e1ad
cmp dword [rsp + 0x30], 7
je 0x14001e208
jmp 0x14001e2aa
mov rax, qword [rsp + 0x78]
mov eax, dword [rax]
xor edx, edx
mov ecx, 2
div rcx
mov rax, rdx
test rax, rax
jne 0x14001e1e5
mov rax, qword [rsp + 0x78]
mov eax, dword [rax]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x68]
movzx eax, word [rcx + rax*2 - 2]
test eax, eax
je 0x14001e203
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov rdx, qword [rsp + 0x68]
mov word [rdx + rax], cx
mov eax, 0xd
jmp 0x14001e2df
jmp 0x14001e2c5
mov rax, qword [rsp + 0x78]
mov eax, dword [rax]
xor edx, edx
mov ecx, 2
div rcx
mov rax, rdx
test rax, rax
jne 0x14001e28d
mov rax, qword [rsp + 0x78]
mov eax, dword [rax]
xor edx, edx
mov ecx, 2
div rcx
cmp rax, 1
jb 0x14001e28d
mov rax, qword [rsp + 0x78]
mov eax, dword [rax]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x68]
movzx eax, word [rcx + rax*2 - 2]
test eax, eax
jne 0x14001e28d
mov rax, qword [rsp + 0x78]
mov eax, dword [rax]
xor edx, edx
mov ecx, 2
div rcx
cmp rax, 1
jbe 0x14001e2a8
mov rax, qword [rsp + 0x78]
mov eax, dword [rax]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x68]
movzx eax, word [rcx + rax*2 - 4]
test eax, eax
je 0x14001e2a8
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov rdx, qword [rsp + 0x68]
mov word [rdx + rax], cx
mov eax, 0xd
jmp 0x14001e2df
jmp 0x14001e2c5
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov rdx, qword [rsp + 0x68]
mov word [rdx + rax], cx
mov eax, 0xd
jmp 0x14001e2df
jmp 0x14001e2db
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov rdx, qword [rsp + 0x68]
mov word [rdx + rax], cx
mov eax, dword [rsp + 0x3c]
add rsp, 0x58
ret
Function at 0x14001e2f0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x140047170]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140003a00
nop
mov rax, qword [rsp + 0x2a0]
mov eax, dword [rax + 8]
or eax, 0x2001f
mov r9d, eax
mov r8, qword [rsp + 0x2a8]
mov rax, qword [rsp + 0x2a0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x58]
call fcn.140004a90
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x14001e37f
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x58]
call fcn.140003bf0
mov eax, dword [rsp + 0x48]
jmp 0x14001e43d
mov dword [rsp + 0x44], 0x100
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001e40c
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x58]
call fcn.14001e2f0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x14001e3ff
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x58]
call fcn.140003bf0
mov eax, dword [rsp + 0x4c]
jmp 0x14001e43d
mov dword [rsp + 0x44], 0x100
jmp 0x14001e387
lea rcx, [rsp + 0x58]
call fcn.140004470
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2a0]
call fcn.14001aea0
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x58]
call fcn.140003bf0
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140023e10
add rsp, 0x298
ret

Function at 0x14001e460
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x14001e4ec
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14001e49f
mov eax, 1
jmp 0x14001e50e
lea rdx, [0x140034ec8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14001e4ea
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x38]
jmp 0x14001e50e
jmp 0x14001e509
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0
je 0x14001e509
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14001e50e
mov eax, 1
add rsp, 0x48
ret
Function at 0x14001f2e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x4c8
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x140047170]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
call fcn.1400222d0
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0x78]
call fcn.140014ab0
nop
mov rdx, qword [rsp + 0x4d0]
lea rcx, [rsp + 0x90]
call fcn.140015260
lea rcx, [rsp + 0xa0]
call fcn.140014f10
nop
mov edx, 0x400
mov rcx, qword [rsp + 0x4d8]
call fcn.14001d890
mov qword [rsp + 0x50], rax
mov r8d, 0x60
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14001f39f
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14001f3b5
call fcn.140017bb0
mov dword [rsp + 0x30], eax
jmp 0x14001f519
mov r8, qword [rsp + 0x4e8]
mov rdx, qword [rsp + 0x4e0]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x14001f3eb
call fcn.140017bb0
mov dword [rsp + 0x30], eax
jmp 0x14001f519
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14001f416
call fcn.140017bb0
mov dword [rsp + 0x30], eax
jmp 0x14001f519
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x34]
inc eax
cmp eax, dword [rsp + 0x34]
jae 0x14001f44d
mov dword [rsp + 0x30], 0x8007000e
jmp 0x14001f519
mov eax, dword [rsp + 0x34]
inc eax
mov eax, eax
mov edx, eax
lea rcx, [rsp + 0xa0]
call fcn.140017080
nop
jmp 0x14001f467
lea rcx, [rsp + 0xa0]
call fcn.140015fd0
test rax, rax
jne 0x14001f486
mov dword [rsp + 0x30], 0x8007000e
jmp 0x14001f519
lea rcx, [rsp + 0xa0]
call fcn.140015fd0
mov qword [rsp + 0x68], rax
call fcn.1400222d0
mov ecx, dword [rsp + 0x34]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0x34]
mov r8, qword [rsp + 0x70]
xor edx, edx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x14001f4d9
call fcn.140017bb0
mov dword [rsp + 0x30], eax
jmp 0x14001f519
lea rcx, [rsp + 0xa0]
call fcn.140015fd0
mov ecx, dword [rsp + 0x40]
xor edx, edx
mov word [rax + rcx*2], dx
lea rcx, [rsp + 0xa0]
call fcn.140015fd0
mov r8d, dword [rsp + 0x4f0]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.14001e520
mov dword [rsp + 0x30], eax
cmp qword [rsp + 0x38], 0
je 0x14001f52c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0xa0]
call fcn.140015b40
nop
lea rcx, [rsp + 0x78]
call fcn.1400156a0
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.140023e10
add rsp, 0x4c8
ret
Function at 0x140020a60
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor eax, eax
test eax, eax
jne 0x140020a73
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x140020b80
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
test eax, eax
jne 0x140020b93
cmp qword [rsp + 0x70], 0
je 0x140020bab
mov dword [rsp + 0x38], 1
jmp 0x140020bb3
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x140020bcc
mov eax, 0xd
jmp 0x140020c4c
xor eax, eax
test eax, eax
jne 0x140020b99
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x30], 1
jne 0x140020be4
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x58
ret

Function at 0x140020d00
Capabilities:
Set registry value

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x58], 0
je 0x140020d2a
mov dword [rsp + 0x30], 1
jmp 0x140020d32
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x38], eax
xor eax, eax
test eax, eax
jne 0x140020d3a
cmp dword [rsp + 0x38], 0
jne 0x140020d51
mov ecx, 0x80004005
call fcn.140018b50
xor eax, eax
test eax, eax
jne 0x140020d18
xor eax, eax
test eax, eax
jne 0x140020d57
movzx eax, byte [rsp + 0x68]
test eax, eax
je 0x140020d74
cmp dword [rsp + 0x70], 0xffffffff
jne 0x140020d74
mov eax, 0x57
jmp 0x140020de1
cmp dword [rsp + 0x70], 0xffffffff
jne 0x140020d8d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc rax
mov dword [rsp + 0x70], eax
movzx eax, byte [rsp + 0x68]
test eax, eax
je 0x140020da0
mov dword [rsp + 0x34], 7
jmp 0x140020da8
mov dword [rsp + 0x34], 1
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x3c], eax
movsxd rax, dword [rsp + 0x70]
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x3c]
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x48
ret
Function at 0x140002210
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0x68
mov eax, dword [0x140047df4]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], eax
lea rax, [r11 + 8]
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov qword [r11 - 0x20], rdx
lea rdx, str.SOFTWAREMicrosoftClipboard
mov qword [r11 - 0x10], r9
mov r9d, 0xf003f
mov qword [r11 - 0x48], rax
mov qword [r11 + 8], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400022c1
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x38], rax
lea rdx, str.DisableAntiSpyware
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x78], rax
mov r9d, 0xb
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x68
ret
lea rdx, str.Registry_error_n
lea rcx, [0x140046430]
call fcn.1400066e0
add rsp, 0x68
ret
Function at 0x140006a30
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0x68
mov eax, dword [0x140047df4]
mov r9d, 0xf003f
mov dword [rsp + 0x40], eax
xor r8d, r8d
lea rax, [r11 + 0x10]
mov qword [r11 - 0x18], rdx
mov qword [r11 - 0x20], rax
lea rdx, str.SOFTWAREMicrosoftClipboard
lea rax, [r11 + 8]
mov qword [r11 + 0x10], 0
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x10], 8
mov qword [r11 + 8], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140006afc
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x38], rax
lea rdx, str.DisableAntiSpyware
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x80], rax
mov r9d, 0xb
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x78]
add rsp, 0x68
ret
lea rdx, str.Registry_error_n
lea rcx, [0x140046430]
call fcn.1400066e0
mov rax, qword [rsp + 0x78]
add rsp, 0x68
ret

Function at 0x140006b20
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0x68
mov eax, dword [0x140047df4]
mov r9d, 0xf003f
mov dword [rsp + 0x40], eax
xor r8d, r8d
lea rax, [r11 + 8]
mov qword [r11 - 0x18], rdx
mov qword [r11 - 0x20], rax
lea rdx, str.SOFTWAREMicrosoftClipboard
lea rax, [r11 + 0x10]
mov dword [rsp + 0x70], 0
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x10], 4
mov qword [r11 + 0x10], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x78]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140006bed
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x38], rax
lea rdx, str.DisableAntiSpyware
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x80], rax
mov r9d, 0xb
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movss xmm0, dword [rsp + 0x70]
add rsp, 0x68
ret
lea rdx, str.Registry_error_n
lea rcx, [0x140046430]
call fcn.1400066e0
movss xmm0, dword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x14000b664
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14000b692
xor eax, eax
jmp 0x14000b778
cmp qword [rcx + 0x68], 0
je 0x14000b6a3
call fcn.14000b794
jmp 0x14000b778
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000b6ba
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000b6bc
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000b6ee
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140030ef0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14000b772
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14000b725
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14000b74e
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14001ab9c
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14000b772
cmp rsi, rbx
ja 0x14000b72c
test rsi, rsi
je 0x14000b772
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14001ab9c
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000d408
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d452
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d452
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d452
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d452
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d452
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000d454
xor al, al
add rsp, 0x28
ret
Function at 0x140016b0c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x140016b43
call fcn.140019778
mov dword [rax], 0x16
call fcn.140019c28
xor eax, eax
jmp 0x140016bd1
mov rdx, r9
mov rcx, r8
call fcn.140016aa8
mov rbx, rax
test rax, rax
je 0x140016bce
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1400169d4]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140016bbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400196ec
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140016ba2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140016bb1
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1400209dc
jmp 0x140016bce
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140016bcb
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14001cef8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001ccf4
Function at 0x140024e48
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14000d0a0
sub rsp, rax
mov rax, qword [0x140045040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14002273c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140024e97
mov rax, rbp
jmp 0x140024f9f
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x47890]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140025f68
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x47890]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140024f9b
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140024f9b
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140025f68
test rax, rax
js 0x140024f9b
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140024f9b
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140024f8d
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140024f8d
cmp byte [rcx], 0xd
jne 0x140024f73
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140024f82
cmp byte [rcx + 1], 0xa
jne 0x140024f82
inc rcx
jmp 0x140024f82
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x45470]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140024f55
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140024f9f
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14000d070
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400251c0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400251d6
mov al, 1
jmp 0x140025236
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400251e7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140025234
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400297a4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140025234
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140025234
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140025234
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140025236
xor al, al
add rsp, 0x20
pop rbx
ret