joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000fd50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140025040]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rdx + 0x18], 7
mov rbx, r8
mov rdi, rdx
mov dword [rsp + 0x38], 4
jbe 0x14000fd7f
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000fddb
cmp qword [rbx + 0x18], 7
mov rdx, rbx
jbe 0x14000fda9
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi + 0x18]
mov esi, dword [rsp + 0x3c]
mov qword [rsp + 0x88], rbp
cmp rdx, 7
jbe 0x14000fe26
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000fe21
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000fea0
mov rcx, r8
call fcn.140017140
xor ebp, ebp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov word [rdi], bp
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14000fe72
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000fe6d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000fea0
mov rcx, r8
call fcn.140017140
mov qword [rbx + 0x10], rbp
mov eax, esi
mov word [rbx], bp
mov rbp, qword [rsp + 0x88]
mov qword [rbx + 0x18], 7
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140017120
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000feb0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140025040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r15, r9
mov rax, r8
mov r14, rcx
mov qword [rsp + 0x38], rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], 7
mov word [rcx], r12w
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x48], r12d
cmp qword [r8 + 0x18], 7
jbe 0x14000ff11
mov rax, qword [r8]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400100d9
mov rdx, r15
cmp qword [r15 + 0x18], 7
jbe 0x14000ff49
mov rdx, qword [r15]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400100ce
cmp dword [rsp + 0x4c], 1
jne 0x1400100ce
xorps xmm0, xmm0
mov ebx, dword [rsp + 0x48]
movdqu xmmword [rsp + 0x50], xmm0
mov rsi, r12
mov qword [rsp + 0x60], r12
mov rdi, r12
cmp rbx, 2
jb 0x14001000f
and rbx, 0xfffffffffffffffe
cmp rbx, 0x1000
jb 0x14000ffd2
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400100ff
call fcn.140017148
test rax, rax
je 0x1400100f8
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000ffe7
test rbx, rbx
je 0x14000ffe4
mov rcx, rbx
call fcn.140017148
mov rdi, rax
jmp 0x14000ffe7
mov rdi, r12
mov rbp, rdi
mov qword [rsp + 0x50], rdi
lea rsi, [rbx + rdi]
mov qword [rsp + 0x60], rsi
mov r8, rbx
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov rbx, rsi
mov qword [rsp + 0x58], rbx
jmp 0x140010019
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
cmp qword [r15 + 0x18], 7
jbe 0x140010023
mov r15, qword [r15]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140010094
sub rbx, rbp
sub rbx, 2
sar rbx, 1
mov rax, qword [r14 + 0x18]
cmp rbx, rax
ja 0x140010085
mov r15, r14
cmp rax, 7
jbe 0x140010069
mov r15, qword [r14]
mov qword [r14 + 0x10], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rbp
mov rcx, r15
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + r15], r12w
jmp 0x140010094
mov r9, rbp
mov rdx, rbx
mov rcx, r14
call fcn.140010170
nop
test rdi, rdi
je 0x1400100ce
sub rsi, rdi
sar rsi, 1
add rsi, rsi
cmp rsi, 0x1000
jb 0x1400100c3
add rsi, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x1400100f8
mov rdi, rcx
mov rdx, rsi
mov rcx, rdi
call fcn.140017140
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r14
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140017120
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400012e0
int3
Function at 0x140011b90
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140025040]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140011bea
mov r8d, 4
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x140011c0b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140017120
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rax, [rsp + 0x30]
mov r9d, 0x24
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x140011bea
mov eax, dword [rsp + 0x3c]
jmp 0x140011bec
Function at 0x140014860
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x40
mov rax, qword [0x140025040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x14001489b
lea r9, str.filename_null_
xor r8d, r8d
lea edx, [rsi + 4]
call fcn.140014b50
jmp 0x1400149cc
mov qword [rsp + 0x60], rdi
call fcn.1400146f0
lea r8, [0x14001d420]
mov qword [rsp + 0x30], 0
mov rdx, rsi
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x1400149ac
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1400149ac
mov rcx, rbx
call fcn.1400146f0
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
cmp eax, 0xffffffff
jne 0x14001490e
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
jne 0x14001498e
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
cmp rsi, 0xffffffffffffffff
jae 0x14001498e
test rsi, rsi
jne 0x140014947
lea edx, [rsi + 0xd]
jmp 0x140014993
lea rcx, [rsi + 1]
call fcn.1400171b0
mov r9, rdi
mov qword [rbx + 0x98], rax
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rsi
jne 0x14001498e
mov rax, qword [rbx + 0x98]
mov rcx, rbx
mov byte [rsi + rax], 0
call fcn.140014ce0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1400149c7
mov edx, 5
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call fcn.140014b50
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1400149c7
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea r9, str.filename_s
mov rcx, rbx
lea edx, [r8 + 3]
call fcn.140014b50
mov rdi, qword [rsp + 0x60]
mov eax, dword [rbx + 0x6c]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140017120
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret

Function at 0x140015050
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x78]
mov rdi, r8
mov rsi, rdx
test r9, r9
je 0x140015082
mov edx, 1
mov rcx, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rcx, 0x110
mov qword [rsp + 0x30], rbx
mov edx, edi
call fcn.140015a20
mov r8, rdi
mov rdx, rsi
mov rbx, rax
lea rcx, [rax - 1]
call sub.VCRUNTIME140.dll_memcpy
mov rsi, qword [rsp + 0x38]
mov byte [rbx + rdi - 1], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140016bbc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140016bf6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140016bfb
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140016c44
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14001a9f0]
cmp byte [rcx + rax], 0
je 0x140016c44
dec r8
sub rdx, 1
jne 0x140016c2a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140017d1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140017d66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140017d66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140017d66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140017d66
cmp dword [rcx + 0x84], 0xe
jbe 0x140017d66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140017d68
xor al, al
add rsp, 0x28
ret
Function at 0x140038320
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003832d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003833d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140038325
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140038355
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140038342
sub eax, 3
jb 0x14003836f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400383a6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140038396
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140038394
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140038383
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.1400382e2
jmp 0x14003832d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x22e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400383f2
cmp rsi, rcx
jae 0x1400383fa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400383d9
cmp al, 0x8f
ja 0x1400383d9
cmp byte [rsi - 2], 0xf
je 0x1400383df
sub al, 0xe8
cmp al, 1
ja 0x1400383c3
cmp rsi, rcx
jae 0x1400383fa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400383c9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400383fa
lodsb al, byte [rsi]
jmp 0x1400383d9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x36000]
mov eax, dword [rdi]
or eax, eax
je 0x140038463
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x3b034]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140038407
jns 0x14003843c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140038446
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003845d
mov qword [rbx], rax
add rbx, 8
jmp 0x140038427
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400384bb
sub rsp, 0xffffffffffffff80
jmp 0x140023590
Function at 0x1400012b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x50], 0
jne 0x1400012cd
xor eax, eax
jmp 0x1400013ef
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x20], eax
mov dword [rsp], 0
jmp 0x140001332
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x20]
cmp dword [rsp], eax
jae 0x1400013ed
mov rax, qword [rsp + 0x18]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x140001390
inc rax
test dl, dl
jne 0x14000137d
xor eax, eax
jmp 0x140001395
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400013e8
mov rax, qword [rsp + 0x18]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp]
movzx eax, word [rax + rcx*2]
mov word [rsp + 0x10], ax
mov rax, qword [rsp + 0x18]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
movzx ecx, word [rsp + 0x10]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
jmp 0x1400013ef
jmp 0x14000132a
xor eax, eax
add rsp, 0x48
ret
Function at 0x140008a10
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov rax, qword [0x14007c0c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x140084eb8], eax
jle 0x140008ad2
lea rcx, [0x140084eb8]
call fcn.140045c08
cmp dword [0x140084eb8], 0xffffffff
jne 0x140008ad2
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x20]
movzx r8d, byte [rsp + 0x21]
movzx edx, byte [rsp + 0x22]
lea rcx, [rsp + 0x40]
call fcn.140008b90
mov rcx, rax
call fcn.140009840
mov rdx, rax
lea rcx, [0x140084ec0]
call fcn.140003ed0
nop
lea rcx, [0x1400688b0]
call fcn.140045ee4
nop
lea rcx, [0x140084eb8]
call fcn.140045b9c
nop
mov qword [rsp + 0x70], 0
lea rcx, [0x140084ec0]
call fcn.140002150
lea r8, [rsp + 0x70]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x140008b0b
xor al, al
jmp 0x140008b6c
mov rcx, qword [rsp + 0x90]
call fcn.140002150
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x140008b46
xor al, al
jmp 0x140008b6c
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x140008b5f
mov dword [rsp + 0x28], 1
jmp 0x140008b67
mov dword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140045b30
add rsp, 0x80
pop rdi
ret
Function at 0x140009460
Capabilities:
Unload driver

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1a0
mov rax, qword [0x14007c0c0]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x20]
movzx r8d, byte [rsp + 0x21]
movzx edx, byte [rsp + 0x24]
lea rcx, [rsp + 0x110]
call fcn.140009430
mov rcx, rax
call fcn.1400096c0
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x170]
call fcn.14000c2f0
nop
lea rcx, [rsp + 0x170]
call fcn.140002150
mov rdx, rax
lea rcx, [rsp + 0x150]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x160]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rsp + 0x160]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov dword [rsp + 0x2c], eax
mov rcx, qword [rsp + 0x1b0]
call fcn.140008a10
nop
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0xf0]
call fcn.140008810
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x50]
call fcn.140007d40
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0xb0]
call fcn.14000c070
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x90]
call fcn.14000c420
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x90]
call fcn.1400086d0
nop
lea rcx, [rsp + 0x90]
call fcn.140007d90
nop
lea rcx, [rsp + 0xb0]
call fcn.140002170
nop
lea rcx, [rsp + 0xd0]
call fcn.140002170
nop
lea rcx, [rsp + 0xf0]
call fcn.140007d90
nop
jmp 0x140009659
cmp dword [rsp + 0x2c], 0
jl 0x14000966a
mov dword [rsp + 0x28], 1
jmp 0x140009672
mov dword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x23], al
lea rcx, [rsp + 0x170]
call fcn.140002170
nop
mov rcx, qword [rsp + 0x1b0]
call fcn.140002170
movzx eax, byte [rsp + 0x23]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140045b30
add rsp, 0x1a0
pop rdi
ret
Function at 0x1400139a0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
jmp 0x1400139dd
mov rax, qword [rsp]
add rax, 0x28
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x10]
add rcx, rax
mov rax, rcx
cmp qword [rsp], rax
jae 0x140013a44
mov rax, qword [rsp]
mov eax, dword [rax + 8]
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0
jne 0x140013a1b
mov rax, qword [rsp]
mov eax, dword [rax + 0x10]
mov qword [rsp + 8], rax
mov rax, qword [rsp]
mov eax, dword [rax + 0xc]
cmp qword [rsp + 0x38], rax
jb 0x140013a42
mov rax, qword [rsp]
mov eax, dword [rax + 0xc]
add rax, qword [rsp + 8]
cmp qword [rsp + 0x38], rax
jae 0x140013a42
mov rax, qword [rsp]
jmp 0x140013a46
jmp 0x1400139d1
xor eax, eax
add rsp, 0x28
ret
Function at 0x140013ac0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov rax, qword [0x14007c0c0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x88]
call fcn.140003ed0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov r8d, 0xfde9
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x120]
call fcn.1400138d0
nop
lea rcx, [rsp + 0x88]
call fcn.140002170
nop
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0x48]
call fcn.140009a30
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [0x140084e58]
call fcn.1400133e0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140013c0b
lea rcx, [rsp + 0x120]
call fcn.140007d00
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x20]
movzx r8d, byte [rsp + 0x21]
movzx edx, byte [rsp + 0x24]
lea rcx, [rsp + 0xf0]
call fcn.140013d00
mov rcx, rax
call fcn.1400157f0
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.140002af0
nop
mov ecx, 0x834
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140013c6c
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x120]
call fcn.1400020e0
mov rax, qword [rsp + 0x78]
jmp 0x140013ce6
lea rax, [rsp + 0x22]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x23]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x22]
movzx r8d, byte [rsp + 0x23]
movzx edx, byte [rsp + 0x25]
lea rcx, [rsp + 0xd0]
call fcn.140013d30
mov rcx, rax
call fcn.1400157b0
mov rdx, qword [rsp + 0x160]
mov rcx, rax
call fcn.140002af0
nop
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x120]
call fcn.1400020e0
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140045b30
add rsp, 0x150
pop rdi
ret