joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001fc0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140008160]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140008140]
test rbx, rbx
je 0x14000201c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140002013
test eax, eax
jne 0x140002013
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140001ff8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002350
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400043e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002370
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002378
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002370
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400023cd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400023c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002370
add rax, 0x28
cmp rax, r9
jne 0x1400023b0
xor eax, eax
ret

Function at 0x1400023d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400043e0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400023ef
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400023f8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400023ef
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002490
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400043e0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400024af
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400024b8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140018f94
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001901b
mov rsi, rbx
cmp word [rax], bp
je 0x140018fda
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140018fc4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140018fc0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400167d4
mov rdi, rax
test rax, rax
je 0x140019008
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001fb40
mov rbp, rdi
xor ecx, ecx
call fcn.1400158f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001f3b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f3d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f3d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000b6c0
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002fdd8]
test rcx, rcx
je 0x14000b6fb
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b6ee
mov rcx, qword [0x14002fdd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002fdd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002fde8], 0
je 0x14000b7ee
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140029918]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140040610]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b7cf
test al, 0x10
je 0x14000b7cf
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b775
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x48be20
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.004108c0
mov r13d, eax
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.00416ac0
mov esi, eax
cmp esi, 0x104
jbe 0x48be7d
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.004088f0
mov rdi, rax
jmp 0x48be81
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.00416ac0
mov rax, rdi
mov rcx, rax
call sub.user32.dll_CharUpperW
xor rbx, rbx
xor rax, rax
mov ecx, esi
sub ecx, 1
cmp eax, ecx
jg 0x48bed7
add ecx, 1
mov edx, ebx
shl edx, 5
shr ebx, 0x1b
or edx, ebx
mov ebx, edx
movsxd rdx, eax
movzx edx, word [rdi + rdx*2]
xor ebx, edx
add eax, 1
cmp eax, ecx
jne 0x48bebb
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x48bee9
mov rcx, rdi
call fcn.00408920
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret

Function at 0x48d420
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x828
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rcx, rbx
call fcn.00410080
mov rcx, rsi
call fcn.00411e10
mov rcx, rax
lea rdx, [rbp + 0x20]
mov r8d, 0x400
call sub.kernel32.dll_GetEnvironmentVariableW
mov edi, eax
cmp edi, 0x400
jge 0x48d472
mov rcx, rbx
lea rdx, [rbp + 0x20]
mov r8d, edi
call fcn.00410340
jmp 0x48d4a0
mov rcx, rbx
mov edx, edi
sub edx, 1
call fcn.004120a0
mov rcx, rsi
call fcn.00411e10
mov rsi, rax
mov rcx, qword [rbx]
call fcn.00411e10
mov rcx, rsi
mov rdx, rax
mov r8d, edi
call sub.kernel32.dll_GetEnvironmentVariableW
mov rax, rbx
lea rsp, [rbp + 0x828]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x4aa000
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Get file attributes

Disassembly:
push rbp
push rbx
sub rsp, 0x2c8
mov rbp, rsp
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x2b8], 0
nop
lea rcx, [rbp + 0x2b8]
call fcn.004a9c80
cmp qword [rbp + 0x2b8], 0
je 0x4aa237
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4aa142
mov rcx, qword [rbp + 0x2b8]
call fcn.00411e10
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4aa237
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x2b8]
lea r8, [0x004aa2dc]
call fcn.00412270
mov rcx, qword [rbp + 0x58]
call fcn.00411e10
mov rcx, rax
lea rdx, [rbp + 0x68]
call sub.kernel32.dll_FindFirstFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x4aa129
lea rcx, [rbp + 0x48]
lea rdx, [rbp + 0x94]
mov r8d, 0x104
call fcn.00411f10
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x2b8]
mov r8, qword [rbp + 0x48]
call fcn.00412270
mov rcx, qword [rbp + 0x50]
call fcn.00411e10
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
mov rcx, rbx
lea rdx, [rbp + 0x68]
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4aa0d5
mov rcx, rbx
call sub.kernel32.dll_FindClose
mov rcx, qword [rbp + 0x2b8]
call fcn.00411e10
mov rcx, rax
call sub.kernel32.dll_RemoveDirectoryW
jmp 0x4aa237
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x2b8]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x40]
call fcn.00411320
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4aa237
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x2b8]
xor r8, r8
call fcn.00411660
lea rcx, [rbp + 0x38]
lea rdx, [0x004aa2f0]
call fcn.00410e60
mov rcx, qword [rbp + 0x38]
call fcn.00411320
mov rcx, rax
lea rdx, [rbp + 0x68]
call sub.kernel32.dll_FindFirstFileA
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x4aa213
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x2b8]
xor r8, r8
call fcn.00411660
lea rcx, [rbp + 0x28]
lea rdx, [rbp + 0x94]
mov r8d, 0x104
xor r9, r9
call fcn.00410da0
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
call fcn.00410e60
mov rcx, qword [rbp + 0x30]
call fcn.00411320
mov rcx, rax
call sub.kernel32.dll_DeleteFileA
mov rcx, rbx
lea rdx, [rbp + 0x68]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4aa1b0
mov rcx, rbx
call sub.kernel32.dll_FindClose
lea rcx, [rbp + 0x20]
mov rdx, qword [rbp + 0x2b8]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x20]
call fcn.00411320
mov rcx, rax
call sub.kernel32.dll_RemoveDirectoryA
nop
lea rcx, [rbp + 0x20]
mov edx, 5
call fcn.00410190
lea rcx, [rbp + 0x48]
mov edx, 3
call fcn.00410160
lea rcx, [rbp + 0x2b8]
call fcn.00410080
lea rsp, [rbp + 0x2c8]
pop rbx
pop rbp
ret
Function at 0x4aa3d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x48], r8
mov qword [rbp + 0x38], r9
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
nop
mov rcx, qword [rbp + 0x30]
call fcn.00410080
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4aa4fe
mov rcx, qword [rbp + 0x48]
call fcn.00411e10
mov rcx, qword [rbp + 0x40]
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x78]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4aa614
mov dword [rbp + 0x74], 0
mov rcx, qword [rbp + 0x38]
call fcn.00411e10
mov rcx, qword [rbp + 0x78]
mov rdx, rax
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
lea rax, [rbp + 0x74]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4aa4f0
cmp dword [rbp + 0x74], 0
je 0x4aa4f0
mov eax, dword [rbp + 0x74]
add eax, eax
mov dword [rbp + 0x74], eax
mov ecx, 0x40
mov edx, dword [rbp + 0x74]
call sub.kernel32.dll_LocalAlloc
mov rbx, rax
mov rcx, qword [rbp + 0x38]
call fcn.00411e10
mov rcx, qword [rbp + 0x78]
mov rdx, rax
xor r8, r8
lea r9, [rbp + 0x70]
mov qword [rsp + 0x20], rbx
lea rax, [rbp + 0x74]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4aa4e8
mov rcx, qword [rbp + 0x30]
mov rdx, rbx
call fcn.00411eb0
mov rcx, rbx
call sub.kernel32.dll_LocalFree
mov rcx, qword [rbp + 0x78]
call sub.advapi32.dll_RegCloseKey
jmp 0x4aa614
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x48]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x68]
call fcn.00411320
mov rcx, qword [rbp + 0x40]
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x78]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4aa614
mov dword [rbp + 0x74], 0
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x38]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x60]
call fcn.00411320
mov rcx, qword [rbp + 0x78]
mov rdx, rax
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
lea rax, [rbp + 0x74]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4aa60b
cmp dword [rbp + 0x74], 0
je 0x4aa60b
mov eax, dword [rbp + 0x74]
add eax, eax
mov dword [rbp + 0x74], eax
mov ecx, 0x40
mov edx, dword [rbp + 0x74]
call sub.kernel32.dll_LocalAlloc
mov rbx, rax
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x38]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x58]
call fcn.00411320
mov rcx, qword [rbp + 0x78]
mov rdx, rax
xor r8, r8
lea r9, [rbp + 0x70]
mov qword [rsp + 0x20], rbx
lea rax, [rbp + 0x74]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4aa603
lea rcx, [rbp + 0x50]
mov rdx, rbx
xor r8, r8
call fcn.00410cf0
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x50]
call fcn.00411f60
mov rcx, rbx
call sub.kernel32.dll_LocalFree
mov rcx, qword [rbp + 0x78]
call sub.advapi32.dll_RegCloseKey
nop
lea rcx, [rbp + 0x50]
mov edx, 4
call fcn.00410190
mov rax, qword [rbp + 0x30]
lea rsp, [rbp + 0x88]
pop rbx
pop rbp
ret
Function at 0x4aa670
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0xb0
mov rbp, rsp
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rdx
mov qword [rbp + 0x60], r8
mov qword [rbp + 0x68], r9
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x98], 0
nop
xor rax, rax
mov byte [rbp + 0x5f], al
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4aa77b
mov rcx, qword [rbp + 0x78]
call fcn.00411e10
mov rcx, qword [rbp + 0x70]
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0xf003f
mov qword [rsp + 0x30], 0
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xa4]
mov qword [rsp + 0x40], rax
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x4aa86e
mov rcx, qword [rbp + 0x60]
call fcn.00411e10
mov rbx, rax
mov rcx, qword [rbp + 0x68]
call fcn.00411e10
mov rsi, rax
mov rcx, qword [rbp + 0x68]
call fcn.004108a0
mov rcx, qword [rbp + 0xa8]
mov rdx, rbx
xor r8, r8
mov r9d, 1
mov qword [rsp + 0x20], rsi
add eax, eax
add eax, 2
mov dword [rsp + 0x28], eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov byte [rbp + 0x5f], al
mov rcx, qword [rbp + 0xa8]
call sub.advapi32.dll_RegCloseKey
jmp 0x4aa86e
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x78]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x88]
call fcn.00411320
mov rcx, qword [rbp + 0x70]
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0xf003f
mov qword [rsp + 0x30], 0
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xa4]
mov qword [rsp + 0x40], rax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x4aa86e
lea rcx, [rbp + 0x98]
mov rdx, qword [rbp + 0x68]
xor r8, r8
call fcn.00411660
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x60]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x80]
call fcn.00411320
mov rbx, rax
mov rcx, qword [rbp + 0x98]
call fcn.00411320
mov rsi, rax
mov rcx, qword [rbp + 0x98]
call fcn.004108b0
mov rcx, qword [rbp + 0xa8]
mov rdx, rbx
xor r8, r8
mov r9d, 1
mov qword [rsp + 0x20], rsi
add eax, 1
mov dword [rsp + 0x28], eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete al
mov byte [rbp + 0x5f], al
mov rcx, qword [rbp + 0xa8]
call sub.advapi32.dll_RegCloseKey
nop
lea rcx, [rbp + 0x80]
mov edx, 2
call fcn.00410190
lea rcx, [rbp + 0x98]
call fcn.004100d0
movzx rax, byte [rbp + 0x5f]
lea rsp, [rbp + 0xb0]
pop rbx
pop rsi
pop rbp
ret
Function at 0x4aa8f0
Capabilities:
Delete registry value

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x38], r8
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
nop
xor rax, rax
mov byte [rbp + 0x37], al
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4aa980
mov rcx, qword [rbp + 0x48]
call fcn.00411e10
mov rcx, qword [rbp + 0x40]
mov rdx, rax
xor r8, r8
mov r9d, 0xf003f
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4aa9f2
mov rcx, qword [rbp + 0x38]
call fcn.00411e10
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete al
mov byte [rbp + 0x37], al
mov rcx, qword [rbp + 0x68]
call sub.advapi32.dll_RegCloseKey
jmp 0x4aa9f2
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x48]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x58]
call fcn.00411320
mov rcx, qword [rbp + 0x40]
mov rdx, rax
xor r8, r8
mov r9d, 0xf003f
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4aa9f2
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x38]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x50]
call fcn.00411320
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete al
mov byte [rbp + 0x37], al
mov rcx, qword [rbp + 0x68]
call sub.advapi32.dll_RegCloseKey
nop
lea rcx, [rbp + 0x50]
mov edx, 2
call fcn.00410190
movzx rax, byte [rbp + 0x37]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x4ab340
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rdx
mov rbx, r8
mov qword [rbp + 0x70], rcx
mov rcx, qword [rbp + 0x70]
call fcn.0042e9a0
test rax, rax
je 0x4ab422
cmp word [rax + 0x18], 0x20b
jne 0x4ab38c
lea rax, [rax + 0x90]
mov rcx, qword [rbp + 0x70]
mov edx, dword [rax]
lea rsi, [rcx + rdx]
mov r13d, dword [rax]
add r13d, dword [rax + 4]
jmp 0x4ab3a4
lea rax, [rax + 0x80]
mov rcx, qword [rbp + 0x70]
mov edx, dword [rax]
lea rsi, [rcx + rdx]
mov r13d, dword [rax]
add r13d, dword [rax + 4]
test rsi, rsi
je 0x4ab422
jmp 0x4ab41b
cmp dword [rsi + 0x10], r13d
jbe 0x4ab3bb
mov rcx, rbp
call fcn.004ab100
jmp 0x4ab421
cmp dword [rsi + 0x10], 0
je 0x4ab417
mov rax, qword [rbp + 0x70]
mov ecx, dword [rsi + 0x10]
lea rdi, [rax + rcx]
jmp 0x4ab411
mov rax, qword [rbp + 0x28]
cmp qword [rdi], rax
jne 0x4ab40d
mov rcx, rdi
mov edx, 8
mov r8d, 0x40
lea r9, [rbp + 0x3c]
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4ab40d
mov qword [rdi], rbx
mov rcx, rdi
mov edx, 8
mov r8d, dword [rbp + 0x3c]
lea r9, [rbp + 0x3c]
call sub.kernel32.dll_VirtualProtect
add rdi, 8
cmp qword [rdi], 0
jne 0x4ab3ce
add rsi, 0x14
cmp dword [rsi + 0xc], 0
jne 0x4ab3ab
nop
lea rsp, [rbp + 0x40]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x4adf00
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
xor rcx, rcx
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4adf22
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
xor rcx, rcx
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4adfa4
mov rcx, rbx
call fcn.004108a0
mov ecx, 0x2002
mov edx, eax
add edx, edx
add edx, 2
movsxd rdx, edx
call sub.kernel32.dll_GlobalAlloc
mov rsi, rax
mov rcx, rsi
call sub.kernel32.dll_GlobalLock
mov rdi, rax
test rdi, rdi
je 0x4adf9f
mov rcx, rbx
call fcn.00411e10
mov r13, rax
mov rcx, rbx
call fcn.004108a0
mov rcx, r13
mov rdx, rdi
mov r8d, eax
add r8d, r8d
add r8d, 2
movsxd r8, r8d
call fcn.00408cc0
mov rcx, rsi
call sub.kernel32.dll_GlobalUnlock
mov ecx, 0xd
mov rdx, rsi
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x4bec00
Capabilities:
Create thread
Resume thread

Disassembly:
sub rsp, 0x38
cmp qword [0x00b2f630], 0
jne 0x4beccb
xor rcx, rcx
call fcn.0042dc70
mov eax, eax
mov qword [0x00b2f630], rax
