joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180125cf0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
mov rdi, rdx
mov ebx, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov qword [rbp - 0x4c], rcx
mov rdx, rdi
mov qword [rbp - 0x54], rdx
mov r8d, ebx
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.180005100
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_ReadFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.180005150
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.180002f10
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x180125e70
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
mov rdi, rdx
mov ebx, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov qword [rbp - 0x4c], rcx
mov rdx, rdi
mov qword [rbp - 0x54], rdx
mov r8d, ebx
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.180005100
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.180005150
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.180002f10
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x18014d690
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
cmp edx, 0xffffffff
jne 0x18014d6a4
mov edi, 0xd5313557
jmp 0x18014d6cb
mov ecx, edx
call fcn.18014d5c0
mov rdx, rax
lea rcx, [0x18031d040]
lea r8, [0x18031fca0]
call fcn.180073e70
mov rcx, rax
call fcn.18014d550
mov edi, eax
mov eax, edi
rol eax, 0xd
add eax, edi
mov edi, eax
xor edi, esi
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rsi
pop rdi
ret

Function at 0x180192540
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, eax
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x18019257e
mov r9d, eax
lea r9, [rdx + r9*8 + 0x10]
mov r9, qword [r9]
mov r10, r9
test r10, r10
jne 0x180192563
xor r10d, r10d
jmp 0x180192567
mov r10d, dword [r9 + 0x14]
mov r9d, ecx
rol r9d, 0xd
add r9d, ecx
mov ecx, r9d
xor ecx, r10d
inc eax
cmp r8d, eax
jg 0x18019254b
mov eax, ecx
rol eax, 0xf
add eax, ecx
ret
Function at 0x180195330
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
mov edi, edx
call fcn.18000107c
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 8
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x28
pop rsi
pop rdi
ret

Function at 0x1801953a0
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov edi, edx
mov ebx, r8d
call fcn.18000107c
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 0xc
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, ebx, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x180199700
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x180199734
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x180199716
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret

Function at 0x180199750
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x180199784
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x180199766
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x1400028e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, ebx
movabs rax, 0x20c49ba5e353f7cf
imul rdx, qword [rdi + 0x288]
imul rdx
mov rbx, rdx
sar rbx, 7
mov rax, rbx
shr rax, 0x3f
add rbx, rax
add rbx, qword [rsp + 0x30]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp qword [rsp + 0x40], rbx
jle 0x140002930
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140008090
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov edi, 0x80004005
lea rcx, [rsp + 0x30]
call fcn.140002d80
nop
xor esi, esi
mov ebx, esi
cmp qword [rsp + 0x30], rbx
je 0x14000811e
mov ecx, 0xd0
call fcn.14001ebb0
mov qword [rsp + 0x290], rax
test rax, rax
je 0x1400080e1
mov rcx, rax
call fcn.140007890
mov rbx, rax
jmp 0x1400080e4
mov rbx, rsi
test rbx, rbx
je 0x14000811e
mov rcx, rbx
call fcn.140007cf0
mov edi, eax
test eax, eax
js 0x14000811e
lfence
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x140008310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xb8], rax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140008135
lock inc dword [rax + 8]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140002ef0
test edi, edi
jns 0x1400082a6
test rbx, rbx
je 0x1400082a6
mov dword [rbx], 1
cmp qword [rbx + 8], 0
je 0x140008175
lfence
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp qword [rbx + 0xb8], 0
je 0x140008196
lfence
mov rcx, qword [rbx + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xb8], rsi
cmp qword [rbx + 0x28], 0
je 0x140008240
lfence
xor eax, eax
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x6c], eax
xor edx, edx
mov r8d, 0x1fb
lea rcx, [rsp + 0x84]
call fcn.140020d50
mov dword [rsp + 0x50], 7
mov dword [rsp + 0x5c], esi
mov rax, qword [rbx + 8]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3000
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x70], rax
mov rax, qword [rbx + 0x38]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], 0x1000
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_SafeArrayAccessData
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, 0x22f
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 0x28]
call fcn.1400032d0
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x40], rsi
cmp qword [rbx + 0x20], 0
je 0x140008240
lfence
mov rcx, qword [rbx + 0x20]
call fcn.1400262f0
mov qword [rbx + 0x20], rsi
cmp qword [rbx + 0x10], 0
je 0x140008258
lfence
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 8], 0
je 0x140008270
lfence
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
cmp qword [rbx + 0x38], 0
je 0x140008288
lfence
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x38], rsi
lfence
mov rcx, rbx
call fcn.140007ac0
lfence
mov edx, 0xd0
mov rcx, rbx
call fcn.14001ebec
mov rbx, rsi
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x1400082ea
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x1400082ea
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax]
call qword [0x140036608]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x1400082ea
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [0x140036608]
mov rax, rbx
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000e980
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x58
cmp byte [0x14004b858], 0
je 0x14000e997
mov eax, 0xffffffff
add rsp, 0x58
ret
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea r8, [rsp + 0x20]
lea rcx, [0x14004b8d0]
call fcn.14000ec60
cmp al, 1
jne 0x14000ea61
call fcn.14001cf90
cmp byte [rax], bl
je 0x14000ea5a
call fcn.14001cf90
cmp byte [rax + 0x90], bl
je 0x14000ea5a
call fcn.14001cf90
cmp byte [rax + 0x50], bl
je 0x14000ea5a
call fcn.14001cf90
cmp byte [rax + 0xa0], bl
je 0x14000ea5a
call fcn.14001cf90
cmp byte [rax + 0xb0], bl
je 0x14000ea5a
call fcn.14001cf90
cmp byte [rax + 0xc0], bl
je 0x14000ea5a
lea rax, [0x14004b938]
mov dword [0x14004bb5c], 1
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
lea rax, [0x140010fb0]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14000ea65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x14004bb4c], eax
mov ebx, eax
jmp 0x14000ea65
mov ebx, 0x80070032
jmp 0x14000ea65
mov ebx, dword [rsp + 0x20]
cmp dword [0x14004bb5c], 0
jne 0x14000ea7d
cmp byte [0x14004b932], 0
je 0x14000ea7d
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x140010420
Capabilities:
Create service

Disassembly:
push rdi
sub rsp, 0xa90
mov rax, qword [0x14004a0e8]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rdi, rcx
call fcn.1400106a0
test eax, eax
je 0x140010451
mov eax, 1
jmp 0x140010558
mov r8d, 0x104
lea rdx, [rsp + 0x72]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14001064e
cmp eax, 0x104
je 0x14001064e
lea ecx, [rax + 1]
mov r8d, 0x22
mov word [rsp + 0x70], r8w
mov word [rsp + rcx*2 + 0x70], r8w
lea ecx, [rax + 2]
add rcx, rcx
cmp rcx, 0x20c
jae 0x140010697
mov qword [rsp + 0xaa8], rbx
xor edx, edx
mov qword [rsp + 0xab0], rsi
mov r8d, 0xf003f
xor esi, esi
mov word [rsp + rcx + 0x70], si
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140010571
mov r8d, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80a
call fcn.140010300
test eax, eax
jne 0x14001052f
lea r8, str.Could_not_open_Service_Manager
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.140028300
test eax, eax
je 0x14001052f
cmp eax, 0xc
je 0x14001066b
cmp eax, 0x16
je 0x140010660
cmp eax, 0x22
je 0x140010660
cmp eax, 0x50
jne 0x140010655
lea r8, [rdi + 0x68]
xor r9d, r9d
lea rdx, [rsp + 0x280]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rbx, qword [rsp + 0xaa8]
mov rsi, qword [rsp + 0xab0]
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.14001ec80
add rsp, 0xa90
pop rdi
ret
mov qword [rsp + 0x60], rsi
lea rax, str.RPCSS
mov qword [rsp + 0x58], rsi
add rdi, 0x68
mov qword [rsp + 0x50], rax
mov r9d, 0xf01ff
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rsi
mov r8, rdi
mov qword [rsp + 0x38], rax
mov rdx, rdi
mov dword [rsp + 0x30], 1
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x140010632
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8d, 0x400
lea rdx, [rsp + 0x280]
mov ecx, 0xd80b
call fcn.140010300
test eax, eax
jne 0x140010627
lea r8, str.Could_not_start_service
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.140028300
test eax, eax
je 0x140010627
cmp eax, 0xc
je 0x14001068c
cmp eax, 0x16
je 0x140010681
cmp eax, 0x22
je 0x140010681
cmp eax, 0x50
jne 0x140010676
xor r9d, r9d
mov r8, rdi
jmp 0x140010536
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x140010548
xor eax, eax
jmp 0x140010558
mov ecx, 0x80004005
call fcn.140004100
int3
mov ecx, 0x80070057
call fcn.140004100
int3
mov ecx, 0x8007000e
call fcn.140004100
int3
mov ecx, 0x80004005
call fcn.140004100
int3
mov ecx, 0x80070057
call fcn.140004100
int3
mov ecx, 0x8007000e
call fcn.140004100
int3
call fcn.14001f2c4
int3
Function at 0x140010720
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
cmp dword [rcx + 0x28c], 0
mov rsi, rcx
je 0x140010848
lea rdx, str.SeDebugPrivilege
mov qword [rsp + 0x78], r14
call fcn.14000f4a0
lea rdx, str.SeImpersonatePrivilege
mov rcx, rsi
call fcn.14000f4a0
lea rdx, str.SeTcbPrivilege
mov rcx, rsi
call fcn.14000f4a0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx edx, byte [rsi + 0x299]
movzx ecx, byte [rsi + 0x298]
mov dword [rsi + 0x290], eax
call fcn.140019570
test rax, rax
jne 0x140010799
mov eax, 0x8007000e
jmp 0x1400107a3
xor edx, edx
mov rcx, rax
call fcn.140019690
xor ebx, ebx
lea rcx, [rsp + 0x20]
test eax, eax
cmovns ebx, eax
call fcn.140002d80
mov rcx, qword [rsp + 0x20]
call fcn.140003af0
mov rdi, qword [rsp + 0x28]
mov r14d, eax
test rdi, rdi
je 0x14001080f
mov qword [rsp + 0x70], rbp
mov ebp, 0xffffffff
mov ecx, ebp
lock xadd dword [rdi + 8], ecx
cmp ecx, 1
jne 0x14001080a
mov rdx, qword [rdi]
mov rcx, rdi
mov rax, qword [rdx]
call qword [0x140036608]
lock xadd dword [rdi + 0xc], ebp
cmp ebp, 1
jne 0x14001080a
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [0x140036608]
mov rbp, qword [rsp + 0x70]
mov eax, 0x80004005
test r14d, r14d
cmove ebx, eax
xor edx, edx
xor ecx, ecx
call fcn.14001ebec
xor ecx, ecx
call fcn.1400262f0
xor ecx, ecx
call fcn.1400262f0
xor ecx, ecx
call fcn.1400262f0
xor ecx, ecx
call fcn.1400262f0
mov r14, qword [rsp + 0x78]
test ebx, ebx
js 0x140010892
cmp dword [rsi + 0x28c], 0
je 0x140010870
mov eax, 4
lea rdx, [rsi + 0x270]
xchg dword [rsi + 0x274], eax
mov rcx, qword [rsi + 0x268]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, rsi
call fcn.14000f990
xor ebx, ebx
test eax, eax
cmovns ebx, eax
test ebx, ebx
js 0x140010892
lfence
mov rcx, rsi
call fcn.14000f560
mov ebx, eax
test eax, eax
jne 0x1400108df
xor r9d, r9d
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x1400108e3
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x1400108b0
jmp 0x1400108e3
test ebx, ebx
js 0x14001094d
mov rbx, qword [0x14004a060]
xor edi, edi
mov rdx, qword [0x14004a068]
cmp rbx, rdx
jae 0x140010927
test edi, edi
jne 0x140010927
mov rax, qword [rbx]
test rax, rax
je 0x14001091e
mov rax, qword [rax + 0x20]
mov ecx, dword [rax + 8]
test ecx, ecx
je 0x14001091e
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov rdx, qword [0x14004a068]
mov edi, eax
add rbx, 8
cmp rbx, rdx
jb 0x1400108f8
cmp byte [rsi + 0x60], 0
je 0x140010939
lfence
mov ecx, dword [rsi + 0x5c]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400155d0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x140015689
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x140015655
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14001566d
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14001566d
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call qword [0x140036608]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rdi + 8], 0
je case.default.0x14001566d
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp byte [0x14004bbb8], 0
jne 0x1400156d4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400156c4
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14004bbb0], rax
mov byte [0x14004bbb8], 1
jmp 0x1400156db
mov rax, qword [0x14004bbb0]
mov byte [0x14004bbb8], 1
jmp 0x1400156db
mov rax, qword [0x14004bbb0]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x14001565e
mov r8d, dword [rbx + 8]
xor r9d, r9d
call qword [0x140036608]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
push rax
invalid
Function at 0x140016ab0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x14004a0e8]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140016b35
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140016b35
call fcn.140015030
mov ebx, eax
jmp 0x140016c60
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140016b56
call fcn.140015030
jmp 0x140016c4f
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140016b79
call fcn.140015030
jmp 0x140016c4f
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x140016b9b
mov ebx, 0x8007000e
jmp 0x140016c51
mov ecx, eax
test eax, eax
je 0x140016bd3
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140016c98
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140016bd3
lfence
lea rcx, [rsp + 0x60]
call fcn.140014ea0
jmp 0x140016bdd
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x140016bf0
cmp qword [rsp + 0x60], 0
jne 0x140016bff
mov ebx, 0x8007000e
jmp 0x140016c51
lfence
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140016c2c
call fcn.140015030
jmp 0x140016c4f
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.1400165e0
mov ebx, eax
test rdi, rdi
je 0x140016c60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x140016c77
lea rcx, [rsp + 0x60]
call fcn.140015710
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14001ec80
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
lfence
mov ecx, 0x80070216
call fcn.140004100
int3
Function at 0x14001fb20
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001fb6a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001fb6a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001fb6a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001fb6a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001fb6a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001fb6c
xor al, al
add rsp, 0x28
ret
Function at 0x14002dcb8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14002dd3f
mov rsi, rbx
cmp word [rax], bp
je 0x14002dcfe
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14002dce8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14002dce4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140029bc0
mov rdi, rax
test rax, rax
je 0x14002dd2c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400213d0
mov rbp, rdi
xor ecx, ecx
call fcn.14002a310
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret