joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400083cc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
xor edx, edx
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [rbx + 0x40]
mov edx, eax
mov edi, eax
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
cmp rax, rbx
je 0x14000842c
cmp edi, ebx
jbe 0x140008423
mov rdx, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r11d, eax
lea eax, [rdi - 1]
cmp r11d, eax
jne 0x140008423
mov ebx, 1
jmp 0x14000842c
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140008520
Capabilities:
Encode data using base64 via winapi
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor ebx, ebx
xor r9d, r9d
mov r12d, r8d
mov r13, rdx
mov rdi, rcx
mov ebp, ebx
mov dword [rax + 0x20], ebx
cmp dword [0x140123d38], ebx
je 0x140008601
lea rax, [rax + 0x20]
lea r8d, [rbx + 1]
mov edx, r12d
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
cmp eax, ebx
je 0x140008666
mov edx, dword [rsp + 0x78]
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
cmp rax, rbx
je 0x140008666
lea rax, [rsp + 0x78]
lea r8d, [rbx + 1]
mov r9, rsi
mov edx, r12d
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov ebp, eax
cmp eax, ebx
je 0x1400085f6
lea rcx, str._n_nBase64_of_file_:__s_n_n
mov rdx, rdi
call fcn.14000a838
cmp dword [rsp + 0x78], ebx
jbe 0x1400085ea
mov rdi, rsi
movzx edx, word [rdi]
lea rcx, [0x1400d9d50]
call fcn.14000a838
inc ebx
add rdi, 2
cmp ebx, dword [rsp + 0x78]
jb 0x1400085cf
lea rcx, str._n
call fcn.14000a838
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008666
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, rbx
je 0x140008666
cmp rax, 0xffffffffffffffff
je 0x140008666
lea r9, [rsp + 0x78]
mov r8d, r12d
mov rdx, r13
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
je 0x14000865d
cmp r12d, dword [rsp + 0x78]
jne 0x14000865d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov eax, ebp
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x140008684
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rsi, r8
mov rbp, rdx
cmp dword [0x140123d3c], ebx
je 0x1400086d0
call fcn.1400119e4
mov ebx, eax
test eax, eax
jne 0x140008774
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_file_readData___kull_m_string_quick_base64_to_Binary__0x_08x__n
mov edx, eax
call fcn.14000a838
jmp 0x140008774
and qword [rsp + 0x30], rbx
and dword [rsp + 0x28], ebx
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
je 0x140008774
cmp rax, 0xffffffffffffffff
je 0x140008774
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14000876b
cmp dword [rsp + 0x44], ebx
jne 0x14000876b
mov rax, qword [rsp + 0x40]
mov ecx, 0x40
mov edx, eax
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp], rax
test rax, rax
je 0x14000876b
mov r8d, dword [rsi]
and qword [rsp + 0x20], rbx
lea r9, [rsp + 0x78]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140008761
mov eax, dword [rsp + 0x78]
cmp dword [rsi], eax
jne 0x140008761
mov ebx, 1
jmp 0x14000876b
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140009c30
Capabilities:
Get domain controller name

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
or edx, 0x40020000
lea rax, [r11 + 0x20]
mov rsi, r8
mov qword [r11 - 0x10], rax
mov dword [rsp + 0x20], edx
mov rdx, rcx
xor ebx, ebx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov qword [r11 + 0x20], rbx
call qword [sym.imp.NETAPI32.dll_DsGetDcNameW]
cmp eax, ebx
jne 0x140009cc8
mov rax, qword [rsp + 0x58]
or rcx, 0xffffffffffffffff
mov rdi, qword [rax]
xor eax, eax
add rdi, 4
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
lea ecx, [rbx + 0x40]
mov edx, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
mov qword [rsi], rax
cmp rax, rbx
je 0x140009cbc
mov rax, qword [rsp + 0x58]
mov r8, rdi
mov ebx, 1
mov rdx, qword [rax]
add rdx, 4
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x58]
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x140009cd6
lea rcx, str.ERROR_kull_m_net_getDC___DsGetDcName:__u_n
mov edx, eax
call fcn.14000a838
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140009ce8
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
neg ecx
mov rdi, rdx
sbb esi, esi
and dword [rax + 8], ebx
lea r8, [rax + 8]
and esi, 3
xor edx, edx
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x140009d75
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140009d75
mov edx, dword [rsp + 0x30]
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x140009d89
lea r8, [rsp + 0x30]
lea ecx, [rsi + 4]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ebx, eax
test eax, eax
jne 0x140009d89
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_net_getComputerName___GetComputerNameEx_data___0x_08x__n
mov edx, eax
call fcn.14000a838
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140009d89
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_net_getComputerName___GetComputerNameEx_init___0x_08x__n
mov edx, eax
call fcn.14000a838
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009ef0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [rcx + 8]
lea rax, [0x140123d40]
mov rdi, rdx
mov qword [r11 - 0x28], rbx
mov qword [r11 - 0x20], rax
mov edx, dword [rcx]
mov rbp, r8
cmp edx, ebx
je 0x14000a03d
sub edx, 1
je 0x140009fc6
sub edx, 2
je 0x140009f97
cmp edx, 3
jne 0x14000a117
mov rax, qword [rdi + 8]
cmp dword [rax], ebx
jne 0x140009feb
cmp qword [rsi], rbx
je 0x140009f6f
mov rcx, qword [rcx + 8]
mov edx, dword [rsi]
xor r9d, r9d
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, ebx
je 0x14000a117
mov rax, qword [rsi + 8]
mov rdx, qword [rdi]
lea r9, [rsp + 0x70]
mov rcx, qword [rax + 8]
mov r8d, ebp
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
jmp 0x14000a117
mov rax, qword [rdi + 8]
cmp dword [rax], ebx
jne 0x140009feb
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x30], ebx
mov r9d, r8d
mov qword [rsp + 0x28], rbx
mov edx, 0x22c187
mov r8, qword [rdi]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rsi
call fcn.140008c70
jmp 0x140009f90
mov rax, qword [rdi + 8]
cmp dword [rax], ebx
jne 0x140009feb
mov rcx, qword [rcx + 8]
mov rdx, qword [rsi]
mov r9, r8
mov r8, qword [rdi]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x140009f90
mov rdx, r8
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x40], rax
cmp rax, rbx
je 0x14000a117
lea rcx, [rsp + 0x40]
mov r8, rbp
mov rdx, rdi
call fcn.140009ef0
cmp eax, ebx
je 0x14000a02d
lea rdx, [rsp + 0x40]
mov r8, rbp
mov rcx, rsi
call fcn.140009ef0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000a117
mov rdx, qword [rdi + 8]
mov ecx, dword [rdx]
cmp ecx, ebx
je 0x14000a107
sub ecx, 1
je 0x14000a0e7
sub ecx, 1
je 0x14000a0cd
sub ecx, 1
je 0x14000a0ab
cmp ecx, 3
jne 0x14000a117
mov rcx, qword [rdx + 8]
mov edx, dword [rdi]
xor r9d, r9d
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14000a117
mov rax, qword [rdi + 8]
mov rdx, qword [rsi]
lea r9, [rsp + 0x70]
mov rcx, qword [rax + 8]
mov r8d, ebp
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x140009f90
mov rcx, qword [rdx + 8]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov edx, 0x22c183
jmp 0x140009fb4
mov rcx, qword [rdx + 8]
mov rdx, qword [rsi]
mov r9, r8
mov rcx, qword [rcx]
mov r8, qword [rdi]
call fcn.14000a634
jmp 0x140009f90
mov rcx, qword [rdx + 8]
mov rdx, qword [rdi]
mov r9, r8
mov r8, qword [rsi]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x140009f90
mov rdx, qword [rdi]
mov rcx, qword [rsi]
call sub.msvcrt.dll_memcpy
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000a3f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov r11, rcx
mov rcx, qword [rcx + 8]
mov rbx, r9
mov r9d, dword [rcx]
xor r10d, r10d
test r9d, r9d
je 0x14000a433
cmp r9d, 1
jne 0x14000a453
mov rcx, qword [rcx + 8]
mov r9d, r8d
mov r8, rdx
mov rdx, qword [r11]
mov rcx, qword [rcx]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x14000a441
mov rcx, qword [r11]
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r10d, eax
test eax, eax
je 0x14000a453
test rbx, rbx
je 0x14000a453
mov eax, dword [rsp + 0x40]
mov dword [rbx], eax
mov eax, r10d
add rsp, 0x30
pop rbx
ret

Function at 0x14000a45c
Capabilities:
Compress data via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rax, qword [rsp + 0x80]
mov ebp, edx
mov r13, rcx
mov edx, dword [rax]
xor ebx, ebx
mov r12, r9
lea ecx, [rbx + 0x40]
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14000a4f5
lea ecx, [rbx + 0x40]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x14000a4ec
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r12
mov ecx, 0x102
mov r9, rax
mov r8d, ebp
mov rdx, r13
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ntdll.dll_RtlCompressBuffer]
test eax, eax
setns bl
test ebx, ebx
jne 0x14000a4ec
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret

Function at 0x14000a510
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, rdx
mov rdi, rcx
lea edx, [rbx + 0x10]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x14000a5cf
and qword [rsp + 0x28], rbx
and dword [rsp + 0x20], ebx
lea r8d, [rbx + 2]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r11, rax
mov rax, qword [rsi]
mov qword [rax], r11
mov rdi, qword [rsi]
cmp qword [rdi], rbx
je 0x14000a5b2
mov rcx, qword [rdi]
and qword [rsp + 0x20], rbx
lea edx, [rbx + 4]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r11, rax
mov rax, qword [rsi]
mov qword [rax + 8], r11
mov rdi, qword [rsi]
mov rax, qword [rdi + 8]
test rax, rax
je 0x14000a5b2
cmp dword [rax], 0x504d444d
jne 0x14000a5b2
mov ecx, 0xa793
cmp word [rax + 4], cx
jne 0x14000a5b2
mov ebx, 1
jmp 0x14000a5cf
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000a5c1
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000a5cf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000b0c8
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdx, qword [rdx]
mov ebp, ecx
mov ebx, 0xc0000004
test rdx, rdx
je 0x14000b0fb
lea r9, [rax + 0x10]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, eax
jmp 0x14000b140
mov edi, 0x1000
mov edx, edi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x14000b140
lea r9, [rsp + 0x38]
mov r8d, edi
mov rdx, rax
mov ecx, ebp
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, eax
test eax, eax
jns 0x14000b136
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
add edi, edi
cmp ebx, 0xc0000004
je 0x14000b100
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000be50
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
sub rsp, 0xd0
mov r13d, r8d
mov edi, ecx
mov rsi, rdx
xor ebp, ebp
lea rcx, [rax - 0x78]
xor edx, edx
lea ebx, [rbp + 0x68]
or r13d, 0x10
mov r8, rbx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x60], ebx
cmp qword [rsp + 0x120], rbp
je 0x14000bea3
mov rbx, qword [rsp + 0x120]
jmp 0x14000beb4
mov edx, Ordinal_27
lea ecx, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rbx, rbx
je 0x14000bfef
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsdup]
mov rsi, rax
test rax, rax
je 0x14000bfef
test edi, edi
je 0x14000bf71
sub edi, 1
je 0x14000bf38
cmp edi, 1
jne 0x14000bfd2
mov r9d, dword [rsp + 0x100]
mov r8, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], rbp
and qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], rsi
and qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
jmp 0x14000bfa4
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], rbp
and qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r13d
and dword [rsp + 0x28], ebp
and qword [rsp + 0x20], rbp
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x14000bfa4
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], rbp
and qword [rsp + 0x30], rbp
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov dword [rsp + 0x28], r13d
and dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, eax
test eax, eax
je 0x14000bfd2
cmp dword [rsp + 0x128], 0
jne 0x14000bfbf
cmp qword [rsp + 0x120], 0
jne 0x14000bfe6
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x120], 0
jne 0x14000bfe6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
lea r11, [rsp + 0xd0]
mov eax, ebp
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret
Function at 0x14000cda0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [r9]
xor ebx, ebx
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov dword [rax], ecx
cmp ecx, ebx
je 0x14000ceec
cmp ecx, 1
jne 0x14000cee1
lea edx, [rbx + 0x20]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r11, rax
mov rax, qword [rdi]
mov qword [rax + 8], r11
mov rax, qword [rdi]
cmp qword [rax + 8], rbx
je 0x14000cee1
mov eax, esi
mov rcx, rbp
mov qword [rsp + 0x28], rbx
neg eax
mov dword [rsp + 0x20], ebx
sbb r8d, r8d
xor r9d, r9d
xor edx, edx
and r8d, 2
add r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r11, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx], r11
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
cmp qword [rcx], rbx
je 0x14000cee1
mov rcx, qword [rcx]
neg esi
mov qword [rsp + 0x20], rbx
sbb edx, edx
xor r9d, r9d
xor r8d, r8d
and edx, 0xfffffffe
add edx, 4
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r11, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx + 8], r11
mov rax, qword [rdi]
mov rdx, qword [rax + 8]
mov rcx, qword [rdx + 8]
cmp rcx, rbx
je 0x14000cee1
cmp dword [rcx], 0x66676572
jne 0x14000cec7
cmp dword [rcx + 0x1c], ebx
jne 0x14000cec7
add rcx, 0x1000
cmp dword [rcx], 0x6e696268
jne 0x14000cec7
mov qword [rdx + 0x10], rcx
movsxd rax, dword [rcx + 4]
lea rdx, [rax + rcx + 0x20]
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx + 0x18], rdx
mov rax, qword [rdi]
mov ecx, 0x6b6e
mov rdx, qword [rax + 8]
mov rax, qword [rdx + 0x18]
cmp word [rax + 4], cx
jne 0x14000cec7
test byte [rax + 6], 0xc
jne 0x14000ceec
mov rcx, qword [rdx + 8]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov r11, qword [rdi]
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000cef1
mov ebx, 1
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000d4ec
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r9d, dword [rcx]
xor ebx, ebx
mov r10, r8
mov r11, rdx
mov rbp, rcx
test r9d, r9d
je 0x14000d597
cmp r9d, 1
jne 0x14000d5d0
call fcn.14000d39c
test rax, rax
mov r11, rax
setne bl
test ebx, ebx
je 0x14000d5d0
mov edi, dword [rax + 8]
mov rcx, qword [rsp + 0x60]
btr edi, 0x1f
test rcx, rcx
je 0x14000d54d
mov eax, dword [rax + 0x10]
mov dword [rcx], eax
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x14000d5d0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000d593
xor ebx, ebx
cmp dword [rsi], edi
setae bl
test ebx, ebx
je 0x14000d593
bt dword [r11 + 8], 0x1f
jae 0x14000d57a
lea rdx, [r11 + 0xc]
jmp 0x14000d58b
mov rax, qword [rbp + 8]
movsxd r8, dword [r11 + 0xc]
mov rdx, qword [rax + 0x10]
lea rdx, [r8 + rdx + 4]
mov r8d, edi
call sub.msvcrt.dll_memcpy
mov dword [rsi], edi
jmp 0x14000d5d0
mov rax, qword [rsp + 0x70]
mov r9, qword [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov rdx, r10
mov rcx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test ebx, ebx
jne 0x14000d5d0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000d5e8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r9d, dword [rcx]
xor ebx, ebx
mov r10, r8
mov r11, rdx
mov rdi, rcx
test r9d, r9d
je 0x14000d67d
cmp r9d, 1
jne 0x14000d6b4
call fcn.14000d39c
mov r11, rax
test rax, rax
je 0x14000d6b4
mov ecx, dword [rax + 8]
mov r8d, ecx
btr r8d, 0x1f
cmp r8d, dword [rsp + 0x70]
setae bl
test ebx, ebx
je 0x14000d676
mov eax, dword [rsp + 0x60]
and ecx, 0x80000000
or ecx, dword [rsp + 0x70]
mov dword [r11 + 0x10], eax
bt ecx, 0x1f
mov dword [r11 + 8], ecx
jae 0x14000d659
lea rcx, [r11 + 0xc]
jmp 0x14000d66a
mov rax, qword [rdi + 8]
movsxd rdx, dword [r11 + 0xc]
mov rcx, qword [rax + 0x10]
lea rcx, [rdx + rcx + 4]
mov rdx, qword [rsp + 0x68]
call sub.msvcrt.dll_memcpy
jmp 0x14000d6b4
mov ecx, Ordinal_54
jmp 0x14000d6ae
mov eax, dword [rsp + 0x70]
mov r9d, dword [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x68]
mov rdx, r10
mov rcx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
test ebx, ebx
jne 0x14000d6b4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000d6c4
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r10d, dword [rcx]
xor r14d, r14d
mov r12, r9
mov r11d, r8d
mov rbp, rdx
mov edi, r14d
cmp r10d, r14d
je 0x14000d800
cmp r10d, 1
jne 0x14000d83f
cmp dword [rdx + 0x18], r14d
je 0x14000d83f
cmp r11d, dword [rdx + 0x18]
jae 0x14000d83f
cmp dword [rdx + 0x20], 0xffffffff
je 0x14000d83f
mov rax, qword [rcx + 8]
movsxd rcx, dword [rdx + 0x20]
mov r8, qword [rax + 0x10]
add rcx, r8
movzx eax, word [rcx + 4]
cmp eax, 0x666c
je 0x14000d749
cmp eax, 0x686c
jne 0x14000d83f
cmp word [rcx + 6], r14w
je 0x14000d83f
movzx eax, word [rcx + 6]
cmp r11d, eax
jae 0x14000d83f
movsxd rdx, dword [rcx + r11*8 + 8]
mov eax, 0x6b6e
add rdx, r8
cmp word [rdx + 4], ax
jne 0x14000d83f
cmp r9, r14
je 0x14000d83f
mov rsi, qword [rsp + 0x80]
cmp rsi, r14
je 0x14000d83f
test byte [rdx + 6], 0x20
je 0x14000d7d5
movzx ebx, word [rdx + 0x4c]
cmp dword [rsi], ebx
seta dil
cmp edi, r14d
je 0x14000d7fc
lea rcx, [rdx + 0x50]
mov rdx, rbx
call fcn.1400110b0
mov rbp, rax
cmp rax, r14
je 0x14000d7f7
lea r8, [rbx + rbx]
mov rdx, rax
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000d7f7
movzx ebx, word [rdx + 0x4c]
shr ebx, 1
cmp dword [rsi], ebx
seta dil
cmp edi, r14d
je 0x14000d7fc
movzx r8d, word [rbp + 0x4c]
add rdx, 0x50
mov rcx, r9
call sub.msvcrt.dll_memcpy
mov word [r12 + rbx*2], r14w
mov dword [rsi], ebx
jmp 0x14000d83f
mov r9, qword [rsp + 0x80]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov r8, r12
mov edx, r11d
mov rcx, rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, r14d
sete dil
cmp edi, r14d
jne 0x14000d83f
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, edi
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
ret