joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008b30
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008b50
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140008b98
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140008b44
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008b85

Function at 0x140008bc0
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
lea r8, [0x14001f2c0]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140008c78
mov rdx, qword [0x14001f200]
lea rcx, [0x14001f200]
mov rax, qword [rdx + 8]
test rax, rax
je 0x140008c48
cmp rdx, rcx
jne 0x140008c2a
mov qword [rdx], rax
cmp rax, rcx
je 0x140008c2f
nop dword [rax]
test rax, rax
je 0x140008c5a
mov rdx, qword [rdx]
mov qword [rax], rdx
mov rdx, rax
mov rax, qword [rdx + 8]
cmp rax, rcx
jne 0x140008c18
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
test rax, rax
je 0x140008c5a
mov rdx, rax
jmp 0x140008c26
lea rcx, [0x14001f300]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140008c96
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
lea rcx, str.failed_to_to_lock_cleanup_mutex_n
call sym.__shmem_get_error
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
jmp 0x140008c5a
Function at 0x180002bc0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180002be8
xor eax, eax
lea r8, [0x1800022e0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x100002184
Capabilities:
Get token membership

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x100007110]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
lea rax, [rsp + 0x68]
mov r9d, ecx
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
lea r8d, [rbx + 0x20]
lea rcx, [rsp + 0x70]
mov dl, 2
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov byte [rsp + 0x70], bl
mov byte [rsp + 0x71], bl
mov byte [rsp + 0x72], bl
mov byte [rsp + 0x73], bl
mov byte [rsp + 0x74], bl
mov byte [rsp + 0x75], 5
mov dword [rsp + 0x60], ebx
call qword [entry0]
cmp eax, ebx
je 0x100002219
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r11d, dword [rsp + 0x60]
jmp 0x10000221c
mov r11d, ebx
cmp r11d, ebx
setne al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.100004df0
add rsp, 0x80
pop rbx
ret

Function at 0x1000024d8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x12e0
call fcn.100005330
sub rsp, rax
mov rax, qword [0x100007110]
xor rax, rsp
mov qword [rsp + 0x12d0], rax
mov r8, rcx
lea rcx, [rsp + 0x330]
mov edx, 0x3e8
call fcn.100002314
xor r9d, r9d
lea r11, [rsp + 0x50]
lea edx, [r9 + 0x19]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor edi, edi
cmp eax, edi
jl 0x100002605
mov rcx, qword [0x1000076d0]
lea r9d, [rdi + 0xa]
lea r8, [rsp + 0x30]
lea edx, [rdi + 3]
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, edi
jle 0x100002605
mov rcx, qword [0x1000076d0]
lea r9d, [rdi + 0x64]
lea r8, [rsp + 0x260]
lea edx, [rdi + 2]
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, edi
jle 0x100002605
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 0x104
lea r8, [rsp + 0x30]
movsxd rcx, eax
mov rdx, rbx
sub rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.100001ec8
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rsp + 0x260]
movsxd rcx, eax
sub rbx, rcx
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.100001ec8
lea r9, [rsp + 0x330]
lea r8, [0x100001520]
lea rcx, [rsp + 0xb00]
mov edx, 0x3e8
call fcn.100001f94
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xb00]
call fcn.100002240
cmp eax, edi
setge al
jmp 0x100002607
xor al, al
mov rcx, qword [rsp + 0x12d0]
xor rcx, rsp
call fcn.100004df0
mov rbx, qword [rsp + 0x12f8]
add rsp, 0x12e0
pop rdi
ret
Function at 0x100002630
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1070
call fcn.100005330
sub rsp, rax
mov rax, qword [0x100007110]
xor rax, rsp
mov qword [rsp + 0x1060], rax
mov dil, cl
lea rcx, [rsp + 0x30]
mov ebx, r8d
mov sil, dl
call fcn.10000317c
lea rcx, [rsp + 0x60]
call fcn.10000317c
lea rcx, [rsp + 0x90]
call fcn.10000317c
lea rcx, [rsp + 0x30]
call fcn.100004840
mov rbp, rax
test rax, rax
je 0x10000274a
test dil, dil
jne 0x1000026bd
mov dl, sil
mov rcx, rax
call fcn.1000044b0
test al, al
jne 0x1000026bd
call fcn.100004918
jmp 0x10000274a
mov ecx, 0x220
call fcn.100002184
test al, al
jne 0x1000026d9
mov ecx, 0x223
call fcn.100002184
test al, al
je 0x10000274a
test ebx, ebx
je 0x1000026eb
imul ebx, ebx, 0x3e8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 0x3e8
lea rcx, [rsp + 0xc0]
mov r8, rbp
mov rdx, rbx
call fcn.100002314
lea r9, [rsp + 0xc0]
lea r8, [0x100001540]
lea rcx, [rsp + 0x890]
mov rdx, rbx
call fcn.100001f94
lea r8, [rsp + 0x890]
lea rdx, [0x100001510]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0xa8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xb0]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.100004df0
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x100002cd8
Capabilities:
Create process on windows
Get common file path
Self delete

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x620
mov rax, qword [0x100007110]
xor rax, rsp
mov qword [rsp + 0x610], rax
mov bl, cl
mov edi, 0x68
lea rcx, [rsp + 0x70]
mov r8, rdi
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x70], edi
lea rcx, [rsp + 0x400]
xor edi, edi
mov edx, 0x104
mov word [rsp + 0xb0], di
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x168
lea r8, [0x1000015a0]
movsxd rcx, eax
sub rdx, rcx
lea rcx, [rsp + 0x130]
call fcn.100001ec8
cmp eax, edi
jl 0x100002e2c
lea rcx, [rsp + 0x100]
lea rdx, [0x1000015c0]
lea r8d, [rdi + 0x22]
call sub.msvcrt.dll_memcpy
mov rax, qword [0x1000015e8]
lea r11, [rsp + 0xe0]
mov qword [r11], rax
mov rax, qword [0x1000015f0]
lea rdx, [rsp + 0x100]
mov qword [r11 + 8], rax
mov rax, qword [0x1000015f8]
cmp bl, dil
mov qword [r11 + 0x10], rax
mov eax, dword [0x100001600]
lea rcx, [rsp + 0x130]
mov dword [r11 + 0x18], eax
movzx eax, word [0x100001604]
mov word [r11 + 0x1c], ax
lea rax, [rsp + 0xe0]
cmove rdx, rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, edi
je 0x100002e2c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x610]
xor rcx, rsp
call fcn.100004df0
mov rbx, qword [rsp + 0x638]
add rsp, 0x620
pop rdi
ret
Function at 0x10000323c
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x278
mov rax, qword [0x100007110]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rcx
mov ecx, r8d
mov rbp, r9
mov ebx, r8d
mov r13, rdx
xor edi, edi
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r12, rax
test rax, rax
jne 0x100003286
mov edi, 0x8007000e
jmp 0x1000033a6
mov edx, dword [rbp]
mov r9, rax
mov r8d, ebx
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x1000032ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80004005
jmp 0x10000339e
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
lea rdx, [0x100001718]
mov rcx, r12
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x1000032d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80004005
jmp 0x1000032fc
mov rdx, qword [rsp + 0x38]
mov eax, dword [rdx + 0xc]
mov ecx, dword [rdx + 8]
shl rcx, 0x20
add rcx, rax
mov qword [r13 + 8], rcx
mov ecx, dword [rdx + 0x10]
mov eax, dword [rdx + 0x14]
shl rcx, 0x20
add rcx, rax
mov qword [r13 + 0x10], rcx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [0x100001720]
mov rcx, r12
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10000339e
xor esi, esi
test dword [rsp + 0x30], 0xfffffffc
jbe 0x10000339e
xor ebp, ebp
mov rcx, qword [rsp + 0x40]
lea r8, [0x100001740]
mov edx, 0x200
movzx eax, word [rcx + rbp + 2]
movzx r9d, word [rcx + rbp]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], eax
call fcn.100003110
test eax, eax
js 0x10000338d
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov rcx, r12
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10000338d
mov rcx, qword [r13 + 0x20]
mov rbx, qword [rsp + 0x50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rbx
call fcn.1000031dc
mov qword [r13 + 0x20], rax
mov ecx, dword [rsp + 0x30]
inc esi
add rbp, 4
shr ecx, 2
cmp esi, ecx
jb 0x10000332b
mov rcx, r12
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.100004df0
add rsp, 0x278
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1000033d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x100007110]
xor rax, rsp
mov qword [rsp + 0x450], rax
and qword [rsp + 0x38], 0
mov r8, qword [rcx + 8]
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x50]
mov rsi, rdx
mov ebx, 0x200
or r9d, 0xffffffff
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r9, [rsp + 0x50]
lea r8, [0x100001768]
lea rcx, [rsp + 0x250]
mov rdx, rbx
call fcn.100003110
mov edi, eax
test eax, eax
js 0x1000034b5
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x250]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], 0x104
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebx, eax
test eax, eax
jne 0x1000034ad
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x40]
neg eax
sbb ebx, ebx
and ebx, edi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000034b3
or ebx, 0x80070000
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.100004df0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x10000356c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
lea rdx, [rsp + 0x60]
mov rsi, rcx
xor ebx, ebx
call fcn.1000034e0
cmp al, bl
je 0x10000361a
mov ecx, dword [rsp + 0x60]
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rdi, rax
cmp rax, rbx
je 0x10000361a
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x100003612
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x100003609
mov r8d, dword [rsp + 0x58]
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.100004984
mov ebx, dword [rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x100004130
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x100007110]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, qword [rcx + 0x20]
mov rdi, rcx
lea rdx, [0x100001c70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100004174
mov eax, 1
jmp 0x100004307
lea rdx, [0x100001c88]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100004302
lea rdx, [0x100001ca0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100004302
lea rdx, [0x100001cb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100004302
lea rdx, [0x100001cc0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100004274
lea rdx, [0x100001ce0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100004274
lea rdx, [0x100001d50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10000420a
mov eax, 2
jmp 0x100004307
lea rdx, [0x100001d60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10000426a
lea rdx, [0x100001d78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10000426a
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x10000424c
lea rdx, [0x100001d90]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10000426a
lea rdx, [0x100001d9c]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
neg eax
sbb eax, eax
not eax
and eax, 5
jmp 0x100004307
mov eax, 3
jmp 0x100004307
lea r8, [rsp + 0x38]
lea rdx, [0x100001d20]
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x30], 0x104
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000042fb
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000042e5
lea rdx, [0x100001d00]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x1000042fb
mov eax, 7
jmp 0x100004307
mov eax, 4
jmp 0x100004307
mov eax, 6
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.100004df0
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x100004888
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
lea rax, [rsp + 0x50]
lea rdx, [0x100001e20]
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor edi, edi
cmp eax, edi
jne 0x100004904
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x50]
lea r9d, [rdi + 1]
add eax, r9d
lea rdx, [0x100001e50]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
sete al
jmp 0x100004906
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x100004918
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x40]
lea rdx, [0x100001e20]
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor ebx, ebx
cmp eax, ebx
jne 0x100004973
mov rcx, qword [rsp + 0x40]
lea rdx, [0x100001e50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x100004966
cmp eax, 2
jne 0x100004968
mov bl, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret

Function at 0x100004984
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
or r9d, 0xffffffff
mov r10d, r8d
mov r11, rdx
mov rbx, rcx
lea rbp, [0x1000017a0]
cmp r8d, 4
jbe 0x100004a1d
lea edi, [r8 - 5]
shr edi, 2
inc edi
movzx ecx, byte [r11]
movzx eax, r9b
shr r9d, 8
xor rcx, rax
add r11, 4
add r10d, 0xfffffffc
mov edx, dword [rbp + rcx*4]
movzx ecx, byte [r11 - 3]
xor edx, r9d
movzx eax, dl
shr edx, 8
xor rcx, rax
mov r8d, dword [rbp + rcx*4]
movzx ecx, byte [r11 - 2]
xor r8d, edx
movzx eax, r8b
shr r8d, 8
xor rcx, rax
mov edx, dword [rbp + rcx*4]
movzx ecx, byte [r11 - 1]
xor edx, r8d
movzx eax, dl
shr edx, 8
xor rcx, rax
mov r9d, dword [rbp + rcx*4]
xor r9d, edx
sub rdi, 1
jne 0x1000049b6
test r10d, r10d
je 0x100004a44
movzx ecx, byte [r11]
movzx eax, r9b
inc r11
xor rcx, rax
mov eax, r9d
mov r9d, dword [rbp + rcx*4]
shr eax, 8
xor r9d, eax
add r10d, 0xffffffff
jne 0x100004a22
mov rbp, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [rbx], r9d
mov rax, rbx
mov rbx, qword [rsp + 8]
ret
Function at 0x100004df0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100007110]
jne 0x100004e0b
rol rcx, 0x10
test cx, 0xffff
jne 0x100004e07
ret 0
ror rcx, 0x10
jmp 0x1000050fc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100007200]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1000072f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100005181
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100007200]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1000051a3
mov rax, qword [rsp + 0x88]
mov qword [0x1000072f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100007298], rax
mov rax, qword [0x1000072f8]
mov qword [0x100007170], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100007280], rax
mov dword [0x100007160], 0xc0000409
mov dword [0x100007164], 1
mov rax, qword [0x100007110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100007118]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001320]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x100004f98
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100004fe5
cmp rcx, 0xffffffffffffffff
je 0x100004fe5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x100004fdd
cmp dword [rcx + 0x3c], edx
jl 0x100004fdd
cmp dword [rcx + 0x3c], 0x10000000
jae 0x100004fdd
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100004fe5
mov rax, rdx
add rsp, 0x18
ret
Function at 0x180005f00
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x280
movdqa xmmword [rsp + 0x2e0], xmm6
movdqa xmmword [rsp + 0x2f0], xmm7
movdqa xmmword [rsp + 0x300], xmm8
movdqa xmmword [rsp + 0x310], xmm9
movdqa xmmword [rsp + 0x320], xmm10
movdqa xmmword [rsp + 0x330], xmm11
movdqa xmmword [rsp + 0x340], xmm12
movdqa xmmword [rsp + 0x350], xmm13
movdqa xmmword [rsp + 0x360], xmm14
movdqa xmmword [rsp + 0x370], xmm15
mov eax, dword [0x1803b76a4]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x280]
mov qword [rdx + 8], r8
call fcn.180153570
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1803b76a4]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x180006090
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x1800060ac
cmp rcx, r8
jl 0x18000609f
mov qword [rdx + 0x80], rcx
test dword [0x1803b0818], 1
je 0x1800060db
cmp byte [rsp + 0xd0], 0
je 0x1800060db
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x180005c00
mov rsp, r8
jmp rax