joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400233a4
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
xor edx, edx
mov r13d, r8d
mov r15, rcx
mov r12, r9
lea rcx, [rbp - 0x49]
lea r8d, [rdx + 0x68]
call sub.msvcrt.dll_memset
xor eax, eax
xor esi, esi
and dword [rbp + 0x6f], eax
xor ebx, ebx
xor edi, edi
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x69], rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
test r15, r15
jne 0x14002340e
mov r14d, 0x80070057
mov ecx, r14d
call fcn.140025d30
jmp 0x14002355f
lea rdx, [rbp + 0x67]
mov rcx, r15
call fcn.140029fcc
mov r14d, eax
test eax, eax
jns 0x14002342d
mov ecx, eax
call fcn.140025d30
xor r15d, r15d
jmp 0x140023451
mov edx, dword [rbp + 0x67]
lea r8, [rbp - 0x69]
mov rcx, r15
call fcn.140028308
xor r15d, r15d
mov r14d, eax
test eax, eax
jns 0x14002344d
mov ecx, eax
call fcn.140025d30
mov rsi, qword [rbp - 0x69]
mov ecx, r14d
call fcn.140025d50
test r14d, r14d
js 0x140023401
or dword [rbp - 0xd], 1
lea rax, [rbp - 0x61]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x49]
mov dword [rbp - 0x49], 0x68
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], r15
mov rdx, rsi
mov qword [rsp + 0x30], r15
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
mov word [rbp - 9], r15w
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop dword [rax + rax]
test eax, eax
jne 0x1400234e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x1400234cd
mov r14d, 0x80004005
jmp 0x140023401
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
jmp 0x140023401
mov rbx, qword [rbp - 0x61]
mov edx, r13d
mov rdi, qword [rbp - 0x59]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x61]
test eax, eax
je 0x14002353b
cmp eax, 0x102
je 0x14002351f
mov edx, 0x42b
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop dword [rax + rax]
jmp 0x1400234c2
mov edx, 0x5b4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop dword [rax + rax]
mov r14d, 0x800705b4
jmp 0x140023401
lea rdx, [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
nop dword [rax + rax]
test eax, eax
je 0x1400234b2
test r12, r12
je 0x14002355f
mov eax, dword [rbp + 0x6f]
mov dword [r12], eax
mov ecx, r14d
call fcn.140025d50
test rdi, rdi
je 0x14002357b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x14002358f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rsi, rsi
je 0x1400235bc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
mov rbx, qword [rsp + 0x130]
mov eax, r14d
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140023830
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov rbp, r9
mov ecx, r14d
test r9, r9
je 0x140023892
mov ecx, 0x3fffffff
mov rax, r9
mov edx, ecx
cmp word [rax], r14w
je 0x140023873
add rax, 2
sub rdx, 1
jne 0x140023863
mov rax, rdx
neg rax
sbb edi, edi
not edi
and edi, 0x80070057
test rdx, rdx
je 0x14002388d
sub rcx, rdx
jmp 0x140023897
mov rcx, r14
jmp 0x140023897
mov edi, 0x80070057
lea rdx, [rcx + rcx]
test edi, edi
jns 0x1400238ab
mov rdx, r14
mov ecx, edi
call fcn.140025d30
jmp 0x14002390e
lea rbx, [rdx + 2]
cmp rbx, rdx
jb 0x1400238b9
mov edi, r14d
jmp 0x1400238c8
mov edi, 0x80070216
mov ecx, edi
call fcn.140025d30
mov rbx, rdx
mov ecx, edi
call fcn.140025d50
test edi, edi
js 0x1400238a2
mov esi, ebx
cmp rbx, rsi
je 0x1400238e6
mov ecx, 0x80070216
call fcn.140025d30
jmp 0x1400238ed
xor ecx, ecx
call fcn.140025d50
mov rax, rbx
sub rax, rsi
neg rax
sbb edi, edi
and edi, 0x80070216
mov ecx, edi
call fcn.140025d50
cmp rbx, rsi
jne 0x1400238a2
mov dword [rsp + 0x60], esi
mov ecx, edi
call fcn.140025d50
test edi, edi
jns 0x140023920
mov ecx, edi
call fcn.140025d30
mov ecx, edi
call fcn.140025d50
test edi, edi
js 0x1400239d5
lea r9, [rsp + 0x58]
mov qword [rsp + 0x58], r14
mov r8d, 2
lea rdx, str.SYSTEMSetupMoSetup
mov rcx, 0xffffffff80000002
call fcn.14002a384
mov rbx, qword [rsp + 0x58]
mov edi, eax
test eax, eax
jns 0x140023961
mov ecx, eax
jmp 0x1400239b1
xor ecx, ecx
call fcn.140025d50
mov eax, dword [rsp + 0x60]
lea rdx, str.CorrelationVector
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14002399d
mov edi, r14d
jmp 0x1400239b6
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x1400239b6
mov ecx, edi
call fcn.140025d30
mov ecx, edi
call fcn.140025d50
test rbx, rbx
je 0x1400239d1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jns 0x1400239dc
mov ecx, edi
call fcn.140025d30
mov ecx, edi
call fcn.140025d50
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140023a00
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push r14
sub rsp, 0x40
and qword [rax - 0x10], 0
mov rbp, r9
mov r14, r8
lea r9, [rax - 0x10]
xor ebx, ebx
mov rcx, 0xffffffff80000002
lea r8d, [rbx + 1]
call fcn.14002a384
mov esi, eax
test eax, eax
jns 0x140023a4c
mov ecx, eax
call fcn.140025d30
jmp 0x140023b10
and dword [rsp + 0x50], ebx
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140023a91
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x140023acd
test rbx, rbx
jne 0x140023adb
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x140023ad4
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140023a50
mov esi, 0x8007000e
mov ecx, esi
jmp 0x140023a42
mov esi, 0x8000ffff
jmp 0x140023acd
cmp dword [rsp + 0x30], 1
je 0x140023ae9
mov esi, 0x8007000d
jmp 0x140023acd
mov edx, dword [rsp + 0x50]
lea r9, [rsp + 0x34]
mov r8, rbp
mov rcx, rbx
call fcn.140002c54
mov esi, eax
test eax, eax
js 0x140023a40
cmp dword [rsp + 0x34], 0
je 0x140023b10
xor ebx, ebx
mov ecx, esi
call fcn.140025d50
test rbx, rbx
je 0x140023b3c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
cmp qword [rsp + 0x38], 0
je 0x140023b55
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x140023cac
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov ebx, r9d
mov rsi, r8
mov rdi, rdx
xor ecx, ecx
call fcn.140025d50
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, 2
mov dword [rsp + 0x50], ebx
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.14002a384
mov rbx, qword [rsp + 0x30]
mov edi, eax
test eax, eax
jns 0x140023d03
mov ecx, eax
jmp 0x140023d50
xor ecx, ecx
call fcn.140025d50
mov r9d, 4
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140023d3c
xor edi, edi
jmp 0x140023d55
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x140023d55
mov ecx, edi
call fcn.140025d30
mov ecx, edi
call fcn.140025d50
test rbx, rbx
je 0x140023d70
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jns 0x140023d7b
mov ecx, edi
call fcn.140025d30
mov ecx, edi
call fcn.140025d50
mov rbx, qword [rsp + 0x58]
mov eax, edi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140023d9c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push r14
sub rsp, 0x40
and qword [rax - 0x10], 0
mov r14, r9
mov rbp, r8
lea r9, [rax - 0x10]
xor ebx, ebx
mov rcx, 0xffffffff80000002
lea r8d, [rbx + 1]
call fcn.14002a384
mov esi, eax
test eax, eax
jns 0x140023de3
mov ecx, eax
jmp 0x140023eaa
and dword [rsp + 0x50], ebx
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140023e28
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x140023e64
test rbx, rbx
jne 0x140023e6f
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x140023e68
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140023de7
mov esi, 0x8007000e
mov ecx, esi
jmp 0x140023eaa
mov esi, 0x8000ffff
jmp 0x140023e64
cmp dword [rsp + 0x30], 4
je 0x140023e7d
mov esi, 0x8007000d
jmp 0x140023e64
xor ebp, ebp
cmp dword [rsp + 0x50], 4
je 0x140023e96
mov esi, 0x8007000d
mov ecx, esi
mov ebp, esi
call fcn.140025d30
jmp 0x140023e9b
mov eax, dword [rbx]
mov dword [r14], eax
mov ecx, ebp
call fcn.140025d50
mov esi, ebp
test ebp, ebp
jns 0x140023eaf
mov ecx, ebp
call fcn.140025d30
mov ecx, esi
call fcn.140025d50
test rbx, rbx
je 0x140023edb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
cmp qword [rsp + 0x38], 0
je 0x140023ef4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x14002404c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov r14, r9
lea rax, [rbp - 0x10]
xor edi, edi
mov qword [r11 - 0x48], rax
xor ebx, ebx
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
and qword [rbp - 0x10], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea r9d, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400240da
xor esi, esi
mov rdi, qword [rbp - 0x10]
and qword [rbp - 0x10], rbx
mov ecx, esi
call fcn.140025d50
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400240ca
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rbp - 0x10], rbx
test esi, esi
jns 0x1400240f5
mov ecx, esi
call fcn.140025d30
jmp 0x1400241ba
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
je 0x1400240a2
mov ecx, esi
call fcn.140025d30
jmp 0x1400240aa
and dword [rbp + 0x40], ebx
lea rax, [rbp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x38]
lea rdx, str.BuildLabEx
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140024139
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x1400240ce
test rbx, rbx
jne 0x140024183
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x140024179
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x1400240f8
mov esi, 0x8007000e
jmp 0x1400240ce
mov esi, 0x8000ffff
jmp 0x1400240ce
cmp dword [rbp + 0x38], 1
je 0x140024193
mov esi, 0x8007000d
jmp 0x1400240ce
mov edx, dword [rbp + 0x40]
lea r9, [rbp + 0x30]
mov r8, r14
mov rcx, rbx
call fcn.140002c54
mov esi, eax
test eax, eax
jns 0x1400241b2
mov ecx, eax
jmp 0x1400240d0
cmp dword [rbp + 0x30], 0
je 0x1400241ba
xor ebx, ebx
mov ecx, esi
call fcn.140025d50
test rbx, rbx
je 0x1400241e6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test rdi, rdi
je 0x1400241fa
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, esi
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140024624
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140024648
shr eax, 4
not eax
and eax, 1
jmp 0x14002464a
xor eax, eax
mov dword [rbx], eax
xor ecx, ecx
call fcn.140025d50
xor ecx, ecx
call fcn.140025d50
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14002466c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14002468e
shr eax, 4
and eax, 1
jmp 0x140024690
xor eax, eax
mov dword [rbx], eax
xor ecx, ecx
call fcn.140025d50
xor ecx, ecx
call fcn.140025d50
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140024a30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r14, rdx
mov edi, 0x104
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, edi
mov qword [rsp + 0x20], rbx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x140024ab4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x140024a9a
mov edi, 0x80004005
jmp 0x140024aa8
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.140025d30
jmp 0x140024b51
cmp esi, edi
ja 0x140024af8
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140029fcc
mov edi, eax
test eax, eax
js 0x140024ae4
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r8, r14
call fcn.140028308
mov edi, eax
test eax, eax
jns 0x140024aeb
mov ecx, eax
call fcn.140025d30
mov ecx, edi
call fcn.140025d50
test edi, edi
jns 0x140024b51
jmp 0x140024aa8
mov rdx, rsi
lea r8, [rsp + 0x20]
call fcn.140002ac4
mov edi, eax
test eax, eax
jns 0x140024b19
mov ecx, eax
call fcn.140025d30
mov rbx, qword [rsp + 0x20]
jmp 0x140024b51
mov rbx, qword [rsp + 0x20]
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
je 0x140024a83
cmp eax, esi
je 0x140024b49
mov edi, 0x8007007a
jmp 0x140024aa8
mov rax, rbx
xor ebx, ebx
mov qword [r14], rax
mov ecx, edi
call fcn.140025d50
test rbx, rbx
je 0x140024b85
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140094220
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140027abc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
and qword [rax + 8], 0
lea rdx, str.SYSTEMSetupMoSetupVolatile
mov rsi, r9
mov r8d, 1
lea r9, [rax + 8]
mov rcx, 0xffffffff80000002
call fcn.14002a384
mov edi, eax
test eax, eax
jns 0x140027b08
mov ecx, eax
call fcn.140025d30
jmp 0x140027b60
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
and qword [rsp + 0x20], 0
lea rdx, str.InstallTicks
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
je 0x140027b59
cmp eax, 2
je 0x140027b5e
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x140027b5e
mov ecx, edi
jmp 0x140027b01
mov ecx, 1
mov dword [rsi], ecx
mov ecx, edi
call fcn.140025d50
cmp qword [rsp + 0x40], 0
je 0x140027b80
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1400280e4
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov r12, r9
mov rsi, r8
mov ebp, edx
mov r15, rcx
test r9, r9
jne 0x140028124
mov ebx, 0x80070057
mov ecx, ebx
call fcn.140025d30
jmp 0x1400282ce
lea edi, [rdx + 2]
mov r14d, 0x80070216
cmp edi, ebp
jae 0x14002813b
mov ecx, r14d
call fcn.140025d30
cmp edi, ebp
sbb ebx, ebx
and ebx, r14d
mov ecx, ebx
call fcn.140025d50
cmp edi, ebp
jb 0x140028118
mov eax, 0xaaaaaaab
mov ebx, r13d
mul edi
shr edx, 1
je 0x140028178
mov ecx, edx
shl ecx, 2
mov eax, ecx
shr eax, 2
cmp eax, edx
je 0x140028174
mov ecx, r14d
mov ebx, r14d
call fcn.140025d30
jmp 0x14002817b
mov edi, ecx
jmp 0x14002817b
mov edi, r13d
mov ecx, ebx
call fcn.140025d50
test ebx, ebx
js 0x140028118
lea r14d, [rdi + 1]
test rsi, rsi
jne 0x1400281c0
cmp r14d, edi
jb 0x14002819d
mov dword [r12], r14d
mov ebx, r13d
jmp 0x1400281a9
mov ebx, 0x80070216
mov ecx, ebx
call fcn.140025d30
mov ecx, ebx
call fcn.140025d50
test ebx, ebx
js 0x140028118
mov ebx, r13d
jmp 0x1400282ce
cmp r14d, edi
jae 0x1400281d2
mov ecx, 0x80070216
call fcn.140025d30
cmp r14d, edi
sbb ebx, ebx
and ebx, 0x80070216
mov ecx, ebx
call fcn.140025d50
cmp r14d, edi
jb 0x140028118
cmp dword [r12], r14d
jae 0x1400281fa
mov ebx, 0x8007007a
jmp 0x140028118
lea r9, [rsi + r14*2]
test ebp, ebp
jle 0x1400282c1
lea rdx, [rsi + 6]
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx r11d, byte [r15]
mov cl, r13b
inc r15
mov r8b, r13b
cmp ebp, 1
jbe 0x140028234
mov cl, byte [r15]
inc r15
cmp ebp, 2
jbe 0x140028234
mov r8b, byte [r15]
inc r15
cmp rdx, r9
jae 0x1400282f5
movzx r10d, cl
mov rax, r11
shr rax, 2
mov ecx, r10d
shr rcx, 4
movzx eax, byte [rax + rdi]
mov word [rsi], ax
mov rax, r11
shl rax, 4
or rcx, rax
and ecx, 0x3f
movzx eax, byte [rcx + rdi]
mov word [rsi + 2], ax
cmp ebp, 1
jbe 0x14002828a
mov ecx, r10d
movzx eax, r8b
shr rax, 6
shl ecx, 2
or rcx, rax
and ecx, 0x3f
movzx eax, byte [rcx + rdi]
jmp 0x14002828f
mov eax, 0x3d
mov word [rsi + 4], ax
cmp ebp, 2
jbe 0x1400282a5
movzx eax, r8b
and eax, 0x3f
movzx ecx, byte [rax + rdi]
jmp 0x1400282aa
mov ecx, 0x3d
mov word [rsi + 6], cx
add rdx, 8
add rsi, 8
add ebp, 0xfffffffd
test ebp, ebp
jg 0x140028211
cmp rsi, r9
jae 0x1400282f5
mov word [rsi], r13w
mov dword [r12], r14d
mov ecx, ebx
call fcn.140025d50
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x8000ffff
mov ebx, ecx
jmp 0x14002811a
Function at 0x14002a44c
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov r11, r8
mov r10, rdx
xor r8d, r8d
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
mov rdi, rcx
mov rbx, rdx
shr rbx, 1
lea rax, [rbx + rbx*2]
sub r10, rax
cmp r10, 1
mov rax, r10
setne r8b
add r8, 2
neg rax
sbb rax, rax
and rax, r8
lea rax, [rax + rbx*4]
inc rax
cmp rax, 0x81
ja 0x14002a5bc
xor r9d, r9d
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_F
xor esi, esi
test rbx, rbx
je 0x14002a532
movzx ecx, byte [rdi]
inc esi
movzx edx, byte [rdi + 2]
mov eax, ecx
movzx r8d, byte [rdi + 1]
and cl, 3
shr rax, 2
add rdi, 3
shl cl, 4
movzx ecx, cl
mov al, byte [rax + r14]
mov byte [r9 + r11], al
mov eax, r8d
shr rax, 4
and r8b, 0xf
or rcx, rax
shl r8b, 2
mov al, byte [rcx + r14]
mov byte [r9 + r11 + 1], al
mov eax, edx
shr rax, 6
and edx, 0x3f
movzx ecx, r8b
or rcx, rax
mov al, byte [rcx + r14]
mov byte [r9 + r11 + 2], al
mov al, byte [rdx + r14]
mov byte [r9 + r11 + 3], al
add r9, 4
mov eax, esi
cmp rax, rbx
jb 0x14002a4c1
sub r10, 1
je 0x14002a588
cmp r10, 1
jne 0x14002a5b7
movzx ecx, byte [rdi]
movzx edx, byte [rdi + 1]
mov eax, ecx
shr rax, 2
and cl, 3
shl cl, 4
movzx ecx, cl
mov al, byte [rax + r14]
mov byte [r9 + r11], al
mov eax, edx
shr rax, 4
and dl, 0xf
or rcx, rax
shl dl, 2
mov al, byte [rcx + r14]
mov byte [r9 + r11 + 1], al
movzx eax, dl
mov al, byte [rax + r14]
mov byte [r9 + r11 + 2], al
mov byte [r9 + r11 + 3], 0x3d
jmp 0x14002a5b3
movzx ecx, byte [rdi]
mov eax, ecx
and cl, 3
shr rax, 2
shl cl, 4
mov al, byte [rax + r14]
mov byte [r9 + r11], al
movzx eax, cl
mov al, byte [rax + r14]
mov byte [r9 + r11 + 1], al
mov word [r9 + r11 + 2], 0x3d3d
add r9, 4
mov byte [r9 + r11], 0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
ret
Function at 0x14002a660
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
xor ebx, ebx
mov r14, r9
mov r15d, r8d
mov rsi, rdx
test rcx, rcx
je 0x14002a75a
test rdx, rdx
je 0x14002a75a
xor edx, edx
call fcn.14002bad0
mov rdi, rax
test rax, rax
je 0x14002a6f0
xor edx, edx
mov rcx, rsi
call fcn.14002bad0
mov rbx, rax
test rax, rax
je 0x14002a6f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14002a6d6
xor edx, edx
mov rcx, rbx
call fcn.14002ae08
mov r9, qword [rsp + 0x70]
mov r8, r14
mov rdx, rbx
mov dword [rsp + 0x28], r15d
mov rcx, rdi
call fcn.14002a790
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
test rdi, rdi
je 0x14002a723
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test rbx, rbx
je 0x14002a748
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebp
jmp 0x14002a76d
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret