joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c0a0
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x1b8]
sub rsp, 0x2a0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140034ab8]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
cmp dword [r9 + 0x10], 0xffffff2f
je 0x14000c28b
cmp dword [r9 + 0x10], 0xffffff31
je 0x14000c148
cmp dword [r9 + 0x10], 0xffffff38
jne 0x14000c286
lea rcx, [rsp + 0x30]
call fcn.140015078
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call fcn.140008234
test eax, eax
je 0x14000c12c
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rcx, rdi
call fcn.1400063b0
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
call fcn.140004e60
nop
jmp 0x14000c27c
mov r8d, 0x104
lea rdx, [rsp + 0x70]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rcx, [rsp + 0x30]
call fcn.140015078
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call fcn.140008234
lea rcx, [rsp + 0x30]
call fcn.140014a28
test eax, eax
je 0x14000c19b
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
call fcn.140017eb0
test eax, eax
je 0x14000c27c
lea rcx, [rsp + 0x70]
jmp 0x14000c1b7
lea rdx, [rsp + 0x70]
mov rcx, rax
sub rcx, rdx
cmp rcx, 1
jne 0x14000c1c8
lea rcx, [rax + 1]
mov edx, 0x3a
call fcn.140017b84
test rax, rax
jne 0x14000c1a2
jmp 0x14000c241
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
lea rcx, [rsp + 0x50]
call fcn.1400147a4
nop
mov r9d, 0x51
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
lea rcx, [rsp + 0x38]
call fcn.1400147a4
nop
lea rcx, [rsp + 0x50]
call fcn.1400145b4
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.1400145b4
mov rdx, rax
mov r9d, MsiDatabaseExportA
mov r8, rbx
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.USER32.dll_MessageBoxA]
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x38]
call fcn.140014484
nop
lea rcx, [rsp + 0x50]
call fcn.140014484
nop
jmp 0x14000c27c
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, qword [rdi + 0x30]
lea r8, [rsp + 0x70]
mov rdx, rsi
mov rcx, qword [rdi + 8]
call fcn.140009dcc
test eax, eax
je 0x14000c278
lea rdx, [rbp + 0x80]
mov rcx, qword [rdi + 8]
call fcn.140008248
jmp 0x14000c27c
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
call fcn.1400149a0
mov rax, rbx
jmp 0x14000c292
call fcn.140004e98
cdqe
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140017020
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d794
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rdi, rdx
mov rbx, rcx
mov eax, dword [r9 + 0x10]
cmp eax, 0xffffff2f
je 0x14000d87d
cmp eax, 0xffffff30
jbe 0x14000d879
cmp eax, 0xffffff32
jbe 0x14000d827
cmp eax, 0xffffff38
jne 0x14000d879
lea rcx, [rsp + 0x58]
call fcn.140015078
nop
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx + 8]
call fcn.1400088fc
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rcx, rbx
call fcn.140006b60
mov r8d, eax
mov rdx, rdi
call fcn.140004e60
nop
lea rcx, [rsp + 0x58]
call fcn.1400149a0
jmp 0x14000d879
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
test eax, eax
jne 0x14000d844
xor edx, edx
mov rcx, qword [rbx + 8]
call fcn.14000899c
jmp 0x14000d879
inc edi
mov ecx, edi
call fcn.140016f60
mov rsi, rax
test rax, rax
je 0x14000d879
mov r8d, edi
mov rdx, rax
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rdx, rsi
mov rcx, qword [rbx + 8]
call fcn.14000899c
mov rcx, rsi
call fcn.140016a28
xor eax, eax
jmp 0x14000d884
call fcn.140004e98
cdqe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14000e5a4
Capabilities:
Reference sql statements

Disassembly:
lea rdx, str.SOFTWAREEntrustWIGLSSMDomains
add rcx, 0x40
mov r8d, 1
jmp 0x140003460
test edx, edx
je 0x14000e5ad
jmp 0x140009474
lea rdx, str.SOFTWAREEntrustWIGLDomains
add rcx, 0x40
mov r8d, 1
jmp 0x140003460
Function at 0x14000fcd8
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x3e8]
sub rsp, 0x4d0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140034ab8]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea edx, [rbx + 1]
lea rcx, [rsi + 8]
call fcn.140014a38
lea r8d, [rbx + 1]
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rdx, [0x140029834]
lea rcx, [rsi + 8]
call fcn.140014b88
cmp eax, 0xffffffff
jle 0x14000fdc9
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsi + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400147a4
nop
mov r9d, 0x2e
xor r8d, r8d
mov rdx, qword [rsi + 0x10]
lea rcx, [rsp + 0x28]
call fcn.1400147a4
nop
lea rcx, [rsp + 0x40]
call fcn.1400145b4
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.1400145b4
mov rdx, rax
mov r9d, MsiDatabaseExportA
mov r8, rbx
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rsp + 0x28]
call fcn.140014484
nop
lea rcx, [rsp + 0x40]
call fcn.140014484
jmp 0x14000fe8e
lea rcx, [rsp + 0x20]
call fcn.140015078
nop
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rdi, rax
xor ebx, ebx
test eax, eax
je 0x14000fe67
xor r12d, r12d
mov byte [rbp - 0x40], 0
and dword [rsp + 0x68], 0
mov dword [rbp - 0x80], 0x400
lea rax, [rbp - 0x40]
mov qword [rsp + 0x78], rax
lea r9, [rsp + 0x60]
mov r8, r12
mov edx, 0x102d
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.USER32.dll_SendMessageA]
lea rcx, [rbp - 0x40]
call fcn.1400179f0
test rax, rax
je 0x14000fe5e
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call fcn.140014e84
cmp edi, 1
jbe 0x14000fe5e
lea eax, [rdi - 1]
cmp ebx, eax
jae 0x14000fe5e
lea rdx, [0x140029830]
lea rcx, [rsp + 0x20]
call fcn.140014e84
inc ebx
inc r12
cmp ebx, edi
jb 0x14000fdf5
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140014d8c
mov edx, 1
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_EndDialog]
nop
lea rcx, [rsp + 0x20]
call fcn.1400149a0
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.140017020
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x140011d88
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov r12, r8
mov rdi, rdx
xor ebx, ebx
lea rcx, [rbp + 0x2f]
call fcn.140010eb8
nop
test rdi, rdi
je 0x140011f42
test r12, r12
je 0x140011f42
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140011f42
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test eax, eax
je 0x140011f38
lea rcx, [rbp + 0x17]
call fcn.140010eb8
nop
mov edx, edi
lea rcx, [rbp + 0x17]
call fcn.140011048
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
mov r8d, edi
mov rdx, qword [rbp + 0x27]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140011f2f
cmp dword [rbp + 0x7f], edi
jne 0x140011f2f
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x10001
call qword [sym.imp.CRYPT32.dll_CryptMsgOpenToDecode]
mov rdi, rax
test rax, rax
je 0x140011f28
lea r9d, [rbx + 1]
mov r8d, dword [rbp + 0x1f]
mov rdx, qword [rbp + 0x27]
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CryptMsgUpdate]
test eax, eax
je 0x140011f28
mov dword [rbp + 0x6f], ebx
lea rcx, [rbp - 1]
call fcn.140010eb8
nop
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 0xc]
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CryptMsgGetParam]
test eax, eax
je 0x140011f1d
mov edx, dword [rbp + 0x6f]
lea rcx, [rbp - 1]
call fcn.140011048
lea r11, [rbp + 0x6f]
mov qword [rsp + 0x20], r11
mov r9, qword [rbp + 0xf]
xor r8d, r8d
lea edx, [rbx + 0xc]
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CryptMsgGetParam]
test eax, eax
je 0x140011f1d
mov r8d, dword [rbp + 7]
mov rdx, qword [rbp + 0xf]
mov ecx, 0x10001
call qword [sym.imp.CRYPT32.dll_CertCreateCertificateContext]
test rax, rax
je 0x140011f16
mov qword [r12], rax
mov ebx, 1
jmp 0x140011f1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
lea rcx, [rbp - 1]
call fcn.140010f3c
jmp 0x140011f2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
lea rcx, [rbp + 0x17]
call fcn.140010f3c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x2f]
call fcn.140010f3c
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x140011f68
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rsi, r8
mov rdi, rdx
xor ebx, ebx
lea rcx, [rbp + 0x2f]
call fcn.140010eb8
nop
test rdi, rdi
je 0x14001211a
test rsi, rsi
je 0x14001211a
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14001211a
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test eax, eax
je 0x140012110
lea rcx, [rbp - 0x59]
call fcn.140010eb8
nop
mov edx, edi
lea rcx, [rbp - 0x59]
call fcn.140011048
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x6f]
mov r8d, edi
mov rdx, qword [rbp - 0x49]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140012107
cmp dword [rbp + 0x6f], edi
jne 0x140012107
mov r8d, dword [rbp - 0x51]
mov rdx, qword [rbp - 0x49]
mov edi, 0x10001
mov ecx, edi
call qword [sym.imp.CRYPT32.dll_CertCreateCertificateContext]
test rax, rax
je 0x14001205c
mov qword [rsi], rax
mov ebx, 1
jmp 0x140012107
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [rbp - 0x51]
add r8d, 0xffffffe7
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x59]
call fcn.140011218
nop
mov r8d, dword [rbp - 0x39]
add r8d, 0xffffffe5
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x41]
call fcn.140011298
nop
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.14001116c
nop
lea rcx, [rbp + 0x17]
call fcn.140010f3c
lea rcx, [rbp - 9]
call fcn.140010aac
nop
mov r8, qword [rbp - 0x31]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 9]
call fcn.140010d04
mov r8d, dword [rbp - 0x21]
test r8d, r8d
je 0x1400120e9
mov rdx, qword [rbp - 0x19]
mov ecx, edi
call qword [sym.imp.CRYPT32.dll_CertCreateCertificateContext]
test rax, rax
je 0x1400120e3
mov qword [rsi], rax
mov ebx, 1
jmp 0x1400120e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp - 0x29]
call fcn.140010f3c
nop
lea rcx, [rbp - 9]
call fcn.140010ac4
nop
lea rcx, [rbp - 0x41]
call fcn.140010f3c
nop
lea rcx, [rbp - 0x59]
call fcn.140010f3c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x2f]
call fcn.140010f3c
mov eax, ebx
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret

Function at 0x140013a68
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov r8d, 1
cmp eax, 0xffffffff
je 0x140013a96
mov ecx, eax
and ecx, 0x10
test cl, cl
jne 0x140013a96
bt eax, 0xc
jb 0x140013a96
mov ecx, r8d
jmp 0x140013a98
xor ecx, ecx
test rbx, rbx
je 0x140013aae
test ecx, ecx
je 0x140013aa8
and eax, r8d
test al, al
jne 0x140013aab
xor r8d, r8d
mov dword [rbx], r8d
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x140013ab8
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, rdx
mov r13, rcx
call fcn.1400179f0
mov rsi, rax
test eax, eax
jne 0x140013aec
mov eax, 1
jmp 0x140013b96
inc eax
mov edi, MsiDatabaseExportA
movsxd rcx, eax
call fcn.140016f60
lea ebx, [rdi - 0xf]
mov rbp, rax
test rax, rax
je 0x140013b6b
mov rdx, r13
mov rcx, rax
call fcn.140018500
movsxd rdx, esi
mov rcx, rbp
add rdx, rbp
call fcn.1400180f4
mov rcx, rbp
mov rdx, rax
mov r13, rax
call fcn.1400180f4
test r13, r13
je 0x140013b4f
test rax, rax
je 0x140013b4f
cmp byte [r13], 0x5c
jne 0x140013b4f
cmp byte [rax], 0x3a
je 0x140013b4f
cmp byte [rax], 0x5c
je 0x140013b4f
mov byte [r13], 0
sub esi, ebx
test esi, esi
jle 0x140013b5e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, eax
mov rcx, rbp
call fcn.140016a28
cmp edi, 0xffffffff
je 0x140013b7e
mov ecx, edi
and ecx, 0x10
test cl, cl
je 0x140013b7e
bt edi, 0xc
jb 0x140013b7e
mov eax, ebx
jmp 0x140013b80
xor eax, eax
test r12, r12
je 0x140013b96
test eax, eax
je 0x140013b90
and edi, ebx
test dil, dil
jne 0x140013b92
xor ebx, ebx
mov dword [r12], ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x140013f68
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140034ab8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
movzx ecx, dx
mov rdi, r8
lea rdx, [rbp - 0x10]
mov r8d, 0xa
call fcn.1400175f8
mov rcx, qword [rbx + 0x48]
lea r11, [rbp - 0x18]
lea rdx, [rbp - 0x10]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140014031
and dword [rbp - 0x20], eax
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x1c]
lea rdx, str.Path
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140014027
cmp dword [rbp - 0x1c], 1
jne 0x140014027
mov edx, dword [rbp - 0x20]
mov rcx, rdi
inc edx
call fcn.140014a38
mov rax, qword [rdi]
mov rcx, qword [rbp - 0x18]
lea r11, [rbp - 0x20]
lea r9, [rbp - 0x1c]
lea rdx, str.Path
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140017020
add rsp, 0x50
pop rdi
pop rbx
pop rbp
ret
Function at 0x140014048
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x40
mov r9d, 4
mov rbx, rcx
movzx ecx, dx
lea edx, [r9 - 1]
lea r8, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea rcx, [rsp + 0x60]
call fcn.1400191b4
mov rdx, qword [rbx + 0x40]
and qword [rsp + 0x50], 0
lea rax, [rsp + 0x58]
lea r11, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
lea rax, [rsp + 0x50]
xor r8d, r8d
mov ecx, 0x2500
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], r11d
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
mov rax, qword [rsp + 0x50]
jne 0x1400140cd
test rax, rax
je 0x1400140cd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
ret

Function at 0x14001414c
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x140034ab8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rcx, qword [rcx + 0x48]
lea r8, [rsp + 0x20]
mov r9d, 0x104
xor edx, edx
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x140014191
lea rcx, [rsp + 0x20]
call fcn.140017e8c
movzx ebx, ax
movzx eax, bx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140017020
add rsp, 0x140
pop rbx
ret

Function at 0x140016130
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140034ab8]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x38]
mov rdi, rcx
lea rdx, str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x14001623c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov esi, 0x104
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x14001622d
cmp dword [rsp + 0x30], 2
mov byte [rsp + 0x143], bl
jne 0x1400161f1
lea rcx, [rsp + 0x40]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
cmp eax, 0x103
setbe bl
jmp 0x14001622d
lea rdx, [rsp + 0x40]
mov ecx, ebx
sub rdx, rdi
lea rax, [rsi + 0x7ffffefa]
cmp rax, rbx
je 0x140016219
mov al, byte [rdx + rdi]
cmp al, bl
je 0x140016219
mov byte [rdi], al
inc rdi
sub rsi, 1
jne 0x1400161fb
cmp rsi, rbx
jne 0x140016226
dec rdi
mov ecx, 0x8007007a
cmp ecx, ebx
mov byte [rdi], bl
setge bl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14001623e
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140017020
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400179f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x140017a0d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140017a68
test al, 7
jne 0x140017a00
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140017a21
mov rdx, qword [rax - 8]
test dl, dl
je 0x140017a92
test dh, dh
je 0x140017a8c
shr rdx, 0x10
test dl, dl
je 0x140017a86
test dh, dh
je 0x140017a80
shr rdx, 0x10
test dl, dl
je 0x140017a7a
test dh, dh
je 0x140017a74
shr edx, 0x10
test dl, dl
je 0x140017a6e
test dh, dh
jne 0x140017a21
lea rax, [rcx + rax - 1]
ret
lea rax, [rcx + rax - 2]
ret
lea rax, [rcx + rax - 3]
ret
lea rax, [rcx + rax - 4]
ret
lea rax, [rcx + rax - 5]
ret
lea rax, [rcx + rax - 6]
ret
lea rax, [rcx + rax - 7]
ret
lea rax, [rcx + rax - 8]
ret

Function at 0x14001c203
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140034ab8]
jne 0x14001703a
rol rcx, 0x10
test cx, 0xffff
jne 0x140017036
repz ret
ror rcx, 0x10
jmp 0x14001c15c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140036510]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140036608]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001c1e1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140036510]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001c203
mov rax, qword [rsp + 0x88]
mov qword [0x140036608], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400365a8], rax
mov rax, qword [0x140036608]
mov qword [0x140036480], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140036590], rax
mov dword [0x140036470], 0xc0000409
mov dword [0x140036474], 1
mov rax, qword [0x140034ab8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140034ac0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140036508], eax
mov ecx, 1
call fcn.1400207e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14002a880]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140036508], 0
jne 0x14001c28a
mov ecx, 1
call fcn.1400207e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400213fc
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140034ab8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140019788
xor ebx, ebx
cmp qword [0x140037470], rbx
mov rdi, rax
jne 0x14002150f
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400215e6
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400215e6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140037470], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140037478], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140037480], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140037490], rax
test rax, rax
je 0x140021506
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140037488], rax
jmp 0x140021516
mov rax, qword [0x140037488]
jmp 0x14002151d
mov rax, qword [0x140037488]
mov r11, qword [0x140037490]
cmp rax, rdi
je 0x140021584
cmp r11, rdi
je 0x140021584
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140037490]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140021584
test rax, rax
je 0x140021584
call rsi
test rax, rax
je 0x14002157e
lea rcx, [rsp + 0x30]
mov r9d, MsiDatabaseExportA
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14002157e
test byte [rsp + 0x40], 1
jne 0x140021584
bts ebp, 0x15
jmp 0x1400215c4
mov rcx, qword [0x140037478]
cmp rcx, rdi
je 0x1400215c4
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400215c4
call rax
mov rbx, rax
test rax, rax
je 0x1400215c4
mov rcx, qword [0x140037480]
cmp rcx, rdi
je 0x1400215c4
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400215c4
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140037470]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400215e6
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400215e8
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140017020
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret