joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f3060
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [rdx]
mov r14, rdx
mov rbp, rcx
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400f3224
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x80], rdi
nop dword [rax + rax]
mov rcx, qword [rbx + 0x20]
call fcn.1402bfd80
mov rdi, rax
test rax, rax
je 0x1400f31bb
mov rcx, rax
call fcn.1402bfff8
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], 0
jne 0x1400f30b1
add r8d, r8d
xor r9d, r9d
mov eax, r8d
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [rax*4]
movsxd r10, ecx
add r10, rdi
neg eax
movsxd rdx, eax
je 0x1400f310a
imul eax, dword [r10 + rdx*4], 0xcc9e2d51
rol eax, 0xf
imul ecx, eax, 0x1b873593
xor r9d, ecx
rol r9d, 0xd
add r9d, 0xfaddaf14
lea r9d, [r9 + r9*4]
inc rdx
jne 0x1400f30e2
mov ecx, r8d
xor edx, edx
and ecx, 3
dec ecx
je 0x1400f3130
dec ecx
je 0x1400f3126
dec ecx
jne 0x1400f3148
movzx edx, byte [r10 + 2]
shl edx, 0x10
movzx eax, byte [r10 + 1]
shl eax, 8
xor edx, eax
movzx eax, byte [r10]
xor eax, edx
imul ecx, eax, 0xcc9e2d51
rol ecx, 0x10
imul eax, ecx, 0x1b873593
xor r9d, eax
xor r9d, r8d
mov eax, r9d
shr eax, 0x10
xor eax, r9d
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov rcx, rdi
mov dword [rsp + 0x78], eax
call fcn.1402bd0e0
movzx eax, byte [0x14043124a]
lea rcx, [rbp + 0x448]
lea r9, [rbx + 0x20]
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x20], al
call fcn.1400eac70
movzx eax, byte [0x14043124a]
lea rcx, [rbp + 0x458]
lea r9, [rsp + 0x78]
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x20], al
call fcn.1400ea9d0
cmp byte [rbx + 0x19], 0
jne 0x1400f320e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1400f31ee
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1400f320e
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400f31e0
jmp 0x1400f320e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400f320b
cmp rbx, qword [rax + 0x10]
jne 0x1400f320b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400f31f8
mov rbx, rax
cmp rbx, qword [r14]
jne 0x1400f3090
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x70]
mov al, 1
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
Function at 0x1400f34e0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
xor bl, bl
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x1400f3576
mov qword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov rcx, rax
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400f3576
mov rcx, qword [rsp + 0x58]
mov r9d, 4
lea rax, [rsp + 0x48]
lea edx, [r9 + 0xe]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400f356b
cmp dword [rsp + 0x48], 4
jne 0x1400f356b
mov eax, dword [rsp + 0x50]
mov bl, 1
cmp eax, 2
je 0x1400f355e
cmp eax, 3
jne 0x1400f3563
mov byte [rdi], 1
jmp 0x1400f356b
cmp eax, 1
setne cl
mov byte [rdi], cl
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f41b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov dword [rbp - 0x50], r14d
mov qword [rbp - 0x18], r14
lea edx, [r14 + 9]
lea rcx, [rbp - 0x20]
call fcn.1402028a0
mov eax, dword [rbp - 0x18]
inc eax
movsxd rdx, eax
lea r9d, [r14 + 9]
lea r8, [0x140352c88]
mov rcx, qword [rbp - 0x20]
call fcn.1402c06dc
lea edx, [r14 + 9]
lea rcx, [rbp - 0x20]
call fcn.140203bb0
nop
lea edx, [r14 + 0x23]
lea rcx, [rbp - 0x10]
call fcn.14020e790
nop
lea r8, [rbp - 0x20]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400d4050
nop
cmp dword [rbp - 8], r14d
jle 0x1400f424a
mov rcx, qword [rbp - 0x10]
call fcn.1402bd0e0
nop
cmp dword [rbp - 0x18], 0
jle 0x1400f4259
mov rcx, qword [rbp - 0x20]
call fcn.1402bd0e0
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x40]
call fcn.1402053e0
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400f428a
test al, 0x10
je 0x1400f428a
cmp dword [rbp - 0x28], 0
jle 0x1400f42a8
mov rcx, qword [rbp - 0x30]
call fcn.1402bd0e0
jmp 0x1400f42a8
cmp dword [rbp - 0x28], 0
jle 0x1400f4299
mov rcx, qword [rbp - 0x30]
call fcn.1402bd0e0
xor r8d, r8d
mov rdx, qword [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test rsi, rsi
je 0x1400f4320
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400f42b1
mov qword [rbp - 0x28], r14
test ebx, ebx
jne 0x1400f42d0
lea rax, [0x14034d1a0]
mov qword [rbp - 0x30], rax
jmp 0x1400f42f2
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp - 0x28]
inc eax
movsxd rdx, eax
mov r8, rsi
mov rcx, qword [rbp - 0x30]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.140203bb0
nop
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.1400d4050
nop
cmp dword [rbp - 0x28], 0
jle 0x1400f4363
mov rcx, qword [rbp - 0x30]
call fcn.1402bd0e0
jmp 0x1400f4363
mov qword [rdi + 8], r14
mov edx, dword [rbp - 0x34]
test edx, edx
jne 0x1400f4337
lea rax, [0x14034d1a0]
mov qword [rdi], rax
jmp 0x1400f435a
mov rcx, rdi
call fcn.1402028a0
movsxd r9, dword [rbp - 0x34]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x40]
mov rcx, qword [rdi]
call fcn.1402c06dc
mov edx, dword [rbp - 0x34]
mov rcx, rdi
call fcn.140203bb0
nop
cmp dword [rbp - 0x38], 0
jle 0x1400f4372
mov rcx, qword [rbp - 0x40]
call fcn.1402bd0e0
mov rax, rdi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400f4390
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov dword [rbp - 0x50], r14d
mov qword [rbp - 0x18], r14
lea edx, [r14 + 9]
lea rcx, [rbp - 0x20]
call fcn.1402028a0
mov eax, dword [rbp - 0x18]
inc eax
movsxd rdx, eax
lea r9d, [r14 + 9]
lea r8, [0x140352c88]
mov rcx, qword [rbp - 0x20]
call fcn.1402c06dc
lea edx, [r14 + 9]
lea rcx, [rbp - 0x20]
call fcn.140203bb0
nop
lea edx, [r14 + 0x26]
lea rcx, [rbp - 0x10]
call fcn.14020e790
nop
lea r8, [rbp - 0x20]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400d4050
nop
cmp dword [rbp - 8], r14d
jle 0x1400f442a
mov rcx, qword [rbp - 0x10]
call fcn.1402bd0e0
nop
cmp dword [rbp - 0x18], 0
jle 0x1400f4439
mov rcx, qword [rbp - 0x20]
call fcn.1402bd0e0
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x40]
call fcn.1402053e0
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400f446a
test al, 0x10
je 0x1400f446a
cmp dword [rbp - 0x28], 0
jle 0x1400f4488
mov rcx, qword [rbp - 0x30]
call fcn.1402bd0e0
jmp 0x1400f4488
cmp dword [rbp - 0x28], 0
jle 0x1400f4479
mov rcx, qword [rbp - 0x30]
call fcn.1402bd0e0
xor r8d, r8d
mov rdx, qword [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test rsi, rsi
je 0x1400f4500
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400f4491
mov qword [rbp - 0x28], r14
test ebx, ebx
jne 0x1400f44b0
lea rax, [0x14034d1a0]
mov qword [rbp - 0x30], rax
jmp 0x1400f44d2
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rbp - 0x28]
inc eax
movsxd rdx, eax
mov r8, rsi
mov rcx, qword [rbp - 0x30]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.140203bb0
nop
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.1400d4050
nop
cmp dword [rbp - 0x28], 0
jle 0x1400f4543
mov rcx, qword [rbp - 0x30]
call fcn.1402bd0e0
jmp 0x1400f4543
mov qword [rdi + 8], r14
mov edx, dword [rbp - 0x34]
test edx, edx
jne 0x1400f4517
lea rax, [0x14034d1a0]
mov qword [rdi], rax
jmp 0x1400f453a
mov rcx, rdi
call fcn.1402028a0
movsxd r9, dword [rbp - 0x34]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x40]
mov rcx, qword [rdi]
call fcn.1402c06dc
mov edx, dword [rbp - 0x34]
mov rcx, rdi
call fcn.140203bb0
nop
cmp dword [rbp - 0x38], 0
jle 0x1400f4552
mov rcx, qword [rbp - 0x40]
call fcn.1402bd0e0
mov rax, rdi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400f4c70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rsi
sub rsp, 0x78
xor edx, edx
mov rbx, rcx
xor r8d, r8d
lea ecx, [rdx + 6]
mov sil, 1
call fcn.1400ce2e0
test al, al
je 0x1400f4de3
cmp byte [rbx + 0x22d], 0
mov qword [rsp + 0x70], rdi
jne 0x1400f4d3f
xor ecx, ecx
call fcn.1400f4570
mov rdi, rax
test rax, rax
je 0x1400f4d3f
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0xa0]
lea r9, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
lea rdx, str.NoSSL
xor r8d, r8d
mov dword [rsp + 0x98], 0
mov dword [rsp + 0xa0], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400f4d1c
cmp dword [rsp + 0x98], ebx
sete sil
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8]
test sil, sil
jne 0x1400f4d3f
movzx eax, sil
mov rdi, qword [rsp + 0x70]
add rsp, 0x78
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x40]
call fcn.1400caec0
lea rcx, [rsp + 0x58]
call fcn.1400cafe0
mov ecx, dword [rax + 0x10]
cmp ecx, dword [rsp + 0x50]
jne 0x1400f4d77
mov rax, qword [rax + 8]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa0], rax
jmp 0x1400f4dbb
test ecx, ecx
jne 0x1400f4d9c
lea rcx, [rax + 8]
lea rdx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa0], rax
jmp 0x1400f4dbb
mov rax, qword [rax + 8]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
mov rdi, qword [rsp + 0x70]
cmp eax, 0xffffffff
sete al
add rsp, 0x78
pop rsi
pop rbx
ret
mov eax, dword [0x140431ac0]
test al, 1
jne 0x1400f4e1b
or eax, 1
lea rcx, [0x1403050b0]
mov qword [0x140431ad0], 0xffffffff80000002
mov dword [0x140431ac0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x140431ac8], rax
call fcn.1402be804
lea rdx, [0x140352cb8]
lea rcx, [0x140431ac8]
call fcn.1400ece40
mov rbx, rax
test rax, rax
je 0x1400f4e7e
lea rcx, [rsp + 0x98]
mov dword [rsp + 0x28], 4
lea rdx, str.NoSSL
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + 8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x98], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8]
xor al, al
add rsp, 0x78
pop rsi
pop rbx
ret
Function at 0x1400f4e90
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor eax, eax
test dl, dl
movzx edi, dl
setne al
mov dword [rcx + 0x108], eax
mov eax, dword [0x140431ac0]
test al, 1
jne 0x1400f4ee2
or eax, 1
lea rcx, [0x1403050b0]
mov qword [0x140431ad0], 0xffffffff80000002
mov dword [0x140431ac0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x140431ac8], rax
call fcn.1402be804
lea rdx, [0x140352cb8]
lea rcx, [0x140431ac8]
call fcn.1400ece40
mov rbx, rax
test rax, rax
je 0x1400f4f57
lea rdx, str.EarlyWarning
test dil, dil
je 0x1400f4f38
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x48]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400f4f4a
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f4f70
Capabilities:
Create thread
Resume thread

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
movaps xmmword [rax - 0x38], xmm6
movzx esi, dl
mov rbx, rcx
xor r12d, r12d
mov eax, dword [0x1404214a0]
cmp eax, 0xffffffff
jne 0x1400f4fd9
call fcn.140114cf0
test al, al
je 0x1400f4fc7
mov edi, 1
mov dword [0x1404214a0], edi
jmp 0x1400f51c2
cmp qword [rbx + 0x2f8], r12
jne 0x1400f4fb7
mov dword [0x1404214a0], r12d
jmp 0x1400f4fe2
cmp eax, 1
je 0x1400f51c2
cmp qword [rbx + 0x270], r12
jne 0x1400f51be
mov edi, 1
xor eax, eax
lock cmpxchg dword [rbx + 0x110], edi
jne 0x1400f51c2
call fcn.140114b00
test al, al
je 0x1400f51c2
mov byte [rbx + 0x33], sil
call fcn.140107a50
test al, al
jne 0x1400f51c2
xor r14b, r14b
test sil, sil
jne 0x1400f5163
xor ecx, ecx
call fcn.1400f4570
mov rsi, rax
test rax, rax
je 0x1400f5163
lea rax, [0x14034d1a0]
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], r12
lea r8, [rbp - 0x11]
lea rdx, str.LastCFU
mov rcx, rsi
call fcn.1400d9fd0
test al, al
je 0x1400f5144
lea rax, vtable.Core::DateTime.0
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], r12
mov dword [rbp + 0x1f], edi
cmp dword [rbp - 5], 0x13
jl 0x1400f5144
mov qword [rbp - 0x19], r12
lea edx, [rdi + 0x12]
lea rcx, [rbp - 0x21]
call fcn.1402028a0
mov eax, dword [rbp - 0x19]
inc eax
movsxd rdx, eax
lea r9d, [rdi + 0x12]
lea r8, str.yyyy_MM_dd_HH:mm:ss
mov rcx, qword [rbp - 0x21]
call fcn.1402c06dc
lea edx, [rdi + 0x12]
lea rcx, [rbp - 0x21]
call fcn.140203bb0
nop
xor r9d, r9d
lea r8, [rbp + 0xf]
lea rdx, [rbp - 0x21]
mov rcx, qword [rbp - 0x11]
call fcn.1400ec430
test al, al
sete r15b
cmp dword [rbp - 0x19], 0
jle 0x1400f50e9
mov rcx, qword [rbp - 0x21]
call fcn.1402bd0e0
test r15b, r15b
jne 0x1400f5144
call fcn.1401167f0
mov rcx, rax
lea r8, [rbp + 0xf]
lea rdx, [rbp - 1]
call fcn.1400cb050
xorps xmm6, xmm6
cvtsi2sd xmm6, qword [rbp + 7]
movaps xmm1, xmm6
divsd xmm1, qword [0x140379530]
movq rdx, xmm1
lea rcx, str.LastCFU__3.1f_mins_ago_n
call fcn.1402bd818
divsd xmm6, qword [0x140379550]
movzx r14d, r14b
movsd xmm0, qword [0x1403793c8]
comisd xmm0, xmm6
cmova r14d, edi
mov rax, qword [rsi]
mov edx, edi
mov rcx, rsi
call qword [rax]
nop
cmp dword [rbp - 9], 0
jle 0x1400f515e
mov rcx, qword [rbp - 0x11]
call fcn.1402bd0e0
test r14b, r14b
jne 0x1400f51c2
mov dword [rbp + 0x77], r12d
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x1400f51f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x270], rax
test rax, rax
je 0x1400f51c2
mov eax, dword [rbx + 0x220]
mov dword [rbx + 0x224], eax
mov edx, 4
mov rcx, rbx
call fcn.1400f6840
mov rcx, qword [rbx + 0x270]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
jmp 0x1400f51c4
xor al, al
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400f7120
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
lea r14, [0x14034d1a0]
mov qword [rbp - 0x28], r14
xor esi, esi
mov qword [rbp - 0x20], rsi
mov edx, 0x258
xor ecx, ecx
lea r8d, [rsi + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400f7335
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400fd5f0
test al, al
je 0x1400f7335
cmp dword [rbp - 0x1c], esi
je 0x1400f7335
mov rbx, qword [rbp - 0x28]
lea r8d, [rsi + 0xa]
lea rdx, [rbp + 0x20]
mov rcx, rbx
call fcn.1402c04f0
mov edi, eax
mov rdx, qword [rbp + 0x20]
sub rdx, rbx
sar rdx, 1
movsxd rcx, dword [rbp - 0x1c]
cmp rdx, rcx
jne 0x1400f7335
test eax, eax
je 0x1400f7335
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rsi
mov edx, 0x259
xor ecx, ecx
lea r8d, [rsi + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400f7236
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400fd5f0
test al, al
je 0x1400f7236
lea r8d, [rsi + 1]
lea rdx, [0x14034bd50]
lea rcx, [rbp - 0x28]
call fcn.140205020
test al, al
jne 0x1400f7236
mov edx, dword [rbp - 0x1c]
lea rcx, [rbp - 0x18]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x10]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x18]
call fcn.1402c06dc
mov edx, dword [rbp - 0x1c]
lea rcx, [rbp - 0x18]
call fcn.140203bb0
mov eax, dword [0x140431ac0]
test al, 1
jne 0x1400f726e
or eax, 1
mov dword [0x140431ac0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x140431ac8], rax
mov qword [0x140431ad0], 0xffffffff80000002
lea rcx, [0x1403050b0]
call fcn.1402be804
lea rdx, [0x140352cb8]
lea rcx, [0x140431ac8]
call fcn.1400ece40
mov rbx, rax
test rax, rax
je 0x1400f7325
lea rdx, [0x140352fe8]
mov rcx, rax
call fcn.1400ed340
cmp eax, 4
je 0x1400f7317
mov dword [rbp + 0x20], edi
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x140352fe8]
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400f7317
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400f72e0
test rax, rax
je 0x1400f7317
mov eax, dword [rbp - 0xc]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.RURL
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
cmp dword [rbp - 0x10], 0
jle 0x1400f7335
mov rcx, qword [rbp - 0x18]
call fcn.1402bd0e0
nop
cmp dword [rbp - 0x20], 0
jle 0x1400f7344
mov rcx, qword [rbp - 0x28]
call fcn.1402bd0e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400f7c90
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x108], 1
mov rdi, rcx
jne 0x1400f7cab
cmp byte [rcx + 0x10c], 0
je 0x1400f7cc6
call fcn.14017b0c0
test al, al
jne 0x1400f7cc6
mov rcx, rdi
call fcn.1400fa1f0
test al, al
jne 0x1400f7cc6
add rsp, 0x30
pop rdi
ret
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rbx
xor ebx, ebx
mov qword [rsp + 0x28], rax
lea r8, [0x1400f7d10]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x48]
test rax, rax
mov qword [rdi + 0x288], rax
setne al
add rsp, 0x30
pop rdi
ret

Function at 0x1400fa0d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor ecx, ecx
xor ebp, ebp
call fcn.1400f4570
mov rsi, rax
test rax, rax
je 0x1400fa14f
mov rcx, qword [rsi + 8]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.NoRestorePoint
xor r8d, r8d
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
test ebx, ebx
cmove ebp, dword [rsp + 0x58]
mov edx, 1
mov rcx, rsi
call qword [rax]
test ebp, ebp
jne 0x1400fa1cf
mov rax, qword [rdi + 0x4a0]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400fa1cf
nop
mov rcx, qword [rbx + 0x30]
test byte [rcx + 0x40], 1
je 0x1400fa175
mov rax, qword [rcx]
call qword [rax + 0x48]
cmp eax, 7
jne 0x1400fa1de
cmp byte [rbx + 0x19], 0
jne 0x1400fa1c6
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1400fa19f
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1400fa1c6
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400fa191
jmp 0x1400fa1c6
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400fa1c3
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1400fa1c3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400fa1b0
mov rbx, rax
cmp rbx, qword [rdi + 0x4a0]
jne 0x1400fa160
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400fa670
Capabilities:
Get disk information

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x1398]
mov eax, 0x1498
call fcn.1402cec90
sub rsp, rax
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp + 0x1380], rax
cmp qword [rcx + 0x3f8], 0
mov r14, rcx
ja 0x1400fa86f
mov eax, dword [0x1403533ec]
lea rdx, [rbp + 0x380]
mov ecx, 0x3ff
mov dword [rsp + 0x70], eax
movzx eax, word [0x1403533f0]
mov word [rsp + 0x74], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [rbp + 0x380], 0
je 0x1400fa86f
mov qword [rsp + 0x14b8], rbx
mov qword [rsp + 0x1490], rdi
lea rdi, [rbp + 0x380]
mov qword [rsp + 0x14c0], rsi
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdi]
lea rdx, [rbp + 0xb80]
lea rcx, [rsp + 0x70]
mov r8d, 0x400
mov word [rsp + 0x70], ax
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1400fa830
lea r8, [rbp + 0xb80]
lea rdx, [rsp + 0x70]
lea rcx, str._ws___ws_r_n
call fcn.1402bd818
lea rcx, [rbp + 0xb80]
mov edx, 0x3b
call fcn.1402c0274
test rax, rax
je 0x1400fa7e4
mov edx, 0x3a
mov rcx, rax
call fcn.1402c0274
test rax, rax
je 0x1400fa830
mov edx, 0x5c
mov rcx, rax
call fcn.1402c0274
mov rsi, rax
test rax, rax
je 0x1400fa830
lea r8, [0x14034c088]
lea rcx, [rbp - 0x80]
mov edx, 0x200
call fcn.1402bcbb8
lea rcx, [rbp - 0x80]
mov r8, rsi
mov edx, 0x200
call fcn.1402bf098
lea rax, [rbp - 0x80]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movzx eax, word [rdi]
lea rcx, [r14 + 0x3f0]
mov word [rsp + 0x48], ax
call fcn.14011df90
lea rdx, [rsp + 0x50]
jmp 0x1400fa80e
lea rax, [rbp + 0xb80]
lea rdx, [rsp + 0x30]
lea rcx, [r14 + 0x3f0]
mov qword [rsp + 0x30], rax
movzx eax, word [rdi]
mov word [rsp + 0x38], ax
call fcn.14011df90
lea rdx, [rsp + 0x60]
lea r9, [rax + 0x20]
lea rcx, [r14 + 0x3f0]
mov qword [rsp + 0x20], rax
call fcn.14011e000
nop dword [rax]
nop word [rax + rax]
inc rbx
cmp word [rbp + rbx*2 + 0x380], 0
jne 0x1400fa830
inc rbx
lea rdi, [rbp + 0x380]
cmp word [rdi + rbx*2], 0
lea rdi, [rdi + rbx*2]
jne 0x1400fa710
mov rdi, qword [rsp + 0x1490]
mov rsi, qword [rsp + 0x14c0]
mov rbx, qword [rsp + 0x14b8]
mov al, 1
mov rcx, qword [rbp + 0x1380]
xor rcx, rsp
call fcn.1402bcad0
add rsp, 0x1498
pop r14
pop rbp
ret