joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rcx
mov qword [rbp - 0x29], rcx
xor r15d, r15d
mov dword [rbp - 0x39], r15d
mov dword [rbp - 0x19], 0x5f005f
mov dword [rbp - 0x15], 0x520043
mov dword [rbp - 0x11], 0x40005f
mov dword [rbp - 0xd], 0x410046
mov dword [rbp - 9], 0x4c0049
mov dword [rbp - 5], 0x440045
mov dword [rbp - 1], 0x44005f
mov dword [rbp + 3], 0x57004f
mov dword [rbp + 7], 0x4c004e
mov dword [rbp + 0xb], 0x41004f
mov dword [rbp + 0xf], 0x5f0044
mov dword [rbp + 0x13], 0x450052
mov dword [rbp + 0x17], 0x440041
mov dword [rbp + 0x1b], 0x5f0040
mov dword [rbp + 0x1f], 0x520043
mov dword [rbp + 0x23], 0x5f005f
mov word [rbp + 0x27], r15w
lea rdx, [rbp - 0x19]
call fcn.140001f2c
nop
mov dword [rbp - 0x39], 1
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400bcfc0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140022e74
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x320
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov r9d, dword [0x1401a8d80]
mov edi, edx
mov eax, 0x2aaaaaab
mov r8d, r9d
mov rbx, rcx
mov ebp, 1
imul r8d, r9d
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 7
jne 0x140022efb
xor ecx, ecx
lea rdx, [rsp + 0x50]
mov eax, dword [rdx]
add ecx, ebp
lea rdx, [rdx + 4]
imul eax, eax, 0xb9
add r9d, eax
movsxd rax, ecx
cmp rax, 0x2b8
jb 0x140022ed8
mov dword [0x1401a8d80], r9d
mov r8d, r9d
mov eax, 0x38e38e39
imul r8d, r9d
mov ecx, r8d
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xb
jne 0x140022fa1
mov eax, 0x78787879
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub r8d, edx
cmp r8d, 5
jne 0x140022f5a
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov rax, qword [str.lXvyMHnJ]
or r8, 0xffffffffffffffff
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov al, byte [0x14013a6d0]
mov rcx, r8
mov byte [rsp + 0x38], al
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140022f7c
mov eax, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400bc638
mov rcx, rax
call fcn.1400be0fc
mov dword [rbx + 0x38], edi
test edi, edi
jns 0x140022fcc
mov rcx, qword [rbx + 0x30]
and qword [rsp + 0x30], 0
and qword [rsp + 0x20], 0
mov rax, qword [rcx]
lea r8, [rbx + 0x3c]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [rax + 0x40]
mov rcx, qword [rbx + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edx, dword [0x1401a8d80]
lea ecx, [rdx + 2]
lea eax, [rdx + 1]
imul ecx, eax
imul ecx, edx
and ecx, 0x8000000f
jge 0x140022ff7
sub ecx, ebp
or ecx, 0xfffffff0
add ecx, ebp
cmp ecx, 7
jne 0x140023007
test edx, edx
cmove edx, ebp
mov dword [0x1401a8d80], edx
and qword [rbx + 0x30], 0
xor eax, eax
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1400bcfc0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140023d04
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
sub rsp, 0x2a0
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rcx, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140023d9b
mov ecx, dword [0x1401a8d80]
mov eax, 0x6bca1af3
mov r8d, ecx
imul r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub r8d, edx
cmp r8d, 9
jne 0x140023d8e
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
jmp 0x140023d9d
xor al, al
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400bcfc0
add rsp, 0x2a0
pop rbx
ret

Function at 0x140023db8
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x50
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rdi, rdx
and qword [rax - 0x28], 0
mov dword [rax - 0x30], 0x80
mov dword [rax - 0x38], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140023e66
mov ecx, dword [0x1401a8d80]
lea edx, [rcx + 2]
lea eax, [rcx + 1]
imul edx, eax
imul edx, ecx
and edx, 0x80000003
jge 0x140023e28
dec edx
or edx, 0xfffffffc
inc edx
cmp edx, 1
jne 0x140023e43
mov edx, RegisterTypeLib
lea r8d, [rdx + 1]
lea rcx, str._d__d_n
call fcn.1400bd8cc
nop
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x140023e5f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x140023ef3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and dword [rsp + 0x60], 0
mov rax, qword [rdi]
mov ebx, dword [rax - 0x10]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
or eax, ecx
jge 0x140023e9b
xor edx, edx
mov rcx, rdi
call fcn.1400021d0
lea r8d, [rbx + rbx]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov rdx, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
sete bl
mov rdx, qword [rdi]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140023ef1
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, bl
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140023f04
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rsp + 0x440], rax
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov rdi, rdx
mov edx, 0x80000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r9d, dword [0x1401a8d80]
lea ecx, [r9 + 1]
mov rbx, rax
lea r8d, [r9 + 2]
mov eax, 0x30c30c31
imul r8d, ecx
imul r8d, r9d
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 0x10
jne 0x140023fac
xor ecx, ecx
lea rdx, [rsp + 0x40]
mov eax, dword [rdx]
inc ecx
lea rdx, [rdx + 4]
imul eax, eax, 0xac
add r9d, eax
movsxd rax, ecx
cmp rax, 0x3fc
jb 0x140023f89
mov dword [0x1401a8d80], r9d
cmp rbx, 0xffffffffffffffff
jne 0x140023fb9
xor eax, eax
jmp 0x140024082
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov eax, eax
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, dword [0x1401a8d80]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 5
jne 0x140024074
jmp 0x14002406f
mov eax, r8d
and eax, 0x80000001
jge 0x140024013
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x14002402a
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x1401a8d80], eax
jmp 0x140024039
lea r8d, [r8*2 + 1]
mov dword [0x1401a8d80], r8d
mov eax, 0x55555556
mov ecx, r8d
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
je 0x14002405d
sub ecx, 2
je 0x140024061
dec ecx
je 0x140024064
jmp 0x14002406f
add r8d, 2
inc r8d
add r8d, 2
mov dword [0x1401a8d80], r8d
test r8d, r8d
jne 0x140024002
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400bcfc0
mov rbx, qword [rsp + 0x470]
add rsp, 0x450
pop rdi
ret
Function at 0x140024698
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
mov rcx, qword [rcx]
xor edi, edi
mov rsi, rdx
mov qword [rax - 0x18], rdi
mov dword [rax - 0x20], 0x80
lea r8d, [rdi + 2]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rax - 0x28], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002472e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rdx, qword [rsi]
mov dword [rsp + 0x50], edi
mov r8d, dword [rdx - 0x10]
lea r9, [rsp + 0x50]
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140024725
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dil, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov al, dil
add rsp, 0x40
pop rdi
ret
Function at 0x1400263e4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
lea rcx, str.Wininet.dll
mov rdi, r9
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
test rax, rax
jne 0x14002646f
mov r8d, dword [0x1401a8d80]
mov eax, 0x30c30c31
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0x11
jne 0x14002646b
mov edx, ebx
mov r9d, 8
mov ecx, edx
mov eax, edx
and ecx, 1
sar eax, 1
dec ecx
not ecx
and ecx, r8d
mov edx, ecx
xor edx, eax
dec r9
jne 0x14002643e
inc ebx
add r8d, edx
cmp ebx, 0x100
jl 0x140026436
mov dword [0x1401a8d80], r8d
xor eax, eax
jmp 0x140026498
lea rdx, str.HttpQueryInfoW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002646b
xor r8d, r8d
mov r9, rdi
mov rcx, rsi
lea edx, [r8 + 0x16]
mov qword [rsp + 0x20], rbx
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14002a6c0
Capabilities:
Get disk size

Disassembly:
push rbx
sub rsp, 0x30
mov r8d, dword [0x1401a8d80]
mov bl, 1
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xf
jne 0x14002a73b
mov ecx, r8d
mov eax, 0x92492493
xor ebx, ebx
imul ecx, r8d
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 0xc
jne 0x14002a73b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x1400387b8
Capabilities:
Get disk size

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rax - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
movsxd rdi, edx
mov rbx, rcx
and dword [rax - 0x28], 0
lea rcx, [rax + 0x18]
call fcn.14001a1f0
nop
mov dword [rsp + 0x30], 1
mov rdx, qword [rax]
xor eax, eax
test rdx, rdx
setne al
test eax, eax
jne 0x140038805
mov ecx, 0x80004005
call fcn.140001874
int3
lea r14, [rbx + 0xc8]
mov rax, qword [r14]
sub rdx, rax
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140038828
add rax, 2
test cx, cx
jne 0x140038812
xor eax, eax
jmp 0x14003882d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14003885a
call fcn.14001f584
test al, al
jne 0x14003885a
call fcn.14001fca4
test al, al
jne 0x14003885a
lea rcx, [rdi + rdi*4]
mov rax, qword [rbx + rcx*8 + 0xe8]
cmp dword [rax - 0x10], 0
je 0x14003885a
mov sil, 1
jmp 0x14003885d
xor sil, sil
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x30], eax
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140038882
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test sil, sil
jne 0x140038931
mov edx, edi
mov rcx, rbx
call fcn.140038950
test al, al
jne 0x1400388be
call fcn.1400385c8
test al, al
jne 0x140038931
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x140038931
mov edx, edi
mov rcx, rbx
call fcn.1400390ec
test al, al
je 0x140038931
call fcn.14001f584
test al, al
jne 0x140038910
call fcn.14001fca4
test al, al
jne 0x140038910
lea rcx, [rsp + 0x78]
call fcn.14001a1f0
nop
mov rdx, rax
mov rcx, r14
call fcn.140001ff8
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140038925
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140038925
mov r8d, 1
lea rdx, [0x140139da8]
mov rcx, r14
call fcn.1400020f0
lea rax, [rdi + rdi*4]
mov byte [rbx + rax*8 + 0xf0], 1
lea rax, [rdi*4 + 0x1a]
add rax, rdi
lea rax, [rbx + rax*8]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14003a450
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rsi, rcx
xor ebp, ebp
mov dword [rax - 0x18], ebp
mov r9d, dword [0x1401a8d80]
mov r8d, r9d
imul r8d, r9d
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub r8d, edx
lea edi, [rbp + 1]
cmp r8d, 0xb
jne 0x14003a4e2
mov edx, ebp
mov r8d, edx
mov r10d, 8
mov ecx, r8d
and ecx, edi
sub ecx, edi
not ecx
and ecx, r9d
mov eax, r8d
sar eax, 1
mov r8d, ecx
xor r8d, eax
sub r10, rdi
jne 0x14003a4b2
add r9d, r8d
add edx, edi
cmp edx, 0x100
jl 0x14003a4a9
mov dword [0x1401a8d80], r9d
mov rax, qword [0x1401aa148]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], bp
jne 0x14003a4ed
lea rdx, [0x1401aa148]
mov rcx, rsi
call fcn.140002bac
mov dword [rsp + 0x20], edi
mov ecx, dword [0x1401a8d80]
imul ecx, ecx
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 6
jne 0x14003a544
call fcn.1400bd978
mov ecx, dword [0x1401a8d80]
cmp ecx, eax
jne 0x14003a544
sub ecx, edi
mov dword [0x1401a8d80], ecx
test ebx, ebx
jns 0x14003a553
mov ecx, 0x80070057
call fcn.140001874
int3
mov rax, qword [rsi]
sub edi, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or edi, eax
jge 0x14003a56c
mov edx, ebx
mov rcx, rsi
call fcn.1400021d0
mov rax, qword [rsi]
cmp ebx, dword [rax - 0xc]
jg 0x14003a586
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rsi]
mov word [rax + rcx*2], bp
mov rax, rsi
jmp 0x14003a591
mov ecx, 0x80070057
call fcn.140001874
nop
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14003a5a8
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r8d, dword [0x1401a8d80]
mov eax, 0x4ec4ec4f
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 0xb
jne 0x14003a625
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400bc638
mov rcx, rax
call fcn.1400be0fc
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov r8d, dword [0x1401a8d80]
xor edi, edi
mov ebx, eax
movzx esi, al
mov eax, 0x78787879
imul r8d, r8d
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x11
sub r8d, edx
cmp r8d, 0xe
jne 0x14003a67d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401a8d80]
lea edx, [rdi + 7]
test rax, rax
cmove ecx, edx
mov dword [0x1401a8d80], ecx
cmp esi, 6
ja 0x14003a68d
jne 0x14003a692
shr bx, 8
cmp bl, 1
jbe 0x14003a692
mov edi, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov al, dil
add rsp, 0x20
pop rdi
ret
Function at 0x14003ba74
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rdx, qword [rcx]
mov rcx, qword [0x1401a3d48]
lea rax, [r11 + 8]
mov rsi, r8
mov r9d, 0xf003f
xor r8d, r8d
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
je 0x14003badb
call fcn.14003a368
test al, al
jne 0x14003bad4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor al, al
jmp 0x14003bbbb
mov rax, qword [rsi]
cmp dword [rax - 0x10], ebx
jne 0x14003baf8
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
jmp 0x14003bbab
mov r8d, dword [0x1401a8d80]
mov eax, 0x38e38e39
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 7
jne 0x14003bb69
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400bc638
mov rcx, rax
call fcn.1400be0fc
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x14003bbab
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x58]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete al
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14003c49c
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x60
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
xor ebp, ebp
mov qword [rax - 0x20], rbp
mov dword [rax - 0x18], ebp
mov qword [rax - 0x10], rbp
mov dword [rax - 0x40], 0x2001f
mov dword [rax - 0x48], 0x100
mov r8, qword [r8]
mov rdx, r9
lea rcx, [rax - 0x20]
call fcn.1400186cc
test eax, eax
je 0x14003c557
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
mov r8, qword [rdi]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400186cc
test eax, eax
je 0x14003c557
mov r8d, dword [0x1401a8d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 0xb
jne 0x14003c54a
dec r8d
mov dword [0x1401a8d80], r8d
mov dil, bpl
mov rbx, qword [rsp + 0x48]
jmp 0x14003c62a
mov rcx, qword [rsi]
mov eax, ebp
test rcx, rcx
setne al
mov rbx, qword [rsp + 0x48]
test eax, eax
jne 0x14003c570
lea edi, [rax + 0xd]
jmp 0x14003c5a4
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bp
jne 0x14003c574
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test rbx, rbx
je 0x14003c5ba
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebp
mov r8d, dword [0x1401a8d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 0xa
jne 0x14003c624
mov edx, ebp
mov r9d, edx
mov r10d, 8
mov ecx, r9d
and ecx, 1
dec ecx
not ecx
and ecx, r8d
mov eax, r9d
sar eax, 1
mov r9d, ecx
xor r9d, eax
dec r10
jne 0x14003c5f3
add r8d, r9d
inc edx
cmp edx, 0x100
jl 0x14003c5ea
mov dword [0x1401a8d80], r8d
test edi, edi
sete dil
test rbx, rbx
je 0x14003c63d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov al, dil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14003c920
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
mov rax, r9
mov rbx, rdx
mov rdi, rcx
and qword [rbp - 0x20], 0
and dword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov r9d, 0x2001f
mov r8, qword [r8]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.14001878c
test eax, eax
je 0x14003c9b6
mov eax, dword [0x1401a8d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 5
jne 0x14003c9aa
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor dil, dil
mov rbx, qword [rbp - 0x20]
jmp 0x14003ca4d
mov dword [rbp + 0x20], 4
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, qword [rbx]
mov rbx, qword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14003c9f5
mov eax, dword [rbp - 0x30]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
mov r8d, dword [0x1401a8d80]
imul r8d, r8d
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 0xa
jne 0x14003ca2f
lea ecx, [r8 - 6]
call fcn.1400bd778
mov edx, dword [0x1401a8d80]
mov dword [rax], edx
test rbx, rbx
je 0x14003ca43
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov qword [rbp - 0x20], rbx
and dword [rbp - 0x18], 0
test edi, edi
sete dil
test rbx, rbx
je 0x14003ca60
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x20], 0
and dword [rbp - 0x18], 0
mov al, dil
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x14003ca78
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
lea rcx, [r11 + 0x18]
mov rax, r9
mov rdi, rdx
mov rdx, qword [r8]
mov qword [r11 - 0x18], rcx
mov rcx, rax
mov r9d, 0x2001f
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14003cb21
mov r8d, dword [0x1401a8d80]
mov eax, 0x30c30c31
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xb
jne 0x14003cb1d
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400bc638
mov rcx, rax
call fcn.1400be0fc
xor al, al
jmp 0x14003cb99
mov rcx, qword [rdi]
mov rdx, qword [rsi]
mov r9d, 1
mov eax, dword [rcx - 0x10]
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [0x1401a8d80]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
and r8d, 0x8000000f
jge 0x14003cb83
dec r8d
or r8d, 0xfffffff0
inc r8d
cmp r8d, 7
jne 0x14003cb94
call fcn.1400bd978
mov dword [0x1401a8d80], eax
test edi, edi
sete al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret