joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006220
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rcx
mov ecx, 4
mov esi, r8d
mov rbp, rdx
mov r9, qword [rax]
mov eax, dword [rcx + r9]
cmp dword [0x14002e9b8], eax
jle 0x140006281
lea rcx, [0x14002e9b8]
call fcn.1400094c0
cmp dword [0x14002e9b8], 0xffffffff
jne 0x140006281
mov rax, qword [rbx + 0x18]
lea rcx, [0x14002e9b8]
mov qword [0x14002e9c0], rax
call fcn.140009460
cmp qword [0x14002e9c0], 0
mov r8d, esi
mov rdx, rbp
jge 0x1400062a9
lea rcx, [rbx + 0x38]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp 0x140007600
mov qword [rsp + 0x30], rdi
mov rdi, qword [rbx + 0xd8]
xchg qword [rbx + 0xd8], rdi
mov rcx, rdi
call 0x140007600
test al, al
je 0x140006368
xor eax, eax
mov r8d, 1
lock cmpxchg dword [rbx + 0x34], r8d
cmp eax, r8d
je 0x140006368
mov rax, qword [rbx + 0xd8]
xchg qword [rbx + 0xd8], rax
cmp rax, rdi
je 0x1400062fa
xor esi, esi
jmp 0x140006365
lea rax, [rbx + 0x38]
mov ecx, 0x38
cmp rdi, rax
mov edx, 0x88
cmove ecx, edx
xor eax, eax
lea rdi, [rcx + rbx]
lock cmpxchg dword [rdi], r8d
xor esi, esi
cmp eax, r8d
je 0x14000634a
cmp qword [rdi + 0x28], rsi
je 0x14000633e
xor edx, edx
mov rcx, rdi
call fcn.140002660
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rdi + 0x28], rsi
mov eax, esi
mov qword [rdi + 0x38], 0x12c
xchg dword [rdi], eax
mov rcx, rdi
call fcn.140003230
test al, al
je 0x14000635d
xchg qword [rbx + 0xd8], rdi
mov rcx, rbx
call fcn.140006380
xchg dword [rbx + 0x34], esi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x58]
xor sil, sil
mov edi, 4
mov r14, rdx
movsxd rbp, r8d
mov rbx, rcx
add rdi, qword [rax]
nop word [rax + rax]
mov eax, dword [rdi]
cmp dword [0x14002e914], eax
jle 0x14000767a
lea rcx, [0x14002e914]
call fcn.1400094c0
cmp dword [0x14002e914], 0xffffffff
jne 0x14000767a
mov rax, qword [rbx + 0x48]
mov rcx, qword [rax + 0x18]
mov qword [0x14002e9a0], rcx
lea rcx, [0x14002e914]
call fcn.140009460
mov rcx, qword [rbx + 0x28]
test rcx, rcx
jne 0x140007691
mov rcx, rbx
call fcn.140003230
test al, al
jne 0x140007640
jmp 0x1400076f8
mov edi, 1
test ebp, ebp
je 0x1400076ad
mov r9, rcx
mov r8, rbp
mov rcx, r14
mov edx, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1400076bc
mov r8, r14
lea rdx, [0x14000b7f8]
call fcn.140005800
cmp qword [0x14002e9a0], 0
jl 0x1400076d9
cdqe
lock xadd qword [rbx + 0x38], rax
cmp rax, qword [0x14002e9a0]
setge sil
lock xadd dword [rbx + 0x40], edi
inc edi
cmp edi, 1
jne 0x1400076f4
xor ecx, ecx
xchg dword [rbx + 0x40], ecx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
movzx eax, sil
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140006380
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14002e010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
mov ecx, 4
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov eax, dword [rcx + rdx]
cmp dword [0x14002e9b4], eax
jle 0x1400063ea
lea rcx, [0x14002e9b4]
call fcn.1400094c0
cmp dword [0x14002e9b4], 0xffffffff
jne 0x1400063ea
mov rax, qword [rbx + 0x20]
mov qword [0x14002e908], rax
lea rcx, [0x14002e9b4]
call fcn.140009460
mov rcx, qword [0x14002e908]
cmp rcx, 2
jl 0x14000653b
movsxd rax, dword [rbx + 0x30]
sub rax, rcx
sub rax, 1
js 0x14000653b
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x38]
call fcn.140002d00
mov rdi, rax
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x38]
call fcn.140003420
nop
mov r9, rdi
mov r8, rax
lea rcx, [rsp + 0x60]
call fcn.1400051b0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140006485
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006480
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006480
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009330
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], ax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400064df
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400064da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009330
