joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140062980
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r15, r8
mov rbp, rdx
mov r14, rcx
mov rbx, 0xffffffffffffffff
test r9, r9
je 0x1400629c8
mov r8, rbx
inc r8
cmp word [r9 + r8*2], 0
jne 0x1400629b2
mov rdx, r9
mov rcx, r15
call fcn.140018f70
mov rcx, qword [r14]
test rcx, rcx
jne 0x1400629d7
xor eax, eax
jmp 0x140062aa0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rsi
xor esi, esi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov dword [rsp + 0x30], esi
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rbp
mov dword [rsp + 0x34], 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x140062a99
mov ecx, dword [rsp + 0x34]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x140062a27
cmp ecx, 7
jne 0x140062a99
add rdx, 2
mov qword [rsp + 0x48], rdi
mov ecx, 1
cmovb rdx, rbx
call fcn.1402090a4
mov rdi, rax
test rax, rax
je 0x140062a94
mov rcx, qword [r14]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140062a8c
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], si
jne 0x140062a70
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call fcn.140018f70
mov esi, 1
mov rcx, rdi
call fcn.140203254
mov rdi, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401f3bf0
add rsp, 0x58
pop r15
pop r14
pop rbp
pop rbx
ret

Function at 0x140062ac0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
je 0x140062b25
test rbx, rbx
je 0x140062b25
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rdi]
mov r9d, 1
add eax, eax
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140062b25
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140062b40
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x50], r14
mov rbx, qword [rcx]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140062b94
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140062c11
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140062bcc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140062ccc
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x58], 0x105
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140062caf
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140062b40
test eax, eax
je 0x140062ccc
mov dword [rsp + 0x58], 0x105
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140062c60
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140062cbf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r14
mov rcx, qword [rdi]
test rcx, rcx
jne 0x140062cd1
mov ebx, r14d
jmp 0x140062ce2
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, r14d
test eax, eax
sete bl
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140062cf2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov qword [rsp + 0x50], r14
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1401f3bf0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140062d20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [r8], r9d
lea rax, [rsp + 0x34]
mov rcx, qword [rcx]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov rbx, r8
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 4
mov dword [rsp + 0x38], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140062d91
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401f3bf0
add rsp, 0x50
pop rbx
ret
mov eax, dword [rsp + 0x30]
mov dword [rbx], eax
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401f3bf0
add rsp, 0x50
pop rbx
ret

Function at 0x140062db0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401f3bf0
add rsp, 0x48
ret
Function at 0x140063880
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
mov qword [rbp - 0x38], rcx
xor r14d, r14d
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x140063a7f
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x10], rax
mov rcx, qword [rdi]
sub rcx, 0x18
call fcn.1400191a0
add rax, 0x18
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 1]
mov r8d, 0x20019
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.140062e10
test eax, eax
jne 0x140063961
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140063949
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140063958
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x30], r14
jmp 0x140063a3b
mov dword [rbp - 0x28], r14d
mov dword [rbp - 0x18], 4
mov dword [rbp - 0x10], 4
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
mov rbx, qword [rbp - 0x20]
mov rdx, rbx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140063a02
mov esi, dword [rbp - 0x28]
lea rdx, [rbx - 0x18]
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400639ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400639d9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x30], r14
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400639fe
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x140038716.0]
mov eax, esi
jmp 0x140063a5e
lea rdx, [rbx - 0x18]
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140063a28
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140063a37
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x30], r14
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140063a5c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401f3bf0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019320
int3
Function at 0x140074cd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
cmp dword [rcx + 0xb4], 0
mov r10, rcx
jne 0x140074ce7
xor eax, eax
add rsp, 0x38
ret
mov ecx, dword [rcx + 0x88]
sub ecx, 1
je 0x140074d17
cmp ecx, 1
jne 0x140074ce0
mov dword [rsp + 0x20], r9d
lea rcx, [r10 + 8]
mov r9, r8
mov r8, rdx
mov rdx, qword [r10 + 0xa8]
call fcn.140043110
add rsp, 0x38
ret
mov rcx, r10
add rsp, 0x38
jmp fcn.140062d20

Function at 0x140075110
Capabilities:
Get file system object information

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov r9d, 0x2b8
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x14007512c
add rsp, 0x38
ret

Function at 0x1400756c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, qword [rcx + 0x18]
mov rdi, rcx
test rax, rax
jne 0x14007574c
mov edx, 0x104
mov qword [rsp + 0x268], rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [rdi + 0x30]
mov dword [rsp + 0x20], 0x101
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140075110
mov rcx, qword [rdi + 0x30]
lea r8, [rdi + 0x18]
mov qword [rdi + 0x18], rcx
lea rdx, str._folder_
lea rcx, [rdi + 0x330]
call fcn.14003cb50
mov ecx, dword [rdi + 0x38]
mov rax, qword [rdi + 0x18]
mov rbx, qword [rsp + 0x268]
mov dword [rdi + 0x28], ecx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401f3bf0
mov rsi, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x140075900
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rdx]
mov rsi, 0xffffffffffffffff
cmp dword [rax - 0x10], 0
jne 0x140075955
lea rdx, str.__noext__
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140075940
mov rcx, rdi
call fcn.140018f70
jmp 0x14007595d
mov rcx, rdi
call fcn.14003cae0
mov r8, qword [rbx + 0x3c8]
test r8, r8
je 0x140075a90
mov r9, qword [rdi]
mov rax, r9
sub r8, r9
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140075994
add rax, 2
test ecx, ecx
jne 0x140075980
test edx, edx
jne 0x1400759a3
mov ebx, dword [rbx + 0x3c0]
jmp 0x140075a56
mov dword [rsp + 0x20], 0x1511
lea r8, [rbx + 0x30]
mov edx, 0x80
mov rcx, r9
call fcn.140075110
mov rcx, qword [rbx + 0x30]
xor r15d, r15d
test rcx, rcx
je 0x1400759d2
call qword [sym.imp.USER32.dll_DestroyIcon]
mov qword [rbx + 0x30], r15
cmp dword [rbx + 0x38], r15d
je 0x140075a01
lea rdx, [0x140295af0]
mov rcx, qword [rdi]
call fcn.140208b4c
test eax, eax
je 0x140075a01
cmp dword [rbx + 0x38], r15d
jl 0x140075a01
lea rcx, [rbx + 0x40]
cmp word [rcx], r15w
je 0x140075a01
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea rbp, [rbx + 0x248]
lea rcx, [rbx + 0x378]
mov rdx, qword [rdi]
call fcn.140049750
mov rcx, rax
test rbp, rbp
je 0x140075a30
mov rax, rsi
inc rax
cmp word [rbp + rax*2], r15w
jne 0x140075a22
mov r15d, eax
mov r8d, r15d
mov rdx, rbp
call fcn.140018f70
mov eax, dword [rbx + 0x38]
mov dword [rbx + 0x3c0], eax
mov rdx, rdi
lea rcx, [rbx + 0x3c8]
call fcn.140017ba0
mov ebx, dword [rbx + 0x38]
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140075a77
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x140038716.0]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.140019320
int3
Function at 0x140079a70
Capabilities:
Get file system object information

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
xor edx, edx
mov r9d, 0x2b8
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x140079a8e
add rsp, 0x38
ret

Function at 0x14007a280
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
cmp qword [rcx + 0x160], 0
jne 0x14007a425
mov ecx, 0xc8
call fcn.1401f4268
mov rbx, rax
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, 0xc8
mov rcx, rax
call fcn.1401f6840
mov rcx, rbx
call fcn.140079490
nop
mov qword [rdi + 0x160], rax
lea rbx, [rax + 0x70]
mov rcx, qword [rbx]
xor esi, esi
test rcx, rcx
je 0x14007a2ec
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbx], rsi
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x14007a425
mov rbx, qword [rdi + 0x160]
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x14007a31b
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbx + 0x78], rsi
mov rsi, qword [rbx + 0x70]
test rsi, rsi
je 0x14007a377
mov rcx, rsi
mov r8d, 2
movzx eax, word [rsi]
test ax, ax
je 0x14007a351
nop word [rax + rax]
movzx eax, ax
add r8d, eax
add rcx, rax
movzx eax, word [rcx]
test ax, ax
jne 0x14007a340
mov r14d, r8d
mov ecx, r8d
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rbp, rax
test rax, rax
je 0x14007a373
mov r8d, r14d
mov rdx, rsi
mov rcx, rax
call fcn.1401f61a0
mov qword [rbx + 0x78], rbp
mov rax, qword [rdi + 0x160]
mov dword [rax + 0x98], 1
mov rax, qword [rdi + 0x160]
mov dword [rax + 0xa0], 1
lea r8, [rdi + 0x208]
cmp qword [r8], 0
jne 0x14007a3b3
mov edx, 0xa
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea rcx, [rdi + 0x210]
cmp qword [rcx], 0
jne 0x14007a3cc
lea rdx, str.::26EE0668_A00A_44D7_9371_BEB064C98683
call fcn.14007cc30
mov r8, qword [rdi + 0x160]
mov qword [rdi + 0x168], r8
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14007a41e
mov rdx, 0xffffffffffff0000
call fcn.14007d0b0
mov rcx, qword [rdi + 0x160]
mov qword [rcx + 8], rax
mov r9, qword [rdi + 0x160]
mov rcx, qword [rdi + 0x10]
mov r9, qword [r9 + 8]
mov edx, 0x1102
mov r8d, 2
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x14007a427
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14007c9c0
Capabilities:
Get file system object information

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x20], 0x208
xor edx, edx
mov r9d, 0x2b8
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x14007c9de
add rsp, 0x38
ret

Function at 0x140083f60
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov qword [rcx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
shr ax, 8
cmp dil, 6
ja 0x140083f90
jne 0x140083fd4
test ax, ax
je 0x140083fd4
mov rcx, qword [rbx]
test rcx, rcx
je 0x140083fad
mov qword [rbx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140038716.0]
nop
mov qword [rsp + 0x20], rbx
lea r9, [0x1402963e8]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x14023f660]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x140083fd4
xor eax, eax
jmp 0x140083fed
mov dword [rbx + 8], 0xffffffff
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400842b0
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x40
cmp dword [rsp + 0x80], 0
jne 0x1400842d7
cmp r8d, 2
jne 0x1400842df
call fcn.140084440
mov rax, qword [rsp + 0x78]
mov qword [rax], 0
xor eax, eax
add rsp, 0x40
pop rdi
ret
cmp r8d, 5
jne 0x140084301
call fcn.140084740
mov rax, qword [rsp + 0x78]
mov qword [rax], 0
mov eax, 1
add rsp, 0x40
pop rdi
ret
cmp r8d, 0x4a
jne 0x1400842d7
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0x2710
jne 0x1400842ea
mov rdi, qword [rax + 0x10]
cmp dword [rdi], 0x1348acf
jne 0x1400842ea
add rdi, 4
je 0x1400842ea
cmp word [rdi], 0x68
jne 0x1400842ea
call fcn.14002eed0
test eax, eax
je 0x140084358
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140019100
nop
mov rcx, rax
call fcn.140085440
jmp 0x1400842ea
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400842ea
Function at 0x14008b3f0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x140310110], eax
jg 0x14008b43b
lea rax, [0x140310120]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401f3bf0
add rsp, 0x60
pop rbx
ret
lea rcx, [0x140310110]
call fcn.1401f3cb8
cmp dword [0x140310110], 0xffffffff
jne 0x14008b421
xor edx, edx
mov r8d, 0x100
lea rbx, [0x140310120]
mov rcx, rbx
call fcn.1401f6840
lea rcx, [0x140310128]
call fcn.140093000
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov dword [0x1403101a8], eax
xorps xmm0, xmm0
movdqa xmmword [0x140310210], xmm0
mov qword [0x140310120], 0
movdqa xmmword [0x1403101b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [0x1403101c0], xmm1
movdqa xmmword [0x1403101d0], xmm0
movdqa xmmword [0x1403101e0], xmm1
movdqa xmmword [0x1403101f0], xmm0
movdqa xmmword [0x140310200], xmm1
lea rcx, [0x14023c600]
call fcn.1401f3f94
nop
lea rcx, [0x140310110]
call fcn.1401f3c4c
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401f3bf0
add rsp, 0x60
pop rbx
ret
Function at 0x1400a0ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov ebx, r8d
lea rdx, [rsp + 0x20]
mov rsi, rcx
call fcn.1400a06a0
xor ebp, ebp
cmp dword [rsi + 0x310], ebp
jne 0x1400a0cf5
sub ebx, dword [rsi + 0x230]
imul ebx, dword [rsi + 0x234]
mov ecx, dword [rax + 8]
sub ecx, dword [rax]
mov edx, ecx
mov r11d, ecx
mov r10d, ebx
test ebx, ebx
js 0x1400a0d91
jmp 0x1400a0d01
mov r10d, ebp
mov r11d, ebp
mov ebx, ebp
mov ecx, ebp
mov edx, ebp
cmp ebx, dword [rdi + 0x34]
jge 0x1400a0d91
mov r8d, dword [rdi + 0x30]
mov r9d, ebp
dec r8d
mov eax, ebx
test r8d, r8d
cmovle r9d, r8d
test ecx, ecx
movsxd rcx, dword [rdi + 0x3c]
cmovs edx, ebp
cmp edx, r8d
cmovl r8d, edx
movsxd rdx, dword [rdi + 0x28]
imul rdx, rax
movsxd rax, r9d
imul rcx, rax
mov eax, dword [rdi + 0x38]
add rdx, rcx
add rdx, qword [rdi + 0x40]
cmp eax, 0x18
je 0x1400a0d73
cmp eax, 0x20
jne 0x1400a0d91
cmp r9d, r8d
jg 0x1400a0d91
sub r8d, r9d
lea eax, [r8 + 1]
nop dword [rax]
xor byte [rdx], 0x80
xor byte [rdx + 2], 0x80
lea rdx, [rdx + 4]
sub rax, 1
jne 0x1400a0d60
jmp 0x1400a0d91
cmp r9d, r8d
jg 0x1400a0d91
sub r8d, r9d
lea eax, [r8 + 1]
nop
xor byte [rdx], 0x80
xor byte [rdx + 2], 0x80
lea rdx, [rdx + 3]
sub rax, 1
jne 0x1400a0d80
lea eax, [r10 - 1]
test eax, eax
js 0x1400a0e31
cmp eax, dword [rdi + 0x34]
jge 0x1400a0e31
mov r8d, dword [rdi + 0x30]
mov eax, r11d
movsxd rcx, dword [rdi + 0x3c]
dec r8d
cmp ebp, r8d
movsxd rdx, r10d
mov r9d, ebp
cmovge r9d, r8d
test r11d, r11d
cmovs eax, ebp
cmp eax, r8d
cmovl r8d, eax
movsxd rax, dword [rdi + 0x28]
dec rdx
imul rdx, rax
movsxd rax, r9d
imul rcx, rax
mov eax, dword [rdi + 0x38]
add rdx, rcx
add rdx, qword [rdi + 0x40]
cmp eax, 0x18
je 0x1400a0e13
cmp eax, 0x20
jne 0x1400a0e31
cmp r9d, r8d
jg 0x1400a0e31
sub r8d, r9d
lea eax, [r8 + 1]
xor byte [rdx], 0x80
xor byte [rdx + 2], 0x80
lea rdx, [rdx + 4]
sub rax, 1
jne 0x1400a0e00
jmp 0x1400a0e31
cmp r9d, r8d
jg 0x1400a0e31
sub r8d, r9d
lea eax, [r8 + 1]
nop
xor byte [rdx], 0x80
xor byte [rdx + 2], 0x80
lea rdx, [rdx + 3]
sub rax, 1
jne 0x1400a0e20
lea eax, [r10 + 1]
test eax, eax
js 0x1400a0ed1
cmp eax, dword [rdi + 0x34]
jge 0x1400a0ed1
movsxd rcx, dword [rdi + 0x28]
mov r9d, ebp
mov r8d, dword [rdi + 0x30]
movsxd rdx, dword [rdi + 0x3c]
dec r8d
cmp ebp, r8d
movsxd rax, r10d
cmovge r9d, r8d
test r11d, r11d
cmovs r11d, ebp
cmp r11d, r8d
cmovl r8d, r11d
inc rax
imul rax, rcx
movsxd rcx, r9d
imul rdx, rcx
mov ecx, dword [rdi + 0x38]
add rax, rdx
add rax, qword [rdi + 0x40]
cmp ecx, 0x18
je 0x1400a0eb3
cmp ecx, 0x20
jne 0x1400a0ed1
cmp r9d, r8d
jg 0x1400a0ed1
sub r8d, r9d
lea ecx, [r8 + 1]
nop
xor byte [rax], 0x80
xor byte [rax + 2], 0x80
lea rax, [rax + 4]
sub rcx, 1
jne 0x1400a0ea0
jmp 0x1400a0ed1
cmp r9d, r8d
jg 0x1400a0ed1
sub r8d, r9d
lea ecx, [r8 + 1]
nop
xor byte [rax], 0x80
xor byte [rax + 2], 0x80
lea rax, [rax + 3]
sub rcx, 1
jne 0x1400a0ec0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a3450
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0x1f8], 0
mov rbx, rdx
mov rsi, rcx
je 0x1400a3544
call fcn.140098f00
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
bt ecx, 0x10
jae 0x1400a350a
lea r14, [rsi + 0x200]
mov rax, qword [r14]
cmp rax, qword [r14 + 8]
je 0x1400a34a7
mov qword [r14 + 8], rax
mov rbp, qword [rsi + 0x368]
xor edi, edi
test rbp, rbp
je 0x1400a350a
nop word [rax + rax]
cmp rdi, qword [rsi + 0x368]
jae 0x1400a3573
mov rax, qword [rsi + 0x360]
mov rcx, qword [rax + rdi*8]
cmp dword [rcx + 0x20], 0
je 0x1400a3502
mov rdx, qword [r14 + 8]
mov dword [rsp + 0x20], edi
cmp rdx, qword [r14 + 0x10]
je 0x1400a34f5
mov dword [rdx], edi
add qword [r14 + 8], 4
jmp 0x1400a3502
lea r8, [rsp + 0x20]
mov rcx, r14
call fcn.1400a3e00
inc rdi
cmp rdi, rbp
jb 0x1400a34c0
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.1400a0500
xor r8d, r8d
mov edx, eax
mov rcx, rsi
mov edi, eax
call fcn.1400a3130
cmp byte [rsi + 0x1f8], 0
je 0x1400a355b
mov dword [rsi + 0x218], edi
mov dword [rsi + 0x21c], edi
mov qword [rsi + 0x220], rbx
jmp 0x1400a355b
lea rdx, [rsp + 0x58]
call fcn.1400a0500
xor r8d, r8d
mov edx, eax
mov rcx, rsi
call fcn.1400a3130
mov rbx, qword [rsp + 0x60]
mov eax, 1
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80070057
call fcn.140019320
int3