joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140089270
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14010a2e0]
mov ecx, 0x10
mov edx, 8
call fcn.1400074e0
test rax, rax
je 0x140089347
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400893e0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140089339
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
je 0x140089316
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
call fcn.140007570
mov edx, 8
mov rcx, qword [rbp - 0x18]
call fcn.140007570
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rdi
mov ecx, 8
mov edx, 0x10
call fcn.14009d190
ud2

Function at 0x140089510
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x140089553
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x140085a70]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.14009d420
ud2

Function at 0x14008c910
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x14008c945
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14008c94a
call fcn.140089510
nop
add rsp, 0x38
ret

Function at 0x140092171
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140092178
test al, 1
je 0x140092197
test al, 2
jne 0x1400921ac
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1400dc888]
mov edx, 0x23
jmp 0x1400921bf
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1400dc8c8]
mov edx, 0x25
call fcn.14009d5e0
ud2
Function at 0x140092a62
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call fcn.1400919bb
mov rcx, qword [rax]
movzx eax, bl
lea r9, [rsp + 0x2c]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140092a9e
xor eax, eax
jmp 0x140092aac
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbx
ret
Function at 0x140092d09
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0xc0]
lea rbp, [rsp + 0x3a]
lea r13, [rsp + 0x52]
xor ecx, ecx
cmp qword [rdx + 0x18], 0xffffffffffffffff
lea r15, [rdx + 0x18]
cmove r15, rcx
mov r12d, 0x7fffffff
cmp rax, r12
cmovb r12, rax
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], r15
mov rdx, qword [r14 + 0x10]
mov rcx, rsi
mov r8, rbx
call fcn.140092a5a
mov al, byte [rsp + 0x39]
cmp al, 3
je 0x140092e7b
mov rcx, qword [rsp + 0x30]
cmp al, 2
je 0x140092e89
mov dl, byte [rsp + 0x38]
movzx r8d, word [rbp + 4]
mov word [r13 + 4], r8w
mov r8d, dword [rbp]
mov dword [r13], r8d
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x50], dl
mov byte [rsp + 0x51], al
mov rcx, r15
lea rdx, str.C:Users_fhnir.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.35.1_srciopoll_evented.rs
call fcn.14000204c
mov rcx, qword [r15]
mov rdx, rdi
mov r8d, r12d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140092e9b
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
call fcn.140013e7f
cmp al, 0xd
jne 0x140092e4b
mov rax, qword [r15 + 8]
test rax, rax
je 0x140092e4b
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x140092ecd
mov r15, r14
mov r14, rbx
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.1400307df
mov rbx, rax
xor ecx, ecx
call fcn.14002ef4a
test rbx, rbx
je 0x140092e40
mov ecx, 1
mov rdx, rsi
call fcn.140030904
mov rsi, rbx
mov rbx, r14
mov r14, r15
mov r15, qword [rsp + 0x40]
mov rcx, rsi
call fcn.14008d9da
cmp al, 0xd
jne 0x140092eac
mov qword [rsp + 0x30], rsi
mov rcx, r14
lea rdx, [rsp + 0x48]
call fcn.1400927f7
lea rsi, [rsp + 0x30]
mov rcx, rsi
call fcn.14008dc53
jmp 0x140092d5f
mov rax, qword [rsp + 0x28]
mov qword [rax], 2
jmp 0x140092ebc
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rcx
jmp 0x140092ebc
cdqe
mov rcx, qword [rsp + 0x28]
and qword [rcx], 0
mov qword [rcx + 8], rax
jmp 0x140092ebc
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2

Function at 0x14009c600
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14009c64a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14009c64a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14009c64a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14009c64a
cmp dword [rcx + 0x84], 0xe
jbe 0x14009c64a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14009c64c
xor al, al
add rsp, 0x28
ret
Function at 0x1400050b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, r8
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov r14, rdx
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
lea rcx, [0x14002ecf0]
mov r8d, 0x208
test eax, eax
jne 0x14000523a
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x38], r8d
call fcn.14001d2a0
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbp
call qword [0x14002ef10]
mov r9d, 0xc0
mov qword [rsp + 0x28], rbx
mov r8, r14
mov dword [rsp + 0x20], 0xc4
lea rdx, [0x14002ecf6]
lea rcx, str._ws_ws_n_c_c__ws___
call fcn.140001010
xor edi, edi
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x140005171
test rax, rax
je 0x140005202
mov qword [rsp + 0x98], rsi
mov rcx, rdi
mov qword [rsp + 0x50], r15
lea r15, [0x14002dab0]
nop word [rax + rax]
lea rsi, [rbx + rcx*2]
mov edx, 0x80
movzx ecx, word [rsi]
call fcn.14000dad4
test eax, eax
je 0x1400051db
call fcn.14000a870
cdqe
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [r15 + rcx*2], 0
jne 0x1400051c3
xor edx, edx
div rcx
movzx eax, word [r15 + rdx*2]
mov word [rsi], ax
inc edi
mov rax, 0xffffffffffffffff
mov ecx, edi
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400051e6
cmp rcx, rax
jb 0x1400051a0
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov eax, dword [rsp + 0x30]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, rbx
lea rcx, str._ws_n_n
call fcn.140001010
mov rdi, qword [rsp + 0x58]
jmp 0x140005282
mov dword [rsp + 0x3c], 0x208
call fcn.14001d2a0
lea rax, [rsp + 0x3c]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbp
call qword [0x14002ef10]
mov r8, r14
lea rdx, [0x14002ecf6]
lea rcx, str.Failed_to_read:__ws_ws_n_n
call fcn.140001010
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140006220
add rsp, 0x60
pop r14
pop rbp
pop rbx
ret
Function at 0x1400052a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
mov eax, 0x2050
call fcn.14001cf40
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2040], rax
lea rax, [rsp + 0x30]
xor ebx, ebx
mov r9d, 0xf003f
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
test eax, eax
je 0x140005355
mov r8d, 0x208
mov dword [rsp + 0x38], 0x208
lea rcx, [0x14002ecf0]
call fcn.14001d2a0
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
lea edx, [rbx + 3]
mov rcx, 0xffffffff80000002
call qword [0x14002ef10]
lea r8, str.SYSTEMCurrentControlSetControlSystemInformation
lea rdx, [0x14002ecf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x14000553b
mov qword [rsp + 0x2060], rsi
lea rcx, [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
mov r8d, 0x1ffe
call fcn.14001d2a0
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x1ffe
mov qword [rsp + 0x28], rax
lea rdx, str.ComputerHardwareIds
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400054cf
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x140005435
mov qword [rsp + 0x2068], rdi
mov qword [rsp + 0x2070], r14
lea r14, [0x14002dab0]
nop
mov eax, ebx
lea rdi, [rsp + 0x40]
movzx ecx, word [rdi + rax*2]
lea rdi, [rdi + rax*2]
mov edx, 0x80
call fcn.14000dad4
test eax, eax
je 0x14000541b
call fcn.14000a870
cdqe
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x140005400
dec rcx
xor edx, edx
div rcx
movzx eax, word [r14 + rdx*2]
mov word [rdi], ax
mov eax, dword [rsp + 0x38]
inc ebx
cmp ebx, eax
jb 0x1400053d0
mov r14, qword [rsp + 0x2070]
mov rdi, qword [rsp + 0x2068]
mov dword [rsp + 0x28], eax
lea rdx, str.ComputerHardwareIds
lea rax, [rsp + 0x40]
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
mov dword [rsp + 0x3c], 0x208
mov r8d, 0x208
lea rcx, [0x14002ecf0]
call fcn.14001d2a0
lea rax, [rsp + 0x3c]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002ef10]
mov eax, dword [rsp + 0x38]
lea r8, str.ComputerHardwareIds
mov dword [rsp + 0x28], eax
lea rdx, [0x14002ecf6]
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
lea rcx, str._ws_ws_n_c_c_multi_string_of_length__d_n_n
call fcn.140001010
jmp 0x14000552a
xor edx, edx
mov dword [rsp + 0x3c], 0x208
mov r8d, 0x208
lea rcx, [0x14002ecf0]
call fcn.14001d2a0
lea rax, [rsp + 0x3c]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002ef10]
lea r8, str.ComputerHardwareIds
lea rdx, [0x14002ecf6]
lea rcx, str.Failed_to_read:__ws_ws_n_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x2060]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140006220
add rsp, 0x2050
pop rbx
ret
Function at 0x140005560
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r8
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
xor r8d, r8d
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
mov rsi, rdx
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140005602
xor edx, edx
mov dword [rsp + 0x38], 0x208
mov r8d, 0x208
lea rcx, [0x14002ecf0]
call fcn.14001d2a0
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x14002ef10]
mov r8, rsi
lea rdx, [0x14002ecf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400056f4
mov rbx, qword [rsp + 0x30]
call fcn.14000a870
mov dword [rsp + 0x40], eax
call fcn.14000a870
mov dword [rsp + 0x44], eax
mov r9d, 0xb
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 8
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
mov dword [rsp + 0x38], 0x208
lea rcx, [0x14002ecf0]
mov r8d, 0x208
test eax, eax
jne 0x1400056ab
call fcn.14001d2a0
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x14002ef10]
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
mov r8, rdi
lea rdx, [0x14002ecf6]
lea rcx, str._ws_ws_n_c_c_qword_n_n
call fcn.140001010
jmp 0x1400056eb
call fcn.14001d2a0
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x14002ef10]
mov r8, rdi
lea rdx, [0x14002ecf6]
lea rcx, str.Failed_to_write:__ws_ws_n_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140006220
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005710
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, r8
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov r9d, 0xf003f
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400057b2
xor edx, edx
mov dword [rsp + 0x38], 0x208
mov r8d, 0x208
lea rcx, [0x14002ecf0]
call fcn.14001d2a0
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
lea edx, [rbx + 3]
mov rcx, rdi
call qword [0x14002ef10]
mov r8, rsi
lea rdx, [0x14002ecf6]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140005926
mov rsi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov rcx, rsi
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov dword [rsp + 0x38], ebx
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000583c
xor edx, edx
mov dword [rsp + 0x3c], 0x208
mov r8d, 0x208
lea rcx, [0x14002ecf0]
call fcn.14001d2a0
lea rax, [rsp + 0x3c]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002ef10]
mov r8, rbp
lea rdx, [0x14002ecf6]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.140001010
jmp 0x14000591d
mov ecx, dword [rsp + 0x38]
call fcn.14000db54
mov rdi, rax
test rax, rax
jne 0x14000585e
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.140001010
jmp 0x14000591d
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x14000588a
call fcn.14000a870
and eax, 0x800000ff
jge 0x14000587b
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rsp + 0x38]
cmp ebx, eax
jb 0x140005866
mov dword [rsp + 0x28], eax
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14000db40
xor edx, edx
mov dword [rsp + 0x3c], 0x208
mov r8d, 0x208
lea rcx, [0x14002ecf0]
call fcn.14001d2a0
lea rax, [rsp + 0x3c]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x14002ef10]
mov eax, dword [rsp + 0x38]
lea rdx, [0x14002ecf6]
mov dword [rsp + 0x28], eax
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
mov r8, rbp
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140006220
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005950
Capabilities:
Delete registry key

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov qword [rsp + 0x50], 0
mov rdi, rdx
lea r8, [rsp + 0x50]
mov rdx, rsi
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp eax, 0x3fd
jne 0x1400059cc
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140005a2c
xor edx, edx
mov dword [rsp + 0x58], 0x208
mov r8d, 0x208
lea rcx, [0x14002ecf0]
call fcn.14001d2a0
lea rax, [rsp + 0x58]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x14002ef10]
mov r8, rsi
lea rdx, [0x14002ecf6]
lea rcx, str.Failed_to_create_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140005b59
mov r8, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCopyTreeW]
test eax, eax
jne 0x140005af7
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor edx, edx
mov dword [rsp + 0x58], 0x208
lea rcx, [0x14002ecf0]
mov r8d, 0x208
test eax, eax
jne 0x140005ac4
call fcn.14001d2a0
lea rax, [rsp + 0x58]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x14002ef10]
mov r9d, 0xc0
mov qword [rsp + 0x28], rsi
mov r8, rdi
mov dword [rsp + 0x20], 0xc4
lea rdx, [0x14002ecf6]
lea rcx, str._ws_ws_n_c_c_renamed_to__ws_n_n
call fcn.140001010
jmp 0x140005b4e
call fcn.14001d2a0
lea rax, [rsp + 0x58]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x14002ef10]
lea rcx, str.Failed_to_delete_key:__ws_ws_n_n
jmp 0x140005b3f
xor edx, edx
mov dword [rsp + 0x58], 0x208
mov r8d, 0x208
lea rcx, [0x14002ecf0]
call fcn.14001d2a0
lea rax, [rsp + 0x58]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x14002ef10]
lea rcx, str.Failed_to_copy_key:__ws_ws_n_n
mov r8, rdi
lea rdx, [0x14002ecf6]
call fcn.140001010
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140006220
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005b70
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp eax, 2
je 0x140005c49
xor edx, edx
mov dword [rsp + 0x30], 0x208
lea rcx, [0x14002ecf0]
mov r8d, 0x208
test eax, eax
jne 0x140005c09
call fcn.14001d2a0
lea rax, [rsp + 0x30]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x14002ef10]
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
mov r8, rdi
lea rdx, [0x14002ecf6]
lea rcx, str._ws_ws_n_c_c_deleted_n_n
call fcn.140001010
jmp 0x140005c49
call fcn.14001d2a0
lea rax, [rsp + 0x30]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x14002ef10]
mov r8, rdi
lea rdx, [0x14002ecf6]
lea rcx, str.Failed_to_delete_value:__ws_ws_n_n
call fcn.140001010
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140006220
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140005c70
Capabilities:
Delete registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp eax, 2
je 0x140005d52
xor edx, edx
mov dword [rsp + 0x30], 0x208
lea rcx, [0x14002ecf0]
mov r8d, 0x208
test eax, eax
jne 0x140005d0f
call fcn.14001d2a0
lea rax, [rsp + 0x30]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x14002ef10]
mov r9, rsi
mov dword [rsp + 0x28], 0xc4
mov r8, rdi
mov dword [rsp + 0x20], 0xc0
lea rdx, [0x14002ecf6]
lea rcx, str._ws_ws_ws_n_c_c_deleted_n_n
call fcn.140001010
jmp 0x140005d52
call fcn.14001d2a0
lea rax, [rsp + 0x30]
mov r9d, 0x208
lea r8, [0x14002ecf0]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x14002ef10]
mov r9, rsi
lea rdx, [0x14002ecf6]
mov r8, rdi
lea rcx, str.Failed_to_delete_value:__ws_ws_ws_n_n
call fcn.140001010
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140006220
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400060b0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x6a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x480]
mov r8d, 0x208
call fcn.14001d2a0
mov r8, rdi
lea rdx, str._ws
lea rcx, [rsp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x250
call fcn.14001d2a0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0x208
call fcn.14001d2a0
lea r9, [rsp + 0x4c]
mov r8, rdi
lea rdx, str._ws_ws
lea rcx, [rsp + 0x270]
call qword [sym.imp.USER32.dll_wsprintfW]
movzx ecx, word [rsp + 0x4c]
movzx eax, word [rsp + 0x4e]
cmp cx, 0x2e
jne 0x140006189
test ax, ax
je 0x1400061c3
cmp cx, cx
jne 0x140006189
cmp ax, cx
jne 0x140006189
cmp word [rsp + 0x50], 0
je 0x1400061c3
test byte [rsp + 0x20], 0x10
lea rdx, str.desktop.ini
je 0x1400061a6
lea rcx, [rsp + 0x270]
call fcn.1400060b0
jmp 0x1400061c3
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
je 0x1400061c3
lea rcx, [rsp + 0x270]
call fcn.140005d70
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140006130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.140006220
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x6a0
pop rdi
ret

Function at 0x140006c00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006c4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006c4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006c4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006c4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140006c4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006c4c
xor al, al
add rsp, 0x28
ret

Function at 0x14000e878
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000e674