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14000653b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006536
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006536
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009330
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140009310
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x140006a30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x14002e010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
mov rdi, qword [0x14002e9d0]
xor ebp, ebp
mov qword [r11 - 0x58], rbp
lea rax, [0x14002a920]
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rdi
mov qword [r11 - 0x40], rbp
mov rax, qword [rdi]
lea r14, [0x14000b7fb]
cmp dword [rax], ebp
je 0x140006ac7
mov qword [r11 - 0x38], rbp
lea rcx, [r11 - 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], r14
lea rax, str._SMARTCACHESP__::_CertVerifier::_CertTrustDelayInit___
mov qword [rsp + 0x20], rax
lea r9, str._s_s
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.140005dd0
nop
lea rcx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [0x14002e9d0]
mov qword [rsp + 0x30], rbp
lea rax, [0x14002a8a0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbp
mov rax, qword [rdi]
cmp dword [rax], 0
je 0x140006b3b
mov qword [rsp + 0x78], rbp
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
lea rax, str._SMARTCACHESP__::_CertVerifier::_CertTrustSharedInit___
mov qword [rsp + 0x20], rax
lea r9, str._s_s
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.140005dd0
nop
cmp dword [rbx], 0
jne 0x140006ba1
mov qword [rbx + 0x48], rbp
mov rcx, rbx
call fcn.140006750
test eax, eax
jne 0x140006b92
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140006b63
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 8], rbp
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140006b76
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x10], rbp
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140006b89
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x18], rbp
mov dword [rbx + 4], 1
jmp 0x140006b9b
call fcn.140003870
mov qword [rbx + 0x48], rax
mov dword [rbx], 1
lea rcx, [rsp + 0x30]
call fcn.140006160
lea rcx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x50]
call fcn.140006160
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140009310
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140007600
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rcx
mov ecx, 4
mov esi, r8d
mov rbp, rdx
mov r9, qword [rax]
mov eax, dword [rcx + r9]
cmp dword [0x14002e9b8], eax
jle 0x140006281
lea rcx, [0x14002e9b8]
call fcn.1400094c0
cmp dword [0x14002e9b8], 0xffffffff
jne 0x140006281
mov rax, qword [rbx + 0x18]
lea rcx, [0x14002e9b8]
mov qword [0x14002e9c0], rax
call fcn.140009460
cmp qword [0x14002e9c0], 0
mov r8d, esi
mov rdx, rbp
jge 0x1400062a9
lea rcx, [rbx + 0x38]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp 0x140007600
mov qword [rsp + 0x30], rdi
mov rdi, qword [rbx + 0xd8]
xchg qword [rbx + 0xd8], rdi
mov rcx, rdi
call 0x140007600
test al, al
je 0x140006368
xor eax, eax
mov r8d, 1
lock cmpxchg dword [rbx + 0x34], r8d
cmp eax, r8d
je 0x140006368
mov rax, qword [rbx + 0xd8]
xchg qword [rbx + 0xd8], rax
cmp rax, rdi
je 0x1400062fa
xor esi, esi
jmp 0x140006365
lea rax, [rbx + 0x38]
mov ecx, 0x38
cmp rdi, rax
mov edx, 0x88
cmove ecx, edx
xor eax, eax
lea rdi, [rcx + rbx]
lock cmpxchg dword [rdi], r8d
xor esi, esi
cmp eax, r8d
je 0x14000634a
cmp qword [rdi + 0x28], rsi
je 0x14000633e
xor edx, edx
mov rcx, rdi
call fcn.140002660
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rdi + 0x28], rsi
mov eax, esi
mov qword [rdi + 0x38], 0x12c
xchg dword [rdi], eax
mov rcx, rdi
call fcn.140003230
test al, al
je 0x14000635d
xchg qword [rbx + 0xd8], rdi
mov rcx, rbx
call fcn.140006380
xchg dword [rbx + 0x34], esi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x58]
xor sil, sil
mov edi, 4
mov r14, rdx
movsxd rbp, r8d
mov rbx, rcx
add rdi, qword [rax]
nop word [rax + rax]
mov eax, dword [rdi]
cmp dword [0x14002e914], eax
jle 0x14000767a
lea rcx, [0x14002e914]
call fcn.1400094c0
cmp dword [0x14002e914], 0xffffffff
jne 0x14000767a
mov rax, qword [rbx + 0x48]
mov rcx, qword [rax + 0x18]
mov qword [0x14002e9a0], rcx
lea rcx, [0x14002e914]
call fcn.140009460
mov rcx, qword [rbx + 0x28]
test rcx, rcx
jne 0x140007691
mov rcx, rbx
call fcn.140003230
test al, al
jne 0x140007640
jmp 0x1400076f8
mov edi, 1
test ebp, ebp
je 0x1400076ad
mov r9, rcx
mov r8, rbp
mov rcx, r14
mov edx, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1400076bc
mov r8, r14
lea rdx, [0x14000b7f8]
call fcn.140005800
cmp qword [0x14002e9a0], 0
jl 0x1400076d9
cdqe
lock xadd qword [rbx + 0x38], rax
cmp rax, qword [0x14002e9a0]
setge sil
lock xadd dword [rbx + 0x40], edi
inc edi
cmp edi, 1
jne 0x1400076f4
xor ecx, ecx
xchg dword [rbx + 0x40], ecx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
movzx eax, sil
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1406cc058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406cc1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406cc089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406cc06f
add dl, dl
jne 0x1406cc096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406cc0f6
xor eax, eax
add dl, dl
jne 0x1406cc0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406cc1ad
add dl, dl
jne 0x1406cc0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406cc0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406cc0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406cc0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406cc0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406cc07e
mov eax, 1
add dl, dl
jne 0x1406cc106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406cc113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406cc0fb
sub eax, ebx
mov ebx, 1
jne 0x1406cc14c
mov ecx, 1
add dl, dl
jne 0x1406cc12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406cc13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406cc123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406cc07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406cc168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406cc175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406cc15d
cmp eax, 0x7d00
jae 0x1406cc19b
cmp eax, 0x500
jb 0x1406cc196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406cc07e
cmp eax, 0x7f
ja 0x1406cc19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406cc07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406cc1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406cc07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400083b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rbx, rdx
mov rsi, rcx
lea rdi, [rcx + 0x28]
mov qword [rbp - 0x28], rdi
mov dword [rbp - 0x20], 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
nop
lea rcx, [rsi + 0x30]
mov rdx, rbx
call fcn.140008e3c
cmp qword [rsi + 0x40], 0
jne 0x1400084d2
mov ebx, 0x12c
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
and qword [rbp - 0x30], 0
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftDDDiagnosticsHub
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400084bc
lea rcx, [rbp - 0x18]
call fcn.14000776c
mov rcx, qword [rbp - 0x30]
mov qword [rbp - 0x18], rcx
test eax, eax
jne 0x1400084bc
and dword [rbp + 0x20], eax
mov dword [rbp + 0x30], 4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x38]
xor r8d, r8d
lea rdx, str.CollectorService.IdleShutdownInSeconds
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400084bc
cmp dword [rbp + 0x38], 4
jne 0x1400084bc
mov ebx, dword [rbp + 0x20]
test ebx, ebx
jne 0x1400084bc
lea r8, str.Service_idle_shutdown_has_been_disabled
lea rdx, str.onecorecomdiagnostics_standardcollector_basecollection_standardcollector.service_standardcollectorhost.cpp
mov rcx, qword [0x140017848]
call fcn.14000b534
jmp 0x1400084c8
lea rcx, [rsi + 0x18]
mov edx, ebx
call fcn.140005d70
nop
lea rcx, [rbp - 0x18]
call fcn.14000776c
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
xor byte [rax + 0x77a4f7f6], 0x53
movabs r11, 0x9737eac5c7538ecb
sbb byte [rsi - 0x59a6968d], dil
invalid

Function at 0x140008788
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
test r8, r8
je 0x1400087b8
movzx eax, byte [r9 + rdx]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, r8
jb 0x14000879a
mov rax, rcx
ret
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call sub.MSVCR80.dll__amsg_exit
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.1018c000
add rsp, 0x28
jmp 0x10007510
Function at 0x140002bec
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
cmp dword [0x1400dda64], 0
mov esi, r9d
movzx ebp, r8w
mov edi, edx
mov rbx, rcx
jne 0x140002c71
call fcn.140002d18
test al, al
jne 0x140002c71
mov rcx, rbx
call fcn.140002c98
test eax, eax
je 0x140002c8c
call fcn.14002c844
test al, al
je 0x140002c71
and qword [rsp + 0x40], 0
mov r9d, edi
mov rax, qword [rsp + 0x80]
movzx edx, bp
movzx r8d, word [rbx + 0x68]
mov rcx, qword [rbx + 0x60]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov word [rsp + 0x28], si
and qword [rsp + 0x20], 0
call qword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_ReportEventW]
nop dword [rax + rax]
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
xor eax, eax
jmp 0x140002c76

Function at 0x140003828
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400db348]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r9d, dword [rcx + 0x14]
lea r8, str._08x
mov rdi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x38]
lea edx, [rbx + 0x10]
call fcn.140003d10
test eax, eax
js 0x1400038d3
lea rax, [rsp + 0x30]
mov rdx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea r8, str.SoftwareMicrosoftWindows_SearchTracingEventThrottleState
mov dword [rsp + 0x20], 2
call fcn.14000a9b8
test eax, eax
jne 0x1400038d3
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 3]
mov dword [rsp + 0x28], SafeArrayPutElement
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
mov edx, 1
test eax, eax
movzx ebx, bl
cmove ebx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov al, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002a3f0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140003bbc
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400db348]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r9d, dword [rcx + 0x14]
lea r8, str._08x
mov rdi, rdx
lea rcx, [rsp + 0x38]
xor ebx, ebx
lea edx, [rbx + 0x10]
call fcn.140003d10
test eax, eax
js 0x140003c4f
lea rax, [rsp + 0x30]
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, 0xffffffff80000002
mov dword [rsp + 0x20], 2
call fcn.14000a9b8
test eax, eax
jne 0x140003c4f
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
mov edx, 1
test eax, eax
movzx ebx, bl
cmove ebx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov al, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002a3f0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x14000aa4c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x1400db348]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, qword [rsp + 0x2b8]
mov rbp, r8
mov rbx, qword [rsp + 0x2c0]
mov r8, rdx
mov r14d, r9d
mov rsi, rdx
mov rdx, 0xffffffff80000002
lea r9, [rsp + 0x40]
call fcn.14000aaf4
test al, al
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rdi
cmove rdx, rsi
mov r9d, r14d
and qword [rsp + 0x20], 0
mov r8, rbp
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14002a3f0
add rsp, 0x260
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400148fc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov rdi, r8
xor ecx, ecx
mov rsi, rdx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [rbx + 0xb0]
mov dword [rsp + 0x50], 4
test rcx, rcx
je 0x14001499a
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140014988
cmp dword [rsp + 0x68], 4
jne 0x140014988
mov eax, dword [rsp + 0x30]
mov dword [rdi], eax
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
jmp 0x140014977
mov ecx, 6
jmp 0x14001498a