joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400063e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov eax, r8d
mov rsi, rdx
mov ebx, r8d
shr eax, 4
mov rbp, rcx
mov r8d, 6
add ax, 1
mov rcx, rsi
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x140006549
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140006549
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x140006549
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x14000647a
cmp rdi, r11
jae 0x140006549
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x140006464
cmp rdi, r11
jae 0x140006549
movzx eax, word [rdi]
test ax, ax
je 0x140006549
mov qword [rsp + 0x60], r13
movzx ebx, ax
call qword [0x140017030]
xor r13d, r13d
lea r12, [rdi + 2]
mov r9d, ebx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rbp]
mov edx, 1
movsxd rsi, eax
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, esi
or edx, ecx
jge 0x1400064ea
mov edx, esi
mov rcx, rbp
call fcn.140006560
mov rbx, qword [rbp]
movzx edi, word [rdi]
call qword [0x140017030]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r9d, edi
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
mov r13, qword [rsp + 0x60]
js 0x14000653e
mov rcx, qword [rbp]
cmp esi, dword [rcx - 0xc]
jg 0x14000653e
mov dword [rcx - 0x10], esi
mov rcx, qword [rbp]
mov eax, 1
mov byte [rsi + rcx], 0
jmp 0x14000654b
mov ecx, 0x80070057
call fcn.140005f70
int3
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1400076a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov edi, r8d
mov rbp, rdx
mov dword [rsp + 0x68], 0
mov ecx, 0x7fff
call qword [0x1400121f8]
mov rsi, rax
mov r9d, 1
mov r8d, edi
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x140007765
mov rcx, rsi
call qword [0x140012208]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
lea rdx, [0x1400128bc]
test rdx, 0xffffffffffff0000
jne 0x140007741
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.140005fc0
test rax, rax
je 0x14000775d
mov r8d, edi
mov rdx, rax
mov rcx, rbp
call fcn.1400060f0
jmp 0x14000775d
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbp
call fcn.140006280
nop
mov rax, rbp
jmp 0x140007871
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
or rbx, 0xffffffffffffffff
test rsi, rsi
je 0x1400077c8
test rsi, 0xffffffffffff0000
jne 0x1400077b4
movzx edi, si
xor edx, edx
mov ecx, edi
call fcn.140005fc0
test rax, rax
je 0x1400077db
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400060f0
jmp 0x1400077db
xor eax, eax
mov rcx, rbx
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x1400077ca
xor ecx, ecx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.140006280
nop
mov rcx, rsi
call qword [0x140012208]
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x14000780d
cmp rax, qword [rdi - 0x18]
jne 0x14000780d
lea rsi, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x14000784c
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
jne 0x140007829
call fcn.140005f60
int3
mov eax, dword [rdi - 0x10]
mov dword [rsi + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rsi + 0x18]
call qword [0x1400121d0]
lea rax, [rsi + 0x18]
mov qword [rbp], rax
lock xadd dword [rdi - 8], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x14000786e
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + 8]
mov rax, rbp
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x290
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x2c0], rbx
mov rax, qword [0x140017060]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r12, r9
mov r13, r8
mov rbp, rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r9
xor ebx, ebx
mov dword [rsp + 0x34], ebx
mov qword [rsp + 0x48], rbx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
lea rdx, [0x1400128bc]
or rsi, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x140007b5e
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.140005fc0
test rax, rax
je 0x140007b79
mov r8d, edi
mov rdx, rax
mov rcx, rbp
call fcn.1400060f0
jmp 0x140007b79
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbp
call fcn.140006280
nop
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [0x1400177a0]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140007c40
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140007c40
mov eax, dword [rsp + 0x38]
cmp eax, 1
je 0x140007bfe
cmp eax, 2
jne 0x140007c40
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140007c17
test al, 1
jne 0x140007c40
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], 0
je 0x140007c1e
jmp 0x140007c40
mov word [rsp + 0x70], 0
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x70]
mov rcx, rbp
call fcn.140006280
nop
test rbx, rbx
je 0x140007c4f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x140007c71
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, rbp
jmp 0x140007c74
mov rax, rbp
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14000eea0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007f50
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x290
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x140017060]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r12, r8
mov rbp, rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r8
xor ebx, ebx
mov dword [rsp + 0x34], ebx
mov qword [rsp + 0x48], rbx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
lea rdx, [0x1400128bc]
or rsi, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x140007fea
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.140005fc0
test rax, rax
je 0x140008005
mov r8d, edi
mov rdx, rax
mov rcx, rbp
call fcn.1400060f0
jmp 0x140008005
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbp
call fcn.140006280
nop
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [0x1400177a8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400080d0
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400080d0
mov eax, dword [rsp + 0x38]
cmp eax, 1
je 0x14000808e
cmp eax, 2
jne 0x1400080d0
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400080a7
test al, 1
jne 0x1400080d0
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], 0
je 0x1400080ae
jmp 0x1400080d0
mov word [rsp + 0x70], 0
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x70]
mov rcx, rbp
call fcn.140006280
nop
test rbx, rbx
je 0x1400080df
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x140008101
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, rbp
jmp 0x140008104
mov rax, rbp
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14000eea0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140008230
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rbp
mov rbp, rdx
mov r12d, 1
mov rdx, qword [rdx]
mov edi, dword [rdx - 0x10]
lea eax, [rdi - 1]
test eax, eax
js 0x1400083bb
cmp eax, edi
jg 0x1400083bb
cdqe
cmp word [rdx + rax*2], 0x5c
je 0x1400082cb
lea ebx, [rdi + 1]
mov ecx, r12d
sub ecx, dword [rdx - 8]
mov eax, dword [rdx - 0xc]
sub eax, ebx
or eax, ecx
jge 0x140008297
mov edx, ebx
mov rcx, rbp
call fcn.140005e00
mov rcx, qword [rbp]
mov word [rcx + rdi*2], 0x5c
test ebx, ebx
js 0x1400082c0
mov rax, qword [rbp]
cmp ebx, dword [rax - 0xc]
jg 0x1400082c0
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rbp]
mov word [rax + rcx*2], 0
jmp 0x1400082cb
mov ecx, 0x80070057
call fcn.140005f70
int3
mov rcx, qword [rbp]
or esi, 0xffffffff
cmp dword [rcx - 0x10], 2
jle 0x140008399
add rcx, 4
mov dx, 0x5c
call qword [0x1400121e0]
mov rdi, rax
test rax, rax
je 0x140008399
sub rdi, qword [rbp]
sar rdi, 1
cmp edi, esi
je 0x140008399
test r12d, r12d
je 0x140008399
mov r8d, edi
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.140008850
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [0x140012390]
test eax, eax
jne 0x14000833e
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r12d, eax
lea ecx, [rdi + 1]
mov rdx, qword [rbp]
test ecx, ecx
js 0x140008373
cmp ecx, dword [rdx - 0x10]
jge 0x140008373
movsxd rcx, ecx
lea rcx, [rdx + rcx*2]
mov dx, 0x5c
call qword [0x1400121e0]
test rax, rax
jne 0x140008368
mov edi, esi
jmp 0x140008375
sub rax, qword [rbp]
sar rax, 1
mov edi, eax
jmp 0x140008375
mov edi, esi
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140008390
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp edi, 0xffffffff
jne 0x140008305
mov rdx, qword [rbp]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400083b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, r12d
jmp 0x1400083c6
mov ecx, 0x80070057
call fcn.140005f70
nop
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x14000eb54
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x140017060]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.14000f3f2
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x140003000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.14000f3f2
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x14000ebe7
cmp dword [rsp + 0x24], 5
jb 0x14000ec01
jmp 0x14000ebfd
cmp dword [rsp + 0x30], esi
jne 0x14000ec01
cmp dword [rsp + 0x24], 4
ja 0x14000ebfd
jne 0x14000ec01
cmp dword [rsp + 0x28], 0
jbe 0x14000ec01
mov byte [rbx + 0x18], sil
lea rax, [0x140012528]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.140008dc0
movzx ecx, byte [0x140017838]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x140017838], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000eea0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14000f587
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140017060]
jne 0x14000eeba
rol rcx, 0x10
test cx, 0xffff
jne 0x14000eeb6
repz ret
ror rcx, 0x10
jmp 0x14000f4e0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400172a0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140017398]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000f565
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400172a0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000f587
mov rax, qword [rsp + 0x88]
mov qword [0x140017398], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140017338], rax
mov rax, qword [0x140017398]
mov qword [0x140017210], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140017320], rax
mov dword [0x140017200], 0xc0000409
mov dword [0x140017204], 1
mov rax, qword [0x140017060]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140017068]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140017298], eax
mov ecx, 1
call fcn.14000fa2c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140012568]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140017298], 0
jne 0x14000f60e
mov ecx, 1
call fcn.14000fa2c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1000020e4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x90
mov rax, qword [0x100004100]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rsi, qword [0x100004688]
xor r12d, r12d
mov r8d, r12d
mov rdx, rsi
cmp rsi, r12
je 0x1000022d9
or r13, 0xffffffffffffffff
mov rdi, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x28]
xor eax, eax
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
lea r8d, [r8 + rcx*2 + 4]
cmp rdx, r12
jne 0x10000212e
lea ebp, [r8 + r8 + 2]
mov ecx, ebp
call fcn.10000196c
mov rbx, rax
cmp rax, r12
jne 0x100002169
mov eax, 0xc0000017
jmp 0x1000022db
mov rdx, rax
cmp rsi, r12
je 0x10000220c
mov rcx, qword [rsi + 0x18]
mov rdi, rdx
movzx eax, word [rcx]
add rcx, 2
mov word [rdi], ax
add rdi, 2
cmp ax, r12w
jne 0x10000217c
mov rdi, qword [rsi + 0x18]
xor eax, eax
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
mov eax, ecx
mov r8, rcx
lea r9, [rdx + rax*2 + 2]
mov word [rdx + rax*2], r12w
mov rdx, qword [rsi + 0x18]
mov rcx, r9
movzx eax, word [rdx]
add rdx, 2
mov word [rcx], ax
add rcx, 2
cmp ax, r12w
jne 0x1000021b8
xor eax, eax
add r8d, 4
mov rdi, r9
mov rcx, r13
lea rdx, [r9 + r8*2 + 2]
repne scasw ax, word [rdi]
mov rax, qword [0x100001400]
mov qword [rdi - 2], rax
movzx eax, word [0x100001408]
mov word [rdi + 6], ax
mov word [r9 + r8*2], r12w
mov rsi, qword [rsi + 0x28]
cmp rsi, r12
jne 0x100002175
mov word [rdx], r12w
lea rdx, [0x100001410]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x68]
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov edx, 0xf003f
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], 0x30
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x50], 0x40
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov edi, eax
cmp eax, r12d
je 0x10000227d
mov rcx, qword [0x100004690]
cmp rcx, r12
je 0x100002279
mov r8, rbx
xor edx, edx
call sub.ntdll.dll_RtlFreeHeap
mov eax, edi
jmp 0x1000022db
lea rdx, [0x100001498]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x78]
mov r9d, 7
xor r8d, r8d
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [0x100004690]
mov edi, eax
cmp eax, r12d
jne 0x10000226a
cmp rcx, r12
je 0x1000022ce
mov r8, rbx
xor edx, edx
call sub.ntdll.dll_RtlFreeHeap
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.100002c40
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1000025fc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10a0
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x100004100]
xor rax, rsp
mov qword [rsp + 0x1090], rax
xor ebx, ebx
lea rdx, [0x100001590]
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x38], ebx
mov ebp, ebx
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x80]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x30]
mov edx, 0xf003f
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x40
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
call qword [sym.imp.ntdll.dll_NtOpenKey]
cmp eax, ebx
je 0x1000026a3
lea rcx, [0x100001618]
mov edx, eax
call fcn.1000017b8
or eax, 0xffffffff
jmp 0x100002852
lea rdx, [0x100001650]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
lea r9, [rsp + 0x90]
lea rdx, [rsp + 0x40]
mov r8d, 2
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
cmp eax, ebx
je 0x100002701
lea rcx, [0x100001668]
mov edx, eax
call fcn.1000017b8
mov ebx, 0xfffffffe
jmp 0x100002845
mov edx, dword [rsp + 0x94]
cmp edx, 7
je 0x100002723
lea rcx, [0x100001690]
call fcn.1000017b8
mov ebx, 0xfffffffd
jmp 0x100002845
lea rsi, [rsp + 0x9c]
lea r9, [0x1000016a8]
cmp word [rsi], bx
je 0x100002845
mov rdi, rsi
mov r8d, 8
mov rdx, r9
sub rdi, r9
movzx ecx, word [rdi + rdx]
cmp cx, 0x5a
ja 0x10000275e
cmp cx, 0x41
jb 0x10000275e
add cx, 0x20
movzx eax, word [rdx]
cmp ax, 0x5a
ja 0x100002771
cmp ax, 0x41
jb 0x100002771
add ax, 0x20
add rdx, 2
add r8d, 0xffffffff
je 0x100002785
cmp cx, bx
je 0x100002785
cmp cx, ax
je 0x10000274a
movzx eax, ax
movzx ecx, cx
mov rdi, rsi
sub ecx, eax
je 0x1000027b6
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
mov eax, ecx
lea ebp, [rbp + rcx + 1]
lea rsi, [rsi + rax*2 + 2]
cmp rsi, rbx
jne 0x100002732
jmp 0x100002845
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
movsxd rax, ecx
lea rdx, [rsi + rax*2 + 2]
cmp word [rdx], bx
jne 0x1000027df
mov word [rsi], bx
mov word [rsi + 2], bx
lea eax, [rbp + rbp]
jmp 0x100002807
mov edi, dword [rsp + 0x98]
shr edi, 1
sub edi, ecx
mov rcx, rsi
sub edi, ebp
mov r8d, edi
add r8, r8
call sub.ntdll.dll_memmove
lea edx, [rdi + 1]
lea eax, [rbp + rdi]
mov word [rsi + rdx*2], bx
add eax, eax
mov r9d, dword [rsp + 0x94]
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x9c]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
cmp eax, ebx
je 0x100002845
lea rcx, [0x1000016c0]
mov edx, eax
call fcn.1000017b8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rcx, qword [rsp + 0x1090]
xor rcx, rsp
call fcn.100002c40
lea r11, [rsp + 0x10a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100002884
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rdi
sub rsp, 0xb0
lea rdx, [0x1000016e0]
lea rcx, [rax - 0x48]
xor edi, edi
mov byte [rax + 8], dil
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
lea ecx, [rdi + 0x40]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x98], ecx
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0xd0]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x80]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov ebx, eax
cmp eax, edi
je 0x10000294d
lea rcx, [0x100001718]
call fcn.1000017b8
jmp 0x100002abe
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0xc8], edi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xcc], edi
mov byte [rsp + 0xc0], 0x10
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov ebx, eax
cmp eax, edi
je 0x1000029bb
cmp eax, 0x103
jne 0x100002ab0
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0xc8], 0xa
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xcc], edi
mov byte [rsp + 0xc0], 1
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov ebx, eax
cmp eax, edi
je 0x100002a2d
cmp eax, 0x103
jne 0x100002ab0
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0xc8], 0xb
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xcc], edi
mov byte [rsp + 0xc0], 1
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov ebx, eax
cmp eax, edi
je 0x100002a9b
cmp eax, 0x103
jne 0x100002ab0
mov rcx, qword [rsp + 0xd0]
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtFlushBuffersFile]
mov ebx, edi
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0xd8]
add rsp, 0xb0
pop rdi
ret