joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008f0bc
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov rbp, r9
mov r14, r8
mov rsi, rdx
mov rdi, rcx
cmp rcx, 0xffffffff80000001
jne 0x14008f0ec
xor ecx, ecx
call fcn.14007ace8
and qword [rsp + 0x50], rbx
lea rax, [rsp + 0x50]
mov r9d, 2
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, 0x80070000
test eax, eax
jne 0x14008f128
mov rbx, qword [rsp + 0x50]
and qword [rsp + 0x50], 0
xor edi, edi
jmp 0x14008f139
movzx edi, ax
or edi, esi
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14007ac40
mov ecx, edi
call fcn.14007ace8
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14008f156
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x50], 0
test edi, edi
js 0x14008f19b
xor ecx, ecx
call fcn.14007ace8
mov eax, dword [rsp + 0x70]
xor ecx, ecx
mov dword [rsp + 0x28], eax
test rbx, rbx
mov r9d, 3
mov qword [rsp + 0x20], rbp
cmovne rcx, rbx
mov rdx, r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14008f191
xor edi, edi
jmp 0x14008f1a2
movzx edi, ax
or edi, esi
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14007ac40
mov ecx, edi
call fcn.14007ace8
test rbx, rbx
je 0x14008f1b7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
mov eax, edi
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14008f1d4
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
lea rax, [rbp + 0x20]
and qword [rbp + 0x20], rbx
lea rdx, [0x1403de7e0]
mov rsi, r8
mov qword [r11 - 0x28], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008f22a
mov rbx, qword [rbp + 0x20]
and qword [rbp + 0x20], 0
xor edi, edi
jmp 0x14008f23f
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14007ac40
mov ecx, edi
call fcn.14007ace8
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14008f25a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp + 0x20], 0
movzx eax, di
test eax, eax
je 0x14008f281
cmp eax, 2
je 0x14008f27d
test edi, edi
mov eax, 0x80004005
cmovns edi, eax
test edi, edi
jns 0x14008f28b
mov ecx, edi
call fcn.14007ac40
jmp 0x14008f28b
xor eax, eax
jmp 0x14008f286
mov eax, 1
mov dword [rbp + 0x28], eax
xor edi, edi
mov ecx, edi
call fcn.14007ace8
test rbx, rbx
je 0x14008f2a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
js 0x14008f38b
cmp dword [rbp + 0x28], 1
jne 0x14008f392
lea r9, [rbp + 0x28]
mov r8, rsi
call fcn.140090c50
mov edi, eax
test eax, eax
jns 0x14008f2cb
mov ecx, eax
jmp 0x14008f38d
cmp dword [rbp + 0x28], 1
jne 0x14008f392
xor ebx, ebx
lea rax, [rbp + 0x28]
and qword [rbp + 0x28], rbx
lea rdx, [0x1403de7e0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008f30f
mov rbx, qword [rbp + 0x28]
xor edi, edi
and qword [rbp + 0x28], rdi
jmp 0x14008f324
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14007ac40
mov ecx, edi
call fcn.14007ace8
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14008f33f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp + 0x28], 0
test edi, edi
js 0x14008f36b
xor ecx, ecx
mov rdx, rsi
test rbx, rbx
cmovne rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x14008f35d
xor edi, edi
jmp 0x14008f372
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14007ac40
mov ecx, edi
call fcn.14007ace8
test rbx, rbx
je 0x14008f387
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jns 0x14008f392
mov ecx, edi
call fcn.14007ac40
mov ecx, edi
call fcn.14007ace8
mov rbx, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140090c50
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
xor ebx, ebx
lea rax, [r11 - 0x28]
and qword [r11 - 0x28], rbx
lea rdx, [0x1403de7e0]
mov r14, r9
mov qword [r11 - 0x38], rax
mov rbp, r8
mov rcx, 0xffffffff80000002
lea esi, [rbx + 1]
xor r8d, r8d
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140090caf
mov rbx, qword [rsp + 0x30]
and qword [rsp + 0x30], 0
xor edi, edi
jmp 0x140090cc4
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14007ac40
mov ecx, edi
call fcn.14007ace8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140090ce1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x30], 0
test edi, edi
jns 0x140090cee
mov ecx, edi
call fcn.14007ac40
jmp 0x140090d36
xor ecx, ecx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
test rbx, rbx
mov rdx, rbp
cmovne rcx, rbx
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140090d33
cmp eax, 2
je 0x140090d31
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x140090ce5
xor esi, esi
mov dword [r14], esi
mov ecx, edi
call fcn.14007ace8
test rbx, rbx
je 0x140090d4b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x70]
mov eax, edi
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140091b14
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r14, r9
lea rax, [rbp - 8]
mov r15, r8
mov qword [r11 - 0x38], rax
xor edi, edi
xor ebx, ebx
and qword [rbp - 8], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea r9d, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140091b6d
mov rdi, qword [rbp - 8]
xor esi, esi
and qword [rbp - 8], rbx
jmp 0x140091b82
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.14007ac40
mov ecx, esi
call fcn.14007ace8
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140091b9c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 8], rbx
test esi, esi
js 0x140091c3d
and dword [rbp + 0x20], ebx
lea rax, [rbp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
mov rdx, r15
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140091c2f
test rbx, rbx
jne 0x140091c04
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x140091bfd
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140091ba7
mov esi, 0x8007000e
jmp 0x140091c3d
mov esi, 0x8000ffff
jmp 0x140091c3d
cmp dword [rbp - 0x10], 3
je 0x140091c11
mov esi, 0x8007000d
jmp 0x140091c3d
mov qword [r14], rbx
xor ecx, ecx
call fcn.14007ace8
mov rcx, qword [rbp + 0x40]
xor esi, esi
xor ebx, ebx
test rcx, rcx
je 0x140091c44
mov eax, dword [rbp + 0x20]
mov dword [rcx], eax
jmp 0x140091c44
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.14007ac40
mov ecx, esi
call fcn.14007ace8
test rbx, rbx
je 0x140091c64
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rdi, rdi
je 0x140091c72
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x68]
mov eax, esi
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x140091f9c
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x270
mov rax, qword [0x140451b38]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor eax, eax
lea rdx, [rsp + 0x50]
mov r8d, 0x104
mov qword [rsp + 0x20], rax
lea rcx, str.systemroot
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [0x140458a84]
mov ebx, eax
lea rcx, [0x14043e218]
call fcn.1400f3318
test ebx, ebx
jne 0x140092042
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140458554]
mov ebx, eax
lea rcx, [0x14042af18]
call fcn.1400f39c8
lea rdx, [0x140454e48]
lea rcx, [0x14044380c]
call fcn.1400f470c
test ebx, ebx
jne 0x14009202f
mov esi, 0x80004005
jmp 0x140092166
movzx esi, bx
or esi, 0x80070000
test ebx, ebx
cmovle esi, ebx
jmp 0x140092166
lea rdx, [rsp + 0x50]
lea rcx, str.windir
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140453470]
mov ebx, eax
lea rcx, [0x14043023c]
call fcn.1400f50f4
test ebx, ebx
jne 0x14009208a
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140092025
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x140092166
lea rcx, [rsp + 0x20]
call fcn.1400925b8
mov esi, eax
test eax, eax
jns 0x1400920a1
mov ecx, eax
jmp 0x140092168
lea rax, str.SPPSvc
xor esi, esi
and qword [rsp + 0x38], rsi
lea rdx, [0x1404593f0]
mov qword [rsp + 0x28], rax
lea rcx, [0x140435310]
lea rax, [0x140092790]
mov qword [rsp + 0x30], rax
call fcn.1400f470c
and qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x140092148
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x14045b598]
mov ebx, eax
lea rcx, [0x140437120]
call fcn.1400f43c0
test ebx, ebx
jne 0x140092120
lea rdx, [0x140455918]
mov esi, 0x80004005
lea rcx, [0x1404322e8]
call fcn.1400f4dac
jmp 0x14009212e
movzx esi, bx
or esi, 0x80070000
test ebx, ebx
cmovle esi, ebx
mov ecx, esi
call fcn.14007ac40
lea rdx, [0x140459af8]
lea rcx, [0x14042c43c]
call fcn.1400f406c
mov ecx, esi
call fcn.14007ace8
test esi, esi
jns 0x14009216d
lea rdx, [0x140457ac0]
lea rcx, [0x140433d54]
call fcn.1400f4a64
mov ecx, esi
call fcn.14007ac40
mov ecx, esi
call fcn.14007ace8
cmp dword [rsp + 0x20], 0
je 0x1400921c8
cmp qword [0x14045d840], 0
je 0x1400921c8
mov rbx, qword [0x14045dae0]
test rbx, rbx
je 0x1400921c8
mov rax, qword [0x1403d25b8]
mov rcx, qword [0x14045d848]
call rax
mov rax, qword [0x14045d848]
mov rcx, rbx
call rax
lea rdx, [0x14045b924]
lea rcx, [0x14042ee3c]
call fcn.1400f3670
and qword [0x14045dae0], 0
lea rdx, [0x140454938]
lea rcx, [0x14043a868]
call fcn.1400f3d14
cmp dword [rsp + 0x24], 0
je 0x1400921e8
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
mov eax, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140388a40
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rsi
ret
Function at 0x14009fef4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
xor ebx, ebx
lea rax, [r11 - 0x20]
and qword [r11 - 0x20], rbx
mov r14, r9
mov rbp, r8
mov qword [r11 - 0x38], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
lea esi, [rbx + 1]
mov r9d, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14009ff48
mov rbx, qword [rsp + 0x38]
and qword [rsp + 0x38], 0
xor edi, edi
jmp 0x14009ff5d
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14007ac40
mov ecx, edi
call fcn.14007ace8
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14009ff7a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x38], 0
test edi, edi
jns 0x14009ff87
mov ecx, edi
call fcn.14007ac40
jmp 0x14009ffcf
xor ecx, ecx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
test rbx, rbx
mov rdx, rbp
cmovne rcx, rbx
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14009ffcc
cmp eax, 2
je 0x14009ffca
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14009ff7e
xor esi, esi
mov dword [r14], esi
mov ecx, edi
call fcn.14007ace8
test rbx, rbx
je 0x14009ffe4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x68]
mov eax, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400a4e44
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
or rbx, 0xffffffffffffffff
mov r14, r8
mov r15, rdx
mov edi, r12d
mov esi, r12d
test rcx, rcx
jne 0x1400a4e7c
mov ecx, 0x80070057
mov esi, ecx
jmp 0x1400a4f6e
test r15, r15
je 0x1400a4e70
test r14, r14
je 0x1400a4e70
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400a4f4d
mov rcx, r13
lea rdx, [rsp + 0x80]
mov rbx, r13
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400a4f4d
cmp dword [rsp + 0x80], r12d
jne 0x1400a4e70
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x1400a4f03
mov rdi, r12
jmp 0x1400a4f0b
mov rdx, rdi
test rdi, rdi
jne 0x1400a4f12
mov esi, 0x8007000e
jmp 0x1400a4f6c
mov rcx, r13
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x98]
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400a4f4d
cmp dword [rsp + 0x98], ebp
je 0x1400a4f3f
mov esi, 0x8000ffff
jmp 0x1400a4f6c
mov rax, rdi
mov dword [r15], ebp
mov qword [r14], rax
mov rdi, r12
jmp 0x1400a4f73
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400a4f5e
mov esi, 0x80004005
jmp 0x1400a4f6c
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.14007ac40
mov ecx, esi
call fcn.14007ace8
test rdi, rdi
je 0x1400a4f93
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400a4fa6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x88]
mov eax, esi
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400adee4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp rcx, 0xffffffff80000001
jne 0x1400adf10
xor ecx, ecx
call fcn.14007ace8
and qword [rsp + 0x50], rbx
lea rax, [rsp + 0x50]
mov r9d, 2
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, 0x80070000
test eax, eax
jne 0x1400adf4c
mov rbx, qword [rsp + 0x50]
and qword [rsp + 0x50], 0
xor edi, edi
jmp 0x1400adf5d
movzx edi, ax
or edi, esi
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14007ac40
mov ecx, edi
call fcn.14007ace8
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400adf7a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x50], 0
test edi, edi
js 0x1400adfc4
xor ecx, ecx
call fcn.14007ace8
mov eax, dword [rsp + 0x70]
xor ecx, ecx
mov dword [rsp + 0x28], eax
test rbx, rbx
lea rax, [rsp + 0x68]
mov r9d, 4
cmovne rcx, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400adfba
xor edi, edi
jmp 0x1400adfcb
movzx edi, ax
or edi, esi
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14007ac40
mov ecx, edi
call fcn.14007ace8
test rbx, rbx
je 0x1400adfe0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b02ac
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
and dword [rbp - 0x40], 0
lea rax, [0x140043e1c]
and dword [rbp - 0x3c], 0
lea rdx, [rbp - 0x30]
and qword [rbp - 0x38], 0
mov rsi, r9
and qword [rbp - 0x18], 0
xor r9d, r9d
mov qword [rbp - 0x28], rax
mov ecx, 0xb9
lea rax, [rbp + 0x28]
mov qword [rbp - 0x30], 3
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x40]
lea r8d, [r9 + 0x30]
mov qword [rbp - 0x10], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x28]
test ebx, ebx
jns 0x1400b031c
mov ecx, ebx
jmp 0x1400b0399
xor edi, edi
cmp dword [rbp - 0x3c], edi
jle 0x1400b0385
movsxd rbx, edi
shl rbx, 7
add rbx, qword [rbp - 0x38]
mov rcx, rbx
lea rdx, [rbx + 0x68]
call fcn.1400b1cdc
lea rax, [0x140043adc]
mov qword [rbp - 0x30], 3
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
lea rax, [rbp + 0x30]
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x20], rax
xor r9d, r9d
lea rax, [rbx + 0x60]
mov ecx, 0xb9
mov qword [rbp - 0x10], rax
lea rax, [rbx + 0x58]
mov qword [rbp - 8], rax
lea r8d, [r9 + 0x30]
call sub.ntdll.dll_NtQuerySystemInformation
inc edi
cmp edi, dword [rbp - 0x3c]
jl 0x1400b0323
lea r8, [rbp - 0x40]
mov rdx, rsi
call fcn.1400b8ef8
mov ebx, eax
test eax, eax
jns 0x1400b039e
mov ecx, eax
call fcn.14007ac40
mov ecx, ebx
call fcn.14007ace8
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.1400c4d6c
mov rdi, qword [rbp - 0x38]
test rdi, rdi
je 0x1400b03cd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b8850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140451b38]
xor rax, rsp
mov qword [rbp - 8], rax
xor r15d, r15d
mov dword [rbp - 0x38], 0x73006d
mov ebx, r15d
mov dword [rbp - 0x34], 0x740066
lea rax, [rbp - 0x50]
mov qword [rbp - 0x40], rbx
mov r8, rcx
mov dword [rbp - 0x30], 0x73003a
mov rsi, rdx
mov dword [rbp - 0x2c], 0x700070
mov r9, rcx
mov dword [rbp - 0x28], 0x63002f
mov dword [rbp - 0x24], 0x630061
sub r8, rax
mov dword [rbp - 0x20], 0x650068
mov dword [rbp - 0x1c], 0x740073
mov dword [rbp - 0x18], 0x72006f
mov dword [rbp - 0x14], 0x2f0065
mov dword [rbp - 0x10], 0x730025
mov word [rbp - 0xc], r15w
mov dword [rbp - 0x50], 0x6d0048
mov dword [rbp - 0x4c], 0x630061
mov dword [rbp - 0x48], 0x65004b
mov dword [rbp - 0x44], 0x79
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x1400b890d
add rax, 2
test edx, edx
jne 0x1400b88f9
test ecx, ecx
jne 0x1400b891f
mov edi, 0x80070057
mov ecx, edi
call fcn.14007ac40
jmp 0x1400b8949
mov r8, r9
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x40]
call fcn.140079e68
mov edi, eax
test eax, eax
jns 0x1400b8942
mov ecx, eax
call fcn.14007ac40
mov rbx, qword [rbp - 0x40]
jmp 0x1400b8949
mov rax, qword [rbp - 0x40]
mov qword [rsi], rax
mov ecx, edi
call fcn.14007ace8
test rbx, rbx
je 0x1400b8971
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140388a40
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c0bec
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r15, r8
mov r12d, edx
xor edi, edi
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x48], rdi
mov ebx, edi
mov r13, r9
call fcn.1400c65d4
mov r14, qword [rbp - 0x48]
mov esi, eax
test eax, eax
jns 0x1400c0c3f
mov ecx, eax
call fcn.14007ac40
jmp 0x1400c0cd8
mov esi, 0x20
mov edx, esi
lea ecx, [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x1400c0c5c
mov rbx, rdi
jmp 0x1400c0c61
test rbx, rbx
jne 0x1400c0c6a
mov esi, 0x8007000e
mov ecx, esi
jmp 0x1400c0c35
mov edi, dword [rbp - 0x50]
lea rcx, [0x14004789c]
mov qword [rbp - 0x38], rcx
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x4c]
mov qword [rbp - 0x18], r14
xor r9d, r9d
mov qword [rbp - 0x30], rcx
mov dword [rbp - 0x1c], edi
mov qword [rbp - 0x40], 3
mov dword [rbp - 0x28], r12d
lea r8d, [r9 + 0x3c]
mov qword [rbp - 0x24], r15
lea ecx, [r8 + 0x7d]
mov dword [rbp - 0x10], esi
mov qword [rbp - 0xc], rbx
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rbp - 0x4c]
test esi, esi
js 0x1400c0c66
mov ecx, edi
mov dword [r13], 0x20
xor eax, eax
mov rdi, r14
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x50]
mov rcx, rbx
xor edi, edi
mov ebx, edi
mov qword [rax], rcx
mov ecx, esi
call fcn.14007ace8
test rbx, rbx
je 0x1400c0ced
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r14, r14
je 0x1400c0cfb
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x70]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400c2440
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
or rbx, 0xffffffffffffffff
xor edi, edi
mov rbp, r8
mov esi, edx
test rcx, rcx
jne 0x1400c2470
mov ecx, 0x80070057
mov edi, ecx
jmp 0x1400c24f0
mov qword [rsp + 0x30], rdi
mov r8d, 2
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400c24cf
mov rbx, rdx
mov qword [rsp + 0x20], rdi
mov rcx, rdx
lea r9, [rsp + 0x50]
mov rdx, rbp
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400c24cf
cmp dword [rsp + 0x50], esi
je 0x1400c24f5
mov ecx, 0x8000ffff
jmp 0x1400c2469
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400c24e0
mov edi, 0x80004005
jmp 0x1400c24ee
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14007ac40
mov ecx, edi
call fcn.14007ace8
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400c250f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov eax, edi
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret