joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009590
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
mov rdx, rax
neg rdx
movabs rcx, 0x7ffffffff0deafff
and rcx, rdx
mov qword [sym.default_browser_agent.exe_gMozillaPoisonSize], rax
mov qword [sym.default_browser_agent.exe_gMozillaPoisonBase], rcx
test rax, rax
je 0x1400095e9
shr rax, 1
add rax, rcx
add rax, 0xffffffffffffffff
mov qword [sym.default_browser_agent.exe_gMozillaPoisonValue], rax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140065710
nop
add rsp, 0x58
ret
Function at 0x1400099b0
Capabilities:
Delete registry value

Disassembly:
push rsi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x48]
call fcn.14000b030
cmp byte [rsp + 0x68], 1
jne 0x1400099e8
mov eax, dword [rsp + 0x48]
mov byte [rsi + 4], 1
mov dword [rsi], eax
jmp 0x140009a85
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
movaps xmm0, xmmword [0x140067290]
movups xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], 0
cmp qword [rsp + 0x38], 7
jbe 0x140009a1e
mov r8, qword [rsp + 0x20]
jmp 0x140009a23
lea r8, [rsp + 0x20]
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
jne 0x140009a6d
lea rdx, str.RegistryDeleteValue
xor ecx, ecx
mov r8d, 0xfe
call fcn.140009ce0
mov dword [rsi], 0
mov bl, byte [rsp + 0x68]
mov byte [rsi + 4], 1
lea rcx, [rsp + 0x20]
call fcn.140007340
test bl, bl
jne 0x140009a85
jmp 0x140009a7b
mov byte [rsi + 4], 0
lea rcx, [rsp + 0x20]
call fcn.140007340
lea rcx, [rsp + 0x48]
call fcn.140007340
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140065710
mov rax, rsi
add rsp, 0x78
pop rbx
pop rsi
ret
Function at 0x140009aa0
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
movaps xmmword [rsp + 0x90], xmm6
mov rsi, r8
mov r14, rcx
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm6, xmmword [0x140067290]
movups xmmword [rsp + 0x70], xmm6
mov word [rsp + 0x60], 0
lea rbx, [rsp + 0x60]
mov rcx, rbx
call fcn.140007520
mov byte [rsp + 0x50], 0
movups xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x70], xmm6
mov word [rsp + 0x60], 0
mov rcx, rbx
call fcn.140007340
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x40], xmm6
mov word [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140009bb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea rdx, str.RegistrySetValueString
mov ecx, esi
mov r8d, 0x6e
call fcn.140009ce0
mov byte [r14 + 4], 1
mov dword [r14], esi
lea rcx, [rsp + 0x60]
call fcn.140007340
lea rcx, [rsp + 0x30]
call fcn.140007340
jmp 0x140009caa
mov ebp, eax
cdqe
add rax, rax
mov rdi, 0xffffffffffffffff
cmovae rdi, rax
mov rcx, rdi
call fcn.1400646bc
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r15
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140009c22
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea rdx, str.RegistrySetValueString
mov ecx, esi
mov r8d, 0x77
jmp 0x140009c7f
add ebp, ebp
cmp qword [rsp + 0x78], 7
jbe 0x140009c31
mov rbx, qword [rsp + 0x60]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r15
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
mov r8, rbx
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
jne 0x140009c62
mov byte [r14 + 4], 0
jmp 0x140009c8c
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea rdx, str.RegistrySetValueString
mov ecx, esi
mov r8d, 0x81
call fcn.140009ce0
mov byte [r14 + 4], 1
mov dword [r14], esi
mov rcx, r15
call fcn.140064680
mov bl, byte [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140007340
test bl, bl
je 0x140009ba1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140065710
mov rax, r14
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140009ce0
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov ebp, r8d
mov r12, rdx
mov r15d, ecx
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.0x_X_in__S:_d
mov rcx, r14
mov edx, r15d
mov r8, r12
mov r9d, ebp
call fcn.1400011b0
add eax, 1
movsxd rbx, eax
mov rsi, rbx
add rsi, rbx
mov rax, 0xffffffffffffffff
cmovb rsi, rax
mov rcx, rsi
call fcn.1400646bc
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r15d
mov rcx, rdi
mov rdx, rbx
mov r8, 0xffffffffffffffff
mov r9, r14
call fcn.140001230
mov rdx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140009dd3
mov rbx, rax
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, r15d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140064680
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140065710
nop
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140009e00
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, r8d
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0xc8], r9
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea r12, [rsp + 0xc8]
mov qword [rsp + 0x50], r12
call fcn.1400017d0
mov rcx, qword [rax]
or rcx, 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
cmp eax, 0xfffffffe
mov ecx, 0xffffffff
cmovg ecx, eax
add ecx, 1
movsxd rbp, ecx
mov rbx, rbp
add rbx, rbp
mov r13, 0xffffffffffffffff
cmovb rbx, r13
mov rcx, rbx
call fcn.1400646bc
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x50], r12
call fcn.1400017d0
mov rcx, qword [rax]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
mov rdx, rsi
mov r8, rbp
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
lea r12, str.Error:__s___S:_d_
mov rcx, r12
mov rdx, rsi
mov r8, r14
mov r9d, r15d
call fcn.1400011b0
add eax, 1
movsxd rbx, eax
mov rbp, rbx
add rbp, rbx
cmovb rbp, r13
mov rcx, rbp
call fcn.1400646bc
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rbx
mov r8, 0xffffffffffffffff
mov r9, r12
call fcn.140001230
mov rdx, qword [sym.default_browser_agent.exe_gWinEventLogSourceName]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140009f90
mov rbx, rax
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov dx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rdi
call fcn.140064680
mov rcx, rsi
call fcn.140064680
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140065710
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000b1a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, rcx
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x60]
call fcn.14000b030
cmp byte [rsp + 0x80], 1
jne 0x14000b1e2
mov eax, dword [rsp + 0x60]
mov byte [rsi + 4], 1
mov dword [rsi], eax
jmp 0x14000b2d9
movups xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x140067290]
movups xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], 0
mov dword [rsp + 0x38], 4
cmp qword [rsp + 0x58], 7
jbe 0x14000b220
mov r8, qword [rsp + 0x40]
jmp 0x14000b225
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14000b270
cmp eax, 2
jne 0x14000b29c
mov byte [rsi + 4], 0
mov word [rsi], 0
jmp 0x14000b286
xor eax, eax
cmp dword [rsp + 0x3c], 0
setne al
mov byte [rsi + 4], 0
or eax, 0x100
mov word [rsi], ax
lea rcx, [rsp + 0x40]
call fcn.140007340
lea rcx, [rsp + 0x60]
call fcn.140007340
jmp 0x14000b2d9
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
lea rdx, str.RegistryGetValueBool
mov ecx, edi
mov r8d, 0x9d
call fcn.140009ce0
mov byte [rsi + 4], 1
mov dword [rsi], edi
mov bl, byte [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.140007340
test bl, bl
je 0x14000b290
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140065710
mov rax, rsi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000b300
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov ebx, r9d
mov rsi, rcx
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x60]
call fcn.14000b030
cmp byte [rsp + 0x80], 1
jne 0x14000b345
mov eax, dword [rsp + 0x60]
mov byte [rsi + 4], 1
mov dword [rsi], eax
jmp 0x14000b40e
movups xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x140067290]
movups xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], 0
movzx eax, bl
mov dword [rsp + 0x3c], eax
cmp qword [rsp + 0x58], 7
jbe 0x14000b382
mov r8, qword [rsp + 0x40]
jmp 0x14000b387
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
jne 0x14000b3d1
mov byte [rsi + 4], 0
lea rcx, [rsp + 0x40]
call fcn.140007340
lea rcx, [rsp + 0x60]
call fcn.140007340
jmp 0x14000b40e
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
lea rdx, str.RegistrySetValueBool
mov ecx, edi
mov r8d, 0xb5
call fcn.140009ce0
mov dword [rsi], edi
mov bl, byte [rsp + 0x80]
mov byte [rsi + 4], 1
lea rcx, [rsp + 0x40]
call fcn.140007340
test bl, bl
je 0x14000b3c5
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140065710
mov rax, rsi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000b430
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
movaps xmmword [rsp + 0xb0], xmm6
mov rsi, rcx
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm6, xmmword [0x140067290]
movups xmmword [rsp + 0x90], xmm6
mov word [rsp + 0x80], 0
lea rdi, [rsp + 0x80]
mov rcx, rdi
call fcn.140007520
mov byte [rsp + 0x70], 0
movups xmm0, xmmword [rsp + 0x80]
movups xmm1, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
movups xmmword [rsp + 0x90], xmm6
mov word [rsp + 0x80], 0
mov rcx, rdi
call fcn.140007340
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x60], xmm6
mov word [rsp + 0x50], 0
mov dword [rsp + 0x44], 8
cmp qword [rsp + 0x98], 7
jbe 0x14000b4fa
mov rdi, qword [rsp + 0x80]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
mov r8, rdi
mov r9d, 0x40
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14000b549
cmp eax, 2
jne 0x14000b572
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov byte [rsi + 0x10], 0
jmp 0x14000b559
mov rax, qword [rsp + 0x48]
mov byte [rsi + 0x10], 0
mov qword [rsi], rax
mov byte [rsi + 8], 1
lea rcx, [rsp + 0x80]
call fcn.140007340
lea rcx, [rsp + 0x50]
call fcn.140007340
jmp 0x14000b5af
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
lea rdx, str.RegistryGetValueQword
mov ecx, edi
mov r8d, 0xd1
call fcn.140009ce0
mov byte [rsi + 0x10], 1
mov dword [rsi], edi
mov bl, byte [rsp + 0x70]
lea rcx, [rsp + 0x80]
call fcn.140007340
test bl, bl
je 0x14000b566
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140065710
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000b5e0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm6
mov rsi, rcx
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], r8
movaps xmm6, xmmword [0x140067290]
movups xmmword [rsp + 0x80], xmm6
mov word [rsp + 0x70], 0
lea rdi, [rsp + 0x70]
mov rcx, rdi
call fcn.140007520
mov byte [rsp + 0x60], 0
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x80], xmm6
mov word [rsp + 0x70], 0
mov rcx, rdi
call fcn.140007340
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x50], xmm6
mov word [rsp + 0x40], 0
cmp qword [rsp + 0x88], 7
jbe 0x14000b695
mov rdi, qword [rsp + 0x70]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
lea rdx, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov rcx, 0xffffffff80000001
mov r8, rdi
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
jne 0x14000b6e2
mov byte [rsi + 4], 0
lea rcx, [rsp + 0x70]
call fcn.140007340
lea rcx, [rsp + 0x40]
call fcn.140007340
jmp 0x14000b71c
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
lea rdx, str.RegistrySetValueQword
mov ecx, edi
mov r8d, 0xe9
call fcn.140009ce0
mov dword [rsi], edi
mov bl, byte [rsp + 0x60]
mov byte [rsi + 4], 1
lea rcx, [rsp + 0x70]
call fcn.140007340
test bl, bl
je 0x14000b6d6
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140065710
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140011f70
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov al, 1
cmp byte [rcx + 8], 0
jne 0x140012049
mov rsi, rcx
mov rdi, qword [rcx]
test rdi, rdi
jne 0x140011fc0
lea r8, str.MozillaFirefoxDefaultBrowserAgentRegistryMutex
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
mov rcx, qword [rsi]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140011fb4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], rdi
test rdi, rdi
je 0x140012050
mov rcx, rdi
mov edx, 0xbb8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x140011fe6
cmp eax, 0x80
je 0x140012001
test eax, eax
jne 0x140012020
mov byte [rsi + 8], 1
jmp 0x140012042
lea rcx, str.Timed_out_waiting_for_registry_mutex
lea rdx, str.Acquire
mov r8d, 0xa9
call fcn.140009e00
jmp 0x140012042
lea rcx, str.Found_abandoned_registry_mutex._Continuing...
lea rdx, str.Acquire
mov r8d, 0xb0
call fcn.140009e00
mov byte [rsi + 8], 1
jmp 0x140012042
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_to_wait_on_registry_mutex:__X
lea rdx, str.Acquire
mov r8d, 0xb6
mov r9d, eax
call fcn.140009e00
cmp byte [rsi + 8], 0
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Couldnt_open_registry_mutex:__X
lea rdx, str.Acquire
mov r8d, 0x9f
mov r9d, eax
call fcn.140009e00
xor eax, eax
jmp 0x140012049
Function at 0x140013240
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rdi, rdx
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x140013342
mov dword [rsp + 0x6c], 0
mov dword [rsp + 0x68], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, 2
test eax, eax
jne 0x140013337
mov dword [rsp + 0x64], 0xffffffff
mov dword [rsp + 0x60], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8, rdi
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, 2
test eax, eax
jne 0x140013337
xor ebx, ebx
cmp dword [rsp + 0x64], 0
sete bl
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140013347
mov ebx, 2
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140065710
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400144c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x14001456c
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x14001456c
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14001456a
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea rbx, [rsp + 0x28]
mov qword [rsp + 0x20], rbx
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x140014583
cmp eax, 1
je 0x140014537
test eax, eax
jne 0x14001456a
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x140014560
mov r9, qword [rsi + 0x80]
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14001456a
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x14001456c
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140065710
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov dil, 1
jmp 0x14001456c
Function at 0x1400203f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r14, r9
mov rdi, r8
mov rsi, rdx
mov r15, rcx
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, qword [rcx]
mov rcx, qword [rbp + 8]
cmp byte [rcx + 0x19], 0
jne 0x1400204a0
mov rbx, rcx
lea rdx, [rcx + 0x20]
mov rcx, rdi
call fcn.140019df0
mov ecx, eax
xor cl, 1
movzx ecx, cl
shl rcx, 4
mov rcx, qword [rbx + rcx]
cmp byte [rcx + 0x19], 0
je 0x140020426
mov qword [rsp + 0x30], rbx
test al, al
je 0x1400204f8
mov rax, qword [r15]
mov rbp, rbx
cmp rbp, qword [rax]
je 0x1400204ad
lea rcx, [rsp + 0x30]
call fcn.14001fd20
mov r12b, 1
mov rbx, qword [rsp + 0x30]
lea rcx, [rbx + 0x20]
mov rdx, rdi
call fcn.140019df0
test al, al
je 0x1400204e9
mov qword [rsp + 0x20], r14
mov rcx, r15
mov rdx, rsi
mov r8d, r12d
mov r9, rbp
call fcn.140020190
mov dil, 1
jmp 0x1400204c6
mov qword [rsp + 0x30], rbp
mov rax, rbp
cmp rbp, qword [rax]
jne 0x140020463
mov qword [rsp + 0x20], r14
mov dil, 1
mov rcx, r15
mov rdx, rsi
mov r8b, 1
mov r9, rbp
call fcn.140020190
mov byte [rsi + 8], dil
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140065710
mov rax, rsi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, r14
call fcn.140020510
mov qword [rsi], rbx
xor edi, edi
jmp 0x1400204c6
xor r12d, r12d
mov rbp, rbx
jmp 0x140020475
Function at 0x140052590
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x88
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400525e4
movaps xmm0, xmmword [rsp + 0x20]
mov eax, dword [0x14009e2a0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x88], 1
movups xmmword [rax + 0x90], xmm0
add rsp, 0x88
ret
call sub.KERNEL32.dll_GetLastError
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x4c], eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [0x14004fbd0]
mov qword [rsp + 0x40], rax
lea rax, [0x14008d688]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rdx, str.srclibstd_syswindows_rand.rscouldnt_generate_random_bytes:
lea rcx, [rsp + 0x58]
call fcn.1400330e0
ud2
Function at 0x14005ec60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov r9, rcx
add qword [rcx + 0x10], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14005ec9b
mov r15d, 8
sub r15, r11
cmp r15, r8
mov rax, r8
cmovb rax, r15
cmp rax, 4
jb 0x14005eca3
mov r14d, dword [rdx]
mov r10d, 4
jmp 0x14005eca9
xor r15d, r15d
jmp 0x14005ed61
xor r14d, r14d
xor r10d, r10d
mov rcx, r10
or rcx, 1
cmp rcx, rax
jae 0x14005eccc
movzx edi, word [rdx + r10]
lea ecx, [r10*8]
shl rdi, cl
or r14, rdi
or r10, 2
cmp r10, rax
jae 0x14005ece3
movzx eax, byte [rdx + r10]
shl r10d, 3
mov ecx, r10d
shl rax, cl
or r14, rax
lea ecx, [r11*8]
shl r14, cl
or r14, qword [r9 + 0x38]
mov qword [r9 + 0x38], r14
cmp r15, r8
jbe 0x14005ed03
add r11, r8
jmp 0x14005ee3e
mov rcx, qword [r9 + 0x30]
xor rcx, r14
mov rdi, qword [r9 + 0x28]
mov rax, qword [r9 + 0x18]
add rax, rdi
rol rdi, 0xd
xor rdi, rax
rol rax, 0x20
mov rsi, qword [r9 + 0x20]
add rsi, rcx
rol rcx, 0x10
xor rcx, rsi
add rax, rcx
rol rcx, 0x15
xor rcx, rax
mov qword [r9 + 0x30], rcx
add rsi, rdi
rol rdi, 0x11
xor rdi, rsi
mov qword [r9 + 0x28], rdi
rol rsi, 0x20
mov qword [r9 + 0x20], rsi
xor rax, r14
mov qword [r9 + 0x18], rax
mov qword [r9 + 0x40], 0
sub r8, r15
mov r11d, r8d
and r11d, 7
sub r8, r11
cmp r15, r8
jae 0x14005ede3
mov rax, qword [r9 + 0x30]
mov rsi, qword [r9 + 0x18]
mov rcx, qword [r9 + 0x20]
mov rdi, qword [r9 + 0x28]
nop word cs:[rax + rax]
nop dword [rax]
add rsi, rdi
rol rdi, 0xd
mov rbx, qword [rdx + r15]
xor rdi, rsi
rol rsi, 0x20
xor rax, rbx
add rcx, rax
rol rax, 0x10
xor rax, rcx
add rsi, rax
rol rax, 0x15
add rcx, rdi
rol rdi, 0x11
xor rdi, rcx
rol rcx, 0x20
xor rax, rsi
xor rsi, rbx
add r15, 8
cmp r15, r8
jb 0x14005ed90
mov qword [r9 + 0x30], rax
mov qword [r9 + 0x18], rsi
mov qword [r9 + 0x28], rdi
mov qword [r9 + 0x20], rcx
cmp r11, 4
jb 0x14005edf5
mov esi, dword [rdx + r15]
mov r8d, 4
jmp 0x14005edfa
xor esi, esi
xor r8d, r8d
mov rax, r8
or rax, 1
cmp rax, r11
jae 0x14005ee20
lea rax, [r8 + r15]
movzx eax, word [rdx + rax]
lea ecx, [r8*8]
shl rax, cl
or rsi, rax
or r8, 2
cmp r8, r11
jae 0x14005ee3a
add r15, r8
movzx eax, byte [rdx + r15]
shl r8d, 3
mov ecx, r8d
shl rax, cl
or rsi, rax
mov qword [r9 + 0x38], rsi
mov qword [r9 + 0x40], r11
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret