joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c556c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor esi, esi
xor ebx, ebx
and dword [rbp - 0x24], esi
mov r15, r8
and dword [rbp - 0x28], esi
mov r14, rdx
and qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x40], rbx
test ecx, ecx
je 0x1400c55e8
cmp ecx, 1
je 0x1400c55ab
mov edi, 0x80070057
jmp 0x1400c5623
lea rax, [0x1400142f8]
mov qword [rbp - 0x20], 3
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
xor r9d, r9d
lea rax, [rbp + 0x30]
mov qword [rbp - 0x10], rax
mov ecx, 0xb9
lea rax, [rbp - 0x38]
mov qword [rbp - 8], rax
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov edi, dword [rbp + 0x30]
jmp 0x1400c5623
lea rax, [0x140014638]
mov qword [rbp - 0x20], 3
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
xor r9d, r9d
lea rax, [rbp + 0x48]
mov qword [rbp - 0x10], rax
mov ecx, 0xb9
lea rax, [rbp - 0x38]
mov qword [rbp - 8], rax
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov edi, dword [rbp + 0x48]
test edi, edi
jns 0x1400c562e
mov ecx, edi
jmp 0x1400c56e7
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.140051f90
mov edi, eax
test eax, eax
jns 0x1400c5650
mov ecx, eax
call fcn.1400790f8
mov rbx, qword [rbp - 0x40]
jmp 0x1400c56ec
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x30]
call fcn.140068df4
mov edi, eax
test eax, eax
jns 0x1400c5670
mov ecx, eax
call fcn.1400790f8
mov rsi, qword [rbp - 0x30]
jmp 0x1400c5647
mov rbx, qword [rbp - 0x40]
mov r14d, 0x7fffffff
test rbx, rbx
jne 0x1400c5683
xor edi, edi
jmp 0x1400c56b5
mov r8d, r14d
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.140078cfc
mov edi, eax
test eax, eax
js 0x1400c56ae
mov r8d, dword [rbp - 0x40]
lea rcx, [rbp - 0x30]
mov rdx, rbx
call fcn.14006eb00
mov edi, eax
test eax, eax
jns 0x1400c56b5
mov ecx, eax
call fcn.1400790f8
mov ecx, edi
call fcn.140079118
test edi, edi
jns 0x1400c56cd
mov ecx, edi
call fcn.1400790f8
mov rsi, qword [rbp - 0x30]
jmp 0x1400c56ec
mov rsi, qword [rbp - 0x30]
mov r8d, r14d
mov rcx, rsi
mov rdx, r15
call fcn.1400689cc
mov edi, eax
test eax, eax
jns 0x1400c56ec
mov ecx, eax
call fcn.1400790f8
mov ecx, edi
call fcn.140079118
test rbx, rbx
je 0x1400c5701
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x1400c5715
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rbp - 0x38], 0
test rsi, rsi
je 0x1400c572e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x98]
mov eax, edi
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c6e88
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor edi, edi
lea rax, [rbp - 0x18]
and qword [rbp - 8], rdi
mov r14, r9
mov r15, r8
mov qword [rbp - 0x10], rdi
xor ebx, ebx
mov qword [r11 - 0x48], rax
and qword [rbp - 0x18], rbx
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c6f0b
xor esi, esi
mov rdi, qword [rbp - 0x18]
and qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rdi
mov ecx, esi
call fcn.140079118
lea rcx, [rbp - 0x18]
call fcn.1400695f4
test esi, esi
jns 0x1400c6f26
mov ecx, esi
call fcn.1400790f8
jmp 0x1400c6fd5
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
je 0x1400c6edf
mov ecx, esi
call fcn.1400790f8
jmp 0x1400c6eeb
and dword [rbp + 0x20], ebx
lea rax, [rbp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
mov rdx, r15
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400c6f60
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x1400c6eff
test rbx, rbx
jne 0x1400c6f9e
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x1400c6f94
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400c6f29
mov esi, 0x8007000e
jmp 0x1400c6eff
mov esi, 0x8000ffff
jmp 0x1400c6eff
cmp dword [rbp - 0x20], 1
je 0x1400c6fae
mov esi, 0x8007000d
jmp 0x1400c6eff
mov edx, dword [rbp + 0x20]
lea r9, [rbp - 0x1c]
mov r8, r14
mov rcx, rbx
call fcn.140077918
mov esi, eax
test eax, eax
jns 0x1400c6fcd
mov ecx, eax
jmp 0x1400c6f01
cmp dword [rbp - 0x1c], 0
je 0x1400c6fd5
xor ebx, ebx
mov ecx, esi
call fcn.140079118
test rbx, rbx
je 0x1400c6ff5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp - 8]
call fcn.1400695f4
lea rcx, [rbp - 0x10]
call fcn.1400695f4
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400c702c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140425b28]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov eax, dword [0x1403b53f0]
xor r14d, r14d
mov r12, rdx
mov qword [rsp + 0x40], r14
mov r13, rcx
mov qword [rsp + 0x38], r14
mov r15d, 0x104
mov dword [rsp + 0x48], 1
mov ebx, r14d
mov dword [rsp + 0x4c], eax
mov edx, r15d
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x50]
mov esi, r14d
mov edi, r14d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1400c70d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400c70b9
mov r14d, 0x80004005
jmp 0x1400c70ca
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov ecx, r14d
call fcn.1400790f8
jmp 0x1400c71d4
mov rcx, r15
lea rax, [rsp + 0x50]
cmp word [rax], r14w
je 0x1400c70ef
add rax, 2
sub rcx, 1
jne 0x1400c70df
mov rax, rcx
neg rax
sbb r14d, r14d
not r14d
and r14d, 0x80070057
test rcx, rcx
je 0x1400c710c
sub r15, rcx
jmp 0x1400c710f
xor r15d, r15d
mov rax, rcx
neg rax
sbb rdx, rdx
and rdx, r15
xor r15d, r15d
test rcx, rcx
je 0x1400c70ca
lea ebx, [r15 + 0x5c]
cmp bx, word [rsp + rdx*2 + 0x4e]
je 0x1400c7138
lea eax, [rbx - 0x2d]
cmp ax, word [rsp + rdx*2 + 0x4e]
jne 0x1400c713b
dec rdx
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140078c04
mov r14d, eax
test eax, eax
jns 0x1400c715f
mov ecx, eax
call fcn.1400790f8
mov rbx, qword [rsp + 0x30]
jmp 0x1400c71d4
cmp bx, word [r13]
lea rcx, [r13 + 2]
lea rdx, [rsp + 0x38]
cmovne rcx, r13
call fcn.140078fc0
mov r14d, eax
test eax, eax
jns 0x1400c7190
mov ecx, eax
call fcn.1400790f8
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
jmp 0x1400c71d4
mov rbx, qword [rsp + 0x30]
lea r9, [rsp + 0x4c]
mov rdi, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov r8, rbx
mov qword [rsp + 0x20], rdi
mov edx, 3
call fcn.1400c82b0
mov r14d, eax
test eax, eax
jns 0x1400c71cb
mov ecx, eax
call fcn.1400790f8
mov rsi, qword [rsp + 0x40]
jmp 0x1400c71d4
mov rax, qword [rsp + 0x40]
mov qword [r12], rax
mov ecx, r14d
call fcn.140079118
test rdi, rdi
je 0x1400c71fd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079118
test rbx, rbx
je 0x1400c721e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079118
test rsi, rsi
je 0x1400c723f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079118
mov eax, r14d
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140368700
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c767c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x140425b28]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x90
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1400c76f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400c76da
mov ebx, 0x80004005
jmp 0x1400c76e8
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.1400790f8
jmp 0x1400c7712
cmp dword [rsp + 0x30], 2
jne 0x1400c770e
cmp dword [rsp + 0x24], 5
ja 0x1400c7707
jne 0x1400c770e
cmp dword [rsp + 0x28], ebx
jbe 0x1400c770e
mov eax, 1
jmp 0x1400c7710
mov eax, ebx
mov dword [rdi], eax
mov ecx, ebx
call fcn.140079118
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140368700
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rdi
ret

Function at 0x1400c7ed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor eax, eax
xor r14d, r14d
mov qword [r11 - 0x38], rax
mov rbp, rdx
mov qword [r11 - 0x30], rax
mov rsi, rcx
mov qword [r11 - 0x28], rax
mov qword [r11 + 8], r14
test rcx, rcx
jne 0x1400c7f0f
mov ebx, 0x80070057
mov ecx, ebx
jmp 0x1400c7fad
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x1400c7f24
shr edi, 4
and edi, 1
jmp 0x1400c7f27
mov edi, r14d
xor ecx, ecx
call fcn.140079118
xor ecx, ecx
call fcn.140079118
mov ebx, r14d
test edi, edi
jne 0x1400c7fb2
test rbp, rbp
je 0x1400c7f91
xor r9d, r9d
lea r8, [rsp + 0x60]
lea edx, [rdi + 1]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x1400c7f7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400c7f6a
mov ebx, 0x80004005
jmp 0x1400c7f08
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400c7f08
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rsp + 0x30], r14d
test rbp, rbp
lea rdx, [rsp + 0x20]
mov rcx, rsi
cmove rdx, r14
call fcn.1400c7fe4
mov ebx, eax
test eax, eax
jns 0x1400c7fb2
mov ecx, eax
call fcn.1400790f8
mov ecx, ebx
call fcn.140079118
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400c7fc9
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400c7fe4
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x140425b28]
xor rax, rsp
mov qword [rbp + 0x560], rax
xor r13d, r13d
mov r12, rdx
mov r8, rcx
test rcx, rcx
je 0x1400c805b
mov edi, 0x104
mov rax, r8
mov ecx, edi
cmp word [rax], r13w
je 0x1400c803c
add rax, 2
sub rcx, 1
jne 0x1400c802c
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rcx, rcx
je 0x1400c8056
sub rdi, rcx
jmp 0x1400c8065
mov rdi, r13
jmp 0x1400c8065
mov rdi, qword [rsp + 0x20]
mov ebx, 0x80070057
test ebx, ebx
cmovs rdi, r13
jns 0x1400c8074
mov ecx, ebx
jmp 0x1400c823f
mov r14d, 0x105
lea rcx, [rsp + 0x30]
mov edx, r14d
call fcn.140077be0
mov ebx, eax
test eax, eax
js 0x1400c823d
lea rax, [rdi - 1]
mov ecx, 0x80070216
cmp rax, rdi
ja 0x1400c80a7
mov rdi, rax
mov ebx, r13d
jmp 0x1400c80ae
mov ebx, ecx
call fcn.1400790f8
mov ecx, ebx
call fcn.140079118
test ebx, ebx
js 0x1400c806d
add rdi, rdi
mov ecx, 0x5c
cmp word [rsp + rdi + 0x30], cx
jne 0x1400c80db
cmp rdi, 0x20a
jae 0x1400c8277
mov word [rsp + rdi + 0x30], r13w
cmp word [rsp + 0x30], cx
lea rax, [rsp + 0x30]
lea rdi, [rsp + 0x32]
mov word [rbp + 0x140], r13w
cmovne rdi, rax
mov r15d, r13d
mov edx, ecx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcschr]
mov r8, rdi
lea rcx, [rbp + 0x350]
mov rsi, rax
test rax, rax
jne 0x1400c812e
mov rdx, r14
call fcn.140077be0
mov ebx, eax
test eax, eax
js 0x1400c823d
lea r15d, [rsi + 1]
jmp 0x1400c8176
mov r14, rsi
mov edx, 0x105
sub r14, rdi
sar r14, 1
mov r9, r14
call fcn.1400c8450
mov ebx, eax
test eax, eax
js 0x1400c823d
cmp rsi, rdi
jb 0x1400c8234
add r14, r14
cmp r14, 0x20a
jae 0x1400c8277
mov word [rbp + r14 + 0x350], r13w
mov r14d, 0x105
lea r8, [rbp + 0x350]
mov rdx, r14
lea rcx, [rbp + 0x140]
call fcn.1400c84e8
mov ebx, eax
test eax, eax
js 0x1400c823d
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400c81ac
test al, 0x10
jne 0x1400c81da
mov eax, r15d
lea rcx, [rbp + 0x140]
neg eax
sbb rdx, rdx
and rdx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400c820d
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400c820d
test rsi, rsi
je 0x1400c81ff
lea r8, [0x1403b53f0]
mov rdx, r14
lea rcx, [rbp + 0x140]
lea rdi, [rsi + 2]
call fcn.1400c84e8
mov ebx, eax
test eax, eax
js 0x1400c823d
test r15d, r15d
jne 0x1400c8244
lea ecx, [r15 + 0x5c]
jmp 0x1400c80f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400c8221
mov ebx, 0x80004005
jmp 0x1400c806d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400c806d
mov ecx, 0x80070216
mov ebx, ecx
jmp 0x1400c823f
mov ecx, eax
call fcn.1400790f8
mov ecx, ebx
call fcn.140079118
mov eax, ebx
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.140368700
mov rbx, qword [rsp + 0x6c0]
add rsp, 0x670
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140368998
int3
Function at 0x1400cee98
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x140425b28]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
xor esi, esi
cmp dword [0x14042fb68], 1
mov r14, rcx
je 0x1400ceed0
mov esi, 0x8000ffff
jmp 0x1400cef0a
mov rcx, qword [0x14042e950]
lea r8, [rsp + 0x20]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1400cef11
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400ceefc
mov esi, 0x80004005
jmp 0x1400cef0a
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.1400790f8
mov ecx, esi
call fcn.140079118
test esi, esi
jns 0x1400cef25
mov ecx, esi
call fcn.1400790f8
jmp 0x1400cef7c
mov edi, dword [0x14042f560]
test edi, edi
je 0x1400cef42
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.14017ee54
mov edi, dword [0x14042f560]
mov rbx, rax
mov rbp, rbx
test rbx, rbx
jne 0x1400cef51
mov esi, 0x8007000e
jmp 0x1400cef1c
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rbp
call fcn.140160d14
mov rcx, qword [r14]
xor ebx, ebx
test rcx, rcx
je 0x1400cef79
test edi, edi
je 0x1400cef79
call fcn.14017f0ac
mov qword [r14], rbp
xor eax, eax
lea rdi, [rsp + 0x20]
lea ecx, [rax + 0x10]
rep stosb byte [rdi], al
mov ecx, esi
call fcn.140079118
test rbx, rbx
je 0x1400cefa5
cmp dword [0x14042f560], 0
je 0x1400cefa5
mov rcx, rbx
call fcn.14017f0ac
mov eax, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140368700
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400ddf08
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor esi, esi
lea r9, [rbp + 0x58]
mov r15, rdx
mov dword [rbp + 0x50], esi
mov r14, rcx
mov qword [rsp + 0x20], rsi
mov ebx, esi
lea rdx, [rbp + 0x50]
lea r8d, [rsi + 4]
mov qword [rbp - 8], rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400ddf79
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400ddf5f
mov edi, 0x80004005
jmp 0x1400ddf6d
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.1400790f8
jmp 0x1400de00d
cmp dword [rbp + 0x58], 4
je 0x1400ddf88
mov ecx, 0x8007000d
mov edi, ecx
jmp 0x1400ddf6f
mov eax, dword [rbp + 0x50]
sub eax, 1
je 0x1400ddfc2
cmp eax, 1
jne 0x1400ddf7f
lea rax, [rbp - 0x10]
mov rdx, r15
lea r9, [rbp - 8]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0xc]
call fcn.1400df5d0
mov edi, eax
test eax, eax
js 0x1400ddfd0
mov rbx, qword [rbp - 8]
mov r12d, dword [rbp - 0x10]
mov r13d, dword [rbp - 0xc]
jmp 0x1400ddfdd
mov rdx, r15
call fcn.1400df8b0
mov edi, eax
test eax, eax
jns 0x1400ddfd4
mov ecx, eax
jmp 0x1400ddf6f
mov r12d, 1
mov r13d, esi
mov qword [r14 + 8], r15
mov rcx, qword [r14 + 0x18]
mov qword [rbp - 8], rsi
test rcx, rcx
je 0x1400ddff4
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rbp + 0x50]
test rbx, rbx
cmovne rsi, rbx
mov qword [r14 + 0x18], rsi
mov dword [r14 + 0x20], r13d
mov dword [r14 + 0x10], r12d
mov dword [r14], eax
mov ecx, edi
call fcn.140079118
lea rcx, [rbp - 8]
call fcn.14005a598
mov rbx, qword [rsp + 0x80]
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400df8b0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x140425b28]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
lea rcx, [rsp + 0x40]
xor edx, edx
lea r8d, [rdx + 0x78]
call sub.msvcrt.dll_memset
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, 0x78
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400df922
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400df912
mov ebx, 0x80004005
jmp 0x1400df984
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400df984
cmp dword [rsp + 0x30], 0x78
je 0x1400df930
mov ebx, 0x8007000d
jmp 0x1400df984
mov r8d, 0x3c
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x40]
call fcn.140078cfc
mov ebx, eax
test eax, eax
jns 0x1400df94f
mov ecx, eax
jmp 0x1400df986
lea rdx, str.spp:migblob_aesencryptor_tokenact
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400df98b
and qword [rsp + 0x20], 0
mov ecx, 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc00004a5
call fcn.140052eec
mov ebx, 0x80049e59
mov ecx, ebx
call fcn.1400790f8
mov ecx, ebx
call fcn.140079118
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140368700
add rsp, 0xd0
pop rbx
ret
Function at 0x1400e8874
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
sub rsp, 0x50
rdtsc
and qword [0x14042e9c8], 0
and qword [0x14042e9b8], 0
shl rdx, 0x20
or rax, rdx
btr eax, 0x1f
mov qword [0x14042e9d8], rax
call fcn.1400e81d0
mov qword [0x14042e9b0], rax
test rax, rax
je 0x1400e88dc
mov ebx, 1
mov qword [0x14042e9c0], rbx
mov qword [0x14042e9d0], rbx
call fcn.1400e7a68
mov ecx, dword [0x14042f3e8]
test eax, eax
mov edx, eax
cmovns ecx, ebx
mov dword [0x14042f3e8], ecx
jmp 0x1400e88f1
and qword [0x14042e9c0], 0
mov edx, 0x8007000e
and qword [0x14042e9d0], 0
xor eax, eax
test edx, edx
cmovs eax, edx
test eax, eax
js 0x1400e8940
and dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x20]
and dword [rsp + 0x40], 0
xor r9d, r9d
mov ecx, 0xb9
mov dword [rsp + 0x34], 0x64
mov qword [rsp + 0x20], 8
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x1400f34f4
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x140425b28]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r15d, r15d
lea rax, [rsp + 0x48]
mov r14, rdx
mov qword [rbp - 0x69], r15
mov rdx, qword [rcx]
mov rsi, rcx
xorps xmm0, xmm0
mov qword [rbp - 0x61], r15
xorps xmm1, xmm1
mov qword [rbp - 0x39], r15
lea r9d, [r15 + 8]
mov qword [rsp + 0x48], r15
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
movdqu xmmword [rbp - 0x59], xmm0
movdqu xmmword [rbp - 0x49], xmm1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x1400f3572
mov ebx, r15d
jmp 0x1400f3682
test eax, eax
jne 0x1400f3613
mov ebx, r15d
mov edi, r15d
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r15
lea r8, [rbp - 0x29]
mov qword [rsp + 0x30], r15
mov edx, edi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x40], 0x25
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc edi
cmp eax, 0x103
je 0x1400f3639
test eax, eax
je 0x1400f35d1
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x1400f3629
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x29]
call fcn.140052048
test eax, eax
js 0x1400f3632
lea r8, [rbp - 0x59]
mov rcx, rsi
lea rdx, [rbp - 0x29]
call fcn.1400f4698
mov ebx, eax
test eax, eax
js 0x1400f360f
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x69]
call fcn.1400f4f50
mov ebx, eax
test eax, eax
jns 0x1400f3580
mov ecx, eax
jmp 0x1400f362b
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
je 0x1400f357d
mov ecx, ebx
call fcn.1400790f8
jmp 0x1400f3682
mov ebx, 0x8004f807
jmp 0x1400f3629
lea rdx, [rbp - 0x69]
mov qword [rbp - 0x79], r15
lea rcx, [rbp - 0x79]
mov qword [rbp - 0x71], r15
call fcn.140077a64
mov rdx, r14
lea rcx, [rbp - 0x79]
call fcn.140077a64
xor edx, edx
lea rcx, [rbp - 0x79]
call fcn.1400f5380
mov rdi, qword [rbp - 0x71]
test rdi, rdi
je 0x1400f3682
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, ebx
call fcn.140079118
lea rcx, [rsp + 0x48]
call fcn.1400695f4
lea rcx, [rbp - 0x59]
call fcn.1400f2324
xor edx, edx
lea rcx, [rbp - 0x69]
call fcn.1400f5380
mov rdi, qword [rbp - 0x61]
test rdi, rdi
je 0x1400f36c4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140368700
mov rbx, qword [rsp + 0x140]
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret