joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cd3b6
Capabilities:
Encode data using xor

Disassembly:
sub dil, 0x86
cmp r14b, dil
push r10
push 0x3487b113
mov rdi, qword [rsp + 0x20]
mov rdi, qword [rdi]
call fcn.1400a8361
invalid
pushfq
and dl, 0x80
shr rdx, 0x32
mov qword [rsp + 0x20], 0xffffffff84d83326
mov rdx, qword [rsp + rdx*2 - 0x20e8]
jne 0x1400c6ad3
jo 0x1400cd393
stc
in eax, 0xc9
movabs al, byte [0xb25b47237682f4f2]
loopne 0x1400cd373
enter 0xffffffffffffb1f4, 0x3d
xor dword [rax - 0x313d6bfe], esp
mov esi, dword [rdi + 0x1b]
ficomp dword [rax + 0x21746026]
enter 0xffffffffffffe199, 0xffffffffffffffad
xor byte [rsi], ah
add eax, 0xbaff0008
push rcx
fcomp st(1)
jle 0x1400cd3e6
hlt
invalid

Function at 0x1400ce5e5
Capabilities:
Connect pipe

Disassembly:
mov rdx, qword [rsp + rdx - 0xe3c04c8]
neg bx
neg byte [rsp + 0x20]
and dword [rsp + 0x40], 0x7a0f239f
jno 0x140093fdc
jle fcn.1400ce5a8
add dword [rdi], ebx
or eax, 0x30641f00
add byte [rdi], bl
push rsp
invalid

Function at 0x1400d03fa
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rdx
mov rdx, r15
add qword [rsp + 8], 0xfffffffffffe3e60
mov r15b, 4
xchg qword [rsp + 0x20], rbx
and r15d, 0xa3223b0b
mov r15w, 0x351a
jae 0x14004ee87

Function at 0x1400d4438
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rbp, qword [rsp + 0x20]
shr byte [rsp + 0x38], 0xdb
sets byte [rsp + 0x38]
sub r13, qword [rsp + 0x38]
jbe 0x1400b2451
call fcn.1400d053e
push rcx
test dword [rcx + 0x7a2c3a78], ebx
cmpsb byte [rsi], byte [rdi]
jrcxz 0x1400d10f8
jmp 0x1400d115d
invalid
jbe 0x1400d10f2
and bpl, 0x24
jge 0x1400605fa
in eax, dx
movabs eax, dword [0xe34ff95f0d94b8e4]
cmpsb byte [rsi], byte [rdi]
mov edx, 0xeba50796
lodsd eax, dword [rsi]
pop rcx
or al, 0x38
and al, 5
test eax, 0x727633ef
outsb dx, byte [rsi]
xlatb
test dword [rbx + 0x1d], ebx
add dword [rax + rdi*4 - 0x2c], eax
lodsd eax, dword [rsi]
cmp sil, byte [rcx]
add eax, 0xd618028
sar dword [rbp + 0x42], 1
invalid

Function at 0x1400d88dc
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov qword [rsp + 0x20], rax
movabs rbx, 0x22bccc37d210e920
neg bl
add ebx, 0xbf3151b0
add qword [rsp + 0x10], 0xfffffffffff9e579
and bl, bl
push r12
nop
movabs r12, 0xb8eaa1a2c37a733

Function at 0x1400d8e13
Capabilities:
Connect pipe

Disassembly:
add r12d, 0xa510b916
shr ebp, 0x23
add qword [rsp + rbx - 0xffffa8], 0xffffffffbff5805a
call fcn.14005efc4

Function at 0x1400d8e2e
Capabilities:
Connect pipe

Disassembly:
and qword [rsp + 0x10], 0xffffffffa19be491
sub r9d, r9d
jne 0x1400715ea
lea rax, [rax + r9 + 0x4c2f38b8]
mov qword [rsp + r9 + 0x28], r9
not byte [rsp + r9*2 + 0x28]
jo 0x1400109a6
jg 0x14006895a
js 0x140090ab4
call fcn.14008deab
Function at 0x1400d9a8d
Capabilities:
Encode data using xor

Disassembly:
shr r9w, 0x7f
xor r13d, 0xde2cc5aa
mov r8, qword [rsp + rbp - 0x39143f0d]
add qword [rsp + 0x40], 0xffffffffbff9d1c5
mov r13w, word [rsp + 0x55]
call fcn.140067f3d
mov rdx, qword [rsp + r10 - 0x193cbd9b]
or r10w, r10w
lea r10, [r10 + r10*2 - 0x7a4c3929]
push r10
sub r10d, dword [rsp + r10 + 0x2e960014]
jo 0x14006ba40
lea rdx, [rdx + 1]
not r10w
xor qword [rsp], 0xffffffffb7ada425
jno 0x1400daf7f
or dword [rax], edi
pop rdx
sbb al, 0x6a
add r14d, dword [rdi + 0x6b]
sub ch, byte [rax + 0x46]
add byte [rcx + rcx - 0x33], cl
rol dword [rax], 1
and dh, ah
movabs byte [0x98dea0f25b476336], al
add dword [rbp + 0x59], r8d
and byte [rdx + 0x24], dh
jb 0x1400a338a
invalid
add al, 0
loopne 0x1400a338d
inc dword [rcx - 0x7b2027eb]
cmp byte [rdi - 0x39], dl
xchg edi, eax
sti
adc dword [0x1788f1370], 0xfb97c757
mov word [r9], es
sbb esp, ecx
stosb byte [rdi], al
xchg byte [r11 - 0x31], bpl
sbb ecx, edx
xor dword [rsi - 0x1ffffc], eax
pop rsp
mov ecx, dword [rcx - 0x49]
and eax, 0xf6bd517e
outsb dx, byte [rsi]
jg 0x1400a339d
invalid
push rdx
push r10
movabs r10, 0x8297727193cbdb3
pushfq
or r10d, r10d
test r10w, r10w
jno 0x1400a32bb
invalid

Function at 0x1400dae55
Capabilities:
Delete registry key
Encode data using xor
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
je fcn.1400c03cf
add qword [rsp + r13 + 0x5335a100], 0xffffffffbff5d4bb
mov r9, qword [rsp + r13 + 0x5335a148]
xchg qword [rsp + r13 + 0x5335a158], rdx
mov r9, qword [rsp + r9 + 0x43e83be3]
sub dword [rsp + r13 + 0x5335a148], 0x3d14958a
mov byte [rsp + r13 + 0x5335a148], 0xb3
call fcn.140079484
push rbp
push r10
call fcn.1400156f0
Function at 0x140009e70
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x140009ea5
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x140009eaa
call fcn.140021b80
mov ecx, dword [0x14037d0a0]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdx
add rsp, 0x38
ret

Function at 0x14000c8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000c930
cmp r10, r11
jb 0x14000c9a6
cmp r10, rdx
ja 0x14000c9ba
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000c932
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000c910
jmp 0x14000c994
ja 0x14000c93a
mov r11, r10
cmp rax, r8
jne 0x14000c8d4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000c970
mov rdi, r8
sub ecx, edx
jns 0x14000c98b
jmp 0x14000c996
cmp r8, rsi
je 0x14000c9cb
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000c996
xor al, 1
cmp rdi, rsi
jne 0x14000c950
jmp 0x14000c996
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140035fa0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140035d80
ud2
lea rcx, str.called__Option::unwrap____on_a__None__valueinternal_error:_entered_unreachable_code_rustc_88fb1b922b047981fc0cfc62aa1418b4361ae72elibrary_alloc_src_vecmod.rs
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140035d90
ud2
Function at 0x140011850
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140011892
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14001189a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1400118ab
jmp 0x1400118c2
xor r10d, r10d
jmp 0x14001194d
xor r9d, r9d
xor esi, esi
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1400118c2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400118d9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1400118f9
add r11, r8
jmp 0x140011a2a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1400119c2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140011970
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x1400119e0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x1400119f2
jmp 0x140011a0c
xor r8d, r8d
xor r9d, r9d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140011a0c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140011a26
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140017f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x140017fab
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x140017fab
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x140017fc6
cmp eax, 0x42
jne 0x140017fab
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x140018076
cmp byte [r9 + r11], 0x5f
jne 0x140018076
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x1400180de
mov rcx, rsi
xor edx, edx
call fcn.1400130c0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.1400130c0
test al, al
jne 0x140018171
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140018002
lea rdx, [0x14036cfc3]
mov r8d, 1
call fcn.14000a8e0
test al, al
jne 0x140018171
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x140017fba
xor r14d, r14d
lea rbx, [0x14036d38e]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x140018034
cmp byte [rax + rcx], 0x45
je 0x14001819a
sub r14, 1
jb 0x140018059
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140018059
mov r8d, 2
mov rdx, rbx
call fcn.14000a8e0
test al, al
jne 0x140018171
mov rcx, rsi
call fcn.1400181b0
test al, al
jne 0x140018171
mov rax, qword [rsi]
test rax, rax
jne 0x140018020
jmp 0x140017fba
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x140018138
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x1400180d2
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x1400180bc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x1400180ab
add dl, 0xa9
jmp 0x1400180ba
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x140018138
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x140018138
movzx edx, bl
add rax, rdx
jae 0x140018080
jmp 0x140018138
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x140018138
cmp rax, rcx
jae 0x140018135
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x140018179
cmp qword [rsi + 0x20], 0
je 0x1400181a6
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.140017f50
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x140017fbc
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140018188
lea rax, [0x14036d359]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.14000a8e0
test al, al
je 0x140018188
mov dil, 2
jmp 0x140017fba
mov dil, 1
xor r8d, r8d
mov rcx, qword [rsi + 0x20]
test rcx, rcx
jne 0x140018143
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x140017fba
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x140017fba
xor edi, edi
jmp 0x140017fba
Function at 0x14001f840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x14001f870
test ecx, ecx
jne 0x14001f8c0
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x14001f87c
test ecx, ecx
jne 0x14001f8c0
mov rcx, rdi
call fcn.14001f720
movzx eax, al
test bpl, bpl
jne 0x14001f8c7
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x14001f8b3.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x14001fa38]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x14001f8b3.2
xor eax, eax
test bpl, bpl
je 0x14001f88c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x14001fa19
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x14001f8fa
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x14001f979
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x14001f940
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x14001f95b
inc rax
dec rdi
cmp rax, 1
jne 0x14001f920
jmp 0x14001f979
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x14001f95b
cmp ebx, 0x5c
je 0x14001f95b
inc rax
dec rdi
cmp rax, 1
jne 0x14001f940
jmp 0x14001f979
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x14001fa27
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x14001f9a3
mov al, 9
cmp rdx, 2
je 0x14001f9a7
cmp rdx, 1
jne 0x14001f9b7
cmp byte [r8], 0x2e
jne 0x14001f9b7
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x14001f9b7
mov al, 0xa
jmp 0x14001f9b7
cmp byte [r8], 0x2e
jne 0x14001f9b7
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], rdx
mov byte [rsi + 0x18], al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x14001f8b3.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x14001f8b3.2
mov ecx, 2
jmp case.0x14001f8b3.2
lea r8, str.library_std_srcpath.rs
call fcn.140035d70
ud2
lea r8, str.library_std_srcpath.rs
call fcn.140035d70
ud2
Function at 0x140021b80
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x140021bc3
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x140020840]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
mov qword [rbp - 0x60], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.140035cb0
ud2
Function at 0x14002b7f8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002b5e8
Function at 0x14002e860
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14002e890
xor eax, eax
jmp 0x14002e953
mov rbp, rbx
cmp word [rax], si
je 0x14002e8b5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14002e89c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14002e898
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14002e7b0
movsxd r14, eax
test eax, eax
jne 0x14002e8f3
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
jmp 0x14002e889
mov rcx, r14
call fcn.14002f714
mov rdi, rax
test rax, rax
jne 0x14002e90c
xor ecx, ecx
call fcn.14002ce40
jmp 0x14002e8e8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14002e7b0
test eax, eax
jne 0x14002e93d
mov rcx, rdi
call fcn.14002ce40
jmp 0x14002e947
xor ecx, ecx
call fcn.14002ce40
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140031e1c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14002d8b4
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140031ea6
cmp byte [rbp - 0x21], r15b
je 0x140031ea1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140031edc
call fcn.14002ff34
test eax, eax
jne 0x140031ec8
cmp byte [rbp - 0x21], r15b
je 0x140031ec0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140031edc
cmp byte [rbp - 0x21], r15b
je 0x140031ed9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14002ce90
test eax, eax
jne 0x140031f7c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14002d8b4
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140031f1b
cmp byte [rbp - 0x21], r15b
je 0x140031f50
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140031f50
call fcn.14002ff34
test eax, eax
jne 0x140031f3c
cmp byte [rbp - 0x21], r15b
je 0x140031f35
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140031f50
cmp byte [rbp - 0x21], r15b
je 0x140031f4d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14002ce90
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140031f7c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140031f7f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140031f8d
mov rcx, rdi
call fcn.14002ce40
cmp byte [rbp + 0x3f], r15b
je 0x140031f9c
mov rcx, qword [rbp + 0x27]
call fcn.14002ce40
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140009024
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000906e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000906e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000906e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000906e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000906e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009070
xor al, al
add rsp, 0x28
ret
Function at 0x140001334
Capabilities:
Terminate process

Disassembly:
jmp 0x1400081ec
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140007e34
Capabilities:
Parse pe header

Disassembly:
jmp 0x140007e34
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007e7e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007e7e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007e7e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007e7e
cmp dword [rcx + 0x84], 0xe
jbe 0x140007e7e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140007e80
xor al, al
add rsp, 0x28
ret
Function at 0x140001280
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x190
lea rbp, [rsp + 0x40]
mov rax, qword [0x140063028]
xor rax, rbp
mov qword [rbp + 0x148], rax
call fcn.14001e930
test eax, eax
jne 0x1400013d4
mov rax, qword [rbp + 0x198]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x190]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x188]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x180]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x178]
lea r8, [rbp + 0x20]
mov edx, dword [rbp + 0x168]
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [rbp + 4], eax
call fcn.140004730
mov dword [rbp + 0x10], eax
lea rax, [rbp + 0x20]
mov qword [rbp + 0x130], rax
cmp qword [rbp + 0x130], 0
jne 0x14000133c
mov qword [rbp + 0x138], 0
jmp 0x1400013bc
mov rcx, qword [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x140001365
mov qword [rbp + 0x140], 0
jmp 0x1400013ae
movsxd rcx, dword [rbp]
shl rcx, 1
mov rax, rcx
add rax, 0xf
cmp rax, rcx
ja 0x140001382
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140045760
sub rsp, rax
lea rcx, [rsp + 0x40]
mov r9d, dword [rbp + 0x10]
mov r8d, dword [rbp]
mov rdx, qword [rbp + 0x130]
call fcn.140004740
mov qword [rbp + 0x140], rax
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x138], rax
mov rdx, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x170]
call fcn.14001fe10
mov eax, dword [rbp + 4]
jmp 0x140001425
mov rax, qword [rbp + 0x198]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x190]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x188]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x180]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x178]
mov r8, qword [rbp + 0x170]
mov edx, dword [rbp + 0x168]
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov rcx, qword [rbp + 0x148]
xor rcx, rbp
call fcn.14002f160
lea rsp, [rbp + 0x150]
pop rbp
ret

Function at 0x140001450
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov rax, qword [0x140063028]
xor rax, rsp
mov qword [rsp + 0xc8], rax
call fcn.14001e930
test eax, eax
jne 0x1400014c3
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x30]
call fcn.140004c20
lea rcx, [rsp + 0x30]
call fcn.14000a230
mov rdx, rax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [rsp + 0xc0], eax
lea rcx, [rsp + 0x30]
call fcn.140004c60
mov eax, dword [rsp + 0xc0]
jmp 0x1400014d9
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14002f160
add rsp, 0xd8
ret