joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002fd0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14004ce78]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, rdx
mov rsi, rcx
call fcn.14000ef80
lea rdx, str.environ
mov rcx, rax
call qword [sym.imp.python310.dll_PyObject_GetAttrString]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.python310.dll_PyUnicode_FromString]
mov rdx, rsi
lea rcx, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.1400198a0
lea rcx, [rsp + 0x20]
test rbp, rbp
je 0x140003091
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, 0xffffffffffffffff
mov rcx, rbp
call sub.python310.dll_PyUnicode_FromWideChar
mov r8, rax
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.python310.dll_PyObject_SetItem]
test eax, eax
je 0x14000307f
mov ecx, 1
call qword [sym.imp.python310.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python310.dll_Py_Exit]
int3
sub qword [rsi], 1
jne 0x1400030ae
mov rax, qword [rsi + 8]
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1400030ae
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.python310.dll_PyObject_DelItem]
test eax, eax
je 0x1400030ae
call fcn.140002680
sub qword [rdi], 1
jne 0x1400030be
mov rax, qword [rdi + 8]
mov rcx, rdi
call qword [rax + 0x30]
sub qword [rbx], 1
jne 0x1400030ce
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14001e4c0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140019950
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
test edx, edx
je 0x140019a14
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
sub r9, 1
jne 0x140019970
not eax
ret
Function at 0x14001eeac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001eef6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001eef6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001eef6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001eef6
cmp dword [rcx + 0x84], 0xe
jbe 0x14001eef6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001eef8
xor al, al
add rsp, 0x28
ret

Function at 0x1400263c0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400261ec
Function at 0x1400116b8
Capabilities:
Terminate process

Disassembly:
jmp 0x14001e200
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001184d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x140013580
push rbp
push rsi
push rdi
sub rsp, 0x130
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x108], rax
lea rcx, [0x1400311b6]
call fcn.140011c2b
lea rax, [rbp + 8]
lea rcx, [0x140025f98]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
mov edx, 0xa
lea rcx, str.shellcode_size:__d_n
call fcn.1400115a5
lea r9, [rbp + 0x34]
mov r8d, 0x40
mov edx, 0xa
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rax, [rbp + 8]
call rax
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140025d50]
call fcn.140011a69
mov eax, edi
mov rcx, qword [rbp + 0x108]
xor rcx, rbp
call fcn.1400115d2
lea rsp, [rbp + 0x110]
pop rdi
pop rsi
pop rbp
ret

Function at 0x140011889
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001f550
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001f570
xor al, al
jmp 0x14001f5f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001f583
xor al, al
jmp 0x14001f5f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001f5ad
xor al, al
jmp 0x14001f5f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001f5c1
xor al, al
jmp 0x14001f5f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001f5d3
xor al, al
jmp 0x14001f5f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001f5ef
xor al, al
jmp 0x14001f5f1
mov al, 1
add rsp, 0x38
ret
Function at 0x1406e0e3d
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffa22d837f
call fcn.140cec4f6
and byte [rsi + rcx*4 - 0x78ec7743], ch
and eax, 0xeea89273
ror dword [rcx + rdi*2 - 0x732e3175], 1
xor ch, cl
mov dword [rsi - 0x73], esp
nop
push qword [rbp + 0x27]
jae 0x1406e0e43
scasd eax, dword [rdi]
mov dh, 0x60
add byte [rax], ah
lodsb al, byte [rsi]
invalid
cmp eax, 0xc47296ea
ficom dword [rcx - 0x27]
invalid
Function at 0x140001160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140001193
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400011d6
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x1400011d1
cmp rbx, r11
jae 0x1400011d6
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x1400011c0
cmp rbx, r11
jb 0x1400011da
xor eax, eax
jmp 0x1400011e6
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400012f0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140001364
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001386
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001386
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x140001386
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14000163e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400012f0
cmp byte [0x14006da80], 0
jne 0x140001689
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001679
lea rdx, [0x14004bdf8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14006da80], 1
mov qword [0x14006da78], rax
jmp 0x140001690
mov rax, qword [0x14006da78]
mov byte [0x14006da80], 1
jmp 0x140001690
mov rax, qword [0x14006da78]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x1400016af
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
Function at 0x140001610
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140001364
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001386
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001386
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x140001386
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14000163e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400012f0
cmp byte [0x14006da80], 0
jne 0x140001689
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001679
lea rdx, [0x14004bdf8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14006da80], 1
mov qword [0x14006da78], rax
jmp 0x140001690
mov rax, qword [0x14006da78]
mov byte [0x14006da80], 1
jmp 0x140001690
mov rax, qword [0x14006da78]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x1400016af
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]

Function at 0x1400017c0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x140001800
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
jne 0x140001833
lea eax, [r8 + 0xd]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
xor edi, edi
mov rbx, r8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rbx, [rbx + rax*2]
lea edi, [rdi + rax*2]
cmp eax, 1
jne 0x140001842
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x1400020f0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14006c270]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
lea rcx, [rsp + 0x48]
or r9d, 0x2001f
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
call fcn.1400016c0
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x14000220c
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400021e1
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1400020f0
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x14000220c
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140002190
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400021f6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x50], ebp
call fcn.140001610
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x140002217
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140034530
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret

Function at 0x140003880
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x50], rax
test rax, rax
jne 0x1400038a8
add rsp, 0x30
pop rdi
ret
lea rax, [rsp + 0x40]
lea r8, [0x140002800]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x1400038e5
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140004d80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x4b0], rbx
mov rax, qword [0x14006c270]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rsi, r9
mov rbx, r8
mov rax, rdx
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x70], r12
xor edx, edx
lea r8d, [r12 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140004df8
call fcn.1400012c0
mov ebx, eax
jmp 0x140004f1d
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140004e19
call fcn.1400012c0
jmp 0x140004f11
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140004e3c
call fcn.1400012c0
jmp 0x140004f11
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x140004e5e
mov ebx, 0x8007000e
jmp 0x140004f13
mov ecx, eax
test eax, eax
je 0x140004e9b
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140004e91
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140004e9b
lea rcx, [rsp + 0x70]
call fcn.140001ff0
mov rax, qword [rsp + 0x70]
jmp 0x140004ea5
mov ecx, 0x80070216
call fcn.140001050
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x140004ebd
test rax, rax
jne 0x140004ec9
mov ebx, 0x8007000e
jmp 0x140004f13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140004eee
call fcn.1400012c0
jmp 0x140004f11
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r12w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140004ad0
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x140004f34
lea rcx, [rsp + 0x70]
call fcn.140001fe0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140034530
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x140005e30
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, rcx
mov r8, rcx
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerLow_RightsElevationPolicy_
lea rcx, [rsp + 0x48]
call fcn.140005790
mov rdx, qword [rsp + 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140005e94
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x140005eaf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140005ec0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [0x14006da40], 0
mov esi, edx
mov rdi, rcx
je 0x140005ee6
or eax, 0xffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x140005f28
cmp eax, 0x80010106
jne 0x140005f64
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140005f2c
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov byte [rdi + 0x62], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x40]
mov rcx, rdi
mov rdx, rax
call fcn.1400058f0
cmp al, 1
jne 0x140005f54
mov edx, esi
mov rcx, rdi
call fcn.140004d00
mov ebx, eax
jmp 0x140005f58
mov ebx, dword [rsp + 0x40]
cmp byte [rdi + 0x62], 0
je 0x140005f64
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140006400
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
lea rcx, [0x14006bfe0]
mov rax, qword [0x14006bfe0]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION_
test rdx, 0xffffffffffff0000
jne 0x140006464
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.140001200
test rax, rax
je 0x140006479
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140005520
jmp 0x140006474
mov r8d, VarR8FromDisp
lea rcx, [rsp + 0x78]
call fcn.140005390
mov rbx, qword [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
call fcn.140027d80
cmp eax, 1
je 0x1400064f1
cmp eax, 2
je 0x1400064e7
add eax, 0xfffffffd
cmp eax, 1
ja 0x1400064dd
mov dword [rsp + 0x70], 0x2328
jmp 0x1400064f9
mov dword [rsp + 0x70], 0xffffffff
jmp 0x140006529
mov dword [rsp + 0x70], 0x1f40
jmp 0x1400064f9
mov dword [rsp + 0x70], 0x1b58
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.BackgroundHost64.exe
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006553
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x140006570
Capabilities:
Delete registry key

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
lea rcx, [0x14006bfe0]
mov rax, qword [0x14006bfe0]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION_
test rdx, 0xffffffffffff0000
jne 0x1400065d4
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.140001200
test rax, rax
je 0x1400065e9
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140005520
jmp 0x1400065e4
mov r8d, VarR8FromDisp
lea rcx, [rsp + 0x70]
call fcn.140005390
mov rbx, qword [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rdx, str.BackgroundHost64.exe
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000665e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140006670
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
lea rcx, [0x14006bfe0]
mov rax, qword [0x14006bfe0]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerMainFeatureControlFEATURE_WEBOC_MOVESIZECHILD_
test rdx, 0xffffffffffff0000
jne 0x1400066d4
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.140001200
test rax, rax
je 0x1400066e9
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140005520
jmp 0x1400066e4
mov r8d, 0x55
lea rcx, [rsp + 0x78]
call fcn.140005390
mov rbx, qword [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.BackgroundHost64.exe
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000678d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret