joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d100
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov ebx, ecx
xor edi, edi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, str.stop_BFE
lea r8, str.net.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, str.config_BFE_startauto
lea r8, str.sc.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, str.start_BFE
lea r8, str.net.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rax, [rbp + 0x28]
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x30]
mov qword [rbp - 0x18], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14001d33a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x28], rax
lea rdx, [0x140099090]
lea rcx, [rbp + 0x28]
call fcn.14000cc80
test al, al
jne 0x14001d1dd
lea rdx, [0x140099090]
lea rcx, [rbp + 0x28]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14001d345
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x30], rax
lea rdx, str.connectionNotEstablished_KB_11369_ShellExecute
lea rcx, [rbp + 0x30]
call fcn.14000cc80
test al, al
jne 0x14001d221
lea rdx, str.connectionNotEstablished_KB_11369_ShellExecute
lea rcx, [rbp + 0x30]
call fcn.14000c480
nop
mov r8d, 0xffffffff
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x30]
call fcn.14005c670
lea rax, [rbp + 0x28]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x30]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x38]
mov qword [rbp - 8], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14001d350
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x28], rax
lea rdx, [0x140098d49]
lea rcx, [rbp + 0x28]
call fcn.14000cc80
test al, al
jne 0x14001d290
lea rdx, [0x140098d49]
lea rcx, [rbp + 0x28]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14001d35b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x30], rax
lea rdx, str.Necessary_changes_have_been_done.
lea rcx, [rbp + 0x30]
call fcn.14000cc80
test al, al
jne 0x14001d2d4
lea rdx, str.Necessary_changes_have_been_done.
lea rcx, [rbp + 0x30]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14001d32f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x38], rax
lea rdx, str.Success
lea rcx, [rbp + 0x38]
call fcn.14000cc80
test al, al
jne 0x14001d314
lea rdx, str.Success
lea rcx, [rbp + 0x38]
call fcn.14000c480
nop
lea r9, [rbp + 0x28]
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x38]
mov ecx, ebx
call fcn.14005d170
add rsp, 0x50
pop rdi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
int3
Function at 0x140022010
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
lea rax, [rbp + 0x18]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140022204
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x18], rax
lea rdx, [0x140099090]
lea rcx, [rbp + 0x18]
call fcn.14000cc80
test al, al
jne 0x14002207c
lea rdx, [0x140099090]
lea rcx, [rbp + 0x18]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14002220f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x20], rax
lea rdx, str.interactiveServiceDet_KB_11377_ShellExecute
lea rcx, [rbp + 0x20]
call fcn.14000cc80
test al, al
jne 0x1400220c0
lea rdx, str.interactiveServiceDet_KB_11377_ShellExecute
lea rcx, [rbp + 0x20]
call fcn.14000c480
nop
mov r8d, 0xffffffff
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x20]
call fcn.14005c670
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
lea r9, str.config_UI0Detect_startdisabled
lea r8, str.sc.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14002221a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x18], rax
lea rdx, [0x140098d49]
lea rcx, [rbp + 0x18]
call fcn.14000cc80
test al, al
jne 0x140022157
lea rdx, [0x140098d49]
lea rcx, [rbp + 0x18]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140022225
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x20], rax
lea rdx, str.System_restart_is_needed_to_fix_the_issue_completely.
lea rcx, [rbp + 0x20]
call fcn.14000cc80
test al, al
jne 0x14002219b
lea rdx, str.System_restart_is_needed_to_fix_the_issue_completely.
lea rcx, [rbp + 0x20]
call fcn.14000c480
nop
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400221f9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x28], rax
lea rdx, str.Success
lea rcx, [rbp + 0x28]
call fcn.14000cc80
test al, al
jne 0x1400221db
lea rdx, str.Success
lea rcx, [rbp + 0x28]
call fcn.14000c480
nop
lea r9, [rbp + 0x18]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x28]
mov ecx, ebx
call fcn.14005d170
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
nop
mov ecx, 0x80004005
call fcn.14000dd90
int3
Function at 0x140043e00
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
push rbx
push rsi
push rdi
push r14
sub rsp, 0xf8
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov r14d, ecx
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x140044021
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov ecx, r14d
call fcn.140041a00
mov dword [rsp + 0x130], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x138], eax
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140043f07
test rcx, rcx
je 0x140043f07
mov dword [rsp + 0x128], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x128]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ProxyEnable
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.AutoConfigURL
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.AutoDetect
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x80]
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0xc8], rax
lea rdx, [0x140099090]
lea rcx, [rsp + 0x80]
call fcn.14000c6f0
mov rbx, rax
lea rdx, str.setInternetBasicSettings_result:
lea rcx, [rsp + 0x88]
call fcn.14000c6f0
nop
mov esi, 0xffffffff
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call fcn.14005c670
lea rax, [rsp + 0x90]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0xd8], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xe0], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x90]
call fcn.14000c6f0
mov rdi, rax
lea rdx, str.Necessary_changes_have_been_done.
lea rcx, [rsp + 0x98]
call fcn.14000c6f0
mov rbx, rax
lea rdx, str.Success
lea rcx, [rsp + 0xa0]
call fcn.14000c6f0
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
mov ecx, r14d
call fcn.14005d170
nop
jmp 0x140043ff8
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140044014
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rsp, 0xf8
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.14000dd90
int3
Function at 0x140047da0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x230
mov qword [rax - 0x178], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov dword [rsp + 0x20], ecx
lea rdx, str.C:Windowsiassist_
lea rcx, [rsp + 0x28]
call fcn.14000c6f0
nop
lea rdx, str.Host.txt
lea rcx, [rsp + 0x28]
call fcn.14000c2e0
lea rax, [rsp + 0x40]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0xd8], rcx
call fcn.14000d070
mov qword [rsp + 0x50], rax
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.hostFileEntries:
lea rcx, [rsp + 0x58]
call fcn.14000c6f0
nop
mov ebx, 0xffffffff
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.14005c670
lea rdx, [0x1400a3cc0]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rsi, rax
mov qword [rsp + 0x30], rax
lea rdx, str.C:WindowsSystem32Driversetchosts
lea rcx, [rsp + 0x48]
call fcn.14000c6f0
nop
lea rdx, [0x140098d4c]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rdi, rax
mov qword [rsp + 0x38], rax
nop dword [rax]
nop word [rax + rax]
mov r8, rsi
mov edx, 0x12c
lea rcx, [rsp + 0xf0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x140047ede
mov rdx, rdi
lea rcx, [rsp + 0xf0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
jmp 0x140047eb0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x60], rcx
mov eax, ebx
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140047f30
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rsp + 0x28]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x68], rax
lock xadd dword [rax + 0x10], ebx
sub ebx, 1
jg 0x140047f57
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400691f0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14005c180
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x260
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14005c23f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000cc80
test al, al
jne 0x14005c21b
lea rax, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14005c200
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000d160
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400691f0
add rsp, 0x260
pop rbx
ret
mov ecx, 0x80004005
call fcn.14000dd90
int3

Function at 0x14005c250
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rdi, rcx
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14005c323
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14005ff40
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov rbx, qword [rsp + 0x70]
test eax, eax
jne 0x14005c2d4
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005c2ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14005c319
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, esi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.14000dd90
int3
Function at 0x14005f110
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0xc0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x50], 0x70
mov dword [rsp + 0x54], 0x40
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x68], rax
lea rax, [0x14009a104]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x80], ecx
mov qword [rsp + 0x88], rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
jmp 0x14005f1ab
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005f1ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rsp, 0xc0
pop rbx
ret

Function at 0x14005f1e0
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x30], 0
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x14005f2de
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rbx, 0xffffffffffffffff
test eax, eax
js 0x14005f29b
lea rcx, [rsp + 0x50]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14005f280
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14000d160
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14005f2b6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400691f0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000dd90
int3
Function at 0x1400605e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0xda0
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rsp + 0xdd0], rbx
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0xd90], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x80], rcx
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400607e6
mov rax, qword [rax]
call qword [rax + 0x18]
mov qword [rsp + 0xa0], rax
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.14005ff40
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x48], eax
test eax, eax
jne 0x140060733
mov dword [rsp + 0x30], 0xbb8
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
lea rcx, [rsp + 0xc0]
call fcn.14005a920
mov qword [rsp + 0xa8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb0], rdx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
cmp rcx, rax
je 0x1400606fe
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test edi, edi
mov rdi, 0xffffffffffffffff
jne 0x14006073f
lea rcx, [rsp + 0x1d0]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x140060714
mov r8d, eax
lea rdx, [rsp + 0x1d0]
mov rcx, r14
call fcn.14000d160
jmp 0x14006073f
mov rdi, 0xffffffffffffffff
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x50], rbx
mov eax, edi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x14006076f
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rsi]
sub rax, 0x18
mov qword [rsp + 0x58], rax
lock xadd dword [rax + 0x10], edi
sub edi, 1
jg 0x140060793
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, dword [rsp + 0x34]
jmp 0x1400607c2
mov rcx, qword [rsp + 0xd90]
xor rcx, rsp
call fcn.1400691f0
mov rbx, qword [rsp + 0xdd0]
add rsp, 0xda0
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.14000dd90
int3
Function at 0x1400614b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x2c0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rsp + 0x2f0], rbx
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rsi, rdx
mov r14, rcx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x1400614fc
mov eax, 1
jmp 0x1400616e3
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14006154d
cmp eax, 2
jne 0x14006153a
lea rcx, str.Key_not_found._n
call fcn.14000db40
mov eax, 1
jmp 0x1400616e3
lea rcx, str.Error_opening_key._n
call fcn.14000db40
xor eax, eax
jmp 0x1400616e3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rdi, [rsi + rcx*2]
mov qword [rsp + 0x68], rdi
cmp word [rdi - 2], 0x5c
je 0x140061581
mov eax, 0x5c
mov word [rdi], ax
add rdi, 2
mov qword [rsp + 0x68], rdi
xor ebx, ebx
mov word [rdi], bx
jmp 0x140061583
xor ebx, ebx
mov dword [rsp + 0x48], 0x104
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
lea r8, [rsp + 0xa0]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400616b1
nop word [rax + rax]
mov ecx, 0x7ffffffe
mov qword [rsp + 0x80], rcx
lea r8, [rsp + 0xa0]
mov qword [rsp + 0x70], r8
mov edx, 0x208
mov qword [rsp + 0x78], rdx
mov rax, rdi
mov qword [rsp + 0x58], rax
mov r9, rbx
mov qword [rsp + 0x60], rbx
test rdx, rdx
je 0x14006164b
test rcx, rcx
je 0x14006165c
movzx r10d, word [r8]
test r10w, r10w
je 0x14006165c
mov word [rax], r10w
add rax, 2
mov qword [rsp + 0x58], rax
add r8, 2
mov qword [rsp + 0x70], r8
dec rdx
mov qword [rsp + 0x78], rdx
dec rcx
mov qword [rsp + 0x80], rcx
inc r9
mov qword [rsp + 0x60], r9
jmp 0x140061604
sub rax, 2
mov qword [rsp + 0x58], rax
dec r9
mov qword [rsp + 0x60], r9
mov word [rax], bx
mov rdx, rsi
mov rcx, r14
call fcn.1400614b0
test eax, eax
je 0x1400616b1
mov dword [rsp + 0x48], 0x104
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
lea r8, [rsp + 0xa0]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400615d0
sub rdi, 2
mov qword [rsp + 0x68], rdi
mov word [rdi], bx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x1400616df
mov eax, 1
jmp 0x1400616e3
xor eax, eax
jmp 0x1400616e3
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400691f0
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2c0
pop r14
pop rdi
pop rsi
ret
Function at 0x140061a50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x78
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rdi, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x58], rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov dword [rsp + 0x98], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
jne 0x140061abc
mov rax, qword [rdi]
sub rax, 0x18
mov qword [rsp + 0xa0], rax
mov ecx, 0xffffffff
lock xadd dword [rax + 0x10], ecx
sub ecx, 1
jg 0x140061ab8
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor al, al
jmp 0x140061b16
mov rax, qword [rdi]
sub rax, 0x18
mov qword [rsp + 0xa8], rax
mov ecx, 0xffffffff
lock xadd dword [rax + 0x10], ecx
sub ecx, 1
jg 0x140061aeb
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov al, 1
jmp 0x140061b16
add rsp, 0x78
pop rdi
pop rbx
ret
Function at 0x1400624f0
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0xa8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x50], 0x40
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x140062556
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
test rax, rax
jns 0x140062543
addss xmm0, dword [0x1400a89d8]
mulss xmm0, dword [0x1400a89c8]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
cvttss2si eax, xmm0
jmp 0x14006255d
mov eax, 4
jmp 0x14006255d
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400691f0
add rsp, 0xa8
ret

Function at 0x1400627e0
Capabilities:
Get session user name

Disassembly:
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x2b8], rbx
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rcx
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x24], 0
call fcn.14000d980
mov rcx, rax
test rax, rax
je 0x1400628c1
mov rax, qword [rax]
call qword [rax + 0x18]
mov qword [rsp + 0x28], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], 0x101
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.14000c760
mov dword [rsp + 0x24], 1
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x38], rbx
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14006289b
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, rdi
jmp 0x1400628a0
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400691f0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x2a0
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000dd90
int3