joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400117e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov rax, qword [0x14001b050]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], 0x20
mov r9, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x80]
mov edx, dword [rsp + 0x70]
lea rcx, [0x140018010]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x38], 0x20
mov eax, dword [0x140024590]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], 9
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x4c], rax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x54], eax
mov rax, qword [0x14001b468]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x38]
mov rax, qword [rsp + 0x30]
call qword [0x1400193c8]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140014730
add rsp, 0x68
ret

Function at 0x1400118a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov rax, qword [0x14001b050]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r9d, 0x20
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
lea rcx, [0x1400180c0]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x28], 0x20
mov eax, dword [0x140024590]
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x30], 0x16
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x3c], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x44], eax
mov rax, qword [0x14001b468]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x28]
mov rax, qword [rsp + 0x20]
call qword [0x1400193c8]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140014730
add rsp, 0x58
ret

Function at 0x140011950
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov rax, qword [0x14001b050]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r9d, 0x20
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
lea rcx, [0x140018070]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x28], 0x20
mov eax, dword [0x140024590]
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x30], 0x18
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x3c], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x44], eax
mov rax, qword [0x14001b468]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x28]
mov rax, qword [rsp + 0x20]
call qword [0x1400193c8]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140014730
add rsp, 0x58
ret
Function at 0x140011a00
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14001b050]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x28], 0x24
mov eax, dword [0x140024590]
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x30], 0x1c
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x34], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x3c], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x44], rax
mov r9, qword [rsp + 0x44]
mov r8, qword [rsp + 0x3c]
mov rdx, qword [rsp + 0x34]
lea rcx, [0x140018110]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [0x14001b468]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x28]
mov rax, qword [rsp + 0x20]
call qword [0x1400193c8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140014730
add rsp, 0x68
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d9
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x14000403a
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x140004030
push rdx
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
push r9
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040ce
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040ce
add rax, rdx
mov r8d, dword [rax + 0x20]
mov ecx, dword [rax + 0x18]
add r8, rdx
push rax
jrcxz 0x1400040cd
dec rcx
mov esi, dword [r8 + rcx*4]
xor r9, r9
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004084
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004075
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004024
Function at 0x1400017f0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x110
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r14, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9d, [rdi + 0x18]
lea r8, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rsi, qword [rsp + 0x40]
mov r15d, edi
mov rcx, rbx
call qword [sym.imp.dbghelp.dll_ImageNtHeader]
test rax, rax
je 0x1400018b8
movzx edx, word [rax + 0x14]
add rdx, 0x18
add rdx, rax
mov r8d, edi
movzx r9d, word [rax + 6]
test r9d, r9d
je 0x1400018b8
lea r10, [0x140025d6c]
nop word [rax + rax]
mov rax, rdi
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r10 + rax - 1]
jne 0x14000191e
cmp rax, 6
jne 0x1400018a0
mov r15d, dword [rdx + 0x10]
mov ecx, 0x1000
call fcn.140022264
mov rbx, rax
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.libcrypto_3_x64.dll_SHA256_Init]
lea rbp, [r15 + rsi]
cmp rsi, rbp
jae 0x140001955
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1000
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140001930
mov r8, qword [rsp + 0x60]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call qword [sym.imp.libcrypto_3_x64.dll_SHA256_Update]
jmp 0x140001949
inc r8d
add rdx, 0x28
cmp r8d, r9d
jl 0x140001890
jmp 0x1400018b8
xor r9d, r9d
lea r8, [0x140025d68]
lea rdx, str.ReadProcessMemory_failed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
add rsi, 0x1000
cmp rsi, rbp
jb 0x1400018e0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.libcrypto_3_x64.dll_SHA256_Final]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov dword [rsp + 0x30], 1
nop word [rax + rax]
movzx r8d, byte [rsp + rdi + 0xe0]
lea rdx, str._02x
lea rcx, [rsp + 0x58]
call fcn.1400015d0
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.140001c90
inc rdi
cmp rdi, 0x20
jl 0x140001990
mov rcx, rbx
call fcn.140022220
mov rax, r14
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140022200
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140001a00
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r8
mov rsi, rdx
mov qword [rsp + 0x40], rdx
xor r13d, r13d
mov dword [rsp + 0x20], r13d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx], r13
mov qword [rdx + 8], r13
mov qword [rdx + 0x10], r13
mov dword [rsp + 0x20], 1
movsxd r15, dword [r8 + 0x3c]
add r15, r8
movzx eax, word [r15 + 0x14]
lea rbx, [r15 + 0x18]
add rbx, rax
mov r14d, r13d
cmp r13w, word [r15 + 6]
jae 0x140001bc0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140001a90
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140001e40
nop
lea rdx, [rsp + 0x48]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
cmp rbp, 0xf
cmova rdx, rdi
cmp qword [rsp + 0x58], 5
jne 0x140001b78
mov rax, r13
lea r8, [0x140025d6c]
nop word [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x140001af9
cmp rax, 5
jne 0x140001ae0
mov eax, r13d
jmp 0x140001afe
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140001b78
mov r8d, dword [rbx + 0xc]
add r8, r12
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], r8
mov r9d, dword [rbx + 8]
mov ecx, r13d
mov rdx, r13
test r9, r9
je 0x140001b42
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
crc32 ecx, eax
inc rdx
cmp rdx, r9
jb 0x140001b30
mov dword [rsp + 0x38], ecx
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x140001b6a
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rdx + 0x10], xmm1
add qword [rsi + 8], 0x18
jmp 0x140001b78
lea r8, [rsp + 0x28]
mov rcx, rsi
call fcn.1400020d0
nop
cmp rbp, 0xf
jbe 0x140001bab
lea rdx, [rbp + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140001ba3
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001be8
mov rcx, rdi
call fcn.140022220
inc r14d
add rbx, 0x28
movzx eax, word [r15 + 6]
cmp r14d, eax
jl 0x140001a70
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140022200
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140002310
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x6b0
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000234d
xor al, al
jmp 0x14000242f
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x6c0], rbx
mov rcx, rsi
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000241c
nop dword [rax]
nop word [rax + rax]
mov edx, dword [rsp + 0x28]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002406
lea rdx, [rsp + 0x260]
mov dword [rsp + 0x260], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400023fd
nop dword [rax + rax]
lea rax, [rsp + 0x290]
mov r8, rdi
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400023e4
add rax, 2
test ecx, ecx
jne 0x1400023d0
mov rcx, rbx
test edx, edx
je 0x140002450
lea rdx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400023c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002380
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x6c0]
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.140022200
mov rsi, qword [rsp + 0x6c8]
add rsp, 0x6b0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140002427
Function at 0x14000e240
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov r14, rdx
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000e365
mov qword [rsp + 0x48], rdi
mov rax, 0xffffffffffffffff
xor edi, edi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x14000e2a0
test rax, rax
je 0x14000e33c
mov qword [rsp + 0x88], rsi
mov rcx, rdi
mov qword [rsp + 0x40], r15
lea r15, [0x1400810f0]
nop dword [rax]
lea rsi, [rbx + rcx*2]
mov edx, 0x80
movzx ecx, word [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswctype]
test eax, eax
je 0x14000e30d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [r15 + rcx*2], 0
jne 0x14000e2f5
xor edx, edx
div rcx
movzx eax, word [r15 + rdx*2]
mov word [rsi], ax
inc edi
mov rax, 0xffffffffffffffff
mov ecx, edi
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000e320
cmp rcx, rax
jb 0x14000e2d0
mov r15, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
mov eax, dword [rsp + 0x30]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdi, qword [rsp + 0x48]
jmp 0x14000e37f
mov rcx, rbp
call fcn.14000e100
mov rdx, rax
lea rcx, str.Failed_to_read:__ws_ws_n_n
mov r8, r14
call fcn.14000ab70
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140022200
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
Function at 0x14000e490
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
mov eax, 0x2050
call fcn.140023300
sub rsp, rax
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rsp + 0x2040], rax
lea rax, [rsp + 0x30]
xor ebx, ebx
mov r9d, 0xf003f
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
test eax, eax
je 0x14000e545
mov r8d, 0x208
mov dword [rsp + 0x38], 0x208
lea rcx, [0x140081f80]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
lea edx, [rbx + 3]
mov rcx, 0xffffffff80000002
call qword [0x1400824c8]
lea r8, str.SYSTEMCurrentControlSetControlSystemInformation
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000e67d
mov qword [rsp + 0x2060], rsi
lea rcx, [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
mov r8d, 0x1ffe
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x1ffe
mov qword [rsp + 0x28], rax
lea rdx, str.ComputerHardwareIds
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000e64e
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x14000e625
mov qword [rsp + 0x2068], rdi
mov qword [rsp + 0x2070], r14
lea r14, [0x1400810f0]
nop
mov eax, ebx
lea rdi, [rsp + 0x40]
movzx ecx, word [rdi + rax*2]
lea rdi, [rdi + rax*2]
mov edx, 0x80
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswctype]
test eax, eax
je 0x14000e60b
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x14000e5f0
dec rcx
xor edx, edx
div rcx
movzx eax, word [r14 + rdx*2]
mov word [rdi], ax
mov eax, dword [rsp + 0x38]
inc ebx
cmp ebx, eax
jb 0x14000e5c0
mov r14, qword [rsp + 0x2070]
mov rdi, qword [rsp + 0x2068]
mov dword [rsp + 0x28], eax
lea rdx, str.ComputerHardwareIds
lea rax, [rsp + 0x40]
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x14000e66c
mov rcx, rsi
call fcn.14000e100
mov rdx, rax
lea r8, str.ComputerHardwareIds
lea rcx, str.Failed_to_read:__ws_ws_n_n
call fcn.14000ab70
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x2060]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140022200
add rsp, 0x2050
pop rbx
ret
Function at 0x14000e6a0
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r8
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
xor r8d, r8d
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
mov rsi, rdx
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000e73f
xor edx, edx
mov dword [rsp + 0x38], 0x208
mov r8d, 0x208
lea rcx, [0x140081f80]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x1400824c8]
mov r8, rsi
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000e788
mov rbx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x38], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov dword [rsp + 0x3c], eax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140022200
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000e7a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, r8
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov r9d, 0xf003f
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000e842
xor edx, edx
mov dword [rsp + 0x38], 0x208
mov r8d, 0x208
lea rcx, [0x140081f80]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
lea edx, [rbx + 3]
mov rcx, rdi
call qword [0x1400824c8]
mov r8, rsi
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000e946
mov rsi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov rcx, rsi
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov dword [rsp + 0x38], ebx
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000e8c9
xor edx, edx
mov dword [rsp + 0x3c], 0x208
mov r8d, 0x208
lea rcx, [0x140081f80]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x3c]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x1400824c8]
mov r8, rbp
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000e93d
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000e8e9
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.14000ab70
jmp 0x14000e93d
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x14000e916
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14000e907
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rsp + 0x38]
cmp ebx, eax
jb 0x14000e8f1
mov dword [rsp + 0x28], eax
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140022200
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000e970
Capabilities:
Delete registry key

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov qword [rsp + 0x50], 0
mov rdi, rdx
lea r8, [rsp + 0x50]
mov rdx, rsi
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp eax, 0x3fd
jne 0x14000e9ec
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14000ea4c
xor edx, edx
mov dword [rsp + 0x58], 0x208
mov r8d, 0x208
lea rcx, [0x140081f80]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x58]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x1400824c8]
mov r8, rsi
lea rdx, [0x140081f86]
lea rcx, str.Failed_to_create_key:__ws_ws_n_n
call fcn.14000ab70
jmp 0x14000eb79
mov r8, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCopyTreeA]
test eax, eax
jne 0x14000eb17
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
xor edx, edx
mov dword [rsp + 0x58], 0x208
lea rcx, [0x140081f80]
mov r8d, 0x208
test eax, eax
jne 0x14000eae4
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x58]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x1400824c8]
mov r9d, 0xc0
mov qword [rsp + 0x28], rsi
mov r8, rdi
mov dword [rsp + 0x20], 0xc4
lea rdx, [0x140081f86]
lea rcx, str._ws_ws_n_c_c_renamed_to__ws_n_n
call fcn.14000ab70
jmp 0x14000eb6e
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x58]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x1400824c8]
lea rcx, str.Failed_to_delete_key:__ws_ws_n_n
jmp 0x14000eb5f
xor edx, edx
mov dword [rsp + 0x58], 0x208
mov r8d, 0x208
lea rcx, [0x140081f80]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x58]
mov r9d, 0x208
lea r8, [0x140081f80]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x1400824c8]
lea rcx, str.Failed_to_copy_key:__ws_ws_n_n
mov r8, rdi
lea rdx, [0x140081f86]
call fcn.14000ab70
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140022200
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret