joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009b94
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
xor edx, edx
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [rbx + 0x40]
mov edx, eax
mov edi, eax
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
cmp rax, rbx
je 0x140009bf4
cmp edi, ebx
jbe 0x140009beb
mov rdx, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r11d, eax
lea eax, [rdi - 1]
cmp r11d, eax
jne 0x140009beb
mov ebx, 1
jmp 0x140009bf4
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140009ce8
Capabilities:
Encode data using base64 via winapi
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor ebx, ebx
xor r9d, r9d
mov r12d, r8d
mov r13, rdx
mov rdi, rcx
mov ebp, ebx
mov dword [rax + 0x20], ebx
cmp dword [0x140140238], ebx
je 0x140009dc9
lea rax, [rax + 0x20]
lea r8d, [rbx + 1]
mov edx, r12d
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
cmp eax, ebx
je 0x140009e2e
mov edx, dword [rsp + 0x78]
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
cmp rax, rbx
je 0x140009e2e
lea rax, [rsp + 0x78]
lea r8d, [rbx + 1]
mov r9, rsi
mov edx, r12d
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov ebp, eax
cmp eax, ebx
je 0x140009dbe
lea rcx, str._n_nBase64_of_file_:__s_n_n
mov rdx, rdi
call fcn.14000c030
cmp dword [rsp + 0x78], ebx
jbe 0x140009db2
mov rdi, rsi
movzx edx, word [rdi]
lea rcx, [0x1400ea930]
call fcn.14000c030
inc ebx
add rdi, 2
cmp ebx, dword [rsp + 0x78]
jb 0x140009d97
lea rcx, str._n
call fcn.14000c030
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140009e2e
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, rbx
je 0x140009e2e
cmp rax, 0xffffffffffffffff
je 0x140009e2e
lea r9, [rsp + 0x78]
mov r8d, r12d
mov rdx, r13
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
je 0x140009e25
cmp r12d, dword [rsp + 0x78]
jne 0x140009e25
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov eax, ebp
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x140009e4c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rsi, r8
mov rbp, rdx
cmp dword [0x14014023c], ebx
je 0x140009e98
call fcn.1400136d4
mov ebx, eax
test eax, eax
jne 0x140009f3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.PA7LB_kull_m_file_readGeneric___kull_m_string_quick_base64_to_Binary__0x_08x__n
mov edx, eax
call fcn.14000c030
jmp 0x140009f3d
and qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r9d
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
je 0x140009f3d
cmp rax, 0xffffffffffffffff
je 0x140009f3d
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140009f34
cmp dword [rsp + 0x4c], ebx
jne 0x140009f34
mov rax, qword [rsp + 0x48]
mov ecx, 0x40
mov edx, eax
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp], rax
test rax, rax
je 0x140009f34
mov r8d, dword [rsi]
and qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140009f2a
mov eax, dword [rsp + 0x40]
cmp dword [rsi], eax
jne 0x140009f2a
mov ebx, 1
jmp 0x140009f34
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14000b418
Capabilities:
Get domain controller name

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
or edx, 0x40020000
lea rax, [r11 + 0x20]
mov rsi, r8
mov qword [r11 - 0x10], rax
mov dword [rsp + 0x20], edx
mov rdx, rcx
xor ebx, ebx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov qword [r11 + 0x20], rbx
call qword [sym.imp.NETAPI32.dll_DsGetDcNameW]
cmp eax, ebx
jne 0x14000b4b0
mov rax, qword [rsp + 0x58]
or rcx, 0xffffffffffffffff
mov rdi, qword [rax]
xor eax, eax
add rdi, 4
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
lea ecx, [rbx + 0x40]
mov edx, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
mov qword [rsi], rax
cmp rax, rbx
je 0x14000b4a4
mov rax, qword [rsp + 0x58]
mov r8, rdi
mov ebx, 1
mov rdx, qword [rax]
add rdx, 4
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x58]
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x14000b4be
lea rcx, str.PA7LB_kull_m_net_getDC___DsGetDcName:__u_n
mov edx, eax
call fcn.14000c030
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000b4d0
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
neg ecx
mov rdi, rdx
sbb esi, esi
and dword [rax + 8], ebx
lea r8, [rax + 8]
and esi, 3
xor edx, edx
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x14000b55d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x14000b55d
mov edx, dword [rsp + 0x30]
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x14000b571
lea r8, [rsp + 0x30]
lea ecx, [rsi + 4]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ebx, eax
test eax, eax
jne 0x14000b571
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.PA7LB_kull_m_net_getComputerName___GetComputerNameEx_data___0x_08x__n
mov edx, eax
call fcn.14000c030
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000b571
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.PA7LB_kull_m_net_getComputerName___GetComputerNameEx_init___0x_08x__n
mov edx, eax
call fcn.14000c030
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b6d8
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [rcx + 8]
lea rax, [0x140140240]
mov rdi, rdx
mov qword [r11 - 0x28], rbx
mov qword [r11 - 0x20], rax
mov edx, dword [rcx]
mov rbp, r8
cmp edx, ebx
je 0x14000b825
sub edx, 1
je 0x14000b7ae
sub edx, 2
je 0x14000b77f
cmp edx, 3
jne 0x14000b8ff
mov rax, qword [rdi + 8]
cmp dword [rax], ebx
jne 0x14000b7d3
cmp qword [rsi], rbx
je 0x14000b757
mov rcx, qword [rcx + 8]
mov edx, dword [rsi]
xor r9d, r9d
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, ebx
je 0x14000b8ff
mov rax, qword [rsi + 8]
mov rdx, qword [rdi]
lea r9, [rsp + 0x70]
mov rcx, qword [rax + 8]
mov r8d, ebp
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
jmp 0x14000b8ff
mov rax, qword [rdi + 8]
cmp dword [rax], ebx
jne 0x14000b7d3
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x30], ebx
mov r9d, r8d
mov qword [rsp + 0x28], rbx
mov edx, 0x22c187
mov r8, qword [rdi]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rsi
call fcn.14000a448
jmp 0x14000b778
mov rax, qword [rdi + 8]
cmp dword [rax], ebx
jne 0x14000b7d3
mov rcx, qword [rcx + 8]
mov rdx, qword [rsi]
mov r9, r8
mov r8, qword [rdi]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x14000b778
mov rdx, r8
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x40], rax
cmp rax, rbx
je 0x14000b8ff
lea rcx, [rsp + 0x40]
mov r8, rbp
mov rdx, rdi
call fcn.14000b6d8
cmp eax, ebx
je 0x14000b815
lea rdx, [rsp + 0x40]
mov r8, rbp
mov rcx, rsi
call fcn.14000b6d8
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000b8ff
mov rdx, qword [rdi + 8]
mov ecx, dword [rdx]
cmp ecx, ebx
je 0x14000b8ef
sub ecx, 1
je 0x14000b8cf
sub ecx, 1
je 0x14000b8b5
sub ecx, 1
je 0x14000b893
cmp ecx, 3
jne 0x14000b8ff
mov rcx, qword [rdx + 8]
mov edx, dword [rdi]
xor r9d, r9d
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14000b8ff
mov rax, qword [rdi + 8]
mov rdx, qword [rsi]
lea r9, [rsp + 0x70]
mov rcx, qword [rax + 8]
mov r8d, ebp
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x14000b778
mov rcx, qword [rdx + 8]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov edx, 0x22c183
jmp 0x14000b79c
mov rcx, qword [rdx + 8]
mov rdx, qword [rsi]
mov r9, r8
mov rcx, qword [rcx]
mov r8, qword [rdi]
call fcn.14000be2c
jmp 0x14000b778
mov rcx, qword [rdx + 8]
mov rdx, qword [rdi]
mov r9, r8
mov r8, qword [rsi]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x14000b778
mov rdx, qword [rdi]
mov rcx, qword [rsi]
call sub.msvcrt.dll_memcpy
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000bbe8
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov r11, rcx
mov rcx, qword [rcx + 8]
mov rbx, r9
mov r9d, dword [rcx]
xor r10d, r10d
test r9d, r9d
je 0x14000bc2b
cmp r9d, 1
jne 0x14000bc4b
mov rcx, qword [rcx + 8]
mov r9d, r8d
mov r8, rdx
mov rdx, qword [r11]
mov rcx, qword [rcx]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x14000bc39
mov rcx, qword [r11]
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r10d, eax
test eax, eax
je 0x14000bc4b
test rbx, rbx
je 0x14000bc4b
mov eax, dword [rsp + 0x40]
mov dword [rbx], eax
mov eax, r10d
add rsp, 0x30
pop rbx
ret

Function at 0x14000bc54
Capabilities:
Compress data via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rax, qword [rsp + 0x80]
mov ebp, edx
mov r13, rcx
mov edx, dword [rax]
xor ebx, ebx
mov r12, r9
lea ecx, [rbx + 0x40]
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14000bced
lea ecx, [rbx + 0x40]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x14000bce4
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r12
mov ecx, 0x102
mov r9, rax
mov r8d, ebp
mov rdx, r13
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ntdll.dll_RtlCompressBuffer]
test eax, eax
setns bl
test ebx, ebx
jne 0x14000bce4
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret

Function at 0x14000bd08
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, rdx
mov rdi, rcx
lea edx, [rbx + 0x10]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x14000bdc7
and qword [rsp + 0x28], rbx
and dword [rsp + 0x20], ebx
lea r8d, [rbx + 2]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r11, rax
mov rax, qword [rsi]
mov qword [rax], r11
mov rdi, qword [rsi]
cmp qword [rdi], rbx
je 0x14000bdaa
mov rcx, qword [rdi]
and qword [rsp + 0x20], rbx
lea edx, [rbx + 4]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r11, rax
mov rax, qword [rsi]
mov qword [rax + 8], r11
mov rdi, qword [rsi]
mov rax, qword [rdi + 8]
test rax, rax
je 0x14000bdaa
cmp dword [rax], 0x504d444d
jne 0x14000bdaa
mov ecx, 0xa793
cmp word [rax + 4], cx
jne 0x14000bdaa
mov ebx, 1
jmp 0x14000bdc7
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000bdb9
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000bdc7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000c8c0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdx, qword [rdx]
mov ebp, ecx
mov ebx, 0xc0000004
test rdx, rdx
je 0x14000c8f3
lea r9, [rax + 0x10]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, eax
jmp 0x14000c938
mov edi, 0x1000
mov edx, edi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x14000c938
lea r9, [rsp + 0x38]
mov r8d, edi
mov rdx, rax
mov ecx, ebp
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, eax
test eax, eax
jns 0x14000c92e
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
add edi, edi
cmp ebx, 0xc0000004
je 0x14000c8f8
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d648
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
sub rsp, 0xd0
mov r13d, r8d
mov edi, ecx
mov rsi, rdx
xor ebp, ebp
lea rcx, [rax - 0x78]
xor edx, edx
lea ebx, [rbp + 0x68]
or r13d, 0x10
mov r8, rbx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x60], ebx
cmp qword [rsp + 0x120], rbp
je 0x14000d69b
mov rbx, qword [rsp + 0x120]
jmp 0x14000d6ac
mov edx, 0x18
lea ecx, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rbx, rbx
je 0x14000d7e7
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsdup]
mov rsi, rax
test rax, rax
je 0x14000d7e7
test edi, edi
je 0x14000d769
sub edi, 1
je 0x14000d730
cmp edi, 1
jne 0x14000d7ca
mov r9d, dword [rsp + 0x100]
mov r8, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], rbp
and qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], rsi
and qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
jmp 0x14000d79c
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], rbp
and qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r13d
and dword [rsp + 0x28], ebp
and qword [rsp + 0x20], rbp
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x14000d79c
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], rbp
and qword [rsp + 0x30], rbp
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov dword [rsp + 0x28], r13d
and dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, eax
test eax, eax
je 0x14000d7ca
cmp dword [rsp + 0x128], 0
jne 0x14000d7b7
cmp qword [rsp + 0x120], 0
jne 0x14000d7de
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x120], 0
jne 0x14000d7de
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
lea r11, [rsp + 0xd0]
mov eax, ebp
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret
Function at 0x14000e608
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [r9]
xor ebx, ebx
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov dword [rax], ecx
cmp ecx, ebx
je 0x14000e754
cmp ecx, 1
jne 0x14000e749
lea edx, [rbx + 0x20]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r11, rax
mov rax, qword [rdi]
mov qword [rax + 8], r11
mov rax, qword [rdi]
cmp qword [rax + 8], rbx
je 0x14000e749
mov eax, esi
mov rcx, rbp
mov qword [rsp + 0x28], rbx
neg eax
mov dword [rsp + 0x20], ebx
sbb r8d, r8d
xor r9d, r9d
xor edx, edx
and r8d, 2
add r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r11, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx], r11
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
cmp qword [rcx], rbx
je 0x14000e749
mov rcx, qword [rcx]
neg esi
mov qword [rsp + 0x20], rbx
sbb edx, edx
xor r9d, r9d
xor r8d, r8d
and edx, 0xfffffffe
add edx, 4
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r11, rax
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx + 8], r11
mov rax, qword [rdi]
mov rdx, qword [rax + 8]
mov rcx, qword [rdx + 8]
cmp rcx, rbx
je 0x14000e749
cmp dword [rcx], 0x66676572
jne 0x14000e72f
cmp dword [rcx + 0x1c], ebx
jne 0x14000e72f
add rcx, 0x1000
cmp dword [rcx], 0x6e696268
jne 0x14000e72f
mov qword [rdx + 0x10], rcx
movsxd rax, dword [rcx + 4]
lea rdx, [rax + rcx + 0x20]
mov rax, qword [rdi]
mov rcx, qword [rax + 8]
mov qword [rcx + 0x18], rdx
mov rax, qword [rdi]
mov ecx, 0x6b6e
mov rdx, qword [rax + 8]
mov rax, qword [rdx + 0x18]
cmp word [rax + 4], cx
jne 0x14000e72f
test byte [rax + 6], 0xc
jne 0x14000e754
mov rcx, qword [rdx + 8]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov r11, qword [rdi]
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000e759
mov ebx, 1
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000ed54
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r9d, dword [rcx]
xor ebx, ebx
mov r10, r8
mov r11, rdx
mov rbp, rcx
test r9d, r9d
je 0x14000edff
cmp r9d, 1
jne 0x14000ee38
call fcn.14000ec04
test rax, rax
mov r11, rax
setne bl
test ebx, ebx
je 0x14000ee38
mov edi, dword [rax + 8]
mov rcx, qword [rsp + 0x60]
btr edi, 0x1f
test rcx, rcx
je 0x14000edb5
mov eax, dword [rax + 0x10]
mov dword [rcx], eax
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x14000ee38
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000edfb
xor ebx, ebx
cmp dword [rsi], edi
setae bl
test ebx, ebx
je 0x14000edfb
bt dword [r11 + 8], 0x1f
jae 0x14000ede2
lea rdx, [r11 + 0xc]
jmp 0x14000edf3
mov rax, qword [rbp + 8]
movsxd r8, dword [r11 + 0xc]
mov rdx, qword [rax + 0x10]
lea rdx, [r8 + rdx + 4]
mov r8d, edi
call sub.msvcrt.dll_memcpy
mov dword [rsi], edi
jmp 0x14000ee38
mov rax, qword [rsp + 0x70]
mov r9, qword [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov rdx, r10
mov rcx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test ebx, ebx
jne 0x14000ee38
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000ee50
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r9d, dword [rcx]
xor ebx, ebx
mov r10, r8
mov r11, rdx
mov rdi, rcx
test r9d, r9d
je 0x14000eee5
cmp r9d, 1
jne 0x14000ef1c
call fcn.14000ec04
mov r11, rax
test rax, rax
je 0x14000ef1c
mov ecx, dword [rax + 8]
mov r8d, ecx
btr r8d, 0x1f
cmp r8d, dword [rsp + 0x70]
setae bl
test ebx, ebx
je 0x14000eede
mov eax, dword [rsp + 0x60]
and ecx, 0x80000000
or ecx, dword [rsp + 0x70]
mov dword [r11 + 0x10], eax
bt ecx, 0x1f
mov dword [r11 + 8], ecx
jae 0x14000eec1
lea rcx, [r11 + 0xc]
jmp 0x14000eed2
mov rax, qword [rdi + 8]
movsxd rdx, dword [r11 + 0xc]
mov rcx, qword [rax + 0x10]
lea rcx, [rdx + rcx + 4]
mov rdx, qword [rsp + 0x68]
call sub.msvcrt.dll_memcpy
jmp 0x14000ef1c
mov ecx, 0x32
jmp 0x14000ef16
mov eax, dword [rsp + 0x70]
mov r9d, dword [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x68]
mov rdx, r10
mov rcx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
test ebx, ebx
jne 0x14000ef1c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000ef2c
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r10d, dword [rcx]
xor r14d, r14d
mov r12, r9
mov r11d, r8d
mov rbp, rdx
mov edi, r14d
cmp r10d, r14d
je 0x14000f068
cmp r10d, 1
jne 0x14000f0a7
cmp dword [rdx + 0x18], r14d
je 0x14000f0a7
cmp r11d, dword [rdx + 0x18]
jae 0x14000f0a7
cmp dword [rdx + 0x20], 0xffffffff
je 0x14000f0a7
mov rax, qword [rcx + 8]
movsxd rcx, dword [rdx + 0x20]
mov r8, qword [rax + 0x10]
add rcx, r8
movzx eax, word [rcx + 4]
cmp eax, 0x666c
je 0x14000efb1
cmp eax, 0x686c
jne 0x14000f0a7
cmp word [rcx + 6], r14w
je 0x14000f0a7
movzx eax, word [rcx + 6]
cmp r11d, eax
jae 0x14000f0a7
movsxd rdx, dword [rcx + r11*8 + 8]
mov eax, 0x6b6e
add rdx, r8
cmp word [rdx + 4], ax
jne 0x14000f0a7
cmp r9, r14
je 0x14000f0a7
mov rsi, qword [rsp + 0x80]
cmp rsi, r14
je 0x14000f0a7
test byte [rdx + 6], 0x20
je 0x14000f03d
movzx ebx, word [rdx + 0x4c]
cmp dword [rsi], ebx
seta dil
cmp edi, r14d
je 0x14000f064
lea rcx, [rdx + 0x50]
mov rdx, rbx
call fcn.140012d6c
mov rbp, rax
cmp rax, r14
je 0x14000f05f
lea r8, [rbx + rbx]
mov rdx, rax
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000f05f
movzx ebx, word [rdx + 0x4c]
shr ebx, 1
cmp dword [rsi], ebx
seta dil
cmp edi, r14d
je 0x14000f064
movzx r8d, word [rbp + 0x4c]
add rdx, 0x50
mov rcx, r9
call sub.msvcrt.dll_memcpy
mov word [r12 + rbx*2], r14w
mov dword [rsi], ebx
jmp 0x14000f0a7
mov r9, qword [rsp + 0x80]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov r8, r12
mov edx, r11d
mov rcx, rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, r14d
sete dil
cmp edi, r14d
jne 0x14000f0a7
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, edi
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
ret