joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62d4e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x62d5e2
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call sym.net_url.splitHostPort
test rdi, rdi
jne 0x62d533
mov rbx, qword [0x008c20c8]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x0065d9e0]
call sym.runtime.mapaccess1_faststr
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x78]
call sym.net_http.idnaASCIIFromURL
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00949288]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x62d5b5
xor eax, eax
lea rbx, [0x006a353d]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006a3578]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x62d5dc
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00725c48]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net_http.canonicalAddr
Function at 0x140004130
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r15, rdx
mov rsi, rcx
xor edi, edi
mov qword [rsp + 0x58], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
lea rbx, [rcx + 0x10]
mov qword [rsp + 0x50], rbx
mov rcx, rbx
call int.140007160
test eax, eax
jne 0x1400042f2
cmp qword [rsi], rdi
je 0x1400042b8
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140003cf0
lea rcx, [rsp + 0x30]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
cmp r14, 0x10
cmovae rcx, rbp
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x1400041e4
movabs r8, 0x100000001b3
movzx eax, byte [rdi + rcx]
xor r9, rax
imul r9, r8
inc rdi
cmp rdi, rdx
jb 0x1400041d1
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x68]
call fcn.140005630
mov rdi, qword [rax + 8]
test rdi, rdi
jne 0x140004204
mov rdi, qword [rsi + 0x70]
cmp r14, 0x10
jb 0x14000423b
lea rdx, [r14 + 1]
mov rax, rbp
cmp rdx, 0x1000
jb 0x140004233
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400042ec
mov rcx, rbp
call fcn.140005774
cmp rdi, qword [rsi + 0x70]
je 0x140004247
mov rdi, qword [rdi + 0x30]
jmp 0x1400042b8
mov rdx, r15
lea rcx, [rsp + 0x60]
push rdx
call fcn.14003cda2
test eax, eax
js 0x14000426f
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsi]
call fcn.1400725ad
test eax, 0x247c8b48
pop rax
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x1400042b8
cmp byte [rsi + 0x60], 0
je 0x140004296
mov rdx, rdi
mov rcx, qword [rsi + 0xa8]
call fcn.1400046c0
mov rdi, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x68]
call fcn.140004ac0
mov rdi, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140007168
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140005710
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call fcn.14000cba8
nop
mov ecx, eax
call fcn.140006d04
int3
Function at 0x140005450
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14000561b
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140003fd0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400055e4
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14000555d
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400055d3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x14000559a
mov r10, qword [rdx]
cmp r10, rax
je 0x140005594
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400055d3
cmp r9, rdx
je 0x1400055af
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x1400055f5
cmp r9, rdx
jne 0x1400055a0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400054e1
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400055d3
lea rcx, str.invalid_hash_bucket_count
call fcn.140006550
int3

Function at 0x1400150f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140015118
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140015118
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14002d012
Capabilities:
Packed with generic packer

Disassembly:
mov r14, qword [rsp + r14 + 0x40]
add dword [rsp + 0x48], 0x600cd59f
add dword [rsp + 0x48], 0x40064087
jne 0x1400310de
mov r8, qword [rsp + 0x38]
add qword [rsp + 0x10], 0xffffffffbffcb893
or word [rsp + 0x18], 0xf31f
cmp word [rsp + 0x48], 0x4d23
js 0x140050d3e
adc al, 0x2e
cmp al, 0x52
out 0xaf, eax
xchg esi, eax
invalid

Function at 0x14002d053
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
xchg qword [rsp + 0x18], rsi
jl fcn.140080204
add qword [rsp], 0x1eccc
sub r8b, 8
push rdi
jns 0x14008d7b2
jo 0x140085d64
push r8
mov r8, qword [rsp + 0x20]
mov qword [rsp + 0x20], rsi
mov rdi, qword [rsp]
sets byte [rsp]
push r11
push r10
nop
mov r10, qword [rsp + 0x10]
mov r11, r10
call fcn.1400799a6

Function at 0x14002fff3
Capabilities:
Packed with generic packer

Disassembly:
and qword [rsp + 0x18], r8
jle 0x140030040
and dword [rsp + 0x18], r8d
not r8b
jne 0x14002d030

Function at 0x14003b21f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rbp, [rbp + 0x7f0e410b]
mov qword [rsp + 0x28], rbx
call fcn.140036a59

Function at 0x14003b230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jbe 0x1400846be
syscall
push rbx
movabs rbx, 0x373a0f9b7c29ce3c
pushfq
shl bl, 0x36
mov rbx, qword [rsp + 8]
mov qword [rsp + 8], 0xffffffffdc04e3e1
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1400b756c
lea rdi, [rsi*8 - 0x6bfeafef]
cmp r11w, 0x25b2
lea rcx, [rcx + 1]
not rsi
jo 0x140028d7e
movabs r8, 0x5b16600d943e8a1b
mov qword [rsp + 0x38], rcx
add qword [rsp + 0x20], 0x1083b
call fcn.140030cda
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x50]
ret
not word [rsp + rsi*8 + 0x38]
mov rsi, qword [rsp + rsi*2 + 0x28]
cmp word [rsp + 0x40], 0x499f
js 0x14005734c
test byte [rsp + 0x38], 0x1d
not qword [rsp + 0x38]
jb 0x14004a563
cmp dword [rsp + 0x40], 0xb5be9a39
jno 0x140082e20

Function at 0x14003b542
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jno 0x14004adc0
sub bl, byte [rsp + rbx + 0x12]
call 0x140032114

Function at 0x14003bcb9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ja 0x140044463
call fcn.140042e47

Function at 0x14004adcc
Capabilities:
Packed with generic packer

Disassembly:
cmp r15w, 0x2eab
jns 0x14002c9c5

Function at 0x140056417
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rbp, qword [rsp + 0x10]
mov rbp, qword [rbp + riz]
test r8d, 0xffb25c1c
jl 0x140076e4b
je 0x140028048
cmp qword [rsp + r11*2 - 0x1c8], r14
xchg qword [rsp + r11 - 0xa8], rbx
mov rcx, qword [rsp + r11*2 - 0x1b8]
jg 0x140048e78
je 0x14008e6ae
call fcn.14002d224

Function at 0x1400740c0
Capabilities:
Packed with generic packer

Disassembly:
call fcn.140040b33
or dl, ah
invalid
mov rsi, qword [rsp + r13*2 + 0x5a]
mov rsi, qword [rsi + r13 + 1]
not r13
movzx r13, r11b
jne 0x14004c2d5
js 0x140052ea8
mov qword [rsp + r13*2 + 0x58], r13
jb 0x1400738a9
push rbp
lea rsi, [rsi + r13*2 - 0x7541acd2]
or r13, qword [rsp + r13 + 0x18]
Function at 0x14007a374
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x58], rax
mov r14, qword [rsp + 0x30]
jae fcn.140052c5f
xor qword [rsp + 0x38], 0x7894cc87
add word [rsp + 0x40], 0xf110
jl 0x140088705
mov rcx, qword [rsp + 0x40]
mov rsi, qword [rsp + rcx - 0x6115be8c]
mov rcx, qword [rsp + 0x10]
call fcn.14007d189

Function at 0x140080204
Capabilities:
Packed with generic packer

Disassembly:
not r15
or r15b, 0x35
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
mov r15b, 0x86
jbe 0x140054e05
jle 0x14003c009
cmp si, 0x6b3b
lea r15, [rsi*4 + 0x5a95d4a8]
mov qword [rsp + 0x10], r15
lea rax, [rax + 0x263db69b]
movzx si, byte [rsp + 0x10]
call fcn.140078f13
clc
hlt
mov r9w, r8w
movabs rax, 0x87948a3a253e3dac
sub r9b, 0x82
jbe 0x14007b26f
adc al, 0xc2
cmp edx, dword [rdx - 9]
test r11, rsp
mov esp, 0xee8162d6
invalid
setl r12b
add r12b, 7
push rsi
mov qword [rsp + 0x18], rbx
not r12w
movabs rsi, 0xaa0a3095ed95ccb2
jb 0x14004fcd3
test si, 0xf098
push rbp
not si
je 0x140050971
movabs rbp, 0x18a98a0d6a21a021
call fcn.140033f65
sub r9d, r8d
ja 0x14008d725
push rdx
pushfq
movabs rdx, 0xf72fe1b38403a5aa
and dx, dx
or edx, 0x478d6c35
xor dl, 0xf
mov rax, qword [rsp + 0x20]
push rsi
jns 0x14002c9c5
call fcn.14002abb3

Function at 0x1400a487b
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test rbp, rbp
lea rsp, [rsp + 0x10]
je 0x1400a48f6
push rbx
mov ebx, 0x4f952806
movzx r11d, bl
lea r11, [0x1400eeae8]
mov ebx, 0x61b2b38
movzx ebx, byte [rbx + rdx - 0x61b2b38]
xor ebx, eax
and ebx, 0xff
mov ebx, dword [r11 + rbx*4]
push 0x5331bf05
shr eax, 8
xor eax, ebx
inc rdx
xor eax, 0x2e2979a4
shr byte [rsp + 7], 0xc1
dec rbp
push 0xfffffffff701d427
lea rsp, [rsp + 0x10]
jne 0x1400a489c
mov r11d, 0x3f9144b7
lea rbp, [r11*8 + 0x6f199faf]
lea r11, [rbp + r11*8 - 0x249df77]
pop rbx
mov r11d, 0xc89c685
not eax
mov dword [rdi + r11*2 - 0x19138d0a], eax
lea rcx, [r11*2 + 0x6d1f2c03]
sal ecx, 0x6e
jmp r10

Function at 0x1400b8ab1
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], r10
push r9
lea r10, [0x1400b7a08]
movzx r9d, byte [r11]
push 0xfffffffffb992d17
xor r9d, eax
and r9d, 0xff
mov r9d, dword [r10 + r9*4]
sar dword [rsp + 3], 0xd0
shr eax, 8
xor eax, r9d
sar byte [rsp + 5], 1
inc r11
push 0xffffffffc031f30e
xor eax, 0xd911239f
inc dword [rsp + 7]
dec r8
lea rsp, [rsp + 0x10]
jne 0x1400b8abe
pop r9
mov ebp, 0xf5add899
lea rcx, [rbp*2 + 0x7a2a181e]
ror ecx, cl
pop r10
Function at 0x140001000
Capabilities:
Capture screenshot
Check for foreground window switch
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x124f80
jae 0x1400010d1
mov qword [rsp + 0x60], rbx
nop dword [rax]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov dword [rsp + 0x40], 0x999999
mov r9d, esi
mov dword [rsp + 0x38], 2
mov edx, 0xffffffff
mov dword [rsp + 0x30], 2
mov r8d, 1
mov qword [rsp + 0x28], rbx
mov rcx, rax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x124f80
jb 0x140001060
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
xor eax, eax
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400019fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a46
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a46
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a46
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a46
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a46
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a48
xor al, al
add rsp, 0x28
ret
Function at 0x14000f5b0
Capabilities:
Create directory
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1400700d0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
xor esi, esi
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], esi
xor edx, edx
mov r8d, 0x208
call fcn.14002ad80
mov r8d, 0x104
lea rdx, [rsp + 0x50]
lea rcx, [0x14004d848]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
cmp eax, 0x104
jbe 0x14000f610
xor al, al
jmp 0x14000f736
test rdi, rdi
mov qword [rsp + 0x288], rbx
lea rcx, [rdi + 0x10]
cmove rcx, rsi
lea rdx, [rsp + 0x50]
call fcn.14000de00
mov rcx, rax
lea rdx, str.Intel
call fcn.14000de00
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140010d80
cmp qword [rax + 0x18], 8
jb 0x14000f653
mov rax, qword [rax]
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x14000f673
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xb7
je 0x14000f673
mov bl, 1
jmp 0x14000f675
xor bl, bl
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x14000f692
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
inc r8
call fcn.1400068f0
test bl, bl
jne 0x14000f707
test rdi, rdi
lea rcx, [rdi + 0x10]
lea rdx, str.Logs
cmove rcx, rsi
call fcn.14000de00
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140010d80
cmp qword [rax + 0x18], 8
jb 0x14000f6c4
mov rax, qword [rax]
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x14000f6e4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xb7
je 0x14000f6e4
mov bl, 1
jmp 0x14000f6e6
xor bl, bl
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x14000f703
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
inc r8
call fcn.1400068f0
test bl, bl
je 0x14000f70b
xor al, al
jmp 0x14000f72e
test rdi, rdi
lea rcx, [rdi + 0x10]
lea rdx, str.IntelCPHS.log
cmove rcx, rsi
call fcn.14000de00
xor edx, edx
mov rcx, rax
call fcn.1400084b0
mov al, 1
mov rbx, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140027c60
mov rsi, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x140013440
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14001346e
mov r8, rdx
mov rdx, qword [rdi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140014c80
cmp byte [0x140071f98], 0
mov qword [rsp + 0x30], rbx
jne 0x1400134c1
lea rcx, str.Advapi32.dll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x1400134b1
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rbx, rax
mov qword [0x140071f90], rax
mov byte [0x140071f98], 1
jmp 0x1400134c8
mov rbx, qword [0x140071f90]
mov byte [0x140071f98], 1
jmp 0x1400134c8
mov rbx, qword [0x140071f90]
test rbx, rbx
je 0x1400134f8
mov rcx, rbx
call qword [fcn.14000b730]
mov r8d, dword [rdi + 8]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rsi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax
mov rcx, qword [rdi]
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x140014cf7
lea rcx, str.Advapi32.dll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x140014d0b
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140014d0b
mov rcx, rax
call qword [fcn.14000b730]
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, rbp
call rdi
jmp 0x140014d10
cmp dword [rcx + 8], 0
je 0x140014d0b
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyW]
jmp 0x140014d10
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400149a0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1400700d0]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rcx
mov qword [rsp + 0x70], rdx
xor ecx, ecx
xor r8d, r8d
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], ecx
mov edi, dword [rsi + 8]
mov qword [rsp + 0x58], rcx
or edi, 0x2001f
mov qword [rsp + 0x60], rcx
mov r9d, edi
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140014af7
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140014a23
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
and edi, 0x300
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], edi
test ebx, ebx
jne 0x140014af7
xor edi, edi
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x80]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x140014acf
nop word [rax + rax]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.1400149a0
mov ebx, eax
test eax, eax
jne 0x140014af7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x80]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x140014a80
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140014ae4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov qword [rsp + 0x48], rdi
mov rdx, qword [rsp + 0x70]
mov rcx, rsi
mov dword [rsp + 0x50], edi
call fcn.140013440
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140014b07
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140027c60
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014c80
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14001346e
mov r8, rdx
mov rdx, qword [rdi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140014c80
cmp byte [0x140071f98], 0
mov qword [rsp + 0x30], rbx
jne 0x1400134c1
lea rcx, str.Advapi32.dll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x1400134b1
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rbx, rax
mov qword [0x140071f90], rax
mov byte [0x140071f98], 1
jmp 0x1400134c8
mov rbx, qword [0x140071f90]
mov byte [0x140071f98], 1
jmp 0x1400134c8
mov rbx, qword [0x140071f90]
test rbx, rbx
je 0x1400134f8
mov rcx, rbx
call qword [fcn.14000b730]
mov r8d, dword [rdi + 8]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rsi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax
mov rcx, qword [rdi]
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x140014cf7
lea rcx, str.Advapi32.dll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x140014d0b
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140014d0b
mov rcx, rax
call qword [fcn.14000b730]
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rsi
mov rcx, rbp
call rdi
jmp 0x140014d10
cmp dword [rcx + 8], 0
je 0x140014d0b
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyW]
jmp 0x140014d10
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret