joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400026f0
Capabilities:
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x2c0
mov rax, qword [0x14004f678]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov r14, rdx
mov edx, ecx
mov ecx, r8d
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14000272d
xor eax, eax
jmp 0x1400028ae
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], rbp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x68], 1
mov ecx, 0x20
call fcn.140015184
mov rbx, rax
mov qword [rsp + 0x28], rax
xor esi, esi
test rax, rax
je 0x140002793
mov rax, qword [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov dword [rbx + 8], 1
mov dword [rbx + 0xc], 1
lea rcx, vtable.std::_Ref_count_resource_void____ptr64__int____cdecl___void____ptr64__.0
mov qword [rbx], rcx
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rbp
jmp 0x140002796
mov rbx, rsi
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x70], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x74]
call fcn.1400171d0
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [0x14004f608]
test eax, eax
je 0x14000287b
mov rdi, qword [r14]
mov rdx, qword [rdi]
lea rcx, [rsp + 0x9c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x140002858
mov eax, dword [rdi + 8]
cmp dword [rsp + 0x78], eax
je 0x140002858
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, dword [rsp + 0x78]
cmp r8d, eax
je 0x140002858
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x1400028e9
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14000284e
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400028cc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [0x14004f610]
test eax, eax
jne 0x1400027d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
sete sil
test rbx, rbx
je 0x1400028ac
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400028ac
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400028ac
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 8]
mov eax, esi
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400153e0
add rsp, 0x2c0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov dword [rsp + 0x20], eax
lea rdx, [0x14003b110]
lea rcx, [rsp + 0x20]
call fcn.14001603c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rdx, [0x14003b110]
lea rcx, [rsp + 0x28]
call fcn.14001603c
int3
Function at 0x140003120
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1050
call fcn.140015370
sub rsp, rax
mov rax, qword [0x14004f678]
xor rax, rsp
mov qword [rsp + 0x1040], rax
movaps xmm0, xmmword [str.SOFTWAREMicrosoftWindows_NTCurrentVersionPrintPrinters_]
lea rcx, [rsp + 0xba]
movaps xmm1, xmmword [0x14002c750]
mov rdi, r8
movzx eax, word [0x14002c7b8]
mov rbx, rdx
movaps xmmword [rsp + 0x40], xmm0
xor edx, edx
movaps xmm0, xmmword [0x14002c760]
mov r8d, 0xf86
movaps xmmword [rsp + 0x50], xmm1
mov esi, r9d
movaps xmm1, xmmword [0x14002c770]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x14002c780]
movaps xmmword [rsp + 0x70], xmm1
movaps xmm1, xmmword [0x14002c790]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [0x14002c7a0]
movaps xmmword [rsp + 0x90], xmm1
movsd xmm1, qword [0x14002c7b0]
movaps xmmword [rsp + 0xa0], xmm0
movsd qword [rsp + 0xb0], xmm1
mov word [rsp + 0xb8], ax
call fcn.1400171d0
mov r8, rbx
lea rcx, [rsp + 0x40]
mov edx, 0x800
call fcn.140007ae0
test eax, eax
jns 0x140003202
mov eax, 0xe
jmp 0x140003281
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov r9d, 2
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003281
mov rcx, qword [rsp + 0x30]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], esi
lea rdx, str.SpoolDirectory
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete cl
test eax, eax
je 0x14000327f
nop dword [rax]
test cl, cl
je 0x140003270
xor eax, eax
movabs dword [0], eax
mov eax, ebx
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400153e0
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140003440
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14004f678]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], 0xffffffffdc3cba00
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov rdi, rax
test rax, rax
jne 0x14000348a
xor ebx, ebx
jmp 0x14000358d
xor edx, edx
xor ecx, ecx
mov r8d, 0x20000000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
jne 0x1400034a9
xor ebx, ebx
jmp 0x14000357e
mov r8d, 0x34
lea rdx, str.Spooler
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
xor ebx, ebx
test rax, rax
je 0x14000356f
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400034f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x14000356f
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
setne cl
test eax, eax
jne 0x140003520
test cl, cl
je 0x140003516
mov dword [rbx], ebx
nop dword [rax]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
setne cl
test eax, eax
jne 0x14000353d
test cl, cl
je 0x140003537
mov dword [rbx], ebx
cmp dword [rsp + 0x3c], 4
je 0x14000356a
mov edx, 0x1f4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140003520
cmp dword [rsp + 0x3c], 4
je 0x14000356a
mov ecx, 0x5b4
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000356f
mov ebx, 1
test rsi, rsi
je 0x14000357e
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test rbp, rbp
je 0x14000358d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test rdi, rdi
je 0x14000359c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400153e0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140004d60
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x4d0
mov rax, qword [0x14004f678]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
mov rbx, rcx
call fcn.1400052f0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140001360
mov rax, qword [rsp + 0x70]
test rax, rax
jne 0x140004db6
xor ebx, ebx
jmp 0x140004e9d
lea rdx, [rsp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathIsSameRootW]
lea rbp, [rsp + 0xa0]
test eax, eax
cmove rbp, qword [rsp + 0x70]
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x80], rax
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x88], rax
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x90], rax
xor ebx, ebx
lea rdi, [rsp + 0x80]
nop word [rax + rax]
mov rsi, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140004e86
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
movzx eax, bx
add r8d, eax
lea r9, [rsp + 0x2b0]
lea rdx, str._KVP
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x140004e86
mov r8d, 9
lea rdx, [rsp + 0x2b0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
inc bx
add rdi, 8
cmp bx, 3
jb 0x140004e20
mov ebx, 1
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x140004ebc
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140004f03
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140004ed8
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov eax, ebx
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.1400153e0
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140014ea8
nop
int3
Function at 0x1400051a0
Capabilities:
Get common file path
Get system information on windows

Disassembly:
push rbx
sub rsp, 0xc0
mov rax, qword [0x14004f678]
xor rax, rsp
mov qword [rsp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov edx, 8
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140001360
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x14000526f
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ebx, eax
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x140005233
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x1400052de
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140005253
mov r8, qword [rcx]
lea rax, [rsp + 0x60]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
nop
mov rax, rbx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400153e0
add rsp, 0xc0
pop rbx
ret
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x103
ja 0x140005201
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x28]
cmp ax, 9
je 0x1400052aa
cmp ax, 6
lea rdx, str.spoolDRIVERSw32x86
jne 0x1400052b1
lea rdx, str.spoolDRIVERSx64
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140005201
mov rbx, qword [rsp + 0xa0]
xor eax, eax
mov qword [rsp + 0xa0], rax
jmp 0x14000520d
call fcn.140014ea8
nop
int3
Function at 0x140005980
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x278
mov rax, qword [0x14004f678]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.1400171d0
mov r8d, 0x30
lea rdx, [rsp + 0x20]
lea rcx, [fcn.140005980]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
ja 0x140005a26
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
ja 0x140005a26
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea rdx, [rsp + 0x50]
lea rcx, str.KvpinsRoot
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400153e0
add rsp, 0x278
ret
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400153e0
add rsp, 0x278
ret
Function at 0x140006f50
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x14004f678]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov esi, r8d
mov r14, rdx
mov ebp, ecx
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140006fb6
mov eax, 0x57
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400153e0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor r15d, r15d
mov ebx, r15d
lea rdi, [0x1400073f0]
lea rax, [0x140007820]
test esi, esi
cmovne rdi, rax
jne 0x140006fff
mov edx, 0x115c1
lea rcx, str.GIF89a
call fcn.140009e70
mov rbx, rax
test rax, rax
jne 0x140006fff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xffffffff
test eax, eax
cmovne ecx, eax
mov eax, ecx
jmp 0x140006f8f
test bpl, 1
je 0x14000700e
lea rax, [0x1400072b0]
jmp 0x140007020
test bpl, 2
mov rax, r15
lea rcx, [0x140007350]
cmovne rax, rcx
mov rcx, r15
mov qword [rsp + 0x98], rcx
test rax, rax
je 0x14000704e
lea rcx, [0x14002ce38]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x98], rcx
test rcx, rcx
je 0x140007135
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rdi
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
call qword [rax + 0x10]
mov rdi, rax
test rax, rax
jne 0x1400070c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xffffffff
test eax, eax
cmovne ebx, eax
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x1400070c0
mov r8, qword [rcx]
lea rax, [rsp + 0x60]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
mov eax, ebx
jmp 0x140006f8f
mov edx, 1
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rdi
call fcn.14000aec0
test eax, eax
setne cl
test eax, eax
jne 0x1400070ed
test cl, cl
je 0x1400070e6
mov dword [r15], r15d
mov dword [rsp + 0x30], 1
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x140007133
cmp dword [rsp + 0x30], 0x103
je 0x140007133
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
setne cl
test eax, eax
jne 0x14000712a
test cl, cl
je 0x140007123
mov dword [r15], r15d
mov ebx, dword [rsp + 0x30]
jmp 0x1400070a1
jmp 0x140007133
mov ecx, 0x80004005
call fcn.140003410
int3
Function at 0x140008c60
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rdx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
Function at 0x14000c1c0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
xor r8d, r8d
mov rdx, rbx
cmp r9w, 0xffff
mov rcx, rsi
movzx ebp, r9w
sete r8b
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rdi, qword [rsp + 0x50]
mov ecx, eax
neg ecx
sbb r9w, r9w
mov word [rdi], r9w
test eax, eax
jne 0x14000c24d
cmp bp, 0xffff
jne 0x14000c24d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x14000c227
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x14000c24d
mov rcx, rbx
call fcn.14000ecd0
test eax, eax
je 0x14000c24d
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb cx, cx
mov word [rdi], cx
cmp word [rdi], 0
jne 0x14000c26e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rbx
lea rcx, [0x14002d788]
mov r9d, eax
mov rdx, rsi
call fcn.140001910
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000c5c0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x14000c675
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x14000c641
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14000c659
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14000c659
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je case.default.0x14000c659
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x1400516a0], 0
jne 0x14000c6c0
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c6b0
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140051698], rax
mov byte [0x1400516a0], 1
jmp 0x14000c6c7
mov rax, qword [0x140051698]
mov byte [0x1400516a0], 1
jmp 0x14000c6c7
mov rax, qword [0x140051698]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x14000c64a
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x68
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm3
mov rdx, rax
lea rcx, [0x14003b548]
call fcn.1400131ec
movdqa xmm0, xmmword [rsp + 0x20]
movdqa xmm1, xmmword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
movdqa xmm3, xmmword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
add rsp, 0x68
jmp 0x140012d63
jmp rax
lea rax, sym.imp.ADVAPI32.dll_RegDeleteKeyW
jmp 0x140012cec
Function at 0x14000d740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x14004f678]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000d7c5
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000d7c5
call fcn.14000c040
mov ebx, eax
jmp 0x14000d8ea
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14000d7e6
call fcn.14000c040
jmp 0x14000d8d9
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14000d809
call fcn.14000c040
jmp 0x14000d8d9
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14000d82b
mov ebx, 0x8007000e
jmp 0x14000d8db
mov ecx, eax
test eax, eax
je 0x14000d860
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14000d922
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000d860
lea rcx, [rsp + 0x60]
call fcn.14000be90
jmp 0x14000d86a
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x14000d87d
cmp qword [rsp + 0x60], 0
jne 0x14000d88c
mov ebx, 0x8007000e
jmp 0x14000d8db
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14000d8b6
call fcn.14000c040
jmp 0x14000d8d9
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.14000d260
mov ebx, eax
test rdi, rdi
je 0x14000d8ea
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x14000d901
lea rcx, [rsp + 0x60]
call fcn.14000c6f0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400153e0
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140003410
int3
Function at 0x14000f0a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x90
movzx r14d, r9w
mov r15d, r8d
mov rbp, rdx
mov rsi, qword [rsp + 0xd0]
mov dword [rsi], 0xffffffff
mov rcx, rdx
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov ecx, eax
add rcx, 2
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
je 0x14000f256
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_VariantInit]
inc eax
mov ecx, eax
cmp rcx, 0x7fffffff
ja 0x14000f251
lea rdx, [0x14002c4ec]
test rbp, rbp
cmovne rdx, rbp
xor ebx, ebx
test eax, eax
jne 0x14000f12c
cmp word [rdx], bx
je 0x14000f177
jmp 0x14000f256
mov r8, rdi
mov r9d, 0x7ffffffe
sub r9, rcx
nop dword [rax + rax]
lea rax, [r9 + rcx]
test rax, rax
je 0x14000f163
movzx eax, word [rdx]
test ax, ax
je 0x14000f163
mov word [r8], ax
add r8, 2
add rdx, 2
sub rcx, 1
jne 0x14000f140
lea rax, [r8 - 2]
test rcx, rcx
cmovne rax, r8
mov word [rax], bx
je 0x14000f253
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
mov dword [rsp + 0x20], 0x70
mov dword [rsp + 0x24], 0x40
mov qword [rsp + 0x28], rbx
lea rax, str.Open
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdi
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], r15d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14000f25b
test r14w, r14w
je 0x14000f227
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, rsi
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000f21f
cmp dword [rsi], 0x103
jne 0x14000f229
mov dword [rsi], 0xffffffff
jmp 0x14000f229
mov dword [rsi], ebx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
setne cl
test eax, eax
jne 0x14000f25b
test cl, cl
je 0x14000f240
xor eax, eax
movabs dword [0], eax
jmp 0x14000f25b
xor ebx, ebx
mov word [rdi], bx
mov ebx, 0x8007000e
test rdi, rdi
je 0x14000f26a
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x14000f340
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x14004f678]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, r9
xor r9d, r9d
cmp r8w, 0xffff
mov r8d, edx
lea rdx, [rsp + 0x20]
sete r9b
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14000f38c
lea rcx, [rsp + 0x20]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400153e0
add rsp, 0x240
pop rbx
ret
Function at 0x14000f3e0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rdx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_HeapFree]

Function at 0x14000f8a0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, [rsp + 0x20]
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x20]
mov dword [rbx], eax
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x140011380
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x20
pop rbx
ret