joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c5f0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x6a0
mov rax, qword [0x14004c120]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov rsi, rcx
lea rcx, [rsp + 0x272]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x270], di
call fcn.140018f80
lea rcx, [rsp + 0x482]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x480], di
call fcn.140018f80
lea rcx, [rsp + 0x270]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [rdi + 0x5c]
lea rcx, [rsp + 0x270]
call fcn.14001a7e4
test rax, rax
je 0x14000c67e
mov word [rax], di
lea rcx, [rsp + 0x270]
mov edx, 0x5c
call fcn.14001a7e4
test rax, rax
je 0x14000c6b2
lea r8, str.Intelgp_
lea rcx, [rsp + 0x270]
mov edx, 0x104
mov word [rax + 2], di
call fcn.140019d38
lea r8, [rsp + 0x270]
lea rcx, [rsp + 0x480]
mov edx, 0x104
call fcn.140019dc0
lea r8, str.profile_.dat
lea rcx, [rsp + 0x480]
mov r9d, 0xd
mov edx, 0x104
call fcn.14001a6fc
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000c74e
test byte [rsp + 0x20], 0x10
jne 0x14000c723
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14000c780
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000c707
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
cmp eax, 0x12
cmove edi, edi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
jmp 0x14000c753
mov eax, 0x80004005
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.140018f50
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000c780
Capabilities:
Delete file
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x14004c120]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r14, rcx
mov rbx, r8
mov rdi, rdx
lea rcx, [rsp + 0x32]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], si
call fcn.140018f80
lea rcx, [rsp + 0x30]
mov r8, rbx
mov edx, 0x104
call fcn.140019dc0
or r9, 0xffffffffffffffff
nop dword [rax + rax]
inc r9
cmp word [rdi + r9*2 + 0x2c], si
jne 0x14000c7e0
lea r8, [rdi + 0x2c]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.14001a6fc
mov rcx, r14
call fcn.14000b860
lea rdx, str.profile_
lea rcx, [rdi + 0x2c]
mov rbp, rax
mov qword [rsp + 0x28], rax
call fcn.140018650
test rax, rax
je 0x14000c920
lea r8, [rax + 0x10]
lea rcx, [rbp + 4]
mov edx, 0x104
call fcn.140019dc0
lea rcx, [rbp + 4]
mov edx, 0x2e
call fcn.14001a7e4
test rax, rax
je 0x14000c920
lea r8, [0x140035dac]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov word [rax], si
mov qword [rsp + 0x20], rsi
call fcn.14001aaf8
test eax, eax
jne 0x14000c911
mov ecx, 0x35c8
call fcn.140019320
mov r9, qword [rsp + 0x20]
mov edx, 1
mov rcx, rax
mov r8d, 0x35c8
mov rbx, rax
call fcn.14001afac
cmp rax, 0x35c8
jne 0x14000c8ff
mov r8, rbp
mov rdx, rbx
mov rcx, r14
call fcn.14000dd30
test eax, eax
js 0x14000c8ff
mov rsi, qword [r14 + 0x20]
lea r9, [rsp + 0x28]
lea rcx, [r14 + 0x20]
mov r8, qword [rsi + 8]
mov rdx, rsi
call fcn.14000abb0
movabs rcx, 0xaaaaaaaaaaaaaa9
mov rdx, rax
mov rax, qword [r14 + 0x28]
sub rcx, rax
cmp rcx, 1
jb 0x14000c949
inc rax
mov qword [r14 + 0x28], rax
mov qword [rsi + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
mov esi, 1
mov rcx, rbx
call fcn.1400184c0
mov rcx, qword [rsp + 0x20]
call fcn.14001ad24
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
jne 0x14000c92b
mov rdx, rbp
mov rcx, r14
call fcn.14000b970
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140018f50
add rsp, 0x250
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.list_T__too_long
call fcn.14002efc4
int3
Function at 0x14000d660
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x290
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14004c120]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov edi, edx
mov rbx, rcx
xor esi, esi
cmp dword [rcx + 0x18], esi
jne 0x14000d6c9
lea rax, [0x140050538]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x14000bb40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x18], 1
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x50], si
mov r8d, 0x26
lea rdx, str.GlobalProfileAppListChangedForSession
lea rcx, [rsp + 0x50]
call fcn.14000e940
mov word [rsp + 0x70], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x72]
call fcn.140018f80
mov r9d, edi
lea r8, [0x140035b58]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.14001aad4
cmp word [rsp + 0x70], 0
jne 0x14000d730
mov r8, rsi
jmp 0x14000d74b
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000d740
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000e680
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
test rax, rax
je 0x14000d821
mov dword [rsp + 0x30], esi
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x14000ba30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14000d817
mov qword [rsp + 0x40], rdi
mov rdi, qword [rbx]
lea r9, [rsp + 0x30]
mov r8, qword [rdi + 8]
mov rdx, rdi
mov rcx, rbx
call fcn.14000abf0
mov rdx, rax
mov rax, qword [rbx + 8]
movabs rcx, 0x666666666666665
sub rcx, rax
cmp rcx, 1
jae 0x14000d803
lea rcx, str.list_T__too_long
call fcn.14002efc4
int3
inc rax
mov qword [rbx + 8], rax
mov qword [rdi + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
jmp 0x14000d821
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x68], 8
jb 0x14000d833
mov rcx, qword [rsp + 0x50]
call fcn.1400184c0
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140018f50
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000da30
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov dword [r11 + 0x20], r9d
push rdi
sub rsp, 0x60
xor ecx, ecx
lea rax, [r11 - 0x18]
mov rdi, rdx
mov qword [r11 - 0x28], rcx
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rcx
mov rbx, r8
mov qword [r11 - 0x18], rcx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], ecx
lea rdx, str.SOFTWAREIntelDisplayigfxcuiprofiles_app
xor r9d, r9d
mov rcx, 0xffffffff80000002
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000dabe
lea rax, [rsp + 0x88]
mov r9d, 4
mov r8, rbx
mov rdx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x14000dad0
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
test r8d, r8d
je 0x14000db99
mov edx, dword [rdx + 4]
mov qword [rsp + 0x48], r14
call fcn.14000dbe0
mov edx, dword [rbx + 4]
lea rdi, [rbx + 8]
lea r9, [rsp + 0x58]
mov r8, rdi
mov rcx, rsi
call fcn.14000be80
mov r14, rax
test rax, rax
je 0x14000db8c
mov rdx, qword [rax]
mov rcx, qword [rdx]
cmp rcx, rdx
je 0x14000db34
mov r8d, dword [rbx]
cmp dword [rcx + 0x10], r8d
je 0x14000db2f
mov rcx, qword [rcx]
cmp rcx, rdx
jne 0x14000db21
cmp rcx, rdx
jne 0x14000db8c
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x40], rbp
call fcn.14000ece0
mov ebp, dword [r14 + 8]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000db50
add rax, 0xfffffffffffffffc
lea rdx, str..exe
lea rcx, [rdi + rax*2]
call fcn.14001a93c
test eax, eax
je 0x14000db74
mov ebp, dword [rbx]
mov rdx, qword [rsp + 0x58]
mov r9d, ebp
mov r8, rdi
mov rcx, rsi
call fcn.14000da30
mov rbp, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
mov edx, dword [rdx]
lea r8, [rsp + 0x58]
call fcn.14000bdb0
mov rdi, rax
test rax, rax
je 0x14000db91
cmp qword [rax + 8], 0
jbe 0x14000db91
mov rdx, rbx
mov rcx, rax
call fcn.14000ed50
mov r9d, dword [rdi + 8]
mov rdx, qword [rsp + 0x58]
lea r8, [rbx + 8]
mov rcx, rsi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp fcn.14000da30
Function at 0x14000dbe0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14004c120]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor eax, eax
mov edi, edx
mov rbx, rcx
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
test edx, edx
je 0x14000dc44
mov r8, qword [rcx + 0x20]
mov rax, qword [r8]
cmp rax, r8
je 0x14000dc44
nop dword [rax + rax]
mov rcx, qword [rax + 0x10]
cmp dword [rcx], edx
je 0x14000dd01
mov rax, qword [rax]
cmp rax, r8
jne 0x14000dc30
lea rdx, [rsp + 0x20]
mov ecx, edi
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x14000dce1
mov rcx, qword [rsp + 0x20]
lea r8, [rsp + 0x28]
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x14000dce1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x14000dce1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14000dcdb
mov r10, qword [rbx + 0x20]
mov rax, qword [r10]
cmp rax, r10
je 0x14000dcdb
mov rcx, qword [rax + 0x10]
lea r9, [rsp + 0x40]
add rcx, 4
sub r9, rcx
movzx r8d, word [rcx]
movzx edx, word [rcx + r9]
sub r8d, edx
jne 0x14000dcc6
add rcx, 2
test edx, edx
jne 0x14000dcb0
test r8d, r8d
je 0x14000dcd5
mov rax, qword [rax]
cmp rax, r10
jne 0x14000dca0
jmp 0x14000dcdb
mov rcx, qword [rax + 0x10]
mov dword [rcx], edi
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14000dcf1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14000dd01
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140018f50
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x140010250
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x50
xor edi, edi
lea rax, [rsp + 0x68]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionControl_PanelCplsigfxcpl.cpl
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400102f2
lea rax, [rsp + 0x60]
mov qword [rsp + 0x78], rbx
mov rbx, qword [rsp + 0x70]
lea r9d, [rdi + 4]
lea rdx, str.RunLevel
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x1400102e5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov al, 1
add rsp, 0x50
pop rdi
ret
Function at 0x1400115e0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xe0
xor eax, eax
xor ebx, ebx
lea rcx, [rsp + 0x78]
lea r8d, [rbx + 0x60]
xor edx, edx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.140018f80
lea rax, [rsp + 0x50]
lea rdx, [0x140050db0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001166d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0xe0
pop rbx
ret
Function at 0x140011680
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x150
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov ebx, ecx
lea r8, [0x140051e90]
mov edx, 0x400
lea rcx, [0x140052f00]
call fcn.140019dc0
lea r8, str.8A694AF2_286D_429D_867A_3F95898EE308.bat
mov edx, 0x432
lea rcx, [0x140052f00]
call fcn.140019d38
lea rcx, [0x140052f00]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1400116e2
lea rcx, [0x140052f00]
call fcn.14001bc60
lea rcx, [0x140052f00]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14001188c
mov dword [rsp + 0x20], 1
lea r9d, [rax + 0x40]
lea r8d, [rax + 2]
lea rdx, [0x140052f00]
lea rcx, [rsp + 0x40]
call fcn.14000f6a0
nop
lea rdx, str._echo_off
lea rcx, [rsp + 0x40]
call fcn.14000ee00
mov rcx, rax
call fcn.14000f2e0
cmp ebx, 1
jne 0x140011775
lea rdx, str.sc_stop_igfxCUIService1.0.0.0
lea rcx, [rsp + 0x40]
call fcn.14000ee00
mov rcx, rax
call fcn.14000f2e0
lea rdx, str.TIMEOUT_1__NOBREAK
lea rcx, [rsp + 0x40]
call fcn.14000ee00
mov rcx, rax
call fcn.14000f2e0
lea rdx, str.sc_delete_igfxCUIService1.0.0.0
jmp 0x140011802
cmp ebx, 2
jne 0x140011814
lea rdx, str.sc_stop_igfxCUIService2.0.0.0
lea rcx, [rsp + 0x40]
call fcn.14000ee00
mov rcx, rax
call fcn.14000f2e0
lea rdx, str.TIMEOUT_1__NOBREAK
lea rcx, [rsp + 0x40]
call fcn.14000ee00
mov rcx, rax
call fcn.14000f2e0
lea rdx, str.sc_delete_igfxCUIService2.0.0.0
lea rcx, [rsp + 0x40]
call fcn.14000ee00
mov rcx, rax
call fcn.14000f2e0
lea rdx, str.TIMEOUT_5__NOBREAK
lea rcx, [rsp + 0x40]
call fcn.14000ee00
mov rcx, rax
call fcn.14000f2e0
lea rdx, str.igfxCUIService__service
lea rcx, [rsp + 0x40]
call fcn.14000ee00
mov rcx, rax
call fcn.14000f2e0
lea rdx, str.sc_start_igfxCUIService1.0.0.0
lea rcx, [rsp + 0x40]
call fcn.14000ee00
mov rcx, rax
call fcn.14000f2e0
lea rdx, str.del__Q_86F549EB_A66B_4D6C_958D_CDDD66410751.bat
lea rcx, [rsp + 0x40]
call fcn.14000ee00
mov rcx, rax
call fcn.14000f2e0
lea rcx, [rsp + 0x48]
call fcn.1400128e0
test rax, rax
jne 0x140011863
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x40]
mov edx, dword [rcx + 0x10]
or edx, 2
cmp qword [rcx + 0x48], 0
jne 0x14001185a
or edx, 4
xor r8d, r8d
call fcn.1400127f0
nop
lea rcx, [rsp + 0xe8]
call fcn.14000fdd0
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0xe8]
call fcn.14002fa5c
mov al, 1
add rsp, 0x150
pop rbx
ret
Function at 0x140011b80
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x48
xor eax, eax
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionControl_PanelCpls
lea rcx, [rsp + 0x20]
mov r9d, 0xf003f
mov rdx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x30], rax
call fcn.140005ff0
test eax, eax
jne 0x140011c71
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
test rcx, rcx
je 0x140011bdf
mov rbx, qword [rsp + 0x20]
lea r8, str.igfxcpl.cpl
mov rdx, rbx
call fcn.140007640
jmp 0x140011c57
cmp byte [0x1400504c0], 0
jne 0x140011c2a
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140011c1a
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1400504c0], 1
mov qword [0x1400504b8], rax
jmp 0x140011c31
mov rax, qword [0x1400504b8]
mov byte [0x1400504c0], 1
jmp 0x140011c31
mov rax, qword [0x1400504b8]
mov rbx, qword [rsp + 0x20]
lea rdx, str.igfxcpl.cpl
mov rcx, rbx
test rax, rax
je 0x140011c51
mov r8d, dword [rsp + 0x28]
xor r9d, r9d
call rax
jmp 0x140011c57
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test rbx, rbx
je 0x140011c65
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140011c81
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x48
ret

Function at 0x140011c90
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xe0
xor eax, eax
xor ebx, ebx
lea rcx, [rsp + 0x78]
lea r8d, [rbx + 0x60]
xor edx, edx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.140018f80
lea rax, [rsp + 0x50]
lea rdx, [0x140051620]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140011d1d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0xe0
pop rbx
ret
Function at 0x140016700
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
mov rbx, rdx
lea r8, str.SOFTWAREIntelDisplayigfxcuiMISC
lea rcx, [rsp + 0x30]
mov r9d, 0x2001f
mov rdx, 0xffffffff80000002
xor dil, dil
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
call fcn.140005ff0
test eax, eax
jne 0x140016799
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov rbx, qword [rsp + 0x30]
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x70], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test rbx, rbx
je 0x140016794
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dil, 1
jmp 0x14001679e
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400167ac
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movzx eax, dil
add rsp, 0x50
pop rdi
ret

Function at 0x140016de0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
mov ebx, edx
lea r8, str.SOFTWAREIntelDisplayigfxcuiMISC
lea rcx, [rsp + 0x30]
mov r9d, 0x2001f
mov rdx, 0xffffffff80000002
xor dil, dil
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
call fcn.140005ff0
test eax, eax
jne 0x140016e78
mov dword [rsp + 0x70], ebx
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
mov r9d, 4
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x140016e73
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dil, 1
jmp 0x140016e7d
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140016e8b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movzx eax, dil
add rsp, 0x50
pop rdi
ret
Function at 0x140017080
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov edi, r8d
lea rdx, str.Received_Post_Shell_Event__ld_n
lea rcx, [0x14004f170]
call fcn.140005d00
xor esi, esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], rsi
mov r9d, 0x2001f
lea r8, str.SOFTWAREIntelDisplayigfxcuiMISC
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x38]
call fcn.140005ff0
mov rbx, qword [rsp + 0x38]
test eax, eax
jne 0x140017130
mov dword [rsp + 0x78], 2
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 4]
xor r8d, r8d
lea rdx, str.InstallStage
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x14001712c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, esi
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
call fcn.1400110c0
xor edx, edx
mov ecx, edi
call fcn.1400110d0
mov byte [0x140054010], 1
test rbx, rbx
je 0x140017153
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140017f40
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rbx, [rcx + 0x10]
xor edx, edx
mov rdi, rcx
lea r9, [0x140038dd0]
lea rcx, [0x140041410]
lea r8d, [rdx + 0x17]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140017fdc
mov rcx, qword [rbx]
test rcx, rcx
je 0x140017fdc
mov rax, qword [rcx]
xor ebx, ebx
add rdi, 0x18
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rdx, str.ROOTCIMV2
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [rax + 0x18]
test eax, eax
js 0x140017fdc
mov rcx, qword [rdi]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
lea edx, [rbx + 0xa]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x14001bc60
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001bc76
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14001bc78
xor eax, eax
test eax, eax
je 0x14001bc88
mov ecx, eax
call fcn.14001e770
or eax, 0xffffffff
jmp 0x14001bc8a
xor eax, eax
add rsp, 0x28
ret
Function at 0x4019d8
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0x11385def
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x401c98
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0x42cdb7dd
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x401d18
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0xf798ed1a
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x401d58
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0xf768efe9
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x401d98
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x1c
mov ecx, 0x3910913
call fcn.004018ef
add rsp, 0x1c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x14000a3e4
Capabilities:
Allocate or change rwx memory
Attach user process memory
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x140029048]
test rcx, rcx
je 0x14000a3fc
call qword [sym.imp.ntoskrnl.exe_ObUnRegisterCallbacks]
mov rcx, qword [0x140029040]
test rcx, rcx
je 0x14000a40e
call qword [sym.imp.ntoskrnl.exe_ObUnRegisterCallbacks]
lea rbx, [0x140029100]
jmp 0x14000a43f
cmp qword [rax + 8], rbx
jne 0x14000a451
mov rcx, qword [rax]
cmp qword [rcx + 8], rax
jne 0x14000a451
mov qword [0x140029100], rcx
mov edx, 0x78787878
mov qword [rcx + 8], rbx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [0x140029100]
cmp rax, rbx
jne 0x14000a417
add rsp, 0x20
pop rbx
ret
mov ecx, 3
int 0x29