joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400312b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x540
mov rax, qword [0x1401c0030]
xor rax, rsp
mov qword [rsp + 0x530], rax
mov qword [rsp + 0x58], 0
mov ecx, dword [rsp + 0x560]
call fcn.140027ba0
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x120]
mov rdi, rax
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0x208
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 0xffffffff
cmp qword [rsp + 0x550], 0
je 0x14003133d
mov rcx, qword [rsp + 0x558]
call fcn.14000c1f0
movzx eax, al
test eax, eax
je 0x14003135b
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x558]
call fcn.14000b4e0
mov eax, dword [rsp + 0x50]
jmp 0x140031539
mov rcx, qword [rsp + 0x558]
call fcn.14000b420
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0x48]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x550]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140031520
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x120]
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140031479
mov rdx, qword [rsp + 0x558]
lea rcx, [rsp + 0xf8]
call fcn.14000b5f0
nop
lea rcx, [rsp + 0xf8]
call fcn.140039480
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xf8]
call fcn.140019680
lea rax, [rsp + 0x98]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0xf8]
mov rcx, qword [rsp + 0x60]
call fcn.14000b5f0
mov qword [rsp + 0x68], rax
mov r8d, dword [rsp + 0x560]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x550]
call fcn.1400312b0
test eax, eax
je 0x14003145f
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], 0x208
lea rcx, [rsp + 0xf8]
call fcn.14000b4e0
jmp 0x140031393
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x558]
mov rcx, qword [rsp + 0x70]
call fcn.14000b5f0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x88], rax
lea rdx, [0x1401862f0]
mov rcx, qword [rsp + 0x80]
call fcn.140019710
mov qword [rsp + 0x90], rax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
call fcn.14003a2e0
mov rcx, qword [rsp + 0x558]
call fcn.14000b420
xor r9d, r9d
mov r8d, dword [rsp + 0x48]
mov rdx, rax
mov rcx, qword [rsp + 0x550]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov dword [rsp + 0x4c], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x54], eax
mov rcx, qword [rsp + 0x558]
call fcn.14000b4e0
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14005e8d0
add rsp, 0x540
pop rdi
ret
Function at 0x1400323b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x880
mov rax, qword [0x1401c0030]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x820
rep stosb byte [rdi], al
mov dword [rsp + 0x38], 0x820
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x898]
call fcn.14000b420
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x890]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140032468
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x898]
call fcn.14000b4e0
mov rcx, qword [rsp + 0x8a0]
call fcn.14000b4e0
mov eax, dword [rsp + 0x34]
jmp 0x1400324dc
mov rcx, qword [rsp + 0x8a0]
call fcn.14000b420
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400324ab
mov dword [rsp + 0x30], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x898]
call fcn.14000b4e0
mov rcx, qword [rsp + 0x8a0]
call fcn.14000b4e0
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.14005e8d0
add rsp, 0x880
pop rdi
ret

Function at 0x140032500
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x880
mov rax, qword [0x1401c0030]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov ecx, dword [rsp + 0x8a8]
call fcn.140027bd0
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x898]
call fcn.14000b420
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0x34]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x890]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400325f0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x820
rep stosb byte [rdi], al
mov dword [rsp + 0x38], 0x820
mov rcx, qword [rsp + 0x8a0]
call fcn.14000b420
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400325e5
mov dword [rsp + 0x30], 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x3c], eax
mov rcx, qword [rsp + 0x898]
call fcn.14000b4e0
nop
mov rcx, qword [rsp + 0x8a0]
call fcn.14000b4e0
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.14005e8d0
add rsp, 0x880
pop rdi
ret
Function at 0x140034150
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x140034168
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
shl rax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
mov dword [rax], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1400341ca
mov eax, dword [rsp + 0x34]
jmp 0x140034254
cmp dword [rsp + 0x38], 1
je 0x1400341df
cmp dword [rsp + 0x38], 2
je 0x1400341df
mov eax, 0xd
jmp 0x140034254
cmp qword [rsp + 0x60], 0
je 0x14003423d
cmp dword [rsp + 0x30], 0
je 0x140034229
mov eax, dword [rsp + 0x30]
xor edx, edx
mov ecx, 2
div rcx
mov rax, rdx
test rax, rax
jne 0x140034220
mov eax, dword [rsp + 0x30]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x60]
movzx eax, word [rcx + rax*2 - 2]
test eax, eax
je 0x140034227
mov eax, 0xd
jmp 0x140034254
jmp 0x14003423d
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov rdx, qword [rsp + 0x60]
mov word [rdx + rax], cx
mov eax, dword [rsp + 0x30]
xor edx, edx
mov ecx, 2
div rcx
mov rcx, qword [rsp + 0x68]
mov dword [rcx], eax
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400346b0
Capabilities:
Query or enumerate registry key

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x2c0
mov rax, qword [0x1401c0030]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rax, [rsp + 0xa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0x104
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0xa0]
mov edx, dword [rsp + 0x40]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400347ca
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x78]
call fcn.140019710
nop
lea rcx, [rsp + 0x78]
call fcn.140039480
lea rdx, [0x1401864e0]
lea rcx, [rsp + 0x78]
call fcn.140019680
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x78]
call fcn.14000b420
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.140019710
mov qword [rsp + 0x50], rax
mov r8d, dword [rsp + 0x2d0]
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000003
call fcn.140035260
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], 0x104
lea rcx, [rsp + 0x78]
call fcn.14000b4e0
jmp 0x1400346f2
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14005e8d0
add rsp, 0x2c0
pop rdi
ret
Function at 0x1400348d0
Capabilities:
Delete registry key

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x218
mov rax, qword [0x1401c0030]
xor rax, rsp
mov qword [rsp + 0x208], rax
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x5c], 0
call fcn.14003a890
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
je 0x14003491d
mov dword [rsp + 0x50], 0xf023f
jmp 0x140034925
mov dword [rsp + 0x50], 0xf013f
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x54], 0
je 0x14003493e
mov dword [rsp + 0x58], 0xf013f
jmp 0x140034946
mov dword [rsp + 0x58], 0xf023f
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x68], eax
mov edx, dword [rsp + 0x228]
lea rcx, [rsp + 0x1e8]
call fcn.140035660
nop
lea rcx, [rsp + 0x1e8]
call fcn.14000b420
lea rcx, [rsp + 0x5c]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov ecx, dword [rsp + 0x60]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0
jne 0x140034a58
lea rax, [rsp + 0x90]
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x80]
call fcn.140034a90
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x78]
call fcn.140034d70
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x1e8]
call fcn.14000b420
xor r9d, r9d
mov r8d, dword [rsp + 0x68]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ecx, dword [rsp + 0x228]
call fcn.1400346b0
mov dword [rsp + 0x6c], 1
lea rcx, [rsp + 0x1e8]
call fcn.14000b4e0
mov eax, dword [rsp + 0x6c]
jmp 0x140034a71
mov dword [rsp + 0x70], 0
lea rcx, [rsp + 0x1e8]
call fcn.14000b4e0
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x208]
xor rcx, rsp
call fcn.14005e8d0
add rsp, 0x218
ret
Function at 0x140035310
Capabilities:
Delete registry key

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1401c0030]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x38], 0
mov ecx, dword [rsp + 0x98]
call fcn.140027ba0
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x88]
call fcn.14000b420
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0x30]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400353c3
mov edx, dword [rsp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.1400380c0
lea rcx, [rsp + 0x40]
call fcn.14000b420
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.14000b4e0
nop
mov rcx, qword [rsp + 0x88]
call fcn.14000b4e0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14005e8d0
add rsp, 0x78
ret

Function at 0x140036110
Capabilities:
Query or enumerate registry key

Disassembly:
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1401c0030]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0x104
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x80]
mov edx, dword [rsp + 0x40]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14003621b
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140036204
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rdx, [0x140186ad0]
mov rcx, qword [rsp + 0x50]
call fcn.140019710
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call fcn.140035f90
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], 0x104
jmp 0x140036158
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14005e8d0
add rsp, 0x2a0
pop rdi
ret
Function at 0x1400365b0
Capabilities:
Query or enumerate registry key

Disassembly:
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1401c0030]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0x104
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x80]
mov edx, dword [rsp + 0x40]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400366bb
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400366a4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rdx, str.SoftwareWebexRecorderPlayback
mov rcx, qword [rsp + 0x50]
call fcn.140019710
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call fcn.140036240
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], 0x104
jmp 0x1400365f8
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14005e8d0
add rsp, 0x2a0
pop rdi
ret

Function at 0x1400366e0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x1401c0030]
xor rax, rsp
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x20]
call fcn.14000b5f0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x30]
call fcn.14000b5f0
mov qword [rsp + 0x40], rax
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x88]
call fcn.140029b30
lea rcx, [rsp + 0x88]
call fcn.14000b420
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x88]
call fcn.14000b4e0
nop
mov rcx, qword [rsp + 0xc8]
call fcn.14000b4e0
nop
mov rcx, qword [rsp + 0xd0]
call fcn.14000b4e0
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14005e8d0
add rsp, 0xb8
ret
Function at 0x140038300
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x140
mov rax, qword [0x1401c0030]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov dword [rsp + 0x80], VarBstrFromR4
lea rax, [rsp + 0x88]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov dword [rsp + 0xbc], 1
xor eax, eax
mov word [rsp + 0xc0], ax
lea rdx, [0x140186d80]
lea rcx, [rsp + 0x110]
call fcn.140019710
nop
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x110]
call fcn.1400196b0
mov rcx, qword [rsp + 0x150]
call fcn.14000b420
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000010
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x50]
call fcn.14000b5f0
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.14003a900
nop
lea rcx, [rsp + 0x110]
call fcn.14000b4e0
nop
mov rcx, qword [rsp + 0x150]
call fcn.14000b4e0
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14005e8d0
add rsp, 0x140
pop rdi
ret
Function at 0x1400387e0
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov dword [rsp + 0x24], 1
mov dword [rsp + 0x20], 0
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14003881c
xor eax, eax
jmp 0x14003883c
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140038850
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x308
mov rax, qword [0x1401c0030]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x1400388a6
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x310]
call fcn.14000b4e0
mov eax, dword [rsp + 0x30]
jmp 0x1400389af
mov dword [rsp + 0x24], 0
mov dword [rsp + 0xb0], 0x238
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14003898b
mov r8d, dword [rsp + 0xb8]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xdc]
mov rcx, qword [rsp + 0x38]
call fcn.140019710
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x310]
mov rcx, qword [rsp + 0x48]
call fcn.14000b5f0
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.140038d00
test eax, eax
jne 0x140038964
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x24], eax
jmp 0x14003898b
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [rsp + 0x20], eax
jmp 0x1400388d0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x310]
call fcn.14000b4e0
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.14005e8d0
add rsp, 0x308
ret

Function at 0x140039570
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call fcn.14000c1f0
movzx eax, al
test eax, eax
jne 0x14003959d
mov rcx, qword [rsp + 0x30]
call fcn.14000b420
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, qword [rsp + 0x30]
call fcn.14000b4e0
add rsp, 0x28
ret
Function at 0x140039780
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x258
mov rax, qword [0x1401c0030]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0x104
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x260]
call fcn.140019710
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14005e8d0
add rsp, 0x258
ret
Function at 0x140039be0
Capabilities:
Decode data using base64 via winapi
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x8f0
mov rax, qword [0x1401c0030]
xor rax, rsp
mov qword [rsp + 0x8e0], rax
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x54], 0x410
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0xc0]
mov rdi, rax
xor eax, eax
mov ecx, 0x820
rep stosb byte [rdi], al
lea rcx, [rsp + 0x80]
call fcn.14000c2f0
nop
mov rcx, qword [rsp + 0x908]
call fcn.14000b420
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x4c]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140039daa
cmp dword [rsp + 0x40], 0x410
jae 0x140039daa
mov rcx, qword [rsp + 0x908]
call fcn.14000b420
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x4c]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0xc0]
mov r8d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140039daa
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x80]
call fcn.1400196e0
mov eax, dword [rsp + 0x60]
xor edx, edx
mov ecx, 2
div rcx
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x80]
call fcn.140019430
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x80]
call fcn.14000b510
lea rcx, [rsp + 0xa0]
call fcn.14000b4e0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x900]
call fcn.14000b570
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x80]
call fcn.14000b4e0
nop
mov rcx, qword [rsp + 0x908]
call fcn.14000b4e0
mov rax, qword [rsp + 0x900]
mov rcx, qword [rsp + 0x8e0]
xor rcx, rsp
call fcn.14005e8d0
add rsp, 0x8f0
pop rdi
ret