joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400050ec
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x10], 0
lea rax, [rbp + 0x10]
and qword [rbp - 0x10], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov ebx, r9d
mov qword [rsp + 0x20], rax
mov rdi, r8
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400051e5
mov rcx, qword [rbp + 0x10]
lea rax, [rbp - 0x10]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ZoomUMX
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400051c7
and dword [rbp + 0x30], eax
lea r9, [rbp + 0x30]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallLocation
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rbp + 0x18], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400051c7
mov eax, dword [rbp + 0x30]
dec eax
cmp eax, 1
ja 0x1400051c7
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1400051b4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400051c3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1400051e7
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1400051d6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400051e5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x1400051f8
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
test r8, r8
je 0x140005286
mov r9d, 1
mov rdx, rbx
xor ecx, ecx
lea r8d, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x140005286
mov edi, 0x400
lea r8, [0x14002a588]
mov edx, edi
mov rcx, rbx
call fcn.14000ef78
lea r8, [0x14002a5a0]
mov edx, edi
mov rcx, rbx
call fcn.14000ef78
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea r8, [0x14002a588]
mov edx, edi
mov rcx, rbx
call fcn.14000ef78
lea r8, str.ZoomDownload
mov edx, edi
mov rcx, rbx
call fcn.14000ef78
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, 1
jmp 0x140005288
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140006ec8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x20]
xor eax, eax
mov rsi, rcx
movsxd rdx, dword [r9 + 0xc]
test edx, edx
jle 0x140006f0b
mov rcx, qword [r9]
xor r8d, r8d
add rcx, 0x804
cmp dword [rcx], 0
je 0x140006f0b
inc eax
inc r8
add rcx, 0x80c
cmp r8, rdx
jl 0x140006ef5
cmp eax, edx
je 0x140006f6f
cmp eax, 0xffffffff
je 0x140006f6f
test eax, eax
js 0x140006f6f
cmp eax, edx
jge 0x140006f6f
cdqe
imul rcx, rax, 0x80c
mov rax, qword [r9]
lea rdi, [rcx + rax]
mov dword [rcx + rax + 0x804], 1
mov ecx, 0x20
lea rbx, [rdi + 0x400]
call fcn.140009c68
lea rcx, [0x14002c468]
mov r8, rax
xor edx, edx
mov qword [rax + 0x10], rcx
lea rcx, [0x140006e10]
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x18], rsi
call fcn.14001360c
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140007510
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.CDownloadDialog::DownloadComplete__success
mov edi, edx
test edx, edx
jne 0x140007531
lea rcx, str.CDownloadDialog::DownloadComplete__fail
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400075cc
movsxd r8, dword [rcx + 0xc]
xor edx, edx
test r8d, r8d
jle 0x140007570
mov rax, qword [rcx]
xor r9d, r9d
add rax, 0x804
cmp dword [rax], 1
je 0x140007570
inc edx
inc r9
add rax, 0x80c
cmp r9, r8
jl 0x14000755b
cmp edx, r8d
je 0x1400075cc
cmp edx, 0xffffffff
je 0x1400075cc
test edi, edi
setne r8b
call fcn.140007958
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x34], eax
mov rax, qword [rbx + 0x20]
movsxd rcx, dword [rax + 0xc]
test ecx, ecx
jle 0x1400075c2
mov rax, qword [rax]
mov r8, rcx
xor edx, edx
lea rcx, [rax + 0x804]
mov eax, dword [rcx]
sub eax, 2
cmp eax, 1
ja 0x1400075d7
inc rdx
add rcx, 0x80c
cmp rdx, r8
jl 0x1400075a9
xor edx, edx
mov rcx, rbx
call fcn.140006f80
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x1400075c2
mov rcx, rbx
call fcn.140006ec8
jmp 0x1400075cc
Function at 0x140007958
Capabilities:
Read file on windows

Disassembly:
test edx, edx
js 0x140007bf6
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1740]
mov eax, 0x1840
call fcn.140021bf0
sub rsp, rax
mov rax, qword [0x140031010]
xor rax, rsp
mov qword [rbp + 0x1730], rax
xor r15d, r15d
mov rdi, rcx
cmp edx, dword [rcx + 0xc]
jge 0x140007bd1
movsxd rax, edx
imul rbx, rax, 0x80c
mov rax, qword [rdi]
movzx ecx, r8b
xor ecx, 1
add ecx, 2
mov dword [rbx + rax + 0x804], ecx
mov rsi, qword [rdi]
cmp dword [rbx + rsi + 0x808], 1
jne 0x140007bd1
xor edx, edx
lea rcx, [rbp + 0xf30]
mov r8d, 0x800
call fcn.14000b3c0
lea rcx, [rsi + 0x400]
add rcx, rbx
lea rdx, [0x14002c640]
call fcn.14000f694
mov rsi, rax
test rax, rax
je 0x140007bc3
mov r9, rax
lea edx, [r15 + 1]
mov r8d, 0x800
lea rcx, [rbp + 0xf30]
call fcn.140013978
mov rcx, rsi
mov r14, rax
call fcn.14000f7c4
test r14d, r14d
jle 0x140007bc3
movzx ecx, byte [rbp + 0x172f]
lea rdx, str.Package_url
cmp r14d, 0x800
cmovl ecx, r15d
mov byte [rbp + 0x172f], cl
lea rcx, [rbp + 0xf30]
call fcn.14000be08
mov rsi, rax
test rax, rax
je 0x140007bc3
lea rdx, [0x14002c658]
mov rcx, rax
call fcn.14000be08
test rax, rax
je 0x140007a81
mov byte [rax], r15b
mov r14d, 0x400
lea rcx, [rbp + 0x330]
mov r8d, r14d
xor edx, edx
call fcn.14000b3c0
mov r8d, r14d
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.14000b3c0
lea r8, [rbp + 0x330]
call fcn.1400051f8
test al, al
je 0x140007bc3
lea r8, [rbp + 0x330]
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.14000ef78
lea r8, [0x14002be4c]
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.14000ef78
lea r8, str.Zoom.msi
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.14000ef78
mov r9d, 0x517500
mov dword [rsp + 0x20], r15d
lea r8, [rsp + 0x30]
mov rcx, rdi
lea rdx, [rsi + 0xc]
call fcn.1400077b4
mov r8d, r14d
lea rcx, [rbp + 0x730]
xor edx, edx
call fcn.14000b3c0
lea r8, [rbp + 0x330]
mov edx, r14d
lea rcx, [rbp + 0x730]
call fcn.14000ef18
lea r8, str._Installer.exe
mov edx, r14d
lea rcx, [rbp + 0x730]
call fcn.14000ef78
mov r8d, r14d
lea rcx, [rbp + 0xb30]
xor edx, edx
call fcn.14000b3c0
lea r8, [rsi + 0xc]
mov edx, r14d
lea rcx, [rbp + 0xb30]
call fcn.14000ef18
lea rdx, str.Zoom.msi_tatupg
lea rcx, [rbp + 0xb30]
call fcn.14000be08
test rax, rax
je 0x140007bd1
lea r8, str.Installer.exe_tatupg
mov edx, 0x16
mov rcx, rax
call fcn.14000ef18
mov r9d, 0xc3800
mov dword [rsp + 0x20], r15d
lea r8, [rbp + 0x730]
mov rcx, rdi
lea rdx, [rbp + 0xb30]
call fcn.1400077b4
jmp 0x140007bd1
mov rax, qword [rdi]
mov dword [rbx + rax + 0x804], 3
mov rcx, qword [rbp + 0x1730]
xor rcx, rsp
call fcn.140009960
mov rbx, qword [rsp + 0x1880]
add rsp, 0x1840
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007bf8
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, r8
lea rcx, str.WinMain_start__lpCmdLine_is:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor ebp, ebp
lea rcx, str.NULL
test rsi, rsi
cmovne rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.WinMain_start__parameter_is:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.installer.exeInstaller.exepackage.nameZoom.msipackage.versionlatestpackage.size4980kdownloadRoothttps:__www.zoom.us_client
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 0x478
call fcn.140009c68
mov rdi, rax
xor edx, edx
lea rax, vtable.CZpDownloadMgr.0
mov r8d, 0x400
lea rcx, [rdi + 8]
mov qword [rdi], rax
lea rax, vtable.CDownloadDialog.0
mov qword [rcx + 8], rbp
mov qword [rcx], rax
mov dword [rcx + 0x10], ebp
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov dword [rcx + 0x30], ebp
mov dword [rcx + 0x38], 0x131a230
mov qword [0x140034040], rcx
lea rcx, [rdi + 0x62]
mov qword [rdi + 0x48], rbp
mov qword [rdi + 0x50], rbp
mov dword [rdi + 0x58], ebp
mov word [rdi + 0x60], bp
mov qword [rdi + 0x468], rbp
mov byte [rdi + 0x470], bpl
call fcn.14000b3c0
lea r8, str.zoom.us_Downloader_Mutex_1.0.0.0
mov qword [0x140034048], rdi
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
je 0x140007cee
mov rcx, rax
jmp 0x140007d80
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.zoom.us_Downloader_Mutex_1.0.0.0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140007d7d
mov edx, 0x2710
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007d7d
mov r8, rsi
call fcn.1400083fc
mov rcx, qword [0x140034038]
mov dword [0x140034030], ebp
test rcx, rcx
je 0x140007d46
call fcn.140004be0
mov rbx, qword [0x140034048]
test rbx, rbx
je 0x140007d67
mov rcx, rbx
call fcn.140007dc8
mov edx, 0x478
mov rcx, rbx
call fcn.1400099bc
lea rcx, str.WinMain_end
mov qword [0x140034048], rbp
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x140007dae
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, str.zoom.us_Boot_Downloader
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140007dae
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7e9
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageA]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140008b34
Capabilities:
Print debug messages

Disassembly:
test rdx, rdx
je 0x140008c66
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
mov eax, 0x64030
call fcn.140021bf0
sub rsp, rax
mov rax, qword [0x140031010]
xor rax, rsp
mov qword [rsp + 0x64020], rax
mov rsi, r8
mov rbp, rdx
test r8, r8
je 0x140008c3f
lea rcx, str.CZpDownloadMgr::FindParam
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x64000
call fcn.14000b3c0
xor r14d, r14d
lea rdi, [rsp + 0x20]
mov al, byte [rsi]
inc rsi
test al, al
je 0x140008c1d
cmp al, 0x25
jne 0x140008c03
movsx ecx, byte [rsi]
call fcn.140013ccc
movsx ecx, byte [rsi + 1]
mov ebx, eax
call fcn.140013ccc
add rsi, 2
mov ecx, eax
test bl, bl
je 0x140008c1d
test cl, cl
je 0x140008c1d
cmp bl, 0x39
jle 0x140008be6
lea eax, [rbx - 0x61]
cmp al, 5
ja 0x140008c11
sub bl, 7
shl bl, 4
cmp cl, 0x39
jg 0x140008bf2
mov al, 0xd0
jmp 0x140008bfb
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x140008c11
mov al, 0xa9
add cl, bl
add cl, al
mov byte [rdi], cl
jmp 0x140008c0e
cmp al, 0x2b
jne 0x140008c0c
mov byte [rdi], 0x20
jmp 0x140008c0e
mov byte [rdi], al
inc rdi
inc r14d
cmp r14d, 0x63fff
jb 0x140008ba9
lea rcx, [rsp + 0x20]
mov byte [rdi], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r8, [rsp + 0x20]
mov rdx, rbp
lea rcx, [0x140034028]
call fcn.140005294
mov rcx, qword [rsp + 0x64020]
xor rcx, rsp
call fcn.140009960
lea r11, [rsp + 0x64030]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140009340
Capabilities:
Get common file path
Print debug messages

Disassembly:
push rdi
sub rsp, 0x2a0
mov rax, qword [0x140031010]
xor rax, rsp
mov qword [rsp + 0x290], rax
lea rax, [rsp + 0x30]
mov rdi, 0xffffffff80000002
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallFF66E9F6_83E7_3A3E_AF14_8DE9A809A6A4
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400093fe
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall9A25302D_30C0_39D9_BD6F_21E6EC160475
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400093fe
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall1F1C2DFC_2D24_3E06_BCB8_725134ADF989
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400093fe
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall9BE518E6_ECC6_35A9_88E4_87755C07200F
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140009472
mov edi, 0x104
lea rcx, [rsp + 0x180]
mov r8d, edi
xor edx, edx
call fcn.14000b3c0
mov edx, edi
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140009472
lea r8, str.winsxsx86_microsoft.vc90.crt_
mov edx, edi
lea rcx, [rsp + 0x180]
call fcn.14000ef78
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x140009472
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, str._CZpDownloadMgr::NeedDownloadVCRed__return_true
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
jmp 0x140009481
lea rcx, str._CZpDownloadMgr::NeedDownloadVCRed__return_false
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, 1
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140009960
add rsp, 0x2a0
pop rdi
ret
Function at 0x1400023c0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x1400023ee
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140002f40
cmp byte [0x14002d3a8], 0
jne 0x140002439
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002429
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14002d3a8], 1
mov qword [0x14002d3a0], rax
jmp 0x140002440
mov rax, qword [0x14002d3a0]
mov byte [0x14002d3a8], 1
jmp 0x140002440
mov rax, qword [0x14002d3a0]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000245f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140002fb4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x140002fcf
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140002fcf
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x140002fcf
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
pop rax
call 0x1be6e745a
jrcxz 0x14004699c
pushfq
mov esp, 0xfcb88be2
jp 0x140046973
jge 0x1400468dc
cmp al, 0x65
mov r14b, 0xc2
invalid
neg byte [rbp - 0x47]
fistp dword [rbx + rax*2]
test eax, 0x7faf5cc0
div dword [rsi - 0x1d]
leave
xchg dl, ch
adc eax, esi
adc eax, 0xd20b2ba5
adc dword [rdx - 0x4fdde943], ecx
ja 0x14004691e
retf 0x9f35
Function at 0x140002f40
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x1400023ee
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140002f40
cmp byte [0x14002d3a8], 0
jne 0x140002439
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002429
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14002d3a8], 1
mov qword [0x14002d3a0], rax
jmp 0x140002440
mov rax, qword [0x14002d3a0]
mov byte [0x14002d3a8], 1
jmp 0x140002440
mov rax, qword [0x14002d3a0]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000245f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140002fb4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x140002fcf
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x140002fcf
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x140002fcf
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
pop rax
call 0x1be6e745a
jrcxz 0x14004699c
pushfq
mov esp, 0xfcb88be2
jp 0x140046973
jge 0x1400468dc
cmp al, 0x65
mov r14b, 0xc2
invalid
neg byte [rbp - 0x47]
fistp dword [rbx + rax*2]
test eax, 0x7faf5cc0
div dword [rsi - 0x1d]
leave
xchg dl, ch
adc eax, esi
adc eax, 0xd20b2ba5
adc dword [rdx - 0x4fdde943], ecx
ja 0x14004691e
retf 0x9f35
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
mov ecx, dword [rax + 0x18]
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
add rax, rdx
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140001b50
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14000eea0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.14000eea0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x140001bc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x140016104]
mov r12, rcx
test ebx, ebx
jle 0x140001cf0
mov rax, qword [0x140016108]
xor r9d, r9d
add rax, 0x18
nop dword [rax + rax]
mov r8, qword [rax]
cmp r8, r12
ja 0x140001c0b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp r12, r8
jb 0x140001c95
add r9d, 1
add rax, 0x28
cmp r9d, ebx
jne 0x140001bf0
mov rcx, r12
call fcn.140002640
mov rsi, rax
test rax, rax
je 0x140001d12
mov rax, qword [0x140016108]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.140002770
mov edx, dword [rsi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140016108]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001cf7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001c8e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001ca0
add dword [0x140016104], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x140016108]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001c8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001b50
nop dword [rax]
xor ebx, ebx
jmp 0x140001c18
mov rax, qword [0x140016108]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001b50
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140001b50
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140002290
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r13, [0x140016160]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140016140]
test rbx, rbx
je 0x1400022ec
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x1400022e3
test r12, r12
je 0x1400022e3
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400022c8
mov rcx, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140002640
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400122c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002660
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002668
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002660
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1400026b5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400026ac
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002660
add rax, 0x28
cmp rax, r9
jne 0x140002698
xor eax, eax
ret

Function at 0x1400026c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400122c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400026e0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400026e8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400026e0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140002770
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400122c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002790
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140002798
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret