joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008f020
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
xor edi, edi
lea rax, [r11 - 0x28]
mov r14, r9
mov qword [r11 - 0x20], rdi
mov rbp, r8
mov qword [r11 - 0x28], rdi
xor r8d, r8d
mov qword [r11 - 0x38], rax
lea r9d, [rdi + 1]
mov rcx, 0xffffffff80000002
lea rdx, [0x1403b9cf0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008f0a1
mov ebx, edi
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov ecx, ebx
call fcn.140079118
lea rcx, [rsp + 0x30]
call fcn.1400695f4
test ebx, ebx
jns 0x14008f0bf
mov ecx, ebx
call fcn.1400790f8
jmp 0x14008f107
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
je 0x14008f074
mov ecx, ebx
call fcn.1400790f8
mov rsi, rdi
jmp 0x14008f083
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14008f0ff
cmp eax, 2
je 0x14008f104
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
je 0x14008f104
jmp 0x14008f098
mov edi, 1
mov dword [r14], edi
mov ecx, ebx
call fcn.140079118
lea rcx, [rsp + 0x38]
call fcn.1400695f4
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x14008f134
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
and qword [r11 + 8], 0
lea rax, [r11 + 0x10]
and qword [r11 + 0x10], 0
lea rdx, [0x1403b9cf0]
mov rsi, r8
mov qword [r11 - 0x18], rax
xor r8d, r8d
mov r9d, 2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008f1bd
xor ebx, ebx
mov rdi, qword [rsp + 0x48]
and qword [rsp + 0x48], 0
mov qword [rsp + 0x40], rdi
mov ecx, ebx
call fcn.140079118
lea rcx, [rsp + 0x48]
call fcn.1400695f4
test ebx, ebx
js 0x14008f1ec
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x14008f1da
xor ebx, ebx
jmp 0x14008f1f3
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
je 0x14008f184
mov ecx, ebx
call fcn.1400790f8
xor edi, edi
jmp 0x14008f194
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
je 0x14008f1f3
mov ecx, ebx
call fcn.1400790f8
mov ecx, ebx
call fcn.140079118
lea rcx, [rsp + 0x40]
call fcn.1400695f4
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14008fcc8
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x140425b28]
xor rax, rsp
mov qword [rbp + 0x27], rax
and qword [rbp - 0x41], 0
lea rax, [rbp - 0x49]
and dword [rbp - 0x39], 0
lea r9, [rbp - 0x41]
and dword [rbp - 0x35], 0
lea r8, str.PolicyValuesArray
and qword [rbp - 0x31], 0
lea rdx, [0x1403b9cf0]
mov qword [rsp + 0x20], rax
mov r15, rcx
call fcn.14008fe50
mov edi, eax
mov r13d, 0x8007000d
cmp eax, 0x80070002
jne 0x14008fd3f
xor edi, edi
jmp 0x14008fdd3
test eax, eax
jns 0x14008fd4f
mov ecx, eax
call fcn.1400790f8
jmp 0x14008fdd3
mov ecx, dword [rbp - 0x49]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
mov rbx, rdx
shr rbx, 5
lea rax, [rbx + rbx*2]
shl rax, 4
sub rcx, rax
je 0x14008fd7b
mov edi, r13d
mov ecx, r13d
jmp 0x14008fd45
mov rsi, qword [rbp - 0x41]
xor r14d, r14d
test ebx, ebx
je 0x14008fdc7
movups xmm0, xmmword [rsi]
lea r8, [rbp - 0x49]
movups xmm1, xmmword [rsi + 0x10]
lea rdx, [rbp - 9]
movdqu xmmword [rbp - 9], xmm0
lea rcx, [rbp - 0x39]
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rbp + 7], xmm1
movups xmmword [rbp + 0x17], xmm0
call fcn.14008ae4c
mov edi, eax
test eax, eax
js 0x14008fd43
cmp dword [rbp - 0x49], 0
je 0x14008fd73
inc r14d
add rsi, 0x30
cmp r14d, ebx
jb 0x14008fd86
lea rdx, [rbp - 0x39]
mov rcx, r15
call fcn.14008fb20
xor ebx, ebx
cmp edi, r13d
cmovne ebx, edi
mov ecx, ebx
call fcn.140079118
lea rcx, [rbp - 0x39]
call fcn.14008f6dc
and qword [rbp - 0x19], 0
lea rax, [0x140001b38]
xor r9d, r9d
mov qword [rbp - 0x21], rax
lea rax, [rbp - 0x41]
mov qword [rbp - 0x29], 3
lea rdx, [rbp - 0x29]
mov qword [rbp - 0x11], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140368700
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x14008fe50
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor edi, edi
lea rax, [rbp - 0x18]
and qword [rbp - 8], rdi
mov r14, r9
mov r15, r8
mov qword [rbp - 0x10], rdi
xor ebx, ebx
mov qword [r11 - 0x48], rax
and qword [rbp - 0x18], rbx
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008fed3
xor esi, esi
mov rdi, qword [rbp - 0x18]
and qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rdi
mov ecx, esi
call fcn.140079118
lea rcx, [rbp - 0x18]
call fcn.1400695f4
test esi, esi
jns 0x14008feee
mov ecx, esi
call fcn.1400790f8
jmp 0x14008ff92
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
je 0x14008fea7
mov ecx, esi
call fcn.1400790f8
jmp 0x14008feb3
and dword [rbp + 0x20], ebx
lea rax, [rbp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
mov rdx, r15
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14008ff28
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x14008fec7
test rbx, rbx
jne 0x14008ff66
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x14008ff5c
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x14008fef1
mov esi, 0x8007000e
jmp 0x14008fec7
mov esi, 0x8000ffff
jmp 0x14008fec7
cmp dword [rbp - 0x20], 3
je 0x14008ff76
mov esi, 0x8007000d
jmp 0x14008fec7
mov qword [r14], rbx
xor ecx, ecx
call fcn.140079118
mov rcx, qword [rbp + 0x40]
xor esi, esi
xor ebx, ebx
test rcx, rcx
je 0x14008ff92
mov eax, dword [rbp + 0x20]
mov dword [rcx], eax
mov ecx, esi
call fcn.140079118
test rbx, rbx
je 0x14008ffb2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp - 8]
call fcn.1400695f4
lea rcx, [rbp - 0x10]
call fcn.1400695f4
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400901e4
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140425b28]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor eax, eax
lea rdx, [rsp + 0x50]
mov r8d, 0x104
mov qword [rsp + 0x20], rax
lea rcx, str.systemroot
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140090252
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14009023f
mov esi, 0x80004005
jmp 0x14009034e
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x14009034e
lea rdx, [rsp + 0x50]
lea rcx, str.windir
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140090298
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140090235
movzx esi, ax
lea rdx, [0x14042bd04]
or esi, 0x80070000
lea rcx, [0x14040da28]
test eax, eax
cmovle esi, eax
call fcn.1400ea7f4
jmp 0x14009034e
lea rcx, [rsp + 0x20]
call fcn.1400905a8
mov esi, eax
test eax, eax
jns 0x1400902af
mov ecx, eax
jmp 0x140090350
lea rax, str.SPPSvc
xor esi, esi
and qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x28]
and qword [rsp + 0x40], rsi
mov qword [rsp + 0x28], rax
lea rax, [0x140090780]
mov qword [rsp + 0x30], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x140090330
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140427f20]
mov ebx, eax
lea rcx, [0x140412580]
call fcn.1400ea158
test ebx, ebx
jne 0x140090308
mov esi, 0x80004005
jmp 0x140090329
lea rdx, [0x14042c2d8]
lea rcx, [0x140405b84]
call fcn.1400ea4ac
movzx esi, bx
or esi, 0x80070000
test ebx, ebx
cmovle esi, ebx
mov ecx, esi
call fcn.1400790f8
mov ecx, esi
call fcn.140079118
test esi, esi
jns 0x140090355
lea rdx, [0x14042d8c0]
lea rcx, [0x14040f468]
call fcn.1400e8a6c
mov ecx, esi
call fcn.1400790f8
mov ecx, esi
call fcn.140079118
cmp dword [rsp + 0x20], 0
je 0x140090396
cmp qword [0x14042f8b0], 0
je 0x140090396
mov rbx, qword [0x14042fb40]
test rbx, rbx
je 0x140090396
mov rdi, qword [0x14042f8b8]
mov rcx, rdi
call qword [0x1403af620]
mov rcx, rbx
call rdi
and qword [0x14042fb40], 0
cmp dword [rsp + 0x24], 0
je 0x1400903b6
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
lea rdx, [0x14042b110]
lea rcx, [0x1404048ec]
call fcn.1400e9e10
mov eax, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140368700
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400903e4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140425b28]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [0x140425898]
lea rdx, [0x1404287dc]
lea rcx, [0x140412c70]
movups xmm0, xmmword [rax - 0x10]
movdqu xmmword [rsp + 0x20], xmm0
call fcn.1400e90f0
xorps xmm0, xmm0
lea r9, [0x1404258b0]
lea r8, [0x140425890]
lea rdx, [0x140001010]
lea rcx, [rsp + 0x20]
movdqu xmmword [0x1404258b8], xmm0
call qword [sym.imp.ADVAPI32.dll_EventRegister]
xor edi, edi
test eax, eax
jne 0x140090485
lea rdx, [0x14042e12c]
lea rcx, [0x140410898]
call fcn.1400e9ac8
mov r8, qword [0x140425898]
lea edx, [rdi + 2]
mov rcx, qword [0x1404258b0]
movzx r9d, word [r8]
call qword [sym.imp.ADVAPI32.dll_EventSetInformation]
call fcn.1400901e4
lea rdx, [0x140427558]
mov esi, eax
lea rcx, [0x140409868]
call fcn.1400e8db8
mov rcx, qword [0x1404258b0]
call qword [sym.imp.ADVAPI32.dll_EventUnregister]
lea rdx, [0x140429728]
mov qword [0x1404258b0], rdi
lea rcx, [0x140413b44]
mov dword [0x140425890], edi
call fcn.1400e9438
test esi, esi
jns 0x1400904d9
mov ecx, esi
call fcn.1400790f8
jmp 0x14009050a
mov eax, dword [0x14042e928]
mov ebx, edi
test eax, eax
sete bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdx, [0x1404298a4]
lea rcx, [0x14040b7f8]
call fcn.1400e977c
mov ecx, esi
call fcn.140079118
test esi, esi
sets dil
mov eax, edi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140368700
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400a13a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
xor edi, edi
lea rax, [r11 - 0x30]
mov r14, r9
mov qword [r11 - 0x28], rdi
mov rbp, r8
mov qword [r11 - 0x30], rdi
xor r8d, r8d
mov qword [r11 - 0x48], rax
lea r9d, [rdi + 1]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400a141e
mov ebx, edi
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdi
mov ecx, ebx
call fcn.140079118
lea rcx, [rsp + 0x38]
call fcn.1400695f4
test ebx, ebx
jns 0x1400a143c
mov ecx, ebx
call fcn.1400790f8
jmp 0x1400a1484
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
je 0x1400a13f1
mov ecx, ebx
call fcn.1400790f8
mov rsi, rdi
jmp 0x1400a1400
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400a147c
cmp eax, 2
je 0x1400a1481
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
je 0x1400a1481
jmp 0x1400a1415
mov edi, 1
mov dword [r14], edi
mov ecx, ebx
call fcn.140079118
lea rcx, [rsp + 0x40]
call fcn.1400695f4
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400a14b4
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
or qword [rsp + 0x48], 0xffffffffffffffff
xor edi, edi
mov qword [rsp + 0x40], rdi
mov r14, r8
mov r15, rdx
test rcx, rcx
jne 0x1400a14e8
mov ecx, 0x80070057
mov edi, ecx
jmp 0x1400a15db
test r15, r15
je 0x1400a14dc
test r14, r14
je 0x1400a14dc
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400a15ba
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x48], rbp
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400a15ba
cmp dword [rsp + 0x80], edi
jne 0x1400a14dc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, esi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400a15b0
lea r9, [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov r8d, esi
mov qword [rsp + 0x20], rdi
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400a15ba
cmp dword [rsp + 0x98], esi
je 0x1400a15a3
mov ecx, 0x8000ffff
jmp 0x1400a14e1
mov dword [r15], esi
mov qword [rsp + 0x40], rdi
mov qword [r14], rbx
jmp 0x1400a15e0
mov ecx, 0x8007000e
jmp 0x1400a14e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400a15cb
mov edi, 0x80004005
jmp 0x1400a15d9
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.1400790f8
mov ecx, edi
call fcn.140079118
lea rcx, [rsp + 0x40]
call fcn.14009b030
lea rcx, [rsp + 0x48]
call fcn.140075ab4
mov rbx, qword [rsp + 0x88]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400aa024
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
and dword [rbp - 0x40], 0
lea rax, [0x14000f1b8]
and dword [rbp - 0x3c], 0
lea rdx, [rbp - 0x30]
and qword [rbp - 0x38], 0
mov rsi, r9
and qword [rbp - 0x18], 0
xor r9d, r9d
mov qword [rbp - 0x28], rax
mov ecx, 0xb9
lea rax, [rbp + 0x28]
mov qword [rbp - 0x30], 3
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x40]
lea r8d, [r9 + 0x30]
mov qword [rbp - 0x10], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x28]
test ebx, ebx
jns 0x1400aa094
mov ecx, ebx
jmp 0x1400aa111
xor edi, edi
cmp dword [rbp - 0x3c], edi
jle 0x1400aa0fd
movsxd rbx, edi
shl rbx, 7
add rbx, qword [rbp - 0x38]
mov rcx, rbx
lea rdx, [rbx + 0x68]
call fcn.1400b4fc0
lea rax, [0x14000f4f8]
mov qword [rbp - 0x30], 3
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
lea rax, [rbp + 0x30]
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x20], rax
xor r9d, r9d
lea rax, [rbx + 0x60]
mov ecx, 0xb9
mov qword [rbp - 0x10], rax
lea rax, [rbx + 0x58]
mov qword [rbp - 8], rax
lea r8d, [r9 + 0x30]
call sub.ntdll.dll_NtQuerySystemInformation
inc edi
cmp edi, dword [rbp - 0x3c]
jl 0x1400aa09b
lea r8, [rbp - 0x40]
mov rdx, rsi
call fcn.1400b2abc
mov ebx, eax
test eax, eax
jns 0x1400aa116
mov ecx, eax
call fcn.1400790f8
mov ecx, ebx
call fcn.140079118
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.1400c3cf4
lea rcx, [rbp - 0x38]
call fcn.1400b6d90
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400adc2c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor r15d, r15d
mov r14, r8
mov qword [rbp - 0x10], r15
mov ebx, r15d
mov qword [rbp - 0x20], rbx
mov rsi, rdx
mov qword [rbp - 0x18], r15
mov rdi, rcx
cmp rcx, 0xffffffff80000001
jne 0x1400adc6f
xor ecx, ecx
call fcn.140079118
lea rax, [rbp + 0x30]
mov qword [rbp + 0x30], r15
mov r9d, 2
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400adcf7
mov edi, r15d
mov rbx, qword [rbp + 0x30]
mov qword [rbp - 0x20], rbx
mov rsi, rbx
mov qword [rbp + 0x30], r15
mov ecx, edi
call fcn.140079118
lea rcx, [rbp + 0x30]
call fcn.1400695f4
test edi, edi
js 0x1400add27
xor ecx, ecx
call fcn.140079118
mov eax, dword [rbp + 0x50]
test rbx, rbx
mov dword [rsp + 0x28], eax
mov r9d, 4
cmove rsi, r15
lea rax, [rbp + 0x48]
mov rcx, rsi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400add15
mov edi, r15d
jmp 0x1400add2e
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x1400adc98
mov ecx, edi
call fcn.1400790f8
mov rsi, r15
jmp 0x1400adca7
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x1400add2e
mov ecx, edi
call fcn.1400790f8
mov ecx, edi
call fcn.140079118
lea rcx, [rbp - 0x18]
call fcn.14006f380
lea rcx, [rbp - 0x10]
call fcn.1400695f4
lea rcx, [rbp - 0x20]
call fcn.1400695f4
mov rbx, qword [rsp + 0x88]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b418c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140425b28]
xor rax, rsp
mov qword [rbp - 8], rax
xor r15d, r15d
mov dword [rbp - 0x38], 0x73006d
mov ebx, r15d
mov dword [rbp - 0x34], 0x740066
lea rax, [rbp - 0x50]
mov qword [rbp - 0x40], rbx
mov r8, rcx
mov dword [rbp - 0x30], 0x73003a
mov rsi, rdx
mov dword [rbp - 0x2c], 0x700070
mov r9, rcx
mov dword [rbp - 0x28], 0x63002f
mov dword [rbp - 0x24], 0x630061
sub r8, rax
mov dword [rbp - 0x20], 0x650068
mov dword [rbp - 0x1c], 0x740073
mov dword [rbp - 0x18], 0x72006f
mov dword [rbp - 0x14], 0x2f0065
mov dword [rbp - 0x10], 0x730025
mov word [rbp - 0xc], r15w
mov dword [rbp - 0x50], 0x6d0048
mov dword [rbp - 0x4c], 0x630061
mov dword [rbp - 0x48], 0x65004b
mov dword [rbp - 0x44], 0x79
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x1400b4249
add rax, 2
test edx, edx
jne 0x1400b4235
test ecx, ecx
jne 0x1400b425b
mov edi, 0x80070057
mov ecx, edi
call fcn.1400790f8
jmp 0x1400b4285
mov r8, r9
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x40]
call fcn.140078210
mov edi, eax
test eax, eax
jns 0x1400b427e
mov ecx, eax
call fcn.1400790f8
mov rbx, qword [rbp - 0x40]
jmp 0x1400b4285
mov rax, qword [rbp - 0x40]
mov qword [rsi], rax
mov ecx, edi
call fcn.140079118
test rbx, rbx
je 0x1400b42ad
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079118
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140368700
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400be864
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp - 0x50], 0
mov rdi, r8
and qword [rbp - 0x58], 0
lea r8, [rbp - 0x50]
mov r12d, edx
mov r15, r9
lea rdx, [rbp - 0x60]
call fcn.1400c38d0
mov ebx, eax
test eax, eax
jns 0x1400be8b3
mov ecx, eax
jmp 0x1400be946
mov ebx, 0x20
mov edx, ebx
lea ecx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1400be93f
mov r14, qword [rbp - 0x50]
lea r8d, [rbx + 0x1c]
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x48]
lea rax, [0x140012f78]
mov qword [rbp - 0x2c], rdi
mov edi, dword [rbp - 0x60]
lea ecx, [r8 + 0x7d]
mov qword [rbp - 0x40], rax
xor r9d, r9d
lea rax, [rbp - 0x5c]
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x48], 3
mov dword [rbp - 0x30], r12d
mov dword [rbp - 0x24], edi
mov dword [rbp - 0x18], ebx
mov qword [rbp - 0x14], rsi
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp - 0x5c]
test ebx, ebx
js 0x1400be944
xor eax, eax
mov dword [r15], 0x20
and qword [rbp - 0x58], rax
mov ecx, edi
mov rdi, r14
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x40]
mov qword [rax], rsi
jmp 0x1400be94b
mov ebx, 0x8007000e
mov ecx, ebx
call fcn.1400790f8
mov ecx, ebx
call fcn.140079118
lea rcx, [rbp - 0x58]
call fcn.14005a598
lea rcx, [rbp - 0x50]
call fcn.14005a598
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400bf49c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
or qword [rsp + 0x68], 0xffffffffffffffff
xor ebx, ebx
mov rsi, r8
mov edi, edx
test rcx, rcx
jne 0x1400bf4c6
mov ecx, 0x80070057
mov ebx, ecx
jmp 0x1400bf545
mov qword [rsp + 0x30], rbx
mov r8d, 2
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400bf524
lea r9, [rsp + 0x50]
mov qword [rsp + 0x68], rcx
mov r8d, edi
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400bf524
cmp dword [rsp + 0x50], edi
je 0x1400bf54a
mov ecx, 0x8000ffff
jmp 0x1400bf4c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400bf535
mov ebx, 0x80004005
jmp 0x1400bf543
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.1400790f8
mov ecx, ebx
call fcn.140079118
lea rcx, [rsp + 0x68]
call fcn.140075ab4
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret