joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ec070
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov byte [r11 + 0x18], r8b
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
movzx ebx, r8b
mov r12, rdx
mov r15, rcx
xor r14b, r14b
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [r11 - 0x58], rax
xor eax, eax
mov dword [rsp + 0x48], eax
mov qword [r11 - 0x48], rax
lea rdx, [r11 - 0x58]
call fcn.1400ebe90
mov r13, qword [rsp + 0x50]
test al, al
je 0x1400ec1e7
mov eax, dword [rsp + 0x48]
test eax, eax
jle 0x1400ec1e7
mov rsi, r13
mov ebp, eax
mov r13d, 1
nop dword [rax]
nop word [rax + rax]
xor eax, eax
mov dword [rsp + 0xb8], eax
mov rdi, qword [rsi]
test bl, bl
jne 0x1400ec12b
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
test al, al
jne 0x1400ec1d5
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ec1d5
mov ecx, dword [rsp + 0xb8]
call fcn.1402b9c60
mov rbx, rax
test rax, rax
je 0x1400ec1cd
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ec1c5
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, dword [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx r14d, r14b
test eax, eax
cmove r14d, r13d
mov rcx, rbx
call fcn.1402b9c20
movzx ebx, byte [rsp + 0xb0]
add rsi, 0x10
dec rbp
jne 0x1400ec0f0
mov r13, qword [rsp + 0x50]
test r13, r13
je 0x1400ec20d
lea r9, [fcn.140005eb0]
mov r8d, dword [r13 - 8]
mov edx, 0x10
mov rcx, r13
call fcn.1402ba5c4
lea rcx, [r13 - 8]
call fcn.1402b99fc
movzx eax, r14b
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ec650
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rbp, [0x140348ca0]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
test eax, eax
jle 0x1400ec6ff
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.1401ff260
mov rdx, qword [rsp + 0x30]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140200570
mov qword [rbx + 8], rsi
mov edx, dword [rsp + 0x3c]
test edx, edx
jne 0x1400ec6cf
mov qword [rbx], rbp
jmp 0x1400ec6f5
mov rcx, rbx
call fcn.1401ff260
movsxd r9, dword [rsp + 0x3c]
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x30]
mov rcx, qword [rbx]
call fcn.1402bd21c
mov edx, dword [rsp + 0x3c]
mov rcx, rbx
call fcn.140200570
jmp 0x1400ec70f
mov rdx, qword [0x14041a158]
mov rcx, rbx
call fcn.1401fd200
nop
cmp dword [rsp + 0x38], 0
jle 0x1400ec720
mov rcx, qword [rsp + 0x30]
call fcn.1402b9c20
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400ecd70
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x328], rbx
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov qword [rsp + 0x60], r8
xor dil, dil
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.1400d2bd0
nop
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400ecf82
lea rax, vtable.Core::Collection_class_Core::String_.0
mov qword [rsp + 0x30], rax
xor edi, edi
mov r15d, edi
mov dword [rsp + 0x38], edi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
lea r13, [0x140348ca0]
mov r14, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
test byte [rsp + 0x70], 0x10
jne 0x1400ecf0e
lea rax, [rbp - 0x64]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400ece25
mov qword [rsp + 0x28], 0
test ebx, ebx
jne 0x1400ece43
mov qword [rsp + 0x20], r13
jmp 0x1400ece69
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rsp + 0x28]
inc eax
movsxd rdx, eax
lea r8, [rbp - 0x64]
mov rcx, qword [rsp + 0x20]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.140200570
nop
mov ecx, 0x20
call fcn.1402b968c
mov rbx, rax
test rax, rax
je 0x1400ece96
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0
jmp 0x1400ece99
mov rbx, rdi
mov edx, dword [rsp + 0x2c]
lea rcx, [rbx + 0x10]
call fcn.1401ff260
movsxd r9, dword [rsp + 0x2c]
mov eax, dword [rbx + 0x18]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call fcn.1402bd21c
mov edx, dword [rsp + 0x2c]
lea rcx, [rbx + 0x10]
call fcn.140200570
xor edi, edi
mov qword [rsp + 0x48], rbx
test r15d, r15d
jne 0x1400ecee8
mov qword [rbx + 8], rdi
mov rsi, rbx
mov qword [rsp + 0x40], rbx
jmp 0x1400eceef
mov qword [r14], rbx
mov qword [rbx + 8], r14
mov r14, rbx
mov qword [rbx], rdi
inc r15d
mov dword [rsp + 0x38], r15d
cmp dword [rsp + 0x28], 0
jle 0x1400ecf0e
mov rcx, qword [rsp + 0x20]
call fcn.1402b9c20
lea rdx, [rsp + 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400ece12
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
sete dil
mov edx, r15d
mov rcx, qword [rsp + 0x60]
call fcn.140118ec0
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140118d80
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
test rsi, rsi
je 0x1400ecf82
nop
mov rbx, qword [rsi]
cmp dword [rsi + 0x18], 0
jle 0x1400ecf72
mov rcx, qword [rsi + 0x10]
call fcn.1402b9c20
mov rcx, rsi
call fcn.1402177e0
mov rsi, rbx
test rbx, rbx
jne 0x1400ecf60
cmp dword [rsp + 0x58], 0
jle 0x1400ecf93
mov rcx, qword [rsp + 0x50]
call fcn.1402b9c20
movzx eax, dil
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1402b9610
mov rbx, qword [rsp + 0x328]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400edda0
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x80
mov eax, dword [rcx + 0xc]
mov ebp, r9d
movsxd rsi, r8d
mov r14, rdx
mov rdi, rcx
test eax, eax
jne 0x1400edec3
add rcx, 0x30
mov qword [r11 + 8], rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lock inc dword [rdi + 0x10]
lea rcx, [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 0x58
mov byte [rdi + 0xa9], 0
call fcn.1402b968c
test rax, rax
je 0x1400ede44
mov rcx, qword [rsp + 0xc0]
lea r9, [r14 + rsi]
lea r8, [rdi + 0xb0]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0xb8]
mov rdx, rdi
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov dword [rsp + 0x20], ebp
call fcn.1400ed8c0
mov rsi, rax
jmp 0x1400ede46
xor esi, esi
mov rdx, qword [rsi + 8]
mov rcx, qword [rdi + 0xa0]
lea rax, [rdi + 0xb0]
lea r9, [rsi + 0x20]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400ede9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xea
je 0x1400ede9e
cmp eax, 0x3e5
je 0x1400ede9e
mov rdx, rsi
mov rcx, rdi
call fcn.1400ee5c0
cmp ebx, 0x6d
je 0x1400ededf
cmp ebx, 0xe9
jne 0x1400edee6
jmp 0x1400ededf
mov rbx, qword [rsp + 0x90]
lea r11, [rsp + 0x80]
mov rax, rsi
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
lea rcx, [rsp + 0x40]
call fcn.1400ed6c0
lea rdx, [0x140410420]
lea rcx, [rsp + 0x40]
call fcn.1402c1558
int3
mov byte [rdi + 0xa8], 0
lea rax, [0x140348ca0]
lea rdx, [0x1404104b0]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, vtable.Core::NamedPipeException.0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], ebx
call fcn.1402c1558
int3
Function at 0x1400ee1f0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
mov dword [r11 + 0x18], r8d
push rdi
sub rsp, 0x70
mov eax, dword [rcx + 0xc]
mov ebx, r9d
mov rsi, rdx
mov rdi, rcx
mov dword [r11 + 0x18], 0
test eax, eax
jne 0x1400ee2e1
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [r11 + 8], rbp
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rdi + 0xa0]
lea rbp, [rdi + 0xd0]
lea r9, [rsp + 0x90]
mov r8d, ebx
mov rdx, rsi
mov qword [rdi + 0xe8], rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400ee2b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x3e5
jne 0x1400ee2a0
mov rcx, qword [rdi + 0xa0]
lea r8, [rsp + 0x90]
mov r9d, 1
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1400ee2b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x1400ee2b3
cmp ebx, 0x6d
je 0x1400ee2fd
cmp ebx, 0xe9
jne 0x1400ee304
jmp 0x1400ee2fd
mov rcx, qword [rdi + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x90]
mov rbp, qword [rsp + 0x80]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, [rsp + 0x30]
call fcn.1400ed6c0
lea rdx, [0x140410420]
lea rcx, [rsp + 0x30]
call fcn.1402c1558
int3
mov byte [rdi + 0xa8], 0
mov rcx, qword [rdi + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [0x140348ca0]
lea rdx, [0x1404104b0]
mov qword [rsp + 0x50], rax
lea rax, vtable.Core::NamedPipeException.0
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x48], rax
call fcn.1402c1558
int3
Function at 0x1400ee350
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
mov dword [r11 + 0x18], r8d
push rbx
push rbp
push rdi
sub rsp, 0x70
mov eax, dword [rcx + 0xc]
xor ebp, ebp
mov rdi, rdx
mov rbx, rcx
mov byte [rcx + 0xa9], 0
mov dword [r11 + 0x20], ebp
test eax, eax
jne 0x1400ee4c4
lea edx, [rbp + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [r11 + 8], rsi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rbx + 0xa0]
lea rsi, [rbx + 0xb0]
lea r9, [rsp + 0xa8]
mov r8d, 0x1000
mov rdx, rdi
mov qword [rbx + 0xc8], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400ee45c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x3e5
jne 0x1400ee405
mov rcx, qword [rbx + 0xa0]
lea r9d, [rbp + 1]
lea r8, [rsp + 0xa8]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1400ee45c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xea
jne 0x1400ee43e
mov rcx, qword [rbx + 0xa0]
lea r8, [rsp + 0xa8]
mov r9d, 1
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1400ee45c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0xea
je 0x1400ee45c
test edi, edi
je 0x1400ee45c
cmp edi, 0x6d
je 0x1400ee4e0
cmp edi, 0xe9
jne 0x1400ee4e7
jmp 0x1400ee4e0
mov rcx, qword [rbx + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0xa0]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x1400ee49d
mov byte [rbx + 0xa9], 1
jmp 0x1400ee4ad
cmp dword [rsp + 0xa0], ebp
sete al
mov byte [rbx + 0xa9], al
mov eax, dword [rsp + 0xa8]
mov rsi, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x30]
call fcn.1400ed6c0
lea rdx, [0x140410420]
lea rcx, [rsp + 0x30]
call fcn.1402c1558
int3
mov byte [rbx + 0xa8], bpl
mov rcx, qword [rbx + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [0x140348ca0]
lea rdx, [0x1404104b0]
mov qword [rsp + 0x50], rax
lea rax, vtable.Core::NamedPipeException.0
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x48], rax
call fcn.1402c1558
int3
Function at 0x1400f0c00
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x40
lea r8, [rcx + 0xe8]
lea rdx, str.PrivateCloud
mov rsi, rcx
mov byte [rcx + 0xe0], 0
call fcn.1400f1660
test al, al
je 0x1400f0cb4
xor ecx, ecx
mov qword [rsp + 0x30], rdi
call fcn.1400f2f90
mov rdi, rax
test rax, rax
je 0x1400f0caf
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.UsePrivateCloud
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
mov rbx, qword [rsp + 0x38]
jne 0x1400f0ca2
cmp dword [rsp + 0x50], 0
setne al
mov byte [rsi + 0xe0], al
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rdi, qword [rsp + 0x30]
add rsp, 0x40
pop rsi
ret

Function at 0x1400f0de0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [0x14042c9e0]
movzx edi, dl
mov rsi, rcx
test al, 1
jne 0x1400f0e2d
or eax, 1
lea rcx, [0x1403017d0]
mov qword [0x14042c9f0], 0xffffffff80000002
mov dword [0x14042c9e0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x14042c9e8], rax
call fcn.1402bb344
lea rdx, [0x14034ee50]
lea rcx, [0x14042c9e8]
call fcn.1400eb8d0
mov rbx, rax
test rax, rax
je 0x1400f0ea2
lea rdx, str.UsePrivateCloud
test dil, dil
je 0x1400f0e83
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x48]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400f0e95
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x40]
mov byte [rsi + 0xe0], dil
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f1750
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r14, r8
mov rsi, rdx
mov rbp, rcx
xor bl, bl
mov eax, dword [0x14042c9e0]
test al, 1
jne 0x1400f17b3
or eax, 1
mov dword [0x14042c9e0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x14042c9e8], rax
mov qword [0x14042c9f0], 0xffffffff80000002
lea rcx, [0x1403017d0]
call fcn.1402bb344
lea rdx, [0x14034ee50]
lea rcx, [0x14042c9e8]
call fcn.1400eb8d0
mov rdi, rax
test rax, rax
je 0x1400f1875
lea r15, vtable.Core::ByteArray.0
mov qword [rsp + 0x38], r15
xor eax, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x50], rax
mov eax, dword [r14 + 0xc]
lea r9d, [rax + rax]
mov rcx, qword [rbp + 0xc0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov rdx, qword [r14]
call qword [rax + 0x20]
test al, al
je 0x1400f184a
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8]
nop
mov qword [rsp + 0x38], r15
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x1400f1875
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, bl
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x1400f18a0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [0x14042c9e0]
mov rbx, rdx
test al, 1
jne 0x1400f18e5
or eax, 1
lea rcx, [0x1403017d0]
mov qword [0x14042c9f0], 0xffffffff80000002
mov dword [0x14042c9e0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x14042c9e8], rax
call fcn.1402bb344
lea rdx, [0x14034ee50]
lea rcx, [0x14042c9e8]
call fcn.1400eb8d0
mov rdi, rax
test rax, rax
je 0x1400f1937
mov rcx, qword [rax + 8]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rdi]
test ebx, ebx
mov edx, 1
mov rcx, rdi
sete bl
call qword [rax]
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f1a80
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [rdx]
mov r14, rdx
mov rbp, rcx
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400f1c44
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x80], rdi
nop dword [rax + rax]
mov rcx, qword [rbx + 0x20]
call fcn.1402bc8c0
mov rdi, rax
test rax, rax
je 0x1400f1bdb
mov rcx, rax
call fcn.1402bcb38
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], 0
jne 0x1400f1ad1
add r8d, r8d
xor r9d, r9d
mov eax, r8d
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [rax*4]
movsxd r10, ecx
add r10, rdi
neg eax
movsxd rdx, eax
je 0x1400f1b2a
imul eax, dword [r10 + rdx*4], 0xcc9e2d51
rol eax, 0xf
imul ecx, eax, 0x1b873593
xor r9d, ecx
rol r9d, 0xd
add r9d, 0xfaddaf14
lea r9d, [r9 + r9*4]
inc rdx
jne 0x1400f1b02
mov ecx, r8d
xor edx, edx
and ecx, 3
dec ecx
je 0x1400f1b50
dec ecx
je 0x1400f1b46
dec ecx
jne 0x1400f1b68
movzx edx, byte [r10 + 2]
shl edx, 0x10
movzx eax, byte [r10 + 1]
shl eax, 8
xor edx, eax
movzx eax, byte [r10]
xor eax, edx
imul ecx, eax, 0xcc9e2d51
rol ecx, 0x10
imul eax, ecx, 0x1b873593
xor r9d, eax
xor r9d, r8d
mov eax, r9d
shr eax, 0x10
xor eax, r9d
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov rcx, rdi
mov dword [rsp + 0x78], eax
call fcn.1402b9c20
movzx eax, byte [0x14042c16a]
lea rcx, [rbp + 0x440]
lea r9, [rbx + 0x20]
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x20], al
call fcn.1400e97f0
movzx eax, byte [0x14042c16a]
lea rcx, [rbp + 0x450]
lea r9, [rsp + 0x78]
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x20], al
call fcn.1400e9550
cmp byte [rbx + 0x19], 0
jne 0x1400f1c2e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1400f1c0e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1400f1c2e
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400f1c00
jmp 0x1400f1c2e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400f1c2b
cmp rbx, qword [rax + 0x10]
jne 0x1400f1c2b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400f1c18
mov rbx, rax
cmp rbx, qword [r14]
jne 0x1400f1ab0
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x70]
mov al, 1
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
Function at 0x1400f1f00
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
xor bl, bl
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x1400f1f96
mov qword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov rcx, rax
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400f1f96
mov rcx, qword [rsp + 0x58]
mov r9d, 4
lea rax, [rsp + 0x48]
lea edx, [r9 + 0xe]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400f1f8b
cmp dword [rsp + 0x48], 4
jne 0x1400f1f8b
mov eax, dword [rsp + 0x50]
mov bl, 1
cmp eax, 2
je 0x1400f1f7e
cmp eax, 3
jne 0x1400f1f83
mov byte [rdi], 1
jmp 0x1400f1f8b
cmp eax, 1
setne cl
mov byte [rdi], cl
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f2bd0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov dword [rbp - 0x50], r14d
mov qword [rbp - 0x18], r14
lea edx, [r14 + 9]
lea rcx, [rbp - 0x20]
call fcn.1401ff260
mov eax, dword [rbp - 0x18]
inc eax
movsxd rdx, eax
lea r9d, [r14 + 9]
lea r8, [0x14034ee78]
mov rcx, qword [rbp - 0x20]
call fcn.1402bd21c
lea edx, [r14 + 9]
lea rcx, [rbp - 0x20]
call fcn.140200570
nop
lea edx, [r14 + 0x23]
lea rcx, [rbp - 0x10]
call fcn.14020a8a0
nop
lea r8, [rbp - 0x20]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400d2bd0
nop
cmp dword [rbp - 8], r14d
jle 0x1400f2c6a
mov rcx, qword [rbp - 0x10]
call fcn.1402b9c20
nop
cmp dword [rbp - 0x18], 0
jle 0x1400f2c79
mov rcx, qword [rbp - 0x20]
call fcn.1402b9c20
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x40]
call fcn.140201da0
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400f2caa
test al, 0x10
je 0x1400f2caa
cmp dword [rbp - 0x28], 0
jle 0x1400f2cc8
mov rcx, qword [rbp - 0x30]
call fcn.1402b9c20
jmp 0x1400f2cc8
cmp dword [rbp - 0x28], 0
jle 0x1400f2cb9
mov rcx, qword [rbp - 0x30]
call fcn.1402b9c20
xor r8d, r8d
mov rdx, qword [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test rsi, rsi
je 0x1400f2d40
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400f2cd1
mov qword [rbp - 0x28], r14
test ebx, ebx
jne 0x1400f2cf0
lea rax, [0x140348ca0]
mov qword [rbp - 0x30], rax
jmp 0x1400f2d12
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rbp - 0x28]
inc eax
movsxd rdx, eax
mov r8, rsi
mov rcx, qword [rbp - 0x30]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.140200570
nop
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.1400d2bd0
nop
cmp dword [rbp - 0x28], 0
jle 0x1400f2d83
mov rcx, qword [rbp - 0x30]
call fcn.1402b9c20
jmp 0x1400f2d83
mov qword [rdi + 8], r14
mov edx, dword [rbp - 0x34]
test edx, edx
jne 0x1400f2d57
lea rax, [0x140348ca0]
mov qword [rdi], rax
jmp 0x1400f2d7a
mov rcx, rdi
call fcn.1401ff260
movsxd r9, dword [rbp - 0x34]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x40]
mov rcx, qword [rdi]
call fcn.1402bd21c
mov edx, dword [rbp - 0x34]
mov rcx, rdi
call fcn.140200570
nop
cmp dword [rbp - 0x38], 0
jle 0x1400f2d92
mov rcx, qword [rbp - 0x40]
call fcn.1402b9c20
mov rax, rdi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret