joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bdb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rbx, rcx
lea r8, str.ToggleDockState
lea r14, str.TOSTABSYSSVC.cpp
lea r15, str.__ToggleDockState_
lea r12, [0x14002b804]
lea rcx, [rbp + 7]
lea rdx, str.ENTER__s
mov qword [rbp - 1], r8
mov qword [rbp + 7], r14
mov qword [rbp + 0x17], r15
mov qword [rbp + 0x1f], r12
mov dword [rbp + 0xf], 0x6fb
mov dword [rbp + 0x27], 3
call fcn.1400012a0
mov rax, qword [rbx]
cmp rax, qword [0x14002e048]
jne 0x14000be38
mov rax, qword [rbx + 8]
cmp rax, qword [0x14002e050]
jne 0x14000be38
mov rcx, qword [0x140039138]
jmp 0x14000be60
mov rax, qword [rbx]
cmp rax, qword [0x14002e058]
jne 0x14000bf38
mov rax, qword [rbx + 8]
cmp rax, qword [0x14002e060]
jne 0x14000bf38
mov rcx, qword [0x140039140]
test rcx, rcx
je 0x14000bf38
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov edx, 0x40000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
mov qword [rsp + 0xd0], rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000bece
mov edi, 0x80004005
lea rdx, str.Error_Code:_0x_x
lea rcx, [rbp - 0x29]
mov r8d, edi
mov qword [rbp - 0x29], r14
mov dword [rbp - 0x21], 0x713
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r12
mov dword [rbp - 9], ebx
call fcn.1400012a0
jmp 0x14000bf25
xor r9d, r9d
lea rdx, [rbp + 0x6f]
mov rcx, rax
lea r8d, [r9 + 1]
mov byte [rbp + 0x6f], bl
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000bf1e
mov edi, 0x80004005
lea rdx, str.Error_Code:_0x_x
lea rcx, [rbp - 0x29]
mov r8d, edi
mov qword [rbp - 0x29], r14
mov dword [rbp - 0x21], 0x716
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r12
mov dword [rbp - 9], ebx
call fcn.1400012a0
jmp 0x14000bf20
mov edi, ebx
test rsi, rsi
je 0x14000bf2e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0xd0]
jmp 0x14000bf6b
xor ebx, ebx
lea rdx, str.Error_Code:_0x_x
lea rcx, [rbp - 0x29]
mov r8d, 0x80004005
mov qword [rbp - 0x29], r14
mov dword [rbp - 0x21], 0x70a
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r12
mov dword [rbp - 9], ebx
call fcn.1400012a0
mov edi, 0x80004005
mov r8, qword [rbp - 1]
lea rdx, str.LEAVE__s
lea rcx, [rbp + 7]
call fcn.1400012a0
mov rbx, qword [rsp + 0xe0]
mov eax, edi
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14000c150
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rbx, rdx
lea r8, str.TSSRegRead_DWORD
lea rsi, str.TOSTABSYSSVC.cpp
lea r14, str.__TSSRegRead_DWORD_
lea r15, [0x14002b804]
lea rdx, str.ENTER__s
lea rcx, [rbp + 0xf]
mov qword [rbp + 7], r8
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], r15
mov dword [rbp + 0x17], 0x77f
mov dword [rbp + 0x2f], 3
call fcn.1400012a0
xor edi, edi
lea rax, [rbp - 0x29]
lea rdx, str.SOFTWAREDynabookDynabook_System_DriverDynabook_Tablet_System_Service
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rbp - 0x29], rdi
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x7f], edi
mov dword [rbp + 0x67], edi
mov dword [rbp + 0x77], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000c226
lea rdx, str.Error_Code:_0x_x
lea rcx, [rbp - 0x21]
or r8d, 0xffffffff
mov qword [rbp - 0x21], rsi
mov dword [rbp - 0x19], 0x78d
mov qword [rbp - 0x11], r14
mov qword [rbp - 9], r15
mov dword [rbp - 1], edi
call fcn.1400012a0
or ebx, 0xffffffff
jmp 0x14000c291
mov rcx, qword [rbp - 0x29]
lea rax, [rbp + 0x77]
lea r9, [rbp + 0x7f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000c27f
lea rdx, str.Error_Code:_0x_x
lea rcx, [rbp - 0x21]
or r8d, 0xffffffff
or ebx, 0xffffffff
mov qword [rbp - 0x21], rsi
mov dword [rbp - 0x19], 0x794
mov qword [rbp - 0x11], r14
mov qword [rbp - 9], r15
mov dword [rbp - 1], edi
call fcn.1400012a0
jmp 0x14000c282
mov ebx, dword [rbp + 0x67]
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14000c291
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, qword [rbp + 7]
lea rdx, str.LEAVE__s
lea rcx, [rbp + 0xf]
call fcn.1400012a0
mov eax, ebx
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c2c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x60
lea rax, [rsp + 0x88]
lea rdx, str.SOFTWAREDynabookDynabook_System_DriverDynabook_Tablet_System_Service
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000c34f
lea rax, str.TOSTABSYSSVC.cpp
or ebx, 0xffffffff
lea rdx, str.Error_Code:_0x_x
mov qword [rsp + 0x30], rax
lea rax, str.__TSSRegRead_WorkAround_
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rax, [0x14002b804]
mov r8d, ebx
mov dword [rsp + 0x38], 0x7af
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], rax
call fcn.1400012a0
mov eax, ebx
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
lea rdx, str.NoWorkaround
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000c3d4
lea rax, str.TOSTABSYSSVC.cpp
or ebx, 0xffffffff
lea rdx, str.Error_Code:_0x_x
mov qword [rsp + 0x30], rax
lea rax, str.__TSSRegRead_WorkAround_
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rax, [0x14002b804]
mov r8d, ebx
mov dword [rsp + 0x38], 0x7b6
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], rax
call fcn.1400012a0
jmp 0x14000c3d8
mov ebx, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14000c3eb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x60
pop rbx
ret
Function at 0x14000d5a0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400363c8]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov dword [rbp - 0x59], edx
lea r8, str.SetServiceStateToReg
mov qword [rbp - 0x21], r8
lea rsi, str.TOSTABSYSSVC.cpp
mov qword [rbp - 0x19], rsi
mov dword [rbp - 0x11], 0x95f
lea r14, str.__SetServiceStateToReg_
mov qword [rbp - 9], r14
lea r15, [0x14002b804]
mov qword [rbp - 1], r15
mov dword [rbp + 7], 3
lea rdx, str.ENTER__s
lea rcx, [rbp - 0x19]
call fcn.1400012a0
nop
xor edi, edi
mov qword [rbp - 0x51], rdi
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], rdi
mov word [rbp + 0x17], di
lea r8d, [rdi + 0x22]
lea rcx, [rbp + 0x17]
call fcn.140001d80
nop
lea r8d, [rdi + 0x17]
lea rcx, [rbp + 0x17]
call fcn.14000dc70
mov qword [rbp - 0x49], rsi
mov dword [rbp - 0x41], 0x964
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r15
mov dword [rbp - 0x29], 3
mov r9d, dword [rbp - 0x59]
lea r8, str.dwServiceState
lea rdx, str._s___X
lea rcx, [rbp - 0x49]
call fcn.1400012a0
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rdx, qword [rbp + 0x17]
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9d, 0x2011f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete al
test al, al
jne 0x14000d6ef
mov dword [rbp - 0x41], 0x966
mov qword [rbp - 0x49], rsi
mov ebx, 0x80004005
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r15
mov dword [rbp - 0x29], edi
mov r8d, ebx
lea rdx, str.Error_Code:_0x_x
lea rcx, [rbp - 0x49]
call fcn.1400012a0
jmp 0x14000d72e
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ServiceState
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
test al, al
jne 0x14000d72c
mov dword [rbp - 0x41], 0x967
jmp 0x14000d6c6
mov ebx, edi
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x14000d741
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], rdi
cmp qword [rbp + 0x2f], 8
jb 0x14000d751
mov rcx, qword [rbp + 0x17]
call fcn.140010f80
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], rdi
mov word [rbp + 0x17], di
mov r8, qword [rbp - 0x21]
lea rdx, str.LEAVE__s
lea rcx, [rbp - 0x19]
call fcn.1400012a0
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140010f60
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140011b3c
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140011b54
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140011b56
xor eax, eax
test eax, eax
je 0x140011b66
mov ecx, eax
call fcn.1400149fc
or eax, 0xffffffff
jmp 0x140011b68
xor eax, eax
add rsp, 0x28
ret

Function at 0x140018418
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140018280
Function at 0x140004e00
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rcx, qword [rsp + 0x90]
call fcn.140113dd0
test eax, eax
je 0x140004e78
mov rax, qword [rsp + 0x90]
cmp qword [rax - 0x10], 0
jbe 0x140004e56
mov rax, qword [rsp + 0x90]
mov rax, qword [rax - 0x18]
mov rcx, qword [rsp + 0x90]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x140004e5f
mov qword [rsp + 0x40], 0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x48], rax
jmp 0x140004e81
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov edx, 0xfffc
mov rcx, qword [rsp + 0x90]
call fcn.140001160
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x50], 0
je 0x140004f44
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x50], 0
je 0x140004f44
mov r9d, 1
lea r8, [0x14032d734]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x90]
call fcn.140123990
inc eax
mov dword [rsp + 0x38], eax
lea rdx, [0x1403becc0]
mov ecx, 0x8000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
lea rcx, [0x1403becc0]
call fcn.140112bc0
mov qword [rsp + 0x70], rax
movsxd rax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x90]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x70]
lea r8, [0x14032e324]
mov edx, 0x10000
lea rcx, [0x1403becc0]
call fcn.140001420
jmp 0x140004f64
mov r9, qword [rsp + 0x90]
lea r8, [0x14032d724]
mov edx, 0x10000
lea rcx, [0x1403becc0]
call fcn.140001420
mov edx, 0x10000
lea rcx, [0x1403becc0]
call fcn.140001160
mov qword [rsp + 0x58], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x98]
movsx eax, byte [rcx + rax]
cmp eax, 0x2e
jne 0x140004ff1
mov r9d, 1
lea r8, [0x14032d714]
mov rdx, qword [rsp + 0x58]
lea rcx, [0x1403becc0]
call fcn.140123990
mov dword [rsp + 0x30], eax
movsxd rax, dword [rsp + 0x30]
mov ecx, 0x10000
sub rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x30]
lea rdx, [0x1403becc0]
add rdx, rcx
mov rcx, rdx
mov r9, qword [rsp + 0x98]
lea r8, [0x14032d704]
mov rdx, rax
call fcn.140001420
jmp 0x14000504e
mov r9d, 1
lea r8, [0x14032d6f4]
mov rdx, qword [rsp + 0x58]
lea rcx, [0x1403becc0]
call fcn.140123990
inc eax
mov dword [rsp + 0x34], eax
movsxd rax, dword [rsp + 0x34]
mov ecx, 0x10000
sub rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x34]
lea rdx, [0x1403becc0]
add rdx, rcx
mov rcx, rdx
mov r9, qword [rsp + 0x98]
lea r8, [0x14032d6e4]
mov rdx, rax
call fcn.140001420
cmp dword [rsp + 0xa0], 0
je 0x1400050bf
mov edx, 0x10000
lea rcx, [0x1403becc0]
call fcn.140001160
mov qword [rsp + 0x28], 2
lea rcx, [0x14032d6d4]
mov qword [rsp + 0x20], rcx
mov r9d, 1
lea r8, [0x14032d6c4]
mov rdx, rax
lea rcx, [0x1403becc0]
call fcn.1401239d0
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x60]
mov edx, 0x10000
lea rcx, [0x1403becc0]
call fcn.140279ac0
mov rcx, qword [rsp + 0x60]
call fcn.14027a7c0
lea rax, [0x1403becc0]
add rsp, 0x88
ret
Function at 0x14000ca30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
cmp qword [rsp + 0x68], 0
je 0x14000ca64
mov rax, qword [rsp + 0x68]
mov qword [rax], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x38]
call fcn.140112d50
lea r8, [0x14032d814]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140278e20
cmp qword [rsp + 0x28], 0
jne 0x14000ca9e
jmp 0x14000ccaf
mov r8d, 2
mov edx, 0xfffffff0
mov rcx, qword [rsp + 0x28]
call fcn.1402796f0
mov r9, qword [rsp + 0x28]
mov r8d, reloc.WS2_32.dll_recv
mov edx, 1
lea rcx, [0x1403bdcc0]
call fcn.14027bacc
mov rcx, rax
call fcn.1400014e0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [0x140326d90]
lea rcx, [0x1403bdcc0]
call fcn.140270070
test eax, eax
jne 0x14000cca5
mov r8d, 1
mov edx, 0xffffffec
mov rcx, qword [rsp + 0x28]
call fcn.1402796f0
mov r9, qword [rsp + 0x28]
mov r8d, 4
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.14027bacc
cmp rax, 4
jne 0x14000cca5
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rsp + 0x20], eax
mov eax, 0xfffffffc
sub eax, dword [rsp + 0x20]
mov r8d, 1
mov edx, eax
mov rcx, qword [rsp + 0x28]
call fcn.1402796f0
movsxd rax, dword [rsp + 0x20]
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x14000cbac
movsxd rax, dword [rsp + 0x20]
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x14000cbac
movsxd rax, dword [rsp + 0x20]
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x14000cbac
xor eax, eax
cmp eax, 1
je 0x14000cbac
movsxd rax, dword [rsp + 0x20]
add rax, 0x18
mov rcx, rax
call fcn.14027bb94
mov qword [rsp + 0x40], rax
jmp 0x14000cbb5
mov qword [rsp + 0x40], 0
movsxd rax, dword [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call fcn.140113960
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x68], 0
je 0x14000cbe7
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
movsxd rax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x28]
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x30]
call fcn.14027bacc
movsxd rcx, dword [rsp + 0x20]
cmp rax, rcx
jne 0x14000cca5
cmp qword [rsp + 0x68], 0
jne 0x14000cca5
mov qword [rsp + 0x38], 0
xor r8d, r8d
lea rdx, [0x14032e78c]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x38]
call fcn.140004e00
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rax
call fcn.140112d50
lea r8, [0x14032d7f4]
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140278e20
cmp qword [rsp + 0x38], 0
je 0x14000cc9b
movsxd rax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x38]
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x30]
call fcn.14027a558
mov rcx, rax
call fcn.1400014e0
mov rcx, qword [rsp + 0x38]
call fcn.1402793a8
mov rcx, qword [rsp + 0x30]
call fcn.140113b40
mov rcx, qword [rsp + 0x28]
call fcn.1402793a8
add rsp, 0x58
ret
Function at 0x140014cc0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [0x1403b8be0], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140014b80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1403b8c00], rax
add rsp, 0x38
ret
Function at 0x140015130
Capabilities:
Log keystrokes

Disassembly:
mov dword [rsp + 0x10], edx
mov byte [rsp + 8], cl
sub rsp, 0x58
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015154
jmp 0x1400151e7
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [rsp + 0x28], 1
movzx eax, byte [rsp + 0x60]
mov word [rsp + 0x30], ax
mov dword [rsp + 0x34], 0
cmp dword [rsp + 0x68], 1
jne 0x14001518a
mov dword [rsp + 0x34], 2
jmp 0x1400151aa
cmp dword [rsp + 0x68], 3
jne 0x14001519b
mov dword [rsp + 0x34], 3
jmp 0x1400151aa
cmp dword [rsp + 0x68], 4
jne 0x1400151aa
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x38], 0
movzx eax, byte [rsp + 0x60]
xor edx, edx
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [rsp + 0x32], ax
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov qword [rsp + 0x40], rax
mov r8d, 0x28
lea rdx, [rsp + 0x28]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
add rsp, 0x58
ret

Function at 0x1400158a0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
mov dword [rsp + 0x30], 3
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140015918
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.SoftwareSASGeneration
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x48
ret
Function at 0x140017060
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
cmp qword [0x1403b9960], 0
je 0x140017185
cmp dword [rsp + 0x68], 2
jl 0x1400170e9
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x60]
movzx ecx, word [rcx + rax]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
cmp eax, 0xa
jne 0x1400170e9
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140015920]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400170e9
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 2
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1403b9960]
call fcn.1401291b0
cmp qword [0x1403b96c0], 0
je 0x140017139
mov eax, 4
imul rax, rax, 2
mov rcx, qword [0x1403b96c0]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax + rcx]
mov qword [rsp + 0x40], rax
jmp 0x140017142
mov qword [rsp + 0x40], 0
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x60]
movzx ecx, word [rcx + rax]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rsp + 0x20], eax
lea r9, str.KVM__Master_:_Write_Input__Type___u_
mov r8d, 4
mov edx, 0x100
mov rcx, qword [rsp + 0x40]
call fcn.140129b00
mov eax, dword [rsp + 0x68]
jmp 0x1400171e3
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x60]
add rdx, rcx
mov rcx, rdx
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, eax
call fcn.140016400
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1400171df
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
jmp 0x140017195
mov eax, dword [rsp + 0x30]
add rsp, 0x58
ret
Function at 0x140017590
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x75b8
call fcn.14026deb0
sub rsp, rax
mov rax, qword [0x140325ed8]
xor rax, rsp
mov qword [rsp + 0x75a0], rax
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x48], 0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x75c0]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x60], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x75c0]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r9, str.KVM__SLAVE_:__mainloopinput__Starting...
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x1403b8c28]
call fcn.140129b00
cmp dword [0x140326ba4], 0
jne 0x140017749
mov eax, 0x7530
sub eax, dword [rsp + 0x40]
movsxd rcx, dword [rsp + 0x40]
lea rcx, [rsp + rcx + 0x70]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, eax
mov rdx, rcx
mov rcx, qword [0x140326da0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x14001768a
cmp dword [rsp + 0x48], 0
je 0x14001768a
cmp dword [0x140326ba4], 0
je 0x1400176ce
mov eax, dword [0x140326ba4]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
lea r9, str.KVM__SLAVE_:_fSuccess__d__cbBytesRead__d__g_shutdown__d
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x1403b8c28]
call fcn.140129b00
mov dword [0x140326ba4], 1
jmp 0x140017749
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x4c], 0
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
sub ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x44]
lea rcx, [rsp + rcx + 0x70]
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov edx, eax
call fcn.140016400
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0
je 0x14001772a
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
jmp 0x1400176e6
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jne 0x140017744
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
jmp 0x14001762e
lea r9, str.KVM__SLAVE_:__mainloopinput__Exiting...
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x1403b8c28]
call fcn.140129b00
mov rcx, qword [0x1403b8c28]
call fcn.140129320
mov qword [0x1403b8c28], 0
xor eax, eax
mov rcx, qword [rsp + 0x75a0]
xor rcx, rsp
call fcn.14026d940
add rsp, 0x75b8
ret
Function at 0x140018d60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x58], 0
je 0x140018de4
cmp dword [0x1403b8c34], 1
jne 0x140018d99
cmp dword [0x140326ba4], 0
jne 0x140018d99
xor eax, eax
jmp 0x140018ec1
mov dword [0x1403b8c30], 0
mov dword [reloc.WS2_32.dll_accept], 5
mov eax, dword [rsp + 0x70]
mov dword [0x140326bcc], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov ecx, 1
call fcn.1400188e0
jmp 0x140018ec1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, reloc.WS2_32.dll_sendto
call fcn.140113f90
mov qword [rsp + 0x30], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x60]
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov ecx, 4
imul rcx, rcx, 0
mov dword [rax + rcx], 1
mov dword [0x1403b8c64], 1
cmp dword [0x1403b8c34], 1
jne 0x140018e77
cmp dword [0x140326ba4], 0
jne 0x140018e77
mov rcx, qword [rsp + 0x30]
call fcn.14027a7c0
xor eax, eax
jmp 0x140018ec1
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
lea r8, [fcn.1400183d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1403b8c78], rax
cmp qword [0x1403b8c78], 0
je 0x140018ebc
mov rcx, qword [0x1403b8c78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x48
ret