joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d3ad4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
mov rcx, qword [0x140148ea8]
lea rbp, [0x140148ea8]
mov ebx, 1
cmp rcx, rbp
je 0x1400d3b0c
test byte [rcx + 0x1c], bl
je 0x1400d3b0c
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x16]
lea r8, [0x1400091b8]
call fcn.14000fcb0
lea rax, [rsp + 0x78]
lea rdx, [0x1400d3c20]
xor esi, esi
and qword [rsp + 0x78], rsi
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d3bbf
mov rdi, qword [rsp + 0x78]
and dword [rsp + 0x60], esi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
lea rdx, [0x1400d3c80]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400d3bbf
cmp dword [rsp + 0x70], 4
jne 0x1400d3bbf
test eax, eax
jne 0x1400d3bbf
cmp dword [rsp + 0x60], ebx
jne 0x1400d3bbf
mov esi, ebx
mov rcx, qword [0x140148ea8]
cmp rcx, rbp
je 0x1400d3bf4
test byte [rcx + 0x1c], 2
je 0x1400d3bc6
cmp byte [rcx + 0x19], 3
jb 0x1400d3bc6
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x18]
lea r8, [0x1400091b8]
call fcn.14000fcb0
mov rcx, qword [0x140148ea8]
cmp rcx, rbp
je 0x1400d3bf4
test byte [rcx + 0x1c], bl
je 0x1400d3bf4
cmp byte [rcx + 0x19], 5
jb 0x1400d3bf4
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
test esi, esi
lea r8, [0x1400091b8]
mov edx, DispGetParam
sete r9b
call fcn.14000fd64
xor ebx, ebx
test esi, esi
sete bl
test rdi, rdi
je 0x1400d3c09
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d874c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, r9
mov r14, r8
mov rdi, rdx
mov r15, rcx
lea rbx, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rbx
je 0x1400d87ba
test byte [rcx + 0x1c], 1
je 0x1400d87ba
cmp byte [rcx + 0x19], 5
jb 0x1400d87ba
mov edx, 0x54
mov qword [rax - 0x58], r8
mov r9, rdi
lea r8, [0x1400091f8]
mov rcx, qword [rcx + 0x10]
call fcn.140017150
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.140011450
nop
lea rcx, [rbp - 0x28]
call fcn.140043db4
mov r8, qword [rbp - 0x28]
lea rdx, [rbp - 0x18]
mov rcx, r15
call fcn.1400da77c
mov esi, eax
test eax, eax
jne 0x1400d8870
mov dword [rbp - 0x30], 4
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x2c]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1400d8831
cmp dword [rbp - 0x2c], 4
je 0x1400d882f
lea esi, [rax + 0xd]
jmp 0x1400d889c
xor esi, esi
cmp esi, 2
jne 0x1400d889c
mov esi, 0x490
mov r10, qword [0x140148ea8]
cmp r10, rbx
je 0x1400d88dd
test byte [r10 + 0x1c], 2
je 0x1400d88a3
cmp byte [r10 + 0x19], 4
jb 0x1400d88a3
mov edx, 0x55
lea r8, [0x1400091f8]
mov rcx, qword [r10 + 0x10]
call fcn.14000fcb0
jmp 0x1400d889c
cmp eax, 2
jne 0x1400d889c
mov rax, qword [r15]
mov rbx, qword [rax + 0x38]
mov rcx, rbx
call qword [fcn.140015690]
mov r9, r12
mov r8, r14
mov rdx, rdi
mov rcx, r15
call rbx
mov esi, eax
lea rbx, [0x140148ea8]
mov r10, qword [0x140148ea8]
cmp r10, rbx
je 0x1400d88dd
test byte [r10 + 0x1c], 1
je 0x1400d88dd
movzx edx, byte [r10 + 0x19]
mov eax, esi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1400d88dd
mov edx, 0x56
mov r9d, esi
lea r8, [0x1400091f8]
mov rcx, qword [r10 + 0x10]
call fcn.14000fd64
nop
mov r14, qword [rbp - 0x28]
lock add dword [r14 - 8], 0xffffffff
jg 0x1400d8907
mov rdi, qword [r14 - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [r14 - 0x18]
mov rcx, rdi
call rbx
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400d8916
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400e0548
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r15d, r15d
mov r14, rdx
lea rax, [rbp - 0x10]
lea rdx, [0x1400e0760]
mov r9d, 0x101
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x10], r15
mov dword [rbp + 0x48], r15d
mov dword [rbp + 0x30], r15d
mov dword [rbp + 0x40], r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400e05b6
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400e072f
mov rcx, qword [rbp - 0x10]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
lea rax, [rbp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x30]
xor edx, edx
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1400e05a3
cmp dword [rbp + 0x48], r15d
jne 0x1400e060e
mov ebx, r15d
jmp 0x1400e072f
mov eax, dword [rbp + 0x30]
inc eax
mov ecx, eax
mov dword [rbp + 0x30], eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140105a40
mov rsi, rax
test rax, rax
jne 0x1400e0645
mov ebx, 0x8007000e
jmp 0x1400e072f
mov ecx, dword [rbp + 0x40]
add ecx, 2
mov eax, ecx
and eax, 1
add ecx, eax
mov dword [rbp + 0x40], ecx
call fcn.140105a40
mov rdi, rax
test rax, rax
jne 0x1400e066c
mov ebx, 0x8007000e
jmp 0x1400e071a
mov ebx, r15d
cmp dword [rbp + 0x48], r15d
jbe 0x1400e0717
mov r8d, dword [rbp + 0x30]
xor edx, edx
mov rcx, rsi
add r8, r8
call sub.msvcrt.dll_memset
mov r8d, dword [rbp + 0x40]
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_memset
mov eax, dword [rbp + 0x30]
mov rcx, qword [rbp - 0x10]
mov dword [rbp - 0x1c], eax
mov eax, dword [rbp + 0x40]
lea r9, [rbp - 0x1c]
mov dword [rbp - 0x20], eax
lea rax, [rbp - 0x20]
mov r8, rsi
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
mov edx, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_RegEnumValueW]
test eax, eax
jne 0x1400e070c
cmp dword [rbp - 0x18], 1
jne 0x1400e070c
lea rdx, [0x1400e07b8]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1400e070c
mov eax, dword [rbp - 0x20]
lea rcx, [r14 + 8]
mov r8, rdi
shr rax, 1
mov rdx, rsi
mov word [rdi + rax*2 - 2], r15w
call fcn.14010ad08
inc ebx
cmp ebx, dword [rbp + 0x48]
jb 0x1400e0679
mov ebx, r15d
mov rcx, rsi
call fcn.140105ac0
test rdi, rdi
je 0x1400e072f
mov rcx, rdi
call fcn.140105ac0
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400e073e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e1960
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x258
mov rax, qword [0x140148058]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.14010ba78
lea rdx, [rsp + 0x40]
mov r8d, 0x100
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1400e19bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
jmp 0x1400e19da
cdqe
cmp rax, 0x100
jae 0x1400e19de
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14010bed8
xor ecx, ecx
test eax, eax
cmovs ecx, eax
test ecx, ecx
jns 0x1400e1a4a
mov ebx, 1
lea rdx, [0x140009520]
xor r9d, r9d
mov dword [rsp + 0x30], ebx
and dword [rsp + 0x28], 0
mov r8, rsi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rdi
call fcn.140111c10
mov ecx, eax
test eax, eax
jns 0x1400e1a4a
mov dword [rsp + 0x30], ebx
and dword [rsp + 0x28], 0
lea rdx, [0x140009580]
xor r9d, r9d
mov r8, rsi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rdi
call fcn.140111c10
mov ecx, eax
test eax, eax
jns 0x1400e1a4a
mov rdx, rbp
mov rcx, rdi
call fcn.14010bed8
mov ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140001000
add rsp, 0x258
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400e1b0c
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x230
mov rax, qword [0x140148058]
xor rax, rsp
mov qword [rsp + 0x220], rax
and dword [rcx], 0
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1400e1b5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x1400e1b7e
cdqe
cmp rax, 0x100
jb 0x1400e1b6f
mov eax, 0x8007007a
jmp 0x1400e1b7e
lea rcx, [rsp + 0x20]
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rbx], eax
xor eax, eax
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140001000
add rsp, 0x230
pop rbx
ret

Function at 0x1400e1b98
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x230
mov rax, qword [0x140148058]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rax, rdx
mov rdi, rcx
xor ebx, ebx
mov dword [rcx], ebx
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1400e1bf0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x1400e1c15
cdqe
cmp rax, 0x100
jb 0x1400e1c01
mov eax, 0x8007007a
jmp 0x1400e1c15
lea rcx, [rsp + 0x20]
call qword [sym.imp.msvcrt.dll__wtoi]
test eax, eax
setne bl
xor eax, eax
mov dword [rdi], ebx
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140001000
mov rbx, qword [rsp + 0x250]
add rsp, 0x230
pop rdi
ret
Function at 0x1400e1f08
Capabilities:
Create directory
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdx, rcx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1400e1f6c
cmp eax, 0x104
jb 0x1400e1f30
mov ecx, 0x8007007a
jmp 0x1400e1f84
lea r8, [0x1400e1f90]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcscat_s]
test eax, eax
je 0x1400e1f50
mov ecx, 0x80004005
jmp 0x1400e1f84
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400e1f82
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400e1f82
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
jmp 0x1400e1f84
xor ecx, ecx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x1400e39a0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
mov rsi, rcx
lea rcx, [rbp + 0x28]
lea edi, [rbx + 1]
xor r8d, r8d
xor edx, edx
mov r9d, edi
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x20], rbx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400e3a27
cmp qword [rbp + 0x28], rbx
je 0x1400e3a27
mov rcx, qword [rbp + 0x28]
lea r8, [rbp + 0x20]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rbp + 0x20]
cmp rcx, 0xfffffffffb69296b
ja 0x1400e39e3
movabs rax, 0xabcc77118461cefd
mul rcx
shr rdx, 0x1a
imul rax, rdx, 0x5f5e100
sub rdi, rax
add rcx, rdi
mov qword [rbp + 0x20], rcx
jmp 0x1400e3a2b
mov rcx, qword [rbp + 0x20]
test rcx, rcx
jne 0x1400e3aae
call qword [sym.imp.msvcrt.dll_time]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_srand]
call qword [sym.imp.msvcrt.dll_rand]
xorps xmm1, xmm1
movd xmm0, eax
mov eax, 0x5f5e0ff
cvtsi2sd xmm1, rax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x1400e3af8]
test rax, rax
jns 0x1400e3a6f
addsd xmm1, qword [0x14000be28]
mulsd xmm0, xmm1
movsd xmm1, qword [0x14000be20]
xor eax, eax
addsd xmm0, qword [0x14000bdf0]
comisd xmm0, xmm1
jb 0x1400e3aa2
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x1400e3aa2
movabs rcx, 0x8000000000000000
mov rax, rcx
cvttsd2si rcx, xmm0
add rcx, rax
mov qword [rbp + 0x20], rcx
cmp qword [rbp + 0x28], rbx
je 0x1400e3ac4
mov rcx, qword [rbp + 0x28]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 0x20]
test ecx, ecx
je 0x1400e3adc
mov eax, 0xabcc76f5
mul ecx
shr edx, 0x1a
imul eax, edx, 0x5f5e101
sub ecx, eax
jne 0x1400e3ae1
mov ebx, 0x80004005
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov dword [rsi], ecx
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e3bd8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rdi, rcx
and qword [rsp + 0x68], rbx
and dword [rsp + 0x60], ebx
test rcx, rcx
jne 0x1400e3bff
mov ebx, 0x80070057
jmp 0x1400e3cee
lea r8, [0x1400e3d00]
lea rdx, [0x140009580]
xor r9d, r9d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], rbx
call fcn.140111a50
mov dword [rsp + 0x60], eax
test eax, eax
jne 0x1400e3cd8
lea rax, [rsp + 0x60]
test rax, rax
jne 0x1400e3c46
mov ebx, 0x80070057
jmp 0x1400e3c56
lea rcx, [rsp + 0x60]
call fcn.1400e39a0
mov ebx, eax
test eax, eax
jns 0x1400e3c5d
and dword [rsp + 0x60], 0
jmp 0x1400e3cd8
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x68]
lea rdx, [0x140009580]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20106
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400e3cca
mov rcx, qword [rsp + 0x68]
lea r9d, [rax + 4]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], r9d
lea rdx, [0x1400e3d00]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400e3cd8
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x68]
mov eax, dword [rsp + 0x60]
mov dword [rdi], eax
test rcx, rcx
je 0x1400e3cee
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400e4358
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r15, qword [rbp + 0x60]
xor edi, edi
lea rax, [0x1400092e0]
and qword [rbp + 0x58], rdi
and dword [rbp + 0x40], edi
and dword [rbp + 0x50], edi
mov r13, 0xffffffff80000002
mov dword [rbp + 0x48], 4
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], r8
mov rbx, r13
mov qword [rbp - 0x10], r9
test r15, r15
jne 0x1400e43b4
mov edi, 0x80070057
jmp 0x1400e448d
and dword [r15], edi
lea rsi, [rbp - 0x30]
xor r14d, r14d
mov rdx, qword [rsi]
test rdx, rdx
je 0x1400e4421
lea rax, [rbp + 0x58]
mov r9d, 0x101
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400e440a
cmp rbx, r13
je 0x1400e43f3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rbp + 0x58]
and qword [rbp + 0x58], rdi
inc r14d
add rsi, 8
cmp r14d, 5
jb 0x1400e43be
jmp 0x1400e4421
and qword [rbp + 0x58], rdi
cmp eax, 2
je 0x1400e4421
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
cmp rbx, r13
je 0x1400e446b
lea rax, [rbp + 0x48]
lea r9, [rbp + 0x40]
lea rdx, [0x140009350]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e446b
cmp dword [rbp + 0x40], 4
jne 0x1400e446b
cmp dword [rbp + 0x48], 4
jne 0x1400e446b
cmp dword [rbp + 0x50], eax
jbe 0x1400e446b
mov dword [r15], 1
test rbx, rbx
je 0x1400e447e
cmp rbx, r13
je 0x1400e447e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x1400e448d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x60
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400e47d8
Capabilities:
Delete registry key

Disassembly:
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov r14, r9
mov r15, r8
mov rsi, rdx
mov rdi, rcx
lea rcx, [rbp - 0x18]
call fcn.140109a60
nop
lea rdx, [0x140009390]
lea rcx, [rbp - 0x18]
call fcn.14010bed8
mov ebx, eax
test eax, eax
js 0x1400e4926
test rdi, rdi
je 0x1400e4860
lea rdx, [0x140001cb8]
lea rcx, [rbp - 0x18]
call fcn.14010ae18
mov ebx, eax
test eax, eax
js 0x1400e4926
mov rdx, rdi
lea rcx, [rbp - 0x18]
call fcn.14010ae18
mov ebx, eax
test eax, eax
js 0x1400e4926
test rsi, rsi
je 0x1400e4895
lea rdx, [0x140001cb8]
lea rcx, [rbp - 0x18]
call fcn.14010ae18
mov ebx, eax
test eax, eax
js 0x1400e4926
mov rdx, rsi
lea rcx, [rbp - 0x18]
call fcn.14010ae18
mov ebx, eax
test eax, eax
js 0x1400e4926
test r15, r15
je 0x1400e48c2
lea rdx, [0x140001cb8]
lea rcx, [rbp - 0x18]
call fcn.14010ae18
mov ebx, eax
test eax, eax
js 0x1400e4926
mov rdx, r15
lea rcx, [rbp - 0x18]
call fcn.14010ae18
mov ebx, eax
test eax, eax
js 0x1400e4926
test r14, r14
je 0x1400e48ef
lea rdx, [0x140001cb8]
lea rcx, [rbp - 0x18]
call fcn.14010ae18
mov ebx, eax
test eax, eax
js 0x1400e4926
mov rdx, r14
lea rcx, [rbp - 0x18]
call fcn.14010ae18
mov ebx, eax
test eax, eax
js 0x1400e4926
lea rcx, [rbp - 0x18]
call fcn.140109d20
mov rdx, rax
neg dword [rbp + 0x40]
sbb rcx, rcx
neg rcx
add rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, 0xfffffffd
je 0x1400e4926
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rcx, [rbp - 0x18]
call fcn.140109cb0
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x1400e72f0
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov rcx, qword [0x140148ea8]
lea r15, [0x140148ea8]
mov esi, 2
cmp rcx, r15
je 0x1400e733c
test byte [rcx + 0x1c], sil
je 0x1400e733c
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 8]
lea r8, [0x140009628]
call fcn.14000fcb0
mov eax, 0x1f40
xor ebx, ebx
mov dword [rsp + 0x58], eax
lea rdx, [0x140009620]
mov ecx, eax
call fcn.140123188
mov rdi, rax
test rax, rax
je 0x1400e73c8
xor r8d, r8d
lea rax, [rsp + 0x58]
mov r9, rdi
lea edx, [r8 + 0xe]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov ebp, eax
cmp eax, 0x7a
je 0x1400e7385
cmp eax, 0x6f
jne 0x1400e739c
mov rcx, rdi
call sub.msvcrt.dll_free
inc ebx
xor edi, edi
cmp ebx, 3
jae 0x1400e73ae
mov eax, dword [rsp + 0x58]
jmp 0x1400e7347
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400e73cd
movzx ebx, bp
or ebx, 0x80070000
test ebp, ebp
cmovle ebx, ebp
test ebx, ebx
js 0x1400e73cd
mov qword [r14 + 0x10], rdi
xor edi, edi
jmp 0x1400e73cd
mov ebx, 0x8007000e
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, qword [0x140148ea8]
cmp rcx, r15
je 0x1400e740f
test byte [rcx + 0x1c], sil
je 0x1400e740f
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, 5
cmovns esi, eax
cmp edx, esi
jl 0x1400e740f
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 6]
lea r8, [0x140009628]
mov r9d, ebx
call fcn.14000fd64
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1400f93ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140148058]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r15d, 0x50
mov rcx, rax
lea edx, [r15 - 0x48]
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400f9531
mov r8, r15
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
xor edi, edi
mov eax, edi
mov ecx, edi
inc edi
shr eax, 2
mov edx, eax
shl eax, 2
sub ecx, eax
movzx eax, byte [rsi]
inc rsi
shl ecx, 3
shl eax, cl
or dword [rbx + rdx*4], eax
cmp edi, 0x14
jb 0x1400f9415
mov eax, dword [0x1401480ec]
xor r8d, r8d
mov dword [rbp - 0x40], 0x123174bb
mov dword [rbp - 0x28], eax
mov eax, dword [0x1401480f0]
mov dword [rbp - 0x3c], 0x86521ff8
mov dword [rbp - 0x24], eax
mov eax, dword [0x1401480f4]
mov dword [rbp - 0x38], 0x98d2438b
mov dword [rbp - 0x20], eax
mov eax, dword [0x1401480f8]
mov dword [rbp - 0x34], 0x7966ce12
mov dword [rbp - 0x1c], eax
mov eax, dword [0x1401480fc]
mov dword [rbp - 0x30], 0xc5d92014
lea rdi, [rbp - 0x28]
lea r9d, [r8 + 5]
mov dword [rbp - 0x18], eax
mov rcx, r8
movabs rax, 0xcccccccccccccccd
mul r8
inc r8
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rbp + rcx*4 - 0x40]
xor dword [rdi], eax
lea rdi, [rdi + 4]
dec r9
jne 0x1400f9493
mov rax, qword [rbp - 0x28]
mov r9d, dword [0x140148100]
mov qword [rsp + 0x30], r14
and qword [rsp + 0x28], 0
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x38], rax
mov eax, dword [rbp - 0x18]
lea r8, [rbp - 0x40]
mov dword [rbp - 0x30], eax
lea rax, [0x140148c30]
mov edx, reloc.Cabinet.dll_FDICreate
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400ffd20
xor eax, eax
lea rdi, [rbp - 0x40]
lea ecx, [rax + 0x14]
rep stosb byte [rdi], al
mov rdi, rbx
mov rcx, r15
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140001000
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400fa458
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
cmp dword [0x14014d1e8], 0
mov rbx, rdx
mov rdi, rcx
jne 0x1400fa54f
lea rax, [0x14014cdd0]
test rax, rax
je 0x1400fa4b7
and dword [0x14014cdd8], 0
and dword [0x14014cde0], 0
mov dword [0x14014cdd0], 0x1423
mov dword [0x14014cdd4], 0x100
mov dword [0x14014cddc], 7
mov dword [0x14014cde4], 1
lea rax, [rsp + 0x80]
lea rdx, [0x140009750]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 1
and dword [rsp + 0x20], 0
mov dword [rsp + 0x70], 0x50
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400fa545
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [0x14014cef0]
lea rdx, [0x140009740]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x14014d1e8], 1
test rdi, rdi
je 0x1400fa569
test rbx, rbx
je 0x1400fa569
mov r8d, dword [rbx]
test r8d, r8d
je 0x1400fa569
mov rdx, qword [rdi]
call fcn.140102730
mov eax, 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400fb3c8
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x5c]
call sub.msvcrt.dll_memset
mov dword [rbx + 0x48], 0x67452301
mov dword [rbx + 0x4c], 0xefcdab89
mov dword [rbx + 0x50], 0x98badcfe
mov dword [rbx + 0x54], 0x10325476
mov dword [rbx + 0x58], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret