joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b4eb0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rcx]
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call qword [rax]
cmp rsi, 0x10
jne 0x1400b4f52
mov rax, qword [rbx + 8]
mov dword [rax], 0x61707865
mov eax, dword [rdi]
mov rcx, qword [rbx + 8]
mov dword [rcx + 4], eax
mov eax, dword [rdi + 4]
mov rcx, qword [rbx + 8]
mov dword [rcx + 8], eax
mov eax, dword [rdi + 8]
mov rcx, qword [rbx + 8]
mov dword [rcx + 0xc], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0xc]
mov dword [rcx + 0x10], eax
mov rax, qword [rbx + 8]
mov dword [rax + 0x14], 0x3120646e
mov rax, qword [rbx + 8]
mov dword [rax + 0x28], 0x79622d36
mov rcx, qword [rbx + 8]
mov eax, dword [rdi]
mov dword [rcx + 0x2c], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 4]
mov dword [rcx + 0x30], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 8]
mov dword [rcx + 0x34], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0xc]
mov dword [rcx + 0x38], eax
jmp 0x1400b4fc7
cmp rsi, 0x20
jne 0x1400b4fd2
mov rax, qword [rbx + 8]
mov dword [rax], 0x61707865
mov eax, dword [rdi]
mov rcx, qword [rbx + 8]
mov dword [rcx + 4], eax
mov eax, dword [rdi + 4]
mov rcx, qword [rbx + 8]
mov dword [rcx + 8], eax
mov eax, dword [rdi + 8]
mov rcx, qword [rbx + 8]
mov dword [rcx + 0xc], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0xc]
mov dword [rcx + 0x10], eax
mov rax, qword [rbx + 8]
mov dword [rax + 0x14], 0x3320646e
mov rax, qword [rbx + 8]
mov dword [rax + 0x28], 0x79622d32
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0x10]
mov dword [rcx + 0x2c], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0x14]
mov dword [rcx + 0x30], eax
mov eax, dword [rdi + 0x18]
mov rcx, qword [rbx + 8]
mov dword [rcx + 0x34], eax
mov rdx, qword [rbx + 8]
mov eax, dword [rdi + 0x1c]
mov dword [rdx + 0x38], eax
mov rax, qword [rbx + 8]
mov dword [rax + 0x3c], 0x6b206574
xor eax, eax
lea rdx, [rsp + 0x20]
mov r8d, 8
mov dword [rsp + 0x21], eax
mov word [rsp + 0x25], ax
mov byte [rsp + 0x27], al
mov rax, qword [rbx]
mov rcx, rbx
mov byte [rsp + 0x20], 0
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b6120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rax, qword [rcx + 0x28]
xor r12d, r12d
mov r13, rdx
mov r15d, dword [rax]
mov esi, dword [rax + 4]
mov ebp, dword [rax + 8]
mov edi, dword [rax + 0xc]
mov r14d, dword [rax + 0x10]
test rdx, rdx
je 0x1400b6243
mov qword [rsp + 0x28], rbx
nop
lea r9d, [r14 + rdi]
mov edx, edi
mov eax, edi
ror edx, 8
add edi, ebp
add ebp, esi
and edx, 0xff00ff00
add esi, r15d
add r12, 8
rol eax, 8
and eax, 0xff00ff
or edx, eax
mov rax, qword [rcx + 0x68]
mov dword [r12 + rax - 8], edx
mov r8, qword [rcx + 8]
movzx edx, sil
mov r10d, dword [r8 + rdx*4]
movzx edx, bpl
shr ebp, 8
mov r11d, dword [r8 + rdx*4]
movzx edx, dil
shr edi, 8
mov ebx, dword [r8 + rdx*4]
movzx edx, r9b
xor r11d, ebp
mov r14d, dword [r8 + rdx*4]
xor ebx, edi
shr esi, 8
xor r10d, esi
mov edx, ebx
mov eax, ebx
shr r9d, 8
ror edx, 8
and edx, 0xff00ff00
xor r14d, r9d
lea r9d, [r15 + rbx]
add ebx, r11d
add r11d, r10d
add r10d, r14d
rol eax, 8
and eax, 0xff00ff
or edx, eax
mov rax, qword [rcx + 0x68]
mov dword [rax + r12 - 4], edx
mov r8, qword [rcx + 8]
movzx edx, r10b
mov esi, dword [r8 + rdx*4]
movzx edx, r11b
shr r10d, 8
mov ebp, dword [r8 + rdx*4]
movzx edx, bl
shr r11d, 8
mov edi, dword [r8 + rdx*4]
movzx edx, r9b
shr ebx, 8
mov r15d, dword [r8 + rdx*4]
shr r9d, 8
xor esi, r10d
xor ebp, r11d
xor edi, ebx
xor r15d, r9d
cmp r12, r13
jne 0x1400b6160
mov rbx, qword [rsp + 0x28]
mov rax, qword [rcx + 0x28]
mov dword [rax], r15d
mov rax, qword [rcx + 0x28]
mov dword [rax + 4], esi
mov rax, qword [rcx + 0x28]
mov rsi, qword [rsp + 0x38]
mov dword [rax + 8], ebp
mov rax, qword [rcx + 0x28]
mov rbp, qword [rsp + 0x30]
mov dword [rax + 0xc], edi
mov rax, qword [rcx + 0x28]
mov rdi, qword [rsp + 0x40]
mov dword [rax + 0x10], r14d
mov qword [rcx + 0x88], 0
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400b6290
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r9d, r9d
nop dword [rax + rax]
mov eax, dword [r9 + rdx]
add r9, 4
mov r8d, eax
rol eax, 8
and eax, 0xff00ff
ror r8d, 8
and r8d, 0xff00ff00
or r8d, eax
mov rax, qword [rcx + 0x48]
mov dword [r9 + rax - 4], r8d
cmp r9, 0x10
jne 0x1400b62b0
xor r8d, r8d
mov rax, qword [rcx + 0x48]
mov rdx, qword [rcx + 8]
add r8, 4
mov eax, dword [r8 + rax - 4]
mov dword [r8 + rdx - 4], eax
cmp r8, 0x10
jne 0x1400b62e3
mov r9, r8
lea r10, [0x140346ca0]
nop dword [rax]
mov rax, qword [rcx + 8]
mov edx, dword [r9 + rax - 0x10]
lea r8, [r9 + rax]
add r9, 4
add edx, dword [r8 - 4]
mov eax, edx
shr edx, 3
and eax, 7
mov eax, dword [r10 + rax*4]
xor eax, edx
mov dword [r8], eax
cmp r9, 0x400
jne 0x1400b6310
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx + 8]
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 0x164]
add r8, 4
add dword [rdx], eax
cmp r8, 0x5c
jne 0x1400b6350
mov rax, qword [rcx + 8]
mov r10d, dword [rax + 0xec]
mov r9d, dword [rax + 0x84]
btr r10d, 0x17
or r10d, 0x1000001
xor r8d, r8d
nop dword [rax]
mov rdx, qword [rcx + 8]
btr r9d, 0x17
add r8, 4
mov eax, dword [rdx + r8 - 4]
add r9d, r10d
and eax, 0xffffff
xor eax, r9d
mov dword [rdx + r8 - 4], eax
cmp r8, 0x400
jne 0x1400b6390
mov r8, qword [rcx + 8]
movzx edx, r9b
mov eax, dword [r8 + rdx*4]
mov ebx, dword [r8]
xor eax, r9d
movzx r10d, al
mov r9d, r10d
lea r11, [r10*4]
mov eax, dword [r11 + r8]
mov dword [r8], eax
mov r8d, 1
nop dword [rax]
mov rdx, qword [rcx + 8]
xor r9, r8
inc r8
mov eax, dword [rdx + r8*4 - 4]
mov dword [r11 + rdx], eax
mov rdx, qword [rcx + 8]
mov eax, dword [rdx + r9*4]
xor eax, r10d
movzx r10d, al
mov r9d, r10d
lea r11, [r10*4]
mov eax, dword [r11 + rdx]
mov dword [rdx + r8*4 - 4], eax
cmp r8, 0x100
jne 0x1400b63f0
mov rax, qword [rcx + 8]
lea rdx, [rsp + 0x20]
mov r8d, 8
mov dword [rax + r10*4], ebx
xor eax, eax
mov qword [rcx + 0x88], 0
mov dword [rsp + 0x21], eax
mov word [rsp + 0x25], ax
mov byte [rsp + 0x27], al
mov rax, qword [rcx]
mov byte [rsp + 0x20], 0
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1402b9610
add rsp, 0x30
pop rbx
ret
Function at 0x1400b6480
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rcx]
mov rdx, r8
call qword [rax + 0x38]
test al, al
jne 0x1400b64f5
mov rax, qword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [rax + 8]
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14000e820
lea rdx, [0x14040fa18]
lea rcx, [rsp + 0x28]
call fcn.1402c1558
nop
xor edx, edx
nop word [rax + rax]
mov rax, qword [rbx + 0x48]
mov rcx, qword [rbx + 0x28]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x10
jne 0x1400b6500
mov eax, dword [rsi]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov rax, qword [rbx + 0x28]
mov dword [rax + 0x10], ecx
mov rcx, qword [rbx + 0x28]
mov eax, dword [rcx + 0x10]
xor dword [rcx], eax
mov rdx, qword [rbx + 0x28]
mov eax, dword [rsi + 4]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
xor dword [rdx + 8], ecx
mov rax, qword [rbx + 0x28]
mov r15d, dword [rax]
mov esi, dword [rax + 4]
mov ebp, dword [rax + 8]
mov edi, dword [rax + 0xc]
mov r14d, dword [rax + 0x10]
xor r12d, r12d
nop word [rax + rax]
mov ecx, edi
ror ecx, 8
and ecx, 0xff00ff00
mov eax, edi
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov rax, qword [rbx + 0x68]
mov dword [r12 + rax], ecx
lea r8d, [r14 + rdi]
add edi, ebp
add ebp, esi
add esi, r15d
mov rdx, qword [rbx + 8]
movzx ecx, sil
shr esi, 8
mov r9d, dword [rdx + rcx*4]
xor r9d, esi
movzx ecx, bpl
shr ebp, 8
mov r10d, dword [rdx + rcx*4]
xor r10d, ebp
movzx ecx, dil
shr edi, 8
mov r11d, dword [rdx + rcx*4]
xor r11d, edi
movzx ecx, r8b
shr r8d, 8
mov r14d, dword [rdx + rcx*4]
xor r14d, r8d
mov ecx, r11d
ror ecx, 8
and ecx, 0xff00ff00
mov eax, r11d
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov rax, qword [rbx + 0x68]
mov dword [rax + r12 + 4], ecx
lea r8d, [r15 + r11]
add r11d, r10d
add r10d, r9d
add r9d, r14d
mov rdx, qword [rbx + 8]
movzx ecx, r9b
shr r9d, 8
mov esi, dword [rdx + rcx*4]
xor esi, r9d
movzx ecx, r10b
shr r10d, 8
mov ebp, dword [rdx + rcx*4]
xor ebp, r10d
movzx ecx, r11b
shr r11d, 8
mov edi, dword [rdx + rcx*4]
xor edi, r11d
movzx ecx, r8b
shr r8d, 8
mov r15d, dword [rdx + rcx*4]
xor r15d, r8d
add r12, 8
cmp r12, 0x20
jne 0x1400b6580
mov rax, qword [rbx + 0x28]
mov dword [rax], r15d
mov rax, qword [rbx + 0x28]
mov dword [rax + 4], esi
mov rax, qword [rbx + 0x28]
mov dword [rax + 8], ebp
mov rax, qword [rbx + 0x28]
mov dword [rax + 0xc], edi
mov rax, qword [rbx + 0x28]
mov dword [rax + 0x10], r14d
mov qword [rbx + 0x88], 0
mov rdx, qword [rbx + 0x70]
mov rcx, rbx
call fcn.1400b6120
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400b6a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
xor r8d, r8d
xor ecx, ecx
mov qword [rbp - 0x3c], rax
mov dword [rbp - 0x34], eax
cpuid
mov dword [rbp - 0x40], r8d
mov dword [rbp - 0x38], ecx
mov dword [rbp - 0x34], edx
mov dl, 1
mov ecx, r8d
mov dword [rbp - 0x20], 0x756e6547
mov dword [rbp - 0x1c], 0x6c65746e
mov dword [rbp - 0x18], 0x49656e69
mov dword [rbp - 0x30], 0x68747541
mov dword [rbp - 0x2c], 0x444d4163
mov dword [rbp - 0x28], 0x69746e65
mov dword [rbp - 0x40], eax
mov dword [rbp - 0x3c], ebx
nop word [rax + rax]
mov eax, dword [rbp + rcx - 0x20]
cmp dword [rbp + rcx - 0x3c], eax
sete al
add rcx, 4
and dl, al
cmp rcx, 0xc
jne 0x1400b6b00
test dl, dl
je 0x1400b6b38
xor ecx, ecx
mov eax, 1
cpuid
shr ebx, 8
mov dword [rbp - 0x40], eax
mov dword [rbp - 0x38], ecx
movzx eax, bl
mov dword [rbp - 0x34], edx
shl eax, 3
jmp 0x1400b6b7c
mov cl, 1
nop word [rax + rax]
mov eax, dword [rbp + r8 - 0x30]
cmp dword [rbp + r8 - 0x3c], eax
sete al
add r8, 4
and cl, al
cmp r8, 0xc
jne 0x1400b6b40
test cl, cl
je 0x1400b6b77
mov eax, 0x80000005
xor ecx, ecx
cpuid
mov dword [rbp - 0x40], eax
movzx eax, cl
mov dword [rbp - 0x3c], ebx
mov dword [rbp - 0x38], ecx
mov dword [rbp - 0x34], edx
jmp 0x1400b6b7c
mov eax, 0x20
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400cb230
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x68]
mov rdi, r8
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x1400cb28e
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov dword [rdi], eax
mov al, 1
add rsp, 0x40
pop rdi
ret
Function at 0x1400cb6c0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x250
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp qword [0x14042bfd0], 0
je 0x1400cb822
lea rcx, str.SeBackupPrivilege
call fcn.1400ff510
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx ecx, word [rsp + 0x30]
call fcn.1400cf300
mov rsi, rax
test rax, rax
je 0x1400cb824
call fcn.1400ceaa0
mov rdi, rax
cmp qword [0x14042baf8], 0
jne 0x1400cb76d
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtQueryKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14042baf8], rax
test rax, rax
jne 0x1400cb76d
xor ebx, ebx
jmp 0x1400cb790
mov ecx, 0xa8
call fcn.1402b968c
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400cb78e
mov rcx, rax
call fcn.1400d00d0
mov rbx, rax
jmp 0x1400cb790
xor ebx, ebx
mov rdx, 0xffffffff80000002
mov rcx, rbx
call fcn.1400d05f0
mov rdx, 0xffffffff80000003
mov rcx, rbx
call fcn.1400d05f0
mov rcx, rsi
call fcn.1400cb850
cmp qword [0x14042bfd0], 0
jbe 0x1400cb7e2
test rdi, rdi
je 0x1400cb7cd
mov rcx, rdi
call fcn.1400cebd0
mov rcx, rsi
call fcn.1400cf490
mov rcx, rbx
call fcn.1400d0270
call fcn.1400cbd50
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
test rbx, rbx
je 0x1400cb801
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
test rdi, rdi
je 0x1400cb813
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
cmp qword [0x14042bfd0], 0
jbe 0x1400cb822
call fcn.1400cc000
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400ceaa0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x258
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.AppCompatProgramsAmcache.hve
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.1402bbbd8
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1400ce880
test al, al
jne 0x1400ceb11
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1402b9610
add rsp, 0x258
ret
mov qword [rsp + 0x260], rbx
mov ecx, 0x20
mov qword [rsp + 0x268], rbp
mov qword [rsp + 0x250], rsi
call fcn.1402b968c
mov rbx, rax
test rax, rax
je 0x1400ceb5e
lea rax, vtable.CommunityRemnantsAmcache.0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx], rax
mov dword [rbx + 0x18], 0
jmp 0x1400ceb60
xor ebx, ebx
mov rsi, qword [rsp + 0x28]
mov ebp, dword [rsp + 0x20]
mov ecx, 0x18
mov qword [rbx + 0x10], rsi
mov dword [rbx + 0x18], ebp
call fcn.1402b968c
test rax, rax
je 0x1400ceb91
lea rcx, vtable.RegParser.0
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rbp
mov qword [rax], rcx
mov rsi, qword [rsp + 0x250]
mov rbp, qword [rsp + 0x268]
mov qword [rbx + 8], rax
mov rax, rbx
mov rbx, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1402b9610
add rsp, 0x258
ret
Function at 0x1400cf300
Capabilities:
Get volume information via ioctl

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov eax, dword [0x140347f48]
movsd xmm0, qword [0x140347f40]
xor r14d, r14d
mov dword [r11 - 0x20], eax
movzx eax, word [0x140347f4c]
movzx ebp, cx
movsd qword [r11 - 0x28], xmm0
mov word [r11 - 0x20], cx
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 3]
lea rcx, [r11 - 0x28]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], r14d
mov word [r11 - 0x1c], ax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400cf3c8
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x90064
mov rcx, rdi
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400cf3cf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400cf461
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], rsi
mov esi, dword [rsp + 0x80]
mov ecx, 0x38
add esi, 0x10
call fcn.1402b968c
mov rbx, rax
test rax, rax
je 0x1400cf413
lea rax, vtable.CommunityRemnantsNtfs.0
mov qword [rbx + 0x10], 0xffffffffffffffff
mov qword [rbx + 0x30], r14
mov qword [rbx], rax
jmp 0x1400cf416
mov rbx, r14
mov word [rbx + 8], bp
mov qword [rbx + 0x10], rdi
mov ecx, dword [rsp + 0x80]
mov dword [rbx + 0x18], ecx
mov ecx, esi
mov dword [rbx + 0x28], esi
call fcn.1402b9c60
mov rsi, qword [rsp + 0xe8]
mov qword [rbx + 0x30], rax
mov rax, qword [rsp + 0x88]
mov ecx, dword [rsp + 0x80]
cqo
idiv rcx
mov qword [rbx + 0x20], rax
mov rax, rbx
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0xd0]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400d0270
Capabilities:
Create thread
Get system information on windows

Disassembly:
mov r11, rsp
push rbp
sub rsp, 0xd0
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0xb0], rax
cmp qword [rcx + 0xa0], 0
mov rbp, rcx
je 0x1400d0374
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x18], r14
lea rcx, [rsp + 0x38]
xor r14d, r14d
mov esi, r14d
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x58]
mov ecx, 2
cmp eax, ecx
cmovl eax, ecx
mov ecx, 8
cmp eax, ecx
cmovg eax, ecx
test eax, eax
jle 0x1400d0336
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xc8], rdi
mov edi, eax
lea rbx, [rsp + 0x70]
nop word [rax + rax]
lea rax, [rsp + 0x30]
lea r8, [0x1400d0940]
mov r9, rbp
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400d0321
mov qword [rbx], rax
inc esi
add rbx, 8
dec rdi
jne 0x1400d02f0
mov rdi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rbp + 0x40]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rdx, [rsp + 0x70]
or r9d, 0xffffffff
mov r8d, 1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov r14, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xf0]
mov al, 1
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1402b9610
add rsp, 0xd0
pop rbp
ret
Function at 0x1400d0390
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rdx
mov rsi, rcx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1400d05b3
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x1400d05b3
mov ebx, r14d
nop dword [rax]
nop dword [rax + rax]
mov dword [rsp + 0x70], 0x100
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x50]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400d05a7
lea rdx, str.CurrentControlSet
lea rcx, [rbp - 0x50]
call fcn.1402b9aac
test eax, eax
jne 0x1400d04e4
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r14
mov word [rbp - 0x70], r14w
lea r8, [rbp - 0x70]
mov rdx, rdi
call fcn.1400d0680
test al, al
je 0x1400d04d4
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
lea rdx, str.HKLMSYSTEM_
call fcn.1402b9aac
test eax, eax
jne 0x1400d04d4
cmp qword [rbp - 0x58], 8
jb 0x1400d05a7
mov rcx, qword [rbp - 0x70]
call fcn.1402177e0
jmp 0x1400d05a7
cmp qword [rbp - 0x58], 8
jb 0x1400d04e4
mov rcx, qword [rbp - 0x70]
call fcn.1402177e0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d05a7
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1400d059c
mov eax, dword [rsp + 0x78]
mov dword [rbp - 0x80], eax
mov eax, dword [rsp + 0x7c]
mov dword [rbp - 0x7c], eax
mov r11, qword [rbp - 0x80]
mov rcx, r11
call fcn.1400cb480
test rax, rax
je 0x1400d0584
mov r9, rax
mov r8, r11
mov rdx, qword [rsp + 0x68]
call fcn.1400d07a0
cmp dword [rsp + 0x74], 0
jbe 0x1400d059c
mov rdx, qword [rsp + 0x68]
mov rcx, rsi
call fcn.1400d05f0
test al, al
jne 0x1400d05a7
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
cmp ebx, dword [rsp + 0x60]
jb 0x1400d0430
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400d1fe0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne dil
test dil, dil
jne 0x1400d201d
mov rbx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__d_while_deleting:__ls_r_n
mov edx, eax
mov r8, rbx
call fcn.1402ba358
movzx eax, dil
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret