joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001d20
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1a8]
sub rsp, 0x2a0
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rsi, rcx
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp - 0x70]
call fcn.140012f60
lea rdx, [rbp - 0x70]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x104
ja 0x140001dc1
lea rcx, [rbp - 0x70]
mov r8, 0xffffffffffffffff
mov rax, r8
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140001d80
xor edi, edi
cmp word [rbp + rax*2 - 0x72], 0x5c
jne 0x140001d9a
mov word [rbp + rax*2 - 0x72], di
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], di
lea rax, [rbp - 0x70]
inc r8
cmp word [rax + r8*2], di
jne 0x140001db1
lea rdx, [rbp - 0x70]
jmp 0x140001de0
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], di
xor r8d, r8d
lea rdx, [0x14003c964]
lea rcx, [rsp + 0x20]
call fcn.140006be0
nop
cmp qword [rsp + 0x30], 0
jne 0x140001e5f
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 7
mov word [rsi], di
xor r8d, r8d
lea rdx, [0x14003c964]
mov rcx, rsi
call fcn.140006be0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140001f73
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f95
jmp 0x140001f6e
lea rcx, [rsp + 0x60]
call fcn.140001c30
mov rbx, rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140007a20
nop
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.140007880
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140001ecd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ec8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f9b
call fcn.140010d2c
movdqa xmm0, xmmword [0x140046250]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140001f22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001fa1
call fcn.140010d2c
movdqa xmm0, xmmword [0x140046250]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], di
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140001f73
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f8f
call fcn.140010d2c
mov rax, rsi
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140016bd0
int3
call fcn.140016bd0
nop
call fcn.140016bd0
nop
call fcn.140016bd0
int3
Function at 0x140004b40
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov r15, r9
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
test rdx, rdx
je 0x140004b29
cmp r8, 0x40000000
ja 0x140004b29
mov rcx, r8
call fcn.14001136c
mov r9, rdi
mov r8, rax
mov rdx, rbp
mov rcx, rbx
mov rsi, rax
call fcn.1400027d0
test al, al
je 0x140004b29
mov r11, qword [rsp + 0x60]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [r11 + rcx], 0
jne 0x140004a94
mov ebx, 0
mov r8d, ebx
sub rdi, rcx
je 0x140004b13
movzx r10d, byte [r11]
mov qword [rsp + 0x40], r14
mov r14, rsi
sub r14, r11
nop word [rax + rax]
movzx eax, r10b
test r10b, r10b
je 0x140004afc
mov rdx, r15
lea r9, [r14 + r8]
sub rdx, r11
movzx ecx, r10b
mov rax, r11
nop word [rax + rax]
cmp cl, 0x78
jne 0x140004aef
movzx ecx, byte [rdx + rax]
cmp byte [r9 + rax], cl
jne 0x140004b00
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x140004ae0
xor al, al
test al, al
je 0x140004b0a
inc r8
cmp r8, rdi
jb 0x140004ac0
jmp 0x140004b0e
lea rbx, [r8 + rsi]
mov r14, qword [rsp + 0x40]
mov rcx, rsi
call fcn.140010d2c
test rbx, rbx
je 0x140004b29
sub rbx, rsi
lea rax, [rbx + rbp]
jmp 0x140004b2b
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
mov eax, 0x1070
call fcn.140011760
sub rsp, rax
xor ebx, ebx
mov rbp, r9
mov rdi, r8
mov rsi, rcx
test r8, r8
je 0x140004c3e
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea r9d, [rbx + 0x28]
lea rax, [rsp + 0x1088]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], ebx
mov edx, 0x80862007
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], 0x33
mov qword [rsp + 0x60], 0x1000
mov dword [rsp + 0x1088], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140004c3e
movsxd rax, dword [rsp + 0xac]
lea rcx, [rsp + 0x70]
add rcx, rax
mov r8d, ebx
movzx eax, word [rcx + 0x14]
lea r11, [rcx + 0x18]
movzx r9d, word [rcx + 6]
add r11, rax
test r9d, r9d
je 0x140004c3e
mov r10d, dword [str.PAGE]
nop word [rax + rax]
mov eax, r8d
lea rcx, [rax + rax*4]
cmp dword [r11 + rcx*8], r10d
lea rdx, [r11 + rcx*8]
jne 0x140004c36
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], bl
jne 0x140004c28
cmp rax, 4
je 0x140004c67
inc r8d
cmp r8d, r9d
jb 0x140004c10
mov rdx, rbx
mov r9, rbp
mov r8d, ebx
mov rcx, rsi
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
jmp 0x140004a30
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x140004c3e
mov ecx, dword [rdx + 8]
mov edx, eax
lea rax, [rsp + 0x70]
add rax, rdx
je 0x140004c3e
test ecx, ecx
je 0x140004c3e
mov ebx, ecx
add rdx, rdi
jmp 0x140004c41
Function at 0x140005c00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
je 0x140005c9a
mov rbx, r8
test r8, r8
jle 0x140005c92
mov rcx, rdi
call fcn.1400073f0
test rax, rax
jle 0x140005c70
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.140012b00
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x140005c8a
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140005c92
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x140005c32
sub r14, rbx
mov rax, r14
jmp 0x140005d11
mov rax, qword [rcx + 0x40]
mov rsi, r14
mov r9, qword [rax]
test r9, r9
je 0x140005cb1
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140005cb3
xor ecx, ecx
movsxd rbx, ecx
test r14, r14
jle 0x140005d0b
test ecx, ecx
jle 0x140005ce7
cmp r14, rbx
mov rcx, r9
cmovl rbx, r14
mov r8, rbx
call fcn.140012b00
mov rax, qword [rdi + 0x58]
add rbp, rbx
sub r14, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x40]
movsxd rax, ebx
add qword [rcx], rax
test r14, r14
jle 0x140005d0b
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005d0b
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.140015d10
sub r14, rax
sub rsi, r14
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140005d30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rsi, rdx
mov rbx, rcx
je 0x140005dcb
mov rdi, r8
test r8, r8
jle 0x140005dc0
mov rcx, rbx
call fcn.140007410
test rax, rax
jle 0x140005da0
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140012b00
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140005db8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140005dc0
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140005d62
sub r14, rdi
mov rax, r14
jmp 0x140005e7a
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140005de2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140005de4
xor ecx, ecx
movsxd rdi, ecx
test r14, r14
jle 0x140005e74
test ecx, ecx
jle 0x140005e1c
cmp r14, rdi
mov rcx, rsi
cmovl rdi, r14
mov r8, rdi
call fcn.140012b00
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub r14, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
test r14, r14
jle 0x140005e74
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x140005e74
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140005e61
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov r9, qword [rbx + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rsi
call fcn.1400166bc
sub r14, rax
sub rbp, r14
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400062e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140006304
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140006347
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140006347
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x140006452
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000638a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140006399
movsx ecx, dil
jmp 0x1400063f3
lea r8, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x41]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x98]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
js 0x140006452
cmp eax, 1
jle 0x14000640d
cmp eax, 3
jne 0x140006452
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call fcn.140015198
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140006457
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x14000643d
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call fcn.140015d10
cmp rsi, rax
jne 0x140006452
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov eax, edi
jne 0x140006457
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret

Function at 0x140006ff0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400070a2
cmp byte [rcx + 0x71], 0
je 0x1400070a2
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140007052
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x14000705f
sub eax, 1
je 0x140007063
sub eax, 2
je 0x1400070a2
xor al, al
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140007090
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call fcn.140015d10
cmp rdi, rax
jne 0x140007052
cmp byte [rbx + 0x71], 0
sete al
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x68]
mov al, 1
add rsp, 0x50
pop rdi
ret
Function at 0x14000cdf0
Capabilities:
Parse pe header

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rsi, rdx
mov rdi, rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14000cef6
movsxd rcx, dword [rdx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x14000cef6
xor eax, eax
mov qword [r11 - 0x40], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov edx, dword [rcx + rdx + 0xb0]
test edx, edx
jne 0x14000ce5b
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
jmp 0x14000cf03
lea rbx, [rsi + rdx]
mov ebp, dword [rcx + rsi + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x30]
cmp rbx, rbp
jae 0x14000cee4
mov edx, dword [rbx + 4]
test edx, edx
je 0x14000cedf
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x40], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x48], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x50], eax
cmp qword [rsp + 0x38], rcx
je 0x14000cebd
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x50]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x30], rcx
jmp 0x14000ced4
lea r8, [rsp + 0x40]
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.14000d420
mov rcx, qword [rsp + 0x30]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x14000ce73
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x10], rax
jmp 0x14000cf03
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x14000ddf0
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rdi, rcx
lea rcx, [0x14003ce50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x14000df80
mov r8, rdi
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp - 0x28]
call fcn.14000dfb0
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov r8, rdi
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 0x48]
call fcn.14000dfb0
nop
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
lea r8, [rbp + 0x18]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14000de95
cmp eax, 2
sete bl
jmp 0x14000def2
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x58]
call rax
lea rdx, [rbp - 0x48]
mov rcx, 0xffffffff80000002
test eax, eax
je 0x14000ded8
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor bl, bl
jmp 0x14000def2
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
je 0x14000def0
xor bl, bl
jmp 0x14000def2
mov bl, 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14000df2e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000df9b
call fcn.140010d2c
movdqa xmm0, xmmword [0x140046250]
movdqu xmmword [rbp - 0x38], xmm0
xor eax, eax
mov word [rbp - 0x48], ax
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14000df7d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000df95
call fcn.140010d2c
movzx eax, bl
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140016bd0
nop
call fcn.140016bd0
nop
int3
Function at 0x14000e370
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x40
xor ebp, ebp
lea r9, [rsp + 0x68]
mov r14, rcx
mov dword [rsp + 0x68], ebp
xor r8d, r8d
xor edx, edx
mov ebx, ebp
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000e3ee
nop
test rbx, rbx
je 0x14000e3b6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x68]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x68]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000e3a0
test eax, eax
jns 0x14000e413
test rbx, rbx
je 0x14000e418
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x40
pop r14
pop rbp
pop rbx
ret
test rbx, rbx
jne 0x14000e423
xor eax, eax
add rsp, 0x40
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rdi
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x14000e4e3
nop word [rax + rax]
mov esi, edi
lea rcx, [rsp + 0x20]
imul rax, rsi, 0x128
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], bpl
movzx edx, word [rbx + rax + 0x2e]
add rax, 0x30
add rdx, rax
add rdx, rbx
call fcn.140006d70
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x14000e482
mov rdx, qword [r14]
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call fcn.14001608c
test eax, eax
je 0x14000e509
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000e4d9
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e4d4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e564
call fcn.140010d2c
inc edi
cmp edi, dword [rbx]
jb 0x14000e440
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rbp
pop rbx
ret
imul rax, rsi, 0x128
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rdi, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000e55f
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e55a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e564
call fcn.140010d2c
mov rax, rdi
jmp 0x14000e4f6
call fcn.140016bd0
int3

Function at 0x140015654
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140015674
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140017bac
or eax, 0xffffffff
jmp 0x140015676
xor eax, eax
add rsp, 0x28
ret

Function at 0x14001ab5c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001a988
Function at 0x576c42d0
Capabilities:
Get storage device properties

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
lea rbx, [rsp + 0x70]
mov rdi, rdx
mov ebp, ecx
xor edx, edx
mov rcx, rdi
mov rsi, r8
call fcn.57732ef8
mov rcx, rbx
mov r8d, ebp
lea rdx, str..PhysicalDrive_d
call qword [0x57755628]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r8d, 3
mov dword [rsp + 0x20], 3
call qword [0x57755348]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x576c43bc
lea r12, [0x5774c240]
xor edx, edx
mov r8d, 0x2710
mov dword [rsp + 0x60], 0
lea r13, [rsp + 0x64]
mov qword [rsp + 0x64], 0
mov rcx, r12
mov dword [rsp + 0x6c], 0
call fcn.57732ef8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x2710
mov qword [rsp + 0x20], r12
mov r9d, 0xc
mov r8, r13
mov qword [rsp + 0x30], rax
mov edx, 0x2d1400
mov rcx, rbx
call qword [0x57755360]
test eax, eax
jne 0x576c43e4
mov rcx, rbx
call qword [0x57755340]
cmp rsi, 0x13
jbe 0x576c4590
mov rdx, rdi
mov ecx, ebp
call fcn.576c3f20
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x5774c258]
test eax, eax
je 0x576c43b3
add rax, r12
mov r15, qword [0x57755578]
mov r13d, 0x64
mov qword [rsp + 0x58], rax
mov r12, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov r14, rax
test r13d, r13d
movzx edx, byte [r12]
je 0x576c44c0
test dl, dl
je 0x576c44c0
movsx ecx, dl
mov byte [rsp + 0x4e], dl
call r15
test eax, eax
je 0x576c4560
movzx edx, byte [rsp + 0x4e]
cmp dl, 0x39
jg 0x576c4540
sub edx, 0x30
movsx ecx, byte [r12 + 1]
shl edx, 4
mov byte [rsp + 0x4e], dl
mov byte [rsp + 0x4f], cl
call r15
test eax, eax
je 0x576c4560
movzx edx, byte [rsp + 0x4f]
cmp dl, 0x39
jg 0x576c4550
sub edx, 0x30
or dl, byte [rsp + 0x4e]
add r12, 2
movzx ecx, dl
mov byte [rsp + 0x4e], dl
call qword [0x57755570]
test eax, eax
je 0x576c4560
movzx edx, byte [rsp + 0x4e]
cmp dl, 0x20
je 0x576c4416
sub r13d, 1
mov byte [r14], dl
add r14, 1
test r13d, r13d
movzx edx, byte [r12]
jne 0x576c4424
mov r8, qword [rsp + 0x50]
mov byte [r14], 0
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x576c44c9
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
mov ecx, eax
cmove r8, rdx
add cl, al
sbb r8, 3
sub r8, qword [rsp + 0x50]
cmp r8d, esi
mov r12d, r8d
jae 0x576c43b3
mov rdx, qword [rsp + 0x50]
add r8, 1
mov rcx, rdi
call fcn.57732f08
mov rcx, rbx
call qword [0x57755340]
test r12d, r12d
je 0x576c43bc
xor eax, eax
jmp 0x576c43d0
and edx, 0xffffffdf
sub edx, 0x37
jmp 0x576c444f
and edx, 0xffffffdf
sub edx, 0x37
jmp 0x576c447c
mov rcx, qword [rsp + 0x58]
call fcn.57732eb0
cmp eax, esi
mov r12d, eax
jae 0x576c43b3
mov rdx, qword [rsp + 0x58]
lea r8, [rax + 1]
mov rcx, rdi
call fcn.57732f08
jmp 0x576c4520
mov eax, 0xffffffff
jmp 0x576c43d0
Function at 0x576c4670
Capabilities:
Get storage device properties

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
movsx eax, byte [rcx]
mov rbx, rdx
mov rsi, r8
cmp al, 0x2a
je 0x576c46f1
cmp al, 0x2f
jne 0x576c4693
movsx eax, byte [rcx + 1]
add rcx, 1
test al, al
je 0x576c478e
sub eax, 0x30
cmp eax, 9
jbe 0x576c46bf
jmp 0x576c46e1
lea r8d, [rdx - 0x30]
cmp r8d, 9
ja 0x576c46e1
lea r8d, [rax + rax*4]
lea edx, [rdx + r8*2 - 0x30]
add eax, edx
cmp eax, 0x5a
jg 0x576c46e1
add rcx, 1
movsx edx, byte [rcx]
test dl, dl
jne 0x576c46a5
mov r8, rsi
mov rdx, rbx
mov ecx, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.576c42d0
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp r8, 5
jbe 0x576c4795
lea rdx, str.__d:
xor r8d, r8d
mov rcx, rbx
mov rbp, rbx
xor edi, edi
lea r12, str.__d:
call fcn.57732ed8
mov edx, 3
jmp 0x576c4760
mov rcx, rbp
add edi, 1
call fcn.57732eb0
cdqe
lea rdx, [rbp + rax]
sub rsi, rax
cmp edi, 0x59
lea rbp, [rdx + 1]
mov byte [rdx], 0x2c
jg 0x576c4778
cmp rsi, 5
jbe 0x576c4778
mov rdx, r12
mov r8d, edi
mov rcx, rbp
call fcn.57732ed8
xor edx, edx
cmp edi, 9
setg dl
add edx, 3
movsxd rdx, edx
mov ecx, edi
sub rsi, rdx
add rdx, rbp
mov r8, rsi
call fcn.576c42d0
cmp eax, 0xffffffff
jne 0x576c4720
cmp rbx, rbp
jae 0x576c4795
xor eax, eax
mov byte [rbp - 1], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
jmp 0x576c46ca
lea r8, str.No_any_serial_number_of_harddisk_got
lea rcx, str..._src_platforms_windows_hdinfo.c
mov edx, 0x23e
call fcn.576b4290
mov eax, 0xffffffff
jmp 0x576c46e6