joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026f00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140026f61
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140026f20
mov ecx, dword [r10]
jmp 0x14002704a
cmp ecx, 0x4e0
jb 0x14002704a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140026f80
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140026fd0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140004170
Capabilities:
Read file on windows

Disassembly:
jmp 0x14060d564
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14060d59a
call fcn.14000ae60
mov dword [rax], 0x16
call fcn.14008a4c8
jmp 0x14060d6ea
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14060d6ea
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14060d6ea
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14060d5c9
lock or dword [rcx + 0x14], 0x10
jmp 0x14060d6ea
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14060d5dd
call fcn.1400a4a20
mov ebp, dword [rbx + 0x10]
cmp ebp, 1
jne 0x14060d5ed
mov rax, qword [rbx]
mov r14b, byte [rax]
jmp 0x14060d5f0
xor r14b, r14b
mov rsi, qword [rbx + 8]
mov rcx, rbx
mov edi, dword [rbx + 0x20]
mov qword [rbx], rsi
call fcn.14003df2c
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.140067804
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14060d6d8
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14060d683
mov rcx, rbx
call fcn.14003df2c
cmp eax, 0xffffffff
je 0x14060d66e
mov rcx, rbx
call fcn.14003df2c
cmp eax, 0xfffffffe
je 0x14060d66e
mov rcx, rbx
call fcn.14003df2c
movsxd rdi, eax
lea rsi, [0x140a81a20]
mov rcx, rbx
sar rdi, 6
call fcn.14003df2c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [rsi + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14060d675
lea rdx, [0x14066dae0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14060d683
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14060d6a7
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14060d6a7
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14060d6a7
mov dword [rbx + 0x20], 0x1000
mov rdx, qword [rbx]
cmp ebp, 1
jne 0x14060d6c5
movzx ecx, byte [rdx]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, r14b
or cx, ax
inc rdx
jmp 0x14060d6d0
movzx ecx, word [rdx]
add dword [rbx + 0x10], 0xfffffffe
add rdx, 2
mov qword [rbx], rdx
movzx eax, cx
jmp 0x14060d6ef
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140021e28
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140092854
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140092886
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140092869
mov rax, r8
ret
Function at 0x14002df9c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14002e023
mov rsi, rbx
cmp word [rax], bp
je 0x14002dfe2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14002dfcc
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14002dfc8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400469ac
mov rdi, rax
test rax, rax
je 0x14002e010
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1405ed0c0
mov rbp, rdi
xor ecx, ecx
call fcn.14008669c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14002f710
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140647b00]
movdqu xmmword [rsp + 0x60], xmm1
xor edi, edi
mov word [rsp + 0x50], di
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
mov word [rsp + 0x30], di
mov qword [rbp + 0xa8], rdi
mov dword [rbp + 0x98], edi
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x70]
call fcn.1405ed770
mov dword [rbp + 0xa0], 0xfe
lea rdx, [rsp + 0x50]
lea ecx, [rdi + 0x13]
call fcn.14003f360
lea rdx, [rsp + 0x30]
lea ecx, [rdi + 0x14]
call fcn.14003f360
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002f830
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x98]
xor r8d, r8d
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002f822
cmp dword [rbp + 0x98], 1
jne 0x14002f822
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140020bd0
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14002f86e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f869
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f8d0
call fcn.14002bfe4
movdqa xmm0, xmmword [0x140647b00]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], di
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14002f8bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f8ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f8ca
call fcn.14002bfe4
add rsp, 0x170
pop rdi
pop rbx
pop rbp
ret
call fcn.140012048
nop
call fcn.140012048
nop
int3
Function at 0x14004cd20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14004cd48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14004cd48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14004ecd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov ebp, ecx
xor edi, edi
cmp qword [rdx + 0x18], 0x10
jb 0x14004ed04
mov rbx, qword [rdx + 0x10]
mov rax, rbx
mov rcx, qword [rdx]
jmp 0x14004ed0e
mov rax, qword [rdx + 0x10]
mov rbx, rax
mov rcx, r14
mov rdx, rdi
add rcx, rdx
sub rbx, rax
mov r8, rbx
sub r8, rdx
inc r8
lea rdx, [rcx + rax]
call fcn.1405ed0c0
mov qword [r14 + 0x10], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
cmp ebp, 0xa
ja case.default.0x14004ed55
lea rdx, [0x140000000]
mov ecx, dword [rdx + rbp*4 + 0x4ef40]
add rcx, rdx
jmp rcx
lea r8, [0x140a7e878]
mov r9d, 0x18
jmp 0x14004ede2
lea r8, [0x140a7e910]
jmp 0x14004eddc
lea r8, [0x140a7e930]
mov r9d, 0x18
jmp 0x14004ede2
lea r8, [0x140a7e9a8]
jmp 0x14004eddc
lea r8, [0x140a7e988]
jmp 0x14004eddc
lea r8, [0x140a7e8a8]
jmp 0x14004eddc
lea r8, [0x140a7e948]
mov r9d, 0x28
jmp 0x14004ede2
lea r8, [0x140a7e890]
mov r9d, 0x18
jmp 0x14004ede2
lea r8, [0x140a7e970]
mov r9d, 0x18
jmp 0x14004ede2
lea r8, [0x140a7e8c8]
mov r9d, 0x28
jmp 0x14004ede2
lea r8, [0x140a7e8f0]
mov r9d, 0x20
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14006fef0
mov r9, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub r9, rbx
lea rcx, [r9 - 1]
test rcx, rcx
je 0x14004ee1e
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + rcx - 1]
sub byte [rbx + rcx], al
sub rcx, 1
jne 0x14004ee10
test r9, r9
je 0x14004eead
cmp r9, 0x40
jb 0x14004ee94
mov rcx, r9
and rcx, 0xffffffffffffffc0
movdqa xmm2, xmmword [0x140647ba0]
lea rax, [rbx + 0x20]
movdqu xmm0, xmmword [rax - 0x20]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm0, xmmword [rax - 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
movdqu xmm0, xmmword [rax]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
pxor xmm0, xmm2
movdqu xmmword [rax + 0x10], xmm0
add rdi, 0x40
lea rax, [rax + 0x40]
cmp rdi, rcx
jb 0x14004ee40
cmp rdi, r9
jae 0x14004eead
lea rax, [rbx + rdi]
mov rcx, r9
sub rcx, rdi
nop
xor byte [rax], 0xe9
lea rax, [rax + 1]
sub rcx, 1
jne 0x14004eea0
lea rdx, [rbx + 8]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14004eec0
lea rax, [r9 - 8]
cmp r8, rax
jb 0x14004eed7
lea r8, [r9 - 9]
mov rcx, r14
call fcn.1400a92b0
mov rdi, qword [rsp + 0x30]
jmp 0x14004eee9
mov rbx, rdi
test rbx, rbx
je 0x14004ef1d
sub rdi, rbx
cmp rdi, 0x1000
jb 0x14004ef12
add rdi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14004ef38
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.14002bfe4
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
call fcn.140012048
int3
Function at 0x140051dc0
Capabilities:
Get token membership

Disassembly:
mov rax, rsp
sub rsp, 0x68
cmp dword [0x140a82824], 0
jne 0x140051e7f
mov qword [rax + 0x20], rbx
xor ebx, ebx
mov qword [rax + 0x18], rbx
mov r9d, 0x220
mov qword [rax - 8], rdi
mov dl, 2
mov dword [rax + 0x10], 0
lea rcx, [rsp + 0x78]
mov word [rax + 0x14], 0x500
lea rax, [rax + 0x18]
mov qword [rsp + 0x50], rax
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea edi, [rbx + 1]
test eax, eax
je 0x140051e6c
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0x70]
xor ecx, ecx
mov dword [rsp + 0x70], ebx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x140051e5e
mov eax, dword [0x140a82820]
cmp dword [rsp + 0x70], ebx
cmovne eax, edi
mov dword [0x140a82820], eax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rbx, qword [rsp + 0x88]
mov dword [0x140a82824], edi
mov rdi, qword [rsp + 0x60]
mov eax, dword [0x140a82820]
add rsp, 0x68
ret
Function at 0x140052080
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140069ec8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140069ec8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400521d0
cmp rax, 0xffffffffffffffff
je 0x1400521d0
xor edi, edi
test rbp, rbp
jle 0x14005217b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14000bb80
mov rbx, rax
test rax, rax
jne 0x140052108
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140052171
mov edx, 0x8000
mov ecx, r14d
call fcn.1400629f0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400041fc
cmp eax, 0xffffffff
je 0x140052151
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140052118
mov edx, r15d
mov ecx, r14d
call fcn.1400629f0
jmp 0x140052171
cmp byte [rsi + 0x38], dil
je 0x140052168
cmp dword [rsi + 0x34], 5
jne 0x140052168
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140052171
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14008669c
jmp 0x1400521e4
jns 0x1400521e4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140069ec8
cmp rax, 0xffffffffffffffff
jne 0x14005219c
cmp byte [rsi + 0x30], dil
je 0x1400521e4
mov edi, dword [rsi + 0x2c]
jmp 0x1400521e4
mov ecx, r14d
call fcn.14002d4dc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400521e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400521e4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400521dd
mov eax, dword [rsi + 0x2c]
jmp 0x1400521e2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140069ec8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14006b564
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x14006b596
call fcn.14000ae60
mov dword [rax], 0x16
call fcn.14008a4c8
jmp 0x14006b6b5
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14006b6b5
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14006b6b5
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14006b5c5
lock or dword [rcx + 0x14], 0x10
jmp 0x14006b6b5
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14006b5d9
call fcn.1400a4a20
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.14003df2c
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.140067804
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14006b6a3
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14006b66e
mov rcx, rsi
call fcn.14003df2c
cmp eax, edi
je 0x14006b659
mov rcx, rsi
call fcn.14003df2c
cmp eax, 0xfffffffe
je 0x14006b659
mov rcx, rsi
call fcn.14003df2c
movsxd rbx, eax
lea r14, [0x140a81a20]
mov rcx, rsi
sar rbx, 6
call fcn.14003df2c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14006b660
lea rdx, [0x14066dae0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14006b66e
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x14006b692
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x14006b692
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x14006b692
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x14006b6b8
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret

Function at 0x14007c6e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007c732
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007c732
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007c732
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007c732
cmp dword [rcx + 0x84], 0xe
jbe 0x14007c732
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14007c734
xor al, al
add rsp, 0x28
ret
Function at 0x140090580
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rsi, rdx
mov edi, ecx
xor r14d, r14d
mov ebx, r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
movdqa xmm1, xmmword [0x140647b00]
movdqu xmmword [rbp + 0x27], xmm1
mov word [rbp + 0x17], r14w
movups xmmword [rbp - 9], xmm0
movdqu xmmword [rbp + 7], xmm1
mov word [rbp - 9], r14w
mov qword [rbp + 0x7f], r14
lea rdx, [rbp + 0x17]
lea ecx, [r14 + 0xf]
call fcn.14003f360
lea rdx, [rbp - 9]
lea ecx, [r14 + 0x10]
call fcn.14003f360
test edi, edi
jne 0x14009066c
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rdx, qword [rbp + 0x17]
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
mov edi, 1
mov r9d, edi
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400906e7
mov dword [rbp + 0x67], r14d
mov dword [rbp + 0x77], 4
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rdx, qword [rbp - 9]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x67]
xor r8d, r8d
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400906e7
cmp dword [rbp + 0x67], 4
jne 0x1400906e7
mov ebx, edi
jmp 0x1400906e7
cmp edi, 1
jne 0x1400906e7
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rdx, qword [rbp + 0x17]
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400906e7
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rdx, qword [rbp - 9]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rsi
lea r9d, [rdi + 3]
xor r8d, r8d
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
cmove ebx, edi
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x1400906f7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x140090733
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009072e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140090797
call fcn.14002bfe4
movdqa xmm0, xmmword [0x140647b00]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp - 9], r14w
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x140090781
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009077c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140090791
call fcn.14002bfe4
mov eax, ebx
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140012048
nop
call fcn.140012048
nop
int3
Function at 0x140095cac
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140095cdc
xor eax, eax
jmp 0x140095d9f
mov rbp, rbx
cmp word [rax], si
je 0x140095d01
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140095ce8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140095ce4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14005be40
movsxd r14, eax
test eax, eax
jne 0x140095d3f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140095cd5
mov rcx, r14
call fcn.1400469ac
mov rdi, rax
test rax, rax
jne 0x140095d58
xor ecx, ecx
call fcn.14008669c
jmp 0x140095d34
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14005be40
test eax, eax
jne 0x140095d89
mov rcx, rdi
call fcn.14008669c
jmp 0x140095d93
xor ecx, ecx
call fcn.14008669c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140096d38
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140083450
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140096dc2
cmp byte [rbp - 0x21], r15b
je 0x140096dbd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140096df8
call fcn.14002dc44
test eax, eax
jne 0x140096de4
cmp byte [rbp - 0x21], r15b
je 0x140096ddc
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140096df8
cmp byte [rbp - 0x21], r15b
je 0x140096df5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140075154
test eax, eax
jne 0x140096e98
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140083450
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140096e37
cmp byte [rbp - 0x21], r15b
je 0x140096e6c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140096e6c
call fcn.14002dc44
test eax, eax
jne 0x140096e58
cmp byte [rbp - 0x21], r15b
je 0x140096e51
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140096e6c
cmp byte [rbp - 0x21], r15b
je 0x140096e69
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140075154
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140096e98
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140096e9b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140096ea9
mov rcx, rdi
call fcn.14008669c
cmp byte [rbp + 0x3f], r15b
je 0x140096eb8
mov rcx, qword [rbp + 0x27]
call fcn.14008669c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14009b1f8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14009b218
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14009330c
or eax, 0xffffffff
jmp 0x14009b21a
xor eax, eax
add rsp, 0x28
ret