joyce8/EMBER2024-capa huggingface dataset:
Function at 0x570f80
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x5711fc
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
movzx ecx, byte [rbx + 0x1f]
mov qword [rsp + 0x98], rcx
movzx edx, byte [rbx + 0x1e]
mov qword [rsp + 0x90], rdx
movzx esi, byte [rbx + 0x1d]
mov qword [rsp + 0x88], rsi
movzx edi, byte [rbx + 0x1c]
mov qword [rsp + 0x80], rdi
movzx r8d, byte [rbx + 0x1b]
mov qword [rsp + 0x78], r8
movzx r9d, byte [rbx + 0x1a]
mov qword [rsp + 0x70], r9
movzx r10d, byte [rbx + 0x19]
mov qword [rsp + 0x68], r10
movzx r11d, byte [rbx + 0x18]
mov qword [rsp + 0x60], r11
movzx r12d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r12
movzx r13d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r13
movzx r15d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r15
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r10d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r10
movzx r9d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r9
movzx r8d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r8
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r8d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r8
movzx r9d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r9
movzx r10d, byte [rbx + 9]
mov qword [rsp + 8], r10
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r15d, byte [rbx + 7]
shl r15, 0x38
movzx r13d, byte [rbx + 6]
shl r13, 0x30
movzx r12d, byte [rbx + 5]
shl r12, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r10d, byte [rbx + 3]
shl r10, 0x18
movzx r9d, byte [rbx + 2]
shl r9, 0x10
movzx r8d, byte [rbx + 1]
shl r8, 8
movzx ebx, byte [rbx]
add rbx, r8
add rbx, r9
add rbx, r10
add rbx, r11
add rbx, r12
add rbx, r13
add rbx, r15
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x98]
shl rcx, 0x38
mov rdx, qword [rsp + 0x90]
shl rdx, 0x30
mov rbx, qword [rsp + 0x88]
shl rbx, 0x28
mov rsi, qword [rsp + 0x80]
shl rsi, 0x20
mov rdi, qword [rsp + 0x78]
shl rdi, 0x18
mov r8, qword [rsp + 0x70]
shl r8, 0x10
mov r9, qword [rsp + 0x68]
shl r9, 8
mov r10, qword [rsp + 0x60]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004627a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00570f80
Function at 0x573c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x573e00
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
lea rax, [0x005f1800]
call fcn.0040d900
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x573c8b
mov rax, rdx
mov rcx, r10
mov rdx, qword [rsp + 0x30]
mov rbx, r8
mov rsi, qword [rsp + 0x60]
cmp rsi, rcx
jle 0x573db9
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x40]
mov ecx, 4
mov rdi, rcx
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x30]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
mov rdi, qword [rsp + 0x30]
call rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x20]
mov rax, qword [rsp + 0x78]
call rsi
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x20]
xor eax, eax
jmp 0x573de0
mov rdx, qword [rsp + 0x40]
movzx r11d, byte [rdx + 3]
lea r12d, [r11 + 1]
mov byte [rdx + 3], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x573c7d
movzx r11d, byte [rdx + 2]
lea r12d, [r11 + 1]
mov byte [rdx + 2], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x573c7d
movzx r11d, byte [rdx + 1]
lea r12d, [r11 + 1]
mov byte [rdx + 1], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x573c7d
movzx r11d, byte [rdx]
inc r11d
mov byte [rdx], r11b
jmp 0x573c7d
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx r11d, byte [r10 + rsi]
movzx r12d, byte [r8 + rax]
xor r11d, r12d
mov byte [rsi + r10], r11b
inc rax
inc r10
nop word [rax + rax]
cmp rdx, rax
jle 0x573d48
cmp r9, r10
jle 0x573d48
ja 0x573dc3
mov rax, r10
mov rcx, r9
call fcn.00464e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.004627a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.00573c20
Function at 0x574ca0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x574edc
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.0050abc0
xorps xmm15, xmm15
mov r14, qword [0x00811f90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x574dea
nop
cmp rdx, 0x40
ja 0x574ece
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rdi + 0x20]
add rdx, rcx
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x574d59
mov rax, rdx
mov rcx, rsi
nop
call fcn.004657a0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x574dc1
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00575420
xorps xmm15, xmm15
mov r14, qword [0x00811f90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x574ec3
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x574df7
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x574e77
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.00575420
xorps xmm15, xmm15
mov r14, qword [0x00811f90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x574eb2
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x574eae
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.004657a0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
call fcn.00464ec0
mov rax, rdx
mov ecx, 0x40
call fcn.00464ec0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004627a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00574ca0
Function at 0x57b3e0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x57b3f8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x57b3f8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x57b400
xor eax, eax
ret
cmp rbx, 3
je 0x57b40c
cmp rbx, 4
jne 0x57b439
cmp al, 0x2c
ja 0x57b426
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x57b436
cmp al, 0x24
je 0x57b436
nop dword [rax]
cmp al, 0x26
jae 0x57b436
jmp 0x57b439
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x57b436
cmp al, 0x5b
je 0x57b436
cmp al, 0x5d
jne 0x57b439
xor eax, eax
ret
cmp al, 0x2f
ja 0x57b472
nop dword [rax]
cmp al, 0x26
ja 0x57b451
cmp al, 0x24
je 0x57b491
cmp al, 0x26
je 0x57b491
jmp 0x57b50b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x57b491
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x57b508
cmp al, 0x2f
je 0x57b491
jmp 0x57b50b
cmp al, 0x3d
ja 0x57b489
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x57b491
nop
cmp al, 0x3d
je 0x57b491
jmp 0x57b50b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x57b500
cmp rbx, 2
jg 0x57b4c7
cmp rbx, 1
je 0x57b4c1
nop dword [rax]
cmp rbx, 2
jne 0x57b50b
cmp al, 0x2f
je 0x57b4b2
cmp al, 0x3b
je 0x57b4b2
cmp al, 0x2c
jne 0x57b4b9
mov ecx, 1
jmp 0x57b4be
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x57b4ea
cmp al, 0x40
je 0x57b4d9
cmp al, 0x2f
je 0x57b4d9
cmp al, 0x3f
jne 0x57b4e2
mov ecx, 1
nop
jmp 0x57b4e7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x57b4f9
cmp rbx, 7
jne 0x57b50b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x57b508
cmp al, 0x7e
jne 0x57b50b
xor eax, eax
ret
cmp rbx, 7
jne 0x57b521
cmp al, 0x21
je 0x57b51d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x57b521
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x5807e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5809f5
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x58090d
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x5809e7
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [r8 + 0x10]
add rdx, rax
cmp rbx, rdx
je 0x580881
mov rax, rdx
mov rcx, rsi
call fcn.004657a0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x5808e9
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00580c80
xorps xmm15, xmm15
mov r14, qword [0x00811f90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x5809df
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x580913
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x580990
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.00580c80
xorps xmm15, xmm15
mov r14, qword [0x00811f90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x5809ce
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x5809ca
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.004657a0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rsi
call fcn.00464ec0
mov rax, rdx
mov ecx, 0x40
call fcn.00464ec0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004627a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005807e0
Function at 0x140007728
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x188]
sub rsp, 0x280
mov rax, qword [0x14000f178]
xor rax, rsp
mov qword [rbp + 0x170], rax
and qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
and qword [rsp + 0x48], 0
lea rdx, str.SystemCurrentControlSetControlAppIDCertChainStore_
mov r14, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140007894
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x60]
and qword [rsp + 0x28], 0
xor edx, edx
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
lea esi, [rbx + 1]
jmp 0x140007881
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x60]
call fcn.140007904
mov ebx, eax
test eax, eax
jne 0x1400078e3
mov rdx, qword [rsp + 0x48]
lea r8d, [rax + 1]
xor r9d, r9d
mov rcx, r14
call qword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
nop dword [rax + rax]
test eax, eax
je 0x1400078d5
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
and qword [rsp + 0x48], 0
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x60]
and qword [rsp + 0x30], 0
mov edx, esi
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
inc esi
mov ebx, eax
test eax, eax
je 0x1400077e6
cmp eax, 0x103
jne 0x140007894
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400078aa
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140009970
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
cmp qword [rsp + 0x48], 0
je 0x140007894
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
nop dword [rax + rax]
jmp 0x140007894
Function at 0x140007904
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
and qword [rbp - 8], 0
lea rax, [rbp - 8]
mov rsi, r8
mov qword [r11 - 0x28], rax
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140007a12
and dword [rbp + 0x28], eax
lea r9, [rbp - 0x10]
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rdx, str.CertData
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140007a12
mov edx, dword [rbp + 0x28]
lea ecx, [rax + 0x40]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x1400079a3
lea ebx, [rax + 8]
jmp 0x140007a12
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.CertData
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140007a03
mov r8d, dword [rbp + 0x28]
mov rdx, rdi
mov ecx, 0x10001
call qword [sym.imp.CRYPT32.dll_CertCreateCertificateContext]
nop dword [rax + rax]
mov qword [rsi], rax
test rax, rax
jne 0x140007a03
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140007a27
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x140008cfc
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x14000f178]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r12d, r12d
lea rax, [rsp + 0x30]
mov qword [rdx], r12
lea r8, [rsp + 0x30]
mov r14d, r12d
sub rcx, rax
mov r15, rdx
mov r9d, 0x104
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x140008d71
movzx eax, word [rcx + r8]
test ax, ax
je 0x140008d71
mov word [r8], ax
add r8, 2
sub r9, 1
jne 0x140008d4d
lea rax, [r8 - 2]
test r9, r9
lea rcx, [rsp + 0x30]
cmovne rax, r8
lea r8, [0x14000bac0]
mov word [rax], r12w
call fcn.1400090c8
mov edi, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, edi
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140008de0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x140008ed5
mov rcx, qword [rbp + 0x178]
mov edx, 0xc9
call fcn.140002ba0
mov esi, eax
jmp 0x140008eb9
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r12d
mov rcx, rbx
mov dword [rsp + 0x20], r12d
call fcn.140003728
mov esi, eax
test eax, eax
jns 0x140008e1e
mov rcx, qword [rbp + 0x178]
mov r9d, eax
mov edx, 0xcf
call fcn.140002b64
mov rcx, rbx
call fcn.140003434
jmp 0x140008eb9
lea r8, [0x14000bac8]
lea rcx, [rsp + 0x30]
call fcn.1400090c8
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, edi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140008e61
mov rcx, qword [rbp + 0x178]
mov edx, 0xd5
call fcn.140002ba0
mov esi, eax
jmp 0x140008e11
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140003728
mov esi, eax
test eax, eax
jns 0x140008e95
mov rcx, qword [rbp + 0x178]
mov r9d, eax
mov edx, 0xd7
call fcn.140002b64
mov rcx, rdi
call fcn.140003434
jmp 0x140008e11
mov rcx, rdi
call fcn.140003434
movsxd rax, dword [rsp + 0x20]
mov rcx, rbx
movsxd r14, dword [rsp + 0x24]
shl rax, 0x1f
or r14, rax
call fcn.140003434
mov esi, r12d
test esi, esi
jns 0x140008ed5
mov rcx, qword [rbp + 0x178]
mov r9d, esi
mov edx, 0x62
call fcn.140002b64
mov eax, esi
jmp 0x140008eda
mov qword [r15], r14
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140009970
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140009770
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14000f9b8], rbx
je 0x1400097bc
cmp rax, rbx
jne 0x1400097af
mov ebx, 1
mov esi, ebx
jmp 0x1400097c1
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140009794
mov ebx, 1
mov eax, dword [0x14000f9c0]
cmp eax, ebx
jne 0x1400097d7
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14000983c
mov eax, dword [0x14000f9c0]
test eax, eax
jne 0x140009836
mov dword [0x14000f9c0], ebx
lea r15, [0x14000b640]
lea rdi, [0x14000b628]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140009828
test eax, eax
jne 0x14000982c
cmp qword [rdi], 0
je 0x14000981d
mov rax, qword [rdi]
mov rcx, qword [0x14000b5c8]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400097fe
test eax, eax
je 0x14000983c
mov eax, 0xff
jmp 0x140009918
mov dword [0x14000f1a4], ebx
mov eax, dword [0x14000f9c0]
cmp eax, ebx
jne 0x140009863
lea rdx, [0x14000b620]
lea rcx, [0x14000b5d0]
call sub.msvcrt.dll__initterm
mov dword [0x14000f9c0], 2
test esi, esi
jne 0x140009870
xor eax, eax
xchg qword [0x14000f9b8], rax
cmp qword [0x14000f9d8], 0
je 0x1400098a4
lea rcx, [0x14000f9d8]
call fcn.140009d90
test eax, eax
je 0x1400098a4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000f9d8]
mov r9, qword [0x14000b5c8]
call r9
mov r8, qword [0x14000f1b8]
mov rdx, qword [0x14000f1b0]
mov ecx, dword [0x14000f1a8]
call fcn.14000701c
mov dword [0x14000f1a0], eax
cmp dword [0x14000f1c0], 0
jne 0x1400098d4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000f1a4], 0
jne 0x1400098e9
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000f1a0]
jmp 0x140009918
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140009e24
add rsp, 0x28
jmp 0x140009770

Function at 0x140009c7c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140009cc8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140009cc0
cmp dword [rcx + 0x3c], edx
jl 0x140009cc0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140009cc0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140009cc8
mov rax, rdx
add rsp, 0x18
ret