joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cad0
Capabilities:
Delete registry key

Disassembly:
push rdi
mov eax, 0x1070
call fcn.140036640
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1080], rbx
mov rdi, rdx
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.140006510
nop
cmp qword [rax + 0x18], 8
jb 0x14000cb0b
mov rax, qword [rax]
mov rdx, rax
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
mov r8, qword [rsp + 0x38]
cmp r8, 8
jb 0x14000cb36
inc r8
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.140007740
mov qword [rsp + 0x38], 7
xor eax, eax
mov qword [rsp + 0x30], rax
mov word [rsp + 0x20], ax
test ebx, ebx
je 0x14000cb90
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400064c0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000cb67
mov rax, qword [rax]
mov r9d, ebx
mov r8, rax
lea rdx, str.Could_not_delete_specified_registry_subkey__s___i_.
lea rcx, [rsp + 0x50]
call fcn.140008bd0
lea rdx, [0x1400e1b88]
lea rcx, [rsp + 0x50]
call fcn.140037734
nop
mov rbx, qword [rsp + 0x1080]
add rsp, 0x1070
pop rdi
ret
Function at 0x14000cbb0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xfe0]
mov eax, 0x10e0
call fcn.140036640
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x1120], rbx
mov rax, qword [0x1400e44d0]
xor rax, rsp
mov qword [rbp + 0xfd8], rax
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x70], rdx
xor r15d, r15d
mov dword [rsp + 0x60], r15d
mov dword [rbp + 0xfb4], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
lea rax, [rbp + 0xfb4]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14000cc71
mov r8d, eax
lea rdx, str.Could_not_get_registry_value_count_while_attempting_to_get_value_names___i_.
lea rcx, [rbp - 0x70]
call fcn.140008bd0
lea rdx, [0x1400e1b88]
lea rcx, [rbp - 0x70]
call fcn.140037734
int3
mov dword [rbp + 0xfb0], 0x7fff
mov qword [rbp + 0xfc8], r15
mov qword [rbp + 0xfd0], r15
mov qword [rbp + 0xfd0], 7
mov qword [rbp + 0xfc8], r15
mov word [rbp + 0xfb8], r15w
xor r8d, r8d
mov edx, 0x7fff
lea rcx, [rbp + 0xfb8]
call fcn.140006b40
nop
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov dword [rsp + 0x60], 1
mov ecx, dword [rbp + 0xfb4]
mov edx, ecx
mov rax, qword [rbx + 0x10]
sub rax, qword [rbx]
sar rax, 5
cmp rax, rcx
jae 0x14000ccf1
mov rcx, rbx
call fcn.14000b970
mov ecx, dword [rbp + 0xfb4]
mov edi, r15d
test ecx, ecx
je 0x14000cdd7
nop dword [rax]
mov dword [rbp + 0xfb0], 0x7fff
lea r8, [rbp + 0xfb8]
cmp qword [rbp + 0xfd0], 8
cmovae r8, qword [rbp + 0xfb8]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xfb0]
mov edx, edi
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x14000cdb0
lea rsi, [rbp + 0xfb8]
cmp qword [rbp + 0xfd0], 8
cmovae rsi, qword [rbp + 0xfb8]
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 8], rax
jne 0x14000cd79
mov edx, 1
mov rcx, rbx
call fcn.14000b8e0
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x78], rcx
mov qword [rbp - 0x80], rcx
test rcx, rcx
je 0x14000cd9b
mov r8d, dword [rbp + 0xfb0]
mov rdx, rsi
call fcn.140006470
nop
add qword [rbx + 8], 0x20
inc edi
cmp edi, dword [rbp + 0xfb4]
jb 0x14000cd00
jmp 0x14000cdd7
mov r9d, eax
mov r8d, edi
lea rdx, str.Could_not_get_registry_value_name_at_index__i___i_.
lea rcx, [rbp - 0x70]
call fcn.140008bd0
lea rdx, [0x1400e1b88]
lea rcx, [rbp - 0x70]
call fcn.140037734
nop
mov r8, qword [rbp + 0xfd0]
cmp r8, 8
jb 0x14000cdfa
inc r8
mov rdx, qword [rbp + 0xfb8]
lea rcx, [rbp + 0xfb8]
call fcn.140007740
mov qword [rbp + 0xfd0], 7
mov qword [rbp + 0xfc8], r15
mov word [rbp + 0xfb8], r15w
mov rax, rbx
mov rcx, qword [rbp + 0xfd8]
xor rcx, rsp
call fcn.140035b70
mov rbx, qword [rsp + 0x1120]
add rsp, 0x10e0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001f810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov r10, r9
movzx ebx, r8b
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rsp + 0x90]
mov qword [rsp + 0x38], r14
mov r11, qword [rcx]
mov r8, qword [r11 + 8]
mov cl, 1
nop dword [rax]
cmp byte [r8 + 0x19], 0
jne 0x14001f8e7
mov r11, r8
test bl, bl
je 0x14001f89b
mov rax, qword [r8 + 0x20]
test rax, rax
je 0x14001f88b
mov r9, qword [r10]
sub r9, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x14001f884
inc rax
test ecx, ecx
jne 0x14001f871
test edx, edx
sets cl
jmp 0x14001f896
mov eax, dword [r10 + 8]
cmp dword [r8 + 0x28], eax
setb cl
xor cl, 1
jmp 0x14001f8d5
mov rax, qword [r10]
test rax, rax
je 0x14001f8ca
mov r9, qword [r8 + 0x20]
sub r9, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x14001f8c3
inc rax
test ecx, ecx
jne 0x14001f8b0
test edx, edx
sets cl
jmp 0x14001f8d5
mov eax, dword [r8 + 0x28]
cmp dword [r10 + 8], eax
setb cl
test cl, cl
je 0x14001f8de
mov r8, qword [r8]
jmp 0x14001f8e2
mov r8, qword [r8 + 0x10]
jmp 0x14001f850
mov rbx, r11
test cl, cl
je 0x14001f96c
mov rdx, qword [rdi]
cmp r11, qword [rdx]
jne 0x14001f920
mov qword [rsp + 0x28], r14
mov r9, r11
mov r8b, 1
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14001f540
mov rcx, qword [rax]
mov qword [rsi], rcx
mov byte [rsi + 8], 1
mov rax, rsi
jmp 0x14001fa0b
cmp byte [r11 + 0x19], 0
je 0x14001f92d
mov rbx, qword [r11 + 0x10]
jmp 0x14001f96c
mov rax, qword [r11]
cmp byte [rax + 0x19], 0
jne 0x14001f950
mov rbx, rax
nop dword [rax]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14001f96c
mov rbx, rax
jmp 0x14001f940
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14001f964
cmp rbx, qword [rax]
jne 0x14001f964
mov rbx, rax
jmp 0x14001f950
cmp byte [rbx + 0x19], 0
cmove rbx, rax
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x14001f99d
mov r9, qword [r10]
sub r9, rax
nop dword [rax + rax]
movzx r8d, byte [rax]
movzx edx, byte [rax + r9]
sub r8d, edx
jne 0x14001f995
inc rax
test edx, edx
jne 0x14001f980
test r8d, r8d
sets al
jmp 0x14001f9a7
mov eax, dword [r10 + 8]
cmp dword [rbx + 0x28], eax
setb al
test al, al
je 0x14001f9d3
mov qword [rsp + 0x28], r14
mov r9, r11
movzx r8d, cl
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14001f540
mov rcx, qword [rax]
mov qword [rsi], rcx
mov byte [rsi + 8], 1
mov rax, rsi
jmp 0x14001fa0b
lea rdi, [r14 + 0x20]
mov qword [rsp + 0x30], rdi
lea rcx, [rdi + 0x10]
call fcn.140015930
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001f9f9
cmp dword [rdi + 8], 1
jne 0x14001f9f9
call fcn.140047990
mov rcx, r14
call fcn.140035bd8
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1400238e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1400e44d0]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [0x1400e6006], 0
lea rsi, [0x1400e5ee0]
mov edi, edx
mov rbx, rcx
je 0x140023938
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x29]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov rcx, rsi
call fcn.140065490
cmp byte [0x1400e5ee0], 0
jne 0x140023a44
mov rcx, qword [0x1400e8130]
mov r8d, 0x104
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
mov rcx, rsi
call fcn.1400375f4
test rax, rax
je 0x140023970
mov byte [rax], 0
mov rcx, rsi
call fcn.140065490
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rcx + rsi]
mov byte [rsp + rcx + 0x30], al
lea rcx, [rcx + 1]
test al, al
jne 0x140023980
lea rcx, [rsp + 0x30]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400239a0
lea r8, str.msocxushell.dll
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400239c0
lea rcx, [rsp + 0x30]
call fcn.140065740
test eax, eax
jne 0x1400239e6
mov byte [0x1400e5ee0], al
jmp 0x1400239ef
cmp byte [0x1400e5ee0], 0
jne 0x140023a44
xor r9d, r9d
mov edx, 0x104
mov rcx, rsi
lea r8d, [r9 + 1]
call fcn.140023540
test eax, eax
je 0x140023a1c
mov edx, 0x5c
mov rcx, rsi
call fcn.1400375f4
test rax, rax
je 0x140023a1c
mov byte [rax], 0
cmp byte [0x1400e5ee0], 0
jne 0x140023a44
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x29]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov rcx, rsi
call fcn.140065490
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14003e380
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140035b70
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400259e0
Capabilities:
Get common file path
Get hostname
Get session user name
Query environment variable

Disassembly:
push rbx
sub rsp, 0x480
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400e44d0]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rbx, rcx
mov byte [rsp + 0x250], 0
call fcn.140065ce0
mov edx, 0x104
lea rcx, [rsp + 0x250]
test eax, eax
je 0x140025a2d
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
jmp 0x140025a33
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [rsp + 0x30], 0
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov rax, qword [rsp + 0x30]
test al, al
cmove rax, qword [str.Unknown]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x140], 0
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rax, qword [rsp + 0x140]
movabs rcx, 0x746c7561666544
test al, al
cmove rax, rcx
mov qword [rsp + 0x140], rax
mov rcx, rbx
call fcn.140064d40
lea r8, [rsp + 0x250]
lea rdx, str._systemroot_
mov rcx, rbx
call fcn.140064d60
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x360]
call fcn.140037fb0
mov r8d, 0x104
lea rdx, [rsp + 0x360]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rdx, [rsp + 0x360]
mov rcx, rbx
call fcn.140063d50
nop
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140035b70
add rsp, 0x480
pop rbx
ret
Function at 0x140028820
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rsi, rdx
xor eax, eax
mov dword [rsp + 0x20], eax
test rdx, rdx
je 0x1400288dc
test r8, r8
je 0x1400288dc
mov qword [rsp + 0x28], rax
lea rcx, str.secur32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400288a6
lea rdx, str.GetUserNameExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400288a6
lea r8, [rsp + 0x60]
mov rdx, rsi
mov ecx, 2
call rax
movzx edi, al
mov dword [rsp + 0x20], edi
test al, al
jne 0x1400288ba
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edi, eax
mov dword [rsp + 0x20], eax
jmp 0x1400288c5
test rbx, rbx
je 0x1400288d4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
jmp 0x1400288da
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14004cbf8
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14004ca83
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004ca83
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004ca83
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004ca83
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004ca83
cmp dword [rcx + 0x84], 0xe
jbe 0x14004ca83
cmp dword [rcx + 0xf8], 0
je 0x14004ca83
mov ecx, ebx
call fcn.14004cb24
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14004c900
cmp dword [rbp + 0x20], 0
je 0x14004cad0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14004cad8
int3
xor r8d, r8d
xor edx, edx
jmp 0x14004ca1c
Function at 0x14005c1ac
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r10, [0x1400e7770]
mov r14, rdx
mov rax, r15
sar rax, 6
mov rdx, r15
and edx, 0x3f
mov rdi, r15
shl rdx, 6
mov r9, qword [r10 + rax*8]
mov r12, qword [r9 + rdx + 0x28]
test r8, r8
je 0x14005c211
cmp byte [r14], 0xa
jne 0x14005c211
mov rcx, r15
mov rax, r15
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
or byte [rax + rcx + 0x38], 4
jmp 0x14005c232
mov dl, byte [r9 + rdx + 0x38]
mov rcx, rdi
and dl, 0xfb
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rcx + 0x38], dl
lea rbp, [r14 + r8]
mov rsi, r14
mov rbx, r14
cmp r14, rbp
jae 0x14005c38c
mov r13d, 1
mov al, byte [rsi]
cmp al, 0x1a
je 0x14005c34c
cmp al, 0xd
je 0x14005c266
mov byte [rbx], al
add rbx, r13
add rsi, r13
jmp 0x14005c341
lea rax, [rsi + 1]
cmp rax, rbp
jae 0x14005c28c
cmp byte [rax], 0xa
jne 0x14005c27e
mov byte [rbx], 0xa
mov eax, 2
jmp 0x14005c284
mov byte [rbx], 0xd
mov rax, r13
add rsi, rax
jmp 0x14005c33e
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, r13d
lea rdx, [rsp + 0x70]
mov rcx, r12
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005c334
cmp dword [rsp + 0x78], 0
je 0x14005c334
mov rcx, rdi
lea r10, [0x1400e7770]
and ecx, 0x3f
mov rax, rdi
sar rax, 6
shl rcx, 6
mov rax, qword [r10 + rax*8]
test byte [rax + rcx + 0x38], 0x48
je 0x14005c304
mov dl, byte [rsp + 0x70]
cmp dl, 0xa
je 0x14005c310
mov rcx, rdi
mov byte [rbx], 0xd
mov rax, rdi
and ecx, 0x3f
sar rax, 6
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rcx + 0x3a], dl
jmp 0x14005c33e
cmp byte [rsp + 0x70], 0xa
jne 0x14005c315
cmp rbx, r14
jne 0x14005c315
mov byte [rbx], 0xa
jmp 0x14005c33e
mov r8d, r13d
or rdx, 0xffffffffffffffff
mov ecx, r15d
call fcn.14005c1a4
cmp byte [rsp + 0x70], 0xa
lea r10, [0x1400e7770]
je 0x14005c341
jmp 0x14005c33b
lea r10, [0x1400e7770]
mov byte [rbx], 0xd
add rbx, r13
cmp rsi, rbp
jb 0x14005c24b
jmp 0x14005c38c
mov rcx, rdi
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov dl, byte [rax + rcx + 0x38]
test dl, 0x40
jne 0x14005c385
mov rax, rdi
or dl, 2
sar rax, 6
and edi, 0x3f
shl rdi, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rdi + 0x38], dl
jmp 0x14005c38c
mov cl, byte [rsi]
mov byte [rbx], cl
add rbx, r13
sub rbx, r14
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005c3ac
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r11, [0x1400e7770]
mov r9, r15
mov rax, r15
sar rax, 6
and r9d, 0x3f
shl r9, 6
mov r14, rdx
mov rdi, r15
mov r10d, 0xa
mov rdx, qword [r11 + rax*8]
mov r12, qword [rdx + r9 + 0x28]
test r8, r8
je 0x14005c418
cmp word [r14], r10w
jne 0x14005c418
mov rcx, r15
mov rax, r15
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r11 + rax*8]
or byte [rax + rcx + 0x38], 4
jmp 0x14005c439
mov dl, byte [rdx + r9 + 0x38]
mov rcx, rdi
and dl, 0xfb
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r11 + rax*8]
mov byte [rax + rcx + 0x38], dl
lea rbp, [r14 + r8*2]
mov rsi, r14
mov rbx, r14
cmp r14, rbp
jae 0x14005c612
mov ecx, 0xd
lea r13d, [rcx - 0xb]
movzx eax, word [rsi]
cmp ax, 0x1a
je 0x14005c5d0
cmp ax, cx
je 0x14005c475
mov word [rbx], ax
add rbx, r13
add rsi, r13
jmp 0x14005c569
lea rax, [rsi + 2]
cmp rax, rbp
jae 0x14005c49d
cmp word [rax], r10w
jne 0x14005c48f
mov word [rbx], r10w
mov eax, 4
jmp 0x14005c495
mov word [rbx], cx
mov rax, r13
add rsi, rax
jmp 0x14005c5b3
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov r8d, r13d
lea rdx, [rsp + 0x70]
mov rcx, r12
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005c5b8
cmp dword [rsp + 0x80], 0
je 0x14005c5b8
mov rcx, rdi
lea r11, [0x1400e7770]
and ecx, 0x3f
mov rax, rdi
sar rax, 6
mov r10d, 0xa
shl rcx, 6
mov rax, qword [r11 + rax*8]
test byte [rax + rcx + 0x38], 0x48
je 0x14005c577
movzx eax, word [rsp + 0x70]
cmp ax, r10w
jne 0x14005c50f
mov word [rbx], r10w
jmp 0x14005c561
mov r8, rdi
mov word [rsp + 0x78], ax
mov r9, rdi
and r8d, 0x3f
sar r9, 6
mov ecx, 0xd
xor edx, edx
mov word [rbx], cx
shl r8, 6
mov rcx, qword [r11 + r9*8]
mov al, byte [rsp + rdx + 0x78]
add rcx, r8
mov byte [rcx + rdx + 0x3a], al
inc rdx
cmp rdx, r13
jl 0x14005c530
mov rcx, rdi
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r11 + rax*8]
mov byte [rax + rcx + 0x3c], r10b
add rbx, r13
mov ecx, 0xd
cmp rsi, rbp
jb 0x14005c455
jmp 0x14005c612
cmp word [rsp + 0x70], r10w
jne 0x14005c584
cmp rbx, r14
je 0x14005c509
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14005c1a4
mov r10d, 0xa
lea r11, [0x1400e7770]
cmp word [rsp + 0x70], r10w
je 0x14005c564
lea ecx, [r10 + 3]
mov word [rbx], cx
add rbx, r13
jmp 0x14005c569
mov ecx, 0xd
lea r11, [0x1400e7770]
mov word [rbx], cx
add rbx, r13
lea r10d, [rcx - 3]
jmp 0x14005c569
mov rcx, rdi
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r11 + rax*8]
mov dl, byte [rax + rcx + 0x38]
test dl, 0x40
jne 0x14005c609
mov rax, rdi
or dl, r13b
sar rax, 6
and edi, 0x3f
shl rdi, 6
mov rax, qword [r11 + rax*8]
mov byte [rax + rdi + 0x38], dl
jmp 0x14005c612
movzx ecx, word [rsi]
mov word [rbx], cx
add rbx, r13
sub rbx, r14
sar rbx, 1
lea rax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005f210
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0xa0
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1400e44d0]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r15d, edx
mov r14, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
mov dword [rsp + 0x40], esi
or rdi, 0xffffffffffffffff
mov qword [r11 - 0x70], rdi
lea rcx, [0x1400e7ed0]
call fcn.1400625a0
nop
mov ebx, esi
mov dword [rsp + 0x50], ebx
nop dword [rax]
cmp ebx, 0x32
jge 0x14005f2c0
cmp rdi, 0xffffffffffffffff
jne 0x14005f2ca
test ebx, ebx
jle 0x14005f288
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r14
call fcn.14005f5a0
mov rdi, rax
mov qword [rsp + 0x48], rax
jmp 0x14005f270
cmp rdi, 0xffffffffffffffff
je 0x14005f387
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, esi
mov dword [rsp + 0x54], ebx
cmp ebx, 0xa
jae 0x14005f333
mov rdx, qword [r14 + 0x108]
mov rax, qword [rdx - 0x10]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x58]
mov r8d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14005f324
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, 1
mov dword [rsp + 0x40], esi
jmp 0x14005f333
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x14005f2dd
test r15d, r15d
je 0x14005f341
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x48], rdi
mov rdx, r14
lea rcx, [rsp + 0x78]
call fcn.140005910
nop
lea rcx, [rsp + 0x78]
call fcn.1400661f0
nop
lea rcx, [rsp + 0x78]
call fcn.140001a90
nop
jmp 0x14005f387
xor edx, edx
mov r8d, 0x104
mov rcx, r14
call fcn.140037fb0
lea rcx, [r14 + 0x108]
call fcn.140064280
lea rcx, [r14 + 0x110]
call fcn.140064280
lea rcx, [0x1400e7ed0]
call fcn.140062960
mov rbx, rax
nop
test rbx, rbx
je 0x14005f40a
mov rdx, rbx
lea rcx, [0x1400e7ed0]
call fcn.1400629c0
mov r15, rax
mov rcx, rbx
call fcn.140062950
test rax, rax
je 0x14005f405
mov rcx, rbx
call fcn.140062950
cmp r14, rax
jne 0x14005f405
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x1400e7ed0]
call fcn.140062ac0
jmp 0x14005f40a
mov rbx, r15
jmp 0x14005f3c0
mov qword [rsp + 0x68], r14
test r14, r14
je 0x14005f43b
lea rcx, [r14 + 0x110]
call fcn.140063c20
nop
lea rcx, [r14 + 0x108]
call fcn.140063c20
mov edx, 0x118
mov rcx, r14
call fcn.140035b94
nop
jmp 0x14005f446
lea rcx, [0x1400e7ed0]
call fcn.140062aa0
cmp rdi, 0xffffffffffffffff
je 0x14005f461
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140035b70
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140060640
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x450
mov rax, qword [0x1400e44d0]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor edi, edi
mov rsi, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
test rcx, rcx
je 0x140060758
test rdx, rdx
je 0x140060758
test r9, r9
je 0x140060758
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x400
call fcn.140037fb0
lea rdx, [rsp + 0x40]
sub rdx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rdx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400606b0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140060758
mov eax, dword [rsp + 0x4a8]
mov dword [rsp + 0x30], edi
sub eax, 1
je 0x140060702
sub eax, 3
je 0x14006074e
cmp eax, 3
jne 0x14006070d
mov eax, dword [rsp + 0x4a0]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x4a8]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov ecx, 1
cmove edi, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x14006075a
mov dword [rsp + 0x30], 4
jmp 0x14006070d
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140035b70
add rsp, 0x450
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret