joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1408b21d9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
btr di, 0xf
shrd r11d, r14d, 0xe8
sar ebx, cl
push rbp
mov rbp, rsp
clc
sub rsp, 0x40
bt rbx, 0xe6
mov rdi, rcx
movzx r11w, dil
rcr r11b, 0x33
shr r11w, cl
mov rbx, r9
or r11b, spl
sub r11, 0x47d800cc
test r15w, r14w
sub ecx, ecx
movsx r11, r12w
mov r11, rdx
clc
stc
test rdx, rdx
jmp 0x1408b2231
je 0x1408b23ad
mov r9, qword [rbp + 0x38]
mov al, byte [r9 + 0x21]
cmp al, 0x20
jmp 0x1408b2246
jae 0x1408b233a
movzx r10d, al
mov rdx, r8
inc al
test r14, 0xaf84691
clc
stc
lea r10, [r10 + r10]
mov byte [r9 + 0x21], al
jmp 0x1408b226f
test r8, r8
jmp 0x1408b2277
je 0x1408b22b8
jmp 0x1408b22a2
cmp al, 0x5c
jmp 0x1408b2289
je 0x1408b2297
cmp al, 0x2f
jne 0x1408b229d
lea rdx, [r8 + 1]
inc al
inc r8
xor al, 0x8c
mov al, byte [r8]
test r15, r13
test al, al
jne 0x1408b2282
mov rcx, rdx
jmp 0x1408b22b8
call fcn.1401363ef
mov dword [r9 + r10*8 + 0x78], eax
setge al
lea eax, [rbx - 0x10000]
cmp r10d, 0x4afb5269
mov rbx, qword [rsp + 0x50]
cmc
mov dword [r9 + r10*8 + 0x80], eax
bswap ax
cmp r13w, r10w
mov eax, dword [rbp + 0x30]
not bp
add eax, 0xffff0000
jmp 0x1408b22fb
sub r11d, edi
mov dword [r9 + r10*8 + 0x84], eax
mov rdi, qword [rsp + 0x58]
bts rbp, rsi
shrd bp, r12w, 0xba
mov dword [r9 + r10*8 + 0x7c], r11d
shrd bp, r11w, 0x84
bsr ebp, esp
and bpl, al
add rsp, 0x40
movzx ebp, r12w
movsx ebp, cx
xchg ebp, ebp
pop rbp
jmp 0x1408b2339
ret
sub eax, eax
movsx dx, r11b
mov dword [rbp - 8], 0xd0001412
movsx rcx, sp
setp cl
movsx edx, r11w
mov qword [rbp - 0x18], rax
mov dl, r15b
movsx cx, r10b
lea rdx, [0x140068a88]
movzx cx, dl
not cl
mov qword [rbp - 0x10], rax
movsx ax, bpl
cmovs rcx, rbp
lea rcx, [rbp - 0x20]
cmovg ax, dx
jmp 0x1408b2386
lea rax, [0x14005b4d8]
mov dword [rbp - 4], 0x12
jmp 0x1408b2399
mov qword [rbp - 0x20], rax
jmp 0x1408b23a2
call 0x140491825
int3
sub eax, eax
mov dword [rbp - 8], 0xd0001416
mov qword [rbp - 0x18], rax
lea rdx, [0x140068a88]
mov qword [rbp - 0x10], rax
cmovo rax, rdx
movsx ecx, r14w
cbw
lea rcx, [rbp - 0x20]
movzx eax, r9w
lea rax, [0x14005b4d8]
jmp 0x1408b23e3
mov dword [rbp - 4], 6
jmp 0x1408b23ef
mov qword [rbp - 0x20], rax
jmp 0x1408b23f8
call 0x1402283f5
int3
Function at 0x140001487
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400a9110]
mov dword [rax], 1
mov rax, qword [0x1400a9120]
mov dword [rax], 1
mov rax, qword [0x1400a9130]
mov dword [rax], 1
mov rax, qword [0x1400a90a0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014d8
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140001504
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000152a
cmp eax, 0x20b
je 0x140001551
jmp 0x140001580
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000153d
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000156c
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140002190
Capabilities:
Query environment variable

Disassembly:
push r13
mov eax, 0x10078
push r12
call fcn.14008a200
sub rsp, rax
xor eax, eax
mov r8d, 0x28
mov rdx, rcx
lea r12, [rsp + 0x20]
xor ecx, ecx
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], cx
lea r13, [rsp + 0x70]
mov rcx, r12
call fcn.140026370
mov rdx, r13
mov r8d, 0x10000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x1400021f1
mov rcx, r13
call sub.msvcrt.dll__wcsdup
add rsp, 0x10078
pop r12
pop r13
ret

Function at 0x140002200
Capabilities:
Set environment variable

Disassembly:
push r13
push r12
sub rsp, 0x78
xor eax, eax
mov r8d, 0x28
lea r13, [rsp + 0x20]
mov r12, rdx
mov rdx, rcx
mov word [rsp + 0x20], ax
mov rcx, r13
call fcn.140026370
mov rdx, r12
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x78
pop r12
pop r13
ret
Function at 0x1400022d0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x70
mov rbx, rdx
mov r14, r8
mov r15, rcx
call fcn.140020650
lea rdx, str.environ
mov rcx, rax
call qword [sym.imp.python39.dll_PyObject_GetAttrString]
mov rcx, rbx
mov r12, rax
call qword [sym.imp.python39.dll_PyUnicode_FromString]
mov r13, rax
test r14, r14
je 0x14000238a
mov rdx, r14
mov rcx, rbx
call fcn.140002200
mov rcx, r14
mov rdx, 0xffffffffffffffff
call sub.python39.dll_PyUnicode_FromWideChar
mov rdx, r13
mov rcx, r12
mov r14, rax
mov r8, rax
call qword [sym.imp.python39.dll_PyObject_SetItem]
test eax, eax
jne 0x1400023cc
sub qword [r14], 1
jne 0x140002351
mov rcx, r14
call fcn.140002240
sub qword [r13], 1
jne 0x140002360
mov rcx, r13
call fcn.140002240
sub qword [r12], 1
jne 0x14000237c
mov rcx, r12
add rsp, 0x70
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.140002240
add rsp, 0x70
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
lea r14, [rsp + 0x20]
mov r8d, 0x28
mov rdx, rbx
mov word [rsp + 0x20], 0
mov rcx, r14
call fcn.140026370
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r13
mov rcx, r12
call qword [sym.imp.python39.dll_PyObject_DelItem]
test eax, eax
je 0x140002351
mov rcx, r15
call fcn.140002250
jmp 0x140002351
mov ecx, 1
call qword [sym.imp.python39.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python39.dll_Py_Exit]
nop
nop word cs:[rax + rax]
nop
Function at 0x14007f1b0
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data with crc32

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [0x1400b9f89], 0
mov r12, rcx
mov r13, rdx
mov rdi, r8
je 0x14007f238
lea rdx, [0x1400a75aa]
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14007f350
mov rsi, qword [0x1400b9e48]
jmp 0x14007f1f5
lea rsi, [rdx + rax + 4]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_strcmp
mov rcx, rsi
mov ebx, eax
call sub.msvcrt.dll_strlen
lea rdx, [rsi + rax + 1]
mov eax, dword [rdx]
test ebx, ebx
jne 0x14007f1f0
movzx r9d, word [rdx + 4]
lea r8, [rdx + 6]
mov rcx, r12
mov rdx, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.14006cd80
mov r8d, 0xa
mov edx, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x1400b9e48], rax
mov rdx, rax
mov r9d, dword [rax]
lea rax, [rax + 4]
mov qword [0x1400b9e48], rax
mov eax, dword [rdx + 4]
lea rcx, [rdx + 8]
mov qword [0x1400b9e48], rcx
test eax, eax
je 0x14007f338
sub eax, 1
lea r8, [rdx + rax + 9]
mov eax, 0xffffffff
nop word [rax + rax]
movzx edx, byte [rcx]
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
shr eax, 1
and edx, 1
add rcx, 1
neg edx
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor eax, edx
cmp r8, rcx
jne 0x14007f2a0
not eax
cmp r9d, eax
jne 0x14007f3d7
mov byte [0x1400b9f89], 1
jmp 0x14007f1cd
cmp byte [0x1400b9f88], 0
jne 0x14007f1e4
mov rbx, qword [sym.imp.python39.dll_PyDict_New]
call rbx
mov qword [0x1400ba8c8], rax
call rbx
mov qword [0x1400ba8c0], rax
call rbx
mov qword [0x1400ba8b8], rax
call rbx
mov qword [0x1400ba8b0], rax
call rbx
mov qword [0x1400ba8a8], rax
call rbx
mov qword [0x1400ba8a0], rax
call rbx
mov qword [0x1400ba898], rax
call rbx
mov byte [0x1400b9f88], 1
mov qword [0x1400ba890], rax
mov rax, qword [sym.imp.python39.dll__PyRuntime]
mov rax, qword [rax + 0x1f0]
mov rax, qword [rax + 0x10]
add rax, 0xdc0
mov qword [0x1400b9e40], rax
jmp 0x14007f1e4
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x140088f00
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14009a260
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14009a260
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140089bb2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400bad28]
test eax, eax
je 0x140089c4a
lea rax, [0x1400bad00]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400bad30]
mov qword [rbp - 8], rax
jmp 0x140089c2e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140089c22
cmp qword [rbp - 0x10], 0
je 0x140089c22
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140089be8
lea rax, [0x1400bad00]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140089c4b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140089d50
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140089d78
mov eax, 0
jmp 0x140089dc6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140089da1
mov eax, 0
jmp 0x140089dc6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140089dc1
mov eax, 0
jmp 0x140089dc6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x140089dcc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140089e4a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140089e41
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140089e41
mov rax, qword [rbp - 8]
jmp 0x140089e5f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140089e14
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140003b70
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003ba4
cmp word [rcx], 0x5a4d
jne 0x140003ba4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003ba4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003ba4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003ab0
test eax, eax
jne 0x140003bc0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003b20
test rax, rax
je 0x140003bb5
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.14000436f
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004270
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004210
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400046d4
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14055f538]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14055f534]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140004722
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000471a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004809
inc ebx
add rax, 0x28
jmp 0x1400046fa
mov rcx, r12
call fcn.140004f01
mov rbp, rax
test rax, rax
jne 0x140004741
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140004670
movsxd rbx, ebx
mov rax, qword [0x14055f538]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140004faf
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14055f538]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400047a3
mov rax, qword [0x14055f538]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140004670
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004803
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004803
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14055f538]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004803
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140004670
inc dword [0x14055f534]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004c30
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14055f5a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14055f580]
test rbx, rbx
je 0x140004c7c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004c76
test eax, eax
jne 0x140004c76
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140004c4e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140004e30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004e53
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004e53
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004e54
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140004e8e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140004e85
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140004e90
inc r8d
add rax, 0x28
jmp 0x140004e6c
xor eax, eax
ret

Function at 0x140004f01
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14055b610]
mov r8, rcx
mov rcx, r9
call fcn.140004e30
test eax, eax
je 0x140004f2d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004e54
xor eax, eax
add rsp, 0x28
ret
Function at 0x140003f80
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x140003f93
mov rcx, qword [rcx + 0x30]
call rax
call fcn.14007e9d0
cmp qword [0x140148e48], 8
lea rcx, [0x140148e30]
cmovae rcx, qword [0x140148e30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [0x140148ee8], 8
lea rcx, [0x140148ed0]
cmovae rcx, qword [0x140148ed0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [0x140148e68], 8
lea rcx, [0x140148e50]
cmovae rcx, qword [0x140148e50]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_DeleteFileW]

Function at 0x140005490
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
test rax, rax
je 0x14000551c
mov qword [rsp + 0x40], rbp
xor bpl, bpl
cmp dword [rsp + 0x20], ebx
jle 0x14000550a
mov qword [rsp + 0x48], rdi
mov rdi, rsi
mov rcx, qword [rdi]
lea rdx, str.__system_level
call fcn.1400a9534
test eax, eax
je 0x140005502
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x20]
jl 0x1400054e1
jmp 0x140005505
mov bpl, 1
mov rdi, qword [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
movzx eax, bpl
mov rbp, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a24f0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
Function at 0x140005610
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x88], rax
movzx ebp, r9b
mov dword [rsp + 0x58], r8d
movzx esi, cl
movzx edi, cl
shl edi, 9
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rdx, str.SoftwareMicrosoftEdgeUpdateClientState_
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rdx + r8*2], 0
jne 0x140005665
lea rcx, [rsp + 0x60]
call fcn.140004fe0
nop
lea rdx, [0x14010e470]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140005682
mov r8, rbx
lea rcx, [rsp + 0x60]
call fcn.140008370
test bpl, bpl
jne 0x1400056e9
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r9d, edi
or r9d, 0x20019
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [rsi - 0x7fffffff]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400056de
xor ebx, ebx
jmp 0x14000577b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
or edi, 0x20007
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsi - 0x7fffffff]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140005741
mov ebx, eax
jmp 0x14000577b
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.updatefreqhourshint
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x60]
call fcn.1400053f0
mov eax, ebx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400a24f0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400057b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
lea rcx, [0x14010d3a0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x14010d380]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005803
mov ecx, 0x800
call rax
call fcn.140005490
movzx esi, al
movzx ecx, al
call fcn.140005540
test al, al
je 0x1400059a8
xor ebp, ebp
test sil, sil
setne bpl
movzx ecx, sil
neg cl
sbb r14d, r14d
and r14d, 0x200
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
lea rdx, [0x14010e580]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140005860
lea rcx, [rsp + 0x58]
call fcn.140004fe0
nop
lea rdx, [0x14010e470]
mov r8, rbx
inc r8
cmp word [rdx + r8*2], 0
jne 0x140005880
lea rcx, [rsp + 0x58]
call fcn.140008370
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
or r14d, 0x20007
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rcx, [rbp - 0x7fffffff]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebp, eax
test eax, eax
je 0x140005901
lea rcx, [rsp + 0x58]
call fcn.1400053f0
mov eax, ebp
jmp 0x1400059aa
lea rbx, [rbx + 1]
cmp word [rdi + rbx*2], 0
jne 0x140005901
lea rax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
lea r8, [0x14010e508]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x140005957
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x58]
call fcn.1400053f0
mov eax, ebx
jmp 0x1400059aa
mov dword [rsp + 0x28], 0x18
lea rax, str.MSPCManager
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [0x14010e568]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x58]
call fcn.1400053f0
mov r9b, 1
mov r8d, 0xa8
movzx ecx, sil
call fcn.140005610
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a24f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret