joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ca7c
Capabilities:
Open clipboard
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov esi, r9d
mov edi, ecx
cmp ecx, 0x80000003
jne 0x14000cad4
xor eax, eax
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140021640
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x802
call fcn.140022250
mov rbx, qword [0x140059d30]
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.140005f0c
mov r9, qword [rsp + 0x40]
lea rax, str.baselogging.cc
mov dword [rsp + 0x38], esi
lea rdx, str.Exception__x_in__s__s__u_r_n_r_n_hs:_d_r_n
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
and dword [rsp + 0x28], 0
mov r8d, edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000cb4c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14000cb71
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.14000d7c0
mov r9d, 0x250012
lea r8, str.Exception
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
sub eax, 3
je 0x14000cba0
cmp eax, 1
jne 0x14000cb96
int3
mov eax, 1
jmp 0x14000caaf
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14000d7c0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rsi, rcx
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [rbx + 1]
mov ecx, 0x2002
movsxd rdi, eax
add rdi, rdi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14000d810
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.140022410
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
jne 0x14000d835
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_CloseClipboard]
Function at 0x140011e6c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
xorps xmm0, xmm0
mov rdi, rcx
lea rcx, [rbp + 7]
mov r15, rdx
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
and qword [rdi + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xor edx, edx
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
jmp 0x140011fad
cmp dword [rbp - 0x39], 0x1000
jne 0x140011fa2
mov rsi, qword [rdi + 0x18]
movups xmm0, xmmword [rbp - 0x59]
mov rbx, rsi
mov rcx, rsi
movups xmm1, xmmword [rbp - 0x49]
movups xmm2, xmmword [rbp - 0x39]
movq rdx, xmm0
mov qword [rbp + 0x67], rdx
mov rax, qword [rsi + 8]
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm1
movups xmmword [rbp - 9], xmm2
jmp 0x140011f0e
cmp qword [rax + 0x20], rdx
jae 0x140011f08
mov rax, qword [rax + 0x10]
jmp 0x140011f0e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140011efc
cmp rbx, rcx
je 0x140011f1f
cmp rdx, qword [rbx + 0x20]
jae 0x140011f7b
mov ecx, 0x58
call fcn.140039824
mov rcx, qword [rbp + 0x67]
lea rdx, [rbp + 0x77]
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
mov r8, rbx
lea r9, [rax + 0x20]
mov qword [r9], rcx
lea rcx, [rdi + 0x18]
movups xmmword [r9 + 8], xmm0
movups xmmword [r9 + 0x18], xmm0
movups xmmword [r9 + 0x28], xmm0
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
and word [rax + 0x18], 0
call fcn.140013060
movups xmm0, xmmword [rbp - 0x29]
mov rbx, qword [rbp + 0x77]
movups xmm1, xmmword [rbp - 0x19]
movups xmm2, xmmword [rbp - 9]
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0x38], xmm1
movups xmmword [rbx + 0x48], xmm2
test byte [rbp - 0x35], 0x70
je 0x140011fa2
mov r8, qword [rbp - 0x41]
xor edx, edx
mov ecx, dword [rbp + 0xb]
mov rax, r8
div rcx
add qword [rdi + 0x10], rax
jmp 0x140011fa6
mov r8, qword [rbp - 0x41]
mov rdx, qword [rbp - 0x59]
add rdx, r8
mov r9d, 0x30
lea r8, [rbp - 0x59]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
je 0x140011ebe
mov rbx, qword [rsp + 0xf8]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018ed4
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov byte [rbp - 0x40], 0
mov rdi, rcx
lea rdx, [rbp - 0x40]
lea rcx, [0x140019004]
mov rsi, r8
call qword [sym.imp.USER32.dll_EnumWindows]
call fcn.14000144c
mov rcx, rax
test rax, rax
je 0x140018ff7
mov rax, qword [rax]
call qword [rax + 0x18]
mov r9, rsi
lea rdx, str._s_s.dmp
add rax, 0x18
lea rcx, [rbp - 0x38]
mov r8, rbx
mov qword [rbp - 0x38], rax
call fcn.14000be78
lea rcx, [rbp - 0x38]
call fcn.14000c63c
mov dl, byte [rdi]
lea r8, [rbp - 0x38]
mov cl, byte [rbp - 0x40]
xor r9d, r9d
call fcn.140019a18
cmp byte [rdi + 1], 0
je 0x140018fbd
mov r9, rsi
lea rdx, str._s_s_full.dmp
mov r8, rbx
lea rcx, [rbp - 0x38]
call fcn.14000be78
lea rcx, [rbp - 0x38]
call fcn.14000c63c
mov rbx, qword [rbp - 0x38]
lea r8, [rbp - 0x30]
xorps xmm0, xmm0
xor eax, eax
mov rcx, rbx
mov dword [rbp - 0x10], eax
xor edx, edx
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x140018fc1
mov dl, byte [rdi]
lea r8, [rbp - 0x38]
mov cl, byte [rbp - 0x40]
xor r9d, r9d
call fcn.140019a18
jmp 0x140018fc1
mov rbx, qword [rbp - 0x38]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140018fdb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140021640
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400017a4
int3
Function at 0x14001bfc4
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x200
call fcn.140022250
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], pe_nt_image_headers64
lea rdx, [rsp + 0x30]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
xor ebx, ebx
test eax, eax
je 0x14001c02a
lea rcx, [rsp + 0x30]
call fcn.140006a00
test al, al
je 0x14001c02a
mov al, 1
jmp 0x14001c070
lea r8, [rsp + 0x28]
mov qword [rsp + 0x28], rbx
mov edx, 0x64
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_NetWkstaGetInfo]
mov rdi, qword [rsp + 0x28]
test eax, eax
jne 0x14001c065
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14001c065
lea rdx, str.google
call fcn.14003525c
test eax, eax
jne 0x14001c065
mov bl, 1
mov rcx, rdi
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov al, bl
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140021640
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x14001dad0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x30], 0
mov r14b, cl
xorps xmm0, xmm0
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x28], xmm0
call fcn.14001d410
test eax, eax
js 0x14001dc70
mov rax, qword [rbp - 0x28]
cmp qword [rbp - 0x30], rax
je 0x14001dc70
call fcn.14001b050
lea rax, str.HKCUSoftwareGoogleUpdate_
test r14b, r14b
lea rdx, str.HKLMSoftwareGoogleUpdate_
cmove rdx, rax
lea rcx, [rbp + 0x38]
call fcn.1400052a0
lea rdx, [0x140051ae0]
lea rcx, [rbp + 0x40]
call fcn.1400052a0
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x48]
call fcn.140004acc
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.1400017c8
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001db80
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001db9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp + 0x38]
mov rcx, rbx
call fcn.14000b3bc
test al, al
jne 0x14001dbbf
mov dl, 1
mov cl, r14b
call fcn.14001dc94
mov edi, eax
jmp 0x14001dc50
and qword [rbp - 0x10], 0
lea rax, [0x14004e350]
mov r8d, 1
mov qword [rbp - 0x18], rax
mov rdx, rbx
mov dword [rbp - 8], 0x200
lea rcx, [rbp - 0x18]
call fcn.14000ac18
mov edi, eax
test eax, eax
js 0x14001dc3c
mov rdi, qword [rbp - 0x28]
xor esi, esi
mov r15, qword [rbp - 0x30]
sub rdi, r15
sar rdi, 3
test rdi, rdi
je 0x14001dc30
and qword [rsp + 0x28], 0
xor r9d, r9d
mov rdx, qword [r15 + rsi*8]
xor r8d, r8d
mov rcx, qword [rbp - 0x10]
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14001dc6c
inc rsi
cmp rsi, rdi
jb 0x14001dc04
xor edx, edx
mov cl, r14b
call fcn.14001dc94
mov edi, eax
lea rax, [0x14004e350]
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x18], rax
call fcn.14000a9cc
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001dc75
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14001dc75
xor edi, edi
jmp 0x14001dc3c
mov edi, 1
lea rcx, [rbp - 0x30]
call fcn.1400063d4
mov rbx, qword [rsp + 0x90]
mov eax, edi
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001dc94
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x20], 0
lea rax, [0x14004f2f0]
mov sil, dl
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x28]
mov dil, cl
call fcn.14001d7b0
mov rax, qword [rbp - 0x28]
lea rcx, [rbp - 0x28]
call qword [rax + 8]
and qword [rbp - 0x10], 0
lea r12, [0x14004e350]
mov qword [rbp - 0x18], r12
mov dword [rbp - 8], 0x200
call fcn.14001b050
lea rax, str.HKCUSoftwareGoogleUpdate_
test dil, dil
lea rdx, str.HKLMSoftwareGoogleUpdate_
mov r8d, 0xf003f
cmove rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000ac18
mov rcx, qword [rbp - 0x10]
lea rdx, str.old_uid
and qword [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, [0x140051ae0]
test eax, eax
jne 0x14001dd49
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x14001de51
and qword [rbp + 0x48], 0
lea rax, [rbp + 0x48]
and dword [rbp + 0x30], 0
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x18]
call fcn.14000ae9c
test eax, eax
jns 0x14001dd7b
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14001ddbf
jmp 0x14001ddba
mov eax, dword [rbp + 0x30]
lea rdx, str.old_uid
mov rbx, qword [rbp - 0x30]
lea rcx, [rbp - 0x18]
mov r9, qword [rbp + 0x48]
mov r8, rbx
mov dword [rsp + 0x20], eax
call fcn.14000b374
test eax, eax
js 0x14001ddb2
mov rcx, qword [rbp - 0x10]
lea rdx, [0x140051ae0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test rbx, rbx
je 0x14001ddbf
mov rcx, rbx
call fcn.1400218ec
test sil, sil
je 0x14001de51
call fcn.14000144c
mov rcx, rax
test rax, rax
je 0x14001de89
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea r8, [rbp + 0x40]
lea rdx, str.old_uid
mov qword [rbp + 0x40], rax
lea rcx, [rbp - 0x18]
call fcn.14000b088
lea rcx, str.__legacy
call fcn.140031e04
mov r8d, eax
lea rdx, str.__legacy
lea rcx, [rbp + 0x40]
call fcn.1400054bc
mov rbx, qword [rbp + 0x40]
lea rdx, str.old_uid
mov r8, rbx
lea rcx, [rbp - 0x18]
mov r9d, 1
call fcn.14000b304
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001de51
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov cl, dil
call fcn.14001de94
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x18], r12
mov ebx, eax
call fcn.14000a9cc
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x28]
call qword [rdx + 0x10]
lea rcx, [rbp - 0x28]
call fcn.14000a844
mov eax, ebx
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400017a4
int3
Function at 0x14001e154
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov bl, cl
test cl, cl
je 0x14001e179
call fcn.14000c29c
test al, al
je 0x14001e24b
and qword [rbp - 0x28], 0
lea rax, [0x14004f2f0]
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x30], rax
mov cl, bl
call fcn.14001d7b0
mov rax, qword [rbp - 0x30]
lea rcx, [rbp - 0x30]
call qword [rax + 8]
and qword [rbp - 0x18], 0
lea rsi, [0x14004e350]
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x10], 0x200
call fcn.14001b050
lea rax, str.HKCUSoftwareGoogleUpdate_
test bl, bl
lea rdx, str.HKLMSoftwareGoogleUpdate_
mov r8d, 0xf003f
cmove rdx, rax
lea rcx, [rbp - 0x20]
call fcn.14000ac18
test eax, eax
js 0x14001e22a
mov rcx, qword [rbp - 0x18]
lea rbx, [0x140051ae0]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp - 0x18]
lea rdx, str.old_uid
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8, rbx
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x20]
call fcn.14000b7cc
cmp byte [rbp + 0x1c], 0
jne 0x14001e22a
mov rcx, qword [rbp - 0x18]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x20], rsi
call fcn.14000a9cc
mov rax, qword [rbp - 0x30]
lea rcx, [rbp - 0x30]
call qword [rax + 0x10]
lea rcx, [rbp - 0x30]
call fcn.14000a844
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x14001e36c
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
test dl, dl
je 0x14001e387
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x14001e38d
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 0x409
lea r10, [0x14004d0c0]
movzx edx, ax
mov r8, rdi
mov eax, ecx
cmp dx, ax
je 0x14001e3ba
inc r8
imul rax, r8, 0x1a
movzx eax, word [rax + r10]
test ax, ax
jne 0x14001e3a1
movzx edx, cx
mov r9, rdi
mov r8d, edi
cmp cx, dx
je 0x14001e3e2
inc r9
inc r8d
imul rax, r9, 0x1a
movzx ecx, word [rax + r10]
test cx, cx
jne 0x14001e3c0
lea rdx, [0x14004b578]
jmp 0x14001e3f3
movsxd rax, r8d
imul rdx, rax, 0x1a
lea rax, [0x14004d0c2]
add rdx, rax
mov rcx, rbx
call fcn.1400052a0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001fb30
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov rsi, rdx
lea rcx, [0x140057eb8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r14, qword [rsi + 0x28]
lea rcx, [0x140057eb8]
and qword [rsi + 0x28], 0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r14, r14
je 0x14001fc39
lea rdi, [rbx + 0x38]
cmp qword [rdi], 0
jne 0x14001fb95
mov rdx, qword [rbx + 0x20]
lea r8, str.Counts
mov rcx, rdi
call fcn.14001f8b8
test eax, eax
jne 0x14001fc39
mov rdx, qword [rsi + 8]
lea rcx, [rbp - 0x10]
call fcn.14000709c
mov rbx, qword [rbp - 0x10]
lea rax, [rbp + 0x38]
mov rcx, qword [rdi]
lea r9, [rbp + 0x40]
and qword [rbp + 0x48], 0
mov esi, 8
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp + 0x48]
mov dword [rbp + 0x38], esi
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001fbeb
cmp dword [rbp + 0x40], 3
jne 0x14001fbeb
test eax, eax
jne 0x14001fbeb
cmp dword [rbp + 0x38], esi
je 0x14001fbf9
mov r8, rsi
lea rcx, [rbp + 0x48]
xor edx, edx
call fcn.140022250
mov rcx, qword [rdi]
lea rax, [rbp + 0x48]
add qword [rbp + 0x48], r14
mov r9d, 3
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001fc39
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14001fde0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
lea rcx, [0x140057eb8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [rsi + 0x28]
lea rcx, [0x140057eb8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x14001fe92
lea rbx, [rdi + 0x68]
cmp qword [rbx], 0
jne 0x14001fe3e
mov rdx, qword [rdi + 0x20]
lea r8, str.Integers
mov rcx, rbx
call fcn.14001f8b8
test eax, eax
jne 0x14001fe92
mov rdx, qword [rsi + 8]
lea rcx, [rsp + 0x60]
call fcn.14000709c
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rcx
mov r9d, 3
mov rcx, qword [rbx]
xor r8d, r8d
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001fe92
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14001fea4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
lea rcx, [0x140057eb8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [rsi + 0x28]
lea rcx, [0x140057eb8]
or dword [rsi + 0x28], 0xffffffff
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x58], ebx
cmp ebx, 0xffffffff
je 0x14001ff5b
lea rbx, [rdi + 0x80]
cmp qword [rbx], 0
jne 0x14001ff07
mov rdx, qword [rdi + 0x20]
lea r8, str.Booleans
mov rcx, rbx
call fcn.14001f8b8
test eax, eax
jne 0x14001ff5b
mov rdx, qword [rsi + 8]
lea rcx, [rsp + 0x60]
call fcn.14000709c
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rcx
mov r9d, 3
mov rcx, qword [rbx]
xor r8d, r8d
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001ff5b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400212b8
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x38]
sub rsp, 0x130
mov ebx, dword [rcx + 0x38]
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movups xmm0, xmmword [rdi + 0x28]
mov dword [rbp - 0x6c], eax
lea r9, [rsp + 0x40]
lea rax, [rdi + 0x5c]
mov dword [rbp - 0x68], ebx
xor ebx, ebx
mov qword [rbp - 0x60], rax
lea rax, [rdi + 0x60]
mov qword [rsp + 0x30], rbx
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x70]
lea rax, [rdi + 0x68]
mov dword [rbp - 0x70], 1
mov qword [rbp - 0x50], rax
lea r8d, [rbx + 0x50]
lea rax, [rbp + 0x40]
mov qword [rbp - 0x38], rbx
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rsp + 0x28], rax
mov rcx, rsi
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x50
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x68], xmm1
mov qword [rsp + 0x78], rbx
movdqa xmmword [rbp - 0x80], xmm0
mov dword [rbp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x14002140a
cmp dword [rsp + 0x40], 2
jne 0x14002140a
cmp dword [rsp + 0x44], ebx
je 0x14002140a
cmp qword [rsp + 0x78], rbx
je 0x14002140a
cmp qword [rbp - 0x80], rbx
je 0x14002140a
cmp qword [rbp - 0x78], rbx
je 0x14002140a
xorps xmm0, xmm0
mov qword [rbp - 0x1c], rbx
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x10], xmm0
xor eax, eax
movaps xmmword [rbp], xmm1
lea r9, [rbp + 0x40]
mov qword [rbp + 0x10], rax
lea r8d, [rbx + 0x50]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [rbp - 0x20]
mov qword [rbp + 0x18], rbx
mov rcx, rsi
mov dword [rbp - 0x20], 3
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002140a
mov rcx, qword [rsp + 0x78]
mov al, 1
mov qword [rdi + 0x40], rcx
mov rcx, qword [rbp - 0x80]
mov qword [rdi + 0x48], rcx
mov rcx, qword [rbp - 0x78]
mov qword [rdi + 0x50], rcx
mov ecx, dword [rsp + 0x44]
mov dword [rdi + 0x58], ecx
jmp 0x14002140c
xor al, al
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140025b3c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002599b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002599b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002599b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002599b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002599b
cmp dword [rcx + 0x84], 0xe
jbe 0x14002599b
cmp dword [rcx + 0xf8], 0
je 0x14002599b
mov ecx, ebx
call fcn.140025a58
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140025828
nop
cmp dword [rbp + 0x20], 0
je 0x1400259e9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400259f4
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002592c
Function at 0x1400302e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140030367
mov rsi, rbx
cmp word [rax], bp
je 0x140030326
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140030310
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14003030c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140031c54
mov rdi, rax
test rax, rax
je 0x140030354
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140022410
mov rbp, rdi
xor ecx, ecx
call fcn.14002e6a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret