joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400479a4
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
and qword [r11 - 0x48], 0
lea rax, [rbp + 0x30]
and qword [r11 - 0x50], 0
and dword [rbp + 0x38], 0
mov dword [rbp + 0x30], r9d
lea r9, [rbp + 0x38]
mov qword [r11 - 0x58], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
mov rdi, qword [rbp + 0x40]
mov ebx, 1
mov dl, bl
mov rcx, rdi
mov r14d, eax
call fcn.14003363c
mov r9, qword [rdi + 0x10]
lea r10, [rdi + 8]
movabs r11, 0x4800144005b3
cmp r9, rbx
je 0x140047a12
mov ecx, dword [rdi]
mov r8d, ecx
jmp 0x140047a41
mov rcx, qword [r10]
mov rax, r11
mov r8d, dword [rdi]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul ecx, ecx, 0x3e8
add ecx, r8d
cmp ecx, 0x40
jne 0x140047a84
and dword [rbp - 0x1c], 0
lea rsi, [0x140081530]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140081538]
cmp rcx, rbx
jbe 0x140047a7b
mov rax, qword [0x140081530]
mov edx, 0x2746
mov rcx, rsi
call qword [rax + 0x30]
mov bl, al
mov dword [rbp - 0x20], 0x2746
jmp 0x140047afd
cmp r9, rbx
je 0x140047a8e
mov eax, r8d
jmp 0x140047aba
mov rcx, qword [r10]
mov rax, r11
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x4d2
jne 0x140047b1f
and dword [rbp - 0x1c], 0
lea rsi, [0x140081530]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140081538]
cmp rcx, rbx
jbe 0x140047af6
mov rax, qword [0x140081530]
mov edx, 0x274d
mov rcx, rsi
call qword [rax + 0x30]
mov bl, al
mov dword [rbp - 0x20], 0x274d
movzx eax, bl
mov qword [rbp - 0x18], rsi
add rax, 2
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
jmp 0x140047b96
cmp r9, rbx
je 0x140047b29
mov eax, r8d
jmp 0x140047b55
mov rcx, qword [r10]
mov rax, r11
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x2738
je 0x140047ba0
cmp r9, rbx
jne 0x140047b8d
mov rcx, qword [r10]
mov rax, r11
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0xea
je 0x140047ba0
test r14d, r14d
je 0x140047ba0
or eax, 0xffffffff
jmp 0x140047bb8
and qword [rbp - 0x10], 0
xorps xmm0, xmm0
mov eax, dword [rbp + 0x38]
movups xmmword [rdi], xmm0
movsd xmm0, qword [rbp - 0x10]
movsd qword [rdi + 0x10], xmm0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14004a458
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
and qword [rax - 0x48], 0
and qword [rax - 0x50], 0
mov rbx, qword [rbp + 0x40]
and dword [rbp + 0x38], 0
mov dword [rax - 0x58], r9d
lea r9, [rbp + 0x38]
call qword [sym.imp.WS2_32.dll_WSASend]
mov edi, 1
mov rcx, rbx
mov dl, dil
mov r14d, eax
call fcn.14003363c
movabs r9, 0x4800144005b3
cmp qword [rbx + 0x10], rdi
je 0x14004a4b8
mov ecx, dword [rbx]
mov r8d, ecx
jmp 0x14004a4e8
mov rcx, qword [rbx + 8]
mov rax, r9
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul ecx, ecx, 0x3e8
add ecx, r8d
cmp ecx, 0x40
jne 0x14004a52c
and dword [rbp - 0x1c], 0
lea rsi, [0x140081530]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140081538]
cmp rcx, rdi
jbe 0x14004a523
mov rax, qword [0x140081530]
mov edx, 0x2746
mov rcx, rsi
call qword [rax + 0x30]
mov dil, al
mov dword [rbp - 0x20], 0x2746
jmp 0x14004a5a5
cmp qword [rbx + 0x10], rdi
jne 0x14004a55f
mov rcx, qword [rbx + 8]
mov rax, r9
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x14004a5c6
and dword [rbp - 0x1c], 0
lea rsi, [0x140081530]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140081538]
cmp rcx, rdi
jbe 0x14004a59e
mov rax, qword [0x140081530]
mov edx, 0x274d
mov rcx, rsi
call qword [rax + 0x30]
mov dil, al
mov dword [rbp - 0x20], 0x274d
movzx eax, dil
mov qword [rbp - 0x18], rsi
add rax, 2
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test r14d, r14d
je 0x14004a5d0
or eax, 0xffffffff
jmp 0x14004a5e8
and qword [rbp - 0x10], 0
xorps xmm0, xmm0
mov eax, dword [rbp + 0x38]
movups xmmword [rbx], xmm0
movsd xmm0, qword [rbp - 0x10]
movsd qword [rbx + 0x10], xmm0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14004b858
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
movzx r15d, r8b
mov rsi, r9
mov r14, rdx
mov edi, 1
cmp rcx, 0xffffffffffffffff
jne 0x14004b902
mov r14d, 0x2719
and dword [rbp - 0x1c], 0
lea rbx, [0x140081530]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140081538]
cmp rcx, rdi
jbe 0x14004b8c2
mov rax, qword [0x140081530]
mov edx, r14d
mov rcx, rbx
call qword [rax + 0x30]
mov dil, al
movzx eax, dil
mov dword [rbp - 0x20], r14d
add rax, 2
mov qword [rbp - 0x18], rbx
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rsi], xmm0
movsd qword [rsi + 0x10], xmm1
xor al, al
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
test r8b, r8b
jne 0x14004b917
test byte [rdx], dil
je 0x14004b917
mov r14d, 0x2726
jmp 0x14004b88e
lea r8, [rbp + 0x20]
mov dword [rbp + 0x20], r15d
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
mov rcx, rsi
mov ebx, eax
sets dl
call fcn.14003363c
test ebx, ebx
js 0x14004b8e7
mov dl, byte [r14]
mov al, dil
mov cl, dl
or dl, 2
and cl, 0xfd
movzx edx, dl
test r15b, r15b
movzx ecx, cl
cmove edx, ecx
mov byte [r14], dl
jmp 0x14004b8e9
Function at 0x14004c4fc
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov r10d, r9d
mov r9, rdx
mov r11d, r8d
cmp rcx, 0xffffffffffffffff
jne 0x14004c585
and dword [rbp - 0x1c], 0
lea rbx, [0x140081530]
movabs rcx, 0x4d54ee85da812030
mov edx, 1
add rcx, qword [0x140081538]
cmp rcx, rdx
jbe 0x14004c552
mov rax, qword [0x140081530]
mov edx, 0x2719
mov rcx, rbx
call qword [rax + 0x30]
mov dl, al
movzx ecx, dl
add rcx, 2
mov dword [rbp - 0x20], 0x2719
mov qword [rbp - 0x10], rcx
mov rcx, qword [rbp + 0x40]
movsd xmm1, qword [rbp - 0x10]
mov qword [rbp - 0x18], rbx
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
or eax, 0xffffffff
jmp 0x14004c687
cmp r11d, 0xa5100000
jne 0x14004c649
mov edx, 1
cmp r10d, 2
jne 0x14004c602
and dword [rbp - 0x1c], 0
lea rbx, [0x140081530]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140081538]
cmp rcx, rdx
jbe 0x14004c5d2
mov rax, qword [0x140081530]
mov edx, 0x2726
mov rcx, rbx
call qword [rax + 0x30]
mov dl, al
movzx eax, dl
add rax, 2
mov dword [rbp - 0x20], 0x2726
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x40]
movsd xmm1, qword [rbp - 0x10]
mov qword [rbp - 0x18], rbx
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rax], xmm0
movsd qword [rax + 0x10], xmm1
jmp 0x14004c57d
cmp r10d, edx
jne 0x14004c65e
cmp qword [rbp + 0x38], 4
jne 0x14004c59d
mov cl, byte [r9]
xorps xmm0, xmm0
mov rax, qword [rbp + 0x30]
mov edx, dword [rax]
mov al, cl
and al, 0xfb
or cl, 4
movzx eax, al
test edx, edx
movzx ecx, cl
cmove ecx, eax
mov rax, qword [rbp + 0x40]
and qword [rbp - 0x10], 0
mov byte [r9], cl
movups xmmword [rax], xmm0
movsd xmm0, qword [rbp - 0x10]
movsd qword [rax + 0x10], xmm0
xor eax, eax
jmp 0x14004c687
cmp r11d, 0xffff
jne 0x14004c65e
cmp r10d, 0x80
jne 0x14004c65e
or byte [rdx], 8
mov eax, dword [rbp + 0x38]
mov r8d, r10d
mov r9, qword [rbp + 0x30]
mov edx, r11d
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbp + 0x40]
test eax, eax
mov ebx, eax
setne dl
call fcn.14003363c
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14004cc74
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, r9
mov dword [rax - 0x20], 1
and dword [rax - 0x28], 0
xor r9d, r9d
mov esi, ecx
call qword [sym.imp.WS2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
mov rcx, rbx
mov rdi, rax
sete dl
call fcn.14003363c
cmp rdi, 0xffffffffffffffff
jne 0x14004ccba
or rax, rdi
jmp 0x14004cce4
cmp esi, 0x17
jne 0x14004cce1
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
lea edx, [rsi + 0x12]
mov dword [rsp + 0x20], 4
lea r8d, [rsi + 4]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14004d22c
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 8]
mov r11, r9
mov rsi, r8
mov r10, rdx
mov rbx, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x78], 0
je 0x14004d25e
xor r9d, r9d
xor r8d, r8d
jmp 0x14004d26d
cmp qword [rdx], 0xffffffffffffffff
jne 0x14004d27b
xor r9d, r9d
mov r8d, 0x2719
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
jmp 0x14004d2f4
mov eax, dword [rsp + 0x70]
lea r9, [rsp + 0x78]
and qword [rsp + 0x30], 0
mov r8d, r11d
mov rdi, qword [rsp + 0x80]
mov rdx, rsi
mov rcx, qword [r10]
and dword [rsp + 0x78], 0
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x14004d2cd
mov eax, 0x2746
jmp 0x14004d2da
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x14004d2fb
cmp eax, 0x3e5
je 0x14004d2fb
mov r9d, dword [rsp + 0x78]
mov r8d, eax
mov rcx, qword [rbx + 8]
mov rdx, rdi
call fcn.14003fcc0
jmp 0x14004d307
mov rcx, qword [rbx + 8]
mov rdx, rdi
call fcn.14003fd5c
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14004d3e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 8]
mov r11, r9
mov rbx, r8
mov r10, rdx
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x78], 0
je 0x14004d412
xor r9d, r9d
xor r8d, r8d
jmp 0x14004d421
cmp qword [rdx], 0xffffffffffffffff
jne 0x14004d42f
xor r9d, r9d
mov r8d, 0x2719
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
jmp 0x14004d492
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x78]
mov eax, dword [rsp + 0x70]
mov r8d, r11d
mov rsi, qword [rsp + 0x80]
mov rdx, rbx
mov rcx, qword [r10]
and dword [rsp + 0x78], 0
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x14004d499
cmp eax, 0x3e5
je 0x14004d499
mov r9d, dword [rsp + 0x78]
mov r8d, eax
mov rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.14003fcc0
jmp 0x14004d4a5
mov rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.14003fd5c
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140050e48
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
je 0x140050e8a
cmp rbx, 0x7fffffff
ja 0x140050e8a
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
cdqe
jmp 0x140050e8e
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14005d020
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, 4
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14005d04a
mov eax, dword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
lea rdx, str.error_while_reading
mov rcx, rbx
call fcn.14005d0c0
int3

Function at 0x14005e26c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005e2b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005e2b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005e2b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005e2b6
cmp dword [rcx + 0x84], 0xe
jbe 0x14005e2b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005e2b8
xor al, al
add rsp, 0x28
ret
Function at 0x10000ac80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [0x100026430]
lea rsi, [0x100026430]
cmp rcx, rsi
je 0x10000acc0
test byte [rcx + 0x1c], 2
je 0x10000acc0
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001f00]
mov edx, 0x6d
call fcn.10000e6d0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0xb0], rax
test rax, rax
jne 0x10000ad1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x10000ad1f
mov rcx, qword [0x100026430]
cmp rcx, rsi
je 0x10000aded
test byte [rcx + 0x1c], 4
je 0x10000aded
mov edx, 0x6e
lea r9, [0x100002dc0]
jmp 0x10000add5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0xa8], rax
test rax, rax
jne 0x10000ad74
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x10000ad74
mov rcx, qword [0x100026430]
cmp rcx, rsi
je 0x10000aded
test byte [rcx + 0x1c], 4
je 0x10000aded
mov edx, 0x6f
jmp 0x10000ad13
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x10000ae08]
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0xb8], rax
test rax, rax
jne 0x10000adeb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x10000adeb
mov rcx, qword [0x100026430]
cmp rcx, rsi
je 0x10000aded
test byte [rcx + 0x1c], 4
je 0x10000aded
mov edx, 0x70
lea r9, [0x100002df0]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001f00]
mov dword [rsp + 0x20], ebx
call fcn.1000071e8
jmp 0x10000aded
xor ebx, ebx
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x10000c444
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
lea rax, [0x100002e80]
mov dword [rcx + 0x50], 0xc0000001
mov rbx, rcx
mov qword [rcx], rax
lea rax, [0x100002eb0]
mov qword [rcx + 8], rax
lea rax, [0x100002ef0]
mov qword [rcx + 0x20], rax
lea rax, [0x100002f20]
mov qword [rcx + 0x28], rax
lea rax, [0x100002f50]
mov qword [rcx + 0x30], rax
lea rax, [0x100002fc0]
mov qword [rcx + 0x38], rax
mov rcx, qword [0x1000272d0]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.100007bf8
Function at 0x10000f9f4
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x100026108]
xor rax, rsp
mov qword [rsp + 0x270], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x10000faf8
test rcx, rcx
je 0x10000fa6e
call qword [entry0]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
test ebx, ebx
mov qword [rsp + 0x48], rcx
jmp 0x10000fa94
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.10000f9f4
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x10000faf8
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10000fa7c
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x10000fae6
call qword [entry0]
and qword [rsp + 0x48], 0
mov rdx, rsi
mov rcx, rdi
call fcn.10000fb58
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x10000fb03
call qword [entry0]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10001ed20
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1000108c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x100026108]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp rax, rbx
jne 0x100010938
call fcn.10000ee98
mov ebx, eax
jmp 0x100010a79
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
cmp rax, rbx
jne 0x10001095b
call fcn.10000ee98
mov ebx, eax
jmp 0x100010a6f
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
cmp rax, rbx
jne 0x100010980
call fcn.10000ee98
mov ebx, eax
jmp 0x100010a6f
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x1000109b9
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1000109af
lea rcx, [rsp + 0x70]
call fcn.10000ee68
nop
mov eax, 0x8007000e
jmp 0x100010a92
mov ecx, eax
cmp rcx, rbx
je 0x1000109f7
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1000109ed
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x1000109f7
lea rcx, [rsp + 0x70]
call fcn.10000f448
mov rax, qword [rsp + 0x70]
jmp 0x100010a01
mov ecx, 0x80070057
call fcn.10000f92c
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x100010a18
cmp rax, rbx
jne 0x100010a24
mov ebx, 0x8007000e
jmp 0x100010a6f
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x100010a4b
call fcn.10000ee98
mov ebx, eax
jmp 0x100010a6f
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.100010704
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x100010a90
lea rcx, [rsp + 0x70]
call fcn.10000ee68
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.10001ed20
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x100013a0c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x100026108]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edi, edi
mov qword [rsp + 0x50], rdi
mov rcx, qword [0x100026430]
lea rsi, [0x100026430]
lea rbp, [0x100001e80]
cmp rcx, rsi
je 0x100013a72
test byte [rcx + 0x1c], 2
je 0x100013a72
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x26]
mov r8, rbp
call fcn.10000e6d0
mov rcx, qword [0x100026430]
lea r9, [0x1000038d0]
lea rax, [rsp + 0x60]
mov r10d, 0x104
lea rdx, [rsp + 0x60]
mov ebx, edi
sub r9, rax
mov r8, r10
lea rax, [r8 + 0x7ffffefa]
cmp rax, rdi
je 0x100013ab4
movzx eax, word [r9 + rdx]
cmp ax, di
je 0x100013ab4
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x100013a91
cmp r8, rdi
jne 0x100013ac2
sub rdx, 2
mov ebx, 0x8007007a
cmp ebx, edi
mov word [rdx], di
jge 0x100013ade
cmp rcx, rsi
je 0x100013b1e
test byte [rcx + 0x1c], 4
je 0x100013b1e
mov edx, SafeArrayAllocDescriptorEx
mov r9d, ebx
jmp 0x100013b12
lea r8, [0x100003918]
lea rcx, [rsp + 0x60]
mov rdx, r10
call fcn.100014950
cmp eax, edi
mov ebx, eax
jge 0x100013b37
mov rcx, qword [0x100026430]
cmp rcx, rsi
je 0x100013b1e
test byte [rcx + 0x1c], 4
je 0x100013b1e
mov edx, reloc.OLEAUT32.dll_SafeArrayAllocDescriptorEx
mov r9d, eax
mov rcx, qword [rcx + 0x10]
mov r8, rbp
call fcn.100007084
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
cmove ebx, eax
jmp 0x100013bcc
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
cmp eax, edi
je 0x100013b8e
mov rcx, qword [0x100026430]
cmp rcx, rsi
je 0x100013bcc
test byte [rcx + 0x1c], 4
je 0x100013bcc
mov edx, 0x29
jmp 0x100013bbd
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
cmp eax, edi
je 0x100013bcc
mov rcx, qword [0x100026430]
cmp rcx, rsi
je 0x100013bcc
test byte [rcx + 0x1c], 4
je 0x100013bcc
mov edx, 0x2a
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, rbp
call fcn.100007084
mov rcx, qword [rsp + 0x50]
cmp rcx, rdi
je 0x100013bdc
call qword [entry0]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10001ed20
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret