joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010260
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, rcx
mov rsi, rdx
mov ecx, 0x2004
call fcn.1400198fc
mov rdi, rax
mov dword [rsp + 0x60], 0x2000
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140010327
mov r14, 0xffffffffffffffff
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140010347
cmp dword [rsp + 0x68], 7
jne 0x140010347
mov ebx, dword [rsp + 0x60]
mov rcx, rdi
call fcn.1400198f4
mov ecx, ebx
mov eax, 2
shr rcx, 1
add rcx, 2
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.1400198fc
mov rdi, rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400102c0
mov ecx, dword [rsp + 0x60]
xor edx, edx
shr ecx, 1
lea eax, [rcx + 1]
mov word [rdi + rcx*2], dx
mov rcx, rdi
mov word [rdi + rax*2], dx
call fcn.14000fef0
test rax, rax
jne 0x140010351
mov rcx, rdi
call fcn.1400198f4
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400130b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov dword [rsp + 0x60], 1
mov rsi, rdx
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov dword [rsp + 0x68], 4
lea rdx, str.ForceHCResetOnResume
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Start_to_write_reg_key___2_
mov ecx, 4
cmp eax, 2
sete dil
call fcn.1400194a0
lea rax, [rsp + 0x30]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREATHEROSVistaAddOn
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001320f
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, str.ResetKeyAddded
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Start_to_write_reg_key___3_
mov ecx, 4
call fcn.1400194a0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.ResetKeyAddded
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test edi, edi
je 0x1400131e4
mov rcx, qword [rsp + 0x30]
lea rdx, str.ForceResetKey
mov dword [rsp + 0x28], 0x104
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ForceHCResetOnResume
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140013d40
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov ebx, ecx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x210
call fcn.14001bd50
lea rcx, str.Enter_USBRootHubAndHCReset____n_n
call fcn.14000db70
lea rcx, [rsp + 0x20]
call fcn.140013760
test eax, eax
je 0x140013f12
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__dongle_status_is__d____n
call fcn.14000db70
mov edx, 1
mov dword [0x1400554b8], 1
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
call fcn.14000db70
mov r8d, 1
lea rdx, str.Enter_Function_DisableRadioHandler__disable___d_n
lea ecx, [r8 + 1]
call fcn.1400194a0
call fcn.140009f30
cmp eax, 0x32
jl 0x140013e00
lea rcx, str.DisableRadioHandler__dont_send_check_msg__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.DisableRadioHandler__dont_send_check_msg_n
mov ecx, 2
call fcn.1400194a0
mov dword [0x140053bd4], 1
mov ecx, dword [0x140053bb0]
xor r9d, r9d
mov edx, 0x5e5d
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostThreadMessageW]
xor edx, edx
lea rcx, str.Enter_Function_DisableRadioHandler__disable___d_n
call fcn.14000db70
xor r8d, r8d
lea rdx, str.Enter_Function_DisableRadioHandler__disable___d_n
lea ecx, [r8 + 2]
call fcn.1400194a0
mov ecx, dword [0x140053bb0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5e5d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.140013760
test eax, eax
je 0x140013f12
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_off_on_radio__dongle_status_is__d_n
call fcn.14000db70
cmp dword [rsp + 0x20], 1
je 0x140013f0b
mov edx, ebx
lea rcx, str.USBRootHubAndHCReset__USBRootHubReset__index_is__d____n
call fcn.14000db70
mov ecx, ebx
call fcn.1400134c0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.140013760
test eax, eax
je 0x140013f12
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_USBRootHubReset__dongle_status_is__d____n
call fcn.14000db70
cmp dword [rsp + 0x20], 1
je 0x140013f0b
mov edx, ebx
lea rcx, str.USBRootHubAndHCReset__USBControllerReset__index_is__d____n
call fcn.14000db70
mov ecx, ebx
call fcn.140012d50
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.140013760
test eax, eax
je 0x140013f12
mov edx, dword [rsp + 0x20]
lea rcx, str.USBRootHubAndHCReset__after_USBControllerReset__dongle_status_is__d___n
call fcn.14000db70
mov eax, 1
jmp 0x140013f20
lea rcx, str.USBRootHubAndHCReset__GetBTAdapterStatus_failed____n
call fcn.14000db70
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400198d0
add rsp, 0x240
pop rbx
ret
Function at 0x140017b40
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rcx
xor ecx, ecx
mov rax, rdi
mov qword [rdi + 0x10], rcx
cmp qword [rdi + 0x18], 8
jb 0x140017b75
mov rax, qword [rdi]
mov word [rax], cx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x40]
cmp ax, 9
je 0x140017b9c
cmp ax, 6
je 0x140017b9c
mov ebx, dword [0x140052cf8]
jmp 0x140017ba7
mov ebx, 0xf013f
mov dword [0x140052cf8], ebx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.14001bd50
mov rcx, qword [0x140052d00]
lea rax, [rsp + 0x38]
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
lea rdx, str.SOFTWAREAtherosVistaAddOn
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140017c60
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallDir
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140017c60
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140017c60
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140017c41
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14000c9b0
mov eax, 1
jmp 0x140017c62
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400198d0
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rdi
ret
Function at 0x140019020
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x50
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
lea rcx, [0x140053b50]
xor r8d, r8d
xor edx, edx
lea r9d, [rbp + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rsi, rax
test rax, rax
je 0x140019152
xorps xmm0, xmm0
mov qword [rsp + 0x68], rdi
movups xmmword [rsp + 0x28], xmm0
lea r8, [rsp + 0x28]
mov dword [rsp + 0x28], 0x20
xor edx, edx
mov rcx, rax
mov edi, ebp
movups xmmword [rsp + 0x38], xmm0
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x140019142
mov qword [rsp + 0x60], rbx
nop word [rax + rax]
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov dword [rsp + 0x24], 0xff
lea rcx, [rsp + 0x24]
mov dword [rsp + 0x20], 0xff
call qword [sym.imp.CFGMGR32.dll_CM_Get_DevNode_Status]
mov edx, eax
lea rcx, str.The_status_of_uResult_is__d__n
mov ebx, eax
call fcn.14000db70
mov edx, dword [rsp + 0x20]
lea rcx, str.The_status_of_uProblem_is__d__n
call fcn.14000db70
test ebx, ebx
je 0x14001912b
xorps xmm0, xmm0
lea rcx, str.The_MemberIndex_of_SetupDiEnumDeviceInfo_is__d__n
movups xmmword [rsp + 0x28], xmm0
inc edi
mov dword [rsp + 0x28], 0x20
mov edx, edi
movups xmmword [rsp + 0x38], xmm0
call fcn.14000db70
lea r8, [rsp + 0x28]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x1400190a0
jmp 0x14001913d
lea rcx, str.This_device_is_3002_UART_dongle._n
mov ebp, 1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rbx, qword [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov rdi, qword [rsp + 0x68]
mov eax, ebp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400198d0
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rsi
ret
Function at 0x1400194a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x10118
call fcn.1400364c0
sub rsp, rax
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rsp + 0x100d0], rax
mov eax, dword [0x140053be8]
test eax, eax
je 0x1400196ef
cmp ecx, eax
jg 0x1400196ef
test ecx, eax
je 0x1400196ef
mov qword [rsp + 0x10110], rbx
mov qword [rsp + 0x10108], rbp
mov qword [rsp + 0x100e8], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140053bec], eax
mov ebx, eax
je 0x140019545
nop dword [rax]
nop dword [rax + rax]
xor eax, eax
lock cmpxchg dword [0x140053bec], ebx
cmp dword [0x140053bec], ebx
je 0x140019545
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x140053bec], ebx
jne 0x140019520
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov rbp, qword [0x140053be0]
mov rbx, 0xffffffffffffffff
cmp rbp, rbx
jne 0x140019574
lea rcx, [0x140053be0]
call fcn.1400193a0
mov rbp, rax
jmp 0x1400195ba
movzx eax, word [0x140053bf8]
cmp word [rsp + 0x50], ax
jne 0x14001959e
movzx eax, word [0x140053bfa]
cmp word [rsp + 0x52], ax
jne 0x14001959e
movzx eax, word [0x140053bfe]
cmp word [rsp + 0x56], ax
je 0x1400195ba
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140053be0]
mov qword [0x140053be0], rbx
call fcn.1400193a0
xor r15d, r15d
test rbp, rbp
je 0x1400196c8
movzx ecx, word [rsp + 0x5e]
movzx edx, word [rsp + 0x5c]
mov eax, dword [0x140053bec]
movzx r9d, word [rsp + 0x5a]
movzx r8d, word [rsp + 0x58]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], edx
lea rdx, str._02d:_02d:_02d__03d__X:
mov qword [rsp + 0x10100], rsi
mov qword [rsp + 0x100f8], rdi
mov qword [rsp + 0x100f0], r14
call fcn.140009aa0
movsxd rsi, eax
lea r14, [rsp + 0x10130]
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x48], r14
lea rdi, [rdi + rsi*2]
call fcn.140001030
mov r9, qword [rsp + 0x10128]
mov r8d, 0x8000
mov qword [rsp + 0x28], r14
mov rdx, rdi
mov qword [rsp + 0x20], r15
mov rcx, qword [rax]
or rcx, 1
call fcn.140024e4c
test eax, eax
lea rcx, [rsp + 0x60]
lea rdx, [0x14004b9a4]
cmovs eax, ebx
add eax, esi
cdqe
lea rcx, [rcx + rax*2]
call fcn.140009aa0
mov r14, qword [rsp + 0x100f0]
lea rax, [rsp + 0x60]
mov rdi, qword [rsp + 0x100f8]
mov rsi, qword [rsp + 0x10100]
nop word [rax + rax]
cmp word [rax + rbx*2 + 2], r15w
lea rbx, [rbx + 1]
jne 0x1400196a0
lea r8d, [rbx + rbx]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov rcx, rbp
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbp, qword [rsp + 0x10108]
mov rbx, qword [rsp + 0x10110]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lock cmpxchg dword [0x140053bec], r15d
mov r15, qword [rsp + 0x100e8]
mov rcx, qword [rsp + 0x100d0]
xor rcx, rsp
call fcn.1400198d0
add rsp, 0x10118
ret
Function at 0x14002e70c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14002e73c
xor eax, eax
jmp 0x14002e7ff
mov rbp, rbx
cmp word [rax], si
je 0x14002e761
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14002e748
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14002e744
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14002e65c
movsxd r14, eax
test eax, eax
jne 0x14002e79f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14002e735
mov rcx, r14
call fcn.1400291c8
mov rdi, rax
test rax, rax
jne 0x14002e7b8
xor ecx, ecx
call fcn.14002918c
jmp 0x14002e794
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14002e65c
test eax, eax
jne 0x14002e7e9
mov rcx, rdi
call fcn.14002918c
jmp 0x14002e7f3
xor ecx, ecx
call fcn.14002918c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14002e81c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14002e8a3
mov rsi, rbx
cmp word [rax], bp
je 0x14002e862
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14002e84c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14002e848
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400291c8
mov rdi, rax
test rax, rax
je 0x14002e890
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001bf40
mov rbp, rdi
xor ecx, ecx
call fcn.14002918c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140034008
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400251bc
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140034092
cmp byte [rbp - 0x21], r15b
je 0x14003408d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400340c8
call fcn.14002b674
test eax, eax
jne 0x1400340b4
cmp byte [rbp - 0x21], r15b
je 0x1400340ac
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400340c8
cmp byte [rbp - 0x21], r15b
je 0x1400340c5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14002d1d4
test eax, eax
jne 0x140034168
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400251bc
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140034107
cmp byte [rbp - 0x21], r15b
je 0x14003413c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14003413c
call fcn.14002b674
test eax, eax
jne 0x140034128
cmp byte [rbp - 0x21], r15b
je 0x140034121
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14003413c
cmp byte [rbp - 0x21], r15b
je 0x140034139
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14002d1d4
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140034168
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14003416b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140034179
mov rcx, rdi
call fcn.14002918c
cmp byte [rbp + 0x3f], r15b
je 0x140034188
mov rcx, qword [rbp + 0x27]
call fcn.14002918c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000612c
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f170]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007200
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007190
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x1400211d0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020600]
jmp 0x14000723c
cmp qword [rbx + 0x18], rdi
je 0x140007243
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007233
jmp 0x14000725d
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020600]
call fcn.140011f98
lea rcx, [0x1400211d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop rbx
xchg ecx, eax
in al, 0x4e
mov sil, 0xc2
wait
sub byte [rax + rdx*8], 0xca
invalid
test dword [rax], eax
stosd dword [rdi], eax
lodsd eax, dword [rsi]
and al, 0xba
lodsd eax, dword [rsi]
sar byte [rbp - 3], 1
pop qword [rax]
lodsd eax, dword [rsi]
sar byte [rbp - 0x6f], 1
or dword [rax + 0x45], 0xfde70375
hlt
cmpsd dword [rsi], dword [rdi]
sahf
and byte [rdx + 0x10], ah
cmc
mov eax, 0xfbb2bf3e
sub byte [rdi + 2], bh
invalid
in eax, 0xc2
iretd
add bh, byte [rbp - 0x1892314a]
xor ecx, dword [rcx - 0x2fbcabf8]
push rsi
mov ebp, 0xcc244820
and al, 0xcc
and al, 0xcc
fstp xword [rdx - 0x51]
mov al, 0x30
adc dword [rdx + 0x2c], eax
sub al, 0xc2
invalid
invalid
cmpsb byte [rsi], byte [rdi]
xor ebx, ebp
invalid
mov fs, eax
scasd eax, dword [rdi]
out 0x9f, al
enter 0x2c73, 0x3e
jae 0x14003f6df
sub eax, 0x42bfb2d7
add al, 0x30
jl 0x14003f6d1
insd dword [rdi], dx
sbb al, 0x13
lea eax, [rax]
invalid
jnp 0x14003f6d3
xor edi, dword [rsi]
sub eax, 0xa1bf7780
call 0x115f2c3a4
xchg edx, esi
sahf
add bh, dh
and al, 0xe0
mov ch, 0x75
push rdx
pushfq
sub edx, esp
add dword [rax - 0x75], ebp
mov bl, byte [rdx - 0x48]
push rsi
invalid
Function at 0x140002ed4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002f1e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002f1e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002f1e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002f1e
cmp dword [rcx + 0x84], 0xe
jbe 0x140002f1e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002f20
xor al, al
add rsp, 0x28
ret
Function at 0x140005a30
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x48
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140005b3a
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140005b2f
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140005b24
mov r8d, 0x7fff
mov rdx, qword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140005b19
mov edx, 0x7fff
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140005b19
mov r9, qword [rsp + 0x28]
lea r8, str._scmd.exe
mov edx, 0x7fff
mov rcx, qword [rsp + 0x30]
call fcn.140023d1c
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140005b19
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x140005b3c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x48
ret

Function at 0x14000ab30
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x68
lea rdx, [rsp + 0x30]
lea rcx, [0x14005d480]
call fcn.14000ae40
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000ac8f
mov edx, 0xfffe
mov ecx, 0x40
call qword [0x140063768]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x14000ac84
lea rax, str.FDCD3784_C0C5_4251_8F78_98D4A5EE6E82
mov qword [rsp + 0x28], rax
lea rax, str.WINCRAFT.exe
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x38]
lea r8, str._s_s__s
mov edx, 0x7fff
mov rcx, qword [rsp + 0x40]
call qword [0x140063e90]
mov dword [rsp + 0x50], eax
cmp dword [0x14005f130], 1
jne 0x14000ac14
lea r8, [rsp + 0x48]
lea rdx, [0x1400345d0]
mov rcx, 0xffffffff80000001
call qword [0x140063cf8]
test eax, eax
jne 0x14000ac14
mov eax, dword [rsp + 0x50]
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14005f2b4]
mov rcx, qword [rsp + 0x48]
call qword [0x140063cf0]
mov rcx, qword [rsp + 0x48]
call qword [0x140063d00]
cmp dword [0x14005f12c], 1
jne 0x14000ac79
lea r8, [rsp + 0x48]
lea rdx, [0x140034630]
mov rcx, 0xffffffff80000002
call qword [0x140063cf8]
test eax, eax
jne 0x14000ac79
mov eax, dword [rsp + 0x50]
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14005f302]
mov rcx, qword [rsp + 0x48]
call qword [0x140063cf0]
mov rcx, qword [rsp + 0x48]
call qword [0x140063d00]
mov rcx, qword [rsp + 0x40]
call qword [0x140063780]
mov rcx, qword [rsp + 0x38]
call qword [0x140063780]
mov eax, 1
add rsp, 0x68
ret
Function at 0x14000aca0
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x38
cmp dword [0x14005f130], 1
jne 0x14000ace7
lea r8, [rsp + 0x20]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [0x140063cf8]
test eax, eax
jne 0x14000ace7
lea rdx, [0x14005f2b4]
mov rcx, qword [rsp + 0x20]
call qword [0x140063d48]
mov rcx, qword [rsp + 0x20]
call qword [0x140063d00]
cmp dword [0x14005f12c], 1
jne 0x14000ad2a
lea r8, [rsp + 0x20]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [0x140063cf8]
test eax, eax
jne 0x14000ad2a
lea rdx, [0x14005f302]
mov rcx, qword [rsp + 0x20]
call qword [0x140063d48]
mov rcx, qword [rsp + 0x20]
call qword [0x140063d00]
mov eax, 1
add rsp, 0x38
ret