joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454ce0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x454d99
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00454de0]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045c780
xorps xmm15, xmm15
mov r14, qword [0x005c6c68]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045c8c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00454ce0
Function at 0x45e960
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x402dcf
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409460
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c8c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402da0
cmp byte [0x005c6a91], 0
je 0x45e975
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45b940
jmp 0x402da0

Function at 0x45e980
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005c6d40]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005c6a91], 0
je 0x45e9b5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005c7080]
aesenc xmm0, xmmword [0x005c7090]
aesenc xmm0, xmmword [0x005c70a0]
movq rax, xmm0
ret
jmp 0x409660

Function at 0x45e9c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005c6d40]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005c6a91], 0
je 0x45e9f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005c7080]
aesenc xmm0, xmmword [0x005c7090]
aesenc xmm0, xmmword [0x005c70a0]
movq rax, xmm0
ret
jmp 0x4096c0

Function at 0x460320
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005c7000]
mov qword [rsp + 8], rdx
lea r8d, [0x005c6aa8]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045e8a0
add rsp, 0x30
ret

Function at 0x460860
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x460890
mov rcx, 0x28
jmp 0x46089b
shl rcx, 3
add rcx, 0x1480
mov qword [0x005c6c68], rcx
ret
Function at 0x46b7c0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x46b82b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x46b7e4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x46b801
cmp rdx, 0
je 0x46b84d
test rdx, 0xf
je 0x46b7dd
test rdx, 7
jne 0x46b801
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x46b7dd
ret
Function at 0x479d00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x479d3f
jb 0x479d54
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x479dc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x479e90
jb 0x479eef
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00479ca0
aeskeygenassist xmm1, xmm0, 1
call fcn.00479cc0
aeskeygenassist xmm1, xmm2, 2
call fcn.00479ca0
aeskeygenassist xmm1, xmm0, 2
call fcn.00479cc0
aeskeygenassist xmm1, xmm2, 4
call fcn.00479ca0
aeskeygenassist xmm1, xmm0, 4
call fcn.00479cc0
aeskeygenassist xmm1, xmm2, 8
call fcn.00479ca0
aeskeygenassist xmm1, xmm0, 8
call fcn.00479cc0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00479ca0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00479cc0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00479ca0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00479cc0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00479ca0
jmp 0x479f5d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00479c00
aeskeygenassist xmm1, xmm2, 2
call fcn.00479c60
aeskeygenassist xmm1, xmm2, 4
call fcn.00479c00
aeskeygenassist xmm1, xmm2, 8
call fcn.00479c60
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00479c00
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00479c60
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00479c00
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00479c60
jmp 0x479f5d
aeskeygenassist xmm1, xmm0, 1
call fcn.00479bc0
aeskeygenassist xmm1, xmm0, 2
call fcn.00479bc0
aeskeygenassist xmm1, xmm0, 4
call fcn.00479bc0
aeskeygenassist xmm1, xmm0, 8
call fcn.00479bc0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00479bc0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00479bc0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00479bc0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00479bc0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00479bc0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00479bc0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x479f6a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x140001030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140001063
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x1400010a7
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x1400010a2
cmp rbx, r11
jae 0x1400010a7
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140001090
cmp rbx, r11
jb 0x1400010ab
xor eax, eax
jmp 0x1400010b7
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140001310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov eax, r8d
mov rsi, rdx
mov ebx, r8d
shr eax, 4
mov rbp, rcx
mov r8d, 6
add ax, 1
mov rcx, rsi
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
mov r12, rax
je 0x140001479
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140001479
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x140001479
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x1400013aa
cmp rdi, r11
jae 0x140001479
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x140001394
cmp rdi, r11
jae 0x140001479
movzx eax, word [rdi]
test ax, ax
je 0x140001479
mov qword [rsp + 0x60], r13
movzx ebx, ax
call qword [0x140056d60]
xor r13d, r13d
lea r12, [rdi + 2]
mov r9d, ebx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, qword [rbp]
mov edx, 1
movsxd rsi, eax
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, esi
or edx, ecx
jge 0x14000141a
mov edx, esi
mov rcx, rbp
call fcn.140001280
mov rbx, qword [rbp]
movzx edi, word [rdi]
call qword [0x140056d60]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ecx, eax
mov r9d, edi
mov r8, r12
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test esi, esi
mov r13, qword [rsp + 0x60]
js 0x14000146e
mov rcx, qword [rbp]
cmp esi, dword [rcx - 0xc]
jg 0x14000146e
mov dword [rcx - 0x10], esi
mov rcx, qword [rbp]
mov eax, 1
mov byte [rsi + rcx], 0
jmp 0x14000147b
mov ecx, 0x80070057
call fcn.140001010
int3
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x140002010
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x28
mov r8, rdx
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140002040
Capabilities:
Delete file
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_DeleteFileA]

Function at 0x140002310
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1f0
mov rdi, r8
mov ebx, 0x103
lea rcx, [rsp + 0xe0]
mov r8d, ebx
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
mov r11, rbx
lea rax, [rsp + 0xe0]
nop
nop
cmp byte [rax], 0
je 0x140002361
add rax, 1
sub r11, 1
jne 0x140002350
jmp 0x1400023a9
test r11, r11
je 0x1400023a9
mov rax, rbx
mov rdx, rbx
sub rax, r11
sub rdx, rax
lea rcx, [rsp + rax + 0xe0]
je 0x1400023a9
lea r8, [0x14003e390]
sub r8, rcx
movzx eax, byte [r8 + rcx]
test al, al
je 0x14000239d
mov byte [rcx], al
add rcx, 1
sub rdx, 1
jne 0x140002386
jmp 0x1400023a2
test rdx, rdx
jne 0x1400023a6
sub rcx, 1
mov byte [rcx], 0
mov rcx, rbx
lea rax, [rsp + 0xe0]
cmp byte [rax], 0
je 0x1400023c5
add rax, 1
sub rcx, 1
jne 0x1400023b4
jmp 0x140002402
test rcx, rcx
je 0x140002402
mov rax, rbx
sub rax, rcx
sub rbx, rax
lea rcx, [rsp + rax + 0xe0]
je 0x140002402
sub rdi, rcx
movzx eax, byte [rdi + rcx]
test al, al
je 0x1400023f6
mov byte [rcx], al
add rcx, 1
sub rbx, 1
jne 0x1400023e0
jmp 0x1400023fb
test rbx, rbx
jne 0x1400023ff
sub rcx, 1
mov byte [rcx], 0
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.14001c250
xor eax, eax
lea rdx, [rsp + 0xe0]
lea rcx, str.gOS___Command____s___s_
mov r8, rsi
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.140003770
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140002498
lea rcx, str.gOS___Command___CreateProcess_FAILED
call fcn.140003770
xor eax, eax
jmp 0x14000249d
mov rax, qword [rsp + 0x50]
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140002d20
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, r9
mov rbx, rcx
call fcn.140002c50
test eax, eax
je 0x140002d5d
mov rcx, qword [rbx]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, rbx
call fcn.140002d10
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140002d70
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x40
mov edx, dword [rcx + 8]
lea r9, [rcx + 0x324]
xor ebx, ebx
lea eax, [rdx + 1]
lea r8, [rcx + 0xc]
mov dword [r9], 0x104
mov dword [rcx + 8], eax
lea rax, [rcx + 0x3bc]
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x140002dd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea r8, [rcx + 0x324]
lea rax, [rcx + 0x214]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov dword [r8], 0x104
xor r9d, r9d
xor r8d, r8d
mov byte [rax], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x38
ret

Function at 0x140002e20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea r8, [rcx + 0x324]
lea rax, [rcx + 0x318]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov dword [r8], 4
lea r9, [rsp + 0x40]
xor ebx, ebx
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov dword [rax], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x140002e70
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, r8
mov r10, rdx
mov rbx, rcx
mov r8, rcx
mov rdx, rax
mov rcx, r10
mov rdi, r9
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x140002ecd
mov rcx, qword [rbx]
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbx]
test eax, eax
je 0x140002eda
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x140002ef0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x38
ret

Function at 0x140002f30
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rcx, r8
mov rbx, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsi]
add eax, 1
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x30
pop rdi
ret
Function at 0x140003770
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x238
cmp dword [0x1400545e8], 0
je 0x1400037cb
call fcn.14001c6a0
cmp rax, 0x104
jae 0x1400037cb
mov r8, qword [rsp + 0x240]
lea r9, [rsp + 0x248]
lea rcx, [rsp + 0x20]
mov edx, 0x208
call fcn.14001ac60
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x238
ret

Function at 0x1400040a0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x270
mov rdi, rcx
mov dword [rcx + 0x4b54], 0
mov rsi, r8
lea rcx, [rsp + 0x160]
mov r8d, 0x103
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
mov r11d, 0x103
lea rax, [rsp + 0x160]
cmp byte [rax], 0
je 0x1400040f8
add rax, 1
sub r11, 1
jne 0x1400040e7
jmp 0x140004144
test r11, r11
je 0x140004144
mov eax, 0x103
mov edx, 0x103
sub rax, r11
sub rdx, rax
lea rcx, [rsp + rax + 0x160]
je 0x140004144
lea r8, [0x14003f87c]
sub r8, rcx
movzx eax, byte [r8 + rcx]
test al, al
je 0x140004138
mov byte [rcx], al
add rcx, 1
sub rdx, 1
jne 0x140004121
jmp 0x14000413d
test rdx, rdx
jne 0x140004141
sub rcx, 1
mov byte [rcx], 0
lea rcx, str.iProDifx___LoadSysFileNames___s_
mov rdx, rbx
call fcn.140003770
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x140004231
movsxd rdx, dword [rdi + 0x4b54]
mov r8d, 0x103
mov rcx, rdx
add edx, 1
mov dword [rdi + 0x4b54], edx
lea rdx, [rsp + 0x4c]
imul rcx, rcx, 0x104
add rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
lea rdx, [rsp + 0x4c]
lea rcx, str.iProDifx___LoadSysFileNames___s_
call fcn.140003770
cmp dword [rdi + 0x4b54], 0x14
jge 0x14000421a
test rbx, rbx
je 0x140004221
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140004221
movsxd rax, dword [rdi + 0x4b54]
lea rdx, [rsp + 0x4c]
mov r8d, 0x103
mov rcx, rax
add eax, 1
mov dword [rdi + 0x4b54], eax
imul rcx, rcx, 0x104
add rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
lea rdx, [rsp + 0x4c]
lea rcx, str.iProDifx___LoadSysFileNames___s_
call fcn.140003770
cmp dword [rdi + 0x4b54], 0x14
jl 0x1400041c0
mov eax, 1
jmp 0x140004233
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
jmp 0x140004233
xor eax, eax
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140004400
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rsi, rcx
lea rcx, [rsp + 0x130]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rbp, str.W22NCPA.dll
xor edi, edi
mov rbx, rbp
nop
nop
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x103
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
mov r11d, 0x103
lea rax, [rsp + 0x20]
cmp byte [rax], 0
je 0x140004475
add rax, 1
sub r11, 1
jne 0x140004464
jmp 0x1400044c3
test r11, r11
je 0x1400044c3
mov eax, 0x103
mov edx, 0x103
sub rax, r11
sub rdx, rax
lea rcx, [rsp + rax + 0x20]
je 0x1400044c3
lea r8, [0x14003e394]
sub r8, rcx
nop
nop
movzx eax, byte [r8 + rcx]
test al, al
je 0x1400044b7
mov byte [rcx], al
add rcx, 1
sub rdx, 1
jne 0x1400044a0
jmp 0x1400044bc
test rdx, rdx
jne 0x1400044c0
sub rcx, 1
mov byte [rcx], 0
mov ecx, 0x103
lea rax, [rsp + 0x20]
nop
cmp byte [rax], 0
je 0x1400044e1
add rax, 1
sub rcx, 1
jne 0x1400044d0
jmp 0x140004533
test rcx, rcx
je 0x140004533
mov eax, 0x103
mov edx, 0x103
sub rax, rcx
sub rdx, rax
lea rcx, [rsp + rax + 0x20]
je 0x140004533
movsxd rax, edi
imul rax, rax, 0x104
sub rax, rcx
lea r8, [rax + rbp]
nop
movzx eax, byte [r8 + rcx]
test al, al
je 0x140004527
mov byte [rcx], al
add rcx, 1
sub rdx, 1
jne 0x140004510
jmp 0x14000452c
test rdx, rdx
jne 0x140004530
sub rcx, 1
mov byte [rcx], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140004553
lea rcx, [rsi + 0xe8]
lea rdx, [rsp + 0x20]
call fcn.140002040
add rbx, 0x104
add edi, 1
cmp byte [rbx], 0
jne 0x140004440
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400095b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call fcn.1400114f8
mov rbx, rax
mov rax, qword [rax + 0x78]
test rax, rax
je 0x1400095e7
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x1400095e7
xor r9d, r9d
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageA]
test edi, edi
mov rbx, qword [rbx + 0xa0]
je 0x140009617
test rbx, rbx
je 0x140009617
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140009617
mov rax, qword [rbx]
or rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [rax + 0x2d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000f298
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x14000f300
call fcn.1400114a8
mov r8d, pe_nt_image_headers64
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x14000f300
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x14000f322
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14000ecf4
test rdi, rdi
mov esi, eax
je 0x14000f320
test rbx, rbx
je 0x14000f320
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret