joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400022d0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x14000231d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140002314
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14000231f
add rax, 0x28
cmp rax, r9
jne 0x140002300
xor eax, eax
ret

Function at 0x140002320
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x1400023b0
mov rdx, qword [0x14005b3f0]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14000239e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000239e
cmp word [rax + 0x18], 0x20b
jne 0x14000239e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x1400023b0
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140002389
add rbx, 0x28
cmp rbx, rdi
je 0x1400023b0
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140002380
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400023c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14005b3f0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400023e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400023e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400023e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000243d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002434
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400023e0
add rax, 0x28
cmp rax, r9
jne 0x140002420
xor eax, eax
ret

Function at 0x140002440
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14005b3f0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000245f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002468
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000245f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002480
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x14005b3f0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1400024a0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1400024a8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400024a0
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x1400024f0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1400024e7
test rcx, rcx
je 0x1400024a0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x1400024d8
xor eax, eax
ret
Function at 0x140002500
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14005b3f0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000251f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002528
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002540
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14005b3f0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002560
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002568
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002560
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140002560
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x1400025b4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400025c0
add rdx, 0x28
cmp r9, rdx
jne 0x1400025a0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400025d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14005b3f0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1400025f2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002600
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400025f2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1400025f2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x1400025f2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140002655
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002668
add rdx, 0x28
cmp rdx, r10
jne 0x140002640
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002677
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002687
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14000265e
test ecx, ecx
jg 0x140002670
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140001940
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140002800
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140002800
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x1400019b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x1400070d4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x140001b60
mov rax, qword [0x1400070d8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400019fc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140001a87
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x1400019e0
mov rcx, r12
call fcn.140002460
mov rbp, rax
test rax, rax
je 0x140001bbd
mov rax, qword [0x1400070d8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.140002590
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400070d8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001ba2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001a80
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001b10
add dword [0x1400070d4], 1
cmp ebx, 8
jae 0x140001ab8
test bl, 4
jne 0x140001b70
test ebx, ebx
je 0x140001aa9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x140001b90
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x140001aa9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x140001aea
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x1400070d8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001a80
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001940
xor edi, edi
jmp 0x140001a07
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x140001aa9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x140001aa9
mov rax, qword [0x1400070d8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.140001940
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140001940
nop
nop dword [rax]
Function at 0x1400020d0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140007140]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140007120]
test rbx, rbx
je 0x140002124
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14000211b
test r12, r12
je 0x14000211b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002100
lea rcx, [0x140007140]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002460
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x140004360]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x1400024d9
mov rcx, r10
call fcn.140002330
test eax, eax
je 0x1400024d9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x1400024d6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x1400024cd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x1400024d9
add r8, 0x28
cmp r8, r9
jne 0x1400024b8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x1400011cc
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1400267d0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbp, r8
mov esi, edx
mov rdi, rcx
call fcn.14000104c
xor ebx, ebx
cmp qword [0x140028258], rbx
je 0x140001259
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, SysAllocStringByteLen
call fcn.14000ce70
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], SysAllocStringByteLen
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 1
jne 0x140001238
cmp dword [rsp + 0x28], 0xa
jae 0x140001246
cmp dword [rsp + 0x30], 2
jne 0x140001259
cmp dword [rsp + 0x24], 5
jb 0x140001259
xor r9d, r9d
mov r8, rbp
mov edx, esi
mov rcx, rdi
call qword [0x140028258]
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000cff0
mov rbx, qword [rsp + 0x108]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret

Function at 0x140001edc
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x140028460], 0
mov rdi, rdx
mov rbx, rcx
jne 0x140001f30
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140001f20
lea rdx, [0x14001c8d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028458], rax
jmp 0x140001f27
mov rax, qword [0x140028458]
mov byte [0x140028460], 1
jmp 0x140001f37
mov rax, qword [0x140028458]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140001f4d
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x140001f53
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140002010
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor edi, edi
mov rbx, r8
mov rbp, rdx
mov r12, rcx
cmp r8, rdi
jne 0x14000203e
lea eax, [rdi + 0xd]
jmp 0x140002075
mov rsi, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ecx, eax
add edi, eax
add rsi, rcx
cmp eax, 1
jne 0x140002041
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x14000278c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x1400267d0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov edi, dword [rcx + 8]
xor eax, eax
mov rsi, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
or edi, 0x2001f
xor r8d, r8d
mov r9d, edi
mov rbp, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x140002899
test rcx, rcx
je 0x140002801
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
and edi, 0x300
mov dword [rsp + 0x50], edi
xor edi, edi
mov qword [rsp + 0x48], rcx
cmp ebx, edi
jmp 0x140002833
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000278c
mov rcx, qword [rsp + 0x48]
mov ebx, eax
cmp eax, edi
jne 0x14000289b
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, edi
je 0x14000281b
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x140002881
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rdi
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x50], edi
call fcn.140001edc
mov rcx, qword [rsp + 0x48]
mov ebx, eax
jmp 0x14000289b
xor edi, edi
cmp rcx, rdi
je 0x1400028a6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14000cff0
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x140008c04
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
and qword [rsp + 0x30], 0
mov eax, 4
lea rdx, str.SOFTWAREIntelDisplayigfxcuiigfxtrayTrayIcon
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], 0x3a98
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140008c7c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.FadeAwayTime
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x1400096f4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
push rbx
push rdi
sub rsp, 0x68
and qword [rax - 0x20], 0
and dword [rax + 0x18], 0
and dword [rax - 0x28], 0
and dword [rax + 8], 0
mov edi, ecx
mov dword [rax + 0x20], 4
mov eax, 0x20019
mov ebx, 1
lea rdx, str.SOFTWAREIntelDisplayigfxcuiigfxtrayTrayIcon
lea ecx, [rax + 6]
cmp edi, ebx
cmove eax, ecx
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rcx
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
and dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140009894
mov rcx, qword [rsp + 0x58]
lea rdx, str.ShowTrayIcon
test edi, edi
jne 0x140009836
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x98]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x90], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000982d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x58]
lea rdx, str.SOFTWAREIntelDisplayigfxcuiigfxtrayTrayIcon
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000985c
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rdx, str.ShowTrayIcon
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000985c
mov ebx, dword [rsp + 0x80]
jmp 0x14000985c
mov r9d, dword [rsp + 0x98]
lea rax, [rsp + 0x88]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, [0x14001d340]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140009889
movsxd r9, dword [rsp + 0x88]
xor r8d, r8d
mov edx, 0x1729
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x68
pop rdi
pop rbx
ret
Function at 0x14000ede0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14000ee69
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x14000ee2b
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14000ee79
mov ecx, 0x20b
cmp word [rax + 0x18], cx
je 0x14000ee41
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14000ee79
cmp dword [rax + 0x84], 0xe
ja 0x14000ee55
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14000ee79
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xb0], ebx
jmp 0x14000ee79
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
lea rdi, [0x140000000]
mov ecx, 1
call fcn.1400ba000
test eax, eax
jne 0x14000eea9
cmp dword [0x1400285d0], 1
jne 0x14000ee95
call fcn.140013af0
mov ecx, 0x1c
call fcn.1400138c8
mov ecx, 0xff
call fcn.140012788
call fcn.14000fefc
test eax, eax
jne 0x14000eed4
cmp dword [0x1400285d0], 1
jne 0x14000eec0
call fcn.140013af0
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.1400138c8
mov ecx, 0xff
call fcn.140012788
call fcn.140014aa0
nop
call fcn.1400147b0
test eax, eax
jns 0x14000eeed
mov ecx, 0x1b
call fcn.14001271c
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x14002a6b0], rax
call fcn.1400145fc
mov qword [0x1400285c0], rax
call fcn.140014504
test eax, eax
jns 0x14000ef19
mov ecx, 8
call fcn.14001271c
call fcn.140014204
test eax, eax
jns 0x14000ef2c
mov ecx, 9
call fcn.14001271c
mov ecx, 1
call fcn.140012828
test eax, eax
je 0x14000ef41
mov ecx, eax
call fcn.14001271c
call fcn.140014188
test byte [rsp + 0x6c], 1
movzx edx, word [rsp + 0x70]
mov r9d, 0xa
cmovne r9d, edx
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.140007a74
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x14000ef78
mov ecx, eax
call fcn.140012a64
call fcn.140012a7c
jmp 0x14000ef99
mov eax, edi
jmp 0x14000efa2
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.140014b10
add rsp, 0x28
jmp 0x14000ede0
Function at 0x140010f3b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400267d0]
jne 0x14000d00a
rol rcx, 0x10
test cx, 0xffff
jne 0x14000d006
repz ret
ror rcx, 0x10
jmp 0x140010e94
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400286e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1400287d8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140010f19
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400286e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140010f3b
mov rax, qword [rsp + 0x88]
mov qword [0x1400287d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140028778], rax
mov rax, qword [0x1400287d8]
mov qword [0x140028650], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140028760], rax
mov dword [0x140028640], 0xc0000409
mov dword [0x140028644], 1
mov rax, qword [0x1400267d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400267d8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400286d8], eax
mov ecx, 1
call fcn.140011140
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14001d9e8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400286d8], 0
jne 0x140010fc2
mov ecx, 1
call fcn.140011140
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140012a70
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400128d8
Function at 0x140016478
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14000fc2c
xor ebx, ebx
mov rdi, rax
cmp qword [0x140029350], rbx
jne 0x14001657e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140016653
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140016653
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140029350], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140029358], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140029360], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140029370], rax
test rax, rax
je 0x140016575
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140029368], rax
jmp 0x140016585
mov rax, qword [0x140029368]
jmp 0x14001658c
mov rax, qword [0x140029368]
mov r11, qword [0x140029370]
cmp rax, rdi
je 0x1400165f4
cmp r11, rdi
je 0x1400165f4
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140029370]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1400165f4
test rax, rax
je 0x1400165f4
call rsi
test rax, rax
je 0x1400165ee
lea rcx, [rsp + 0x88]
mov r9d, SafeArrayGetDim
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400165ee
test byte [rsp + 0x38], 1
jne 0x1400165f4
bts ebp, 0x15
jmp 0x140016632
mov rcx, qword [0x140029358]
cmp rcx, rdi
je 0x140016632
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140016632
call rax
mov rbx, rax
test rax, rax
je 0x140016632
mov rcx, qword [0x140029360]
cmp rcx, rdi
je 0x140016632
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140016632
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140029350]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140016653
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140016655
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret