joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140209bd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rdx]
lea r12, [rdx + 8]
test rax, rax
mov rcx, r12
cmove rcx, rax
mov edx, dword [rcx + 8]
xor ebp, ebp
test edx, edx
setne bpl
lea rbx, [rsi + 0x28]
xor ecx, ecx
cmp rax, 2
cmovb rbx, rcx
mov dword [rsp + 0x20], edx
mov edx, dword [rbx + 8]
mov dword [rsp + 0x24], edx
test edx, edx
mov edx, 2
cmove rdx, rbp
lea rbp, [rsi + 0x48]
cmp rax, 3
cmovb rbp, rcx
mov ebp, dword [rbp + 8]
test ebp, ebp
mov ebx, 3
cmove rbx, rdx
lea rdx, [rsi + 0x68]
cmp rax, 4
cmovb rdx, rcx
mov dword [rsp + 0x28], ebp
mov edx, dword [rdx + 8]
mov dword [rsp + 0x2c], edx
test edx, edx
mov edx, 4
cmove rdx, rbx
lea rbp, [rsi + 0x88]
cmp rax, 5
cmovb rbp, rcx
mov ebp, dword [rbp + 8]
test ebp, ebp
mov ebx, 5
cmove rbx, rdx
lea rdx, [rsi + 0xa8]
cmp rax, 6
cmovb rdx, rcx
mov dword [rsp + 0x30], ebp
mov edx, dword [rdx + 8]
mov dword [rsp + 0x34], edx
test edx, edx
mov edx, 6
cmove rdx, rbx
lea rbp, [rsi + 0xc8]
cmp rax, 7
cmovb rbp, rcx
mov ebp, dword [rbp + 8]
test ebp, ebp
mov ebx, 7
cmove rbx, rdx
lea rdx, [rsi + 0xe8]
cmp rax, 8
cmovb rdx, rcx
mov dword [rsp + 0x38], ebp
mov edx, dword [rdx + 8]
mov dword [rsp + 0x3c], edx
test edx, edx
mov edx, 8
cmove rdx, rbx
lea rbp, [rsi + 0x108]
cmp rax, 9
cmovb rbp, rcx
mov ebp, dword [rbp + 8]
test ebp, ebp
mov ebx, 9
cmove rbx, rdx
cmp rax, 0xa
lea rax, [rsi + 0x128]
cmovb rax, rcx
mov dword [rsp + 0x40], ebp
mov eax, dword [rax + 8]
mov dword [rsp + 0x44], eax
test eax, eax
mov r15d, 0xa
cmove r15, rbx
mov rbx, qword [r14]
lea r13, [r14 + 8]
test rbx, rbx
cmovne rbx, r13
mov rcx, rbx
mov rdx, r15
call fcn.140209330
mov edi, eax
test al, al
je 0x140209d7f
test r15, r15
je 0x140209d7f
mov ebp, 1
mov edx, dword [rsp + rbp*4 + 0x1c]
mov rcx, rbx
call fcn.140209330
mov edi, eax
test al, al
je 0x140209d7f
lea rax, [rbp + 1]
cmp rbp, r15
mov rbp, rax
jb 0x140209d61
test dil, dil
je 0x140209dcc
test r15, r15
je 0x140209dcc
xor ebp, ebp
xor edi, edi
mov rcx, r13
cmp qword [r14], rbp
ja 0x140209d97
xor ecx, ecx
mov rbx, r12
cmp qword [rsi], rbp
ja 0x140209da1
xor ebx, ebx
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
call fcn.140209130
test al, al
je 0x140209dcc
mov rcx, rbx
call fcn.140208b60
inc rbp
add r12, 0x20
add r13, 0x20
mov dil, 1
cmp rbp, r15
jb 0x140209d8b
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, edi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140221f70
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.1401b9cac
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140221fe0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.1401cd234
mov qword [rbx], rax
test rax, rax
je 0x140221fc7
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x140223690
Capabilities:
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.14015ff00
test al, al
jne 0x1402236b1
mov rcx, rsi
call fcn.14015ff00
test al, al
je 0x1402236ba
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x14022a470
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x50], rax
movaps xmm0, xmmword [0x14032f5c0]
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
lea rdx, str.MoveUnsafe
lea r8, str....._base_files_file_util_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r9d, 0x430
call fcn.140160630
xor ebx, ebx
mov rcx, rbp
mov rdx, rsi
xor r8d, r8d
call fcn.14016ac30
mov al, byte [rdi + 0x17]
test al, al
jns 0x14022a52f
cmp qword [rdi + 8], 0x103
jbe 0x14022a52f
lea rcx, [rsp + 0x40]
call fcn.14016ac90
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov cl, byte [r14 + 0x17]
test cl, cl
jns 0x14022a545
cmp qword [r14 + 8], 0x103
jbe 0x14022a545
xor ebx, ebx
jmp 0x14022a505
mov rdx, r14
test cl, cl
jns 0x14022a54f
mov rdx, qword [r14]
mov rcx, rdi
test al, al
jns 0x14022a559
mov rcx, qword [rdi]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x14022a505
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, rdi
call fcn.1400815f0
test al, al
jne 0x14022a589
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14022a541
mov rcx, rdi
mov rdx, r14
call fcn.14022a5a0
test al, al
jne 0x14022a505
jmp 0x14022a57f
Function at 0x140223f00
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x1403b4910], 0
je 0x140223f46
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x1403b48e8]
test rdi, rdi
je 0x140223fe7
test byte [0x1403a2248], 1
je 0x140223f29
cmp byte [rdi + 0x17], 0
jns 0x140223f68
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1403b4910], rax
inc rax
cmp rax, 1
ja 0x140223f29
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1401bd200
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1402240a6
xor esi, esi
jmp 0x140223f29
mov ecx, 0x18
call fcn.1401b9cac
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1401bd200
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x14032f5c0]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.14004bc00
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x14022404d
mov r8, qword [rdi + 8]
jmp 0x140224051
and r8d, 0x7f
mov rcx, rdi
mov dx, 0x5c
call fcn.14015cf90
cmp rax, 0xffffffffffffffff
je 0x14022408b
lea rcx, [rax + 1]
movzx edx, byte [rdi + 0x17]
test dl, dl
jns 0x140224161
cmp qword [rdi + 8], rax
jbe 0x140224171
mov rdx, qword [rdi]
mov qword [rdi + 8], rcx
mov word [rdx + rax*2 + 2], 0
lea rdx, str.debug.log
mov rcx, rdi
call fcn.14005d450
mov qword [0x1403b48e8], rdi
jmp 0x140223f56
mov rcx, qword [0x1403b48e8]
lea rdx, [rsp + 0x40]
call fcn.14005cdc0
mov rcx, qword [0x1403b48e8]
movzx eax, byte [rcx + 0x17]
test al, al
js 0x140224155
mov rdx, rcx
cmp word [rdx + rax*2 - 2], 0x5c
je 0x1402240e8
lea rdx, [0x1403304f0]
call fcn.14005d450
mov rcx, qword [0x1403b48e8]
lea rdx, str.debug.log
call fcn.14005d450
mov rcx, qword [0x1403b48e8]
cmp byte [rcx + 0x17], 0
jns 0x140224104
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1403b4910], rax
inc rax
cmp rax, 1
ja 0x140223f29
mov qword [0x1403b4910], 0
jmp 0x140223fe0
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
jmp 0x1402240cd
cmp rax, rdx
jae 0x140224171
mov byte [rdi + 0x17], cl
mov rdx, rdi
jmp 0x140224084
call fcn.1401d3c50
int3
Function at 0x140228a80
Capabilities:
Access the windows event log
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x858
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x850], rax
cmp byte [0x1403a2280], 0
je 0x140228c62
mov rdx, qword [0x1403b4aa8]
test rdx, rdx
je 0x140228c62
cmp byte [rdx + 0x17], 0
jns 0x140228aca
mov rdx, qword [rdx]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
test rax, rax
je 0x140228c8b
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140160650
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 0x18]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x60]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x14032f5c0]
movaps xmmword [rbx], xmm0
mov rdx, rbx
call fcn.14003afb0
mov eax, dword [rsi + 8]
mov r14w, 1
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x140228b3c
cmp eax, 1
je 0x140228b7f
test eax, eax
jne 0x140228ba8
mov r14w, 4
jmp 0x140228ba8
lea rdi, [rsp + 0x78]
mov r8d, 0x7d8
mov rcx, rdi
mov dl, 0xaa
call fcn.1401bd200
mov rcx, rdi
call fcn.1400d3930
lea rbp, [rsp + 0x48]
mov rcx, rdi
mov rdx, rbp
call fcn.140290230
movzx r8d, byte [rbp + 0x17]
test r8b, r8b
jns 0x140228b86
mov r8, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
jmp 0x140228b8a
mov r14w, 2
jmp 0x140228ba8
and r8d, 0x7f
lea rcx, [rsp + 0x60]
mov rdx, rbp
call fcn.14015be00
cmp byte [rsp + 0x5f], 0
jns 0x140228ba8
mov rcx, qword [rsp + 0x48]
call fcn.1401b9ce8
cmp byte [rsp + 0x77], 0
jns 0x140228bb4
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x48], 0
mov rcx, qword [0x1403b4ab8]
cmp byte [rcx + 0x17], 0
jns 0x140228bd2
mov rcx, qword [rcx]
lea rdx, [rsp + 0x48]
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x140228ca3
mov rax, qword [rsp + 0x48]
mov r9d, dword [0x1403b4ab4]
movzx r8d, word [0x1403b4ab0]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, r15
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
je 0x140228cbe
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140228c43
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [rsp + 0x77], 0
jns 0x140228c54
mov rcx, qword [rsp + 0x60]
call fcn.1401b9ce8
call fcn.140160650
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.140076510
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1401bb0d0
nop
add rsp, 0x858
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [rsi + 0x10]
lea rdx, str.___NOT_ADDED_TO_EVENTLOG__
mov r8d, 0x1a
call fcn.1401f9cc0
jmp 0x140228c62
lea rcx, [rsi + 0x10]
lea rdx, str.___ERROR_GETTING_USER_SID__
mov r8d, 0x1b
call fcn.1401f9cc0
jmp 0x140228be4
lea rcx, [rsi + 0x10]
lea rdx, str.___NOT_ADDED_TO_EVENTLOG__
mov r8d, 0x1a
call fcn.1401f9cc0
jmp 0x140228c33
Function at 0x140229930
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x50], rax
movaps xmm0, xmmword [0x14032f5c0]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x194
call fcn.140160630
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.14016ac30
mov al, byte [rsi + 0x17]
test al, al
jns 0x1402299c0
cmp qword [rsi + 8], 0x103
ja 0x1402299de
test al, al
jns 0x1402299c7
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.14016ac90
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, edi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14022a2c0
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd0
movaps xmmword [rsp + 0xc0], xmm6
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x60]
mov qword [rbx + 0x50], r12
movaps xmm6, xmmword [0x14032f5c0]
movaps xmmword [rbx + 0x40], xmm6
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
lea rdx, str.DoCopyFile
lea r8, str....._base_files_file_util_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r9d, 0x7d
call fcn.140160630
xor ebp, ebp
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
call fcn.14016ac30
mov rcx, rdi
call fcn.14015ff00
test al, al
je 0x14022a394
lea rcx, [rsp + 0x60]
call fcn.14016ac90
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, ebp
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, r15
call fcn.14015ff00
test al, al
je 0x14022a3a4
xor ebp, ebp
jmp 0x14022a35e
cmp byte [rdi + 0x17], 0
jns 0x14022a3b4
cmp qword [rdi + 8], 0x103
ja 0x14022a3a0
cmp byte [r15 + 0x17], 0
jns 0x14022a3c5
cmp qword [r15 + 8], 0x103
ja 0x14022a3a0
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x10], r12
movaps xmmword [rsi], xmm6
lea rdx, str.DoCopyFile
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x8a
call fcn.140160630
lea r8, [0x1403b4b18]
mov rcx, rsi
mov rdx, rbx
call fcn.1400d6e20
cmp byte [r15 + 0x17], 0
jns 0x14022a40e
mov r15, qword [r15]
movzx r8d, r14b
cmp byte [rdi + 0x17], 0
jns 0x14022a41b
mov rdi, qword [rdi]
mov rcx, rdi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14022a466
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x14022a450
mov eax, edi
and eax, 1
je 0x14022a450
mov edx, edi
and edx, 0xfffffffe
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
setne bpl
lea rcx, [rsp + 0x40]
call fcn.1400d6f30
jmp 0x14022a35e
xor ebp, ebp
jmp 0x14022a457
Function at 0x14022ade0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14022ae5f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14022ae64
test bl, bl
je 0x14022ae3b
cmp byte [rdi + 8], 0
je 0x14022aec0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov edx, esi
call fcn.1400844c0
mov sil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rdi]
jmp 0x14022ae0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x14022ae8c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14022ae91
xor esi, esi
jmp 0x14022ae48
mov rcx, qword [rdi]
jmp 0x14022ae79
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
je 0x14022aec8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14022ae3b
mov esi, dword [rsp + 0x24]
jmp 0x14022ae3b
mov rcx, qword [rdi]
jmp 0x14022ae30
mov rcx, qword [rdi]
jmp 0x14022aea8

Function at 0x14022bca0
Capabilities:
Delete registry key

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x70]
mov qword [rax], 0
mov r9d, 0x20019
or r9d, dword [rcx + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x14022bd06
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
lea rax, [rsp + 0x6c]
mov dword [rax], 0
mov rcx, qword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14022bcec
mov ebx, 0x91
cmp dword [rsp + 0x6c], 0
jne 0x14022bcec
mov r8d, dword [rdi + 8]
mov rcx, qword [rdi]
mov rdx, rsi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ebx, eax
jmp 0x14022bcec

Function at 0x14022bd80
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rax, qword [rsp + 0x60]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
add rsp, 0x38
ret
Function at 0x14022bdb0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, r8
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea r9, [rsp + 0x4c]
mov dword [r9], ntohl
lea rax, [rsp + 0x40]
mov qword [rax], 0
lea rdi, [rsp + 0x3c]
mov dword [rdi], 8
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x14022be1d
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, edi
add rsp, 0x58
pop rdi
pop rsi
ret
mov eax, dword [rsp + 0x4c]
and eax, 0xfffffff7
mov edi, 0x3f4
cmp eax, 3
jne 0x14022be07
cmp dword [rsp + 0x3c], 8
jne 0x14022be07
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
xor edi, edi
jmp 0x14022be07

Function at 0x14022be50
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret
Function at 0x140239850
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
movabs rax, 0x4000000000
mov qword [rcx + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov eax, 1
ret
Function at 0x14023d4d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov r15, r8
mov rsi, rdx
mov r14, rcx
mov r10d, dword [rsp + 0xe0]
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8d, dword [rcx + 0x18]
lea ecx, [r10 + 4]
mov edi, ecx
shr edi, 6
xor edx, edx
mov ebx, 0
cmp edi, r8d
jae 0x14023d52b
mov eax, edi
mov rbx, qword [r9 + rax*8]
shr rbx, cl
shl ebx, 5
and ebx, 0x20
lea ecx, [r10 + 3]
mov eax, ecx
shr eax, 6
cmp eax, r8d
jae 0x14023d548
mov eax, eax
mov rdx, qword [r9 + rax*8]
shr rdx, cl
shl edx, 4
and edx, 0x10
or edx, ebx
lea ecx, [r10 + 2]
mov eax, ecx
shr eax, 6
xor ebx, ebx
mov edi, 0
cmp eax, r8d
jae 0x14023d56e
mov eax, eax
mov rdi, qword [r9 + rax*8]
shr rdi, cl
shl edi, 3
and edi, 8
or edx, edi
lea ecx, [r10 + 1]
mov eax, ecx
shr eax, 6
cmp eax, r8d
jae 0x14023d58d
mov eax, eax
mov rbx, qword [r9 + rax*8]
shr rbx, cl
shl ebx, 2
and ebx, 4
or edx, ebx
mov eax, r10d
shr eax, 6
xor ebx, ebx
cmp eax, r8d
jae 0x14023d5ad
mov eax, eax
mov rbx, qword [r9 + rax*8]
mov ecx, r10d
shr rbx, cl
add ebx, ebx
and ebx, 2
or edx, ebx
test r10d, r10d
je 0x14023d5d5
dec r10d
mov eax, r10d
shr eax, 6
xor ecx, ecx
cmp eax, r8d
jae 0x14023d5d3
mov eax, eax
mov rax, qword [r9 + rax*8]
xor ecx, ecx
bt rax, r10
setb cl
or edx, ecx
mov r12d, edx
shr r12, 5
lea eax, [r12 - 1]
neg r12
and eax, edx
xor edx, 0x3f
mov edi, r12d
and edi, edx
or edi, eax
mov rax, rdi
shr rax, 1
and edi, 1
add rdi, rax
xor ebx, ebx
mov r8d, 0xd8
mov rcx, rsi
xor edx, edx
call fcn.1401bd200
mov r8, rbx
xor r8, rdi
dec r8
sar r8, 0x3f
mov qword [rsp + 0x20], rsi
mov rcx, r14
mov rdx, rsi
mov r9, r15
call fcn.14023a5b0
inc rbx
add r15, 0xd8
cmp rbx, 0x11
jne 0x14023d60e
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x14032f5c0]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
add rsi, 0x48
mov ecx, dword [r14 + 0x40]
test ecx, ecx
jle 0x14023d686
xor edx, edx
xor eax, eax
or rax, qword [rsi + rdx*8]
inc rdx
cmp rcx, rdx
jne 0x14023d678
jmp 0x14023d688
xor eax, eax
test rcx, rcx
je 0x14023d721
movsxd rcx, ecx
mov rdx, qword [r14 + 0x38]
xor ebx, ebx
lea r8, [rsp + 0x30]
sub rdi, rdi
jmp 0x14023d6b0
mov rdi, qword [rdx + rbx*8]
sbb rdi, qword [rsi + rbx*8]
mov qword [r8 + rbx*8], rdi
lea rbx, [rbx + 1]
dec rcx
jne 0x14023d6b0
sbb rdi, rdi
mov ecx, dword [r14 + 0x40]
test ecx, ecx
jle 0x14023d6ec
xor edx, edx
mov rbx, rax
test rax, rax
je 0x14023d6df
mov rbx, qword [rsp + rdx*8 + 0x30]
mov qword [rsp + rdx*8 + 0x30], rbx
inc rdx
cmp rcx, rdx
jne 0x14023d6d2
test rcx, rcx
je 0x14023d721
and r12d, 1
mov rax, r12
neg rax
dec r12
movsxd rcx, ecx
xor edx, edx
mov rbx, qword [rsp + rdx*8 + 0x30]
and rbx, rax
mov rdi, qword [rsi + rdx*8]
and rdi, r12
or rdi, rbx
mov qword [rsi + rdx*8], rdi
inc rdx
cmp rcx, rdx
jne 0x14023d703
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401bb0d0
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14024e650
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x238], rax
lea rdi, [rsp + 0x30]
mov r8d, 0x200
mov rcx, rdi
mov dl, 0xaa
call fcn.1401bd200
lea rbx, [rsp + 0x2c]
mov dword [rbx], 0x100
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
sete al
mov edx, dword [rbx]
test rdx, rdx
sete bl
or bl, al
jne 0x14024e6db
mov rcx, rsi
call fcn.14005cdf0
mov edx, 1
mov rcx, rsi
mov r8w, 0x2e
call fcn.14005d2e0
mov r8d, dword [rsp + 0x2c]
dec r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14015cb00
xor bl, 1
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, ebx
add rsp, 0x240
pop rbx
pop rdi
pop rsi
ret

Function at 0x140254de0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
lea r9, [0x1403b5670]
xor r11d, r11d
mov r8d, 0xedb88320
mov eax, r11d
shr eax, 1
mov edx, r11d
and edx, 1
neg edx
and edx, r8d
xor edx, eax
mov esi, edx
shr esi, 1
mov eax, r11d
shl eax, 0x1e
sar eax, 0x1f
and eax, r8d
xor eax, esi
mov r10d, eax
shr r10d, 6
mov esi, r11d
shl esi, 0x1d
sar esi, 0x1f
and esi, 0x76dc419
mov ecx, r11d
shl ecx, 0x1c
sar ecx, 0x1f
and ecx, 0xedb8832
xor ecx, esi
mov esi, r11d
shl esi, 0x1b
sar esi, 0x1f
and esi, 0x1db71064
xor esi, ecx
mov ecx, r11d
shl ecx, 0x1a
sar ecx, 0x1f
and ecx, 0x3b6e20c8
xor ecx, esi
xor ecx, r10d
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
xor edx, ecx
shl eax, 0x1a
sar eax, 0x1f
and eax, r8d
xor eax, edx
mov dword [r9], eax
inc r11
add r9, 4
cmp r11, 0x100
jne 0x140254df5
mov eax, 0x100
lea rcx, [0x1403b5670]
mov edx, dword [rcx + rax*4 - 0x400]
movzx esi, dl
shr edx, 8
xor edx, dword [rcx + rsi*4]
mov dword [rcx + rax*4], edx
inc rax
cmp rax, 0x800
jne 0x140254ea1
lea rax, [0x14029f4f0]
mov qword [0x1403b7670], rax
mov qword [0x1403b5668], rax
lea rsi, [0x14029f5b0]
mov qword [0x1403b7678], rsi
call fcn.14029f6d0
test eax, eax
jne 0x140254ef2
mov qword [0x1403b5668], rsi
add rsp, 0x20
pop rsi
ret