joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438e00
Capabilities:
Accept command line arguments

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rsi, str._script
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x2c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
movsxd rax, dword [rsp + 0x2c]
cmp rax, 1
ja 0x438e5b
jmp 0x438e90
mov rdx, rsi
call sub.SHELL32.dll_StrStrIW
test rax, rax
jne 0x438e7a
movsxd rax, dword [rsp + 0x2c]
add rbx, 1
cmp rax, rbx
jbe 0x438e90
mov rcx, qword [rdi + rbx*8]
cmp word [rcx], 0x2f
jne 0x438e40
mov eax, 0x2d
mov rdx, rsi
mov word [rcx], ax
call sub.SHELL32.dll_StrStrIW
test rax, rax
je 0x438e4d
mov eax, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
Function at 0x43db70
Capabilities:
Query environment variable

Disassembly:
push r13
mov eax, 0x2028
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0067cdd0
sub rsp, rax
lea rbp, [0x00803758]
lea r13, [0x00803ec2]
lea rsi, [rsp + 0x20]
mov r12, r8
xor r8d, r8d
mov rcx, rdx
mov word [r12], r8w
mov rdx, rsi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, qword [0x00826910]
mov r8, rsi
lea rdx, str.Opening__S_n
call fcn.0041e020
lea rdx, [0x00803ea6]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wfopen]
test rax, rax
mov rdi, rax
je 0x43dcbf
nop word [rax + rax]
mov r8, rdi
mov edx, 0x1000
mov rcx, rsi
call sub.msvcrt.dll_fgetws
test rax, rax
je 0x43dc91
mov rbx, rsi
jmp 0x43dc14
add rbx, 2
movzx ecx, word [rbx]
call sub.msvcrt.dll_iswspace
test eax, eax
jne 0x43dc10
mov rdx, rbx
mov rcx, rsi
call fcn.0068bb48
movzx eax, word [rsp + 0x20]
cmp ax, 0x3b
je 0x43dbf0
cmp ax, 0x23
je 0x43dbf0
cmp ax, 0x2f
je 0x43dc85
mov rdx, rbp
mov rcx, rsi
call sub.msvcrt.dll_wcsstr
test rax, rax
jne 0x43dbf0
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp word [rsp + rax*2 + 0x1e], 0xa
je 0x43dcae
cmp word [rsp + 0x20], 0
je 0x43dbf0
mov rdx, rsi
mov rcx, r12
call fcn.0068bb68
mov rdx, r13
mov rcx, rax
call fcn.0068bb68
jmp 0x43dbf0
mov ecx, 0x2d
mov word [rsp + 0x20], cx
jmp 0x43dc42
mov rcx, rdi
call sub.msvcrt.dll_fclose
mov eax, 1
add rsp, 0x2028
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rsi
call sub.msvcrt.dll_wcslen
xor edx, edx
mov word [rsp + rax*2 + 0x1e], dx
jmp 0x43dc62
mov rcx, qword [0x00826910]
mov r8, rsi
lea rdx, str.Failed_to_open__S_n
call fcn.0041db00
xor eax, eax
jmp 0x43dc9e

Function at 0x43dd30
Capabilities:
Accept command line arguments

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rdi, str._cfg:
mov esi, 2
mov r13, rcx
mov rbx, rdx
lea rcx, str._cfg:
call sub.msvcrt.dll_wcslen
lea rdx, [rsp + 0x2c]
mov rcx, rbx
mov r12, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
add r12, r12
cmp dword [rsp + 0x2c], 1
mov rbp, rax
jg 0x43ddac
jmp 0x43ddc1
mov rdx, rdi
mov rcx, rbx
call sub.SHELL32.dll_StrStrIW
test rax, rax
je 0x43dda0
lea rdx, [rbx + r12]
mov rcx, r13
call fcn.0043dce0
test al, al
jne 0x43ddd0
mov eax, esi
add rsi, 1
cmp dword [rsp + 0x2c], eax
jle 0x43ddc1
mov rbx, qword [rbp + rsi*8 - 8]
cmp word [rbx], 0x2f
jne 0x43dd80
mov eax, 0x2d
mov word [rbx], ax
jmp 0x43dd80
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
or dword [r13 + 0x1c000], 0x8000
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x43e680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, r8
movzx edx, cx
mov r8d, 0x64
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov rbx, rax
je 0x43e6d0
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
xor ecx, ecx
mov eax, eax
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsi], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov qword [rdi], 0
mov qword [rsi], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x43e750
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x28
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x43e770
Capabilities:
Enumerate files on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x3a0
lea rcx, [rsp + 0x20]
mov r8, rdx
mov qword [rsp + 0x28], 0
lea rax, [rcx + 0x22]
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x30], rax
lea rax, [0x00840bc0]
mov qword [rsp + 0x20], rax
xor eax, eax
lea rdx, [0x00804054]
mov word [rsp + 0x42], ax
mov qword [rsp + 0x38], pe_nt_image_headers64
call fcn.00403810
lea rsi, [rsp + 0x150]
mov rcx, qword [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x43e844
mov rdi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x43e7fc
mov rdx, rsi
mov rcx, rbx
call rdi
test eax, eax
je 0x43e840
test byte [rsp + 0x150], 0x10
jne 0x43e7f0
mov esi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x28]
lea rax, [0x008407e0]
mov qword [rsp + 0x20], rax
test rcx, rcx
je 0x43e82f
call fcn.007da030
mov eax, esi
add rsp, 0x3a0
pop rbx
pop rsi
pop rdi
ret
xor esi, esi
jmp 0x43e80b
xor esi, esi
jmp 0x43e814

Function at 0x43e870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43e890
shr eax, 4
and eax, 1
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test al, 0x7f
sete al
add rsp, 0x28
ret

Function at 0x43e8a0
Capabilities:
Enumerate files on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x278
xor esi, esi
lea rbp, [rsp + 0x20]
mov rcx, rdx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x43e910
mov r13, qword [sym.imp.KERNEL32.dll_FindNextFileW]
movabs r12, 0xffffffff00000000
nop dword [rax]
mov eax, dword [rsp + 0x3c]
mov ebx, ebx
mov rdx, rbp
mov rcx, rdi
shl rax, 0x20
or rbx, rax
mov eax, dword [rsp + 0x40]
and rbx, r12
or rbx, rax
call r13
add rsi, rbx
test eax, eax
jne 0x43e8e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, rsi
add rsp, 0x278
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x43f100
Capabilities:
Query environment variable

Disassembly:
push rdi
mov eax, 0x2030
push rsi
push rbx
call fcn.0067cdd0
sub rsp, rax
xor edx, edx
lea rdi, [rsp + 0x30]
mov rbx, rcx
mov rax, r8
mov word [rsp + 0x30], dx
mov r8d, 0x1000
mov rdx, rdi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rbx + 0x10]
mov rcx, rdi
mov qword [rbx], rax
call sub.msvcrt.dll_wcslen
lea rsi, [rax + rax]
mov rdx, rsi
sar rdx, 1
cmp rdx, 7
mov qword [rsp + 0x28], rdx
ja 0x43f180
cmp rdx, 1
mov rcx, qword [rbx]
je 0x43f1b4
test rdx, rdx
jne 0x43f19f
xor eax, eax
mov qword [rbx + 8], rdx
mov word [rcx + rdx*2], ax
mov rax, rbx
add rsp, 0x2030
pop rbx
pop rsi
pop rdi
ret
lea rdx, [rsp + 0x28]
mov rcx, rbx
xor r8d, r8d
call fcn.0079f8b0
mov rcx, rax
mov qword [rbx], rax
mov rax, qword [rsp + 0x28]
mov qword [rbx + 0x10], rax
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rbx]
jmp 0x43f166
movzx eax, word [rsp + 0x30]
mov word [rcx], ax
jmp 0x43f166

Function at 0x43f1c0
Capabilities:
Get disk information

Disassembly:
push rsi
push rbx
sub rsp, 0x68
lea rsi, [rsp + 0x50]
mov rbx, rdx
lea rdx, [0x008040b2]
mov rcx, rsi
call fcn.0068bb48
test rbx, rbx
je 0x43f1f7
mov rcx, rbx
call sub.msvcrt.dll_wcslen
cmp rax, 1
jbe 0x43f1f7
cmp word [rbx + 2], 0x3a
je 0x43f250
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x4c]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x43f2d3
mov eax, dword [rsp + 0x4c]
shr eax, 0x13
xor eax, 1
and eax, 1
add rsp, 0x68
pop rbx
pop rsi
ret
movzx eax, word [rbx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x38], 0
mov rcx, rsi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
mov word [rsp + 0x50], ax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x43f233
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x00826910]
lea rdx, str.Error:_canWrite_:_GetVolumeInformation_1__failed_with_error__d_n
mov esi, eax
mov r8d, eax
call fcn.0041db00
cmp esi, 3
jne 0x43f233
mov rcx, qword [0x00826910]
mov r8, rbx
lea rdx, str.Error:_Path_not_found:__S_n
call fcn.0041db00
jmp 0x43f233
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x00826910]
lea rdx, str.Error:_canWrite_:_GetVolumeInformation_2__failed_with_error__d_n
mov esi, eax
mov r8d, eax
call fcn.0041db00
cmp esi, 3
jne 0x43f233
jmp 0x43f2b8
Function at 0x43f300
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r13
mov eax, 0x2028
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0067cdd0
sub rsp, rax
cmp word [rcx + 2], 0x3a
mov rbx, rcx
je 0x43f410
lea rcx, [0x008db680]
mov rdx, rbx
call fcn.0043f1c0
test eax, eax
jne 0x43f360
mov rcx, qword [0x00826910]
mov r8, rbx
lea rdx, str.ERROR_in_mkdir_r__:_Path_not_found_or_write_protected__S_n
call fcn.0041db00
nop
add rsp, 0x2028
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43f481
test al, 0x10
jne 0x43f34d
lea rsi, [rsp + 0x20]
mov rdx, rbx
lea r13, str.ERROR_in_mkdir_r__:_failed__wmkdir__S__d__n
mov rcx, rsi
call fcn.0068bb48
mov rcx, rsi
mov rdi, qword [sym.imp.msvcrt.dll__wmkdir]
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov r12, qword [0x00826910]
jmp 0x43f3bc
lea rcx, [rbx + 2]
mov eax, 0x5c
mov word [rbx], ax
mov edx, 0x5c
call sub.msvcrt.dll_wcschr
test rax, rax
mov rbx, rax
je 0x43f430
xor edx, edx
mov rcx, rsi
mov word [rax], dx
call rdi
test eax, eax
jns 0x43f3b0
call rbp
cmp dword [rax], 0x11
je 0x43f3b0
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
jbe 0x43f3b0
call rbp
mov r8, rsi
mov rdx, r13
mov rcx, r12
mov r9d, dword [rax]
call fcn.0041db00
jmp 0x43f3b0
cmp word [rcx + 4], 0
jne 0x43f323
add rsp, 0x2028
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rsi
call rdi
test eax, eax
jns 0x43f34d
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x11
je 0x43f34d
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
jbe 0x43f34d
call rbx
mov rcx, qword [0x00826910]
mov r8, rsi
mov r9d, dword [rax]
lea rdx, str.ERROR_in_mkdir_r__:_failed__wmkdir__S__d__n
call fcn.0041db00
jmp 0x43f34d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test al, 0x7f
je 0x43f34d
jmp 0x43f376

Function at 0x43f4d0
Capabilities:
Create process on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb0
xor eax, eax
mov ecx, 0xe
mov ebx, dword [rsp + 0x100]
lea rbp, [rsp + 0x40]
mov rsi, rdx
mov r12, r8
mov rdi, rbp
rep stosq qword [rdi], rax
mov rcx, qword [0x00826910]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov dword [rsp + 0x70], r9d
mov dword [rsp + 0x20], r9d
mov r9, r8
mov r8, rdx
mov dword [rsp + 0x28], ebx
lea rdx, str.Run__S__S__d__d__n
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x40
call fcn.0041e020
lea rdx, [0x008041de]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x43f5b4
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov r8, r12
xor ecx, ecx
mov qword [rsp + 0x20], 0
lea rdx, [0x008041de]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
test ebx, ebx
je 0x43f5a4
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x3c]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, dword [rsp + 0x3c]
mov eax, ebx
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbp
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x43f576
Function at 0x43f8c0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
lea rcx, str.kernel32
mov rsi, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x38], 0
mov r12, rdx
call rsi
lea rdx, str.Wow64DisableWow64FsRedirection
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rbx
lea rcx, str.kernel32
mov rdi, rax
call rsi
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rax
call rbx
test rdi, rdi
setne bpl
test rax, rax
mov r13, rax
setne al
xor r14d, r14d
and bpl, al
jne 0x43fae3
lea rbx, [rsp + 0x60]
lea rax, [rbx + 0x10]
lea rcx, str._windir_System32control.exe
mov qword [rsp + 0x60], rax
call sub.msvcrt.dll_wcslen
lea rdi, [rax + rax]
mov rdx, rdi
sar rdx, 1
cmp rdx, 7
mov r8, rdx
mov qword [rsp + 0x40], rdx
ja 0x43faa0
cmp rdx, 1
mov rcx, qword [rsp + 0x60]
je 0x43faf5
lea rsi, [rsp + 0x40]
test rdx, rdx
jne 0x43fac5
mov qword [rsp + 0x68], r8
lea rdx, [0x008db680]
xor eax, eax
mov word [rcx + r8*2], ax
mov r8, rbx
mov rcx, rsi
call fcn.0043f100
mov rcx, qword [rsp + 0x60]
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x43f9ba
call fcn.007da050
mov ecx, 0xe
xor eax, eax
mov rdi, rbx
mov r15, qword [rsp + 0x40]
rep stosq qword [rdi], rax
mov rcx, qword [0x00826910]
mov r9, r12
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
lea rdx, str.Run__S__S__d__d__n
mov dword [rsp + 0x60], 0x70
mov r8, r15
mov dword [rsp + 0x64], 0x40
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x80], r12
mov dword [rsp + 0x90], 1
call fcn.0041e020
lea rdx, [0x008041de]
mov rcx, r15
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x43fa90
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov r8, r12
xor ecx, ecx
mov qword [rsp + 0x20], 0
lea rdx, [0x008041de]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
test r14b, r14b
je 0x43fa68
test bpl, bpl
je 0x43fa68
mov rcx, qword [rsp + 0x38]
call r13
mov rcx, qword [rsp + 0x40]
add rsi, 0x10
cmp rcx, rsi
je 0x43fa7c
call fcn.007da050
nop
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x43fa56
lea rsi, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
mov rdx, rsi
call fcn.0079f8b0
mov rcx, rax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
lea rdx, str._windir_System32control.exe
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
jmp 0x43f989
lea rcx, [rsp + 0x38]
call rdi
test eax, eax
setne r14b
jmp 0x43f936
movzx eax, word [str._windir_System32control.exe]
lea rsi, [rsp + 0x40]
mov word [rcx], ax
jmp 0x43f989
Function at 0x440fd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
xor ebx, ebx
lea r8, [rsp + 0x38]
mov rcx, rdx
lea rdx, [rsp + 0x34]
call fcn.004091d0
cmp dword [rsp + 0x34], 4
jg 0x441000
mov eax, ebx
add rsp, 0x50
pop rbx
ret
lea rax, [rsp + 0x48]
xor r8d, r8d
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4410a0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x44], 4
cmp eax, 5
je 0x4410e4
cmp eax, 0xb
mov ebx, 1
je 0x44108c
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
lea rdx, str.RPSessionInterval
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4410c3
cmp dword [rsp + 0x3c], 1
sete bl
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x50
pop rbx
ret
mov rcx, qword [0x00826910]
mov r8d, eax
mov ebx, 1
lea rdx, str.ERROR_in_SystemProtectionEnabled__:_error_in_RegOpenKeyEx__d_n
call fcn.0041db00
mov eax, ebx
add rsp, 0x50
pop rbx
ret
cmp eax, 2
je 0x4410e0
mov rcx, qword [0x00826910]
mov r8d, eax
lea rdx, str.ERROR_in_SystemProtectionEnabled__:_error_in_RegQueryValueEx__d_n
call fcn.0041db00
jmp 0x44108c
xor ebx, ebx
jmp 0x44108c
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
lea rdx, str.DisableSR
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x441124
mov eax, dword [rsp + 0x3c]
test eax, eax
sete bl
jmp 0x44108c
cmp eax, 2
je 0x4410e0
mov rcx, qword [0x00826910]
mov r8d, eax
mov ebx, 1
lea rdx, str.ERROR_in_SystemProtectionEnabled__:_error_in_RegQueryValueEx__d_n
call fcn.0041db00
jmp 0x44108c

Function at 0x441150
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
xor r8d, r8d
mov r9d, 0x20119
mov rcx, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4411e0
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
mov ebx, 0xffffffff
mov dword [rsp + 0x44], 4
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea rdx, str.SystemRestorePointCreationFrequency
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x48]
test eax, eax
cmove ebx, dword [rsp + 0x3c]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x50
pop rbx
ret
mov rcx, qword [0x00826910]
mov r8d, eax
mov ebx, 0xfffffffe
lea rdx, str.ERROR_in_GetRestorePointCreationFrequency__:_error_in_RegOpenKeyEx__d_n
call fcn.0041db00
jmp 0x4411d5
Function at 0x441200
Capabilities:
Delete registry value
Set registry value

Disassembly:
push rbx
sub rsp, 0x40
cmp edx, 0xfffffffe
mov ebx, edx
je 0x441279
lea rax, [rsp + 0x38]
xor r8d, r8d
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x441280
cmp ebx, 0xffffffff
mov dword [rsp + 0x34], ebx
je 0x4412a0
lea rax, [rsp + 0x34]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea rdx, str.SystemRestorePointCreationFrequency
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rsp, 0x40
pop rbx
ret
mov rcx, qword [0x00826910]
mov r8d, eax
lea rdx, str.ERROR_in_SetRestorePointCreationFrequency__:_error_in_RegOpenKeyEx__d_n
call fcn.0041db00
nop
add rsp, 0x40
pop rbx
ret
lea rdx, str.SystemRestorePointCreationFrequency
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x44126d
Function at 0x444fa0
Capabilities:
Delete file

Disassembly:
push rsi
push rbx
sub rsp, 0x288
lea rbx, [0x00840bc0]
xor r9d, r9d
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x40], 0
lea rax, [rcx + 0x22]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], pe_nt_image_headers64
mov word [rsp + 0x42], r9w
call fcn.00403b60
mov rdx, qword [rsp + 0x30]
movzx eax, word [rdx]
test ax, ax
je 0x445110
mov rcx, rdx
jmp 0x445011
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
je 0x445110
cmp ax, 0x5f
jne 0x445000
movzx r8d, word [rcx + 2]
mov eax, r8d
sub r8d, 0x30
cmp r8d, 9
ja 0x445004
mov rax, qword [0x00828c70]
xor r8d, r8d
mov word [rcx], r8w
mov rax, qword [rax]
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x30]
test rax, rax
je 0x445136
mov r8, qword [0x00826960]
mov r9, rax
mov qword [rsp + 0x158], 0
lea rcx, [rsp + 0x150]
mov byte [rsp + 0x170], 0
lea rdx, [rcx + 0x22]
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x160], rdx
xor edx, edx
mov word [rsp + 0x172], dx
add r8, 0x6000
lea rdx, [0x0080e1e0]
mov qword [rsp + 0x168], pe_nt_image_headers64
call fcn.00403810
mov r8, qword [rsp + 0x160]
lea rdx, str.Old_file:__S_n
mov rcx, qword [0x00826910]
call fcn.0041e020
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.msvcrt.dll__wremove]
mov rcx, qword [rsp + 0x158]
lea rbx, [0x008407e0]
mov qword [rsp + 0x150], rbx
test rcx, rcx
je 0x4450fa
call fcn.007da030
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x20], rbx
test rcx, rcx
jne 0x445126
jmp 0x44512c
mov rcx, qword [rsp + 0x28]
lea rax, [0x008407e0]
mov qword [rsp + 0x20], rax
test rcx, rcx
je 0x44512c
call fcn.007da030
nop
add rsp, 0x288
pop rbx
pop rsi
ret
lea rbx, [0x008407e0]
jmp 0x4450fa
Function at 0x45ad50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
call fcn.00473c70
call fcn.00473d10
call fcn.00473cc0
call fcn.00474040
call fcn.004740b0
call fcn.00474150
call fcn.00474100
nop
add rsp, 0x28
jmp 0x45ad50
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x30], xmm7
lea r8, [0x008e0060]
pxor xmm2, xmm2
movdqa xmm5, xmmword [0x0080ef00]
movdqa xmm6, xmmword [0x0080ef10]
mov rdx, r8
mov rax, r8
movdqa xmm4, xmmword [0x0080ef20]
lea rcx, [0x008e0460]
movdqa xmm3, xmmword [0x0080ef30]
nop word [rax + rax]
movdqa xmm0, xmm5
movdqa xmm1, xmm2
movdqa xmm7, xmm2
pand xmm0, xmm4
psubd xmm1, xmm0
add rax, 0x10
movdqa xmm0, xmm1
movdqa xmm1, xmm5
paddd xmm5, xmm6
psrld xmm1, 1
pand xmm0, xmm3
pxor xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm0, 1
pand xmm1, xmm4
psubd xmm7, xmm1
movdqa xmm1, xmm7
movdqa xmm7, xmm2
pand xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm1, 1
pand xmm0, xmm4
psubd xmm7, xmm0
movdqa xmm0, xmm7
movdqa xmm7, xmm2
pand xmm0, xmm3
pxor xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm0, 1
pand xmm1, xmm4
psubd xmm7, xmm1
movdqa xmm1, xmm7
movdqa xmm7, xmm2
pand xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm1, 1
pand xmm0, xmm4
psubd xmm7, xmm0
movdqa xmm0, xmm7
movdqa xmm7, xmm2
pand xmm0, xmm3
pxor xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm0, 1
pand xmm1, xmm4
psubd xmm7, xmm1
movdqa xmm1, xmm7
movdqa xmm7, xmm2
pand xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm1, 1
pand xmm0, xmm4
psubd xmm7, xmm0
movdqa xmm0, xmm7
movdqa xmm7, xmm2
pand xmm0, xmm3
pxor xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm0, 1
pand xmm1, xmm4
psubd xmm7, xmm1
movdqa xmm1, xmm7
pand xmm1, xmm3
pxor xmm0, xmm1
movaps xmmword [rax - 0x10], xmm0
cmp rax, rcx
jne 0x45ada0
lea r9, [0x008e1c60]
nop dword [rax + rax]
mov eax, dword [rdx]
add rdx, 4
movzx ecx, al
shr eax, 8
xor eax, dword [r8 + rcx*4]
mov dword [rdx + 0x3fc], eax
cmp r9, rdx
jne 0x45aed0
mov rax, qword [0x00826610]
mov rbx, qword [0x00826620]
mov qword [0x008e2060], rax
mov qword [0x008e0040], rax
mov qword [0x008e2068], rbx
call fcn.0045dd20
test eax, eax
jne 0x45af1e
mov qword [0x008e0040], rbx
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret