joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d5f90
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d7070
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d6992
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f9108]
test eax, eax
je 0x2fc4d6a2a
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f9110]
mov qword [rbp - 8], rax
jmp 0x2fc4d6a0e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d6a02
cmp qword [rbp - 0x10], 0
je 0x2fc4d6a02
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d69c8
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d6a2b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d6b30
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d6b58
mov eax, 0
jmp 0x2fc4d6ba6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d6b81
mov eax, 0
jmp 0x2fc4d6ba6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d6ba1
mov eax, 0
jmp 0x2fc4d6ba6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d6bac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d6c2a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d6c21
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d6c21
mov rax, qword [rbp - 8]
jmp 0x2fc4d6c3f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d6bf4
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001a80
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001aca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001aca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001aca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001aca
cmp dword [rcx + 0x84], 0xe
jbe 0x140001aca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001acc
xor al, al
add rsp, 0x28
ret
Function at 0x2fc526280
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc527360
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc526c82
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc549108]
test eax, eax
je 0x2fc526d1a
lea rax, [0x2fc5490e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc549110]
mov qword [rbp - 8], rax
jmp 0x2fc526cfe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc526cf2
cmp qword [rbp - 0x10], 0
je 0x2fc526cf2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc526cb8
lea rax, [0x2fc5490e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc526d1b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc526e20
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc526e48
mov eax, 0
jmp 0x2fc526e96
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc526e71
mov eax, 0
jmp 0x2fc526e96
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc526e91
mov eax, 0
jmp 0x2fc526e96
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc526e9c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc526f1a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc526f11
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc526f11
mov rax, qword [rbp - 8]
jmp 0x2fc526f2f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc526ee4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140003d00
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rax, rcx
and eax, 0xfffffff
cmp rax, 7
jb 0x140003d29
mov r9d, 0xfffffff0
mov rax, rcx
and rax, r9
mov r9d, 0x80000000
cmp rax, r9
je 0x140003d49
test rdx, rdx
je 0x140003d49
cmp word [rdx], 0
je 0x140003d49
test r8, r8
je 0x140003d49
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
sete al
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x140003d50
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
sete al
add rsp, 0x28
ret

Function at 0x140003d70
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
mov r8, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140003dcd
mov rax, rcx
and eax, 0xfffffff
cmp rax, 7
jb 0x140003da4
mov r9d, 0xfffffff0
mov rax, rcx
and rax, r9
mov r9d, 0x80000000
cmp rax, r9
je 0x140003dcd
test rdx, rdx
je 0x140003dcd
cmp word [rdx], 0
je 0x140003dcd
cmp byte [r8 + 0xc], 0
je 0x140003dcd
mov r8d, dword [r8 + 8]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
sete al
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x140003ea0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14003a0c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r10, rcx
mov rbx, r8
and ecx, 0xfffffff
cmp rcx, 7
jb 0x140003ee2
mov r8d, 0xfffffff0
mov rcx, r10
and rcx, r8
mov r8d, 0x80000000
cmp rcx, r8
je 0x140003f78
test rdx, rdx
je 0x140003f78
cmp word [rdx], 0
je 0x140003f78
test rbx, rbx
je 0x140003f78
cmp word [rbx], 0
je 0x140003f78
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], 0
or r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003f78
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
sete bl
test rcx, rcx
je 0x140003f62
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140011e80
add rsp, 0x40
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140011e80
add rsp, 0x40
pop rbx
ret

Function at 0x140003f90
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14003a0c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
mov rax, rcx
mov dword [rsp + 0x34], 4
and eax, 0xfffffff
cmp rax, 7
jb 0x140003fd3
mov r9d, 0xfffffff0
mov rax, rcx
and rax, r9
mov r9d, 0x80000000
cmp rax, r9
je 0x14000401b
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000401b
cmp dword [rsp + 0x30], 4
sete al
test al, al
setne al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140011e80
add rsp, 0x48
ret
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140011e80
add rsp, 0x48
ret
Function at 0x140004260
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14003a0c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
lea eax, [r9 + r9]
movzx ebx, byte [rsp + 0x70]
mov dword [rsp + 0x34], eax
inc ebx
mov rax, rcx
and eax, 0xfffffff
cmp rax, 7
jb 0x1400042ac
mov r9d, 0xfffffff0
mov rax, rcx
and rax, r9
mov r9d, 0x80000000
cmp rax, r9
je 0x1400042ff
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400042ff
cmp ebx, dword [rsp + 0x30]
sete al
test al, al
je 0x1400042ff
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x1400042ff
shr eax, 1
dec eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140011e80
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140011e80
add rsp, 0x40
pop rbx
ret

Function at 0x140004450
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14003a0c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r10, qword [rcx]
mov r11, rdx
mov rdx, r10
mov dword [rsp + 0x30], r8d
and edx, 0xfffffff
mov r9, rcx
cmp rdx, 7
jb 0x140004495
mov edx, 0xfffffff0
mov rcx, r10
and rcx, rdx
mov edx, 0x80000000
cmp rcx, rdx
je 0x1400044da
cmp byte [r9 + 0xc], 0
je 0x1400044da
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r11
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140011e80
add rsp, 0x48
ret
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140011e80
add rsp, 0x48
ret

Function at 0x1400044f0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor r10d, r10d
mov r11, r9
mov rbx, rcx
mov rax, r9
test r9, r9
je 0x14000451d
cmp word [r9], r10w
je 0x14000451d
nop dword [rax]
lea rax, [rax + 2]
inc r10
cmp word [rax], 0
jne 0x140004510
and ecx, 0xfffffff
cmp rcx, 7
jb 0x140004540
mov r9d, 0xfffffff0
mov rcx, rbx
and rcx, r9
mov r9d, 0x80000000
cmp rcx, r9
je 0x140004575
test rdx, rdx
je 0x140004575
cmp word [rdx], 0
je 0x140004575
movzx r9d, byte [rsp + 0x60]
lea eax, [r10 + r10]
mov dword [rsp + 0x28], eax
inc r9d
mov rcx, rbx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
sete al
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x140004580
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [rcx]
xor r10d, r10d
mov r11, r9
mov rax, r9
test r9, r9
je 0x1400045ad
cmp word [r9], r10w
je 0x1400045ad
nop dword [rax]
lea rax, [rax + 2]
inc r10
cmp word [rax], 0
jne 0x1400045a0
mov rcx, rbx
and ecx, 0xfffffff
cmp rcx, 7
jb 0x1400045d3
mov r9d, 0xfffffff0
mov rcx, rbx
and rcx, r9
mov r9d, 0x80000000
cmp rcx, r9
je 0x140004608
test rdx, rdx
je 0x140004608
cmp word [rdx], 0
je 0x140004608
movzx r9d, byte [rsp + 0x60]
lea eax, [r10 + r10]
mov dword [rsp + 0x28], eax
inc r9d
mov rcx, rbx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
sete al
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x140004610
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
mov r11, rcx
mov r10, r8
test r8, r8
je 0x140004643
cmp word [r8], ax
je 0x140004643
nop dword [rax]
lea r10, [r10 + 2]
inc rax
cmp word [r10], 0
jne 0x140004630
mov rdx, rax
jmp 0x140004651
mov rdx, rax
test r8, r8
je 0x14000465e
cmp word [r8], ax
je 0x14000465e
test rax, rax
je 0x14000465e
lea rdx, [rax*2 + 2]
mov r10, qword [rcx]
mov rcx, r10
movzx r9d, r9b
and ecx, 0xfffffff
inc r9d
cmp rcx, 7
jb 0x140004696
mov qword [rsp + 0x48], rdi
mov rcx, r10
mov edi, 0xfffffff0
and rcx, rdi
mov edi, 0x80000000
cmp rcx, rdi
mov rdi, qword [rsp + 0x48]
je 0x1400046c0
cmp byte [r11 + 0xc], 0
je 0x1400046c0
mov dword [rsp + 0x28], edx
mov rcx, r10
mov qword [rsp + 0x20], r8
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x1400046d0
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14003a0c0]
xor rax, rsp
mov qword [rbp + 0x37], rax
movzx edi, dl
xor r14d, r14d
mov qword [rbp - 9], r14
mov rdx, qword [rcx + 8]
test rdx, rdx
je 0x140004717
cmp qword [rcx + 0x10], r14
ja 0x14000471a
mov rdx, r14
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400048a4
test dil, dil
je 0x14000488c
mov qword [rbp - 1], r14
mov qword [rsp + 0x40], r14
lea rax, [rbp - 1]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.TreatAs
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x140004877
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
lea r15, [0x14002e968]
mov qword [rbp + 7], r15
mov rdi, r14
mov qword [rbp + 0xf], r14
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], 0x104
mov word [rbp + 0x2f], r14w
lea rsi, str.BAE3934B_8A6A_4BFB_81BD_3FC599A1BAF1
mov rax, rsi
mov rbx, r14
lea rax, [rax + 2]
inc rbx
cmp word [rax], di
jne 0x1400047d4
mov r8, r14
mov qword [rbp + 0x17], r14
test rbx, rbx
je 0x14000482b
mov rdx, rbx
lea rcx, [rbp + 7]
call fcn.1400031f0
mov r8, rbx
mov qword [rbp + 0x17], rbx
mov rdi, qword [rbp + 0xf]
mov rcx, rdi
sub rsi, rdi
mov rdx, rbx
nop dword [rax]
movzx eax, word [rcx + rsi]
mov word [rcx], ax
lea rcx, [rcx + 2]
sub rdx, 1
jne 0x140004810
test rdi, rdi
je 0x14000482b
mov word [rdi + rbx*2], r14w
mov rax, r14
test rdi, rdi
cmovne rax, r8
lea ecx, [rax + rax]
je 0x140004842
test r8, r8
mov rax, rdi
jne 0x140004845
mov rax, r14
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov qword [rbp + 7], r15
test rdi, rdi
je 0x140004877
mov rcx, rdi
call fcn.1400119f8
nop
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x1400048a4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 1], r14
jmp 0x1400048a4
xor r9d, r9d
xor r8d, r8d
lea rdx, str.TreatAs
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
nop
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400048b7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 9], r14
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140011e80
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400124b4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400124fe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400124fe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400124fe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400124fe
cmp dword [rcx + 0x84], 0xe
jbe 0x1400124fe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140012500
xor al, al
add rsp, 0x28
ret
Function at 0x1400217d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea rdx, [rcx + 9]
movabs rax, 0xcbf29ce484222325
movzx ecx, byte [rdx]
test cl, cl
je 0x140021805
movabs r8, 0x100000001b3
nop
movzx ecx, cl
lea rdx, [rdx + 1]
xor rax, rcx
movzx ecx, byte [rdx]
imul rax, r8
test cl, cl
jne 0x1400217f0
mov rcx, rax
shr rcx, 0x20
xor rax, rcx
ret

Function at 0x140027b50
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x14003a0c0]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140027b8c
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.140012310
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140027c48
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x140027cae
test ebx, ebx
jne 0x140027cae
lea ecx, [rax + 2]
call fcn.140012310
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.140011e80
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x1400281c0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
mov dword [rsp + 0x60], 0
xor ecx, ecx
mov dword [rsp + 0x68], 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140028222
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140028222
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
jne 0x140028222
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x140028222
cmp dword [rdx + 0x84], 0xe
jbe 0x140028222
cmp dword [rdx + 0xf8], 0
je 0x140028222
mov ecx, ebx
call fcn.140028080
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x14003af38]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.140027f00
cmp dword [rsp + 0x60], 0
jne 0x140028265
mov ecx, ebx
call fcn.140028030
int3
add rsp, 0x40
pop rbx
ret

Function at 0x1400282b0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002830c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002830c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002830c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002830c
cmp dword [rcx + 0x84], 0xe
jbe 0x14002830c
cmp dword [rcx + 0xf8], 0
je 0x14002830c
mov ecx, ebx
call fcn.140028080
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x14003af38]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.140027f00
cmp dword [rsp + 0x60], 0
jne 0x14002834f
mov ecx, ebx
call fcn.140028030
int3
add rsp, 0x40
pop rbx
ret
Function at 0x14002c2d2
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
lea rdi, [0x14002c24e]
mov rcx, qword [rdi + 0x1c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, rax
mov ecx, dword [rdi + 0x6c]
mov r14, qword [rsi + 0x2e5e0]
call r14
mov r12, rax
xor ecx, ecx
mov rdx, r12
loop 0x14002c356
mov eax, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, r12
call fcn.14002c422
mov r12, qword [rdi + 4]
mov r13, rax
cmp dword [r12], 0
je 0x14002c36c
mov rcx, r13
call fcn.14002c446
movzx eax, al
cmp al, byte [r12]
je 0x14002c352
cmp al, byte [r12 + 1]
jne 0x14002c417
mov rcx, r13
call fcn.14002c45a
cmp eax, dword [r12 + 4]
je 0x14002c36c
cmp eax, dword [r12 + 8]
jne 0x14002c417
mov ecx, dword [rdi + 0x6c]
mov dword [rsp + 0x20], 0
call r14
mov rdx, rax
xor r9d, r9d
mov rax, qword [rdi + 0x3c]
mov r8d, dword [rax + r9]
mov dword [r9 + rdx], r8d
add r9, 4
cmp r9, 0x40
jl 0x14002c380
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test r13, r13
je 0x14002c417
mov r12, qword [rdi + 0x7c]
mov rcx, r12
mov edx, 0x7000
lea r9, [rsp + 0x20]
mov r8d, dword [rdi + 0x58]
call r13
mov eax, dword [rdi + 0x5c]
push 8
pop rdx
add rsi, rax
mov r8d, dword [rsi + 4]
mov eax, dword [rdx + rsi]
add eax, r8d
mov dword [rdx + r12], eax
add rdx, 4
cmp rdx, 0x7000
jl 0x14002c3cc
mov eax, dword [rdi + 0x54]
mov rcx, r12
mov dword [r12 + 8], eax
mov edx, 0x7000
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
call r13
mov eax, dword [rdi]
mov edi, dword [rdi]
mov edx, dword [r12 + 0xc]
add rdx, r12
add r12, rdi
add rdx, rax
mov rcx, r12
call rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]