cmp qword [0x00b2f630], 0
je 0x4beccb
lea rcx, [0x004be990]
xor rdx, rdx
xor r8, r8
call fcn.0042e470
mov dword [0x00b2f638], eax
xor rcx, rcx
or edx, 0xffffffff
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x00b2f650], rax
xor rcx, rcx
xor rdx, rdx
lea r8, [0x004bea00]
xor r9, r9
mov dword [rsp + 0x20], 4
lea rax, [0x00b2f620]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov qword [0x00b2f628], rax
cmp qword [0x00b2f628], 0
je 0x4beccb
mov ecx, dword [0x00b2f620]
lea rdx, [0x004becdc]
call fcn.004abc50
mov rcx, qword [0x00b2f628]
mov edx, 2
call sub.kernel32.dll_SetThreadPriority
mov rcx, qword [0x00b2f628]
call sub.kernel32.dll_ResumeThread
add rsp, 0x38
ret

Function at 0x4bed20
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [0x00b2f630], 0
je 0x4bee34
mov rbx, qword [0x00b2f650]
mov qword [0x00b2f650], 0
mov rcx, rbx
call sub.kernel32.dll_SetEvent
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
cmp qword [0x00b2f648], 0
je 0x4bed81
mov rbx, qword [0x00b2f648]
mov qword [0x00b2f648], 0
mov rcx, rbx
call sub.kernel32.dll_SetEvent
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov dword [0x00b2f640], 0xffffffff
lea rcx, [0x004be990]
xor rdx, rdx
xor r8, r8
call fcn.0042e7e0
mov rcx, qword [0x00b2f628]
mov edx, 0x1f4
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x4bedd8
mov rcx, qword [0x00b2f628]
xor rdx, rdx
call sub.kernel32.dll_TerminateThread
cmp qword [0x00b2f658], 0
je 0x4bedd8
mov rcx, qword [0x00b2f658]
call sub.kernel32.dll_LocalFree
mov qword [0x00b2f658], 0
mov rcx, qword [0x00b2f628]
call sub.kernel32.dll_CloseHandle
mov ecx, dword [0x00b2f620]
xor rdx, rdx
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.004ab870
mov qword [0x00b2f628], 0
mov dword [0x00b2f620], 0
mov qword [0x00b2f630], 0
add rsp, 0x30
pop rbx
ret
Function at 0x4caee0
Capabilities:
Resolve dns

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rcx, rbx
call fcn.00411320
mov rcx, rax
call sub.wsock32.dll_inet_addr
mov esi, eax
cmp esi, 0xffffffff
jne 0x4caf1e
mov rcx, rbx
call fcn.00411320
mov rcx, rax
call sub.wsock32.dll_gethostbyname
test rax, rax
je 0x4caf1e
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov esi, dword [rax]
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x4ce2e0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0xb0
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov r13, r9
or dword [rbp + 0x100], 0xc11c
cmp byte [0x00b2db60], 0
je 0x4ce319
or dword [rbp + 0x100], 0x80000
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov dword [rbp + 0x68], 0
mov dword [rbp + 0x6c], 0
mov dword [rbp + 0x60], 2
mov dword [rbp + 0x64], 0x11
mov rcx, rbx
lea rdx, [rbp + 0xa0]
lea r8, [rbp + 0x80]
mov r9d, 1
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea rax, [rbp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 1
lea rax, [rbp + 0x60]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 1
call fcn.004ce270
lea rcx, [rbx + 0x68]
mov rdx, rsi
mov r8, r13
mov r9d, dword [rbp + 0x100]
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x108]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
mov rax, qword [rbx + 0x10]
call qword [rax + 0x30]
mov esi, eax
mov ecx, esi
call fcn.004a6de0
test al, al
jne 0x4ce40c
cmp esi, 0x80090318
jne 0x4ce418
test rdi, rdi
je 0x4ce418
mov byte [rbx + 0x98], 1
cmp qword [rbp + 0x88], 0
je 0x4ce463
cmp dword [rbp + 0x80], 0
je 0x4ce463
mov rcx, qword [rbx + 0x80]
mov rdx, qword [rbp + 0x88]
mov r8d, dword [rbp + 0x80]
xor r9, r9
call sub.wsock32.dll_send
test eax, eax
jg 0x4ce452
mov esi, 0x80090304
mov rcx, qword [rbp + 0x88]
mov rax, qword [rbx + 0x10]
call qword [rax + 0x80]
cmp qword [rbp + 0x98], 0
je 0x4ce487
cmp dword [rbp + 0x90], 0
je 0x4ce487
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbx + 0x10]
call qword [rax + 0x80]
mov eax, esi
lea rsp, [rbp + 0xb0]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret