joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e0900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x7ff
movzx ecx, word [rcx + 6]
mov esi, edx
shr cx, 4
and cx, bp
cmp cx, bp
jne 0x1401e0961
test byte [rbx + 6], 0xf
jne 0x1401e0954
xor edi, edi
cmp word [rbx + 4], di
jne 0x1401e0954
cmp word [rbx + 2], di
jne 0x1401e0954
cmp word [rbx], di
jne 0x1401e0954
lea esi, [rdi + 1]
jmp 0x1401e0959
mov esi, 2
movzx eax, si
jmp 0x1401e0b5e
xor edi, edi
test cx, cx
jne 0x1401e097c
mov rcx, rbx
call fcn.1401e8d4c
movzx ecx, ax
cmp di, ax
jl 0x1401e0b5b
movsx edx, cx
test esi, esi
jle 0x1401e09ac
sub ebp, edx
cmp ebp, esi
jg 0x1401e09ac
movsd xmm0, qword [0x14024bfa8]
cmp word [rbx + 6], di
jge 0x1401e099e
xorps xmm0, xmmword [0x14029f7c0]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x1401e0b5e
movzx r11d, word [rbx + 6]
mov eax, edx
neg eax
cmp eax, esi
jge 0x1401e09d9
add si, cx
mov eax, 0x800f
shl si, 4
and r11w, ax
or si, r11w
mov word [rbx + 6], si
or eax, 0xffffffff
jmp 0x1401e0b5e
movzx r15d, r11w
lea ebp, [rsi - 1]
and r11w, 0xf
mov r13d, 0x8000
mov r12d, reloc.WS2_32.dll_recv
and r15w, r13w
or r11w, r12w
add ebp, edx
cmp ebp, 0xffffffcb
jl 0x1401e0b50
test ebp, ebp
jns 0x1401e0b50
lea esi, [r12 - 0xf]
movzx r14d, di
cmp bp, 0xfff0
jg 0x1401e0a74
movzx ecx, word [rbx + 4]
mov eax, 0xfff0
movzx edx, word [rbx + 2]
sub ax, bp
shr ax, 4
movzx r9d, r11w
add ax, si
movzx r8d, ax
movzx eax, r8w
shl ax, 4
add bp, ax
test r14w, r14w
mov eax, edi
setne al
movzx r14d, ax
or r14w, word [rbx]
mov word [rbx], dx
movzx edx, cx
movzx ecx, r9w
mov r9d, edi
sub r8, rsi
jne 0x1401e0a45
mov word [rbx + 4], cx
movzx r11d, di
mov word [rbx + 2], dx
neg bp
je 0x1401e0af3
movzx r8d, word [rbx]
mov eax, edi
movzx r9d, word [rbx + 2]
movzx edx, r8w
movsx r10d, bp
sub r12d, r10d
mov ecx, r12d
shl dx, cl
test r14w, r14w
movzx r14d, dx
movzx edx, word [rbx + 4]
setne al
or r14w, ax
movzx eax, r9w
shl ax, cl
movzx ecx, bp
shr r8w, cl
mov ecx, r12d
or ax, r8w
mov word [rbx], ax
movzx eax, dx
shl ax, cl
movzx ecx, bp
shr r9w, cl
mov ecx, r12d
or ax, r9w
mov word [rbx + 2], ax
movzx eax, r11w
shl ax, cl
movzx ecx, bp
shr dx, cl
mov ecx, r10d
or ax, dx
mov word [rbx + 4], ax
shr r11w, cl
or r11w, r15w
mov word [rbx + 6], r11w
cmp r13w, r14w
jb 0x1401e0b09
jne 0x1401e0b28
test byte [rbx], sil
je 0x1401e0b28
add word [rbx], si
jne 0x1401e0b28
add word [rbx + 2], si
jne 0x1401e0b28
add word [rbx + 4], si
jne 0x1401e0b28
add r11w, si
mov word [rbx + 6], r11w
jmp 0x1401e09d1
cmp r11w, r15w
jne 0x1401e09d1
cmp word [rbx + 4], di
jne 0x1401e09d1
cmp word [rbx + 2], di
jne 0x1401e09d1
cmp word [rbx], di
je 0x1401e0b5b
jmp 0x1401e09d1
mov word [rbx + 6], r15w
mov dword [rbx + 2], edi
mov word [rbx], di
movzx eax, di
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000574c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005578
Function at 0x18000ec30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov r9d, 0x6f
xor r8d, r8d
xor edx, edx
lea rcx, [section..data]
call fcn.180016320
xor edi, edi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], dil
lea r9, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov ecx, 0x93
call fcn.180009960
test al, al
jne 0x18000ed53
mov eax, 0x7678
mov word [rsp + 0x38], ax
mov byte [rsp + 0x3a], dil
lea r8d, [rdi + 4]
lea rdx, [0x180028051]
lea rcx, [rsp + 0x38]
call fcn.18001d320
movzx eax, word [0x18002807e]
mov word [rsp + 0x3e], ax
movzx eax, byte [0x180028080]
mov byte [rsp + 0x40], al
mov eax, 0x2020
mov word [rsp + 0x41], ax
mov byte [rsp + 0x43], dil
lea rax, [rsp + 0x38]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x18000ece6
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x48], rdi
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x30]
mov edx, ebx
lea rcx, [rsp + 0x38]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
test eax, eax
jne 0x18000ee3e
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
mov edx, ebx
lea rcx, [rsp + 0x38]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18000ed3b
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18000ee3e
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18000ee3e
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
movsd xmm0, qword [0x1800360a8]
mulsd xmm0, qword [0x18002a3e0]
addsd xmm0, qword [0x18002a3d0]
cvttsd2si rax, xmm0
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x78]
lea rdx, [0x180036028]
mov ecx, 0x69
call fcn.18000e310
lea r9, [rsp + 0x58]
xor r8d, r8d
lea edx, [r8 + 0x30]
xor ecx, ecx
call fcn.18000c6d0
test al, al
jne 0x18000edcd
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
jmp 0x18000edf2
call qword [sym.imp.dbghelp.dll_ImagehlpApiVersion]
lea rdx, [rbp - 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor r8d, r8d
mov edx, 0xff
xor ecx, ecx
call fcn.18000ef00
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x18000ee2b
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ee26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ee91
call fcn.1800186c0
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x18000ee76
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ee71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ee8b
call fcn.1800186c0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.18001ced4
nop
call fcn.18001ced4
nop
int3
Function at 0x180011be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push r13
push r14
push r15
sub rsp, 0x150
lea r13d, [r8 - 6]
mov r14, rdx
mov r15d, r8d
mov rdx, rcx
cmp r8d, r13d
jbe 0x180011dde
mov qword [rax + 0x10], rbx
lea r8, [0x180000000]
movzx ebx, byte [rsp + 0x180]
mov qword [rax - 0x20], rbp
mov rbp, qword [rsp + 0x188]
mov qword [rax - 0x28], rsi
movzx esi, byte [rsp + 0x180]
mov qword [rax - 0x30], rdi
movzx edi, byte [rsp + 0x180]
mov qword [rax - 0x38], r12
mov r12d, dword [rsp + 0x180]
nop dword [rax]
lea eax, [r15 - 0x23]
cmp eax, 8
ja case.0x180011c68.38
mov ecx, dword [r8 + rax*4 + 0x11dec]
add rcx, r8
jmp rcx
mov rcx, qword [0x180036b28]
xor r8d, r8d
mov edx, 0xab
call fcn.1800116e0
mov rcx, qword [0x180036b28]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x78]
call fcn.180005190
mov rcx, qword [r14]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je case.0x180011c68.42
mov r15d, 0x29
jmp case.0x180011c68.38
xor ebp, ebp
mov r9, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x180011cc7
mov r9, qword [rdx]
mov eax, dword [rdx + 0x10]
lea r8, [rsp + 0x20]
mov edx, 0x13f
mov dword [rsp + 0x180], eax
lea rcx, [rsp + 0x180]
call fcn.1800132a0
movzx ebx, byte [rsp + 0x120]
movzx edi, byte [rsp + 0x121]
jmp case.0x180011c68.38
mov r12d, 0x1388
jmp case.0x180011c68.38
cmp qword [r14 + 0x18], 0x10
mov r9, r14
jb 0x180011d15
mov r9, qword [r14]
cmp rbp, qword [r14 + 0x10]
jae 0x180011d8a
nop dword [rax + rax]
mov r8d, 0x81
mov eax, r8d
sub eax, 0x81
je 0x180011d5a
cmp eax, 1
jne 0x180011d78
movzx eax, dil
mov byte [rsp + rax + 0x20], sil
movzx eax, bl
movzx ecx, byte [rsp + rax + 0x20]
add cl, sil
movzx eax, cl
movzx ecx, byte [rsp + rax + 0x20]
xor byte [r9 + rbp], cl
inc rbp
jmp 0x180011d78
inc bl
lea rdx, [rsp + 0x20]
movzx eax, bl
add rdx, rax
movzx esi, byte [rdx]
add dil, sil
movzx eax, dil
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rdx], cl
inc r8d
cmp r8d, 0x83
jb 0x180011d26
cmp rbp, qword [r14 + 0x10]
jb 0x180011d20
mov byte [rsp + 0x120], bl
jmp case.0x180011c68.38
mov byte [rsp + 0x121], dil
mov rdx, qword [rsp + 0x170]
lea r8, [0x180000000]
dec r15d
cmp r15d, r13d
ja 0x180011c50
mov r12, qword [rsp + 0x130]
mov rdi, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x140]
mov rbp, qword [rsp + 0x148]
mov rbx, qword [rsp + 0x178]
add rsp, 0x150
pop r15
pop r14
pop r13
ret
Function at 0x140002a88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002ad2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002ad2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002ad2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002ad2
cmp dword [rcx + 0x84], 0xe
jbe 0x140002ad2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002ad4
xor al, al
add rsp, 0x28
ret

Function at 0x14000c934
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000c730
Function at 0x14001271c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001274c
xor eax, eax
jmp 0x14001280f
mov rbp, rbx
cmp word [rax], si
je 0x140012771
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140012758
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140012754
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14001263c
movsxd r14, eax
test eax, eax
jne 0x1400127af
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140012745
mov rcx, r14
call fcn.14000e030
mov rdi, rax
test rax, rax
jne 0x1400127c8
xor ecx, ecx
call fcn.14000d3b8
jmp 0x1400127a4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14001263c
test eax, eax
jne 0x1400127f9
mov rcx, rdi
call fcn.14000d3b8
jmp 0x140012803
xor ecx, ecx
call fcn.14000d3b8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400169fc
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140016a12
mov al, 1
jmp 0x140016a72
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140016a23
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140016a70
mov ecx, dword [rcx + 0x18]
nop
call fcn.140012f84
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140016a70
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140016a70
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140016a70
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140016a72
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400182e8
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140010cac
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140018372
cmp byte [rbp - 0x21], r15b
je 0x14001836d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400183a8
call fcn.14000d608
test eax, eax
jne 0x140018394
cmp byte [rbp - 0x21], r15b
je 0x14001838c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400183a8
cmp byte [rbp - 0x21], r15b
je 0x1400183a5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140010b30
test eax, eax
jne 0x140018448
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140010cac
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400183e7
cmp byte [rbp - 0x21], r15b
je 0x14001841c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14001841c
call fcn.14000d608
test eax, eax
jne 0x140018408
cmp byte [rbp - 0x21], r15b
je 0x140018401
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14001841c
cmp byte [rbp - 0x21], r15b
je 0x140018419
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140010b30
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140018448
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14001844b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140018459
mov rcx, rdi
call fcn.14000d3b8
cmp byte [rbp + 0x3f], r15b
je 0x140018468
mov rcx, qword [rbp + 0x27]
call fcn.14000d3b8
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14001aa50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001aa78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001aa78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140008b60
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140085220]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.1400295e0
lea rdx, [rsp + 0x20]
lea rcx, str._SYSTEMDRIVE_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, 0x104
jbe 0x140008bbe
xor al, al
jmp 0x140008c0d
test rbx, rbx
je 0x140008bc7
lea rdi, [rbx + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140007490
lea rdx, str.Intel
mov rcx, rax
call fcn.140007490
lea rdx, str.Logs
mov rcx, rax
call fcn.140007490
lea rdx, str.IntelCpHDCPSvc.log
mov rcx, rax
call fcn.140007490
xor edx, edx
mov rcx, rax
call fcn.14000c0f0
mov al, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400295b0
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret

Function at 0x140008ed0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140085220]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x140009035
cmp byte [rcx + 0x82], 0
je 0x140009035
mov rax, qword [rcx]
mov ebx, 0xffff
mov edx, ebx
call qword [rax + 0x18]
cmp bx, ax
jne 0x140008f2b
xor al, al
jmp 0x140009037
mov qword [rsp + 0x58], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rsp + 0x40]
call fcn.14000a420
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x40]
cmovae r8, qword [rsp + 0x40]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rsp + 0x50]
add r9, rdx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x140008f9e
dec eax
jne 0x140009013
jmp 0x140008fa5
mov byte [rdi + 0x82], 0
lea rax, [rsp + 0x40]
mov r9, qword [rsp + 0x40]
mov r10, qword [rsp + 0x58]
cmp r10, 0x10
cmovae rax, r9
mov rbx, qword [rsp + 0x38]
sub rbx, rax
je 0x140008fec
lea rcx, [rsp + 0x40]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call fcn.14002a018
cmp rbx, rax
jne 0x140009018
cmp byte [rdi + 0x82], 0
je 0x14000901c
test rbx, rbx
jne 0x140008f54
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rsp + 0x40]
call fcn.14000a300
jmp 0x140008f54
sub eax, 2
je 0x14000901c
xor bl, bl
jmp 0x14000901e
mov bl, 1
cmp qword [rsp + 0x58], 0x10
jb 0x140009030
mov rcx, qword [rsp + 0x40]
call fcn.14002823c
movzx eax, bl
jmp 0x140009037
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400295b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000bdd0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rax, qword [0x140085220]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r14d, dx
mov rbx, rcx
mov esi, 0xffff
cmp si, dx
jne 0x14000be1a
xor eax, eax
jmp 0x14000bfe8
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14000be57
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x14000be57
lea ecx, [r9 - 1]
mov dword [rax], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], r14w
movzx eax, r14w
jmp 0x14000bfe8
cmp qword [rcx + 0x90], 0
je 0x14000bfe5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x80]
cmp qword [r8], rax
jne 0x14000be93
mov rdx, qword [rcx + 0x70]
mov rcx, qword [rcx + 0x68]
mov qword [r8], rcx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
sub rdx, rcx
sar rdx, 1
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp qword [rbx + 0x78], 0
jne 0x14000bebc
mov rdx, qword [rbx + 0x90]
movzx ecx, r14w
call fcn.14002a794
cmp ax, si
je 0x14000bfe5
movzx esi, r14w
jmp 0x14000bfe5
mov word [rbp - 1], r14w
mov qword [rbp + 0x1f], reloc.OLEAUT32.dll_SafeArrayDestroy
xor eax, eax
mov qword [rbp + 0x17], rax
mov byte [rbp + 7], al
xor r8d, r8d
lea edx, [rax + 8]
lea rcx, [rbp + 7]
call fcn.14000a420
nop
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdx, qword [rbp + 7]
lea r8, [rbp + 7]
cmovae r8, qword [rbp + 7]
mov rcx, qword [rbx + 0x78]
mov r10, qword [rcx]
add rdx, qword [rbp + 0x17]
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 1]
lea r8, [rbp - 1]
lea rdx, [rbx + 0x84]
call qword [r10 + 0x38]
test eax, eax
js 0x14000bfd5
cmp eax, 1
jg 0x14000bfb7
lea rax, [rbp + 7]
mov r9, qword [rbp + 7]
mov r10, qword [rbp + 0x1f]
cmp r10, 0x10
cmovae rax, r9
mov rdi, qword [rbp - 9]
sub rdi, rax
je 0x14000bf82
lea rcx, [rbp + 7]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rbx + 0x90]
mov r8, rdi
mov edx, 1
call fcn.14002a018
cmp rdi, rax
jne 0x14000bfd5
mov byte [rbx + 0x82], 1
lea rax, [rbp - 1]
cmp qword [rbp - 0x11], rax
jne 0x14000bfd1
test rdi, rdi
jne 0x14000bee2
cmp qword [rbp + 0x17], 0x20
jae 0x14000bfd5
xor r8d, r8d
lea edx, [rdi + 8]
lea rcx, [rbp + 7]
call fcn.14000a300
jmp 0x14000bee2
cmp eax, 3
jne 0x14000bfd5
mov rdx, qword [rbx + 0x90]
movzx ecx, word [rbp - 1]
call fcn.14002a794
cmp ax, si
je 0x14000bfd5
movzx esi, r14w
cmp qword [rbp + 0x1f], 0x10
jb 0x14000bfe5
mov rcx, qword [rbp + 7]
call fcn.14002823c
movzx eax, si
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400295b0
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000e7b0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14000e7de
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140011e60
cmp byte [0x1400892f0], 0
jne 0x14000e829
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000e819
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1400892f0], 1
mov qword [0x1400892e8], rax
jmp 0x14000e830
mov rax, qword [0x1400892e8]
mov byte [0x1400892f0], 1
jmp 0x14000e830
mov rax, qword [0x1400892e8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000e84f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140011ed4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x140011eef
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140011eef
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x140011eef
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
and ebp, dword [rdi - 0x4a0e58b]
rcl dword ds:[rsi], 0x21
mov ebp, 0x134919d4
pabsd mm4, qword [rsi]
scasd eax, dword [rdi]
movabs byte [0x8b875c5f195a1841], al
invalid