joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f968
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, rdx
mov rbx, rcx
xor r13d, r13d
cmp dword [rcx + 0x244], r13d
jne 0x14000f99f
mov rdx, qword [rdx]
or r14, 0xffffffffffffffff
jmp 0x14000fb49
lea rdx, [0x1400613a8]
or r14, 0xffffffffffffffff
mov rax, r14
inc rax
cmp word [rdx + rax*2], r13w
jne 0x14000f9ad
mov r8d, eax
mov rcx, r15
call fcn.14000254c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [rbx + 0x248], r13d
je 0x14000faca
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileType]
test al, 1
jne 0x14000fa9f
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, r14d
mov r8, qword [r15]
xor edx, edx
mov esi, 0xfde9
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rcx, rbx
call fcn.140002b8c
mov rdi, rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, qword [r15]
xor edx, edx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ebx, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov r8, r14
inc r8
cmp byte [rdi + r8], r13b
jne 0x14000fa64
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x80]
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov rcx, rdi
jmp 0x14000fb40
mov rdx, qword [r15]
mov r8d, dword [rdx - 0x10]
add r8d, r8d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x80]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x14000fb46
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ebp, eax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov rcx, qword [r15]
movsxd rdi, dword [rcx - 0x10]
lea rcx, [rdi + 1]
call fcn.140002b8c
mov rsi, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.140033f10
mov r8d, edi
mov rdx, rsi
mov rcx, qword [r15]
call qword [sym.imp.USER32.dll_CharToOemBuffW]
mov byte [rdi + rsi], r13b
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x80]
mov r8d, edi
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov rcx, rsi
call fcn.14001279c
nop
mov rdx, qword [r15]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14000fb65
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140010ae8
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x50
mov rsi, rcx
lea rcx, [rbp + 0x58]
call fcn.140002130
nop
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
or r13, 0xffffffffffffffff
xor r12d, r12d
cmp dword [rsi + 0x48], r12d
je 0x140010c22
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileType]
test al, 1
jne 0x140010bf8
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, r13d
mov r8, qword [rbp + 0x58]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.140002b8c
mov r14, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.140033f10
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
mov r9d, r13d
mov r8, qword [rbp + 0x58]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [rdi - 1]
cdqe
mov byte [rax + r14], r12b
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ebx, eax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov r8, r13
inc r8
cmp byte [r14 + r8], r12b
jne 0x140010bbd
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x50]
mov rdx, r14
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov rcx, r14
call fcn.14001279c
jmp 0x140010c75
mov rdx, qword [rbp + 0x58]
mov r8d, dword [rdx - 0x10]
add r8d, r8d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x40]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x140010c75
mov rdx, qword [rbp + 0x58]
lea rcx, [rbp - 0x10]
call fcn.14000cf58
mov rdx, qword [rbp - 0x10]
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x40]
mov r8d, dword [rdx - 0x10]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140010c75
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140010c95
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140011a5c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov ebp, r8d
mov rdi, rcx
mov r14, r9
mov r15, rdx
lea eax, [rbp + 1]
mov ecx, eax
mov ebx, eax
call fcn.140002b8c
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.140033f10
or r10, 0xffffffffffffffff
xor r9d, r9d
inc r10
cmp byte [r14 + r10], r9b
jne 0x140011aa3
lea r8, [rdi + 0x40]
mov r11d, r9d
mov rbx, r8
xor edx, edx
mov eax, r11d
div r10d
mov al, byte [rdx + r14]
mov byte [rbx], r11b
inc r11d
mov byte [rbx + 0x100], al
inc rbx
cmp r11d, 0xff
jle 0x140011ab6
mov r10b, r9b
mov r11d, 0x100
mov dl, byte [r8]
mov al, byte [r8 + 0x100]
add al, dl
add r10b, al
movzx ecx, r10b
mov al, byte [rcx + rdi + 0x40]
mov byte [r8], al
inc r8
mov byte [rcx + rdi + 0x40], dl
sub r11, 1
jne 0x140011ae3
mov r11b, r9b
test ebp, ebp
je 0x140011b5b
mov r10, rsi
sub r15, rsi
mov rbx, rbp
inc r9b
movzx r8d, r9b
movzx edx, byte [r8 + rdi + 0x40]
add r11b, dl
movzx ecx, r11b
mov al, byte [rcx + rdi + 0x40]
mov byte [r8 + rdi + 0x40], al
mov byte [rcx + rdi + 0x40], dl
movzx ecx, byte [r8 + rdi + 0x40]
add rcx, rdx
movzx eax, cl
mov cl, byte [rax + rdi + 0x40]
xor cl, byte [r15 + r10]
mov byte [r10], cl
inc r10
sub rbx, 1
jne 0x140011b1a
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140017458
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.140027e6c
mov rdi, rax
test rax, rax
je 0x1400174d4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x1400174cf
cmp dword [rbx], 0x40
jb 0x1400174cf
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1400174cf
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x1400174d8
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14001d648
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x78
test rdx, rdx
je 0x14001d6b0
mov r10, qword [rcx + 0x10]
test r10, r10
je 0x14001d69a
cmp qword [rcx + 0x18], 0
jne 0x14001d695
mov eax, dword [rcx + 0xc]
cmp eax, dword [rcx + 0x30]
jae 0x14001d6b6
mov qword [rsp + 0x58], rdx
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x50
mov edx, eax
mov dword [rsp + 0x24], 0x40
mov r8d, 1
mov rcx, qword [r10 + 8]
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
add rsp, 0x78
ret
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x14001d6b0
mov rcx, qword [rcx + 0x40]
add rsp, 0x78
jmp 0x140027dac
call fcn.140013428
int3
call fcn.140013428
int3
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x1400736a0]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x140027e63
test rdx, rdx
je 0x140027e63
mov rcx, rdx
call fcn.14003ad30
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
mov rsi, rax
call fcn.140033f10
mov eax, 0x100
cmp rsi, rax
ja 0x140027e32
mov r8d, eax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, esi
jne 0x140027e32
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140027e3e
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140031760
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140013428
int3
Function at 0x140021b54
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x160
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400736a0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
call fcn.14001af58
nop
lea rax, vtable.CWinApp.0
mov qword [rbx], rax
xor esi, esi
test rdi, rdi
je 0x140021bae
mov rcx, rdi
call fcn.14003d270
jmp 0x140021bb1
mov rax, rsi
mov qword [rbx + 0xa0], rax
call fcn.14001e230
mov rdi, rax
test rax, rax
je 0x140021d32
lea rcx, [rax + 0xc0]
lea rdx, [0x14001b330]
call fcn.1400256ac
mov ecx, esi
test rax, rax
setne cl
test rax, rax
je 0x140021d32
test ecx, ecx
je 0x140021d32
mov qword [rax + 8], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rbx + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x60], eax
mov qword [rdi + 8], rbx
mov qword [rbx + 0x88], rsi
mov qword [rbx + 0x100], rsi
mov qword [rbx + 0xd0], rsi
mov qword [rbx + 0xd8], rsi
mov qword [rbx + 0xb0], rsi
mov qword [rbx + 0xc8], rsi
mov qword [rbx + 0xa8], rsi
mov qword [rbx + 0x118], rsi
mov qword [rbx + 0xb8], rsi
mov qword [rbx + 0x130], rsi
mov qword [rbx + 0x90], rsi
mov qword [rbx + 0x128], rsi
mov qword [rbx + 0x120], rsi
mov dword [rbx + 0x108], esi
mov qword [rbx + 0x110], rsi
mov qword [rbx + 0xe8], rsi
mov qword [rbx + 0xf0], rsi
mov qword [rbx + 0x140], rsi
mov dword [rbx + 0xc0], esi
mov dword [rbx + 0xe0], esi
mov qword [rbx + 0x138], 0x200
mov dword [rbx + 0x14c], esi
mov dword [rbx + 0x150], 0x493e0
mov edi, 1
mov dword [rbx + 0x154], edi
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x34], 6
jne 0x140021ce4
cmp dword [rsp + 0x38], edi
jae 0x140021ce8
cmp dword [rsp + 0x34], 6
mov eax, esi
jbe 0x140021cea
mov eax, edi
mov dword [rbx + 0x158], eax
mov dword [rbx + 0x15c], esi
mov qword [rbx + 0x168], rsi
mov qword [rbx + 0x170], rsi
mov dword [rbx + 0x160], edi
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140031760
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140013428
nop

Function at 0x140024fd8
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14002503f
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140025053
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140025053
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call qword [case.0x140016b06.0]
jmp 0x140025058
cmp dword [rcx + 8], 0
je 0x140025053
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140025058
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14002a9c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, r9
mov r14, r8
and qword [r9], 0
mov rbx, qword [rbp + 0x40]
and dword [rbx], 0
cmp qword [rcx + 0xb0], 0
je 0x14002aa9f
xor r8d, r8d
call fcn.14002ae48
mov rsi, rax
test rax, rax
je 0x14002ab5b
mov qword [rbp - 0x18], rsi
and dword [rbp - 0x10], 0
and qword [rbp - 8], 0
and dword [rbp + 0x20], 0
and dword [rbp + 0x40], 0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x40]
mov dword [rbx], ecx
test eax, eax
jne 0x14002aa83
call fcn.140002b8c
mov qword [rdi], rax
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002aa83
lea ebx, [rax + 1]
jmp 0x14002aa91
mov rcx, qword [rdi]
call fcn.14001279c
and qword [rdi], 0
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002ab59
mov rax, qword [rcx]
and qword [rsp + 0x20], 0
mov r9, r14
mov r8, rdx
lea rdx, [rbp + 0x40]
mov rax, qword [rax + 0x108]
call qword [case.0x140016b06.0]
nop
mov rax, qword [rbp + 0x40]
mov esi, dword [rax - 0x10]
test esi, esi
jne 0x14002aacf
xor ebx, ebx
jmp 0x14002ab38
mov ecx, esi
shr ecx, 1
mov dword [rbx], ecx
call fcn.140002b8c
mov qword [rdi], rax
xor edx, edx
lea ebx, [rdx + 1]
test esi, esi
jle 0x14002ab34
xor r9d, r9d
mov r10d, ebx
test r10, r10
js 0x14002ab70
mov rax, qword [rbp + 0x40]
cmp edx, dword [rax - 0x10]
jge 0x14002ab70
movzx r8d, word [r9 + rax + 2]
test edx, edx
js 0x14002ab70
shl r8b, 4
sub r8b, 0x51
add r8b, byte [r9 + rax]
mov eax, edx
test edx, edx
jns 0x14002ab19
lea eax, [rbx + rdx]
sar eax, 1
movsxd rcx, eax
mov rax, qword [rdi]
mov byte [rcx + rax], r8b
add edx, 2
add r10, 2
add r9, 4
cmp edx, esi
jl 0x14002aaec
mov rax, qword [rbp + 0x40]
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002ab59
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140016b06.0]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400021d4
int3
Function at 0x14002ab7c
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14002abf7
xor r8d, r8d
call fcn.14002ae48
mov rsi, rax
test rax, rax
je 0x14002abf3
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14002abf3
mov eax, dword [rsp + 0x30]
jmp 0x14002ac0d
mov eax, edi
jmp 0x14002ac0d
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14002ca88
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], 0
je 0x14002caba
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002caba
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.14002ff20
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x14002cacc
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14002caf2
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140024fd8
jmp 0x14002cb5d
cmp byte [0x140078f58], 0
jne 0x14002cb36
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002cb26
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140078f50], rax
jmp 0x14002cb2d
mov rax, qword [0x140078f50]
mov byte [0x140078f58], 1
jmp 0x14002cb3d
mov rax, qword [0x140078f50]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14002cb57
mov r8d, dword [rbx + 8]
xor r9d, r9d
call qword [case.0x140016b06.0]
jmp 0x14002cb5d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14003e620
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003e44c
Function at 0x140002d30
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140009750
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140009750
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002da0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000f0a4]
mov rbx, rcx
test esi, esi
jle 0x140002ed0
mov rax, qword [0x14000f0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002deb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002e75
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002dd0
mov rcx, rbx
call fcn.1400037f0
mov rdi, rax
test rax, rax
je 0x140002ef2
mov rax, qword [0x14000f0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003930
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000f0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002ed7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002e6e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002e80
add dword [0x14000f0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000f0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002e6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002d30
nop dword [rax]
xor esi, esi
jmp 0x140002df8
mov rax, qword [0x14000f0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002d30
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002d30
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003460
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000f100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000f0e0]
test rbx, rbx
je 0x1400034bc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400034b3
test rsi, rsi
je 0x1400034b3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003498
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400037f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000b980]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003810
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003818
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003810
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000386d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003864
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003810
add rax, 0x28
cmp rax, r9
jne 0x140003850
xor eax, eax
ret

Function at 0x140003870
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000b980]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000388f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003898
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000388f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003930
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000b980]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000394f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003958
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x413926
Capabilities:
Hash data with crc32

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov dword [rbp - 4], 0xffffffff
mov dword [rbp - 8], 0
jmp 0x413985
mov eax, dword [rbp - 4]
shr eax, 8
mov ecx, eax
mov eax, dword [rbp - 8]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx eax, byte [rax]
movzx edx, al
mov eax, dword [rbp - 4]
movzx eax, al
xor eax, edx
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x00468980]
mov eax, dword [rdx + rax]
xor eax, ecx
mov dword [rbp - 4], eax
add dword [rbp - 8], 1
mov eax, dword [rbp - 8]
cmp eax, dword [rbp + 0x18]
jl 0x413945
mov eax, dword [rbp - 4]
not eax
add rsp, 0x10
pop rbp
ret
Function at 0x416ecd
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x30], rcx
mov ecx, 0x1000
call sub.msvcrt.dll_malloc
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x30]
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rax, qword [rbp - 0x58]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, qword [rbp - 0x58]
add rax, rdx
mov word [rax], 0x2f
mov rax, qword [rbp - 0x58]
lea rdx, str.CriticalBreachDetected.pdf
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp - 0x58]
lea rdx, [0x0046a353]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp - 0x60], rax
cmp qword [rbp - 0x60], 0
je 0x416f89
mov eax, dword [0x004688bc]
mov edx, eax
mov rax, qword [rbp - 0x60]
mov r9, rax
mov r8d, 1
lea rcx, str._PDF_1.4_n__n1_0_obj_n___n_Title____n_Creator__
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp - 0x60]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rax, qword [rbp - 0x58]
mov rcx, rax
call fcn.0044ae60
nop
add rsp, 0x38
pop rdi
pop rbp
ret