joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a44b
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rax
mov dword [0x140034720], eax
mov eax, dword [0x140034720]
cmp eax, 0xffffffff
jne 0x14002a472
call sym.abort
nop
add rsp, 0x20
pop rbp
ret

Function at 0x14002a625
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xffffffffffffffff
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x140040f30]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x140034720]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14002a678
mov rax, qword [rbp - 0x10]
jmp 0x14002a7d8
call sym.pop_pthread_mem
mov qword [rbp - 0x10], rax
mov rax, qword [sym.__dyn_tls_pthread]
test rax, rax
je 0x14002a694
cmp qword [rbp - 0x10], 0
jne 0x14002a69e
mov eax, 0
jmp 0x14002a7d8
mov rax, qword [rbp - 0x10]
mov dword [rax + 0x44], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0x70], eax
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov rdx, qword [rbp - 0x10]
mov qword [rdx + 0x30], rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
lea rcx, [rax + 0x68]
mov rax, qword [rbp - 8]
mov rdx, rax
call sym.replace_spin_keys
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xb8], 0
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
lea rdi, [rax + 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rsi, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdi
mov r8, rsi
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call rax
test eax, eax
jne 0x14002a779
call sym.abort
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadPriority]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0xc0], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 0
mov rax, qword [rbp - 0x10]
movzx edx, byte [rax + 0x40]
and edx, 0xffffffcf
or edx, 0x10
mov byte [rax + 0x40], dl
mov eax, dword [0x140034720]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
test eax, eax
jne 0x14002a7d4
call sym.abort
mov rax, qword [rbp - 0x10]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14002a8d2
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 0x10], 0
mov rax, qword [rbp + 0x10]
mov dword [rbp - 4], eax
call sym.__pthread_self_lite
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 0x40]
and eax, 0x30
test al, al
jne 0x14002a93f
mov rax, qword [rbp - 0x18]
add rax, 0xd0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_longjmp]
call rax
mov eax, dword [0x140034720]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14002aa83
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14002a9dc
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14002a997
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 0x10], 0
mov eax, dword [0x140034720]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x14002aa83
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 1
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14002aa16
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x44]
and eax, 4
test eax, eax
je 0x14002aa83
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 0x10], 0
mov eax, dword [0x140034720]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x14002b6c5
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
call sym._fpreset
lea rax, [0x140034730]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x140040f30]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x140034720]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 8]
mov dword [rdx + 0x70], eax
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rdx, rbp
mov rax, qword [rbp - 8]
add rax, 0xd0
mov rcx, rax
call sym._setjmp
test eax, eax
jne 0x14002b7da
mov qword [rbp - 0x10], pe_nt_image_headers64
lea rax, [0x140034730]
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x14002b7a8
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rcx, rax
call rdx
mov qword [rbp - 0x10], rax
nop
nop
lea rax, [0x140034730]
mov rcx, rax
call sym.pthread_mutex_lock
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
jmp 0x14002b7e9
lea rax, [0x140034730]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14002b825
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14002b893
mov rax, qword [rbp - 8]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 8], 0
mov eax, dword [0x140034720]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x14002b8dd
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 8]
mov dword [rax + 0xbc], 1
jmp 0x14002b8dd
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x140034730]
mov rcx, rax
call sym.pthread_mutex_unlock
test eax, eax
je 0x14002b8cf
mov eax, dword [rbp - 0x14]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x1000d580
Capabilities:
Delete registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xc8
mov rax, qword [0x10014030]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movdqu xmm0, xmmword [rcx]
mov rbp, rdx
mov rsi, r8
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
movdqu xmmword [rsp + 0x20], xmm0
mov rbx, r9
call fcn.1000abf0
xor eax, eax
lea rcx, [rax - 1]
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
not ecx
add rcx, 6
cmp rcx, 0x40
jbe 0x1000d5eb
mov eax, 0x80070057
jmp 0x1000d69a
lea r8, [0x10003ed8]
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.MSVCR80.dll_wcscpy_s]
lea r8, [rsp + 0x30]
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.MSVCR80.dll_wcscat_s]
lea rdx, [0x10003ef8]
mov rcx, rsi
call fcn.1000cef0
lea rdx, [0x10003ee8]
mov rcx, rsi
call fcn.1000cef0
mov rdi, 0xffffffff80000000
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [0x10003ee8]
mov rcx, rbp
call fcn.1000cef0
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [0x10003f08]
mov rcx, rbx
call fcn.1000cef0
lea rdx, [0x10003f18]
mov rcx, rbx
call fcn.1000cef0
lea rdx, [0x10003f50]
mov rcx, rbx
call fcn.1000cef0
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.10007870
add rsp, 0xc8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140008f10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x298
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x40], rdx
mov rbx, rdx
mov rcx, qword [rcx]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rdx
mov r10, r9
mov rax, r8
mov dword [rsp + 0x40], 0x104
xor edi, edi
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x28], rdx
mov r8, r10
mov rdx, rax
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 2]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edx, eax
test eax, eax
jne 0x140008fc8
mov qword [rbx], rdi
lea rax, [rsp + 0x70]
mov qword [rbx + 0x10], rdi
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], 7
mov word [rbx], di
inc r8
cmp word [rax + r8*2], di
jne 0x140008f94
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.1400027d0
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140070140
add rsp, 0x298
pop rdi
pop rbx
ret
call fcn.1400033d0
mov r8, rax
lea r9, str.Unable_to_get_registry_value
lea rcx, [rsp + 0x48]
call fcn.140009370
lea rdx, [0x1400dc6c0]
lea rcx, [rsp + 0x48]
call fcn.140071fb4
int3
Function at 0x140009410
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor esi, esi
mov dword [rsp + 0x30], esi
mov qword [rcx], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
mov dword [rsp + 0x30], 1
mov edx, 0xff
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, esi
nop dword [rax + rax]
cmp edi, 0x1fe
ja 0x1400094cf
movsxd rax, edi
movzx r9d, word [rsp + rax*2 + 0x80]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400094c3
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 8
jb 0x1400094b5
mov rax, qword [rbx]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], si
inc edi
jmp 0x140009480
mov rcx, rbx
call fcn.1400177a0
inc edi
jmp 0x140009480
movsxd r13, dword [rbx + 0x10]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], si
mov r8d, 1
lea rdx, [0x1400bc204]
lea rcx, [rsp + 0x60]
call fcn.1400027d0
nop
lea r9, [rsp + 0x60]
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x78]
cmp r15, 8
cmovae r9, rdi
mov r14, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000952b
mov rcx, qword [rbx]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r14
call fcn.1400176b0
test eax, eax
je 0x14000958f
inc eax
movsxd rdx, eax
cmp r14, rdx
jb 0x140009694
mov r9, r13
mov rax, r14
sub rax, rdx
cmp rax, r13
cmovb r9, rax
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000956f
mov rax, qword [rbx]
lea rcx, [rax + rdx*2]
sub r14, r9
mov qword [rbx + 0x10], r14
sub r14, rdx
lea r8, [r14*2 + 2]
lea rdx, [rcx + r9*2]
call fcn.140072090
nop
cmp r15, 8
jb 0x1400095cb
lea rdx, [r15*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400095c2
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000969a
mov rcx, rdi
call fcn.140070654
nop
jmp 0x1400095d4
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400095f9
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140014b80
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea rcx, str.CommonHelperUtilities::GetOSDrive:__s
call fcn.1400262b0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140009663
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000965e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400096a0
call fcn.140070654
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140070140
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.140015b70
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
int3
Function at 0x1400096f0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov byte [rsp + 0x10], dl
push rdi
sub rsp, 0xf0
mov rdi, r8
xor bl, bl
mov byte [rsp + 0x108], bl
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r11 - 0x74], xmm0
movups xmmword [r11 - 0x64], xmm0
movups xmmword [r11 - 0x54], xmm0
movups xmmword [r11 - 0x44], xmm0
movups xmmword [r11 - 0x34], xmm0
movups xmmword [r11 - 0x24], xmm0
mov dword [r11 - 0x14], eax
mov dword [r11 - 0x78], 0x68
movups xmmword [rsp + 0x68], xmm0
mov qword [r11 - 0x80], rax
xorps xmm1, xmm1
movups xmmword [rsp + 0x50], xmm1
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], 0x18
mov dword [rsp + 0x60], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [r11 - 0x78]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], eax
xor r9d, r9d
lea r8, [rsp + 0x50]
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400097cb
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rdi], 0
sete bl
mov byte [rsp + 0x108], bl
jmp 0x1400097e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CommonHelperUtility::LaunchExeByCreateProcess___CreateProcess_failed__d_.
call fcn.140026280
nop
movzx eax, bl
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rdi
ret

Function at 0x140009810
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rsi, r8
movzx edx, dx
lea r8, [0x1400bc728]
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
mov rcx, rdi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov ebp, eax
mov qword [rsp + 0x30], rbx
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov rcx, rsi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x28], rbx
lea r8d, [rbx + 4]
mov rcx, rax
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor edx, edx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea edx, [rbx + 2]
xor r8d, r8d
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r8d, ebp
mov rdx, r14
mov rcx, rax
mov rbx, rax
call fcn.140072090
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
xor al, al
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000aa00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor edi, edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HTTP_shellopenddeexecApplication
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000aa98
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbx + 0x10], xmm1
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rax, rbx
jmp 0x14000ab31
mov word [rsp + 0x70], di
mov dword [rsp + 0x34], edi
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, [0x1400bc2c0]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ab0a
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000aaf0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1400027d0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x14000ab1d
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140070140
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rdi
ret

Function at 0x14000ab60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov qword [rsp + 0x30], 0
mov edx, ecx
lea rax, [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
test rcx, rcx
je 0x14000ac1b
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x14000abe8
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000abd0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400027d0
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x14000ac1b
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140070140
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
Function at 0x14000b370
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp + 0x27], rcx
mov qword [rbp + 0x2f], rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
mov dword [rbp - 0x49], 0x70
mov dword [rbp - 0x45], 0x140
lea rax, str.open
mov qword [rbp - 0x39], rax
mov rax, rcx
cmp qword [rcx + 0x18], 8
jb 0x14000b3e5
mov rax, qword [rcx]
mov qword [rbp - 0x31], rax
mov rax, rbx
cmp qword [rdx + 0x18], 8
jb 0x14000b3f6
mov rax, qword [rdx]
mov qword [rbp - 0x29], rax
xor esi, esi
mov dword [rbp - 0x19], esi
lea ecx, [rsi + 0x10]
call fcn.1400703c8
lea rcx, [rbp - 0x49]
mov qword [rax], rcx
mov qword [rbp - 0x59], rax
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14001ad60]
xor edx, edx
xor ecx, ecx
call fcn.140081e60
mov qword [rbp - 0x69], rax
test rax, rax
je 0x14000b537
cmp dword [rbp - 0x61], esi
je 0x14000b545
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x61], eax
je 0x14000b550
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x59], xmm0
xor edx, edx
lea rcx, [rbp - 0x59]
call fcn.14006e470
test eax, eax
jne 0x14000b55b
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x69], xmm0
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14000b4b9
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000b4b4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b566
mov rcx, r8
call fcn.140070654
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000b503
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000b4fe
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b531
mov rcx, r8
call fcn.140070654
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140070140
mov rbx, qword [rsp + 0x110]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
call fcn.14007d0fc
nop
mov dword [rbp - 0x61], esi
mov ecx, 6
call fcn.14006d898
nop
mov ecx, 1
call fcn.14006d898
int3
mov ecx, 5
call fcn.14006d898
int3
mov ecx, 2
call fcn.14006d898
nop
call fcn.14007d0fc
int3