joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401850d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x30
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], r12
mov rax, qword [0x1402e3910]
xor rax, rbp
mov qword [rbp], rax
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r12, rcx
test rdx, rdx
jne 0x14018511c
xor eax, eax
jmp 0x14018522a
test rdi, rdi
je 0x140185115
call fcn.140035330
mov r8, rdi
mov rdx, rsi
mov r14, qword [rax + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140185115
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140185115
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x140185250
mov rcx, rax
call fcn.1401d71f0
lea r15d, [rax + 1]
lea ecx, [r15 + r15]
movsxd rdx, ecx
lea rcx, [rdx + 0x10]
cmp rdx, rcx
sbb rdx, rdx
and rdx, rcx
je 0x1401851e3
cmp rdx, 0x400
ja 0x1401851c7
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x1401851a5
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1401cb8d0
sub rsp, rax
lea rdi, [rsp + 0x20]
test rdi, rdi
je 0x140185256
mov dword [rdi], 0xcccc
jmp 0x1401851dd
mov rcx, rdx
call fcn.1401d4260
mov rdi, rax
test rax, rax
je 0x1401851e6
mov dword [rax], 0xdddd
add rdi, 0x10
jmp 0x1401851e6
mov rdi, rbx
test rdi, rdi
je 0x140185256
mov r8d, r15d
mov rdx, r14
mov rcx, rdi
call fcn.140032824
test rax, rax
je 0x14018520e
mov rdx, rax
mov rcx, r12
call fcn.140187d54
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rcx, [rdi - 0x10]
cmp dword [rcx], 0xdddd
jne 0x140185228
call fcn.1401d4808
mov eax, ebx
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1401cb100
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
mov r12, qword [rbp + 0x48]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop rbp
ret
call fcn.140032120
int3
call fcn.140032120
int3

Function at 0x140194388
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r9
mov r15, r8
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140194448
mov rcx, rdx
mov ebx, 0x811c9dc5
xor esi, esi
call fcn.1401d6110
mov r8, rax
mov eax, 0xcccccccd
mul r8d
shr edx, 3
test r8d, r8d
je 0x1401943ec
movzx ecx, word [rdi + rsi*2]
inc esi
imul ebx, ebx, 0x1000193
add esi, edx
xor ebx, ecx
cmp esi, r8d
jb 0x1401943d7
mov dword [r14], ebx
xor edx, edx
mov eax, ebx
div dword [rbp + 0x10]
mov dword [r15], edx
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x14019442d
mov rbx, qword [rbx + rdx*8]
test rbx, rbx
je 0x14019442d
mov eax, dword [r14]
cmp dword [rbx + 8], eax
jne 0x140194423
mov rcx, qword [rbx + 0x10]
mov rdx, rdi
call fcn.1401d70bc
test eax, eax
je 0x140194428
mov rbx, qword [rbx]
jmp 0x140194406
mov rax, rbx
jmp 0x14019442f
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
call fcn.140032120
int3
Function at 0x1401c0ce4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rsi, rcx
cmp qword [0x1402eb898], 0
jne 0x1401c0d14
call fcn.140032120
int3
lea r8, [rbp + 0x77]
xor edx, edx
xor ecx, ecx
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jns 0x1401c0d2c
xor eax, eax
jmp 0x1401c0ed3
lea rcx, [rbp + 0x7f]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
js 0x1401c0d25
mov dword [rbp - 0x59], 0x67
mov edx, 0x18
lea ecx, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
jne 0x1401c0d5d
call fcn.140032120
int3
mov rax, qword [rbp + 0x77]
mov qword [rdi + 0x10], rax
mov rdx, qword [rbp + 0x77]
mov rcx, qword [0x1402eb898]
call fcn.1400196e4
mov qword [rdi + 8], rax
and qword [rdi], 0
mov qword [rbp - 0x29], rdi
mov rax, qword [rsi]
mov rbx, qword [rax + 0x2c8]
mov rcx, rbx
call fcn.1401cb730
mov r8, rdi
lea rdx, [rbp + 0x6f]
mov rcx, rsi
call rbx
nop
mov rax, qword [rbp + 0x6f]
mov r8d, dword [rax - 0x10]
test r8d, r8d
jns 0x1401c0db8
mov ecx, 0x80070057
call fcn.1400063a0
int3
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, r8d
or ecx, edx
jge 0x1401c0dda
mov edx, r8d
lea rcx, [rbp + 0x6f]
call fcn.140006330
mov rax, qword [rbp + 0x6f]
mov qword [rbp - 0x41], rax
mov rax, qword [rsi]
mov rbx, qword [rax + 0x2d0]
mov rcx, rbx
call fcn.1401cb730
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rbx
mov dword [rbp - 0x35], eax
mov rax, qword [rsi]
mov rbx, qword [rax + 0x2d0]
mov rcx, rbx
call fcn.1401cb730
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call rbx
mov dword [rbp - 0x31], eax
mov dword [rbp - 0x2d], 1
movups xmm0, xmmword [rbp - 0x59]
movaps xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rbp - 0x49]
movaps xmmword [rbp + 7], xmm1
movups xmm0, xmmword [rbp - 0x39]
movaps xmmword [rbp + 0x17], xmm0
movsd xmm1, qword [rbp - 0x29]
movsd qword [rbp + 0x27], xmm1
mov qword [rbp - 0x11], 0xffffffffffff0002
mov qword [rbp - 0x19], 0xffffffffffff0000
lea r9, [rbp - 0x19]
xor r8d, r8d
mov edx, 0x1132
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, rax
mov edx, 0x1102
mov r8d, 2
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rbp + 0x7f]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call fcn.1401cb730
mov rcx, rdi
call rbx
nop
mov rsi, qword [rbp + 0x6f]
or ecx, 0xffffffff
lock xadd dword [rsi - 8], ecx
sub ecx, 1
jg 0x1401c0ece
mov rdi, qword [rsi - 0x18]
mov r8, qword [rdi]
mov rbx, qword [r8 + 8]
mov rcx, rbx
call fcn.1401cb730
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
mov eax, 1
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401d0760
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x140286678]
xor ecx, ecx
lea r8, [0x140286670]
lea rdx, str.FlsAlloc
call fcn.1401d0588
mov rbx, rax
test rax, rax
je 0x1401d07a0
mov rcx, rax
call fcn.1401cb730
mov rcx, rdi
call rbx
jmp 0x1401d07a6
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401d0808
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x140286688]
mov ecx, 2
lea r8, [0x140286680]
lea rdx, str.FlsGetValue
call fcn.1401d0588
mov rdi, rax
test rax, rax
je 0x1401d0849
mov rcx, rax
call fcn.1401cb730
mov ecx, ebx
call rdi
jmp 0x1401d0851
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401d085c
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140286690]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x140286688]
call fcn.1401d0588
mov rsi, rax
test rax, rax
je 0x1401d08a8
mov rcx, rax
call fcn.1401cb730
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x1401d08b3
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1401e30a8
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1401e2f33
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401e2f33
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401e2f33
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401e2f33
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401e2f33
cmp dword [rcx + 0x84], 0xe
jbe 0x1401e2f33
cmp dword [rcx + 0xf8], 0
je 0x1401e2f33
mov ecx, ebx
call fcn.1401e2fd4
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1401e2db0
cmp dword [rbp + 0x20], 0
je 0x1401e2f80
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1401e2f88
int3
xor r8d, r8d
xor edx, edx
jmp 0x1401e2ecc

Function at 0x1401e5858
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1401e5878
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401d25a0
or eax, 0xffffffff
jmp 0x1401e587a
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401e5880
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401e58a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401d25a0
or eax, 0xffffffff
jmp 0x1401e58a2
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401fa2c0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1401fa2d3
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1401fa8f0
lea rdx, [0x1402dcd58]
lea rcx, [rsp + 0x20]
call fcn.1401d0318
int3

Function at 0x140206468
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1402f6f54]
xor edx, edx
jmp fcn.1401fa2c0

Function at 0x140206e1c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1402f6f54]
jmp fcn.1401fa2c0
Function at 0x140006464
Capabilities:
Create directory
Get common file path
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rdx
mov edx, 0x801c
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x1400064f2
test rdi, rdi
je 0x1400064f5
cmp byte [rdi], al
je 0x1400064f5
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
je 0x1400064e9
xor edx, edx
mov rcx, rbx
call qword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_CreateDirectoryA]
mov r11d, eax
test eax, eax
jne 0x1400064d8
mov edx, 0x2000
mov rcx, rbx
call qword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_SetFileAttributesA]
test eax, eax
je 0x1400064d1
xor eax, eax
jmp 0x1400064f5
mov eax, 0x80004005
jmp 0x1400064f2
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
jmp 0x1400064ee
mov eax, 0x800700ce
test eax, eax
je 0x1400064f5
mov byte [rbx], 0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140006b20
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx + 0x18]
mov rbx, rcx
cmp rdx, 0xffffffffffffffff
je 0x140006b41
mov rcx, qword [rcx + 8]
call sub.ESENT.dll_JetCloseTable
or qword [rbx + 0x18], 0xffffffffffffffff
mov edx, dword [rbx + 0x10]
cmp edx, 0xffffffff
je 0x140006b59
mov rcx, qword [rbx + 8]
xor r8d, r8d
call sub.ESENT.dll_JetCloseDatabase
or dword [rbx + 0x10], 0xffffffff
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140006b6f
xor edx, edx
call sub.ESENT.dll_JetEndSession
or qword [rbx + 8], 0xffffffffffffffff
mov rcx, qword [rbx]
test rcx, rcx
je 0x140006b80
call sub.ESENT.dll_JetTerm
and qword [rbx], 0
lea rdx, [rbx + 0x138]
lea rcx, [rbx + 0x34]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_MoveFileA]

Function at 0x140006ba0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x4a0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14002d148]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov r12, rdx
xor r13d, r13d
mov esi, r13d
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x40], r13d
mov ebx, r13d
cmp esi, r13d
jne 0x140006cd4
mov word [rsp + 0x70], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x72]
call sub.msvcrt.dll_memset
mov word [rsp + 0x280], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x282]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x48], 0x104
mov dword [rsp + 0x4c], 0x208
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x280]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x70]
mov edx, ebx
mov rcx, r12
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumValueW]
mov esi, eax
cmp eax, r13d
jne 0x140006bf6
cmp dword [rsp + 0x40], 1
jne 0x140006ccd
lea rcx, [rsp + 0x70]
call qword [sym.imp.msvcrt.dll__wtoi]
mov ebp, eax
lea rcx, [rsp + 0x280]
call qword [sym.imp.msvcrt.dll__wtoi]
movsxd rdi, eax
cmp edi, r13d
jle 0x140006ccd
mov dword [rsp + 0x44], ebp
lea rdx, [rsp + 0x44]
lea rcx, [0x14002d3e8]
call fcn.14000a300
mov qword [rax], rdi
inc ebx
jmp 0x140006bf6
xor eax, eax
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.140022620
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140006d0c
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov r11, rsp
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [0x14002d148]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor r12d, r12d
mov ebp, r12d
mov rdi, r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov word [r11 - 0x228], r12w
mov ebx, 0x206
mov r8, rbx
xor edx, edx
lea rcx, [r11 - 0x226]
call sub.msvcrt.dll_memset
mov word [rsp + 0x60], r12w
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x62]
call sub.msvcrt.dll_memset
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400026d0]
mov rbx, 0xffffffff80000001
mov rcx, rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExW]
mov esi, eax
cmp qword [0x14002d3f8], r12
jbe 0x140006eeb
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1400026d0]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140005838
mov esi, eax
mov rbx, qword [0x14002d3f0]
mov rbx, qword [rbx]
cmp eax, r12d
jne 0x140006ee4
mov rdi, qword [rsp + 0x40]
cmp rbx, qword [0x14002d3f0]
je 0x140006eeb
cmp qword [rbx + 0x20], r12
jbe 0x140006e79
mov r8d, 0xa
lea rdx, [rsp + 0x270]
mov ecx, dword [rbx + 0x18]
call qword [sym.imp.msvcrt.dll__itow]
mov r8d, 0xa
lea rdx, [rsp + 0x60]
mov ecx, dword [rbx + 0x20]
call qword [sym.imp.msvcrt.dll__itow]
lea rcx, [rsp + 0x60]
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x270]
mov rcx, rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov esi, eax
cmp byte [rbx + 0x29], r12b
je 0x140006e95
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140022708
jmp 0x140006ed9
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x29], r12b
jne 0x140006eb9
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], r12b
jne 0x140006ed9
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], r12b
je 0x140006eab
jmp 0x140006ed9
mov rax, qword [rbx + 8]
cmp byte [rax + 0x29], r12b
jne 0x140006ed6
cmp rbx, qword [rax + 0x10]
jne 0x140006ed6
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], r12b
je 0x140006ec3
mov rbx, rax
cmp esi, r12d
je 0x140006e02
jmp 0x140006eeb
mov rdi, qword [rsp + 0x40]
jmp 0x140006ef0
cmp esi, r12d
je 0x140006ef5
mov ebp, 0x80004005
cmp rdi, r12
je 0x140006f03
mov rcx, rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebp
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140022620
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x140007364
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_CreateEventW]
mov qword [rbx + 0xa0], rax
test rax, rax
jne 0x14000739c
mov eax, 0x80004005
jmp 0x140007476
lea rax, [rbx + 0x90]
lea r8, [0x14000a0d0]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_CreateThread]
mov qword [rbx + 0x88], rax
test rax, rax
jne 0x1400073d6
mov esi, 0x80004005
mov edi, esi
jmp 0x140007411
mov edx, 2
mov rcx, rax
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_SetThreadPriority]
mov rcx, qword [rbx + 0xa0]
mov edx, 0x9c4
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x88]
xor edi, edi
test eax, eax
mov esi, 0x80004005
cmovne edi, esi
xor edx, edx
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_SetThreadPriority]
mov rcx, qword [rbx + 0xa0]
call qword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle]
and qword [rbx + 0xa0], 0
test edi, edi
js 0x14000746c
cmp qword [rbx + 0x58], 0
je 0x14000744d
mov rcx, qword [rbx + 0x58]
and qword [rbx + 0x58], 0
lea r8, [rbx + 0x60]
lea rdx, [0x140002650]
call qword [sym.imp.ole32.dll_CoGetInterfaceAndReleaseStream]
mov edi, eax
mov rcx, qword [rbx + 0x60]
test rcx, rcx
jne 0x14000745c
test edi, edi
js 0x14000746c
mov edi, esi
test edi, edi
js 0x14000746c
mov rax, qword [rcx]
call qword [rax + 0x18]
mov edi, eax
test eax, eax
jns 0x140007474
mov rcx, rbx
call fcn.1400072a0
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000d184
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14002d148]
xor rax, rsp
mov qword [rsp + 0x270], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x14000d288
test rcx, rcx
je 0x14000d1fe
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
test ebx, ebx
mov qword [rsp + 0x48], rcx
jmp 0x14000d224
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000d184
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x14000d288
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x14000d20c
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000d276
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
and qword [rsp + 0x48], 0
mov rdx, rsi
mov rcx, rdi
call fcn.14000d0d4
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x14000d293
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140022620
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000d850
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x14002d148]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp rax, rbx
jne 0x14000d8c4
call fcn.14000cee0
mov ebx, eax
jmp 0x14000da05
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
cmp rax, rbx
jne 0x14000d8e7
call fcn.14000cee0
mov ebx, eax
jmp 0x14000d9fb
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
cmp rax, rbx
jne 0x14000d90c
call fcn.14000cee0
mov ebx, eax
jmp 0x14000d9fb
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x14000d945
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14000d93b
lea rcx, [rsp + 0x70]
call fcn.14000fe40
nop
mov eax, 0x8007000e
jmp 0x14000da1e
mov ecx, eax
cmp rcx, rbx
je 0x14000d983
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14000d979
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000d983
lea rcx, [rsp + 0x70]
call fcn.14000fe50
mov rax, qword [rsp + 0x70]
jmp 0x14000d98d
mov ecx, 0x80070057
call fcn.1400057b8
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14000d9a4
cmp rax, rbx
jne 0x14000d9b0
mov ebx, 0x8007000e
jmp 0x14000d9fb
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.API_MS_Win_Core_String_L1_1_0.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x14000d9d7
call fcn.14000cee0
mov ebx, eax
jmp 0x14000d9fb
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000e530
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14000da1c
lea rcx, [rsp + 0x70]
call fcn.14000fe40
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140022620
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x140012154
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x14002e150]
test rcx, rcx
jne 0x14001217a
call fcn.140012208
test eax, eax
je 0x1400121a1
mov rcx, qword [0x14002e150]
call qword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x1400121f5
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.API_MS_Win_Core_Memory_L1_1_0.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400121a5
xor eax, eax
jmp 0x1400121f5
mov eax, dword [rax]
mov rcx, qword [0x14002e150]
call qword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x1400121d2
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.API_MS_Win_Core_Memory_L1_1_0.dll_VirtualFree]
mov rax, rdi
jmp 0x1400121f5
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x14002e150]
mov rdx, rbx
call qword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x1400121d9
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret