joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a350
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x4e0
mov qword [rsp + 0x4c8], 0xfffffffffffffffe
mov rax, qword [0x140021220]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
call fcn.140007780
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x78]
call fcn.1400084b0
nop
mov rdx, qword [rsp + 0x4f0]
lea rcx, [rsp + 0x50]
call fcn.14000a730
lea rcx, [rsp + 0x90]
call fcn.14000dc30
nop
mov edx, 0x400
mov rcx, qword [rsp + 0x4f8]
call fcn.140008e50
mov qword [rsp + 0x38], rax
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x14000a406
call fcn.140006280
mov dword [rsp + 0x4b0], eax
jmp 0x14000a5b1
mov r8, qword [rsp + 0x508]
mov rdx, qword [rsp + 0x500]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x4a8], rax
cmp qword [rsp + 0x4a8], 0
jne 0x14000a445
call fcn.140006280
mov dword [rsp + 0x4b0], eax
jmp 0x14000a5b1
mov rdx, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x4b8], rax
cmp qword [rsp + 0x4b8], 0
jne 0x14000a47c
call fcn.140006280
mov dword [rsp + 0x4b0], eax
jmp 0x14000a5b1
mov rdx, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x4b8]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x60]
add eax, 1
cmp eax, dword [rsp + 0x60]
jae 0x14000a4dc
mov dword [rsp + 0x4c0], 0x8007000e
lea rcx, [rsp + 0x90]
call fcn.14000dc50
nop
lea rcx, [rsp + 0x78]
call fcn.1400084d0
mov eax, dword [rsp + 0x4c0]
jmp 0x14000a5f1
mov eax, dword [rsp + 0x60]
add eax, 1
mov edx, eax
lea rcx, [rsp + 0x90]
call fcn.14000dc90
nop
lea rcx, [rsp + 0x90]
call fcn.14000dc80
test rax, rax
jne 0x14000a515
mov dword [rsp + 0x4b0], 0x8007000e
jmp 0x14000a5b1
lea rcx, [rsp + 0x90]
call fcn.14000dc80
mov rbx, rax
call fcn.140007780
mov ecx, eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, dword [rsp + 0x60]
mov r8, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x4a0], eax
cmp dword [rsp + 0x4a0], 0
jne 0x14000a56a
call fcn.140006280
mov dword [rsp + 0x4b0], eax
jmp 0x14000a5b1
mov ebx, dword [rsp + 0x4a0]
lea rcx, [rsp + 0x90]
call fcn.14000dc80
mov r11, rax
xor eax, eax
mov word [r11 + rbx*2], ax
lea rcx, [rsp + 0x90]
call fcn.14000dc80
mov r8d, dword [rsp + 0x510]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000a760
mov dword [rsp + 0x4b0], eax
cmp qword [rsp + 0x48], 0
je 0x14000a5c4
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x4b0]
mov dword [rsp + 0x4c4], eax
lea rcx, [rsp + 0x90]
call fcn.14000dc50
nop
lea rcx, [rsp + 0x78]
call fcn.1400084d0
mov eax, dword [rsp + 0x4c4]
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.140015270
add rsp, 0x4e0
pop rbx
ret
Function at 0x14000c440
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov rax, qword [0x140021220]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rcx, [rsp + 0x50]
call fcn.140006970
mov r11, qword [rsp + 0x2a0]
mov r9d, dword [r11 + 8]
or r9d, 0x2001f
mov r8, qword [rsp + 0x2a8]
mov rdx, qword [rsp + 0x2a0]
mov rdx, qword [rdx]
lea rcx, [rsp + 0x50]
call fcn.140006a20
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x14000c4c9
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x270], eax
lea rcx, [rsp + 0x50]
call fcn.1400069a0
mov eax, dword [rsp + 0x270]
jmp 0x14000c58d
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000c556
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000c440
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x14000c549
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x274], eax
lea rcx, [rsp + 0x50]
call fcn.1400069a0
mov eax, dword [rsp + 0x274]
jmp 0x14000c58d
mov dword [rsp + 0x40], 0x100
jmp 0x14000c4d1
lea rcx, [rsp + 0x50]
call fcn.1400069d0
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2a0]
call fcn.140007920
mov dword [rsp + 0x278], eax
lea rcx, [rsp + 0x50]
call fcn.1400069a0
mov eax, dword [rsp + 0x278]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140015270
add rsp, 0x298
ret
Function at 0x14000cb50
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
test eax, eax
jne 0x14000cb63
xor eax, eax
test eax, eax
jne 0x14000cb63
cmp qword [rsp + 0x70], 0
je 0x14000cb81
mov dword [rsp + 0x48], 1
jmp 0x14000cb89
mov dword [rsp + 0x48], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14000cba2
mov eax, 0xd
jmp 0x14000cc23
xor eax, eax
test eax, eax
jne 0x14000cb6f
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [rsp + 0x40], eax
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
lea rax, [rax + rcx*2]
mov qword [rsp + 0x38], rax
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x30]
lea rax, [rax + rcx*2]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x40], 1
jne 0x14000cbba
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x58
ret

Function at 0x14000e2f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov rax, qword [0x140021220]
xor rax, rsp
mov qword [rsp + 0xb8], rax
cmp dword [0x1400234c8], 0
je 0x14000e328
lea rax, str.GlobalS7LOG_MUTEX
mov qword [rsp + 0xb0], rax
jmp 0x14000e337
lea rax, str.S7LOG_MUTEX
mov qword [rsp + 0xb0], rax
mov r8, qword [rsp + 0xb0]
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x1400234c0], rax
cmp qword [0x1400234c0], 0
je 0x14000e369
mov eax, 1
jmp 0x14000e396
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.ERROR:_Cant_create_S7LOG_MUTEX__GetLastError___d__n
mov edx, 0x80
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCR90.dll_sprintf_s]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140015270
add rsp, 0xc8
ret
Function at 0x14000ee20
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x58]
mov byte [rax], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [0x1400234b0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000ee7f
mov dword [rsp + 0x30], 0
jmp 0x14000eea9
cmp dword [rsp + 0x38], 0
jne 0x14000ee90
mov dword [rsp + 0x30], 0
jmp 0x14000eea9
cmp dword [rsp + 0x34], 1
je 0x14000eea1
mov dword [rsp + 0x30], 0
jmp 0x14000eea9
mov dword [rsp + 0x30], 1
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1400105f0
Capabilities:
Delete file
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov eax, dword [0x140021868]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x14001062c
cmp dword [rsp + 0x48], 4
je 0x140010690
cmp dword [rsp + 0x48], 5
je 0x14001062c
cmp dword [rsp + 0x48], 6
je 0x1400107ee
jmp 0x14001081a
movsxd rcx, dword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov byte [rax + rcx], 0
mov dword [rsp + 0x44], 0
mov r9d, dword [rsp + 0x60]
add r9d, 1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r8, qword [rsp + 0x68]
mov edx, 2
mov rcx, qword [0x1400234a8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x14001081a
cmp dword [0x1400234a4], 1
jne 0x1400107ec
movsxd rcx, dword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov byte [rax + rcx], 0xa
mov eax, dword [rsp + 0x60]
add eax, 1
movsxd rdx, eax
mov r9, qword [0x1400224f0]
mov r8d, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.MSVCR90.dll_fwrite]
mov r8d, 2
xor edx, edx
mov rcx, qword [0x1400224f0]
call qword [sym.imp.MSVCR90.dll_fseek]
mov rcx, qword [0x1400224f0]
call qword [sym.imp.MSVCR90.dll_ftell]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jl 0x1400107ec
mov eax, dword [0x1400203b8]
cmp dword [rsp + 0x40], eax
jle 0x1400107df
mov rcx, qword [0x1400224f0]
call qword [sym.imp.MSVCR90.dll_fclose]
mov eax, 3
sub eax, dword [0x1400203bc]
mov dword [0x1400203bc], eax
mov eax, dword [0x1400203bc]
mov dword [rsp + 0x20], eax
lea r9, str.C:TMPS7LOG
lea r8, str._s_d.LOG
mov edx, 0x100
lea rcx, [0x140022910]
call qword [sym.imp.MSVCR90.dll_sprintf_s]
lea r8, [0x14002091c]
lea rdx, [0x140022910]
lea rcx, [0x1400224f0]
call qword [sym.imp.MSVCR90.dll_fopen_s]
test eax, eax
je 0x140010777
jmp 0x1400107dd
mov r8d, 2
xor edx, edx
mov rcx, qword [0x1400224f0]
call qword [sym.imp.MSVCR90.dll_fseek]
mov rcx, qword [0x1400224f0]
call qword [sym.imp.MSVCR90.dll_ftell]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jl 0x1400107dd
mov eax, dword [0x1400203b8]
cmp dword [rsp + 0x40], eax
jle 0x1400107d0
mov rcx, qword [0x1400224f0]
call qword [sym.imp.MSVCR90.dll_fclose]
lea rcx, [0x140022910]
call qword [sym.imp.MSVCR90.dll_remove]
mov dword [rsp + 0x40], eax
jmp 0x1400107dd
mov rcx, qword [0x1400224f0]
call qword [sym.imp.MSVCR90.dll_fclose]
jmp 0x1400107ec
mov rcx, qword [0x1400224f0]
call qword [sym.imp.MSVCR90.dll_fclose]
jmp 0x14001081a
movsxd rcx, dword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov byte [rax + rcx], 0xa
mov eax, dword [rsp + 0x60]
add eax, 1
movsxd rcx, eax
mov rax, qword [rsp + 0x68]
mov byte [rax + rcx], 0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x58
ret
Function at 0x140010900
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x40]
movsx eax, byte [rax]
test eax, eax
jne 0x140010950
mov edx, 0x64
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll__getcwd]
lea r8, str.Data_
mov edx, 0x64
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll_strcat_s]
jmp 0x140010983
mov rcx, qword [rsp + 0x40]
call sub.MSVCR90.dll_strlen
mov r11, rax
mov rax, qword [rsp + 0x40]
movsx eax, byte [rax + r11]
cmp eax, 0x5c
je 0x140010983
lea r8, [0x140020928]
mov edx, 0x64
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll_strcat_s]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll__mkdir]
mov r11, qword [rsp + 0x48]
movsx eax, byte [r11]
test eax, eax
jne 0x1400109b4
lea r8, str.S7log
mov edx, 0x64
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
jmp 0x140010a00
mov dword [rsp + 0x24], 0
jmp 0x1400109c9
mov eax, dword [rsp + 0x24]
add eax, 1
mov dword [rsp + 0x24], eax
movsxd rcx, dword [rsp + 0x24]
mov rax, qword [rsp + 0x48]
movsx eax, byte [rax + rcx]
test eax, eax
je 0x140010a00
movsxd rcx, dword [rsp + 0x24]
mov rax, qword [rsp + 0x48]
movsx eax, byte [rax + rcx]
cmp eax, 0x2e
jne 0x1400109fe
movsxd rcx, dword [rsp + 0x24]
mov rax, qword [rsp + 0x48]
mov byte [rax + rcx], 0
jmp 0x140010a00
jmp 0x1400109be
mov r8, qword [rsp + 0x48]
mov edx, 0x64
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll_strcat_s]
mov r8, qword [rsp + 0x40]
mov edx, 0x64
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
add rsp, 0x38
ret

Function at 0x140010a30
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov rax, qword [0x140021220]
xor rax, rsp
mov qword [rsp + 0xb8], rax
cmp dword [0x140020b68], 0
je 0x140010a68
lea rax, str.GlobalS7TRACE_MUTEX
mov qword [rsp + 0xb0], rax
jmp 0x140010a77
lea rax, str.S7TRACE_MUTEX
mov qword [rsp + 0xb0], rax
mov r8, qword [rsp + 0xb0]
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x140025290], rax
cmp qword [0x140025290], 0
je 0x140010aa9
mov eax, 1
jmp 0x140010ad6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.ERROR:_Cant_create_S7TRC_MUTEX__GetLastError___d__n
mov edx, 0x80
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCR90.dll_sprintf_s]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140015270
add rsp, 0xc8
ret
Function at 0x140010ec0
Capabilities:
Print debug messages
Read file via mapping

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov rax, qword [0x140021220]
xor rax, rsp
mov qword [rsp + 0xd0], rax
cmp dword [0x140020b68], 0
je 0x140010ef8
lea rax, str.GlobalS7TRACE_SECTION
mov qword [rsp + 0xc8], rax
jmp 0x140010f07
lea rax, str.S7TRACE_SECTION
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 4
mov rdx, qword [rsp + 0xf0]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [0x140025288], rax
cmp qword [0x140025288], 0
je 0x140010f95
mov qword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov rcx, qword [0x140025288]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
je 0x140010f95
mov rax, qword [rsp + 0xc0]
mov qword [0x140020948], rax
mov eax, 1
jmp 0x140010fc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.ERROR:_Cant_create_S7TRC_SECTION__GetLastError___d__n
mov edx, 0x80
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll_sprintf_s]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x140010fc9
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140015270
add rsp, 0xe8
ret

Function at 0x1400110d0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x20], r9
mov word [rsp + 0x18], r8w
mov dword [rsp + 0x10], edx
mov word [rsp + 8], cx
sub rsp, 0x3a8
mov rax, qword [0x140021220]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov r8d, 0x100
xor edx, edx
lea rcx, [rsp + 0x180]
call sub.MSVCR90.dll_memset
mov r8d, 0x100
xor edx, edx
lea rcx, [rsp + 0x290]
call sub.MSVCR90.dll_memset
mov r8d, 0x100
xor edx, edx
lea rcx, [rsp + 0x60]
call sub.MSVCR90.dll_memset
lea r11, [rsp + 0x180]
mov qword [rsp + 0x160], r11
lea rax, [rsp + 0x290]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x170], rax
cmp qword [rsp + 0x3c8], 0
je 0x14001118c
mov r8, qword [rsp + 0x3c8]
mov edx, 0x100
lea rcx, [rsp + 0x180]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
cmp qword [rsp + 0x3d0], 0
je 0x1400111b2
mov r8, qword [rsp + 0x3d0]
mov edx, 0x100
lea rcx, [rsp + 0x290]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
cmp qword [rsp + 0x3d8], 0
je 0x1400111d5
mov r8, qword [rsp + 0x3d8]
mov edx, 0x100
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
lea rdx, str.S7otrc.c
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x160]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
movzx eax, word [rsp + 0x3c0]
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x3b8]
mov r8w, 1
movzx edx, word [rsp + 0x3b0]
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov dword [rsp + 0x280], eax
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.140015270
add rsp, 0x3a8
ret
Function at 0x1400113d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x58]
mov byte [rax], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [0x140025278]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14001142f
mov dword [rsp + 0x30], 0
jmp 0x140011459
cmp dword [rsp + 0x38], 0
jne 0x140011440
mov dword [rsp + 0x30], 0
jmp 0x140011459
cmp dword [rsp + 0x34], 1
je 0x140011451
mov dword [rsp + 0x30], 0
jmp 0x140011459
mov dword [rsp + 0x30], 1
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1400143c0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400143ed
xor al, al
add rsp, 0x28
ret
lea rcx, str.ntdll.dll
mov qword [0x140025ad8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUnmapViewOfSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400143e6
lea rcx, str.ntdll.dll
mov qword [0x140025ac0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtOpenSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400143e6
lea rcx, str.ntdll.dll
mov qword [0x140025ab8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtMapViewOfSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400143e6
lea rcx, str.ntdll.dll
mov qword [0x140025ae0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RtlNtStatusToDosError
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400143e6
mov qword [0x140025ab0], rax
mov al, 1
add rsp, 0x28
ret
Function at 0x1409153c8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14091554f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409153f9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409153df
add dl, dl
jne 0x140915406
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140915466
xor eax, eax
add dl, dl
jne 0x140915415
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14091551d
add dl, dl
jne 0x140915426
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140915433
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140915440
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14091544d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14091545a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409153ee
mov eax, 1
add dl, dl
jne 0x140915476
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140915483
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14091546b
sub eax, ebx
mov ebx, 1
jne 0x1409154bc
mov ecx, 1
add dl, dl
jne 0x14091549e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409154ab
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140915493
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409153ee
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409154d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409154e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409154cd
cmp eax, 0x7d00
jae 0x14091550b
cmp eax, 0x500
jb 0x140915506
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409153ee
cmp eax, 0x7f
ja 0x14091550e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409153ee
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140915542
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409153ee
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140013190
Capabilities:
Encode data using xor
Get file size
Hash data with crc32
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor edi, edi
mov edx, 0x80000000
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14001330f
mov rsi, rax
xor edi, edi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x1400132fe
mov ebp, eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor edi, edi
mov rcx, rsi
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
je 0x1400132fe
mov r14, rax
mov qword [rsp + 0x20], 0
xor edi, edi
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x140013343
test ebp, ebp
je 0x140013317
mov ecx, ebp
mov edi, 0xffffffff
xor edx, edx
movdqa xmm0, xmmword [0x14002bc30]
movdqa xmm1, xmmword [0x14002bc40]
nop word [rax + rax]
movzx ebp, byte [rax + rdx]
xor ebp, edi
mov edi, ebp
and edi, 1
neg edi
mov ebx, ebp
shr ebx, 1
and edi, 0xedb88320
xor edi, ebx
mov ebx, edi
shr ebx, 1
movd xmm2, ebp
shl ebp, 0x1e
sar ebp, 0x1f
and ebp, 0xedb88320
xor ebp, ebx
mov ebx, ebp
shr ebx, 6
pshufd xmm2, xmm2, 0
pand xmm2, xmm0
pcmpeqd xmm2, xmm0
pand xmm2, xmm1
shl edi, 0x1a
sar edi, 0x1f
and edi, 0x76dc4190
xor edi, ebx
shl ebp, 0x1a
sar ebp, 0x1f
and ebp, 0xedb88320
xor ebp, edi
pshufd xmm3, xmm2, 0xee
pxor xmm3, xmm2
pshufd xmm2, xmm3, 0x55
pxor xmm2, xmm3
movd edi, xmm2
xor edi, ebp
inc rdx
cmp rcx, rdx
jne 0x140013270
cmp edi, 0xffffffff
je 0x140013317
not edi
jmp 0x14001331c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140013336
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140013336
mov edi, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call rbx
mov rcx, rsi
call rbx
mov eax, edi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call rbp
mov rcx, rsi
call rbp
jmp 0x140013336