joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015230
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x1406057c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp edx, 0xffffffff
je 0x14001535d
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x14001528d
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x14001528d
dec ecx
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x1400153a2
cmp qword [rdi + 0x80], 0
je 0x140015361
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x1400152c7
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140015368
mov byte [rsp + 0x5f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x5f]
mov r8, rbx
call qword [r10 + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x140015381
mov r15, qword [rsp + 0x48]
sub r15, r14
je 0x14001534d
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x1400153a0
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rbx
mov eax, 0xffffffff
jmp 0x14001539b
xor esi, esi
jmp 0x1400153a2
mov esi, 0xffffffff
jmp 0x1400153a2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x1400153a2
cmp eax, 3
jne 0x1400153a0
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14001dca0
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140015960
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je case.default.0x14001598f
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400159e3
test rsi, rsi
jle 0x1400159e3
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x1400159e3
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jg 0x1400159eb
jmp 0x140015a0b
mov r14, rsi
test r14, r14
jle 0x140015a0b
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x140015a0b
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
invalid

Function at 0x140015f60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x1406057c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x14001600a
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x14001600a
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140016008
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x140016021
cmp eax, 1
je 0x140015fd7
test eax, eax
jne 0x140016008
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x140015ffe
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140016008
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x14001600a
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001dca0
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x14001600a
Function at 0x1400196a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x1406057c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
test rcx, rcx
je 0x1400197d3
mov rsi, rcx
mov rdx, qword [0x140046218]
mov dword [rsp + 0x20], 0x40
mov r8d, 0x2f2000
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x1400197f8
mov rdi, rax
mov qword [rsp + 0x20], 0
lea r8, [0x1400467b0]
mov r9d, 0x2f2000
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140019808
mov dword [rsp + 0x28], 0x2f2000
mov qword [rsp + 0x30], rdi
mov rcx, qword [0x1406058a8]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea r8, str.Successfully_written_cheat_binary_at__size:_
lea rdi, [rsp + 0x30]
xor edx, edx
mov r9, rdi
call fcn.1400199e0
mov dword [rsp + 0x20], 0x40
mov edx, 0x80190000
mov r8d, 0x2cd000
mov rcx, rsi
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x140019818
mov rbx, rax
mov qword [rsp + 0x20], 0
lea r8, [0x1403387b0]
mov r9d, 0x2cd000
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140019808
mov qword [rsp + 0x30], 0x2cd000
mov qword [rsp + 0x28], rbx
mov rcx, qword [0x1406058a8]
mov qword [rsp + 0x20], rdi
lea r8, str.Successfully_written_mapper_binary_at__size:_
lea r9, [rsp + 0x28]
xor edx, edx
call fcn.140016d10
mov sil, 1
jmp 0x14001982f
mov qword [rsp + 0x30], 0
mov rcx, qword [0x1406058a8]
lea r8, str.Bad_process_handle:_
lea r9, [rsp + 0x30]
mov dl, 2
call fcn.140001370
jmp 0x14001982d
mov rcx, qword [0x1406058a8]
lea r8, str.Failed_to_alloc_memory_for_cheat
jmp 0x140019826
mov rcx, qword [0x1406058a8]
lea r8, str.Failed_to_write_cheat_binary
jmp 0x140019826
mov rcx, qword [0x1406058a8]
lea r8, str.Failed_to_alloc_memory_for_mapper
mov dl, 2
call fcn.1400161b0
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14001dca0
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140019850
Capabilities:
Create process on windows
Enumerate processes
Execute command
Set console window title

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x288
mov rcx, qword [0x1406058a8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0xf
lea r8, [rsp + 0x30]
xor edx, edx
call fcn.14001b4f0
lea rcx, str.VZLOMKA_aimware_loader_steam_pepe
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
lea rdx, str.open
lea r8, str.steam:__rungameid_730
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [0x1406058a8]
lea r8, str.Waiting_game...
xor edx, edx
call fcn.1400161b0
lea rsi, [rsp + 0x7c]
lea rdi, [rsp + 0x50]
lea rbx, str.cs2.exe
mov r15, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov r12, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140019924
mov rcx, r14
call r12
xor ebp, ebp
mov ecx, 0xa
call r13
test ebp, ebp
jne 0x140019979
mov dword [rsp + 0x50], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
mov rcx, rax
mov rdx, rdi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x140019910
nop dword [rax + rax]
mov rcx, r14
mov rdx, rdi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x140019910
mov rcx, rsi
mov rdx, rbx
call r15
test eax, eax
jne 0x140019950
mov rcx, r14
call r12
mov ebp, dword [rsp + 0x58]
jmp 0x140019918
mov ecx, 0x1fffff
xor edx, edx
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
call fcn.1400196a0
test al, al
je 0x1400199a7
mov ecx, 0x190
mov edx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
jmp 0x1400199c9
mov rcx, qword [0x1406058a8]
lea r8, str.Failed_to_load_binary_into_game_:_
mov dl, 2
call fcn.1400161b0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14001e500
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001e54a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001e54a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001e54a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001e54a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001e54a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001e54c
xor al, al
add rsp, 0x28
ret

Function at 0x1004010e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
lea r9, str._______________Q_msgkey____M_shmkey____S_semkey__...
lea r8, str.usage:_ipcrm___q_msqid____m_shmid____s_semid_
lea rdx, str._s_n_s_n
call sub.cygwin1.dll_fprintf
mov ecx, 1
call sub.cygwin1.dll_exit
nop
nop word cs:[rax + rax]
Function at 0x14002cbe0
Capabilities:
Terminate process

Disassembly:
invalid
cld
pop r11
jmp 0x14002cbed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002cbfd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14002cbe5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14002cc15
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14002cc02
sub eax, 3
jb 0x14002cc2f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14002cc66
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14002cc56
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14002cc54
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14002cc43
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14002cba2
jmp 0x14002cbed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1bc00
mov dl, 0xa
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14002ccb2
cmp rsi, rcx
jae 0x14002ccba
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14002cc99
cmp al, 0x8f
ja 0x14002cc99
cmp byte [rsi - 2], 0xf
je 0x14002cc9f
sub al, 0xe8
cmp al, 1
ja 0x14002cc83
cmp rsi, rcx
jae 0x14002ccba
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14002cc89
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002ccba
lodsb al, byte [rsi]
jmp 0x14002cc99
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2a000]
mov eax, dword [rdi]
or eax, eax
je 0x14002cd17
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2c22c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14002ccc7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14002cd11
mov qword [rbx], rax
add rbx, 8
jmp 0x14002cce7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14002cd51
cmp al, 0xef
ja 0x14002cd43
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14002cd23
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14002cd32
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14002cda5
sub rsp, 0xffffffffffffff80
jmp 0x14001be90
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [str.h0_t_]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [str.d0_t_]
mov dword [rax], 1
mov rax, qword [0x14008f900]
mov dword [rax], 1
mov rax, qword [0x14008f870]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14008f8d0]
mov dword [0x14009300c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x14008f9c0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [str.p0_t_]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14008f850]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [str._0_t_]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [str.H0_t_]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140093008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x14008f8a0]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call dbg._pei386_runtime_relocator
mov rcx, qword [dbg._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x14008f920]
lea rcx, [dbg.__mingw_invalidParameterHandler]
mov qword [rdx], rax
call sym._set_invalid_parameter_handler
call dbg._fpreset
mov ebx, dword [0x140093028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sym.malloc
mov r12, qword [0x140093020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
mov rcx, qword [r12 + rbx]
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [r12 + rbx]
mov rcx, rax
add rbx, 8
call sym.memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, rbp
mov qword [rdi], 0
mov qword [0x140093020], rbp
call dbg.__main
mov rax, qword [str.h__t_]
mov r8, qword [0x140093018]
mov ecx, dword [0x140093028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140093020]
call sym.main
mov ecx, dword [0x14009300c]
mov dword [0x140093010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140093008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [str.H0_t_]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call dbg._amsg_exit
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x14008f970]
mov rcx, qword [0x14008f960]
call sym._initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sym._cexit
mov eax, dword [0x140093010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [str._P_t_]
mov rcx, qword [0x14008f980]
mov dword [rsi], 1
call sym._initterm
jmp 0x1400011f5
mov rdi, rax
jmp 0x1400012b5
mov ecx, eax
call sym.exit
nop
Function at 0x140001530
Capabilities:
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x14000158b
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 1
jmp 0x1400016a9
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x40], 0
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x1400015ec
mov eax, 0
jmp 0x1400016a9
mov rax, qword [rbp - 0x10]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 3
mov r8d, 0
lea rdx, [0x14008f0c0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x140001640
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
jmp 0x1400016a9
mov rax, qword [rbp - 0x10]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 3
mov r8d, 0
lea rdx, [0x14008f0c4]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x140001694
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
jmp 0x1400016a9
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 1
add rsp, 0x60
pop rbp
ret

Function at 0x1400016af
Capabilities:
Delete registry key

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x1400016e2
mov eax, 1
jmp 0x1400016f4
cmp dword [rbp - 4], 2
jne 0x1400016ef
mov eax, 1
jmp 0x1400016f4
mov eax, 0
add rsp, 0x30
pop rbp
ret
Function at 0x1400016fa
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x10]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x14000174d
mov eax, 0
jmp 0x140001870
mov rax, qword [rbp - 0x18]
lea r8, [rbp - 0x1c]
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x20]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x1400017a3
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
jmp 0x140001870
mov eax, dword [rbp - 0x1c]
cmp eax, 3
je 0x1400017c5
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
jmp 0x140001870
mov rax, qword [rbp + 0x20]
mov eax, dword [rax]
test eax, eax
jne 0x1400017e3
mov rax, qword [rbp + 0x20]
mov dword [rax], 0
mov eax, 0
jmp 0x140001870
mov rax, qword [rbp + 0x20]
mov eax, dword [rax]
mov eax, eax
mov rcx, rax
call sym.operator_new___unsigned_long_long_
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x20]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x14000185c
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
cmp qword [rbp - 0x10], 0
je 0x140001855
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.operator_delete___void_
mov eax, 0
jmp 0x140001870
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov rax, qword [rbp - 0x10]
add rsp, 0x50
pop rbp
ret
Function at 0x140001876
Capabilities:
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov dword [rbp + 0x28], r9d
mov rax, qword [rbp + 0x10]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20006
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x1400018ca
mov eax, 0
jmp 0x14000192f
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp + 0x18]
mov ecx, dword [rbp + 0x28]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp + 0x20]
mov qword [rsp + 0x20], rcx
mov r9d, 3
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
je 0x14000191a
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
jmp 0x14000192f
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 1
add rsp, 0x40
pop rbp
ret

Function at 0x1400019c5
Capabilities:
Terminate process
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov rax, qword [rbp + 0x10]
lea rdx, [0x14008f0d2]
mov rcx, rax
call sym.fopen
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140001a10
lea rax, str.Error_opening_file._n
mov rcx, rax
call sym.printf_char_const__::_
mov ecx, 1
call sym.exit
mov eax, dword [rbp + 0x20]
movsxd rdx, eax
mov rcx, qword [rbp - 8]
mov rax, qword [rbp + 0x18]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140001a44
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.system
nop
add rsp, 0x20
pop rbp
ret

Function at 0x140001a63
Capabilities:
Delete file

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.remove
test eax, eax
sete al
test al, al
jne 0x140001a94
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x140001a6f
nop
nop
add rsp, 0x20
pop rbp
ret

Function at 0x140001e90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call dbg.vfprintf
call sym.abort
nop
nop dword [rax]