joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140085ff8
Capabilities:
Encrypt data using dpapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x70
mov ebx, r9d
mov rsi, r8
mov rbp, rdx
mov r12, rcx
xor edi, edi
mov rcx, qword [str.P5_n_]
lea r14, str.P5_n_
lea r15, [0x140008c50]
cmp rcx, r14
je 0x140086058
test byte [rcx + 0x1c], 2
je 0x140086058
cmp byte [rcx + 0x19], 5
jb 0x140086058
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0xa]
mov r8, r15
call fcn.14000ffa8
xor eax, eax
lea r8, [rsp + 0x50]
lea rdx, [0x14000df60]
mov qword [rsp + 0x48], rax
lea rax, [0x1400086e8]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x50], 0x14
call qword [sym.imp.CRYPT32.dll_CryptProtectData]
cmp eax, edi
jne 0x1400860ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x1400860e7
test byte [rcx + 0x1c], 2
je 0x1400860e7
cmp byte [rcx + 0x19], 2
jb 0x1400860e7
mov rcx, qword [rcx + 0x10]
mov edx, 0xb
mov r9d, eax
mov r8, r15
call fcn.1400100e0
xor eax, eax
jmp 0x140086234
mov esi, dword [rsp + 0x40]
add esi, 0x4c
cmp esi, 0x4c
jb 0x1400860fe
mov ebx, edi
jmp 0x140086106
or esi, 0xffffffff
mov ebx, 0x80070216
cmp ebx, edi
jge 0x140086157
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140086136
test byte [rcx + 0x1c], 2
je 0x140086136
cmp byte [rcx + 0x19], 2
jb 0x140086136
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
mov r9d, ebx
mov r8, r15
call fcn.1400100e0
mov edx, ebx
movzx eax, bx
and edx, 0x1fff0000
cmp edx, 0x70000
cmove ebx, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140086227
mov edx, esi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
cmp rax, rdi
jne 0x14008619d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140086227
test byte [rcx + 0x1c], 2
je 0x140086227
cmp byte [rcx + 0x19], 2
jb 0x140086227
mov edx, 0xd
jmp 0x140086211
lea rdx, [0x14000df80]
mov r8d, 0x4c
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
lea rcx, [rbx + 0x4c]
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r9d, esi
mov r8, rbx
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], esi
call fcn.14007b258
cmp eax, edi
jne 0x140086222
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x140086227
test byte [rcx + 0x1c], 2
je 0x140086227
cmp byte [rcx + 0x19], 2
jb 0x140086227
mov edx, 0xe
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r15
call fcn.1400100e0
jmp 0x140086227
mov edi, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140087c00
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x250
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov ebx, ecx
mov rsi, rdx
xor r12d, r12d
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x1fe
mov edi, 1
mov word [rsp + 0x40], r12w
call sub.msvcrt.dll_memset
mov rcx, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rcx, r13
je 0x140087c7d
test byte [rcx + 0x1c], 2
je 0x140087c7d
cmp byte [rcx + 0x19], 5
jb 0x140087c7d
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x23]
lea r8, [0x140008c50]
call fcn.14000ffa8
lea r9, [0x14000e260]
lea r8, [0x14000e1d0]
lea rcx, [rsp + 0x40]
mov edx, 0x100
mov dword [rsp + 0x20], ebx
call fcn.1400118ac
cmp eax, r12d
mov ebx, eax
jge 0x140087cf8
mov rcx, qword [str.P5_n_]
cmp rcx, r13
je 0x140087cd5
test byte [rcx + 0x1c], 2
je 0x140087cd5
cmp byte [rcx + 0x19], 2
jb 0x140087cd5
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008c50]
mov edx, 0x25
mov r9d, eax
call fcn.1400100e0
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
cmove ebx, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140087e81
mov r15, 0xffffffff80000002
lea rdx, [rsp + 0x40]
mov r9d, 0x20019
mov rcx, r15
xor r8d, r8d
call fcn.14007ac98
mov rbx, rax
cmp rax, r12
jne 0x140087d82
lea rdx, [0x14000e260]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r15
mov edi, r12d
call fcn.14007ac98
mov rbx, rax
cmp rax, r12
jne 0x140087d82
mov rax, qword [str.P5_n_]
cmp rax, r13
je 0x140087cf1
test byte [rax + 0x1c], 2
je 0x140087cf1
cmp byte [rax + 0x19], 2
jb 0x140087cf1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea r8, [0x140008c50]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x26
call fcn.1400100e0
jmp 0x140087cf1
lea rcx, [0x140009d60]
call fcn.140077860
lea r9, [0x14000a1c8]
lea r8, [0x14000e0f0]
mov edx, 1
mov rcx, rbx
mov qword [rsp + 0x20], r12
mov qword [rsi + 0x10], rax
call fcn.14007ad5c
lea r9, [0x14000a1c8]
lea r8, [0x14000e100]
mov edx, 1
mov rcx, rbx
mov qword [rsi], rax
mov qword [rsp + 0x20], r12
call fcn.14007ad5c
lea r8, [rsp + 0x30]
lea rdx, [0x14000e0c8]
xor r9d, r9d
mov rcx, rbx
mov qword [rsi + 8], rax
mov dword [rsp + 0x30], r12d
call fcn.14007afe4
lea r8, [rsp + 0x30]
lea rdx, [0x14000e0b8]
neg eax
sbb ecx, ecx
xor r9d, r9d
and ecx, dword [rsp + 0x30]
mov dword [rsp + 0x30], r12d
mov dword [rsi + 0x18], ecx
mov rcx, rbx
call fcn.14007afe4
mov rcx, rbx
neg eax
sbb edx, edx
and edx, dword [rsp + 0x30]
mov dword [rsi + 0x1c], edx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 1
jne 0x140087e7c
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
cmp eax, r12d
je 0x140087e7c
mov rcx, qword [str.P5_n_]
cmp rcx, r13
je 0x140087e7c
test byte [rcx + 0x1c], 2
je 0x140087e7c
cmp byte [rcx + 0x19], 2
jb 0x140087e7c
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x26]
lea r8, [0x140008c50]
mov r9d, eax
call fcn.1400100e0
mov eax, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14008c5b0
mov rbx, qword [rsp + 0x290]
add rsp, 0x250
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140089998
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x250
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov edi, edx
mov ebx, ecx
mov rcx, qword [str.P5_n_]
lea rbp, str.P5_n_
cmp rcx, rbp
je 0x1400899f4
test byte [rcx + 0x1c], 2
je 0x1400899f4
cmp byte [rcx + 0x19], 5
jb 0x1400899f4
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008c50]
mov edx, 0x65
call fcn.14000ffa8
lea r8, [0x14000e518]
lea rcx, [rsp + 0x30]
mov r9d, ebx
mov edx, 0x104
mov dword [rsp + 0x20], edi
call fcn.1400118ac
mov ebx, eax
test eax, eax
jns 0x140089a60
mov rcx, qword [str.P5_n_]
cmp rcx, rbp
je 0x140089a47
test byte [rcx + 0x1c], 2
je 0x140089a47
cmp byte [rcx + 0x19], 2
jb 0x140089a47
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008c50]
mov edx, 0x66
mov r9d, eax
call fcn.1400100e0
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
cmove ebx, eax
jmp 0x140089b0f
lea rdx, [0x14000ca00]
mov r9d, 0x10000
xor r8d, r8d
mov rcx, 0xffffffff80000002
call fcn.14007ac98
mov rdi, rax
test rax, rax
jne 0x140089abc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, rbp
je 0x140089b0f
test byte [rcx + 0x1c], 2
je 0x140089b0f
cmp byte [rcx + 0x19], 2
jb 0x140089b0f
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x67]
lea r8, [0x140008c50]
mov r9d, eax
call fcn.1400100e0
jmp 0x140089b0f
lea rdx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ebx, eax
test eax, eax
je 0x140089b06
mov rcx, qword [str.P5_n_]
cmp rcx, rbp
je 0x140089b06
test byte [rcx + 0x1c], 2
je 0x140089b06
cmp byte [rcx + 0x19], 2
jb 0x140089b06
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008c50]
mov edx, 0x68
mov r9d, eax
call fcn.1400100e0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14008c5b0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140089f68
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
and qword [rsp + 0x48], 0
mov rdi, rcx
mov rcx, qword [str.P5_n_]
lea rbp, str.P5_n_
cmp rcx, rbp
je 0x140089fb4
test byte [rcx + 0x1c], 2
je 0x140089fb4
cmp byte [rcx + 0x19], 5
jb 0x140089fb4
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008c50]
mov edx, 0x75
call fcn.14000ffa8
lea rax, [rsp + 0x48]
lea rdx, [0x14000e530]
mov r9d, 0x10000
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x14008a00c
mov rcx, qword [str.P5_n_]
cmp rcx, rbp
je 0x14008a099
test byte [rcx + 0x1c], 2
je 0x14008a099
cmp byte [rcx + 0x19], 2
jb 0x14008a099
mov edx, 0x76
jmp 0x14008a086
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ebx, eax
test eax, eax
je 0x14008a05a
mov rcx, qword [str.P5_n_]
cmp rcx, rbp
je 0x14008a05a
test byte [rcx + 0x1c], 2
je 0x14008a05a
cmp byte [rcx + 0x19], 2
jb 0x14008a05a
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008c50]
mov edx, 0x77
mov r9, rdi
mov dword [rsp + 0x20], eax
call fcn.140011a18
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x14008a099
mov rcx, qword [str.P5_n_]
cmp rcx, rbp
je 0x14008a099
test byte [rcx + 0x1c], 2
je 0x14008a099
cmp byte [rcx + 0x19], 2
jb 0x14008a099
mov edx, 0x78
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008c50]
mov r9d, eax
call fcn.1400100e0
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14008c268
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x1400a43c0], rdi
je 0x14008c2c8
cmp rax, rdi
jne 0x14008c2bb
mov r12d, 1
jmp 0x14008c2c8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14008c2a1
mov eax, dword [0x1400a43b8]
cmp eax, 1
jne 0x14008c2dd
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x14008c344
mov eax, dword [0x1400a43b8]
cmp eax, ebx
jne 0x14008c33a
mov dword [0x1400a43b8], 1
lea r13, [0x140001bd0]
lea rdi, [0x140001bb8]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14008c32c
cmp eax, ebx
jne 0x14008c32c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x14008c321
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14008c30a
cmp eax, ebx
je 0x14008c344
mov eax, 0xff
jmp 0x14008c48c
mov dword [0x1400a36b4], 1
mov eax, dword [0x1400a43b8]
cmp eax, 1
jne 0x14008c36c
lea rdx, [0x140001bb0]
lea rcx, [0x140001b98]
call sub.msvcrt.dll__initterm
mov dword [0x1400a43b8], 2
cmp r12d, ebx
jne 0x14008c37b
mov rax, rbx
xchg qword [0x1400a43c0], rax
cmp qword [0x1400a43d8], rbx
je 0x14008c3a3
lea rcx, [0x1400a43d8]
call fcn.14008caac
cmp eax, ebx
je 0x14008c3a3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x1400a43d8]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x14008c3b9
mov eax, 0xff
jmp 0x14008c48c
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14008c43e
cmp word [rcx], bx
je 0x14008c3d4
cmp edx, ebx
jne 0x14008c43e
cmp word [rcx], bx
je 0x14008c3ea
cmp word [rcx], 0x20
ja 0x14008c3ea
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14008c3d4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140030f14
mov dword [0x1400a36b0], eax
cmp dword [0x1400a3694], ebx
jne 0x14008c428
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400a36b4], ebx
jne 0x14008c43c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400a36b0]
jmp 0x14008c48c
cmp word [rcx], 0x22
jne 0x14008c451
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14008c3c5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.140138000
add rsp, 0x28
jmp 0x14008c268
Function at 0x14008c5b0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14009e140]
jne 0x14008c5cb
rol rcx, 0x10
test cx, 0xffff
jne 0x14008c5c7
ret 0
ror rcx, 0x10
jmp 0x14008cc7c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400a3770]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x1400a3868]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14008cd01
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400a3770]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x14008cd23
mov rax, qword [rsp + 0x88]
mov qword [0x1400a3868], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400a3808], rax
mov rax, qword [0x1400a3868]
mov qword [0x1400a36e0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400a37f0], rax
mov dword [0x1400a36d0], 0xc0000409
mov dword [0x1400a36d4], 1
mov rax, qword [0x14009e140]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14009e148]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140001ce8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14008c6a4
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14008c70f
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x14008c72f
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x140001cb0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret

Function at 0x14008cb18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x14008cb65
cmp rcx, 0xffffffffffffffff
je 0x14008cb65
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14008cb5d
cmp dword [rcx + 0x3c], edx
jl 0x14008cb5d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14008cb5d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14008cb65
mov rax, rdx
add rsp, 0x18
ret
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdx
lea rax, [rsp + 0x3c]
mov rdx, rcx
mov rcx, qword [0x0040c758]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add rsp, 0x48
ret

Function at 0x401036
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov rdx, rcx
lea rcx, [0x0040b704]
call sub.msvcrt.dll_wcscpy
lea rcx, [0x0040b700]
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.00401000

Function at 0x4010c8
Capabilities:
Create process on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x100
xor eax, eax
mov rbx, rcx
cmp dl, 2
mov ecx, 0x19
mov dword [rsp + 0x98], 0x68
lea rdi, [rsp + 0x9c]
mov ebp, edx
mov qword [rsp + 0x70], 0
rep stosd dword [rdi], eax
lea rsi, [rsp + 0x98]
lea rdi, [rsp + 0x80]
jne 0x401233
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
mov dword [rsp + 0x6c], eax
je 0x401233
lea rdx, [rsp + 0x78]
mov ecx, eax
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
je 0x401233
lea rax, [rsp + 0x6c]
mov r9d, 8
mov edx, 0x13
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov r12, qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x4011b8
mov qword [rsp + 0x50], rdi
xor r9d, r9d
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r12
mov ebp, eax
jmp 0x401207
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x50], rdi
mov r8, rbx
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r12
test eax, eax
mov ebp, eax
je 0x40116f
mov rcx, qword [rsp + 0x78]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x70]
call rbx
test ebp, ebp
je 0x401295
or edx, 0xffffffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x401279
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rsi
mov rdx, rbx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401295
test bpl, bpl
jne 0x401220
mov rcx, qword [rsp + 0x80]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x88]
call rbx
nop
add rsp, 0x100
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x401378
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rdx, rcx
mov rcx, qword [0x0040c758]
mov dword [rsp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret
Function at 0x4013a8
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x298
lea rdi, str.DriveSize
mov r14, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rax, str.ImageFile
mov r13, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r15, [rsp + 0x34]
test edx, edx
mov rbp, rcx
cmovne rdi, rax
cmp edx, 1
sbb esi, esi
xor ebx, ebx
and esi, 0xc
add esi, 5
mov rdx, qword [rdi + rbx*8]
lea rcx, [rbp + 4]
lea r12, [rsp + 0x38]
call sub.msvcrt.dll_wcscpy
lea rax, [rsp + 0x30]
xor r8d, r8d
mov r9, r15
mov rdx, qword [rdi + rbx*8]
mov qword [rsp + 0x28], rax
inc rbx
mov rcx, qword [0x0040c758]
mov dword [rsp + 0x30], 0x258
mov qword [rsp + 0x20], r12
call r14
mov eax, dword [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov r9d, dword [rsp + 0x34]
mov rdx, rbp
mov rcx, qword [0x0040c758]
mov dword [rsp + 0x28], eax
call r13
cmp esi, ebx
jg 0x4013f2
add rsp, 0x298
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x40146c
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, str.DlgFlags
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov rdx, rbx
mov dword [rsp + 0x34], 4
call fcn.00401000
test byte [rsp + 0x31], 1
je 0x4014a3
xor eax, eax
jmp 0x40152f
lea rcx, str.C:hiberfil.sys
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40151f
lea rax, [rsp + 0x38]
xor r8d, r8d
mov r9d, 1
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerPower
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40149c
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
lea rdx, str.HiberbootEnabled
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
jmp 0x40152f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4014b4
jmp 0x40149c
add rsp, 0x40
pop rbx
ret

Function at 0x401535
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
xor r8d, r8d
mov r9d, 1
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetControlFileSystem
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edx, edx
test eax, eax
jne 0x4015b7
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, str.DisableDeleteNotification
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
cmp dword [rsp + 0x30], 0
sete dl
mov eax, edx
add rsp, 0x48
ret