joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d813c
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x14025b640
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rcx, [0x14033b4b5]
call fcn.1400d83bc
nop
mov rax, qword [rbp + 0x188]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14025b6a8
mov rcx, qword [rbp + 0x180]
call fcn.1400d525c
mov rcx, qword [rbp + 0x190]
call fcn.1400d4ce9
nop
mov rax, qword [rbp + 0x180]
jmp 0x14025b7e4
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0x4550
je 0x14025b6f2
mov rcx, qword [rbp + 0x180]
call fcn.1400d525c
mov rcx, qword [rbp + 0x190]
call fcn.1400d4ce9
nop
mov rax, qword [rbp + 0x180]
jmp 0x14025b7e4
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 6]
mov word [rbp + 0x44], ax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 0x14]
mov rcx, qword [rbp + 0x28]
lea rax, [rcx + rax + 0x18]
mov qword [rbp + 0x68], rax
xor eax, eax
mov word [rbp + 0x84], ax
jmp 0x14025b72f
movzx eax, word [rbp + 0x84]
inc ax
mov word [rbp + 0x84], ax
movzx eax, word [rbp + 0x84]
movzx ecx, word [rbp + 0x44]
cmp eax, ecx
jge 0x14025b7c4
mov rcx, qword [rbp + 0x190]
call fcn.1400d466d
movzx ecx, word [rbp + 0x84]
imul rcx, rcx, 0x28
mov rdx, qword [rbp + 0x68]
add rdx, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1400d8a47
test eax, eax
jne 0x14025b7bf
movzx eax, word [rbp + 0x84]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0x68]
lea rax, [rcx + rax + 0xc]
movzx ecx, word [rbp + 0x84]
imul rcx, rcx, 0x28
mov rdx, qword [rbp + 0x68]
lea rcx, [rdx + rcx + 8]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rbp + 0x180]
call fcn.1400d4d70
mov rcx, qword [rbp + 0x190]
call fcn.1400d4ce9
nop
mov rax, qword [rbp + 0x180]
jmp 0x14025b7e4
jmp 0x14025b71e
mov rcx, qword [rbp + 0x180]
call fcn.1400d525c
mov rcx, qword [rbp + 0x190]
call fcn.1400d4ce9
nop
mov rax, qword [rbp + 0x180]
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x1400d82e0
Capabilities:
Write file on windows

Disassembly:
jmp 0x14024bac0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x14031bec0]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x14033b49b]
call fcn.1400d83bc
nop
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x14024bb27
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14024bb2e
mov al, 1
jmp 0x14024bc9e
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.1400d529d
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.1400d529d
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.1400d7520
movzx eax, al
test eax, eax
je 0x14024bb91
xor al, al
jmp 0x14024bc9e
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x14024bc04
cmp dword [rbp + 0x160], 1
je 0x14024bc0f
cmp dword [rbp + 0x160], 3
je 0x14024bc8d
jmp 0x14024bc9c
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14024bc5f
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14024bc5f
xor al, al
jmp 0x14024bc9e
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14024bc7a
mov dword [rbp + 0x154], 1
jmp 0x14024bc84
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14024bc9e
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14024bc9e
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1402e7640]
call fcn.1400d77cd
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.1400d60b7
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x1400d8371
Capabilities:
Parse pe header

Disassembly:
jmp 0x14026d790
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14033b632]
call fcn.1400d83bc
nop
mov rax, qword [rbp + 0x120]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14026d7cd
xor eax, eax
jmp 0x14026d7fa
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0x4550
je 0x14026d7f6
xor eax, eax
jmp 0x14026d7fa
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400d8727
Capabilities:
Unload driver

Disassembly:
jmp 0x1402804d5
jmp qword [sym.imp.ntdll.dll_NtUnloadDriver]

Function at 0x1400d8880
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140258290
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x278]
mov rax, qword [0x14031bec0]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x14033b488]
call fcn.1400d83bc
nop
xor edx, edx
mov ecx, 2
call fcn.1400d6008
mov qword [rbp + 0x158], rax
mov dword [rbp + 0x10], 0x130
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x158]
call fcn.1400d775a
test eax, eax
je 0x14025834d
mov rdx, qword [rbp + 0x250]
lea rcx, [rbp + 0x3c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140258339
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x18]
mov dword [0x1403248a0], eax
mov eax, dword [rbp + 0x18]
jmp 0x14025835d
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x158]
call fcn.1400d8402
test eax, eax
jne 0x140258308
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402e1f30]
call fcn.1400d77cd
mov rax, rdi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.1400d60b7
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret

Function at 0x1400d888a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x14027a8f0
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rdx, qword [rsp + 0x70]
mov ecx, 0x105
call fcn.1400d5ca2
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x14027a92f
mov dword [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
jmp 0x14027a9d1
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0xffffffff
je 0x14027a950
mov eax, dword [rsp + 0x24]
and eax, 0x10
test eax, eax
jne 0x14027a967
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], 0xffffffff
mov rax, qword [rsp + 0x34]
jmp 0x14027a9d1
mov eax, dword [rsp + 0x24]
and eax, 0x400
test eax, eax
je 0x14027a9bc
mov r9d, 0x2000000
mov r8d, 0x80
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400d6139
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x50]
call fcn.1400d49ec
nop
cmp dword [rsp + 0x28], 0
je 0x14027a9bc
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], 0xffffffff
mov rax, qword [rsp + 0x3c]
jmp 0x14027a9d1
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], 0
mov rax, qword [rsp + 0x44]
add rsp, 0x68
ret

Function at 0x1400d89f2
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140263210
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14033b48c]
call fcn.1400d83bc
nop
movsx eax, byte [rbp + 0xe8]
mov ecx, dword [rbp + 0xe0]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x14027d7e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400d8600
movzx eax, al
test eax, eax
jne 0x14027d800
mov ecx, 7
call fcn.1400d783b
nop
mov byte [rsp + 0x20], 0
call fcn.1400d794e
mov byte [rsp + 0x21], al
cmp dword [0x140325518], 1
jne 0x14027d824
mov ecx, 7
call fcn.1400d783b
nop
jmp 0x14027d87c
cmp dword [0x140325518], 0
jne 0x14027d877
mov dword [0x140325518], 1
lea rdx, [0x14028d908]
lea rcx, [0x14028d5d8]
call fcn.1400d5fe5
test eax, eax
je 0x14027d858
mov eax, 0xff
jmp 0x14027d981
lea rdx, [0x14028d4c8]
lea rcx, [section..rdata]
call fcn.1400d7917
mov dword [0x140325518], 2
jmp 0x14027d87c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400d775f
call fcn.1400d706b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14027d8d9
mov rcx, qword [rsp + 0x30]
call fcn.1400d59dc
movzx eax, al
test eax, eax
je 0x14027d8d9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14033d020]
nop
call fcn.1400d735e
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14027d90d
mov rcx, qword [rsp + 0x38]
call fcn.1400d59dc
movzx eax, al
test eax, eax
je 0x14027d90d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400d81aa
nop
call fcn.14027d9f0
mov dword [rsp + 0x28], eax
call fcn.1400d6eb3
movzx eax, al
test eax, eax
jne 0x14027d92c
mov ecx, dword [rsp + 0x28]
call fcn.1400d4532
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14027d93b
call fcn.1400d8268
nop
xor edx, edx
mov cl, 1
call fcn.1400d585b
mov eax, dword [rsp + 0x28]
jmp 0x14027d981
add rsp, 0x68
ret
Function at 0x140001000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
and dword [rax - 0x18], 0
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
test rax, rax
jne 0x14000104f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000113c
mov ebx, eax
jmp 0x140001115
cmp dword [rsp + 0x20], 1
jle 0x1400010fa
mov rdx, qword [rax + 8]
lea rcx, str._verb
call fcn.140001124
test eax, eax
je 0x1400010fa
xor r14d, r14d
cmp dword [rsp + 0x20], 4
jl 0x1400010fa
mov rdx, qword [rsi + 0x18]
lea rcx, str._genverb
mov rbp, qword [rsi + 0x10]
lea ebx, [r14 + 3]
call fcn.140001124
test eax, eax
je 0x1400010a8
cmp dword [rsp + 0x20], 6
jne 0x1400010fa
mov r14, qword [rsi + 0x20]
mov ebx, 5
lea eax, [rbx + 1]
cmp eax, dword [rsp + 0x20]
jne 0x1400010fa
mov ecx, ebx
mov rcx, qword [rsi + rcx*8]
call fcn.1400035f0
mov rdi, rax
test rax, rax
jne 0x1400010cb
mov ebx, 0x80004005
jmp 0x1400010ff
mov rcx, qword [rax]
lea rdx, [rax + 0x10]
call fcn.140003da0
mov r9, qword [rdi + 0x10]
test r9, r9
jne 0x1400010e7
test r14, r14
cmovne rbp, r14
mov rdx, qword [rdi + 8]
mov r8, rbp
mov rcx, qword [rdi]
call fcn.140004e64
mov ebx, eax
jmp 0x1400010ff
mov ebx, 0x80070057
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test rdi, rdi
je 0x140001115
mov rcx, rdi
call fcn.140003734
shr ebx, 0x1f
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140002324
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x178]
sub rsp, 0x270
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor esi, esi
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], rsi
mov r9d, 0x20019
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ddeexecApplication
mov ebx, esi
mov rdi, rcx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400023e6
movzx eax, byte [rsp + 0x50]
lea r9, [rsp + 0x34]
cmp dword [rsp + 0x34], 1
mov rcx, qword [rsp + 0x38]
cmove eax, esi
xor r8d, r8d
mov byte [rsp + 0x50], al
xor edx, edx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400023e6
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140002f6c
mov rbx, rax
test rax, rax
jne 0x1400024b7
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0x208
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x1400097f0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400024b7
movzx eax, byte [rsp + 0x50]
lea r9, [rsp + 0x34]
cmp dword [rsp + 0x34], 1
mov rcx, qword [rsp + 0x40]
cmove eax, esi
xor r8d, r8d
mov byte [rsp + 0x50], al
xor edx, edx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400024b7
lea rcx, [rsp + 0x50]
call fcn.140002e50
test rax, rax
jne 0x140002486
lea rax, [rsp + 0x50]
mov ecx, esi
cmp word [rsp + 0x50], si
je 0x14000247f
lea rax, [rax + 2]
inc ecx
cmp word [rax], si
jne 0x140002474
mov eax, ecx
lea rax, [rsp + rax*2 + 0x50]
lea rcx, [rbp + 0x158]
cmp rax, rcx
jae 0x1400024b7
mov word [rax], si
lea rcx, [rsp + 0x50]
cmp rax, rcx
jbe 0x1400024a9
sub rax, 2
cmp word [rax], 0x5c
jne 0x140002495
lea rcx, [rax + 2]
xor edx, edx
call fcn.140002f6c
mov rbx, rax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400024c7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], rsi
test rcx, rcx
je 0x1400024dc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400070a0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000257c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov rdi, rcx
xor r14d, r14d
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 0xc8
lea rdx, str.open
call fcn.14000272c
test eax, eax
jne 0x1400026ed
lea rdx, str.edit
mov rcx, rdi
call fcn.14000272c
test eax, eax
jne 0x1400026ed
mov rcx, rdi
lea ebx, [rax + 1]
test rdi, rdi
je 0x140002617
mov eax, r14d
cmp word [rdi], r14w
je 0x140002608
lea rcx, [rcx + 2]
add eax, ebx
cmp word [rcx], r14w
jne 0x1400025fc
cmp eax, 0x104
jbe 0x140002617
mov ebx, r14d
jmp 0x1400026f2
mov esi, 0x10c
mov r8d, esi
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.140002ef0
lea rcx, [rbp + 0x10]
cmp word [rbp + 0x10], r14w
je 0x140002645
add rcx, 2
add esi, 0xffffffff
je 0x140002654
cmp word [rcx], r14w
jne 0x140002636
mov r8d, esi
lea rdx, [0x140009a50]
call fcn.140002ef0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x10]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000260f
movzx eax, byte [rsp + 0x40]
cmp dword [rsp + 0x34], ebx
cmove eax, r14d
mov byte [rsp + 0x40], al
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000260f
lea rdx, str.open
lea rcx, [rsp + 0x40]
call fcn.14000272c
test eax, eax
jne 0x1400026f2
lea rdx, str.edit
lea rcx, [rsp + 0x40]
call fcn.14000272c
test eax, eax
jne 0x1400026f2
jmp 0x14000260f
mov ebx, 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140002702
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.1400070a0
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400033e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x30
xor r14d, r14d
lea rsi, [rcx + 0x10]
mov eax, dword [rsi]
xor edi, edi
mov rbx, rcx
lea r12d, [r14 + 1]
cmp dword [rcx + 0x14], eax
jne 0x14000357d
mov edx, 0x802
xor ecx, ecx
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x14000358e
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx + 0x30]
mov r9, rsi
mov r8d, 0x800
mov rdx, rdi
test rcx, rcx
jne 0x14000346b
mov rcx, qword [rbx]
and qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140003580
jmp 0x140003480
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x140009308]
test eax, eax
js 0x140003580
mov ecx, dword [rsi]
test ecx, ecx
je 0x140003580
cmp dword [rbx + 0x20], ebp
jne 0x1400034c8
mov al, byte [rdi]
cmp al, 0xff
jne 0x14000349b
cmp byte [rdi + 1], 0xfe
je 0x1400034bd
cmp al, 0x3c
jne 0x1400034a5
cmp byte [rdi + 1], bpl
je 0x1400034bd
cmp al, 0xfe
jne 0x1400034af
cmp byte [rdi + 1], 0xff
je 0x1400034b9
test al, al
jne 0x1400034c1
cmp byte [rdi + 1], 0x3c
jne 0x1400034c1
mov dword [rbx + 0x28], r12d
mov dword [rbx + 0x24], r12d
mov ebp, r12d
mov dword [rbx + 0x20], r12d
cmp dword [rbx + 0x24], r14d
je 0x1400034d2
shr ecx, 1
mov dword [rsi], ecx
cmp dword [rbx + 0x28], r14d
je 0x140003505
mov eax, dword [rsi]
xor r8d, r8d
lea r9d, [rax*2 - 2]
test r9d, r9d
je 0x140003505
mov cl, byte [r8 + rdi]
mov al, byte [r8 + rdi + 1]
mov byte [r8 + rdi], al
mov byte [r8 + rdi + 1], cl
add r8d, 2
cmp r8d, r9d
jb 0x1400034ea
cmp dword [rbx + 0x24], r14d
je 0x140003522
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14000351a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbx + 0x18], rdi
xor edi, edi
jmp 0x140003569
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14000c78c], eax
jg 0x1400035aa
mov rax, qword [rbx + 0x18]
mov r8, rdi
mov r9d, dword [rsi]
xor edx, edx
mov ecx, dword [0x14000c790]
mov dword [rsp + 0x28], 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsi], eax
test eax, eax
je 0x140003580
test ebp, ebp
je 0x140003578
cmp dword [rbx + 0x24], r14d
je 0x140003578
mov eax, r12d
jmp 0x14000357a
xor eax, eax
mov dword [rbx + 0x14], eax
mov r14d, r12d
test rdi, rdi
je 0x14000358e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x50]
mov eax, r14d
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
lea rcx, [0x14000c78c]
call fcn.140007218
cmp dword [0x14000c78c], 0xffffffff
jne 0x14000353e
call qword [sym.imp.KERNEL32.dll_GetACP]
lea rcx, [0x14000c78c]
mov dword [0x14000c790], eax
call fcn.1400071b8
jmp 0x14000353e
Function at 0x14000377c
Capabilities:
Download url
Parse url
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x4310]
mov eax, 0x4410
call fcn.140008520
sub rsp, rax
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x4300], rax
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x68]
call sub.VCRUNTIME140.dll_memset
xor ebx, ebx
test rdi, rdi
je 0x1400037ce
mov eax, ebx
cmp word [rdi], bx
jne 0x1400037d3
mov eax, 1
test eax, eax
jne 0x14000391a
lea r8d, [rax + 7]
mov rdx, rdi
lea rcx, str.http:__
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14000382b
mov r8d, 8
lea rcx, str.https:__
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x14000382b
mov r8d, 6
lea rcx, str.ftp:__
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14000391a
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp word [rax], bx
je 0x14000383d
add rax, 2
lea r9, [rbp - 0x50]
mov dword [rsp + 0x20], ebx
mov r8, rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WININET.dll_CreateUrlCacheEntryW]
test eax, eax
je 0x14000391a
lea rax, [rbp + 0x1c0]
mov word [rbp + 0x1210], bx
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x40]
lea rax, [rbp + 0x1210]
mov word [rbp + 0x1c0], bx
mov qword [rbp - 0x78], rax
xor r8d, r8d
lea rax, [rbp + 0x2260]
mov word [rbp + 0x2260], bx
xor edx, edx
mov qword [rbp - 0x68], rax
mov rcx, rdi
mov dword [rsp + 0x40], 0x68
mov dword [rsp + 0x60], 0x825
mov dword [rbp - 0x70], 0x825
mov dword [rbp - 0x60], 0x825
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x1400038ef
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0x825
lea r8, [rbp + 0x32b0]
mov edx, 0x80000000
lea rcx, [rsp + 0x40]
call qword [sym.imp.WININET.dll_InternetCreateUrlW]
test eax, eax
je 0x14000391a
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, [rbp - 0x50]
xor ecx, ecx
lea rdx, [rbp + 0x32b0]
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x14000391a
lea rcx, [rbp - 0x50]
call fcn.1400069c8
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp + 0x4300]
xor rcx, rsp
call fcn.1400070a0
lea r11, [rsp + 0x4410]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140004540
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
xor r15d, r15d
mov rsi, rdx
mov qword [rbp + 0x48], r15
mov r14, rcx
mov dword [rbp + 0x30], r15d
test rcx, rcx
je 0x140004572
mov eax, r15d
cmp word [rcx], r15w
jne 0x140004577
mov eax, 1
test eax, eax
je 0x140004585
mov ebx, 0x80070057
jmp 0x1400046c4
test rsi, rsi
je 0x14000457b
cmp qword [rdx], r15
jne 0x14000457b
lea rax, [rbp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftSharedXMLAlternateProgIDs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
mov edi, 0x80070000
or ebx, edi
test eax, eax
cmovle ebx, eax
cmp ebx, 0x80070002
jne 0x1400045d4
mov ebx, r15d
jmp 0x1400046c4
test ebx, ebx
js 0x1400046c4
mov rcx, qword [rbp + 0x48]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rdx, r14
mov dword [rbp + 0x40], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
mov eax, r15d
test ebx, ebx
cmovns eax, dword [rbp + 0x40]
mov dword [rbp + 0x40], eax
cmp ebx, 0x80070002
je 0x1400045cc
dec eax
mov ecx, r15d
cmp eax, 1
setbe cl
test ecx, ecx
je 0x1400045cc
mov eax, dword [rbp + 0x30]
cmp eax, 2
jbe 0x1400045cc
test ebx, ebx
js 0x1400046c4
add eax, 2
xor ecx, ecx
mov edx, eax
mov dword [rbp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
jne 0x14000465e
mov ebx, 0x8007000e
jmp 0x1400046c4
mov r8d, dword [rbp + 0x30]
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp + 0x48]
lea rax, [rbp + 0x30]
add dword [rbp + 0x30], 0xfffffffe
lea r8, [rbp + 0x40]
mov r9, rdi
mov qword [rsp + 0x20], rax
mov rdx, r14
call fcn.1400046e8
mov ebx, eax
cmp eax, 0x80070002
jne 0x14000469a
mov ebx, r15d
jmp 0x1400046b6
mov eax, dword [rbp + 0x40]
mov ecx, r15d
dec eax
cmp eax, 1
setbe cl
test ecx, ecx
je 0x140004695
test ebx, ebx
js 0x1400046b6
mov qword [rsi], rdi
mov rdi, r15
test rdi, rdi
je 0x1400046c4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x1400046d3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret