joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009e9c8
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x18009ea2c
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x18009ea1a
mov r8, qword [rbx]
xor edx, edx
mov r8d, dword [r8 + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18009ea13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x18009e9e7
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x1800f47c8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18009ea3c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, ecx
mov esi, edx
imul rbx, rax, 0x38
add rbx, qword [0x1800fa590]
mov rdx, qword [rbx]
mov cl, byte [rbx + 0x20]
mov rbp, rdx
lea rdi, [rdx - 5]
and cl, 1
je 0x18009ea72
mov rbp, rdi
movzx eax, cl
lea r9, [rsp + 0x40]
test cl, cl
mov r8d, 0x40
cmove rdi, rdx
lea r14, [rax*2 + 5]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18009eaa8
mov eax, 0xa
jmp 0x18009eb37
test esi, esi
je 0x18009eaca
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18009eaeb
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18009eaeb
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x18009eae5
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18009eaeb
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, sil
shl sil, 2
add al, al
xor al, byte [rbx + 0x20]
and al, 2
xor al, byte [rbx + 0x20]
xor sil, al
and sil, 4
xor sil, al
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x18009ef74
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x18009ef8b
cmp r8b, 0x90
je 0x18009ef8b
cmp r8b, 0xcc
jne 0x18009efad
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x18009efa9
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x18009efad
add edx, r10d
cmp edx, r9d
jb 0x18009ef99
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x18009f314
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x18009f35e
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rbx, qword [0x1800fa588]
lea r12, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r12
cmovbe r12, qword [rbp - 0x50]
sub r12, 0xfff
xor esi, esi
jmp 0x18009f397
cmp rbx, r14
jb 0x18009f394
cmp rbx, r12
jae 0x18009f394
cmp qword [rbx + 8], rsi
jne 0x18009f4f9
mov rbx, qword [rbx]
test rbx, rbx
jne 0x18009f380
mov r15, rdi
cmp rdi, r14
jb 0x18009f4b3
mov r13d, dword [rbp - 0x38]
xor edx, edx
mov rax, r15
div r13
sub r15, rdx
jmp 0x18009f3e3
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18009f41d
cmp dword [rbp - 0x10], 0x10000
je 0x18009f3ed
mov r15, qword [rbp - 0x28]
cmp r15, r13
jb 0x18009f41d
sub r15, r13
cmp r15, r14
jae 0x18009f3b9
jmp 0x18009f41d
test r15, r15
je 0x18009f41d
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18009f4be
cmp r15, r14
jae 0x18009f3a8
test rbx, rbx
jmp 0x18009f4b1
mov r15d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov r14d, r15d
div r15
mov eax, r15d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r12
ja 0x18009f4f9
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18009f4f9
cmp dword [rbp - 0x10], 0x10000
je 0x18009f48c
xor edx, edx
lea edi, [r15 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div r14
sub rdi, rdx
cmp rdi, r12
jbe 0x18009f449
jmp 0x18009f4f9
test rdi, rdi
je 0x18009f4f9
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18009f4be
cmp rdi, r12
jbe 0x18009f425
jmp 0x18009f4f9
lea rcx, [rbx + 0x40]
mov dword [rbx + 0x10], esi
mov edx, 0x40
mov qword [rcx], rsi
mov rax, rcx
mov qword [rbx + 8], rcx
add rdx, 0x40
add rcx, 0x40
mov rsi, rax
cmp rdx, 0xfc0
jbe 0x18009f4ca
mov rax, qword [0x1800fa588]
mov qword [rbx], rax
mov qword [0x1800fa588], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x18009fc44
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18009fc7e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18009fc83
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18009fccc
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800b30a0]
cmp byte [rcx + rax], 0
je 0x18009fccc
dec r8
sub rdx, 1
jne 0x18009fcb2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140132dfa
Capabilities:
Hash data using fnv

Disassembly:
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
jmp 0x140132d31
je 0x140132e1a
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
jmp 0x140132e22
add byte [rax], al
add byte [rax], al
add byte [rcx - 0x75], al
enter 0xffffffffffff8d49, 0x14
mov dword [rdx - 0x75], eax
or al, 0x1a
mov ecx, r8d
lea rdx, [r9 + rcx*4]
mov ecx, dword [rdx + r11]
mov edx, 0x4f22e70e
jmp 0x140132cad
je 0x140132e41
inc r8d
jmp 0x140132dff
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140132d3a
cmp edx, 0xa029da11
jmp 0x140132e14
mov ecx, dword [r10 + r9 + 0x24]
xchg rbx, r13
je 0x140132e90
xor r9d, 0xfe3122a9
lea esi, [rdx + 0xeded]
or r11d, 0xb7cbde74
test r10d, 0xe02290e5
call fcn.1401324d3
lea ecx, [rdx + 0xb0b2]
inc r11
rol ebx, 0x4b
rol r10d, 0x47
movabs r10, 0x7d8eb6a461541aeb
xor ebp, 0x237e7ee6
rcl r12d, 0x27
jae 0x140132e87
jmp 0x140132eac
jmp rcx
mov ecx, dword [r10 + r9 + 0x1c]
add rcx, r9
mov r12d, dword [rcx + r8*4]
add r12, r9
nop word [rax + rax]
jmp 0x140132fb4
lea rax, [0x140000000]
nop
mov byte [rsp + rax + 0x63], r13b
inc rax
cmp rax, 0xa
jb 0x140132fb4
cmp dword [r14 + 0xc], r13d
je 0x1401339e8
je 0x140132fe4
jne 0x140132fe4
cmp r13d, 0xcc78ca03
test r10d, 0x31deeba2
movabs rbp, 0x2d8c1ffffff45e9
bswap r14
jmp 0x1401332c3
jmp 0x140132f2e
invalid
Function at 0x14000d2d0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov r15, rdx
mov r13, rcx
mov rax, qword [0x14012b050]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdx, qword [0x14012d378]
test rdx, rdx
jne 0x14000d3b9
cmp qword [0x14012d388], 0
je 0x14000d3b9
cmp byte [0x14012d398], 0
jne 0x14000d3a8
mov byte [0x14012d398], 1
lea rdx, [rsp + 0x50]
mov ecx, 0x106
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x14000d3a8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
lea rcx, str._sputty__lu__llu.chm
xor r14d, r14d
lea rdx, [rsp + 0x50]
mov r8d, eax
xor r9d, r9d
call fcn.140042890
mov rbx, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
mov rcx, rax
mov edx, 0x40000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14000d42c
mov rsi, rax
jmp 0x14000d4be
xor ebx, ebx
mov rcx, rbx
call fcn.140043590
mov rdx, qword [0x14012d378]
test rdx, rdx
je 0x14000d407
test r15, r15
je 0x14000d3f1
lea rcx, str._s::__s.html_main
mov r8, r15
call fcn.140042890
mov rsi, rax
mov rcx, r13
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
call qword [0x14012d370]
mov rcx, rsi
call fcn.140043590
jmp 0x14000d400
mov rcx, r13
xor r8d, r8d
xor r9d, r9d
call qword [0x14012d370]
mov byte [0x14012d390], 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call 0x1400ba9f0
nop
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x40], r13
mov edi, 1
lea r13, [rsp + 0x50]
mov r12, qword [sym.imp.KERNEL32.dll_CreateFileA]
nop word cs:[rax + rax]
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x14000d54f
mov rcx, rbx
call fcn.140043590
lea rcx, str._sputty__lu__llu.chm
mov rdx, r13
mov r8d, ebp
mov r9, rdi
call fcn.140042890
mov rbx, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
mov rcx, rax
mov edx, 0x40000000
mov r8d, 1
xor r9d, r9d
call r12
add rdi, 1
cmp rax, 0xffffffffffffffff
je 0x14000d450
mov rsi, rax
mov r13, qword [rsp + 0x40]
mov rbp, qword [0x14012d388]
lea r12, [rsp + 0x4c]
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFile]
nop word cs:[rax + rax]
nop dword [rax + rax]
mov r8d, dword [0x14012d394]
sub r8d, r14d
jbe 0x14000d51f
mov dword [rsp + 0x4c], 0
mov edx, r14d
add rdx, rbp
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov r9, r12
call rdi
add r14d, dword [rsp + 0x4c]
test eax, eax
jne 0x14000d4e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x14000d52f
mov qword [0x14012d378], rbx
mov byte [0x14012d380], 1
xor ebx, ebx
mov rcx, rbx
call fcn.140043590
cmp rsi, 0xffffffffffffffff
je 0x14000d3b2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000d3b2
mov r13, qword [rsp + 0x40]
jmp 0x14000d3aa
Function at 0x140030630
Capabilities:
Get memory capacity

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rax, qword [0x14012b050]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x78], rax
lea rsi, [rsp + 0x78]
mov ecx, 9
mov rdx, rsi
mov r8d, 8
call fcn.140030100
call qword [sym.imp.USER32.dll_GetCapture]
mov qword [rsp + 0x78], rax
mov ecx, 0xa
mov rdx, rsi
mov r8d, 8
call fcn.140030100
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov qword [rsp + 0x78], rax
mov ecx, 0xb
mov rdx, rsi
mov r8d, 8
call fcn.140030100
mov ecx, 0x1cbf
call qword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [rsp + 0x74], eax
lea rdx, [rsp + 0x74]
mov ecx, 0xc
mov r8d, 4
call fcn.140030100
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0xd
mov rdx, rsi
mov r8d, 8
call fcn.140030100
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, 6
mov rdx, rsi
mov r8d, 0x38
call fcn.140030100
lea rsi, [rsp + 0x98]
lea r14, [rsp + 0x90]
lea rdi, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x20], rsi
lea rbx, [rsp + 0x80]
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov ecx, 0xe
mov rdx, rbx
mov r8d, 0x20
call fcn.140030100
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov ecx, 0xf
mov rdx, rbx
mov r8d, 0x20
call fcn.140030100
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call 0x1400ba9f0
nop
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140036f60
Capabilities:
Get session user name

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov edx, 0x3a
call fcn.1400414f0
cmp byte [rax], 0
je 0x140036f84
mov rcx, rax
add rsp, 0x20
pop rsi
jmp fcn.14004a3a0
mov rcx, rsi
mov edx, 0x3b
call fcn.1400412a0
test al, al
je 0x140036f9f
add rsp, 0x20
pop rsi
jmp fcn.14007a3e0
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x14003c930
Capabilities:
Authenticate hmac

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r15, rcx
test dl, dl
je 0x14003c97e
call fcn.140043bc0
mov r14, rax
cmp byte [0x14012e5c0], 0
je 0x14003c9a5
mov rdi, r14
add rdi, 0x18
lea rdx, str.demo_server
mov rcx, rdi
call fcn.140042eb0
lea rdx, str.demo_server_2
mov rcx, rdi
call fcn.140042eb0
jmp 0x14003c9ff
mov rcx, qword [r15 + 0x10]
call fcn.140043590
mov rcx, qword [r15 + 8]
call fcn.140043590
xorps xmm0, xmm0
movups xmmword [r15 + 8], xmm0
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14003d0a0
test rax, rax
je 0x14003c9f1
mov rbx, rax
mov rcx, rax
mov rdx, r14
call fcn.14003d100
test al, al
je 0x14003c9e9
lea rdi, [r14 + 0x18]
nop word cs:[rax + rax]
nop
mov rcx, rdi
xor edx, edx
call fcn.140042ba0
mov rcx, rbx
mov rdx, r14
call fcn.14003d100
test al, al
jne 0x14003c9d0
mov rcx, rbx
call fcn.14003cc40
mov rcx, r14
add rcx, 0x18
xor edx, edx
call fcn.140042ba0
mov rcx, r14
call fcn.140043d00
mov qword [r15 + 0x10], rax
mov dword [r15], 1
mov ebp, 1
cmp byte [rax], 0
mov esi, 1
je 0x14003ca5e
mov rdi, rax
mov esi, 1
lea rbx, str.Default_Settings
mov rcx, rdi
mov rdx, rbx
call fcn.1400cfc60
test eax, eax
je 0x14003ca50
add esi, 1
mov dword [r15], esi
nop word cs:[rax + rax]
nop
cmp byte [rdi], 0
lea rdi, [rdi + 1]
jne 0x14003ca50
cmp byte [rdi], 0
jne 0x14003ca30
add esi, 1
movsxd rcx, esi
mov edx, 8
xor r8d, r8d
call fcn.1400434f0
mov qword [r15 + 8], rax
lea rcx, str.Default_Settings
mov qword [rax], rcx
mov rdi, qword [r15 + 0x10]
cmp byte [rdi], 0
je 0x14003cace
mov ebp, 1
lea rbx, str.Default_Settings
nop word cs:[rax + rax]
nop
mov rcx, rdi
mov rdx, rbx
call fcn.1400cfc60
test eax, eax
je 0x14003cac0
mov rax, qword [r15 + 8]
movsxd rcx, ebp
add ebp, 1
mov qword [rax + rcx*8], rdi
nop dword [rax]
cmp byte [rdi], 0
lea rdi, [rdi + 1]
jne 0x14003cac0
cmp byte [rdi], 0
jne 0x14003caa0
movsxd rdx, ebp
mov rcx, qword [r15 + 8]
lea r9, [0x14003cb00]
mov r8d, 8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp 0x1400cf3a0
invalid

Function at 0x14003cc30
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x14003cc3d
mov rcx, qword [rcx]
jmp fcn.1400466f0
ret

Function at 0x14003ccf0
Capabilities:
Query or enumerate registry value

Disassembly:
test rcx, rcx
je 0x14003ccfd
mov rcx, qword [rcx]
jmp fcn.140046750
xor eax, eax
ret
Function at 0x14003d020
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14012b050]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp dword [0x14012ee30], 6
jb 0x14002b052
jne 0x14002b007
cmp dword [0x14012ee34], 0
je 0x14002b052
call fcn.14003e010
test eax, eax
je 0x14002b065
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400f0000]
lea r9, [0x1400efff0]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x14002b052
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call 0x1400ba9f0
nop
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call 0x1400ba9f0
nop
add rsp, 0x38
jmp 0x14002ab90
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x20], 0
lea r9, str.SoftwareSimonTathamPuTTYSessions
xor ecx, ecx
mov dl, 1
mov r8, 0xffffffff80000001
call fcn.140046460
test rax, rax
je 0x14003d08f
mov rdi, rax
call fcn.140043bc0
mov rbx, rax
mov rcx, rsi
mov rdx, rax
call fcn.14007a5e0
mov rdx, qword [rbx]
mov rcx, rdi
call sub.ADVAPI32.dll_RegDeleteKeyA
mov rcx, rbx
call fcn.140043cc0
mov rcx, rdi
call sub.ADVAPI32.dll_RegCloseKey
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp 0x14002afe0
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003d920
Capabilities:
Delete registry key

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x20], 0
lea r9, str.SoftwareSimonTathamPuTTYSshHostCAs
xor ecx, ecx
mov dl, 1
mov r8, 0xffffffff80000001
call fcn.140046460
test rax, rax
je 0x14003d978
mov rdi, rax
call fcn.140043bc0
mov rbx, rax
mov rcx, rsi
mov rdx, rax
call fcn.14007a5e0
mov rdx, qword [rbx]
mov rcx, rdi
call sub.ADVAPI32.dll_RegDeleteKeyA
mov rcx, rbx
call fcn.140043cc0
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003d990
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x440
mov rsi, rcx
mov rax, qword [0x14012b050]
xor rax, rsp
mov qword [rsp + 0x438], rax
mov ecx, 1
call fcn.14003da70
cmp rax, 0xffffffffffffffff
je 0x14003da45
mov rdi, rax
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov rcx, rax
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003da3c
mov edx, dword [rsp + 0x2c]
test edx, edx
je 0x14003da3c
lea rbx, [rsp + 0x30]
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax]
mov rcx, rbx
call rsi
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x400
mov r9, r14
call r15
test eax, eax
je 0x14003da3c
mov edx, dword [rsp + 0x2c]
test edx, edx
jne 0x14003da10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x438]
xor rcx, rsp
call 0x1400ba9f0
nop
add rsp, 0x440
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14003da70
Capabilities:
Get common file path
Query environment variable

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
mov ebp, ecx
mov rax, qword [0x14012b050]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x20], 0
lea r9, str.SoftwareSimonTathamPuTTY
xor ecx, ecx
xor edx, edx
mov r8, 0xffffffff80000001
call fcn.140046460
test rax, rax
je 0x14003daf7
mov rbx, rax
lea rdx, str.RandSeedFile
mov rcx, rax
call fcn.140046750
mov rsi, rax
mov rcx, rbx
call sub.ADVAPI32.dll_RegCloseKey
test rsi, rsi
je 0x14003daf7
lea r8, [rsp + 0x28]
mov rcx, rsi
mov edx, ebp
call fcn.14003e210
mov ebx, eax
mov rcx, rsi
call fcn.140043590
test bl, bl
jne 0x14003dce9
cmp byte [0x14012e5d8], 0
je 0x14003db11
mov rsi, qword [0x14012e5e8]
test rsi, rsi
jne 0x14003db57
jmp 0x14003dc09
lea rcx, str.shell32.dll
call fcn.1400462c0
mov qword [0x14012e5e0], rax
test rax, rax
je 0x14003db3e
lea rdx, str.SHGetFolderPathA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
jmp 0x14003db40
xor esi, esi
mov qword [0x14012e5e8], rsi
mov byte [0x14012e5d8], 1
test rsi, rsi
je 0x14003dc09
lea rdi, [rsp + 0x140]
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x1c
xor r8d, r8d
xor r9d, r9d
call rsi
test eax, eax
js 0x14003dbb2
lea rdx, str.PUTTY.RND
lea rcx, [rsp + 0x140]
xor r8d, r8d
call fcn.140042610
mov rsi, rax
lea r8, [rsp + 0x28]
mov rcx, rax
mov edx, ebp
call fcn.14003e210
mov ebx, eax
mov rcx, rsi
call fcn.140043590
test bl, bl
jne 0x14003dce9
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x1a
xor r8d, r8d
xor r9d, r9d
call qword [0x14012e5e8]
test eax, eax
js 0x14003dc09
lea rdx, str.PUTTY.RND
lea rcx, [rsp + 0x140]
xor r8d, r8d
call fcn.140042610
mov rsi, rax
lea r8, [rsp + 0x28]
mov rcx, rax
mov edx, ebp
call fcn.14003e210
mov ebx, eax
mov rcx, rsi
call fcn.140043590
test bl, bl
jne 0x14003dce9
lea rcx, str.HOMEDRIVE
mov rdi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, [rsp + 0x140]
mov r8d, 0x104
call rdi
mov esi, eax
lea rcx, str.HOMEPATH
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call rdi
test esi, esi
jne 0x14003dc49
mov byte [rsp + 0x140], 0
cmp esi, 0x103
ja 0x14003dc98
cmp eax, 0x103
ja 0x14003dc98
test eax, eax
je 0x14003dc98
lea r8, str.PUTTY.RND
lea rcx, [rsp + 0x140]
lea rdx, [rsp + 0x30]
xor r9d, r9d
call fcn.140042610
mov rsi, rax
lea r8, [rsp + 0x28]
mov rcx, rax
mov edx, ebp
call fcn.14003e210
mov ebx, eax
mov rcx, rsi
call fcn.140043590
test bl, bl
jne 0x14003dce9
lea rcx, [rsp + 0x140]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, 0x104
jae 0x14003dcf0
lea rdx, str.PUTTY.RND
lea rcx, [rsp + 0x140]
xor r8d, r8d
call fcn.140042610
mov rsi, rax
lea r8, [rsp + 0x28]
mov rcx, rax
mov edx, ebp
call fcn.14003e210
mov ebx, eax
mov rcx, rsi
call fcn.140043590
test bl, bl
je 0x14003dcf0
mov rsi, qword [rsp + 0x28]
jmp 0x14003dcf7
mov rsi, 0xffffffffffffffff
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call 0x1400ba9f0
mov rax, rsi
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14003dd20
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
mov rdi, rcx
mov rax, qword [0x14012b050]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 2
call fcn.14003da70
cmp rax, 0xffffffffffffffff
je 0x14003dd74
mov rbx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rcx, rax
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call 0x1400ba9f0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003e090
Capabilities:
Delete registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x28
xor ecx, ecx
call fcn.14003da70
call fcn.14002aa80
mov qword [rsp + 0x20], 0
lea r9, str.SoftwareSimonTathamPuTTY
xor ecx, ecx
mov dl, 1
mov r8, 0xffffffff80000001
call fcn.140046460
test rax, rax
je 0x14003e0da
mov rsi, rax
mov rcx, rax
call fcn.14003e190
mov rcx, rsi
call sub.ADVAPI32.dll_RegCloseKey
mov qword [rsp + 0x20], 0
lea r9, str.SoftwareSimonTatham
xor ecx, ecx
mov dl, 1
mov r8, 0xffffffff80000001
call fcn.140046460
test rax, rax
je 0x14003e17e
mov rsi, rax
lea rdx, [0x14010eab3]
mov rcx, rax
call sub.ADVAPI32.dll_RegDeleteKeyA
mov rcx, rsi
xor edx, edx
call fcn.1400465c0
mov rdi, rax
mov rcx, rsi
call sub.ADVAPI32.dll_RegCloseKey
test rdi, rdi
je 0x14003e139
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140043590
mov qword [rsp + 0x20], 0
lea r9, str.Software
xor ecx, ecx
mov dl, 1
mov r8, 0xffffffff80000001
call fcn.140046460
test rax, rax
je 0x14003e17e
mov rsi, rax
lea rdx, [0x140109d88]
mov rcx, rax
call sub.ADVAPI32.dll_RegDeleteKeyA
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp sub.ADVAPI32.dll_RegCloseKey
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x14003e190
Capabilities:
Delete registry key

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
xor edx, edx
call fcn.1400465c0
test rax, rax
je 0x14003e207
mov rdi, rax
jmp 0x14003e1d5
mov rcx, rsi
mov rdx, rdi
call sub.ADVAPI32.dll_RegDeleteKeyA
mov rcx, rdi
call fcn.140043590
mov rcx, rsi
xor edx, edx
call fcn.1400465c0
mov rdi, rax
test rax, rax
je 0x14003e207
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov dl, 1
mov r8, rsi
mov r9, rdi
call fcn.140046460
test rax, rax
je 0x14003e1b0
mov rbx, rax
mov rcx, rax
call fcn.14003e190
mov rcx, rbx
call sub.ADVAPI32.dll_RegCloseKey
jmp 0x14003e1b0
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret