joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005dcc0
Capabilities:
Access pe header

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rdi, r8
mov rax, rcx
mov rsi, qword [r8 + 0x10]
mov qword [r11 - 0x58], rsi
mov r14d, dword [r8 + 0x18]
mov dword [r11 - 0x64], r14d
mov rdx, qword [r8]
mov qword [r11 - 0x48], rdx
mov ecx, dword [r8 + 8]
mov dword [r11 + 0x20], ecx
test rdx, rdx
je 0x14005de58
test ecx, ecx
je 0x14005de58
test rsi, rsi
jne 0x14005dde2
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r13, rax
xor r12d, r12d
mov qword [rsp + 0x38], r12
test rax, rax
jne 0x14005dd40
mov eax, 0xc00000ef
jmp 0x14005de87
movzx eax, word [rax + 0x14]
lea rbx, [r13 + 0x18]
add rbx, rax
mov qword [rsp + 0x38], rbx
movzx r15d, r12w
mov word [rsp + 0x20], r12w
nop word [rax + rax]
cmp r15w, word [r13 + 6]
jae 0x14005ddb3
mov rdx, rbx
mov rcx, qword [rsp + 0x98]
call fcn.140160e58
test eax, eax
jne 0x14005dd9e
mov esi, dword [rbx + 0xc]
add rsi, qword [rsp + 0x90]
mov qword [rdi + 0x10], rsi
mov qword [rsp + 0x30], rsi
mov r14d, dword [rbx + 8]
mov dword [rdi + 0x18], r14d
mov dword [rsp + 0x24], r14d
jmp 0x14005ddb3
add rbx, 0x28
mov qword [rsp + 0x38], rbx
inc r15w
mov word [rsp + 0x20], r15w
jmp 0x14005dd60
test rsi, rsi
je 0x14005ddd0
test r14d, r14d
je 0x14005ddd0
mov ecx, dword [rsp + 0xa8]
cmp r14d, ecx
jb 0x14005ddd0
mov rdx, qword [rsp + 0x40]
jmp 0x14005ddf5
mov qword [rdi + 0x10], r12
mov dword [rdi + 0x18], r12d
mov eax, 0xc0000225
jmp 0x14005de87
inc rsi
mov qword [rsp + 0x30], rsi
dec r14d
mov dword [rsp + 0x24], r14d
xor r12d, r12d
mov r13d, 0xc0000225
mov dword [rsp + 0x2c], r13d
mov r15d, r12d
mov dword [rsp + 0x28], r12d
nop dword [rax + rax]
mov eax, r14d
sub eax, ecx
cmp r15d, eax
jae 0x14005de56
mov ebx, ecx
mov r8d, ecx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x14005de38
mov qword [rdi + 0x10], rsi
dec dword [rdi + 0x18]
xor eax, eax
jmp 0x14005de87
inc rsi
mov qword [rsp + 0x30], rsi
inc r15d
mov dword [rsp + 0x28], r15d
mov ecx, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0x40]
jmp 0x14005de10
jmp 0x14005de7c
xor r12d, r12d
mov qword [r8 + 0x10], r12
mov dword [r8 + 0x18], r12d
mov eax, 0xc000000d
jmp 0x14005de87
mov qword [rdi + 0x10], r12
mov dword [rdi + 0x18], r12d
mov eax, r13d
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14005dea0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r12
push r14
sub rsp, 0x58
mov r12, rcx
lea r9, [rsp + 0x70]
mov rcx, qword [rcx + 0x30]
mov r8d, 9
mov dl, 1
call qword [sym.imp.ntdll.dll_RtlImageDirectoryEntryToData]
mov r14, rax
test rax, rax
je 0x14005b155
cmp dword [rsp + 0x70], 0
je 0x14005b155
lea r9, [rsp + 0x88]
mov rdx, r12
lea r8, [rsp + 0x78]
mov rcx, rax
call fcn.14005ad30
test eax, eax
jns 0x14005af83
mov eax, 0xc000009a
add rsp, 0x58
pop r14
pop r12
ret
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r13
mov r13d, dword [0x1406f4bb8]
lea eax, [r13 - 1]
lea rax, [rax + rax*2]
lea rdx, [rax*8 + 0x28]
mov rax, qword gs:[0x30]
mov qword [rsp + 0x80], rdx
mov r8, rdx
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x14005aff3
mov rcx, r12
call fcn.14005ae80
mov rdi, qword [rsp + 0x38]
mov eax, 0xc0000017
mov r13, qword [rsp + 0x30]
add rsp, 0x58
pop r14
pop r12
ret
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov qword [rsp + 0x48], rbp
mov ebp, ebx
mov qword [rax], rbx
mov eax, dword [rsp + 0x78]
mov qword [rsp + 0x40], rsi
mov dword [rdi + 0xc], eax
mov qword [rsp + 0x28], r15
mov dword [rdi + 8], r13d
test r13d, r13d
je 0x14005b079
lea rsi, [rdi + 0x18]
mov r15, rsi
nop word [rax + rax]
mov rcx, qword gs:[0x30]
xor edx, edx
mov r8, qword [r14 + 8]
sub r8, qword [r14]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [r15], rax
test rax, rax
je 0x14005b112
mov rdx, qword [r14]
mov rcx, rax
mov r8, qword [r14 + 8]
sub r8, rdx
call fcn.14011c9b0
inc ebp
add r15, 0x18
cmp ebp, r13d
jb 0x14005b030
mov r9d, dword [rsp + 0x80]
mov r8, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_35
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov esi, eax
cmp dword [rdi + 8], ebx
jbe 0x14005b0cd
nop dword [rax + rax]
mov ecx, ebx
xor edx, edx
inc rcx
lea r8, [rcx + rcx*2]
mov rcx, qword gs:[0x30]
mov r8, qword [rdi + r8*8]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
inc ebx
cmp ebx, dword [rdi + 8]
jb 0x14005b0a0
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov r13, qword [rsp + 0x30]
add rsp, 0x58
pop r14
pop r12
ret
test ebp, ebp
je 0x14005b146
mov ebx, ebp
nop dword [rax + rax]
mov rax, qword gs:[0x30]
xor edx, edx
mov r8, qword [rsi]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea rsi, [rsi + 0x18]
sub rbx, 1
jne 0x14005b120
mov rcx, r12
call fcn.14005ae80
mov eax, 0xc0000017
jmp 0x14005b0eb
xor eax, eax
add rsp, 0x58
pop r14
pop r12
ret
jmp 0x14005af20
Function at 0x1400600a0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xa0
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov ebp, edx
mov rsi, rcx
mov qword [rax + 8], 0
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetPhysicallyInstalledSystemMemory]
mov eax, dword [rsp + 0xb0]
cdq
and edx, 0x3ff
lea edi, [rdx + rax]
sar edi, 0xa
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [rsp + 0x88]
mov edx, 0x14b
lea rcx, [rsp + 0x48]
call fcn.1400160a0
nop
lea rcx, [rsi + 0x100]
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], ebp
mov r9d, edi
mov r8d, ebx
mov rdx, rax
call fcn.140063660
nop
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x140060193
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, 0x1000
jb 0x14006018e
test cl, 0x1f
je 0x140060161
call fcn.140128ff4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140060170
call fcn.140128ff4
int3
sub rcx, rax
cmp rcx, 8
jae 0x14006017f
call fcn.140128ff4
int3
cmp rcx, 0x27
jbe 0x14006018b
call fcn.140128ff4
int3
mov rcx, rax
call fcn.1400eb7f4
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140065700
Capabilities:
Get session information

Disassembly:
push rdi
sub rsp, 0x30
movzx edi, dl
cmp ecx, 0xffffffff
jne 0x140065716
xor al, al
add rsp, 0x30
pop rdi
ret
xor eax, eax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x40], eax
mov edx, ecx
lea rax, [rsp + 0x40]
mov r8d, Ordinal_30
xor ecx, ecx
mov qword [rsp + 0x20], rax
xor bl, bl
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x14006578e
cmp dword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x50]
jbe 0x140065789
cmp dword [rcx], 1
jne 0x140065789
mov eax, dword [rcx + 0x10]
test dil, dil
je 0x14006577c
cmp eax, 1
sete bl
call sub.WTSAPI32.dll_WTSFreeMemory
movzx eax, bl
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test eax, eax
movzx ebx, bl
mov edx, 1
cmove ebx, edx
call sub.WTSAPI32.dll_WTSFreeMemory
movzx eax, bl
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400658f0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x38], 0
mov rbx, rcx
jne 0x14006592a
xor ecx, ecx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, [0x140065980]
mov r9, rbx
mov dword [rsp + 0x20], ecx
xor edx, edx
mov dword [rsp + 0x40], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x38], rax
add rsp, 0x30
pop rbx
ret
Function at 0x140065c40
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x108
movzx eax, byte [rcx + 0x1c]
test al, al
je 0x140065c59
xor al, al
add rsp, 0x108
ret
xor eax, eax
mov byte [rcx + 0x1c], 1
xor edx, edx
mov qword [rsp + 0x100], rbx
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea r8d, [rax + 0x68]
mov qword [rsp + 0x60], rax
call fcn.14011d670
xor ebx, ebx
mov dword [rsp + 0x90], WSASetLastError
mov edx, 0x112
mov word [rsp + 0xd0], bx
lea rcx, [rsp + 0x68]
mov dword [rsp + 0xcc], 1
call fcn.1400160a0
cmp qword [rax + 0x18], 0x10
jb 0x140065cc2
mov rax, qword [rax]
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
xor r8d, r8d
lea rcx, [rsp + 0x90]
mov rdx, rax
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov rax, qword [rsp + 0x80]
sete bl
cmp rax, 0x10
jb 0x140065d48
mov rcx, qword [rsp + 0x68]
inc rax
cmp rax, 0x1000
jb 0x140065d43
test cl, 0x1f
jne 0x140065d94
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140065d9a
sub rcx, rax
cmp rcx, 8
jb 0x140065da0
cmp rcx, 0x27
ja 0x140065da6
mov rcx, rax
call fcn.1400eb7f4
test bl, bl
je 0x140065d5e
xor al, al
mov rbx, qword [rsp + 0x100]
add rsp, 0x108
ret
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x100]
mov al, 1
add rsp, 0x108
ret
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3

Function at 0x140067240
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x40
cmp qword [rdx + 8], 0
mov rdi, rdx
ja 0x140067258
xor al, al
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x50], rbx
xor bl, bl
cmp qword [rcx + 0x18], 0x10
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
jb 0x140067273
mov rcx, qword [rcx]
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], ebp
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400672da
mov r8d, dword [rdi + 8]
lea r9, [rsp + 0x58]
mov rdx, qword [rdi]
mov rcx, rax
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x58]
mov eax, 1
cmp rcx, qword [rdi + 8]
movzx ebx, bl
cmove ebx, eax
mov rsi, qword [rsp + 0x68]
movzx eax, bl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140067b60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x20], 0
call fcn.14000b6b4
mov rcx, rax
test rax, rax
jne 0x140067b9e
mov ecx, 0x80004005
call fcn.14000b9ec
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x140067c00
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140067c00
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140067be0
mov r8d, eax
mov rcx, rbx
call fcn.140007d30
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140068300
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov eax, edx
mov edi, 1
cdq
mov r14d, r8d
idiv r8d
mov ebp, ecx
mov r15d, eax
cmp eax, edi
jle 0x14006837a
nop
test ebp, ebp
je 0x14006836a
xor edx, edx
mov r8d, ebp
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14006836a
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
mov rcx, rsi
setne bl
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x140068395
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, r15d
jl 0x140068330
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov al, 1
jmp 0x14006837c
Function at 0x140069180
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov dword [rax + 0x10], 4
mov dword [rax + 8], 4
mov edx, reloc.WS2_32.dll_select
lea rcx, [rax - 0x40]
call fcn.140016310
mov rdi, rax
cmp qword [rax + 0x18], 8
jb 0x1400691bb
mov rdi, qword [rax]
call fcn.14000b6b4
mov rcx, rax
test rax, rax
jne 0x1400691d3
mov ecx, 0x80004005
call fcn.14000b9ec
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x98], rbx
or rsi, 0xffffffffffffffff
test rdi, rdi
je 0x14006922c
test rdi, 0xffffffffffff0000
jne 0x14006921d
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.14000b0cc
test rax, rax
je 0x140069249
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.140008224
jmp 0x140069241
mov rax, rsi
inc rax
cmp word [rdi + rax*2], 0
jne 0x140069220
jmp 0x14006922e
xor eax, eax
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x98]
call fcn.140007d30
mov rbx, qword [rsp + 0x98]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
lea r8, [0x14069df38]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14006929a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x1400692b7
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.14000c6f4
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400692d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov dword [rax + 0x10], 4
mov dword [rax + 8], 4
mov edx, reloc.WS2_32.dll_send
lea rcx, [rax - 0x40]
call fcn.140016310
mov rdi, rax
cmp qword [rax + 0x18], 8
jb 0x14006930b
mov rdi, qword [rax]
call fcn.14000b6b4
mov rcx, rax
test rax, rax
jne 0x140069323
mov ecx, 0x80004005
call fcn.14000b9ec
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x98], rbx
or rsi, 0xffffffffffffffff
test rdi, rdi
je 0x14006937c
test rdi, 0xffffffffffff0000
jne 0x14006936d
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.14000b0cc
test rax, rax
je 0x140069399
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.140008224
jmp 0x140069391
mov rax, rsi
inc rax
cmp word [rdi + rax*2], 0
jne 0x140069370
jmp 0x14006937e
xor eax, eax
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x98]
call fcn.140007d30
mov rbx, qword [rsp + 0x98]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
lea r8, [0x14069df38]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400693ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x140069407
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.14000c6f4
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x140069420
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov dword [r11 + 0x20], r9d
mov qword [r11 + 0x18], r8
push rsi
push rdi
push r14
sub rsp, 0x50
mov rsi, r8
lea rax, [r11 + 0x18]
mov r14, rdx
mov qword [r11 - 0x48], rax
mov rdx, qword [rdx]
xor ebp, ebp
xor r8d, r8d
mov qword [r11 + 0x18], rbp
mov r9d, 0x20206
mov rdi, rcx
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400694ab
cmp eax, 2
jne 0x1400694ee
mov rdx, qword [r14]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov rcx, rdi
mov dword [rsp + 0x28], 0x20206
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400694ee
mov r8, qword [rsi]
lea rax, [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
lea rdx, [0x14069df38]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov rcx, qword [rsp + 0x80]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [r14]
test ebx, ebx
sete dil
sub rdx, 0x18
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140069513
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14006952e
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov rbx, qword [rsp + 0x70]
movzx eax, dil
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14006a0f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov r14, rcx
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rcx, [rsp + 0x40]
call fcn.140016310
mov rsi, rax
cmp qword [rax + 0x18], 8
jb 0x14006a126
mov rsi, qword [rax]
call fcn.14000b6b4
mov rcx, rax
test rax, rax
jne 0x14006a13e
mov ecx, 0x80004005
call fcn.14000b9ec
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
or rdi, 0xffffffffffffffff
test rsi, rsi
je 0x14006a191
test rsi, 0xffffffffffff0000
jne 0x14006a182
movzx esi, si
xor edx, edx
mov ecx, esi
call fcn.14000b0cc
test rax, rax
je 0x14006a1a8
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140008224
jmp 0x14006a1a3
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x14006a185
jmp 0x14006a193
xor eax, eax
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140007d30
mov rbx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x14006a1c5
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14000c6f4
mov dword [rsp + 0xa8], 4
mov dword [rsp + 0x98], 0
mov dword [rsp + 0xa0], 4
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa8]
mov r8, qword [r14]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea rdx, [rbx - 0x18]
test eax, eax
mov eax, edi
je 0x14006a257
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a239
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14006a253
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
jmp 0x14006a28f
mov esi, dword [rsp + 0x98]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a272
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14006a28d
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov eax, esi
add rsp, 0x68
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006a2a0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov r14, rcx
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rcx, [rax - 0x40]
call fcn.140016310
mov rdi, rax
cmp qword [rax + 0x18], 8
jb 0x14006a2dc
mov rdi, qword [rax]
call fcn.14000b6b4
mov rcx, rax
test rax, rax
jne 0x14006a2f4
mov ecx, 0x80004005
call fcn.14000b9ec
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x90], rbx
or rsi, 0xffffffffffffffff
test rdi, rdi
je 0x14006a34d
test rdi, 0xffffffffffff0000
jne 0x14006a33e
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.14000b0cc
test rax, rax
je 0x14006a36a
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140008224
jmp 0x14006a362
mov rax, rsi
inc rax
cmp word [rdi + rax*2], 0
jne 0x14006a341
jmp 0x14006a34f
xor eax, eax
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x90]
call fcn.140007d30
mov rbx, qword [rsp + 0x90]
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x14006a387
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.14000c6f4
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8, qword [r14]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a3cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14006a3e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
Function at 0x14006aa10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rbp, rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
mov r8d, 0xa
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rdi
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, rbx
mov rcx, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x14006ab70
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, r8
mov rcx, qword [rcx]
mov rsi, rdx
test rcx, rcx
je 0x14006ab9e
call fcn.140153014
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x14006abb0
mov rdx, rdi
call fcn.140153024
jmp 0x14006abb8
mov rcx, rdi
call fcn.14015301c
mov rcx, rax
mov qword [rbx], rax
add rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.14011c9b0
mov rsi, qword [rsp + 0x38]
mov qword [rbx + 8], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret