joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b5ee0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rax, qword [rcx + 0x28]
xor r12d, r12d
mov r13, rdx
mov r15d, dword [rax]
mov esi, dword [rax + 4]
mov ebp, dword [rax + 8]
mov edi, dword [rax + 0xc]
mov r14d, dword [rax + 0x10]
test rdx, rdx
je 0x1400b6003
mov qword [rsp + 0x28], rbx
nop
lea r9d, [r14 + rdi]
mov edx, edi
mov eax, edi
ror edx, 8
add edi, ebp
add ebp, esi
and edx, 0xff00ff00
add esi, r15d
add r12, 8
rol eax, 8
and eax, 0xff00ff
or edx, eax
mov rax, qword [rcx + 0x68]
mov dword [r12 + rax - 8], edx
mov r8, qword [rcx + 8]
movzx edx, sil
mov r10d, dword [r8 + rdx*4]
movzx edx, bpl
shr ebp, 8
mov r11d, dword [r8 + rdx*4]
movzx edx, dil
shr edi, 8
mov ebx, dword [r8 + rdx*4]
movzx edx, r9b
xor r11d, ebp
mov r14d, dword [r8 + rdx*4]
xor ebx, edi
shr esi, 8
xor r10d, esi
mov edx, ebx
mov eax, ebx
shr r9d, 8
ror edx, 8
and edx, 0xff00ff00
xor r14d, r9d
lea r9d, [r15 + rbx]
add ebx, r11d
add r11d, r10d
add r10d, r14d
rol eax, 8
and eax, 0xff00ff
or edx, eax
mov rax, qword [rcx + 0x68]
mov dword [rax + r12 - 4], edx
mov r8, qword [rcx + 8]
movzx edx, r10b
mov esi, dword [r8 + rdx*4]
movzx edx, r11b
shr r10d, 8
mov ebp, dword [r8 + rdx*4]
movzx edx, bl
shr r11d, 8
mov edi, dword [r8 + rdx*4]
movzx edx, r9b
shr ebx, 8
mov r15d, dword [r8 + rdx*4]
shr r9d, 8
xor esi, r10d
xor ebp, r11d
xor edi, ebx
xor r15d, r9d
cmp r12, r13
jne 0x1400b5f20
mov rbx, qword [rsp + 0x28]
mov rax, qword [rcx + 0x28]
mov dword [rax], r15d
mov rax, qword [rcx + 0x28]
mov dword [rax + 4], esi
mov rax, qword [rcx + 0x28]
mov rsi, qword [rsp + 0x38]
mov dword [rax + 8], ebp
mov rax, qword [rcx + 0x28]
mov rbp, qword [rsp + 0x30]
mov dword [rax + 0xc], edi
mov rax, qword [rcx + 0x28]
mov rdi, qword [rsp + 0x40]
mov dword [rax + 0x10], r14d
mov qword [rcx + 0x88], 0
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400b6050
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r9d, r9d
nop dword [rax + rax]
mov eax, dword [r9 + rdx]
add r9, 4
mov r8d, eax
rol eax, 8
and eax, 0xff00ff
ror r8d, 8
and r8d, 0xff00ff00
or r8d, eax
mov rax, qword [rcx + 0x48]
mov dword [r9 + rax - 4], r8d
cmp r9, 0x10
jne 0x1400b6070
xor r8d, r8d
mov rax, qword [rcx + 0x48]
mov rdx, qword [rcx + 8]
add r8, 4
mov eax, dword [r8 + rax - 4]
mov dword [r8 + rdx - 4], eax
cmp r8, 0x10
jne 0x1400b60a3
mov r9, r8
lea r10, [0x140321b30]
nop dword [rax]
mov rax, qword [rcx + 8]
mov edx, dword [r9 + rax - 0x10]
lea r8, [r9 + rax]
add r9, 4
add edx, dword [r8 - 4]
mov eax, edx
shr edx, 3
and eax, 7
mov eax, dword [r10 + rax*4]
xor eax, edx
mov dword [r8], eax
cmp r9, 0x400
jne 0x1400b60d0
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx + 8]
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 0x164]
add r8, 4
add dword [rdx], eax
cmp r8, 0x5c
jne 0x1400b6110
mov rax, qword [rcx + 8]
mov r10d, dword [rax + 0xec]
mov r9d, dword [rax + 0x84]
btr r10d, 0x17
or r10d, 0x1000001
xor r8d, r8d
nop dword [rax]
mov rdx, qword [rcx + 8]
btr r9d, 0x17
add r8, 4
mov eax, dword [rdx + r8 - 4]
add r9d, r10d
and eax, 0xffffff
xor eax, r9d
mov dword [rdx + r8 - 4], eax
cmp r8, 0x400
jne 0x1400b6150
mov r8, qword [rcx + 8]
movzx edx, r9b
mov eax, dword [r8 + rdx*4]
mov ebx, dword [r8]
xor eax, r9d
movzx r10d, al
mov r9d, r10d
lea r11, [r10*4]
mov eax, dword [r11 + r8]
mov dword [r8], eax
mov r8d, 1
nop dword [rax]
mov rdx, qword [rcx + 8]
xor r9, r8
inc r8
mov eax, dword [rdx + r8*4 - 4]
mov dword [r11 + rdx], eax
mov rdx, qword [rcx + 8]
mov eax, dword [rdx + r9*4]
xor eax, r10d
movzx r10d, al
mov r9d, r10d
lea r11, [r10*4]
mov eax, dword [r11 + rdx]
mov dword [rdx + r8*4 - 4], eax
cmp r8, 0x100
jne 0x1400b61b0
mov rax, qword [rcx + 8]
lea rdx, [rsp + 0x20]
mov r8d, 8
mov dword [rax + r10*4], ebx
xor eax, eax
mov qword [rcx + 0x88], 0
mov dword [rsp + 0x21], eax
mov word [rsp + 0x25], ax
mov byte [rsp + 0x27], al
mov rax, qword [rcx]
mov byte [rsp + 0x20], 0
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140297ff0
add rsp, 0x30
pop rbx
ret
Function at 0x1400b6240
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rcx]
mov rdx, r8
call qword [rax + 0x38]
test al, al
jne 0x1400b62b5
mov rax, qword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [rax + 8]
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14000e5e0
lea rdx, [0x1403e2000]
lea rcx, [rsp + 0x28]
call fcn.14029f768
nop
xor edx, edx
nop word [rax + rax]
mov rax, qword [rbx + 0x48]
mov rcx, qword [rbx + 0x28]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x10
jne 0x1400b62c0
mov eax, dword [rsi]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov rax, qword [rbx + 0x28]
mov dword [rax + 0x10], ecx
mov rcx, qword [rbx + 0x28]
mov eax, dword [rcx + 0x10]
xor dword [rcx], eax
mov rdx, qword [rbx + 0x28]
mov eax, dword [rsi + 4]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
xor dword [rdx + 8], ecx
mov rax, qword [rbx + 0x28]
mov r15d, dword [rax]
mov esi, dword [rax + 4]
mov ebp, dword [rax + 8]
mov edi, dword [rax + 0xc]
mov r14d, dword [rax + 0x10]
xor r12d, r12d
nop word [rax + rax]
mov ecx, edi
ror ecx, 8
and ecx, 0xff00ff00
mov eax, edi
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov rax, qword [rbx + 0x68]
mov dword [r12 + rax], ecx
lea r8d, [r14 + rdi]
add edi, ebp
add ebp, esi
add esi, r15d
mov rdx, qword [rbx + 8]
movzx ecx, sil
shr esi, 8
mov r9d, dword [rdx + rcx*4]
xor r9d, esi
movzx ecx, bpl
shr ebp, 8
mov r10d, dword [rdx + rcx*4]
xor r10d, ebp
movzx ecx, dil
shr edi, 8
mov r11d, dword [rdx + rcx*4]
xor r11d, edi
movzx ecx, r8b
shr r8d, 8
mov r14d, dword [rdx + rcx*4]
xor r14d, r8d
mov ecx, r11d
ror ecx, 8
and ecx, 0xff00ff00
mov eax, r11d
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov rax, qword [rbx + 0x68]
mov dword [rax + r12 + 4], ecx
lea r8d, [r15 + r11]
add r11d, r10d
add r10d, r9d
add r9d, r14d
mov rdx, qword [rbx + 8]
movzx ecx, r9b
shr r9d, 8
mov esi, dword [rdx + rcx*4]
xor esi, r9d
movzx ecx, r10b
shr r10d, 8
mov ebp, dword [rdx + rcx*4]
xor ebp, r10d
movzx ecx, r11b
shr r11d, 8
mov edi, dword [rdx + rcx*4]
xor edi, r11d
movzx ecx, r8b
shr r8d, 8
mov r15d, dword [rdx + rcx*4]
xor r15d, r8d
add r12, 8
cmp r12, 0x20
jne 0x1400b6340
mov rax, qword [rbx + 0x28]
mov dword [rax], r15d
mov rax, qword [rbx + 0x28]
mov dword [rax + 4], esi
mov rax, qword [rbx + 0x28]
mov dword [rax + 8], ebp
mov rax, qword [rbx + 0x28]
mov dword [rax + 0xc], edi
mov rax, qword [rbx + 0x28]
mov dword [rax + 0x10], r14d
mov qword [rbx + 0x88], 0
mov rdx, qword [rbx + 0x70]
mov rcx, rbx
call fcn.1400b5ee0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140297ff0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400b6850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
xor r8d, r8d
xor ecx, ecx
mov qword [rbp - 0x3c], rax
mov dword [rbp - 0x34], eax
cpuid
mov dword [rbp - 0x40], r8d
mov dword [rbp - 0x38], ecx
mov dword [rbp - 0x34], edx
mov dl, 1
mov ecx, r8d
mov dword [rbp - 0x20], 0x756e6547
mov dword [rbp - 0x1c], 0x6c65746e
mov dword [rbp - 0x18], 0x49656e69
mov dword [rbp - 0x30], 0x68747541
mov dword [rbp - 0x2c], 0x444d4163
mov dword [rbp - 0x28], 0x69746e65
mov dword [rbp - 0x40], eax
mov dword [rbp - 0x3c], ebx
nop word [rax + rax]
mov eax, dword [rbp + rcx - 0x20]
cmp dword [rbp + rcx - 0x3c], eax
sete al
add rcx, 4
and dl, al
cmp rcx, 0xc
jne 0x1400b68c0
test dl, dl
je 0x1400b68f8
xor ecx, ecx
mov eax, 1
cpuid
shr ebx, 8
mov dword [rbp - 0x40], eax
mov dword [rbp - 0x38], ecx
movzx eax, bl
mov dword [rbp - 0x34], edx
shl eax, 3
jmp 0x1400b693c
mov cl, 1
nop word [rax + rax]
mov eax, dword [rbp + r8 - 0x30]
cmp dword [rbp + r8 - 0x3c], eax
sete al
add r8, 4
and cl, al
cmp r8, 0xc
jne 0x1400b6900
test cl, cl
je 0x1400b6937
mov eax, 0x80000005
xor ecx, ecx
cpuid
mov dword [rbp - 0x40], eax
movzx eax, cl
mov dword [rbp - 0x3c], ebx
mov dword [rbp - 0x38], ecx
mov dword [rbp - 0x34], edx
jmp 0x1400b693c
mov eax, 0x20
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140297ff0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400caf50
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x250
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp qword [0x1403fdbf0], 0
je 0x1400cb0b2
lea rcx, str.SeBackupPrivilege
call fcn.1400ffc40
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx ecx, word [rsp + 0x30]
call fcn.1400ce890
mov rsi, rax
test rax, rax
je 0x1400cb0b4
call fcn.1400ce030
mov rdi, rax
cmp qword [0x1403fd758], 0
jne 0x1400caffd
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtQueryKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403fd758], rax
test rax, rax
jne 0x1400caffd
xor ebx, ebx
jmp 0x1400cb020
mov ecx, 0xa8
call fcn.14029806c
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400cb01e
mov rcx, rax
call fcn.1400cf660
mov rbx, rax
jmp 0x1400cb020
xor ebx, ebx
mov rdx, 0xffffffff80000002
mov rcx, rbx
call fcn.1400cfb80
mov rdx, 0xffffffff80000003
mov rcx, rbx
call fcn.1400cfb80
mov rcx, rsi
call fcn.1400cb0e0
cmp qword [0x1403fdbf0], 0
jbe 0x1400cb072
test rdi, rdi
je 0x1400cb05d
mov rcx, rdi
call fcn.1400ce160
mov rcx, rsi
call fcn.1400cea20
mov rcx, rbx
call fcn.1400cf800
call fcn.1400cb5e0
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
test rbx, rbx
je 0x1400cb091
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
test rdi, rdi
je 0x1400cb0a3
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
cmp qword [0x1403fdbf0], 0
jbe 0x1400cb0b2
call fcn.1400cb890
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140297ff0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400ce030
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x258
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.AppCompatProgramsAmcache.hve
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.14029a500
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1400cde10
test al, al
jne 0x1400ce0a1
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140297ff0
add rsp, 0x258
ret
mov qword [rsp + 0x260], rbx
mov ecx, 0x20
mov qword [rsp + 0x268], rbp
mov qword [rsp + 0x250], rsi
call fcn.14029806c
mov rbx, rax
test rax, rax
je 0x1400ce0ee
lea rax, vtable.CommunityRemnantsAmcache.0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx], rax
mov dword [rbx + 0x18], 0
jmp 0x1400ce0f0
xor ebx, ebx
mov rsi, qword [rsp + 0x28]
mov ebp, dword [rsp + 0x20]
mov ecx, 0x18
mov qword [rbx + 0x10], rsi
mov dword [rbx + 0x18], ebp
call fcn.14029806c
test rax, rax
je 0x1400ce121
lea rcx, vtable.RegParser.0
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rbp
mov qword [rax], rcx
mov rsi, qword [rsp + 0x250]
mov rbp, qword [rsp + 0x268]
mov qword [rbx + 8], rax
mov rax, rbx
mov rbx, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140297ff0
add rsp, 0x258
ret
Function at 0x1400ce890
Capabilities:
Get volume information via ioctl

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov eax, dword [0x1403232b8]
movsd xmm0, qword [0x1403232b0]
xor r14d, r14d
mov dword [r11 - 0x20], eax
movzx eax, word [0x1403232bc]
movzx ebp, cx
movsd qword [r11 - 0x28], xmm0
mov word [r11 - 0x20], cx
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 3]
lea rcx, [r11 - 0x28]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], r14d
mov word [r11 - 0x1c], ax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400ce958
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x90064
mov rcx, rdi
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400ce95f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400ce9f1
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], rsi
mov esi, dword [rsp + 0x80]
mov ecx, 0x38
add esi, 0x10
call fcn.14029806c
mov rbx, rax
test rax, rax
je 0x1400ce9a3
lea rax, vtable.CommunityRemnantsNtfs.0
mov qword [rbx + 0x10], 0xffffffffffffffff
mov qword [rbx + 0x30], r14
mov qword [rbx], rax
jmp 0x1400ce9a6
mov rbx, r14
mov word [rbx + 8], bp
mov qword [rbx + 0x10], rdi
mov ecx, dword [rsp + 0x80]
mov dword [rbx + 0x18], ecx
mov ecx, esi
mov dword [rbx + 0x28], esi
call fcn.140298640
mov rsi, qword [rsp + 0xe8]
mov qword [rbx + 0x30], rax
mov rax, qword [rsp + 0x88]
mov ecx, dword [rsp + 0x80]
cqo
idiv rcx
mov qword [rbx + 0x20], rax
mov rax, rbx
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140297ff0
lea r11, [rsp + 0xd0]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400cf800
Capabilities:
Create thread
Get system information on windows

Disassembly:
mov r11, rsp
push rbp
sub rsp, 0xd0
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0xb0], rax
cmp qword [rcx + 0xa0], 0
mov rbp, rcx
je 0x1400cf904
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x18], r14
lea rcx, [rsp + 0x38]
xor r14d, r14d
mov esi, r14d
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x58]
mov ecx, 2
cmp eax, ecx
cmovl eax, ecx
mov ecx, 8
cmp eax, ecx
cmovg eax, ecx
test eax, eax
jle 0x1400cf8c6
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xc8], rdi
mov edi, eax
lea rbx, [rsp + 0x70]
nop word [rax + rax]
lea rax, [rsp + 0x30]
lea r8, [0x1400cfed0]
mov r9, rbp
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400cf8b1
mov qword [rbx], rax
inc esi
add rbx, 8
dec rdi
jne 0x1400cf880
mov rdi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rbp + 0x40]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rdx, [rsp + 0x70]
or r9d, 0xffffffff
mov r8d, 1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov r14, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xf0]
mov al, 1
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140297ff0
add rsp, 0xd0
pop rbp
ret
Function at 0x1400cf920
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rdx
mov rsi, rcx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1400cfb43
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x1400cfb43
mov ebx, r14d
nop dword [rax]
nop dword [rax + rax]
mov dword [rsp + 0x70], 0x100
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x50]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400cfb37
lea rdx, str.CurrentControlSet
lea rcx, [rbp - 0x50]
call fcn.14029848c
test eax, eax
jne 0x1400cfa74
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r14
mov word [rbp - 0x70], r14w
lea r8, [rbp - 0x70]
mov rdx, rdi
call fcn.1400cfc10
test al, al
je 0x1400cfa64
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
lea rdx, str.HKLMSYSTEM_
call fcn.14029848c
test eax, eax
jne 0x1400cfa64
cmp qword [rbp - 0x58], 8
jb 0x1400cfb37
mov rcx, qword [rbp - 0x70]
call fcn.1402012c0
jmp 0x1400cfb37
cmp qword [rbp - 0x58], 8
jb 0x1400cfa74
mov rcx, qword [rbp - 0x70]
call fcn.1402012c0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400cfb37
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1400cfb2c
mov eax, dword [rsp + 0x78]
mov dword [rbp - 0x80], eax
mov eax, dword [rsp + 0x7c]
mov dword [rbp - 0x7c], eax
mov r11, qword [rbp - 0x80]
mov rcx, r11
call fcn.1400cad10
test rax, rax
je 0x1400cfb14
mov r9, rax
mov r8, r11
mov rdx, qword [rsp + 0x68]
call fcn.1400cfd30
cmp dword [rsp + 0x74], 0
jbe 0x1400cfb2c
mov rdx, qword [rsp + 0x68]
mov rcx, rsi
call fcn.1400cfb80
test al, al
jne 0x1400cfb37
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
cmp ebx, dword [rsp + 0x60]
jb 0x1400cf9c0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140297ff0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400d0e80
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne dil
test dil, dil
jne 0x1400d0ebd
mov rbx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__d_while_deleting:__ls_r_n
mov edx, eax
mov r8, rbx
call fcn.140298d38
movzx eax, dil
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d2260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0x3e7
mov r8d, 0xa
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1400d22fa
mov rdx, rax
mov rcx, rbx
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rdi
mov rcx, rbx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400d22ea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov edx, esi
mov rcx, rax
call fcn.1400d2310
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rsi, qword [rsp + 0x30]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400d3930
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov eax, dword [rcx + 8]
mov r10, qword [rcx + 0x10]
sub eax, 0x500
mov edi, eax
je 0x1400d39c6
mov rax, qword [str.WJIM]
mov rbx, r10
sub rbx, r10
cmp qword [r10], rax
jne 0x1400d39bb
mov r9d, 0xdeadbbef
mov rcx, r10
mov r11d, 0x140
nop dword [rax + rax]
imul edx, dword [rcx], 0x5bd1e995
lea rcx, [rcx + 4]
mov r8d, edx
shr r8d, 0x18
xor r8d, edx
imul edx, r9d, 0x5bd1e995
imul r8d, r8d, 0x5bd1e995
xor r8d, edx
mov r9d, r8d
dec r11
jne 0x1400d3970
mov ecx, r8d
shr ecx, 0xd
xor ecx, r8d
imul edx, ecx, 0x5bd1e995
mov ecx, edx
shr ecx, 0xf
xor ecx, edx
cmp ecx, 0xe22a4630
je 0x1400d39d3
inc rbx
inc r10
cmp rbx, rdi
jb 0x1400d3957
xor al, al
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov al, 1
ret
Function at 0x1400d5720
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rsi, r8
mov r15, rdx
mov r13, rcx
xor edi, edi
mov dword [r11 + 8], edi
lea rax, [r11 + 8]
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x68], rdi
lea r9, [r11 + 0x20]
xor r8d, r8d
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400d5954
cmp dword [rsp + 0x90], edi
jne 0x1400d579c
mov rdx, qword [0x1403ec168]
mov rcx, rsi
call fcn.1401e7490
mov al, 1
jmp 0x1400d5956
mov eax, dword [rsp + 0xa8]
cmp eax, 7
jne 0x1400d585d
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x58], rdi
lea r8, [rsp + 0x48]
mov rdx, r15
mov rcx, r13
call fcn.1400d5970
mov r14, qword [rsp + 0x58]
test al, al
jne 0x1400d57df
xor dil, dil
jmp 0x1400d582e
mov rdx, qword [0x1403ec168]
mov rcx, rsi
call fcn.1401e7490
mov eax, dword [rsp + 0x50]
test eax, eax
jle 0x1400d582b
mov rbx, r14
mov ebp, eax
nop dword [rax + rax]
test rdi, rdi
jle 0x1400d5814
lea rdx, [0x140323e5c]
mov rcx, rsi
call fcn.1401e7680
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1401e7680
inc rdi
add rbx, 0x10
dec rbp
jne 0x1400d5800
mov dil, 1
test r14, r14
je 0x1400d5854
lea r9, [fcn.140005d80]
mov r8d, dword [r14 - 8]
mov edx, 0x10
mov rcx, r14
call fcn.140298fa4
lea rcx, [r14 - 8]
call fcn.1402983dc
movzx eax, dil
jmp 0x1400d5956
cmp eax, 0xb
ja 0x1400d5954
mov ecx, 0x816
bt ecx, eax
jae 0x1400d5954
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r14, rax
mov r8d, dword [rsp + 0x90]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400d5954
xor bpl, bpl
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xa8]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [r13 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400d5940
mov eax, dword [rsp + 0xa8]
dec eax
je 0x1400d5932
dec eax
je 0x1400d5932
sub eax, 2
je 0x1400d5912
sub eax, 7
jne 0x1400d5940
movzx edx, byte [rdi]
lea rcx, [rsp + 0x38]
call fcn.1400d3a10
cmp dword [rsp + 0x40], ebx
jle 0x1400d593d
mov rcx, qword [rsp + 0x38]
call fcn.140298600
jmp 0x1400d593d
movzx edx, byte [rdi]
lea rcx, [rsp + 0x48]
call fcn.140003890
cmp dword [rsp + 0x50], 0
jle 0x1400d593d
mov rcx, qword [rsp + 0x48]
call fcn.140298600
jmp 0x1400d593d
mov rdx, rdi
mov rcx, rsi
call fcn.1401e7490
mov bpl, 1
mov r8, rdi
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, bpl
jmp 0x1400d5956
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret