joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f9340
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
je 0x1400f937e
test rax, rax
je 0x1400f9447
mov rcx, qword [rbx]
mov qword [rax], rcx
add rax, 8
mov qword [rsi + 8], rax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
sub rax, qword [rsi]
mov r15, rax
sar r15, 3
lea rcx, [r15 + 1]
mov rdx, rcx
shr rdx, 0x3d
jne 0x1400f9473
movabs rdx, 0x1fffffffffffffff
lea rdi, [rsi + 0x18]
mov r14, rax
sar r14, 2
cmp r14, rcx
cmovbe r14, rcx
movabs rcx, 0x7ffffffffffffff8
cmp rax, rcx
cmovae r14, rdx
test r14, r14
jne 0x1400f943a
xor eax, eax
shl r15, 3
add r15, rax
je 0x1400f9447
lea rax, [rax + r14*8]
mov rcx, qword [rbx]
mov qword [r15], rcx
lea rcx, [r15 + 8]
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
cmp r8, rdx
je 0x1400f9408
mov r9, qword [r8 - 8]
add r8, 0xfffffffffffffff8
mov qword [r15 - 8], r9
add r15, 0xfffffffffffffff8
cmp r8, rdx
jne 0x1400f93f0
mov rdx, qword [rsi]
mov qword [rsi], r15
mov qword [rsi + 8], rcx
mov r8, qword [rsi + 0x10]
mov qword [rsi + 0x10], rax
test rdx, rdx
je 0x1400f9372
sub r8, rdx
sar r8, 3
mov rcx, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400f99b0
mov rcx, rdi
mov rdx, r14
call fcn.1400f9f80
jmp 0x1400f93cd
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1400d1060
mov rcx, rsi
call fcn.1400d0fd0
int3

Function at 0x1401026a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140149038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1401026ee
mov rdx, rcx
add rdi, rdx
cmp al, 1
je 0x14010272c
cmp rdi, rsi
jae 0x14010272c
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x1401026e7
jmp 0x1401026e4
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400988d0
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140174a62
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword gs:[0x60]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], 0
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax + 0x30]
lea rcx, [rbx + 0x11393e]
mov r8d, dword [rcx + 4]
mov edx, dword [rcx]
call fcn.140174962
mov edx, dword [rsp + 0xa4]
lea rax, [rsp + 0x70]
add rdx, rbx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x30]
call rdx
add rsp, 0x270
pop rbx
ret
Function at 0x1400da3bb
Capabilities:
Install driver

Disassembly:
jmp 0x14017d370
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2d8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x7e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2f8]
mov rax, qword [0x140329a40]
xor rax, rbp
mov qword [rbp + 0x2a8], rax
lea rcx, [0x14035171d]
call fcn.1400e103a
mov rcx, qword [rbp + 0x2d0]
call fcn.1400dd327
test eax, eax
jne 0x14017d3d0
xor eax, eax
jmp 0x14017d4ce
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1400daef1
lea rcx, [rbp + 8]
call fcn.1400de76d
nop
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 8]
call fcn.1400debaa
mov rax, qword [rbp + 0x2d0]
add rax, 8
mov rcx, rax
call fcn.1400db0f9
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.1400ded94
mov qword [rbp + 0x298], rax
mov rax, qword [rbp + 0x298]
mov qword [rbp + 0x2a0], rax
mov rcx, qword [rbp + 0x2a0]
call fcn.1400e145e
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.1400dfd2f
nop
lea rcx, [rbp + 0x140]
call fcn.1400daaff
lea rcx, [rbp + 8]
call fcn.1400db0f9
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.1400e0c02
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
jge 0x14017d4b5
cmp dword [rbp + 0x54], 0xc000010e
je 0x14017d4b5
mov r8d, dword [rbp + 0x54]
lea rdx, str.NtLoadDriver_Failed_code_0x_x
mov ecx, 3
call fcn.1400db7c0
mov dword [rbp + 0x264], 0
lea rcx, [rbp + 8]
call fcn.1400dbf6d
mov eax, dword [rbp + 0x264]
jmp 0x14017d4ce
mov dword [rbp + 0x284], 1
lea rcx, [rbp + 8]
call fcn.1400dbf6d
mov eax, dword [rbp + 0x284]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402c3ee0]
call fcn.1400dfc67
mov rax, rdi
mov rcx, qword [rbp + 0x2a8]
xor rcx, rbp
call fcn.1400dd6a1
lea rsp, [rbp + 0x2b8]
pop rdi
pop rbp
ret
Function at 0x1400dac94
Capabilities:
Set registry value

Disassembly:
jmp 0x14015b6b0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x30]
lea rcx, [0x1403510a5]
call fcn.1400e103a
mov rax, qword [rbp + 0x160]
cmp qword [rax], 0
jne 0x14015b726
mov eax, dword [0x140327080]
add eax, 5
lea rcx, str.m_hKey___0
mov qword [rsp + 0x28], rcx
lea rcx, [0x1402abb38]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1402b9570]
mov ecx, 2
call fcn.1400daca8
cmp eax, 1
jne 0x14015b726
int3
xor eax, eax
test eax, eax
jne 0x14015b6d9
cmp qword [rbp + 0x170], 0
je 0x14015b742
mov dword [rbp + 0x134], 1
jmp 0x14015b74c
mov dword [rbp + 0x134], 0
mov eax, dword [rbp + 0x134]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x14015b79b
mov eax, dword [0x140327080]
add eax, 6
lea rcx, str.__atl_condVal
mov qword [rsp + 0x28], rcx
lea rcx, [0x1402abb38]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1402b9570]
mov ecx, 2
call fcn.1400daca8
cmp eax, 1
jne 0x14015b79b
int3
cmp dword [rbp + 0x64], 0
jne 0x14015b7a8
mov eax, 0xd
jmp 0x14015b827
xor eax, eax
test eax, eax
jne 0x14015b72c
mov dword [rbp + 0x24], 0
mov rax, qword [rbp + 0x170]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
call fcn.1400da762
inc eax
mov dword [rbp + 0x44], eax
mov eax, dword [rbp + 0x44]
mov rcx, qword [rbp + 8]
lea rax, [rcx + rax*2]
mov qword [rbp + 8], rax
mov eax, dword [rbp + 0x44]
mov ecx, dword [rbp + 0x24]
lea rax, [rcx + rax*2]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x44], 1
jne 0x14015b7c4
mov eax, dword [rbp + 0x24]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x170]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rbp + 0x168]
mov rax, qword [rbp + 0x160]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1400db522
Capabilities:
Acquire debug privileges

Disassembly:
jmp 0x140165950
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rcx, [0x1403510cb]
call fcn.1400e103a
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1401659cf
mov eax, dword [0x140327428]
add eax, 2
lea rcx, str.___HRESULT__hRes_____0_
mov qword [rsp + 0x28], rcx
lea rcx, [0x1402abb38]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, str.C:Projectsopenprocmon_masteropenprocmon_masterguimain.cpp
mov ecx, 2
call fcn.1400daca8
cmp eax, 1
jne 0x1401659cf
int3
mov ecx, 1
call fcn.1400e110c
mov ecx, 0x404
call fcn.1400db47d
mov edx, 1
lea rcx, str.SeDebugPrivilege
call fcn.1400decc2
xor r9d, r9d
mov r8, qword [rbp + 0x120]
xor edx, edx
lea rcx, [0x14032efe0]
call fcn.1400e0c9d
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140165a55
mov eax, dword [0x140327428]
add eax, 0xa
lea rcx, str.___HRESULT__hRes_____0_
mov qword [rsp + 0x28], rcx
lea rcx, [0x1402abb38]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, str.C:Projectsopenprocmon_masteropenprocmon_masterguimain.cpp
mov ecx, 2
call fcn.1400daca8
cmp eax, 1
jne 0x140165a55
int3
mov edx, dword [rbp + 0x138]
mov rcx, qword [rbp + 0x130]
call fcn.1400e03e7
mov dword [rbp + 0x24], eax
lea rcx, [0x14032efe0]
call fcn.1400dd485
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [rbp + 0x24]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400db89c
Capabilities:
Delete registry key

Disassembly:
jmp 0x140128e60
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, [0x1403510a5]
call fcn.1400e103a
mov rax, qword [rbp + 0x100]
cmp qword [rax], 0
jne 0x140128ed0
mov eax, dword [0x140327068]
inc eax
lea rcx, str.m_hKey___0
mov qword [rsp + 0x28], rcx
lea rcx, [0x1402abb38]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1402b9570]
mov ecx, 2
call fcn.1400daca8
cmp eax, 1
jne 0x140128ed0
int3
xor eax, eax
test eax, eax
jne 0x140128e84
mov rax, qword [rbp + 0x100]
cmp qword [rax + 0x10], 0
je 0x140128f0a
mov r8, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax + 0x10]
call fcn.1400e01f3
jmp 0x140128f94
movzx eax, byte [0x14032efd9]
test eax, eax
jne 0x140128f4c
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140128f45
lea rdx, str.RegDeleteKeyExW
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14032efd0], rax
mov byte [0x14032efd9], 1
cmp qword [0x14032efd0], 0
je 0x140128f7d
xor r9d, r9d
mov rax, qword [rbp + 0x100]
mov r8d, dword [rax + 8]
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax]
call qword [0x14032efd0]
jmp 0x140128f94
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1400dbc2f
Capabilities:
Create thread

Disassembly:
jmp 0x14017efb0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x1403519fe]
call fcn.1400e103a
mov rcx, qword [rbp + 0xe0]
call fcn.1400dec3b
movzx eax, al
test eax, eax
je 0x14017efe8
mov al, 1
jmp 0x14017f03b
mov rax, qword [rbp + 0xe0]
mov byte [rax + 0x28], 1
mov rax, qword [rbp + 0xe0]
mov byte [rax + 0x10], 0
mov rax, qword [rbp + 0xe0]
add rax, 0x18
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0xe0]
lea r8, [0x1400dc909]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbp + 0xe0]
mov qword [rcx + 0x20], rax
mov al, 1
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400dbf7c
Capabilities:
Set registry value

Disassembly:
jmp 0x14015a2c0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x1403510a5]
call fcn.1400e103a
mov rax, qword [rbp + 0xe0]
cmp qword [rax], 0
jne 0x14015a335
mov eax, dword [0x140327078]
inc eax
lea rcx, str.m_hKey___0
mov qword [rsp + 0x28], rcx
lea rcx, [0x1402abb38]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1402b9570]
mov ecx, 2
call fcn.1400daca8
cmp eax, 1
jne 0x14015a335
int3
xor eax, eax
test eax, eax
jne 0x14015a2e9
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400dc08f
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x14019f6b0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x14032f778]
test rcx, rcx
jne 0x14019f6d6
call fcn.14019f834
test eax, eax
je 0x14019f715
mov rcx, qword [0x14032f778]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rbx, rax
test rax, rax
je 0x14019f6f7
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x16]
call fcn.1400df370
jmp 0x14019f779
mov edx, 0x1000
mov r9d, 0x40
mov r8d, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x14019f72c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc0000017
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x14032f778]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x14019f759
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x14019f77c
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x14032f778]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x14019f760
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400dc2a1
Capabilities:
Open clipboard

Disassembly:
jmp 0x14014cf90
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x1403510c2]
call fcn.1400e103a
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14014cffd
lea rax, str.::IsWindow_m_hWnd_
mov qword [rsp + 0x28], rax
lea rax, [0x1402abb38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x6fd
lea rdx, [0x1402ae260]
mov ecx, 2
call fcn.1400daca8
cmp eax, 1
jne 0x14014cffd
int3
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_OpenClipboard]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400dc6c5
Capabilities:
Delete registry value

Disassembly:
jmp 0x140128ff0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x1403510a5]
call fcn.1400e103a
mov rax, qword [rbp + 0xe0]
cmp qword [rax], 0
jne 0x140129060
mov eax, dword [0x14032706c]
inc eax
lea rcx, str.m_hKey___0
mov qword [rsp + 0x28], rcx
lea rcx, [0x1402abb38]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1402b9570]
mov ecx, 2
call fcn.1400daca8
cmp eax, 1
jne 0x140129060
int3
xor eax, eax
test eax, eax
jne 0x140129014
mov rdx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400dca35
Capabilities:
Write clipboard data

Disassembly:
jmp 0x140125040
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x20]
lea rcx, [0x1403510c1]
call fcn.1400e103a
mov rcx, qword [rbp + 0x118]
call fcn.1400dbb26
movzx eax, al
test eax, eax
je 0x14012507c
jmp 0x140125145
mov rax, qword [rbp + 0x110]
add rax, 8
mov rcx, rax
call fcn.1400dc2a1
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, qword [rbp + 0x118]
call fcn.1400db833
inc eax
cdqe
shl rax, 1
mov rdx, rax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1401250c9
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x140125145
mov rcx, qword [rbp + 0x118]
call fcn.1400db833
inc eax
cdqe
shl rax, 1
mov qword [rbp + 0xd8], rax
mov rcx, qword [rbp + 0x118]
call fcn.1400db531
mov qword [rbp + 0xe0], rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, qword [rbp + 0xd8]
mov r8, rcx
mov rcx, qword [rbp + 0xe0]
mov rdx, rcx
mov rcx, rax
call fcn.1400dd6dd
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, qword [rbp + 8]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rsp, [rbp + 0xf8]
pop rdi
pop rbp
ret
Function at 0x1400dcc38
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
jmp 0x14016b870
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x278]
lea rcx, [0x14035113d]
call fcn.1400e103a
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0x64
mov qword [rbp + 0x48], 0
mov dword [rbp + 0x64], 0
cmp qword [rbp + 0x48], 0
je 0x14016b8d6
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rbp + 0x24]
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14016b8f0
jmp 0x14016b93b
lea r9, [rbp + 4]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x48]
mov ecx, 0xb
call fcn.1400df2a8
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jge 0x14016b92b
cmp dword [rbp + 0x84], 0xc0000004
jne 0x14016b929
mov eax, dword [rbp + 4]
mov dword [rbp + 0x24], eax
jmp 0x14016b934
jmp 0x14016b934
mov dword [rbp + 0x64], 1
jmp 0x14016b93b
xor eax, eax
cmp eax, 1
jne 0x14016b8c5
cmp dword [rbp + 0x64], 0
je 0x14016bad8
mov dword [rbp + 0xa4], 0
jmp 0x14016b95f
mov eax, dword [rbp + 0xa4]
inc eax
mov dword [rbp + 0xa4], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax]
cmp dword [rbp + 0xa4], eax
jge 0x14016bad8
lea rcx, [rbp + 0xc8]
call fcn.1400de76d
nop
lea rcx, [rbp + 0xe8]
call fcn.1400de76d
nop
movsxd rax, dword [rbp + 0xa4]
imul rax, rax, 0x128
mov rcx, qword [rbp + 0x48]
lea rax, [rcx + rax + 0x30]
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.1400df5fa
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0xe8]
call fcn.1400ddebc
test eax, eax
je 0x14016baba
mov ecx, 0x28
call fcn.1400da4ec
mov qword [rbp + 0x208], rax
cmp qword [rbp + 0x208], 0
je 0x14016b9fc
mov rcx, qword [rbp + 0x208]
call fcn.1400db09a
mov qword [rbp + 0x218], rax
jmp 0x14016ba07
mov qword [rbp + 0x218], 0
mov rax, qword [rbp + 0x218]
mov qword [rbp + 0x1e8], rax
mov rdx, qword [rbp + 0x1e8]
lea rcx, [rbp + 0x108]
call fcn.1400db8ab
nop
movsxd rax, dword [rbp + 0xa4]
imul rax, rax, 0x128
mov qword [rbp + 0x218], rax
movsxd rcx, dword [rbp + 0xa4]
imul rcx, rcx, 0x128
mov qword [rbp + 0x220], rcx
lea rcx, [rbp + 0x108]
call fcn.1400dfbe5
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x218]
mov r9d, dword [rcx + rdx + 0x20]
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x220]
mov r8, qword [rcx + rdx + 0x18]
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.1400da785
test eax, eax
je 0x14016baad
mov rax, qword [rbp + 0x250]
add rax, 0x10
lea rdx, [rbp + 0x108]
mov rcx, rax
call fcn.1400dccbf
nop
lea rcx, [rbp + 0x108]
call fcn.1400e0ba8
nop
lea rcx, [rbp + 0xe8]
call fcn.1400dbf6d
nop
lea rcx, [rbp + 0xc8]
call fcn.1400dbf6d
jmp 0x14016b951
cmp qword [rbp + 0x48], 0
je 0x14016bae9
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rbp + 0x64]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402c0160]
call fcn.1400dfc67
mov eax, edi
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret
Function at 0x1400dd016
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x1401784c0
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x30]
lea rcx, [0x1403515ac]
call fcn.1400e103a
mov dword [rsp + 0x20], 0
mov r9d, dword [rbp + 0x198]
mov r8d, dword [rbp + 0x190]
mov edx, 1
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.USER32.dll_LookupIconIdFromDirectoryEx]
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jne 0x140178529
xor eax, eax
jmp 0x1401785a5
movzx eax, word [rbp + 0x84]
mov r8d, 3
mov edx, eax
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 0x68], rax
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp + 0x28], rax
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbp + 4], eax
mov rcx, qword [rbp + 0x1a0]
call fcn.1400da429
mov r8d, dword [rbp + 4]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x1a0]
call fcn.1400e17f6
mov eax, 1
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x1400dd27d
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14024b5e0
mov rax, rcx
neg rcx
test rax, 7
je 0x14024b5fd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14024b658
test al, 7
jne 0x14024b5f0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14024b611
mov rdx, qword [rax - 8]
test dl, dl
je 0x14024b682
test dh, dh
je 0x14024b67c
shr rdx, 0x10
test dl, dl
je 0x14024b676
test dh, dh
je 0x14024b670
shr rdx, 0x10
test dl, dl
je 0x14024b66a
test dh, dh
je 0x14024b664
shr edx, 0x10
test dl, dl
je 0x14024b65e
test dh, dh
jne 0x14024b611
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x1400dd2be
Capabilities:
Query or enumerate registry key

Disassembly:
jmp 0x140153ee0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x508
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xd2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x528]
mov rax, qword [0x140329a40]
xor rax, rbp
mov qword [rbp + 0x4b8], rax
lea rcx, [0x1403510a5]
call fcn.1400e103a
xor edx, edx
lea rcx, [rbp + 8]
call fcn.1400db6df
mov rax, qword [rbp + 0x4e0]
mov eax, dword [rax + 8]
or eax, 0x2001f
mov r9d, eax
mov r8, qword [rbp + 0x4e8]
mov rax, qword [rbp + 0x4e0]
mov rdx, qword [rax]
lea rcx, [rbp + 8]
call fcn.1400ddd59
mov dword [rbp + 0x34], eax
cmp dword [rbp + 0x34], 0
je 0x140153ff9
cmp dword [rbp + 0x34], 2
je 0x140153fdc
cmp dword [rbp + 0x34], 3
je 0x140153fdc
lea rcx, [0x14032eee8]
call fcn.1400e0b80
mov dword [rbp + 0x4b4], eax
mov ecx, dword [0x140327084]
add ecx, 7
mov r8d, ecx
lea rdx, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.38.33130_atlmfcinclude_atlbase.h
lea rcx, [rbp + 0x438]
call fcn.1400dca17
mov ecx, dword [rbp + 0x34]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp + 0x4e8]
mov qword [rsp + 0x20], rcx
lea r9, str.CRegKey::RecurseDeleteKey_:_Failed_to_Open_Key__Ts_Error___d__n
xor r8d, r8d
mov ecx, dword [rbp + 0x4b4]
mov edx, ecx
mov rcx, rax
call fcn.1400db068
mov eax, dword [rbp + 0x34]
mov dword [rbp + 0x464], eax
lea rcx, [rbp + 8]
call fcn.1400db8b0
mov eax, dword [rbp + 0x464]
jmp 0x1401540ac
mov dword [rbp + 0x74], 0x100
lea rax, [rbp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x74]
lea r8, [rbp + 0xa0]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14015407b
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 8]
call fcn.1400dd2be
mov dword [rbp + 0x34], eax
cmp dword [rbp + 0x34], 0
je 0x140154072
mov eax, dword [rbp + 0x34]
mov dword [rbp + 0x484], eax
lea rcx, [rbp + 8]
call fcn.1400db8b0
mov eax, dword [rbp + 0x484]
jmp 0x1401540ac
mov dword [rbp + 0x74], 0x100
jmp 0x140154000
lea rcx, [rbp + 8]
call fcn.1400dd08e
mov rdx, qword [rbp + 0x4e8]
mov rcx, qword [rbp + 0x4e0]
call fcn.1400db89c
mov dword [rbp + 0x4a4], eax
lea rcx, [rbp + 8]
call fcn.1400db8b0
mov eax, dword [rbp + 0x4a4]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1402af450]
call fcn.1400dfc67
mov rax, rdi
mov rcx, qword [rbp + 0x4b8]
xor rcx, rbp
call fcn.1400dd6a1
lea rsp, [rbp + 0x4c8]
pop rdi
pop rbp
ret