joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f04b0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r14, r8
mov rsi, rdx
mov rbp, rcx
xor bl, bl
mov eax, dword [0x140429a18]
test al, 1
jne 0x1400f0513
or eax, 1
mov dword [0x140429a18], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x1404299f0], rax
mov qword [0x1404299f8], 0xffffffff80000002
lea rcx, [0x1402fedc0]
call fcn.1402b8a74
lea rdx, [0x14034ce18]
lea rcx, [0x1404299f0]
call fcn.1400ea630
mov rdi, rax
test rax, rax
je 0x1400f05d5
lea r15, vtable.Core::ByteArray.0
mov qword [rsp + 0x38], r15
xor eax, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x50], rax
mov eax, dword [r14 + 0xc]
lea r9d, [rax + rax]
mov rcx, qword [rbp + 0xc0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov rdx, qword [r14]
call qword [rax + 0x20]
test al, al
je 0x1400f05aa
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8]
nop
mov qword [rsp + 0x38], r15
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x1400f05d5
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, bl
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x1400f0600
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [0x140429a18]
mov rbx, rdx
test al, 1
jne 0x1400f0645
or eax, 1
lea rcx, [0x1402fedc0]
mov qword [0x1404299f8], 0xffffffff80000002
mov dword [0x140429a18], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x1404299f0], rax
call fcn.1402b8a74
lea rdx, [0x14034ce18]
lea rcx, [0x1404299f0]
call fcn.1400ea630
mov rdi, rax
test rax, rax
je 0x1400f0697
mov rcx, qword [rax + 8]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rdi]
test ebx, ebx
mov edx, 1
mov rcx, rdi
sete bl
call qword [rax]
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f07e0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [rdx]
mov r14, rdx
mov rbp, rcx
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400f09a4
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x80], rdi
nop dword [rax + rax]
mov rcx, qword [rbx + 0x20]
call fcn.1402b9ff0
mov rdi, rax
test rax, rax
je 0x1400f093b
mov rcx, rax
call fcn.1402ba268
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], 0
jne 0x1400f0831
add r8d, r8d
xor r9d, r9d
mov eax, r8d
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [rax*4]
movsxd r10, ecx
add r10, rdi
neg eax
movsxd rdx, eax
je 0x1400f088a
imul eax, dword [r10 + rdx*4], 0xcc9e2d51
rol eax, 0xf
imul ecx, eax, 0x1b873593
xor r9d, ecx
rol r9d, 0xd
add r9d, 0xfaddaf14
lea r9d, [r9 + r9*4]
inc rdx
jne 0x1400f0862
mov ecx, r8d
xor edx, edx
and ecx, 3
dec ecx
je 0x1400f08b0
dec ecx
je 0x1400f08a6
dec ecx
jne 0x1400f08c8
movzx edx, byte [r10 + 2]
shl edx, 0x10
movzx eax, byte [r10 + 1]
shl eax, 8
xor edx, eax
movzx eax, byte [r10]
xor eax, edx
imul ecx, eax, 0xcc9e2d51
rol ecx, 0x10
imul eax, ecx, 0x1b873593
xor r9d, eax
xor r9d, r8d
mov eax, r9d
shr eax, 0x10
xor eax, r9d
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov rcx, rdi
mov dword [rsp + 0x78], eax
call fcn.1402b7350
movzx eax, byte [0x14042918a]
lea rcx, [rbp + 0x440]
lea r9, [rbx + 0x20]
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x20], al
call fcn.1400e8550
movzx eax, byte [0x14042918a]
lea rcx, [rbp + 0x450]
lea r9, [rsp + 0x78]
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x20], al
call fcn.1400e82b0
cmp byte [rbx + 0x19], 0
jne 0x1400f098e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1400f096e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1400f098e
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400f0960
jmp 0x1400f098e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400f098b
cmp rbx, qword [rax + 0x10]
jne 0x1400f098b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400f0978
mov rbx, rax
cmp rbx, qword [r14]
jne 0x1400f0810
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x70]
mov al, 1
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
Function at 0x1400f0c60
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
xor bl, bl
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x1400f0cf6
mov qword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov rcx, rax
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400f0cf6
mov rcx, qword [rsp + 0x58]
mov r9d, 4
lea rax, [rsp + 0x48]
lea edx, [r9 + 0xe]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400f0ceb
cmp dword [rsp + 0x48], 4
jne 0x1400f0ceb
mov eax, dword [rsp + 0x50]
mov bl, 1
cmp eax, 2
je 0x1400f0cde
cmp eax, 3
jne 0x1400f0ce3
mov byte [rdi], 1
jmp 0x1400f0ceb
cmp eax, 1
setne cl
mov byte [rdi], cl
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f1930
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov dword [rbp - 0x50], r14d
mov qword [rbp - 0x18], r14
lea edx, [r14 + 9]
lea rcx, [rbp - 0x20]
call fcn.1401fcb40
mov eax, dword [rbp - 0x18]
inc eax
movsxd rdx, eax
lea r9d, [r14 + 9]
lea r8, [0x14034cde8]
mov rcx, qword [rbp - 0x20]
call fcn.1402ba94c
lea edx, [r14 + 9]
lea rcx, [rbp - 0x20]
call fcn.1401fde50
nop
lea edx, [r14 + 0x23]
lea rcx, [rbp - 0x10]
call fcn.1402081e0
nop
lea r8, [rbp - 0x20]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400d2ba0
nop
cmp dword [rbp - 8], r14d
jle 0x1400f19ca
mov rcx, qword [rbp - 0x10]
call fcn.1402b7350
nop
cmp dword [rbp - 0x18], 0
jle 0x1400f19d9
mov rcx, qword [rbp - 0x20]
call fcn.1402b7350
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x40]
call fcn.1401ff680
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400f1a0a
test al, 0x10
je 0x1400f1a0a
cmp dword [rbp - 0x28], 0
jle 0x1400f1a28
mov rcx, qword [rbp - 0x30]
call fcn.1402b7350
jmp 0x1400f1a28
cmp dword [rbp - 0x28], 0
jle 0x1400f1a19
mov rcx, qword [rbp - 0x30]
call fcn.1402b7350
xor r8d, r8d
mov rdx, qword [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test rsi, rsi
je 0x1400f1aa0
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400f1a31
mov qword [rbp - 0x28], r14
test ebx, ebx
jne 0x1400f1a50
lea rax, [0x140346ce0]
mov qword [rbp - 0x30], rax
jmp 0x1400f1a72
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp - 0x28]
inc eax
movsxd rdx, eax
mov r8, rsi
mov rcx, qword [rbp - 0x30]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.1401fde50
nop
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.1400d2ba0
nop
cmp dword [rbp - 0x28], 0
jle 0x1400f1ae3
mov rcx, qword [rbp - 0x30]
call fcn.1402b7350
jmp 0x1400f1ae3
mov qword [rdi + 8], r14
mov edx, dword [rbp - 0x34]
test edx, edx
jne 0x1400f1ab7
lea rax, [0x140346ce0]
mov qword [rdi], rax
jmp 0x1400f1ada
mov rcx, rdi
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x34]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x40]
mov rcx, qword [rdi]
call fcn.1402ba94c
mov edx, dword [rbp - 0x34]
mov rcx, rdi
call fcn.1401fde50
nop
cmp dword [rbp - 0x38], 0
jle 0x1400f1af2
mov rcx, qword [rbp - 0x40]
call fcn.1402b7350
mov rax, rdi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400f1b10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov dword [rbp - 0x50], r14d
mov qword [rbp - 0x18], r14
lea edx, [r14 + 9]
lea rcx, [rbp - 0x20]
call fcn.1401fcb40
mov eax, dword [rbp - 0x18]
inc eax
movsxd rdx, eax
lea r9d, [r14 + 9]
lea r8, [0x14034cde8]
mov rcx, qword [rbp - 0x20]
call fcn.1402ba94c
lea edx, [r14 + 9]
lea rcx, [rbp - 0x20]
call fcn.1401fde50
nop
lea edx, [r14 + 0x26]
lea rcx, [rbp - 0x10]
call fcn.1402081e0
nop
lea r8, [rbp - 0x20]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400d2ba0
nop
cmp dword [rbp - 8], r14d
jle 0x1400f1baa
mov rcx, qword [rbp - 0x10]
call fcn.1402b7350
nop
cmp dword [rbp - 0x18], 0
jle 0x1400f1bb9
mov rcx, qword [rbp - 0x20]
call fcn.1402b7350
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x40]
call fcn.1401ff680
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400f1bea
test al, 0x10
je 0x1400f1bea
cmp dword [rbp - 0x28], 0
jle 0x1400f1c08
mov rcx, qword [rbp - 0x30]
call fcn.1402b7350
jmp 0x1400f1c08
cmp dword [rbp - 0x28], 0
jle 0x1400f1bf9
mov rcx, qword [rbp - 0x30]
call fcn.1402b7350
xor r8d, r8d
mov rdx, qword [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test rsi, rsi
je 0x1400f1c80
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400f1c11
mov qword [rbp - 0x28], r14
test ebx, ebx
jne 0x1400f1c30
lea rax, [0x140346ce0]
mov qword [rbp - 0x30], rax
jmp 0x1400f1c52
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp - 0x28]
inc eax
movsxd rdx, eax
mov r8, rsi
mov rcx, qword [rbp - 0x30]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.1401fde50
nop
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.1400d2ba0
nop
cmp dword [rbp - 0x28], 0
jle 0x1400f1cc3
mov rcx, qword [rbp - 0x30]
call fcn.1402b7350
jmp 0x1400f1cc3
mov qword [rdi + 8], r14
mov edx, dword [rbp - 0x34]
test edx, edx
jne 0x1400f1c97
lea rax, [0x140346ce0]
mov qword [rdi], rax
jmp 0x1400f1cba
mov rcx, rdi
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x34]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x40]
mov rcx, qword [rdi]
call fcn.1402ba94c
mov edx, dword [rbp - 0x34]
mov rcx, rdi
call fcn.1401fde50
nop
cmp dword [rbp - 0x38], 0
jle 0x1400f1cd2
mov rcx, qword [rbp - 0x40]
call fcn.1402b7350
mov rax, rdi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400f2440
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rsi
sub rsp, 0x78
mov rbx, rcx
mov sil, 1
call fcn.1400ce2d0
test al, al
je 0x1400f25ab
cmp byte [rbx + 0x225], 0
mov qword [rsp + 0x70], rdi
jne 0x1400f2507
xor ecx, ecx
call fcn.1400f1cf0
mov rdi, rax
test rax, rax
je 0x1400f2507
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0xa0]
lea r9, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
lea rdx, str.NoSSL
xor r8d, r8d
mov dword [rsp + 0x98], 0
mov dword [rsp + 0xa0], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400f24e4
cmp dword [rsp + 0x98], ebx
sete sil
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8]
test sil, sil
jne 0x1400f2507
movzx eax, sil
mov rdi, qword [rsp + 0x70]
add rsp, 0x78
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x40]
call fcn.1400caec0
lea rcx, [rsp + 0x58]
call fcn.1400cafe0
mov ecx, dword [rax + 0x10]
cmp ecx, dword [rsp + 0x50]
jne 0x1400f253f
mov rax, qword [rax + 8]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa0], rax
jmp 0x1400f2583
test ecx, ecx
jne 0x1400f2564
lea rcx, [rax + 8]
lea rdx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa0], rax
jmp 0x1400f2583
mov rax, qword [rax + 8]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
mov rdi, qword [rsp + 0x70]
cmp eax, 0xffffffff
sete al
add rsp, 0x78
pop rsi
pop rbx
ret
mov eax, dword [0x140429a18]
test al, 1
jne 0x1400f25e3
or eax, 1
lea rcx, [0x1402fedc0]
mov qword [0x1404299f8], 0xffffffff80000002
mov dword [0x140429a18], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x1404299f0], rax
call fcn.1402b8a74
lea rdx, [0x14034ce18]
lea rcx, [0x1404299f0]
call fcn.1400ea630
mov rbx, rax
test rax, rax
je 0x1400f2646
lea rcx, [rsp + 0x98]
mov dword [rsp + 0x28], 4
lea rdx, str.NoSSL
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + 8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x98], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8]
xor al, al
add rsp, 0x78
pop rsi
pop rbx
ret
Function at 0x1400f2650
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor eax, eax
test dl, dl
movzx edi, dl
setne al
mov dword [rcx + 0x100], eax
mov eax, dword [0x140429a18]
test al, 1
jne 0x1400f26a2
or eax, 1
lea rcx, [0x1402fedc0]
mov qword [0x1404299f8], 0xffffffff80000002
mov dword [0x140429a18], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x1404299f0], rax
call fcn.1402b8a74
lea rdx, [0x14034ce18]
lea rcx, [0x1404299f0]
call fcn.1400ea630
mov rbx, rax
test rax, rax
je 0x1400f2717
lea rdx, str.EarlyWarning
test dil, dil
je 0x1400f26f8
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x48]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400f270a
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f2730
Capabilities:
Create thread
Resume thread

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
movaps xmmword [rax - 0x38], xmm6
movzx esi, dl
mov rbx, rcx
xor r12d, r12d
mov eax, dword [0x1404194a4]
cmp eax, 0xffffffff
jne 0x1400f2799
call fcn.140112080
test al, al
je 0x1400f2787
mov edi, 1
mov dword [0x1404194a4], edi
jmp 0x1400f2982
cmp qword [rbx + 0x2f0], r12
jne 0x1400f2777
mov dword [0x1404194a4], r12d
jmp 0x1400f27a2
cmp eax, 1
je 0x1400f2982
cmp qword [rbx + 0x268], r12
jne 0x1400f297e
mov edi, 1
xor eax, eax
lock cmpxchg dword [rbx + 0x108], edi
jne 0x1400f2982
call fcn.140111e90
test al, al
je 0x1400f2982
mov byte [rbx + 0x32], sil
call fcn.140105210
test al, al
jne 0x1400f2982
xor r14b, r14b
test sil, sil
jne 0x1400f2923
xor ecx, ecx
call fcn.1400f1cf0
mov rsi, rax
test rax, rax
je 0x1400f2923
lea rax, [0x140346ce0]
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], r12
lea r8, [rbp - 0x11]
lea rdx, str.LastCFU
mov rcx, rsi
call fcn.1400d8ae0
test al, al
je 0x1400f2904
lea rax, vtable.Core::DateTime.0
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], r12
mov dword [rbp + 0x1f], edi
cmp dword [rbp - 5], 0x13
jl 0x1400f2904
mov qword [rbp - 0x19], r12
lea edx, [rdi + 0x12]
lea rcx, [rbp - 0x21]
call fcn.1401fcb40
mov eax, dword [rbp - 0x19]
inc eax
movsxd rdx, eax
lea r9d, [rdi + 0x12]
lea r8, str.yyyy_MM_dd_HH:mm:ss
mov rcx, qword [rbp - 0x21]
call fcn.1402ba94c
lea edx, [rdi + 0x12]
lea rcx, [rbp - 0x21]
call fcn.1401fde50
nop
xor r9d, r9d
lea r8, [rbp + 0xf]
lea rdx, [rbp - 0x21]
mov rcx, qword [rbp - 0x11]
call fcn.1400e9c20
test al, al
sete r15b
cmp dword [rbp - 0x19], 0
jle 0x1400f28a9
mov rcx, qword [rbp - 0x21]
call fcn.1402b7350
test r15b, r15b
jne 0x1400f2904
call fcn.140113b80
mov rcx, rax
lea r8, [rbp + 0xf]
lea rdx, [rbp - 1]
call fcn.1400cb050
xorps xmm6, xmm6
cvtsi2sd xmm6, qword [rbp + 7]
movaps xmm1, xmm6
divsd xmm1, qword [0x140372150]
movq rdx, xmm1
lea rcx, str.LastCFU__3.1f_mins_ago_n
call fcn.1402b7a88
divsd xmm6, qword [0x140372170]
movzx r14d, r14b
movsd xmm0, qword [0x140371fe8]
comisd xmm0, xmm6
cmova r14d, edi
mov rax, qword [rsi]
mov edx, edi
mov rcx, rsi
call qword [rax]
nop
cmp dword [rbp - 9], 0
jle 0x1400f291e
mov rcx, qword [rbp - 0x11]
call fcn.1402b7350
test r14b, r14b
jne 0x1400f2982
mov dword [rbp + 0x77], r12d
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x1400f29b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x268], rax
test rax, rax
je 0x1400f2982
mov eax, dword [rbx + 0x218]
mov dword [rbx + 0x21c], eax
mov edx, 4
mov rcx, rbx
call fcn.1400f42b0
mov rcx, qword [rbx + 0x268]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
jmp 0x1400f2984
xor al, al
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400f4b90
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
lea r14, [0x140346ce0]
mov qword [rbp - 0x28], r14
xor esi, esi
mov qword [rbp - 0x20], rsi
mov edx, 0x258
xor ecx, ecx
lea r8d, [rsi + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400f4da5
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400fb060
test al, al
je 0x1400f4da5
cmp dword [rbp - 0x1c], esi
je 0x1400f4da5
mov rbx, qword [rbp - 0x28]
lea r8d, [rsi + 0xa]
lea rdx, [rbp + 0x20]
mov rcx, rbx
call fcn.1402ba760
mov edi, eax
mov rdx, qword [rbp + 0x20]
sub rdx, rbx
sar rdx, 1
movsxd rcx, dword [rbp - 0x1c]
cmp rdx, rcx
jne 0x1400f4da5
test eax, eax
je 0x1400f4da5
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rsi
mov edx, 0x259
xor ecx, ecx
lea r8d, [rsi + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400f4ca6
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400fb060
test al, al
je 0x1400f4ca6
lea r8d, [rsi + 1]
lea rdx, [0x140345c60]
lea rcx, [rbp - 0x28]
call fcn.1401ff2c0
test al, al
jne 0x1400f4ca6
mov edx, dword [rbp - 0x1c]
lea rcx, [rbp - 0x18]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x10]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x18]
call fcn.1402ba94c
mov edx, dword [rbp - 0x1c]
lea rcx, [rbp - 0x18]
call fcn.1401fde50
mov eax, dword [0x140429a18]
test al, 1
jne 0x1400f4cde
or eax, 1
mov dword [0x140429a18], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x1404299f0], rax
mov qword [0x1404299f8], 0xffffffff80000002
lea rcx, [0x1402fedc0]
call fcn.1402b8a74
lea rdx, [0x14034ce18]
lea rcx, [0x1404299f0]
call fcn.1400ea630
mov rbx, rax
test rax, rax
je 0x1400f4d95
lea rdx, [0x14034d1e8]
mov rcx, rax
call fcn.1400eab30
cmp eax, 4
je 0x1400f4d87
mov dword [rbp + 0x20], edi
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x14034d1e8]
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400f4d87
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400f4d50
test rax, rax
je 0x1400f4d87
mov eax, dword [rbp - 0xc]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.RURL
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
cmp dword [rbp - 0x10], 0
jle 0x1400f4da5
mov rcx, qword [rbp - 0x18]
call fcn.1402b7350
nop
cmp dword [rbp - 0x20], 0
jle 0x1400f4db4
mov rcx, qword [rbp - 0x28]
call fcn.1402b7350
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400f5700
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x100], 1
mov rdi, rcx
jne 0x1400f571b
cmp byte [rcx + 0x104], 0
je 0x1400f5736
call fcn.1401780b0
test al, al
jne 0x1400f5736
mov rcx, rdi
call fcn.1400f7c60
test al, al
jne 0x1400f5736
add rsp, 0x30
pop rdi
ret
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rbx
xor ebx, ebx
mov qword [rsp + 0x28], rax
lea r8, [0x1400f5780]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x48]
test rax, rax
mov qword [rdi + 0x280], rax
setne al
add rsp, 0x30
pop rdi
ret

Function at 0x1400f7b40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor ecx, ecx
xor ebp, ebp
call fcn.1400f1cf0
mov rsi, rax
test rax, rax
je 0x1400f7bbf
mov rcx, qword [rsi + 8]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.NoRestorePoint
xor r8d, r8d
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
test ebx, ebx
cmove ebp, dword [rsp + 0x58]
mov edx, 1
mov rcx, rsi
call qword [rax]
test ebp, ebp
jne 0x1400f7c3f
mov rax, qword [rdi + 0x498]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400f7c3f
nop
mov rcx, qword [rbx + 0x30]
test byte [rcx + 0x40], 1
je 0x1400f7be5
mov rax, qword [rcx]
call qword [rax + 0x48]
cmp eax, 7
jne 0x1400f7c4e
cmp byte [rbx + 0x19], 0
jne 0x1400f7c36
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1400f7c0f
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1400f7c36
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400f7c01
jmp 0x1400f7c36
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400f7c33
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1400f7c33
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400f7c20
mov rbx, rax
cmp rbx, qword [rdi + 0x498]
jne 0x1400f7bd0
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret