joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2ab142060
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x2ab1420ad
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x2ab1420a4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x2ab1420af
add rax, 0x28
cmp rax, r9
jne 0x2ab142090
xor eax, eax
ret

Function at 0x2ab1420b0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x2ab142140
mov rdx, qword [0x2ab161250]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x2ab14212e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x2ab14212e
cmp word [rax + 0x18], 0x20b
jne 0x2ab14212e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x2ab142140
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x2ab142119
add rbx, 0x28
cmp rbx, rdi
je 0x2ab142140
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x2ab142110
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x2ab142150
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x2ab161250]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x2ab142170
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x2ab142178
ret
cmp word [r8 + 0x18], 0x20b
jne 0x2ab142170
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x2ab1421cd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x2ab1421c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x2ab142170
add rax, 0x28
cmp rax, r9
jne 0x2ab1421b0
xor eax, eax
ret

Function at 0x2ab1421d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x2ab161250]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x2ab1421ef
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x2ab1421f8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x2ab1421ef
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x2ab142210
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x2ab161250]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x2ab142230
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x2ab142238
ret
cmp word [rdx + 0x18], 0x20b
jne 0x2ab142230
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x2ab142280
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x2ab142277
test rcx, rcx
je 0x2ab142230
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x2ab142268
xor eax, eax
ret
Function at 0x2ab142290
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x2ab161250]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x2ab1422af
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x2ab1422b8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x2ab1422d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x2ab161250]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x2ab1422f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x2ab1422f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x2ab1422f0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x2ab1422f0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x2ab142344
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x2ab142350
add rdx, 0x28
cmp r9, rdx
jne 0x2ab142330
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x2ab142360
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x2ab161250]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x2ab142382
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x2ab142390
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x2ab142382
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x2ab142382
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x2ab142382
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x2ab1423e5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x2ab1423f8
add rdx, 0x28
cmp rdx, r10
jne 0x2ab1423d0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x2ab142407
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x2ab142417
mov edx, dword [rax + 0xc]
test edx, edx
je 0x2ab1423ee
test ecx, ecx
jg 0x2ab142400
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x14000f660
Capabilities:
Read file on windows

Disassembly:
push r13
push rbp
sub rsp, 0x28
mov rax, r8
mov r8, rdx
mov rdx, rcx
cmp dword [rax], 0
je 0x14000f6c1
mov r13, qword [rax + 8]
cmp rdx, qword [r13 + 0x30]
jne 0x14000f6b2
mov rbp, qword [r13 + 0x28]
mov dword [rbp], 1
mov dword [rbp + 4], r8d
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp + 8]
add rsp, 0x28
pop rbp
pop r13
ret
mov rcx, r13
add rsp, 0x28
pop rbp
pop r13
jmp 0x14000f6e0
mov rcx, rdx
xor edx, edx
inc rdx
mov r9, qword [rax + 0x10]
call fcn.140027a34
add rsp, 0x28
pop rbp
pop r13
ret
push rsi
push rdi
push r12
push rbp
sub rsp, 0x28
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
test rdi, rdi
je 0x14000f747
mov r12, qword [rbp + 0x28]
mov dword [r12], 1
mov dword [r12 + 4], edi
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbp + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r12d, dword [r12 + 8]
test r12d, r12d
jle 0x14000f73a
mov rcx, rsi
mov r8, rdi
mov rdx, qword [rbp + 0x30]
call fcn.140023e60
mov eax, r12d
add rsp, 0x28
pop rbp
pop r12
pop rdi
pop rsi
ret
xor eax, eax
add rsp, 0x28
pop rbp
pop r12
pop rdi
pop rsi
ret
Function at 0x14001c310
Capabilities:
Write file on windows

Disassembly:
push r12
push r13
push r15
sub rsp, 0x20
mov rax, r8
mov r12, rdx
mov rdx, rcx
cmp dword [rax], 0
je 0x14001c36f
mov r13, qword [rax + 8]
mov r8, r12
mov rcx, qword [r13 + 0x38]
mov r15, qword [r13 + 0x28]
call fcn.140023e60
mov dword [r15], 2
mov dword [r15 + 4], r12d
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r15 + 8]
add rsp, 0x20
pop r15
pop r13
pop r12
ret
mov rcx, rdx
xor edx, edx
inc rdx
mov r8, r12
mov r9, qword [rax + 0x18]
call fcn.140027c8c
add rsp, 0x20
pop r15
pop r13
pop r12
ret
Function at 0x140027280
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x150
xor edi, edi
mov rax, qword [0x140002a10]
mov edx, 0x100
xor rax, rsp
pxor xmm0, xmm0
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x140], edi
mov byte [rsp + 0x144], dil
movups xmmword [rsp + rdx + 0x30], xmm0
movups xmmword [rsp + rdx + 0x20], xmm0
movups xmmword [rsp + rdx + 0x10], xmm0
movups xmmword [rsp + rdx], xmm0
sub rdx, 0x40
jne 0x1400272bd
cmp qword [0x140038a40], 0
je 0x1400274b2
lea rcx, [0x140038a40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x140003a40], 0xffffffffffffffff
je 0x140027482
lea rcx, [0x14000eac4]
lea rdx, [rsp + 0x40]
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140027331
mov edx, 0x105
lea rcx, [rsp + 0x40]
lea r8, [0x14000ead0]
call fcn.140035c94
mov edx, 0x105
lea rcx, [rsp + 0x40]
lea r8, [0x14000eadc]
call fcn.140035c94
mov ecx, 1
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
cmp qword [rsp + 0x38], 0
je 0x14002745a
mov edx, 1
mov eax, 0x10
mov qword [rsp + 0x30], rbx
mov rbx, rax
mov qword [rsp + 0x28], rsi
mov rsi, rdx
mov qword [rsp + 0x20], r12
lea r12, [0x140000000]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [r12 + rbx + 0x3a48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140027407
mov qword [r12 + rbx + 0x3a40], rax
inc rsi
add rbx, 0x10
cmp rsi, 0x32
jl 0x14002738e
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
lea rcx, [0x140038a40]
mov qword [0x140003a40], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
cmp rcx, qword [0x140002a10]
jne 0x140027401
mov eax, edi
add rsp, 0x150
pop rdi
ret
call fcn.14002d6f0
nop
mov rcx, qword [r12 + rbx + 0x3a40]
test rcx, rcx
je 0x140027432
cmp rcx, rsi
jge 0x1400273ae
shl rcx, 4
mov rcx, qword [r12 + rcx + 0x3a40]
mov qword [r12 + rbx + 0x3a40], rcx
jmp 0x1400273ae
mov r8, qword [0x140003a50]
test r8, r8
je 0x1400273ae
lea rcx, [0x14000eb00]
mov rdx, qword [r12 + rbx + 0x3a48]
call r8
nop
jmp 0x1400273ae
xor edx, edx
lea rcx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140027368
mov edi, 0xffffffff
jmp 0x1400273ca
lea rcx, [0x140038a40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
cmp rcx, qword [0x140002a10]
jne 0x140027401
xor eax, eax
add rsp, 0x150
pop rdi
ret
lea rcx, [0x140038a40]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
jmp 0x1400272e4

Function at 0x14002c6d8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14002c540
Function at 0x14000da34
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140017850], eax
call fcn.14000d780
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140017850], 0
jne case.default.0x14000da8a
mov ecx, 1
call fcn.14000d780
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
invalid
or dword es:[rbx], edi
jno 0x140025d4d
mov dh, 0xfb
jl 0x140025ca3
pop rdi
mov sil, 0x9f
std
pmullw mm1, mm6
invalid
invalid
Function at 0x11027c0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x11027cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x11027dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x11027c5
lea eax, [rcx + 1]
jmp 0x11027eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x11027fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x11027e4
sub eax, 3
jb 0x110281e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x110286d
sar eax, 1
movsxd rbp, eax
jb 0x1102854
jmp 0x110282c
add ebx, ebx
jne 0x110282a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1102854
inc ecx
add ebx, ebx
jne 0x110283a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1102854
call r11
adc ecx, ecx
add ebx, ebx
jne 0x110284d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x110283c
add ecx, 2
jmp 0x1102859
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.01102782
jmp 0x11027cd
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xcf3000]
mov eax, dword [rdi]
or eax, eax
je 0x11028c9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xd02000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1102879
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x11028c3
mov qword [rbx], rax
add rbx, 8
jmp 0x1102899
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x110290d
cmp al, 0xef
ja 0x11028f5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x11028d5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x11028e4
mov eax, dword [rdi]
add rdi, 4
jmp 0x11028e4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1102961
sub rsp, 0xffffffffffffff80
jmp 0x46c600
Function at 0x14001d019
Capabilities:
Delete file

Disassembly:
jmp 0x140046ff0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x6a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x10e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x6c8]
lea rcx, [0x1400854e4]
call fcn.14001df69
mov edx, 0x410
lea rcx, [rbp + 0x10]
call fcn.14001dad2
mov rax, qword [rbp + 0x6a8]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x6a0]
lea r8, [0x140061390]
mov edx, 0x208
lea rcx, [rbp + 0x10]
call fcn.14001da14
cmp dword [rbp + 0x6b0], 0
je 0x140047081
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400470a2
cmp qword [rbp + 0x690], 0
je 0x1400470a2
mov r8d, dword [rbp + 0x698]
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x690]
call fcn.14001d4dd
lea rcx, [rbp - 0x30]
lea rdx, [0x14006c2f0]
call fcn.14001dcb2
lea rsp, [rbp + 0x678]
pop rdi
pop rbp
ret
Function at 0x14001d154
Capabilities:
Set registry value

Disassembly:
jmp 0x14004bf20
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1e8]
lea rcx, [0x1400854e4]
call fcn.14001df69
mov dword [rbp + 4], 0xc0000001
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x90], 0
xor eax, eax
mov word [rbp + 0x88], ax
xor eax, eax
mov word [rbp + 0x8a], ax
cmp qword [rbp + 0x190], 0
je 0x14004bfbe
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x88]
mov rcx, qword [rbp + 0x190]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
movzx eax, al
test eax, eax
jne 0x14004bfbe
mov eax, 0xc00000f0
jmp 0x14004c16c
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x198]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14004c018
mov dword [rbp + 4], 0xc0000022
jmp 0x14004c148
mov dword [rbp + 0x44], 0
mov dword [rbp + 0x24], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x14004c05f
jmp 0x14004c128
mov dword [rbp + 0x24], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x14004c09f
jmp 0x14004c128
mov dword [rbp + 0x24], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x14004c0dc
jmp 0x14004c128
cmp qword [rbp + 0x190], 0
je 0x14004c11e
movzx eax, word [rbp + 0x88]
add rax, 2
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x44], eax
xor eax, eax
test eax, eax
jne 0x14004c01f
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp + 0x44], 0
je 0x14004c141
mov dword [rbp + 4], 0xc0000022
jmp 0x14004c148
mov dword [rbp + 4], 0
cmp qword [rbp + 0x190], 0
je 0x14004c169
cmp qword [rbp + 0x90], 0
je 0x14004c169
lea rcx, [rbp + 0x88]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14006cfb0]
call fcn.14001dcb2
mov rax, rdi
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x14001d19f
Capabilities:
Map section object

Disassembly:
jmp 0x140048ef0
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1f8]
lea rcx, [0x1400854e4]
call fcn.14001df69
mov qword [rbp + 8], 0
cmp dword [rbp + 0x1b8], 0
je 0x140048f51
mov dword [rbp + 0x24], 4
jmp 0x140048f58
mov dword [rbp + 0x24], 2
mov rax, qword [rbp + 0x1a8]
and rax, 0xfffffffffffff000
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x1a8]
sub rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x1b0]
add rax, rcx
mov qword [rbp + 0x68], rax
mov eax, dword [rbp + 0x24]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
lea rax, [rbp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 8]
mov rdx, 0xffffffffffffffff
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
jge 0x14004900a
mov ecx, dword [rbp + 0xa4]
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140049010
mov rax, qword [rbp + 8]
jmp 0x140049012
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14006a9a0]
call fcn.14001dcb2
mov rax, rdi
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret

Function at 0x14001d1db
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140025670
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x140083341]
call fcn.14001df69
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x44], 0
lea r9, [rbp + 0x44]
mov r8d, 8
lea rdx, [rbp + 0x28]
mov ecx, 0x32
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1400256de
mov ecx, dword [rbp + 4]
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
mov rax, qword [rbp + 0x28]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14005b640]
call fcn.14001dcb2
mov rax, rdi
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x14001d23a
Capabilities:
Terminate thread

Disassembly:
jmp 0x14003cb20
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x140084eaa]
call fcn.14001df69
mov rax, qword [rbp + 0x100]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14003cb60
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14003cba6
mov edx, 0x7d0
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14003cb8a
xor edx, edx
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call fcn.14001da19
mov eax, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x14001d25d
Capabilities:
Delete file

Disassembly:
jmp 0x1400468b0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1400854e4]
call fcn.14001df69
mov eax, dword [rbp + 0x108]
mov dword [rbp + 4], eax
mov ecx, dword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140046904
mov eax, 1
jmp 0x140046914
mov eax, dword [rbp + 4]
dec eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x1400468e0
xor eax, eax
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x14001d3cf
Capabilities:
Access pe header

Disassembly:
jmp 0x14004aa00
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
lea rcx, [0x1400854e4]
call fcn.14001df69
mov dword [rbp + 4], 0
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14004ab17
mov dword [rbp + 0x44], 0
lea rdx, [rbp + 0x44]
mov rcx, qword [rbp + 0x180]
call fcn.14001d5e1
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
je 0x14004ab17
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x68]
call fcn.14001d929
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
je 0x14004ab05
mov rax, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x88]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 0x28], eax
cmp dword [rbp + 0x198], 0
je 0x14004aae5
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 0x16]
btr eax, 0xd
mov rcx, qword [rbp + 0x28]
mov word [rcx + 0x16], ax
mov edx, dword [rbp + 0x188]
mov rcx, qword [rbp + 0x180]
call fcn.14001ddca
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 0x58], eax
mov dword [rbp + 4], 1
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14006b830]
call fcn.14001dcb2
mov eax, edi
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret