joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f828
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14000f848
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000db54
or eax, 0xffffffff
jmp 0x14000f84a
xor eax, eax
add rsp, 0x28
ret

Function at 0x14000fb78
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x14000f8b7
call fcn.14000dbc4
mov dword [rax], 0x16
call fcn.140012fc0
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400085d0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test rcx, rcx
je 0x14000f87e
mov dword [rsp + 0x28], esi
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000f925
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x14000f8f8
cmp eax, 3
jbe 0x14000f915
cmp eax, 8
je 0x14000f905
cmp eax, 0x12
je 0x14000f915
call fcn.14000dbc4
mov dword [rax], 0x16
jmp 0x14000f88e
call fcn.14000dbc4
mov dword [rax], ntohl
jmp 0x14000f88e
call fcn.14000dbc4
mov dword [rax], 2
jmp 0x14000f88e
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.14000fac0
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.14000fac0
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.14000fac0
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.140018298
test eax, eax
jne 0x14000f983
mov rax, rdi
jmp 0x14000f892
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140012fe0
int3
jmp 0x14000f850
Function at 0x14000fb80
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edi, edi
mov rbx, rdx
test rcx, rcx
jne 0x14000f9f5
call fcn.14000dbc4
mov dword [rax], 0x16
call fcn.140012fc0
or eax, 0xffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400085d0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret
cmp rcx, 0xffffffffffffffff
je 0x14000f9c1
test rdx, rdx
je 0x14000f9c1
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000fa50
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x14000fa29
cmp eax, 3
jbe 0x14000fa43
cmp eax, 8
je 0x14000fa36
cmp eax, 0x12
je 0x14000fa43
call fcn.14000dbc4
mov dword [rax], 0x16
jmp 0x14000f9d1
call fcn.14000dbc4
mov dword [rax], ntohl
jmp 0x14000f9d1
call fcn.14000dbc4
mov dword [rax], 2
jmp 0x14000f9d1
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, edi
mov dword [rbx], eax
call fcn.14000fac0
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.14000fac0
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.14000fac0
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.140018298
test eax, eax
je 0x14000f9d4
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140012fe0
int3
jmp 0x14000f998

Function at 0x140010698
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400106b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000db54
or eax, 0xffffffff
jmp 0x1400106ba
xor eax, eax
add rsp, 0x28
ret
Function at 0x140011a88
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14001185c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001185c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001185c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001185c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001185c
cmp dword [rcx + 0x84], 0xe
jbe 0x14001185c
cmp dword [rcx + 0xf8], esi
je 0x14001185c
mov ecx, r14d
call fcn.1400119a4
mov ecx, 2
call fcn.140018108
nop
cmp byte [0x14003c730], 0
jne 0x140011926
mov r15d, 1
mov eax, r15d
xchg dword [0x14003c724], eax
test ebx, ebx
jne 0x1400118cf
mov rdi, qword [0x140032010]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14003c728]
cmp rcx, rax
je 0x1400118c6
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.1400093d0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14003c740]
jmp 0x1400118db
cmp ebx, r15d
jne 0x1400118e1
lea rcx, [0x14003c758]
call fcn.140011f58
nop
test ebx, ebx
jne 0x1400118f8
lea rdx, [0x1400223b8]
lea rcx, [0x140022390]
call fcn.14001171c
lea rdx, [0x1400223c8]
lea rcx, [0x1400223c0]
call fcn.14001171c
movzx eax, byte [0x14003c730]
test esi, esi
cmove eax, r15d
mov byte [0x14003c730], al
jmp 0x140011926
mov ecx, 2
call fcn.14001815c
test esi, esi
jne 0x14001193d
mov ecx, r14d
call fcn.140011958
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400117ec
Function at 0x140014020
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140013ec0
call fcn.14000dbc4
mov dword [rax], 0x16
call fcn.140012fc0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140013ea8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140013ea8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140013ef2
lock or dword [rax + 0x14], 0x10
jmp 0x140013ea8
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140013f0f
mov rcx, qword [rbp + 0x10]
call fcn.14001b13c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14000f108
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400138f8
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140013f66
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140013ea8
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140013fd2
mov rcx, qword [rbp + 0x10]
call fcn.14000f108
cmp eax, 0xffffffff
je 0x140013fb9
mov rcx, qword [rbp + 0x10]
call fcn.14000f108
cmp eax, 0xfffffffe
je 0x140013fb9
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14000f108
movsxd rdi, eax
lea rsi, [0x14003c780]
mov rcx, rbx
sar rdi, 6
call fcn.14000f108
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140013fc0
lea rax, [0x140032270]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140013fd2
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140014008
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140014004
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140014004
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140013eab
jmp 0x140013e78
Function at 0x140771528
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407716af
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140771559
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077153f
add dl, dl
jne 0x140771566
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407715c6
xor eax, eax
add dl, dl
jne 0x140771575
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077167d
add dl, dl
jne 0x140771586
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140771593
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407715a0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407715ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407715ba
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14077154e
mov eax, 1
add dl, dl
jne 0x1407715d6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407715e3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407715cb
sub eax, ebx
mov ebx, 1
jne 0x14077161c
mov ecx, 1
add dl, dl
jne 0x1407715fe
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14077160b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407715f3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077154e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140771638
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140771645
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14077162d
cmp eax, 0x7d00
jae 0x14077166b
cmp eax, 0x500
jb 0x140771666
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077154e
cmp eax, 0x7f
ja 0x14077166e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077154e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407716a2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14077154e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001d50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [0x14002d080]
xor rax, rsp
mov qword [rbp + 0x590], rax
lea rcx, [0x140029a70]
jmp 0x140d8904a

Function at 0x140003794
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14000ccac
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000cad0
Function at 0x1400048b0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1400260f0]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rcx
xor ecx, ecx
xor r8d, r8d
mov edi, dword [rsi + 8]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsi]
or edi, 0x2001f
mov r9d, edi
mov qword [rsp + 0x70], rdx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140004a07
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140004933
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
and edi, 0x300
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], edi
test ebx, ebx
jne 0x140004a07
xor edi, edi
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x80]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], pe_nt_image_headers64
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400049df
nop word [rax + rax]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.1400048b0
mov ebx, eax
test eax, eax
jne 0x140004a07
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x80]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], pe_nt_image_headers64
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140004990
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400049f4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rdi
mov rdx, qword [rsp + 0x70]
mov rcx, rsi
mov dword [rsp + 0x50], edi
call fcn.140004b90
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140004a17
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14000a330
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004ae0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140004b54
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x140004b6f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140004b6f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x140004b6f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140004bbe
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140004ae0
cmp byte [0x140029008], 0
jne 0x140004c09
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004bf9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x140029008], 1
mov qword [0x140029000], rax
jmp 0x140004c10
mov rax, qword [0x140029000]
mov byte [0x140029008], 1
jmp 0x140004c10
mov rax, qword [0x140029000]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140004c2f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jbe 0x14003c12a
pop rax
invalid
pop rax
pop rsi
mov ecx, 0xfff02b54
sub esi, eax
push qword [rbx - 1]
loopne 0x14003c101
scasb al, byte [rdi]
push rbp
invalid
Function at 0x140004b90
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140004b54
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x140004b6f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140004b6f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x140004b6f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x140004bbe
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140004ae0
cmp byte [0x140029008], 0
jne 0x140004c09
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004bf9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x140029008], 1
mov qword [0x140029000], rax
jmp 0x140004c10
mov rax, qword [0x140029000]
mov byte [0x140029008], 1
jmp 0x140004c10
mov rax, qword [0x140029000]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140004c2f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jbe 0x14003c12a
pop rax
invalid
pop rax
pop rsi
mov ecx, 0xfff02b54
sub esi, eax
push qword [rbx - 1]
loopne 0x14003c101
scasb al, byte [rdi]
push rbp
invalid
Function at 0x140005870
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1400260f0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1400058fe
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1400058fe
call fcn.140003990
mov ebx, eax
jmp 0x140005a26
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14000591f
call fcn.140003990
jmp 0x140005a15
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140005942
call fcn.140003990
jmp 0x140005a15
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x140005964
mov ebx, 0x8007000e
jmp 0x140005a17
mov ecx, eax
test eax, eax
je 0x14000599c
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140005992
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000599c
lea rcx, [rsp + 0x70]
call fcn.140003960
jmp 0x1400059a6
mov ecx, 0x80070216
call fcn.140005fe0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x1400059b9
cmp qword [rsp + 0x70], 0
jne 0x1400059c8
mov ebx, 0x8007000e
jmp 0x140005a17
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1400059f2
call fcn.140003990
jmp 0x140005a15
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140005680
mov ebx, eax
test rdi, rdi
je 0x140005a26
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x140005a3d
lea rcx, [rsp + 0x70]
call fcn.140003940
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14000a330
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x140006610
Capabilities:
Get common file path
Get program files directory

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1400260f0]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor r9d, r9d
mov rbx, rdx
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x14000664d
mov eax, 0x80004005
jmp 0x14000665d
lea rcx, [rsp + 0x20]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000a330
add rsp, 0x240
pop rbx
ret
Function at 0x140006680
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1400260f0]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor r9d, r9d
mov rbx, rdx
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x2b]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x1400066bd
mov eax, 0x80004005
jmp 0x1400066cd
lea rcx, [rsp + 0x20]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000a330
add rsp, 0x240
pop rbx
ret

Function at 0x1400066f0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1400260f0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140006736
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140006746
movzx eax, ax
or eax, 0x80070000
jmp 0x140006746
lea rcx, [rsp + 0x20]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000a330
add rsp, 0x240
pop rbx
ret

Function at 0x140006760
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1400260f0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x1400067a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400067b6
movzx eax, ax
or eax, 0x80070000
jmp 0x1400067b6
lea rcx, [rsp + 0x20]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000a330
add rsp, 0x240
pop rbx
ret
Function at 0x140007180
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x14000726e
lea rdx, str.LookupAccountNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsValidSid
mov rcx, rbx
mov qword [rdi + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSidToSidW
mov rcx, rbx
mov qword [rdi + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetNamedSecurityInfoW
mov rcx, rbx
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetEntriesInAclW
mov rcx, rbx
mov qword [rdi + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetNamedSecurityInfoW
mov rcx, rbx
mov qword [rdi + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AllocateAndInitializeSid
mov rcx, rbx
mov qword [rdi + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateWellKnownSid
mov rcx, rbx
mov qword [rdi + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopySid
mov rcx, rbx
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FreeSid
mov rcx, rbx
mov qword [rdi + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x50], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret