joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027a20
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140064d40]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x140027ad1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.14003704c
cmp rax, 1
jne 0x140027b07
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x140027aad
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x140027aa0
cmp rcx, 1
jb 0x140027b07
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140027a70
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140027ea0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140036df8
int3

Function at 0x140027d20
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140064d40]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
mov edi, 0x28
test al, al
je 0x140027dcf
nop dword [rax]
nop dword [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14003704c
cmp rax, 1
jne 0x140027e05
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x140027dac
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140027da0
cmp rcx, 1
jb 0x140027e05
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140027d70
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140027ea0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140036df8
int3

Function at 0x1400288d4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002891e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002891e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002891e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002891e
cmp dword [rcx + 0x84], 0xe
jbe 0x14002891e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140028920
xor al, al
add rsp, 0x28
ret
Function at 0x14002cc44
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002ccb3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002ccb3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002ccb3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002ccb3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002ccb3
cmp dword [rcx + 0x84], 0xe
jbe 0x14002ccb3
cmp dword [rcx + 0xf8], 0
je 0x14002ccb3
mov ecx, ebx
call fcn.14002cd64
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002cb40
nop
cmp dword [rbp + 0x20], 0
je 0x14002cd01
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002cd0c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002cc44

Function at 0x14002ce48
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002ccb3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002ccb3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002ccb3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002ccb3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002ccb3
cmp dword [rcx + 0x84], 0xe
jbe 0x14002ccb3
cmp dword [rcx + 0xf8], 0
je 0x14002ccb3
mov ecx, ebx
call fcn.14002cd64
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002cb40
nop
cmp dword [rbp + 0x20], 0
je 0x14002cd01
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002cd0c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002cc44
Function at 0x14003ebd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003ec57
mov rsi, rbx
cmp word [rax], bp
je 0x14003ec16
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14003ec00
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14003ebfc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140039d64
mov rdi, rax
test rax, rax
je 0x14003ec44
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140044f50
mov rbp, rdi
xor ecx, ecx
call fcn.14003ac98
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14004135c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140041372
mov al, 1
jmp 0x1400413d2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140041383
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400413d0
mov ecx, dword [rcx + 0x18]
nop
call fcn.14003f374
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400413d0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400413d0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400413d0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400413d2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140044d30
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140044d58
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140044d58
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001221
Capabilities:
Query service status
Resolve function by parsing pe exports

Disassembly:
jmp 0x140019120
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x24], eax
xor eax, eax
cmp eax, 1
je 0x1400192f8
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140019197
mov dword [rsp + 0x48], 1
jmp 0x14001919f
mov dword [rsp + 0x48], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000213a
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x28], 0
je 0x1400191d5
lea rax, str.QueryServiceStatus_hService__status_
test rax, rax
je 0x1400191d5
mov dword [rsp + 0x4c], 1
jmp 0x1400191dd
mov dword [rsp + 0x4c], 0
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140019211
mov edx, dword [rsp + 0x2c]
lea rcx, [rsp + 0x44]
call fcn.14000159b
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
lea rdx, [0x1401db250]
lea rcx, [rsp + 0x40]
call fcn.1400a1400
xor eax, eax
test eax, eax
jne 0x1400191b8
xor eax, eax
test eax, eax
jne 0x140019176
mov rax, qword [rsp + 0x88]
mov ecx, dword [rsp + 0x70]
cmp dword [rax + 4], ecx
jne 0x14001923c
mov eax, 1
jmp 0x1400192fd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x78]
cmp eax, dword [rsp + 0x80]
jbe 0x140019256
xor eax, eax
jmp 0x1400192fd
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 4]
cmp dword [rsp + 0x20], eax
je 0x140019287
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 4]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x38], eax
jmp 0x1400192ad
mov rax, qword [rsp + 0x88]
mov ecx, dword [rsp + 0x24]
cmp dword [rax + 0x14], ecx
jb 0x1400192a9
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x24], eax
jmp 0x1400192ad
xor eax, eax
jmp 0x1400192fd
xor edx, edx
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x18]
mov ecx, 0xa
div ecx
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0x3e8
jae 0x1400192d7
mov dword [rsp + 0x3c], 0x3e8
cmp dword [rsp + 0x3c], 0x2710
jbe 0x1400192e9
mov dword [rsp + 0x3c], 0x2710
mov ecx, dword [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001916b
mov eax, 1
add rsp, 0x50
pop rdi
ret
Function at 0x14000124e
Capabilities:
Set registry value

Disassembly:
jmp 0x140032c80
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x140032cbd
mov dword [rsp + 0x34], 1
jmp 0x140032cc5
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140032ce0
lea rax, str.m_hKey___0
test rax, rax
jne 0x140032d1a
lea rax, str.__atl_condVal_m_hKey___0_
mov qword [rsp + 0x28], rax
lea rax, [0x14016bf04]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1874
lea rdx, [0x14016c2a0]
mov ecx, 2
call fcn.14009c570
cmp eax, 1
jne 0x140032d1a
int3
cmp dword [rsp + 0x30], 0
jne 0x140032d2b
mov ecx, 0x80004005
call fcn.1400020ae
xor eax, eax
test eax, eax
jne 0x140032ca8
xor eax, eax
test eax, eax
jne 0x140032d35
xor eax, eax
test eax, eax
jne 0x140032ca8
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x40
pop rdi
ret
Function at 0x140001334
Capabilities:
Set environment variable

Disassembly:
jmp 0x140022960
push rdi
sub rsp, 0x60
mov rdi, rsp
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov qword [rsp + 0x48], 0xfffffffffffffffe
lea rcx, [rsp + 0x38]
call fcn.14000200e
nop
mov r8d, 0x9b9
lea rdx, [0x140178d78]
lea rcx, [rsp + 0x38]
call fcn.14000151e
lea rcx, [rsp + 0x38]
call fcn.14000110e
mov qword [rsp + 0x50], rax
lea rcx, [0x1401e3338]
call fcn.14000110e
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x1400229da
mov dword [rsp + 0x58], 1
jmp 0x1400229e2
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400229fd
lea rax, str.SetEnvironmentVariableW_Common::BuildNumberEnvironmentVariableName__sBuild_
test rax, rax
jne 0x140022a37
lea rax, str.__atl_condVal_SetEnvironmentVariableW_Common::BuildNumberEnvironmentVariableName__sBuild__
mov qword [rsp + 0x28], rax
lea rax, [0x14016bf04]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 7
lea rdx, str.c:_buildagentwork6ef1b807bd9726a1commonCommon.inl
mov ecx, 2
call fcn.14009c570
cmp eax, 1
jne 0x140022a37
int3
cmp dword [rsp + 0x44], 0
jne 0x140022a48
mov ecx, 0x80004005
call fcn.1400020ae
xor eax, eax
test eax, eax
jne 0x1400229a0
lea rcx, [rsp + 0x38]
call fcn.14000119a
mov rcx, rsp
lea rdx, [0x140178420]
call fcn.14009d1e0
add rsp, 0x60
pop rdi
ret

Function at 0x140001497
Capabilities:
Set registry value

Disassembly:
jmp 0x140032190
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x1400321cd
mov dword [rsp + 0x34], 1
jmp 0x1400321d5
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1400321f0
lea rax, str.m_hKey___0
test rax, rax
jne 0x14003222a
lea rax, str.__atl_condVal_m_hKey___0_
mov qword [rsp + 0x28], rax
lea rax, [0x14016bf04]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x186c
lea rdx, [0x14016c2a0]
mov ecx, 2
call fcn.14009c570
cmp eax, 1
jne 0x14003222a
int3
cmp dword [rsp + 0x30], 0
jne 0x14003223b
mov ecx, 0x80004005
call fcn.1400020ae
xor eax, eax
test eax, eax
jne 0x1400321b8
xor eax, eax
test eax, eax
jne 0x140032245
xor eax, eax
test eax, eax
jne 0x1400321b8
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x40
pop rdi
ret
Function at 0x1400014d8
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140027930
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x530
mov rdi, rsp
mov ecx, 0x14c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x540]
mov qword [rsp + 0x510], 0xfffffffffffffffe
mov rax, qword [0x1401dc280]
xor rax, rsp
mov qword [rsp + 0x520], rax
mov dword [rsp + 0x34], 0x100
mov eax, dword [rsp + 0x34]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140001767
nop
mov eax, dword [rsp + 0x34]
shl rax, 2
mov dword [rsp + 0x464], eax
lea rcx, [rsp + 0x50]
call fcn.140001d1b
lea r8, [rsp + 0x24]
mov edx, dword [rsp + 0x464]
mov rcx, rax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x1400279d3
mov dword [rsp + 0x518], 1
jmp 0x1400279de
mov dword [rsp + 0x518], 0
mov eax, dword [rsp + 0x518]
mov dword [rsp + 0x468], eax
cmp dword [rsp + 0x468], 0
jne 0x140027a17
mov dword [rsp + 0x500], 0
lea rcx, [rsp + 0x50]
call fcn.140002397
mov eax, dword [rsp + 0x500]
jmp 0x140027bc9
xor eax, eax
test eax, eax
jne 0x1400279a4
mov eax, dword [rsp + 0x464]
cmp dword [rsp + 0x24], eax
jne 0x140027ae4
xor edx, edx
mov eax, dword [rsp + 0x34]
mov ecx, 2
div ecx
mov ecx, dword [rsp + 0x34]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.1400019f1
mov eax, dword [rsp + 0x34]
shl rax, 2
mov dword [rsp + 0x464], eax
lea rcx, [rsp + 0x50]
call fcn.140001d1b
lea r8, [rsp + 0x24]
mov edx, dword [rsp + 0x464]
mov rcx, rax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x140027a95
mov dword [rsp + 0x51c], 1
jmp 0x140027aa0
mov dword [rsp + 0x51c], 0
mov eax, dword [rsp + 0x51c]
mov dword [rsp + 0x46c], eax
cmp dword [rsp + 0x46c], 0
jne 0x140027ad9
mov dword [rsp + 0x504], 0
lea rcx, [rsp + 0x50]
call fcn.140002397
mov eax, dword [rsp + 0x504]
jmp 0x140027bc9
xor eax, eax
test eax, eax
jne 0x140027a66
jmp 0x140027a1d
mov eax, dword [rsp + 0x24]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rsp + 0x470], eax
mov dword [rsp + 0x474], 0
jmp 0x140027b16
mov eax, dword [rsp + 0x474]
inc eax
mov dword [rsp + 0x474], eax
mov eax, dword [rsp + 0x470]
cmp dword [rsp + 0x474], eax
jae 0x140027bad
lea rcx, [rsp + 0x50]
call fcn.140001d1b
mov ecx, dword [rsp + 0x474]
cmp dword [rax + rcx*4], 0
je 0x140027ba8
lea rcx, [rsp + 0x490]
call fcn.140001e0b
nop
lea rcx, [rsp + 0x50]
call fcn.140001d1b
mov ecx, dword [rsp + 0x474]
movzx r9d, byte [rsp + 0x550]
lea r8, [rsp + 0x490]
mov edx, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x540]
call fcn.1400013d9
test eax, eax
je 0x140027b9b
lea rdx, [rsp + 0x490]
mov rcx, qword [rsp + 0x548]
call fcn.1400021e9
nop
lea rcx, [rsp + 0x490]
call fcn.140001c26
jmp 0x140027b06
mov dword [rsp + 0x508], 1
lea rcx, [rsp + 0x50]
call fcn.140002397
mov eax, dword [rsp + 0x508]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140177e10]
call fcn.14009d1e0
mov rax, rdi
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.1400a2180
add rsp, 0x530
pop rdi
ret
Function at 0x140001b0e
Capabilities:
Set registry value

Disassembly:
jmp 0x140032f70
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x140032fb2
mov dword [rsp + 0x38], 1
jmp 0x140032fba
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140032fd5
lea rax, str.m_hKey___0
test rax, rax
jne 0x14003300f
lea rax, str.__atl_condVal_m_hKey___0_
mov qword [rsp + 0x28], rax
lea rax, [0x14016bf04]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x187d
lea rdx, [0x14016c2a0]
mov ecx, 2
call fcn.14009c570
cmp eax, 1
jne 0x14003300f
int3
cmp dword [rsp + 0x30], 0
jne 0x140033020
mov ecx, 0x80004005
call fcn.1400020ae
xor eax, eax
test eax, eax
jne 0x140032f9d
xor eax, eax
test eax, eax
jne 0x14003302a
xor eax, eax
test eax, eax
jne 0x140032f9d
cmp qword [rsp + 0x60], 0
je 0x14003304c
mov dword [rsp + 0x3c], 1
jmp 0x140033054
mov dword [rsp + 0x3c], 0
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x14003306f
lea rax, str.pszValue___NULL
test rax, rax
jne 0x1400330a9
lea rax, str.__atl_condVal_pszValue___NULL_
mov qword [rsp + 0x28], rax
lea rax, [0x14016bf04]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x187e
lea rdx, [0x14016c2a0]
mov ecx, 2
call fcn.14009c570
cmp eax, 1
jne 0x1400330a9
int3
cmp dword [rsp + 0x34], 0
jne 0x1400330ba
mov eax, 0xd
jmp 0x140033146
xor eax, eax
test eax, eax
jne 0x14003303a
cmp dword [rsp + 0x68], 1
je 0x14003310c
cmp dword [rsp + 0x68], 2
je 0x14003310c
lea rax, str._dwType____1______dwType____2___
mov qword [rsp + 0x28], rax
lea rax, [0x14016bf04]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x187f
lea rdx, [0x14016c2a0]
mov ecx, 2
call fcn.14009c570
cmp eax, 1
jne 0x14003310c
int3
mov rcx, qword [rsp + 0x60]
call fcn.1400a04a0
inc eax
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x40
pop rdi
ret
Function at 0x140001b22
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x140019390
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1400193dc
xor eax, eax
jmp 0x140019489
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400193fb
xor eax, eax
jmp 0x140019489
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x70]
and eax, 0xf
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jbe 0x140019464
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
jae 0x140019464
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
dec eax
mov dword [rsp + 0x40], eax
jmp 0x14001942e
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
jb 0x140019474
xor eax, eax
jmp 0x140019489
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
test eax, eax
jne 0x140019484
xor eax, eax
jmp 0x140019489
mov rax, qword [rsp + 0x20]
add rsp, 0x50
pop rdi
ret
Function at 0x140001e3d
Capabilities:
Check for time delay via gettickcount

Disassembly:
jmp 0x14000a690
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov byte [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x34], eax
movzx eax, byte [rsp + 0x30]
test eax, eax
jne 0x14000a6d9
mov rcx, qword [rsp + 0x50]
call fcn.1400012fd
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.14000226b
movzx eax, al
test eax, eax
je 0x14000a6f5
mov al, 1
jmp 0x14000a7c4
cmp dword [rsp + 0x60], 0xffffffff
jne 0x14000a706
mov dword [rsp + 0x38], 0xffffffff
jmp 0x14000a735
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x34]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x60], eax
ja 0x14000a725
xor al, al
jmp 0x14000a7c4
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 8]
test rax, rax
jne 0x14000a77d
lea rax, str.m_hSemaphore
mov qword [rsp + 0x28], rax
lea rax, [0x140164d5c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x3c
lea rdx, str...CommonCritSectEx.cpp
mov ecx, 2
call fcn.14009c570
cmp eax, 1
jne 0x14000a77d
int3
mov edx, dword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
je 0x14000a7a7
cmp dword [rsp + 0x3c], 0x102
je 0x14000a7ae
jmp 0x14000a7b5
mov byte [rsp + 0x30], 0
jmp 0x14000a7bf
mov byte [rsp + 0x30], 1
jmp 0x14000a7bf
mov ecx, 1
call fcn.140001b7c
jmp 0x14000a6c6
add rsp, 0x40
pop rdi
ret