joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023828
Capabilities:
Get disk size

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r14d, edx
mov rdi, rcx
mov qword [rbp - 0x29], rcx
and dword [rbp - 0x59], 0
mov byte [rcx + 8], 0
btr dword [rcx + 8], 8
and qword [rcx + 0x10], 0
mov dword [rbp - 0x59], 1
lea rdx, str.Invalid_HTTP_S__status_code
lea rcx, [rbp - 0x21]
call fcn.14002cef8
nop
lea rdx, str.errorDesc
mov rcx, rdi
call fcn.14002d968
mov rcx, rax
lea rdx, [rbp - 0x21]
call fcn.14002d184
nop
lea rcx, [rbp - 0x21]
call fcn.14002d0d8
call fcn.140023158
test al, al
jne 0x1400238f1
mov ecx, 0x28
call fcn.1400b8688
mov rsi, rax
xor ebx, ebx
call fcn.1400b99c8
add eax, dword [0x14019fd80]
mov dword [rsi + rbx*4], eax
inc rbx
cmp rbx, 0xa
jl 0x1400238c9
mov ecx, dword [rsi + 0x24]
mov dword [0x14019fd80], ecx
mov rcx, rsi
call fcn.1400ba0bc
lea rcx, [0x1401979a8]
mov rax, qword [0x1401979a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x51], rbx
mov r8d, r14d
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x49]
call fcn.14001bcf4
nop
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14001bbd0
nop
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.14002cf3c
nop
lea rdx, str.errorCode
mov rcx, rdi
call fcn.14002d968
mov rcx, rax
lea rdx, [rbp - 9]
call fcn.14002d184
nop
lea rcx, [rbp - 9]
call fcn.14002d0d8
nop
cmp qword [rbp + 0x2f], 0x10
jb 0x14002396b
mov rcx, qword [rbp + 0x17]
call fcn.1400b8ff4
mov qword [rbp + 0x2f], 0xf
and qword [rbp + 0x27], 0
mov byte [rbp + 0x17], 0
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14002399e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400239b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rbp - 0x39]
and eax, 0xffffff05
or eax, 5
mov dword [rbp - 0x39], eax
and qword [rbp - 0x31], 0
mov byte [rbp - 0x41], 0
lea rdx, str.result
mov rcx, rdi
call fcn.14002d968
mov rcx, rax
lea rdx, [rbp - 0x41]
call fcn.14002d184
nop
lea rcx, [rbp - 0x41]
call fcn.14002d0d8
mov ecx, dword [0x14019fd80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
shl ecx, 3
sub r8d, ecx
cmp r8d, 0x10
jne 0x140023a40
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400b9010
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140038460
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, 1
movzx edx, al
cmp edx, 6
ja 0x140038483
jne 0x140038481
shr ax, 8
cmp al, cl
ja 0x140038483
xor ecx, ecx
mov al, cl
add rsp, 0x28
ret

Function at 0x14003848c
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14019fd80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0x10
jne 0x1400384d7
lea ecx, [r8 - 0xc]
call fcn.1400b97c8
mov ecx, dword [0x14019fd80]
mov dword [rax], ecx
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov r10d, eax
mov eax, dword [0x14019fd80]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 0x80000003
jge 0x1400384fb
dec ecx
or ecx, 0xfffffffc
inc ecx
xor r8d, r8d
cmp ecx, 3
jne 0x140038520
mov r9d, r8d
test eax, eax
je 0x140038519
mov ecx, eax
cdq
and ecx, 1
sub eax, edx
add r9d, ecx
sar eax, 1
jne 0x14003850a
mov dword [0x14019fd80], r9d
cmp r10b, 6
setb al
add rsp, 0x28
ret
Function at 0x1400396f8
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rdx, qword [rcx]
mov rcx, qword [0x14019ad58]
lea rax, [r11 + 8]
mov rsi, r8
mov r9d, 0xf003f
xor r8d, r8d
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
je 0x140039786
mov r8d, dword [0x14019fd80]
mov eax, 0x4ec4ec4f
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 2
jne 0x140039782
test r8d, r8d
je 0x14003977c
mov eax, r8d
mov ecx, r8d
cdq
and ecx, 1
sub eax, edx
add ebx, ecx
sar eax, 1
mov r8d, eax
jne 0x140039767
mov dword [0x14019fd80], ebx
xor al, al
jmp 0x1400397ea
mov rax, qword [rsi]
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x40]
cmp dword [rax - 0x10], ebx
jne 0x1400397a0
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
jmp 0x1400397da
lea rax, [rsp + 0x58]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400397da
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x58]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete al
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14003a00c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, r9
mov r14, r8
mov r15, rdx
mov rbp, rcx
mov r10d, dword [0x14019fd80]
imul r10d, r10d
mov eax, 0x88888889
imul r10d
add edx, r10d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r10d, edx
xor r12d, r12d
cmp r10d, 7
jne 0x14003a0a4
lea ecx, [r12 + 0x28]
call fcn.1400b8688
mov rdi, rax
mov ebx, r12d
call fcn.1400b99c8
add eax, dword [0x14019fd80]
mov dword [rdi + rbx*4], eax
inc rbx
cmp rbx, 0xa
jl 0x14003a07c
mov ecx, dword [rdi + 0x24]
mov dword [0x14019fd80], ecx
mov rcx, rdi
call fcn.1400ba0bc
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x58], r12
mov ebx, 0x2001f
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x100
mov r8, qword [r14]
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140017f78
test eax, eax
je 0x14003a0ff
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r12d
mov r8, qword [r14]
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140017f78
test eax, eax
je 0x14003a0ff
mov dil, r12b
mov rbx, qword [rsp + 0x48]
jmp 0x14003a170
mov rcx, qword [r15]
mov eax, r12d
test rcx, rcx
setne al
mov rbx, qword [rsp + 0x48]
test eax, eax
jne 0x14003a119
lea edi, [rax + 0xd]
jmp 0x14003a14f
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14003a11d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test rbx, rbx
je 0x14003a165
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], r12d
test edi, edi
sete dil
test rbx, rbx
je 0x14003a183
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov al, dil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14003a1ac
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rsi, rcx
and qword [rsp + 0x48], 0
and dword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0x100
mov r8, qword [r8]
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140017f78
test eax, eax
je 0x14003a24b
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
mov r8, qword [rbx]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140017f78
test eax, eax
je 0x14003a24b
xor dil, dil
mov rbx, qword [rsp + 0x48]
jmp 0x14003a2ff
mov eax, dword [r14]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsi]
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov r9d, dword [0x14019fd80]
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
imul r8d, ecx
imul r8d, r9d
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r8d, edx
cmp r8d, 0xc
jne 0x14003a2df
xor ecx, ecx
lea rdx, [rsp + 0x70]
mov eax, dword [rdx]
imul eax, eax, 0x23
add r9d, eax
inc ecx
lea rdx, [rdx + 4]
movsxd rax, ecx
cmp rax, 0x148
jb 0x14003a2bf
mov dword [0x14019fd80], r9d
test rbx, rbx
je 0x14003a2f4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov qword [rsp + 0x48], rbx
and dword [rsp + 0x50], 0
test edi, edi
sete dil
test rbx, rbx
je 0x14003a313
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
and dword [rsp + 0x50], 0
mov al, dil
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1400b9010
add rsp, 0x1d0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14003a47c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rsi, rcx
call fcn.1400382e0
test al, al
jne 0x14003a4b2
call fcn.1400b99c8
mov dword [0x14019fd80], eax
and qword [rbp - 0x28], 0
and dword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
mov r9d, 0x2001f
mov r8, qword [rbx]
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.140018038
mov rbx, qword [rbp - 0x28]
test eax, eax
je 0x14003a4e2
xor dil, dil
jmp 0x14003a53b
mov dword [rbp - 0x2c], 4
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14003a51d
mov eax, dword [rbp - 0x30]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
test rbx, rbx
je 0x14003a531
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov qword [rbp - 0x28], rbx
and dword [rbp - 0x20], 0
test edi, edi
sete dil
test rbx, rbx
je 0x14003a54e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x28], 0
and dword [rbp - 0x20], 0
mov al, dil
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14003a560
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r11d, dword [0x14019fd80]
mov rsi, rdx
mov eax, 0x88888889
mov r10d, r11d
mov rbx, r9
mov rdi, r8
mov r14, rcx
imul r10d, r11d
imul r10d
add edx, r10d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r10d, edx
cmp r10d, 7
jne 0x14003a5ce
lea ecx, [r10 - 6]
cmp r11d, ecx
jle 0x14003a5c8
mov eax, r11d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r11d
jl 0x14003a5b9
mov dword [0x14019fd80], ecx
mov rdx, qword [rdi]
lea rax, [rsp + 0x50]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14003a5f5
xor al, al
jmp 0x14003a635
mov r8, qword [rsi]
mov rdx, qword [r14]
mov r9d, 1
mov ecx, dword [r8 - 0x10]
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14003ad58
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x728
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rsp + 0x710], rax
mov rax, r8
mov rdi, rcx
mov r10, r9
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x30], edx
mov rdx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
je 0x14003adaf
xor al, al
jmp 0x14003ae5f
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [0x14019fd80]
mov ebp, eax
imul ecx, ecx
and ecx, 0x8000000f
jge 0x14003adef
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 0xc
jne 0x14003ae4f
mov rdi, rbx
mov esi, 0xd9
call fcn.1400b99c8
inc rdi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rsp + rdi*8 + 0x38], xmm0
cmp rdi, rsi
jb 0x14003adfc
mov rcx, rbx
mov eax, 0xd8
jmp 0x14003ae42
movsd xmm1, qword [rsp + rax*8 + 0x40]
movsd xmm0, qword [rsp + rax*8 + 0x38]
comisd xmm1, xmm0
jbe 0x14003ae3f
movsd qword [rsp + rax*8 + 0x40], xmm0
movsd qword [rsp + rax*8 + 0x38], xmm1
dec rax
cmp rax, rcx
jg 0x14003ae21
inc rcx
dec rsi
jne 0x14003ae1a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
sete al
mov rcx, qword [rsp + 0x710]
xor rcx, rsp
call fcn.1400b9010
add rsp, 0x728
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14003ae7c
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x7b8]
sub rsp, 0x890
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov r14, rdx
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], r15
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.140039224
nop
mov r9d, 0x2001f
mov r8, qword [rax]
mov rdx, qword [0x14019ad58]
lea rcx, [rsp + 0x48]
call fcn.140018038
test eax, eax
setne bl
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003af10
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14003af21
mov dil, r15b
mov rbx, qword [rsp + 0x48]
jmp 0x14003b02e
mov esi, r15d
mov edi, 1
mov ecx, dword [0x14019fd80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub r8d, edx
cmp r8d, 0xc
jne 0x14003af80
lea ecx, [r8 - 8]
call fcn.1400b97c8
mov rbx, rax
call fcn.1400b99c8
mov dword [rbx], eax
mov dword [0x14019fd80], eax
mov rcx, rbx
call fcn.1400b8ff4
mov word [rbp - 0x80], r15w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp - 0x7e]
call fcn.1400be450
mov dword [rsp + 0x40], 0x400
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x80]
mov edx, esi
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add esi, edi
test eax, eax
jne 0x14003b013
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x68]
call fcn.140001cb0
nop
mov rdx, rax
mov rcx, r14
call fcn.140019760
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003af29
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14003af29
test rbx, rbx
je 0x14003b029
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], r15d
test rbx, rbx
je 0x14003b041
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], r15d
mov al, dil
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.1400b9010
mov rbx, qword [rsp + 0x8d0]
add rsp, 0x890
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003e17c
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rcx
and dword [rsp + 0x38], 0
xor esi, esi
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov r11d, eax
mov r8d, dword [0x14019fd80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
lea r15d, [rsi + 1]
cmp ecx, r15d
jne 0x14003e228
mov ecx, r15d
cmp r8d, r15d
jle 0x14003e21f
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r8d
jl 0x14003e210
mov r8d, ecx
mov dword [0x14019fd80], ecx
movzx r12d, r11b
movzx eax, r11w
shr ax, 8
movzx r13d, al
lea eax, [r8 + 1]
imul eax, r8d
and eax, 0x8000000f
jge 0x14003e250
sub eax, r15d
or eax, 0xfffffff0
add eax, r15d
cmp eax, 9
jne 0x14003e2c6
xor r9d, r9d
lea r10, [rsp + 0x60]
mov bpl, r8b
sub bpl, r9b
mov edi, r15d
mov r14d, 2
xor r15d, r15d
mov eax, r8d
cdq
idiv edi
mov dword [rsp + 0x3c], edx
lea ebx, [r15 + 1]
mov esi, edx
mov eax, r8d
cdq
idiv ebx
mov ecx, eax
mov al, bpl
imul cl
mov cl, al
mov al, sil
imul cl
mov byte [r10 + r15], al
inc ebx
inc r15
cmp r15, 0xd
jl 0x14003e27f
mov r15d, 1
add edi, r15d
add r10, 0xd
sub r14, r15
jne 0x14003e26c
add r9d, r15d
cmp r9d, 0xb
jl 0x14003e25d
mov rbx, qword [rsp + 0x40]
mov esi, dword [rsp + 0x30]
cmp r11d, 0x80000000
jae 0x14003e2d5
mov esi, r11d
shr esi, 0x10
cmp r12d, 6
jb 0x14003e2f4
cmp r13d, 2
jb 0x14003e2f4
mov rcx, rbx
call fcn.14003e974
nop
mov dword [rsp + 0x38], r15d
jmp 0x14003e38d
lea rcx, [0x1401979a8]
mov rax, qword [0x1401979a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], esi
mov r9d, r13d
mov r8d, r12d
lea rdx, str._d._d___d_
lea rcx, [rsp + 0x30]
call fcn.14000f8ac
mov ecx, dword [0x14019fd80]
mov r8d, ecx
imul r8d, ecx
imul r8d, ecx
mov eax, 0x66666667
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 0xa
jne 0x14003e362
add dword [0x1401a0f60], r15d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000291c
mov dword [rsp + 0x38], r15d
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003e38d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rbx
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400b9010
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14003f9e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x1401a16e0], al
je 0x14003fa0d
lea rax, [0x14019bb40]
jmp 0x14003fa8f
mov dword [rbp - 0x40], 0x150013
mov dword [rbp - 0x3c], 0x1c0018
mov dword [rbp - 0x38], 0x150016
mov dword [rbp - 0x34], 0x40034
mov dword [rbp - 0x30], 0x2b001b
mov dword [rbp - 0x2c], 0x16000d
mov dword [rbp - 0x28], 0x20000
mov dword [rbp - 0x24], 0x140013
mov dword [rbp - 0x20], 0x150030
mov dword [rbp - 0x1c], 0x60008
mov dword [rbp - 0x18], 3
mov dword [rbp - 0x14], 5
lea rdx, [0x14019bb40]
lea rcx, [0x14019ada0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
inc rax
cmp rax, 0x17
jl 0x14003fa68
mov byte [0x1401a16e0], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b9010
add rsp, 0x40
pop rbp
ret

Function at 0x14003faa4
Capabilities:
Encode data using xor
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
cmp byte [0x1401a16e8], bl
je 0x14003fad3
lea rax, [0x14019ba40]
jmp 0x14003fb66
mov ecx, dword [0x14019fd80]
mov dword [rsp + 0x30], 0x40053
mov edi, 1
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
mov dword [rsp + 0x34], 0x410001
mov dword [rsp + 0x38], 0x4e
imul r8d, eax
imul r8d, ecx
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 2
jne 0x14003fb3b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea rax, [0x14019ba40]
lea rcx, [0x14019ada0]
movzx ecx, byte [rbx + rcx]
xor cx, word [rsp + rbx*2 + 0x30]
mov word [rax + rbx*2], cx
add rbx, rdi
cmp rbx, 5
jl 0x14003fb42
mov byte [0x1401a16e8], dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b9010
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14003fb80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r8d, dword [0x14019fd80]
mov ebx, 1
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
lea edi, [rbx + 6]
imul ecx, eax
mov eax, 0x88888889
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, edi
jne 0x14003fbf6
mov ecx, ebx
cmp r8d, ebx
jle 0x14003fbf0
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r8d
jl 0x14003fbe1
mov dword [0x14019fd80], ecx
xor eax, eax
cmp byte [0x1401a16ff], al
je 0x14003fc0c
lea rax, [0x14019b588]
jmp 0x14003fc9d
mov dword [rbp - 0x40], 0x2001b
mov dword [rbp - 0x3c], 0x2f0001
mov dword [rbp - 0x38], 0x1f0006
mov dword [rbp - 0x34], 0x8000e
mov dword [rbp - 0x30], 0x110004
mov dword [rbp - 0x2c], 0x10000d
mov dword [rbp - 0x28], 0x70000
mov dword [rbp - 0x24], 0x30038
mov dword [rbp - 0x20], 0xf000a
mov dword [rbp - 0x1c], 0x1c000e
mov dword [rbp - 0x18], 0x300002
mov r9d, 0x1a
mov dword [rbp - 0x14], 0xd001a
mov dword [rbp - 0x10], 0x1b0006
mov word [rbp - 0xc], ax
lea rdx, [0x14019b588]
lea rcx, [0x14019ada0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
add rax, rbx
cmp rax, r9
jl 0x14003fc78
mov byte [0x1401a16ff], bl
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b9010
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret