joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140165540
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rsi, r8
mov rdi, rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov byte [rdx], 1
call fcn.140185f60
mov r8, rax
lea r9, [rsp + 0x38]
xor edx, edx
lea rcx, [0x14052b620]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x1401655c0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, str.windows:_could_not_open_default_folder_Local_App_Data..._
lea r8, str.WINDOWSGAMEPROVIDER
call fcn.1400d1eb0
xor al, al
jmp 0x140165787
lea rcx, [rsp + 0x70]
call fcn.14013a6d0
nop
mov rdx, qword [rsp + 0x38]
lea rcx, [rbp - 0x80]
call fcn.140158340
mov rcx, rax
lea rdx, str.Packages
call fcn.140158340
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r14w
mov dword [rsp + 0x30], 2
mov rcx, qword [rbp - 8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140165644
mov rax, qword [rbp - 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140165644
mov rax, qword [rbp - 0x58]
mov r9, qword [rax]
cmp rdx, qword [rbp - 0x10]
cmovb rdx, qword [rbp - 0x10]
jmp 0x140165667
test cl, 4
jne 0x1401656a3
mov rax, qword [rbp - 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1401656a3
mov rax, qword [rbp - 0x60]
mov r9, qword [rax]
mov rax, qword [rbp - 0x28]
movsxd rcx, dword [rax]
lea rdx, [rdx + rcx*2]
sub rdx, r9
mov rax, r9
sar rdx, 1
test rax, rax
je 0x1401656a3
lea rcx, [rbp + 0x70]
cmp rdx, 7
ja 0x14016569d
mov qword [rbp + 0x80], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.14043cc20
mov word [rbp + rbx + 0x70], r14w
jmp 0x1401656a3
call fcn.140102e90
nop
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.1401846b0
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x1401656f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401656f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401657aa
call fcn.1403e3650
mov r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140165e10
movzx esi, al
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140165779
mov rdi, qword [rsp + 0x48]
cmp rbx, rdi
je 0x140165736
nop dword [rax]
mov rcx, rbx
call fcn.1400c6440
add rbx, 0x20
cmp rbx, rdi
jne 0x140165720
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140165763
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401657a4
mov rcx, rbx
call fcn.1403e3650
mov qword [rsp + 0x40], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x70]
call fcn.1401367c0
movzx eax, sil
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1403e3630
add rsp, 0x1a0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1403fd768
nop
call fcn.1403fd768
int3
Function at 0x140176930
Capabilities:
Read http header
Receive http response

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov r9d, 4
mov dword [rsp + 0x30], 0x493e0
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
lea r8, [rsp + 0x30]
mov rcx, qword [rcx + 0x18]
lea edx, [r9 + 2]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x14017697c
lea r9, str.http:_error_setting_timeout
lea r8, str.WINHTTP_CONNECTION
lea edx, [rax + 4]
call fcn.1400c6f10
mov rcx, qword [rdi + 0x18]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x1401769bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f00
jne 0x1401769b1
lea r9, str.http:_need_to_resend_request...
mov edx, 2
lea r8, str.WINHTTP_CONNECTION
call fcn.1400c6f10
xor al, al
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rdi + 0x18]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x68], rbp
mov r9, rbx
xor ebp, ebp
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x28], rbp
xor r8d, r8d
mov edx, 0x20000013
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x140176a0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x78], eax
lea r9, str.http:_WinHttpQueryHeaders_Error_:_
lea rax, [rsp + 0x78]
jmp 0x140176aa2
mov dword [rsp + 0x60], ebp
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0x60]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x140176a8c
mov ecx, dword [rsp + 0x60]
mov dword [rsp + 0x78], ebp
call fcn.1403e38dc
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x78]
mov rcx, qword [rdi + 0x18]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x140176a7d
mov r8d, dword [rsp + 0x78]
lea rcx, [rsi + 0x10]
mov rdx, rbx
call fcn.140176ce0
mov rcx, rbx
call fcn.1403e3650
cmp dword [rsp + 0x60], ebp
ja 0x140176a11
mov rbp, qword [rsp + 0x68]
mov al, 1
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.http:_WinHttpReadData_Error_:_
jmp 0x140176a99
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.http:_WinHttpQueryDataAvailable_Error_:_
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x38]
lea r8, str.WINHTTP_CONNECTION
mov qword [rsp + 0x20], rax
mov edx, 4
call fcn.1400d1640
mov rbp, qword [rsp + 0x68]
xor al, al
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401853f0
Capabilities:
Get local ipv4 addresses

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14, rcx
mov qword [r11 - 0x68], rcx
xor ecx, ecx
mov dword [rsp + 0x30], ecx
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], rcx
mov qword [r14 + 0x18], recv
mov byte [r14], cl
mov dword [rsp + 0x30], 1
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_61201026f9a6d3660b236af9097c2d09___bool__struct__IP_ADAPTER_ADDRESSES_LH_const____ptr64_.0
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], r14
lea rax, [r11 - 0x58]
mov qword [r11 - 0x20], rax
mov dword [rsp + 0x34], 0x3c00
movdqu xmmword [rsp + 0x38], xmm0
mov qword [r11 - 0x70], rcx
mov ecx, 0x3c27
call fcn.1403e3660
test rax, rax
je 0x14018559c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov qword [rsp + 0x38], rdi
lea rsi, [rdi + 0x3c00]
mov qword [rsp + 0x48], rsi
xor edx, edx
mov r8d, 0x3c00
mov rcx, rdi
call fcn.14043d3a0
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9, rdi
xor r8d, r8d
mov edx, 0x88
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
test eax, eax
jns 0x1401854f0
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x14018559c
mov edx, 0x3c27
jmp 0x140185544
mov rbx, rdi
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140185596
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
je 0x14018551a
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1401854f3
sub rsi, rdi
cmp rsi, 0x1000
jb 0x14018553e
add rsi, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x14018559c
mov rdi, rcx
mov rdx, rsi
mov rcx, rdi
call fcn.1403e3650
nop
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140185569
mov r8, qword [rcx]
lea rax, [rsp + 0x60]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
mov rax, r14
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1403e3630
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call fcn.1403c2348
nop
call fcn.1403fd768
int3
Function at 0x140185e10
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov edi, ecx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x140185e9e
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x30]
call fcn.14043d3a0
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140185e9e
nop dword [rax]
cmp dword [rsp + 0x38], edi
je 0x140185e9a
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140185e80
jmp 0x140185e9e
mov esi, dword [rsp + 0x50]
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140185eb1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1403e3630
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140186060
Capabilities:
Get session information

Disassembly:
sub rsp, 0x38
call fcn.140185ee0
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x140186095
lea rax, [rsp + 0x40]
lea r9, str.utils:_active___could_not_get_current_session_id:_
mov qword [rsp + 0x20], rax
lea r8, str.UTILS
call fcn.140102bc0
xor al, al
add rsp, 0x38
ret
lea rcx, [rsp + 0x48]
mov r8d, 8
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
xor ecx, ecx
mov edx, eax
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401860cd
test eax, eax
je 0x1401860cd
cmp dword [rcx], 0
sete al
add rsp, 0x38
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
lea r9, str.registry:_error_while_querying_session_informations:_
lea rax, [rsp + 0x40]
mov edx, 4
lea r8, str.UTILS
mov qword [rsp + 0x20], rax
call fcn.1400d1640
xor al, al
add rsp, 0x38
ret
Function at 0x140186bd0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ebx, ecx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
call fcn.14043d3a0
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140186c56
nop dword [rax + rax]
cmp dword [rsp + 0x40], ebx
jne 0x140186c44
mov ecx, dword [rsp + 0x28]
mov edx, recv
call fcn.140186bd0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140186c30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, recv
mov ecx, ebx
call fcn.140186c90
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1403e3630
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret

Function at 0x140186c90
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov edi, edx
test ecx, ecx
jne 0x140186ca8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x140186cb8
mov r8d, ecx
xor edx, edx
mov ecx, 0x401
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140186cf7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
lea r9, str.failed_to_exit_process_properly__could_not_open_handle...___
lea rax, [rsp + 0x50]
lea r8, str.UTILS
mov qword [rsp + 0x20], rax
lea edx, [rbx + 4]
call fcn.1400d1640
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rsp + 0x40], 1
cmp edi, 0x1c
ja 0x140186dd7
cmp edi, 0xf
ja 0x140186dd7
mov eax, 0x8204
bt eax, edi
jae 0x140186dd7
mov edx, 0x7f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140186d43
xor edi, edi
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140186d70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jne 0x140186d5f
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140186d70
cmp eax, 5
jne 0x140186db8
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140186dae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
lea r9, str.GetExitCodeProcess___failed_
lea rax, [rsp + 0x50]
mov edx, 4
lea r8, str.UTILS
mov qword [rsp + 0x20], rax
call fcn.1400d1640
cmp dword [rsp + 0x40], 0x103
je 0x140186d70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140186dca
cmp edi, 5
jne 0x140186de0
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x48]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x14018a0b0
Capabilities:
Start service

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14018a109
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x14018a109
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
lea r9, str.service:_internal_service_start_failed__err:_
lea rax, [rsp + 0x50]
mov edx, 4
lea r8, str.InstallService
mov qword [rsp + 0x20], rax
call fcn.1400d1640
xor al, al
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0xbc2]
cmp ecx, 1
jbe 0x14018a121
cmp eax, 0x669
jne 0x14018a124
mov byte [rbx], 1
mov al, 1
add rsp, 0x30
pop rbx
ret

Function at 0x14018a130
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
lea r8, [rsp + 0x38]
mov rdi, rdx
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov dword [rsp + 0x50], eax
mov rbx, rcx
lea edx, [rax + 1]
movups xmmword [rsp + 0x38], xmm0
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14018a1b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
jne 0x14018a188
mov al, 1
jmp 0x14018a266
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r9, str.ControlService_SERVICE_CONTROL_STOP__failed_w_err_
lea rax, [rsp + 0x30]
mov edx, 4
lea r8, str.InstallService
mov qword [rsp + 0x20], rax
call fcn.1400d1640
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0xbc2]
cmp ecx, 1
jbe 0x14018a1cc
cmp eax, 0x669
jne 0x14018a1cf
mov byte [rdi], 1
mov eax, dword [rsp + 0x3c]
cmp eax, 1
je 0x14018a263
lea r9, str.Stopping_service
mov edx, 2
lea r8, str.InstallService
call fcn.1400c6f10
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.Progress__.
call fcn.140189920
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14018a250
nop dword [rax]
cmp dword [rsp + 0x3c], 3
jne 0x14018a250
lea rcx, [0x1405785d0]
call fcn.140189920
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14018a220
lea rcx, [0x1405786c8]
call fcn.140189920
mov eax, dword [rsp + 0x3c]
cmp eax, 1
sete al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1403e3630
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x14018c110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x14018c2a1
mov r15, qword [rsp + 0x60]
lea r8d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r9d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x14018c2a1
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r8w, dx
jae 0x14018c1ab
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x14018c2c8
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x14018c1c2
mov eax, ecx
add cx, r11w
cmp cx, r9w
ja 0x14018c1c2
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x14018c1d5
movzx r9d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x14018c222
mov r9d, eax
cmp eax, 0x800
jae 0x14018c1ef
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov r11d, r8d
jmp 0x14018c222
cmp eax, 0x10000
jae 0x14018c209
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov r11d, r10d
jmp 0x14018c222
shr r9d, 0x12
mov r10d, 3
movzx r11d, sil
or r9b, 0xf0
xor r11d, 1
add r11d, r11d
lea r8d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r8d
cmp rdx, rcx
jl 0x14018c2a1
add qword [r14], 2
test sil, sil
jne 0x14018c243
cmp r10d, 3
jae 0x14018c24f
mov rcx, qword [rbx]
mov r8d, r11d
mov byte [rcx], r9b
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jle 0x14018c27e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jg 0x14018c260
shr eax, 0xa
mov r8d, 1
test sil, sil
mov ecx, r8d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x14018c15f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x14018c2af
Function at 0x1401916f0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rsp + 0xe8], rax
xorps xmm0, xmm0
movups xmmword [r11 - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [r11 - 0x40], xmm1
mov r8d, 0x26
lea rdx, str.SOFTWAREBlade_GroupShadowProcessator
lea rcx, [r11 - 0x50]
call fcn.1400c71d0
nop
xor edi, edi
mov qword [rsp + 0x50], rdi
lea rdx, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 7
cmova rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14019192b
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rbx
mov rdx, qword [rsp + 0xc0]
cmp rdx, 7
jbe 0x1401917e7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401917e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140191951
call fcn.1403e3650
movdqa xmm0, xmmword [0x14057a8b0]
movdqu xmmword [rsp + 0xb8], xmm0
mov word [rsp + 0xa8], di
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0xc8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xd8], xmm1
mov r8d, recv
lea rdx, str.ProcessatorPID
lea rcx, [rsp + 0xc8]
call fcn.1400c71d0
nop
mov dword [rsp + 0x50], edi
lea rdx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 7
cmova rdx, qword [rsp + 0xc8]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140191957
mov rdx, qword [rsp + 0xe0]
cmp rdx, 7
jbe 0x1401918cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401918c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140191983
call fcn.1403e3650
nop
test rbx, rbx
je 0x140191904
mov eax, 0x80000000
add rax, rbx
cmp rax, 5
jbe 0x140191904
cmp rbx, 0xffffffff80000007
je 0x140191904
cmp rbx, 0xffffffff80000060
je 0x140191904
cmp rbx, 0xffffffff80000050
je 0x140191904
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14019190a
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.1403e3630
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rdi
ret
mov r8d, eax
lea rdx, str.RegCreateKeyEx_failed.
lea rcx, [rsp + 0x68]
call fcn.1400d5280
lea rdx, [0x1405e62d8]
lea rcx, [rsp + 0x68]
call fcn.1403e644c
nop
call fcn.1403fd768
nop
mov r8d, eax
lea rdx, str.Cannot_write_DWORD_value:_RegSetValueEx_failed.
lea rcx, [rsp + 0x88]
call fcn.1400d5280
lea rdx, [0x1405e62d8]
lea rcx, [rsp + 0x88]
call fcn.1403e644c
nop
call fcn.1403fd768
int3
Function at 0x140191990
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rsp + 0xe8], rax
xorps xmm0, xmm0
movups xmmword [r11 - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [r11 - 0x40], xmm1
mov r8d, 0x26
lea rdx, str.SOFTWAREBlade_GroupShadowProcessator
lea rcx, [r11 - 0x50]
call fcn.1400c71d0
nop
xor edi, edi
mov qword [rsp + 0x50], rdi
lea rdx, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 7
cmova rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140191bc3
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rbx
mov rdx, qword [rsp + 0xc0]
cmp rdx, 7
jbe 0x140191a87
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140191a82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140191be9
call fcn.1403e3650
movdqa xmm0, xmmword [0x14057a8b0]
movdqu xmmword [rsp + 0xb8], xmm0
mov word [rsp + 0xa8], di
xorps xmm0, xmm0
movups xmmword [rsp + 0xc8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xd8], xmm1
mov r8d, recv
lea rdx, str.ProcessatorPID
lea rcx, [rsp + 0xc8]
call fcn.1400c71d0
nop
mov dword [rsp + 0x50], edi
lea rdx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 7
cmova rdx, qword [rsp + 0xc8]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140191bef
mov rdx, qword [rsp + 0xe0]
cmp rdx, 7
jbe 0x140191b65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140191b5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140191c1b
call fcn.1403e3650
nop
test rbx, rbx
je 0x140191b9c
mov eax, 0x80000000
add rax, rbx
cmp rax, 5
jbe 0x140191b9c
cmp rbx, 0xffffffff80000007
je 0x140191b9c
cmp rbx, 0xffffffff80000060
je 0x140191b9c
cmp rbx, 0xffffffff80000050
je 0x140191b9c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140191ba2
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.1403e3630
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rdi
ret
mov r8d, eax
lea rdx, str.RegCreateKeyEx_failed.
lea rcx, [rsp + 0x68]
call fcn.1400d5280
lea rdx, [0x1405e62d8]
lea rcx, [rsp + 0x68]
call fcn.1403e644c
nop
call fcn.1403fd768
nop
mov r8d, eax
lea rdx, str.Cannot_write_DWORD_value:_RegSetValueEx_failed.
lea rcx, [rsp + 0x88]
call fcn.1400d5280
lea rdx, [0x1405e62d8]
lea rcx, [rsp + 0x88]
call fcn.1403e644c
nop
call fcn.1403fd768
int3