joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029b84
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d124
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d124
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029cd4
cmp rax, 0xffffffffffffffff
je 0x140029cd4
xor edi, edi
test rbp, rbp
jle 0x140029c7f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fda4
mov rbx, rax
test rax, rax
jne 0x140029c0c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029c75
mov edx, 0x8000
mov ecx, r14d
call fcn.14001aac0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001de00
cmp eax, 0xffffffff
je 0x140029c55
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029c1c
mov edx, r15d
mov ecx, r14d
call fcn.14001aac0
jmp 0x140029c75
cmp byte [rsi + 0x38], dil
je 0x140029c6c
cmp dword [rsi + 0x34], 5
jne 0x140029c6c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029c75
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b404
jmp 0x140029ce8
jns 0x140029ce8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d124
cmp rax, 0xffffffffffffffff
jne 0x140029ca0
cmp byte [rsi + 0x30], dil
je 0x140029ce8
mov edi, dword [rsi + 0x2c]
jmp 0x140029ce8
mov ecx, r14d
call fcn.1400195f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029ce8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029ce8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029ce1
mov eax, dword [rsi + 0x2c]
jmp 0x140029ce6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d124
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ade0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ae08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ae08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001e1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e66
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e68
xor al, al
add rsp, 0x28
ret
Function at 0x1400112b2
Capabilities:
Terminate process

Disassembly:
jmp 0x1400144a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140011366
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400157f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015810
xor al, al
jmp 0x140015891
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015823
xor al, al
jmp 0x140015891
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001584d
xor al, al
jmp 0x140015891
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015861
xor al, al
jmp 0x140015891
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015873
xor al, al
jmp 0x140015891
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001588f
xor al, al
jmp 0x140015891
mov al, 1
add rsp, 0x38
ret
Function at 0x140013260
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400114dd
movzx eax, al
test eax, eax
jne 0x140013280
mov ecx, 7
call fcn.140011424
nop
mov byte [rsp + 0x20], 0
call fcn.140011447
mov byte [rsp + 0x21], al
cmp dword [0x14001fb28], 1
jne 0x1400132a4
mov ecx, 7
call fcn.140011424
nop
jmp 0x1400132fc
cmp dword [0x14001fb28], 0
jne 0x1400132f7
mov dword [0x14001fb28], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.14001124e
test eax, eax
je 0x1400132d8
mov eax, 0xff
jmp 0x140013401
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.140011438
mov dword [0x14001fb28], 2
jmp 0x1400132fc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001140b
call fcn.14001138e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140013359
mov rcx, qword [rsp + 0x30]
call fcn.1400111f4
movzx eax, al
test eax, eax
je 0x140013359
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.1400113ca
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001338d
mov rcx, qword [rsp + 0x38]
call fcn.1400111f4
movzx eax, al
test eax, eax
je 0x14001338d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001148d
nop
call fcn.1400134b0
mov dword [rsp + 0x28], eax
call fcn.140011366
movzx eax, al
test eax, eax
jne 0x1400133ac
mov ecx, dword [rsp + 0x28]
call fcn.140011073
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400133bb
call fcn.140011497
nop
xor edx, edx
mov cl, 1
call fcn.1400111db
mov eax, dword [rsp + 0x28]
jmp 0x140013401
add rsp, 0x68
ret
Function at 0x140001394
Capabilities:
Create directory
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov r9d, 1
lea rdx, str.EnsureTracingDirectory
mov rbx, rcx
lea rcx, [rbp - 0x38]
lea r8d, [r9 + 0x1d]
call fcn.14000ab2c
xor edi, edi
lea rax, [0x1400122e0]
mov qword [rbp - 0x60], rax
xorps xmm0, xmm0
xor eax, eax
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x10], rdi
lea eax, [rdi + 0x25]
movups xmmword [rbp - 0x50], xmm0
test rbx, rbx
jne 0x140001400
mov dword [rbp - 0x38], 0x80070057
mov word [rbp - 0x32], ax
jmp 0x14000150b
mov rcx, qword [rbx]
mov dword [rbp - 0x38], edi
mov word [rbp - 0x34], ax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
or edx, 0xffffffff
cmp eax, edx
je 0x140001431
mov ecx, eax
and ecx, 0x10
je 0x140001436
mov dword [rbp - 0x38], edi
mov eax, 0x2d
jmp 0x140001507
mov ecx, 0x10
cmp eax, edx
je 0x14000146c
test ecx, ecx
jne 0x14000146c
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140001460
call fcn.14000c0f8
mov dword [rbp - 0x38], eax
mov eax, 0x37
jmp 0x1400013f7
mov eax, 0x37
mov dword [rbp - 0x38], edi
mov word [rbp - 0x34], ax
xor r9d, r9d
lea r8, [rbp + 0x10]
lea rcx, str.O:BAG:BAD:P_A_OICI_GA___BA__A_OICI_GA___SY_
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
nop dword [rax + rax]
test eax, eax
jne 0x1400014a0
call fcn.14000c0f8
mov dword [rbp - 0x38], eax
mov eax, 0x42
jmp 0x1400013f7
mov rcx, qword [rbx]
lea rdx, [rbp - 0x50]
mov eax, 0x42
mov dword [rbp - 0x38], edi
mov word [rbp - 0x34], ax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x50], 0x18
mov dword [rbp - 0x40], edi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14000150b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xb7
cmove eax, edi
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x4f
mov dword [rbp - 0x38], ecx
test ecx, ecx
js 0x1400013f7
mov word [rbp - 0x34], ax
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov ebx, dword [rbp - 0x38]
lea rcx, [rbp - 0x60]
call fcn.14000d4e8
lea rcx, [rbp - 0x38]
call fcn.14000ac34
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140007dfc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rsi, r8
mov r14, rdx
mov rdi, rcx
lea rdx, str.COperationTracker::_Initialize
mov r8d, 0x63c
lea rcx, [rbp - 0x38]
mov r9d, 1
call fcn.14000ab2c
and dword [rbp + 0x38], 0
and qword [rbp - 0x40], 0
call fcn.140009880
mov rcx, rdi
call fcn.1400079a4
mov ebx, eax
mov dword [rbp - 0x38], eax
test eax, eax
mov eax, 0x644
js 0x140007f38
mov word [rbp - 0x34], ax
lea r8, [rbp - 0x40]
mov rax, qword [rdi]
lea rdx, [0x1400123c8]
mov rcx, rdi
mov rax, qword [rax]
call qword [0x14000f760]
mov ebx, eax
mov dword [rbp - 0x38], eax
test eax, eax
mov eax, 0x647
js 0x140007f38
mov r9, qword [rbp - 0x40]
lea r8, [0x140007dc0]
mov word [rbp - 0x34], ax
xor edx, edx
lea rax, [rbp + 0x38]
xor ecx, ecx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
nop dword [rax + rax]
mov rcx, qword [rdi + 0x78]
mov rbx, rax
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x140007ed8
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov qword [rdi + 0x78], rbx
test rbx, rbx
je 0x140007f29
cmp rbx, 0xffffffffffffffff
je 0x140007f29
mov rcx, qword [rdi + 0x100]
xor ebx, ebx
and qword [rbp - 0x40], rbx
mov eax, 0x64c
mov word [rbp - 0x34], ax
mov dword [rbp - 0x38], ebx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140007f19
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov ebx, dword [rbp - 0x38]
mov qword [rdi + 0x100], r14
mov qword [rdi + 0x108], rsi
jmp 0x140007f3c
call fcn.14000c0f8
mov ebx, eax
mov dword [rbp - 0x38], eax
mov eax, 0x64c
mov word [rbp - 0x32], ax
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140007f55
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14000f760]
mov ebx, dword [rbp - 0x38]
lea rcx, [rbp - 0x38]
call fcn.14000ac34
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000c194
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, rcx
lea rdx, str.SxLoadSystem32LibraryEx
lea rcx, [rbp - 0x40]
mov r9d, 1
mov r8d, 0x714
call fcn.14000ab2c
xor r13d, r13d
xor edx, edx
xor ecx, ecx
mov esi, r13d
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
jne 0x14000c205
call fcn.14000c0f8
mov ecx, 0x71f
mov dword [rbp - 0x40], eax
mov word [rbp - 0x3a], cx
jmp 0x14000c357
mov ecx, 0x71f
mov dword [rbp - 0x40], r13d
or rdi, 0xffffffffffffffff
mov word [rbp - 0x3c], cx
mov rdx, rdi
inc rdx
cmp word [r12 + rdx*2], r13w
jne 0x14000c219
lea r15d, [rax + 1]
xor ecx, ecx
inc r15
add r15, rdx
lea rdx, [r15 + r15]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
mov ecx, 0x725
test rax, rax
jne 0x14000c253
mov eax, 0x8007000e
jmp 0x14000c1f9
mov word [rbp - 0x3c], cx
mov edx, r14d
mov rcx, rbx
mov dword [rbp - 0x40], r13d
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jne 0x14000c289
call fcn.14000c0f8
mov dword [rbp - 0x40], eax
mov eax, 0x728
mov word [rbp - 0x3a], ax
jmp 0x14000c340
mov eax, 0x728
mov word [rbp - 0x3c], ax
mov eax, 0x729
cmp ecx, r14d
jb 0x14000c2a5
mov dword [rbp - 0x40], 0x8007006f
jmp 0x14000c280
mov dword [rbp - 0x40], r13d
mov word [rbp - 0x3c], ax
inc rdi
cmp word [rbx + rdi*2], r13w
jne 0x14000c2ad
mov eax, 0x5c
cmp ax, word [rbx + rdi*2 - 2]
je 0x14000c2e5
lea r8, [0x14000f860]
mov rdx, r15
mov rcx, rbx
call fcn.14000c398
mov dword [rbp - 0x40], eax
test eax, eax
mov eax, 0x72d
js 0x14000c280
mov word [rbp - 0x3c], ax
mov r8, r12
mov rdx, r15
mov rcx, rbx
call fcn.14000c398
mov dword [rbp - 0x40], eax
test eax, eax
mov eax, 0x730
js 0x14000c280
xor edx, edx
mov word [rbp - 0x3c], ax
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x14000c333
call fcn.14000c0f8
mov ecx, 0x733
mov dword [rbp - 0x40], eax
mov word [rbp - 0x3a], cx
jmp 0x14000c340
mov ecx, 0x733
mov dword [rbp - 0x40], r13d
mov word [rbp - 0x3c], cx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test rsi, rsi
jne 0x14000c365
mov eax, dword [rbp - 0x40]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
lea rcx, [rbp - 0x40]
call fcn.14000ac34
lea r11, [rsp + 0x60]
mov rax, rsi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14000c470
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r14d, r9d
mov rdi, r8
mov r9d, 2
mov rsi, rdx
mov r15, rcx
lea rdx, str.SxRegReadDWORD
lea rcx, [rbp - 0x38]
lea r8d, [r9 + 0x1f]
call fcn.14000ab2c
xor ebx, ebx
mov dword [rbp - 0x40], ebx
mov dword [rbp + 0x40], ebx
mov dword [rbp + 0x38], ebx
test rdi, rdi
je 0x14000c4bb
mov dword [rdi], ebx
mov eax, 0x2a
test rsi, rsi
jne 0x14000c4d3
mov ebx, 0x80070057
mov word [rbp - 0x32], ax
jmp 0x14000c595
mov word [rbp - 0x34], ax
mov eax, 0x2b
test rdi, rdi
je 0x14000c4c5
mov word [rbp - 0x34], ax
lea r9, [rbp + 0x40]
lea rax, [rbp + 0x38]
mov dword [rbp - 0x38], ebx
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x40]
mov dword [rbp + 0x38], 4
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ecx, eax
test r14d, r14d
je 0x14000c52e
cmp eax, 2
jne 0x14000c52e
lea ebx, [rax - 1]
lea eax, [rcx + 0x2f]
jmp 0x14000c591
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov ecx, 0x34
mov dword [rbp - 0x38], eax
test eax, eax
jns 0x14000c555
lea ebx, [rcx - 0x33]
mov word [rbp - 0x32], cx
mov dword [rbp - 0x30], ebx
mov ebx, eax
jmp 0x14000c598
cmp dword [rbp + 0x40], 4
mov eax, 0x36
mov word [rbp - 0x34], cx
je 0x14000c56e
mov ebx, 0x8007065d
jmp 0x14000c4ca
cmp dword [rbp + 0x38], 4
mov word [rbp - 0x34], ax
je 0x14000c587
mov ebx, 0x80004005
mov eax, 0x37
jmp 0x14000c4ca
mov ecx, dword [rbp - 0x40]
mov eax, 0x3b
mov dword [rdi], ecx
mov word [rbp - 0x34], ax
mov dword [rbp - 0x38], ebx
lea rcx, [rbp - 0x38]
call fcn.14000ac34
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c5c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x70
mov rdi, r8
lea rdx, str.SxRegReadString
mov rsi, rcx
mov r8d, 0x9c
lea rcx, [rbp - 0x40]
mov r9d, 2
call fcn.14000ab2c
and dword [rbp + 0x38], 0
mov eax, 0xa3
mov dword [rbp + 0x40], 1
test rdi, rdi
jne 0x14000c620
mov ebx, 0x80070057
mov dword [rbp - 0x40], ebx
mov word [rbp - 0x3a], ax
jmp 0x14000c7a4
mov word [rbp - 0x3c], ax
mov eax, 0xa4
test rsi, rsi
je 0x14000c60f
and dword [rbp - 0x40], 0
mov edx, 0x20
mov rcx, rdi
mov word [rbp - 0x3c], ax
call fcn.14000d708
mov ebx, eax
mov dword [rbp - 0x40], eax
test eax, eax
mov eax, 0xa9
js 0x14000c617
mov word [rbp - 0x3c], ax
lea rcx, [rbp + 0x38]
mov eax, dword [rdi + 0xc]
lea r9, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
lea rdx, [0x140011d58]
xor r8d, r8d
mov rcx, rsi
lea eax, [rax*2 - 2]
mov dword [rbp + 0x38], eax
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edx, dword [rdi + 0xc]
mov rcx, rdi
mov r10d, eax
call fcn.14000d7cc
test r10d, r10d
je 0x14000c739
mov r13d, 0xbf
lea r12d, [r13 + 7]
cmp r10d, 0xea
jne 0x14000c759
mov edx, dword [rbp + 0x38]
mov rcx, rdi
and dword [rbp - 0x40], 0
add rdx, 3
shr rdx, 1
mov word [rbp - 0x3c], r13w
call fcn.14000d708
mov dword [rbp - 0x40], eax
mov ebx, eax
test eax, eax
js 0x14000c752
mov eax, dword [rdi + 0xc]
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x28], rcx
lea r9, [rbp + 0x40]
xor r8d, r8d
mov word [rbp - 0x3c], r12w
lea rdx, [0x140011d58]
mov rcx, rsi
lea eax, [rax*2 - 2]
mov dword [rbp + 0x38], eax
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edx, dword [rdi + 0xc]
mov rcx, rdi
mov r10d, eax
call fcn.14000d7cc
test r10d, r10d
jne 0x14000c6b1
mov eax, dword [rbp + 0x40]
dec eax
cmp eax, 1
mov eax, 0xc9
jbe 0x14000c77b
mov ebx, 0x8000ffff
jmp 0x14000c614
mov word [rbp - 0x3a], r12w
jmp 0x14000c7a4
movzx ebx, r10w
or ebx, 0x80070000
mov word [rbp - 0x3a], r13w
test r10d, r10d
mov dword [rbp - 0x38], 1
cmovle ebx, r10d
mov dword [rbp - 0x40], ebx
jmp 0x14000c7a4
mov edx, dword [rbp + 0x38]
mov word [rbp - 0x3c], ax
mov al, dl
not al
test al, 1
mov eax, 0xd5
je 0x14000c748
and dword [rbp - 0x40], 0
mov rcx, rdi
shr edx, 1
mov word [rbp - 0x3c], ax
call fcn.14000d7cc
mov ebx, dword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.14000ac34
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c91c
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, rcx
mov dword [rsp + 0x30], 1
lea rcx, [rsp + 0x38]
mov r9d, 2
mov r8d, 0x1ba
lea rdx, str.SxRegWriteDWORD
call fcn.14000ab2c
test rbx, rbx
jne 0x14000c964
mov ebx, 0x80070057
mov eax, 0x1bc
mov dword [rsp + 0x38], ebx
mov word [rsp + 0x3e], ax
jmp 0x14000c9c1
and dword [rsp + 0x38], 0
lea rdx, str.fUpgradeRestored
mov eax, 0x1bd
mov r9d, 4
mov word [rsp + 0x3c], ax
xor r8d, r8d
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], r9d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x1bf
mov dword [rsp + 0x38], ebx
test ebx, ebx
js 0x14000c95d
mov word [rsp + 0x3c], ax
lea rcx, [rsp + 0x38]
call fcn.14000ac34
mov eax, ebx
add rsp, 0x70
pop rbx
ret
Function at 0x14000e178
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 8], edi
je 0x14000e195
mov rax, qword [rcx]
mov dword [rcx + 8], edi
mov word [rax], di
mov r8d, dword [rcx + 0xc]
mov rdx, qword [rcx]
jmp 0x14000e1c8
cmp eax, dword [rbx + 0xc]
jbe 0x14000e215
cmp dword [rbx + 8], edi
je 0x14000e1b1
mov rcx, qword [rbx]
mov dword [rbx + 8], edi
mov word [rcx], di
mov edx, eax
mov rcx, rbx
call fcn.14000d708
mov edx, eax
test eax, eax
js 0x14000e207
mov r8d, dword [rbx + 0xc]
mov rdx, qword [rbx]
lea rcx, str._SystemRoot_Logs
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
jne 0x14000e19e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
cmp dword [rbx + 8], edi
je 0x14000e207
mov rax, qword [rbx]
mov dword [rbx + 8], edi
mov word [rax], di
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
dec eax
mov edx, edi
cmp eax, dword [rbx + 0xc]
jbe 0x14000e225
mov edx, 0x80070057
jmp 0x14000e207
mov dword [rbx + 8], eax
mov ecx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], di
jmp 0x14000e207
Function at 0x14000e3c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140015828], rbx
je 0x14000e40c
cmp rax, rbx
jne 0x14000e3ff
mov ebx, 1
mov esi, ebx
jmp 0x14000e411
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000e3e4
mov ebx, 1
mov eax, dword [0x140015830]
cmp eax, ebx
jne 0x14000e427
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14000e48c
mov eax, dword [0x140015830]
test eax, eax
jne 0x14000e486
mov dword [0x140015830], ebx
lea r15, [0x14000f7a0]
lea rdi, [0x14000f788]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x14000e478
test eax, eax
jne 0x14000e47c
cmp qword [rdi], 0
je 0x14000e46d
mov rax, qword [rdi]
mov rcx, qword [0x14000f760]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000e44e
test eax, eax
je 0x14000e48c
mov eax, 0xff
jmp 0x14000e568
mov dword [0x140015114], ebx
mov eax, dword [0x140015830]
cmp eax, ebx
jne 0x14000e4b3
lea rdx, [0x14000f780]
lea rcx, [0x14000f768]
call sub.msvcrt.dll__initterm
mov dword [0x140015830], 2
test esi, esi
jne 0x14000e4c0
xor eax, eax
xchg qword [0x140015828], rax
cmp qword [0x140015848], 0
je 0x14000e4f4
lea rcx, [0x140015848]
call fcn.14000e840
test eax, eax
je 0x14000e4f4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140015848]
mov r9, qword [0x14000f760]
call r9
mov r8, qword [0x140015128]
mov rdx, qword [0x140015120]
mov ecx, dword [0x140015118]
call fcn.140004408
mov dword [0x140015110], eax
cmp dword [0x140015130], 0
jne 0x14000e524
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140015114], 0
jne 0x14000e539
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140015110]
jmp 0x14000e568
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400c3000
add rsp, 0x28
jmp 0x14000e3c0

Function at 0x14000e72c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000e778
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000e770
cmp dword [rcx + 0x3c], edx
jl 0x14000e770
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000e770
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000e778
mov rax, rdx
add rsp, 0x18
ret