joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023820
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
movsd xmm0, qword [rsp + 0xa0]
mov rsi, r8
movsxd rbp, edx
cvtpd2ps xmm0, xmm0
lea rax, [rax - 0x28]
mov r14, r9
xor r15d, r15d
xor r8d, r8d
mov rdx, rsi
mov qword [rax], r15
mov r9d, 0x2001f
mov rcx, rbp
movss dword [rax + 0x38], xmm0
mov qword [rsp + 0x20], rax
mov ebx, 0x80004005
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
je 0x1400238bb
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test eax, eax
jne 0x1400238ef
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x88]
mov r9d, 4
xor r8d, r8d
mov rdx, r14
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test edi, edi
mov ebx, eax
cmove ebx, r15d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x14003c730
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
lea ebp, [rdx - 1]
mov eax, edx
xor r10d, r10d
mov r14, r8
imul eax, edx
test ebp, ebp
je 0x14003c7e3
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
lea ebx, [rax + rdx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], r15
lea r11, [r9 + 2]
lea r15d, [rbx + 1]
mov edi, r10d
mov esi, ebx
nop
lea eax, [r10 + 1]
inc r10d
lea r11, [r11 + 4]
add eax, esi
add esi, ebx
lea r9, [r14 + rax*4]
mov eax, edi
add edi, r15d
movzx ecx, byte [r14 + rax*4]
lea r8, [r14 + rax*4]
movzx eax, byte [r9]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
mov byte [r11 - 6], al
movzx ecx, byte [r8 + 1]
movzx eax, byte [r9 + 1]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
mov byte [r11 - 5], al
movzx ecx, byte [r8 + 2]
movzx eax, byte [r9 + 2]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
mov byte [r11 - 4], al
cmp r10d, ebp
jb 0x14003c770
mov r15, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
xor eax, eax
pop r14
pop rbp
ret
Function at 0x140040120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r12, r9
mov r13, r8
mov rbx, rdx
mov r14, rcx
call fcn.1400487f0
xor edi, edi
lea r8d, [rdi + 5]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x140040239
mov r8d, 0xf0
mov rdx, rbx
mov rcx, r14
mov qword [rsp + 0x68], r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15d, edi
test rax, rax
je 0x140040197
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x60], rbp
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14004021b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x14004021b
mov rdx, r15
mov rcx, rax
call fcn.140047400
mov r9, r12
mov r8, r13
mov rsi, rax
mov rax, qword [rsp + 0x80]
mov rcx, r14
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rdi, rax
test rax, rax
jne 0x1400401fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rsi, rbp
je 0x140040223
test rsi, rsi
je 0x140040223
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140040223
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r15, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
test ebx, ebx
je 0x140040239
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x1400477a0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x50], rax
test rax, rax
jne 0x1400477c8
add rsp, 0x30
pop rbx
ret
lea rax, [rsp + 0x40]
lea r8, [0x140044920]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x140047809
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x50], rdi
mov rax, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
Function at 0x140047c90
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [0x1400d9251], 0
mov esi, edx
mov rdi, rcx
je 0x140047cb6
or eax, 0xffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x140047cf8
cmp eax, 0x80010106
jne 0x140047d34
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140047cfc
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov byte [rdi + 0x62], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x40]
mov rcx, rdi
mov rdx, rax
call fcn.140045290
cmp al, 1
jne 0x140047d24
mov edx, esi
mov rcx, rdi
call fcn.140047020
mov ebx, eax
jmp 0x140047d28
mov ebx, dword [rsp + 0x40]
cmp byte [rdi + 0x62], 0
je 0x140047d34
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x1400d9710]
mov edx, r9d
jmp 0x140047c90

Function at 0x1400489d0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [0x1400d9251], 0
mov esi, edx
mov rdi, rcx
je 0x140047cb6
or eax, 0xffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x140047cf8
cmp eax, 0x80010106
jne 0x140047d34
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140047cfc
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov byte [rdi + 0x62], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x40]
mov rcx, rdi
mov rdx, rax
call fcn.140045290
cmp al, 1
jne 0x140047d24
mov edx, esi
mov rcx, rdi
call fcn.140047020
mov ebx, eax
jmp 0x140047d28
mov ebx, dword [rsp + 0x40]
cmp byte [rdi + 0x62], 0
je 0x140047d34
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x1400d9710]
mov edx, r9d
jmp 0x140047c90
Function at 0x1400586e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x1b0
mov rax, qword [0x1400cb4d0]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rbx, qword [0x1400d9a10]
mov r14, rcx
movzx edx, dx
mov r8d, 0xf0
mov rcx, rbx
mov edi, 1
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400588cf
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400588cf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400588cf
mov qword [rsp + 0x1a8], rsi
mov qword [rsp + 0x1a0], r12
mov qword [rsp + 0x198], r13
mov qword [rsp + 0x190], r15
mov r13d, 0x403
mov r12d, 0x1234
xor r15d, r15d
mov qword [rsp + 0x1e0], rbp
nop dword [rax]
movzx esi, word [rbx]
cmp r15w, si
je 0x140058889
movzx eax, word [rbx + 2]
mov ebp, dword [rbx + 4]
add rbx, 8
cmp r13w, ax
jne 0x140058809
lea rax, [rsp + 0x78]
lea rcx, [rsp + 0x70]
mov r8d, 3
mov rdx, rbx
mov qword [rsp + 0x70], rax
call fcn.140058900
mov rax, qword [rsp + 0x70]
mov rcx, qword [r14 + 8]
movzx edx, si
xor r9d, r9d
mov r8d, 0x143
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov rcx, qword [rsp + 0x70]
cmp rax, 0xffffffffffffffff
lea rax, [rsp + 0x78]
cmove edi, r15d
cmp rcx, rax
je 0x14005887e
call fcn.140066d24
jmp 0x14005887e
cmp r12w, ax
jne 0x14005887e
lea rax, [rsp + 0x78]
lea rcx, [rsp + 0x70]
mov r8d, 3
mov rdx, rbx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], 0xffffffffffffffff
mov qword [rsp + 0x70], rax
call fcn.140058900
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rcx
cmp rcx, rax
je 0x140058856
call fcn.140066d24
mov rcx, qword [r14 + 8]
lea rax, [rsp + 0x30]
movzx edx, si
xor r9d, r9d
mov r8d, 0x40b
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 0xffffffffffffffff
cmove edi, r15d
add rbx, rbp
test edi, edi
jne 0x140058790
mov rbp, qword [rsp + 0x1e0]
mov r12, qword [rsp + 0x1a0]
mov rsi, qword [rsp + 0x1a8]
mov r13, qword [rsp + 0x198]
mov r15, qword [rsp + 0x190]
mov eax, edi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140067cd0
add rsp, 0x1b0
pop r14
pop rdi
pop rbx
ret
mov eax, edi
jmp 0x1400588b3

Function at 0x14006a538
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14006a3a0

Function at 0x14006b764
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, 0x1dd0a302
jmp 0x14000dad2
dec rcx
jmp 0x14000db19
jne 0x14000dad2
jmp 0x14000dd4a
jmp 0x14000deb9
jmp 0x14000df89
mov rcx, qword [0x1400dbfd0]
xor r8d, r8d
lea rax, [0x14008ce18]
test rcx, rcx
mov edx, r8d
cmove rcx, rax
cmp word [rcx], 0x20
ja 0x14006b78f
cmp word [rcx], r8w
je 0x14006b7b7
test edx, edx
je 0x14006b7af
cmp word [rcx], 0x22
jne 0x14006b79f
test edx, edx
mov eax, r8d
sete al
mov edx, eax
add rcx, 2
xor rcx, rcx
leave
jmp 0x14000b3cd
movzx eax, word [rcx]
test ax, ax
jne 0x14006b7a5
mov rax, rcx
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400597d0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400597e0]
mov dword [rax], 1
mov rax, qword [0x1400597f0]
mov dword [rax], 1
mov rax, qword [0x140059770]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400597c0]
mov dword [0x14005d020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400598b0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140059890]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400596d0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001aa0
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
lea rdx, [0x14004f050]
mov rcx, rax
call sym.fopen
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140001ad9
mov rax, qword [rbp + 0x10]
mov qword [rax], 0
mov rax, qword [rbp - 8]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.ftell
mov rdx, qword [rbp + 0x10]
mov dword [rdx + 8], eax
mov rax, qword [rbp - 8]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 8]
cdqe
mov rcx, rax
call sym.malloc
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov qword [rax], rdx
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
test rax, rax
jne 0x140001b58
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
mov rax, qword [rbp + 0x10]
mov qword [rax], 0
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 8]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov rcx, qword [rbp - 8]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
nop
mov rax, qword [rbp + 0x10]
add rsp, 0x30
pop rbp
ret

Function at 0x140001b97
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x10]
lea rdx, [0x14004f050]
mov rcx, rax
call sym.fopen
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x140001bf2
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sym.fread
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140001bf9
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
lea rdx, [0x14004f053]
mov rcx, rax
call sym.fopen
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140001c2d
mov eax, 0
jmp 0x140001cfc
mov rax, qword [rbp - 8]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.ftell
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.rewind
mov eax, dword [rbp - 0xc]
add eax, 1
cdqe
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x140001c8d
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
mov eax, 0
jmp 0x140001cfc
mov eax, dword [rbp - 0xc]
movsxd rdx, eax
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x18]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0xc]
cdqe
cmp qword [rbp - 0x20], rax
je 0x140001cdc
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sym.free
mov eax, 0
jmp 0x140001cfc
mov eax, dword [rbp - 0xc]
movsxd rdx, eax
mov rax, qword [rbp - 0x18]
add rax, rdx
mov byte [rax], 0
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
mov rax, qword [rbp - 0x18]
add rsp, 0x40
pop rbp
ret

Function at 0x140001d02
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov rbx, rcx
mov qword [rbp + 0x28], rdx
mov rax, qword [rbp + 0x28]
lea rdx, [0x14004f055]
mov rcx, rax
call sym.fopen
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140001d39
mov eax, 1
jmp 0x140001d8a
mov eax, dword [rbx]
add eax, 0x10
mov ecx, eax
mov rax, qword [rbx + 8]
mov rdx, qword [rbp - 8]
mov r9, rdx
mov r8, rcx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rdx, qword [rbp - 8]
lea rax, [rbx + 0x10]
mov r9, rdx
mov r8d, 0x10
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
mov eax, 0
add rsp, 0x38
pop rbx
pop rbp
ret

Function at 0x140001d91
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x10]
lea rdx, [0x14004f055]
mov rcx, rax
call sym.fopen
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x140001dec
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140001ef6
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rbx, rcx
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rsp + 0x40], 0
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x140001fd5
mov rax, qword [rbx + 0x18]
mov rcx, rax
call sym.strlen
lea r8d, [rax + 1]
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x10]
mov rax, qword [rbp - 0x10]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x140001faf
lea rax, str.UUID_successfully_stored_in_the_registry._n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x140001fc3
mov eax, dword [rbp - 4]
mov edx, eax
lea rax, str.Error_storing_UUID_in_the_registry._Error_code:__d_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
jmp 0x140001fe9
mov eax, dword [rbp - 4]
mov edx, eax
lea rax, str.Error_creating_registry_key._Error_code:__d_n
mov rcx, rax
call sym.printf_char_const__::_
nop
add rsp, 0x68
pop rbx
pop rbp
ret

Function at 0x140001ff1
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rbx, rcx
mov dword [rbp - 0x1c], 1
mov dword [rbp - 0x20], 0x3fff
mov eax, dword [rbp - 0x20]
mov eax, eax
mov rcx, rax
call sym.malloc
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14000203e
lea rax, str.Memory_allocation_failed_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x14000210d
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jne 0x1400020e8
mov rdx, qword [rbx + 0x10]
mov rax, qword [rbp - 0x18]
lea r8, [rbp - 0x1c]
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 8]
mov qword [rsp + 0x20], rcx
mov r9, r8
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov dword [rbp - 0x10], eax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
cmp dword [rbp - 0x10], 0
jne 0x1400020c1
mov rax, qword [rbp - 8]
jmp 0x14000210d
mov eax, dword [rbp - 0x10]
mov edx, eax
lea rax, str.Error_querying_registry_key:__d_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov eax, 0
jmp 0x14000210d
mov eax, dword [rbp - 0xc]
mov edx, eax
lea rax, str.Error_opening_registry_key:__d_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov eax, 0
add rsp, 0x58
pop rbx
pop rbp
ret
Function at 0x140002252
Capabilities:
Hide graphical window

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140002283
Capabilities:
Check mutex on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov edx, 0x4e
lea rax, str._v
mov rcx, rax
call sym.XOR_char__char_
mov r8, rax
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateMutexA]
call rax
mov qword [rbp - 8], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0xb7
sete al
test al, al
je 0x1400022e5
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x1400022ea
mov eax, 1
add rsp, 0x30
pop rbp
ret

Function at 0x1400024b8
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov edx, 0x47
lea rax, str.144._g__3_g4__04ghgh62._3
mov rcx, rax
call sym.XOR_char__char_
mov rcx, rax
call sym.system
nop
add rsp, 0x20
pop rbp
ret

Function at 0x1400024e3
Capabilities:
Check for debugger via api

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 4], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea rax, [rbp - 4]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call rax
mov eax, dword [rbp - 4]
cmp eax, 1
sete al
add rsp, 0x30
pop rbp
ret
Function at 0x140007ad0
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0xffffffffffffffff
jne 0x140007b53
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov rcx, rax
lea rax, str.Failed_to_create_file_n
mov rdx, rax
call sym.fprintf__iobuf__char_const__::_
mov eax, 0
jmp 0x140007bda
lea r8, [rbp - 0x10]
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp - 8]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
je 0x140007b8e
mov eax, dword [rbp - 0x10]
cmp dword [rbp + 0x20], eax
je 0x140007bc5
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov rcx, rax
lea rax, str.Failed_to_write_to_file_n
mov rdx, rax
call sym.fprintf__iobuf__char_const__::_
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x140007bda
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
add rsp, 0x50
pop rbp
ret
Function at 0x14000858c
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x18], 0
je 0x1400085cb
cmp qword [rbp + 0x18], 0xffffffffffffffff
je 0x1400085cb
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov rdx, qword [rbp + 0x18]
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
test rax, rax
je 0x1400085ec
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
test rax, rax
je 0x140008623
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x20
pop rbp
ret