joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003fdb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov r15, qword [rdx + 0x18]
mov rdi, rdx
mov r9, rcx
mov r8, rdx
cmp r15, 0xf
jbe 0x14003fdd8
mov r8, qword [rdx]
mov rsi, qword [rdi + 0x10]
xor ebp, ebp
movabs rdx, 0xcbf29ce484222325
mov ecx, ebp
test rsi, rsi
je 0x14003fe14
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, r10
cmp rcx, rsi
jb 0x14003fe00
mov rcx, qword [r9 + 0x30]
mov rax, qword [r9 + 0x18]
and rcx, rdx
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r9 + 8]
jne 0x14003fe32
mov rbx, rbp
jmp 0x14003fe80
mov qword [rsp + 0x40], r14
mov r14, qword [rax + rcx*8]
nop dword [rax + rax]
cmp qword [rbx + 0x28], 0xf
lea rdx, [rbx + 0x10]
jbe 0x14003fe4f
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
cmp r15, 0xf
jbe 0x14003fe5b
mov rcx, qword [rdi]
cmp rsi, qword [rbx + 0x20]
jne 0x14003fe6d
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14003fe7b
cmp rbx, r14
je 0x14003fe78
mov rbx, qword [rbx + 8]
jmp 0x14003fe40
mov rbx, rbp
mov r14, qword [rsp + 0x40]
test rbx, rbx
mov rbx, qword [rsp + 0x48]
setne bpl
mov rax, rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x140047d30
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140047df5
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140047df5
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140047e0e
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x140047de5
cmp byte [rcx], 0x5c
jne 0x140047dde
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x140047dde
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140047dcc
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x140047ddb
test r8b, 0x10
jne 0x140047dde
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x140047dde
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.140044250
test edi, edi
jne 0x140047d50
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140044240
int3
Function at 0x14004d838
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004d882
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004d882
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004d882
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004d882
cmp dword [rcx + 0x84], 0xe
jbe 0x14004d882
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004d884
xor al, al
add rsp, 0x28
ret

Function at 0x141e96058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141e961df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141e96089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141e9606f
add dl, dl
jne 0x141e96096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141e960f6
xor eax, eax
add dl, dl
jne 0x141e960a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141e961ad
add dl, dl
jne 0x141e960b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e960c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e960d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e960dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141e960ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141e9607e
mov eax, 1
add dl, dl
jne 0x141e96106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e96113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141e960fb
sub eax, ebx
mov ebx, 1
jne 0x141e9614c
mov ecx, 1
add dl, dl
jne 0x141e9612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141e9613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141e96123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141e9607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141e96168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141e96175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141e9615d
cmp eax, 0x7d00
jae 0x141e9619b
cmp eax, 0x500
jb 0x141e96196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141e9607e
cmp eax, 0x7f
ja 0x141e9619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141e9607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141e961d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141e9607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x143111058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1431111df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x143111089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14311106f
add dl, dl
jne 0x143111096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1431110f6
xor eax, eax
add dl, dl
jne 0x1431110a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1431111ad
add dl, dl
jne 0x1431110b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1431110c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1431110d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1431110dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1431110ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14311107e
mov eax, 1
add dl, dl
jne 0x143111106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x143111113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1431110fb
sub eax, ebx
mov ebx, 1
jne 0x14311114c
mov ecx, 1
add dl, dl
jne 0x14311112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14311113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x143111123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14311107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x143111168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x143111175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14311115d
cmp eax, 0x7d00
jae 0x14311119b
cmp eax, 0x500
jb 0x143111196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14311107e
cmp eax, 0x7f
ja 0x14311119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14311107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1431111d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14311107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000230c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002356
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002356
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002356
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002356
cmp dword [rcx + 0x84], 0xe
jbe 0x140002356
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002358
xor al, al
add rsp, 0x28
ret
Function at 0x140008b90
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140084220]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.140028930
lea rdx, [rsp + 0x20]
lea rcx, str._SYSTEMDRIVE_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, 0x104
jbe 0x140008bee
xor al, al
jmp 0x140008c3d
test rbx, rbx
je 0x140008bf7
lea rdi, [rbx + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400074d0
lea rdx, str.Intel
mov rcx, rax
call fcn.1400074d0
lea rdx, str.Logs
mov rcx, rax
call fcn.1400074d0
lea rdx, str.IntelCpHDCPSvc.log
mov rcx, rax
call fcn.1400074d0
xor edx, edx
mov rcx, rax
call fcn.14000c170
mov al, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140028900
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret

Function at 0x140008f00
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140084220]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x140009065
cmp byte [rcx + 0x82], 0
je 0x140009065
mov rax, qword [rcx]
mov ebx, 0xffff
mov edx, ebx
call qword [rax + 0x18]
cmp bx, ax
jne 0x140008f5b
xor al, al
jmp 0x140009067
mov qword [rsp + 0x58], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rsp + 0x40]
call fcn.14000a450
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x40]
cmovae r8, qword [rsp + 0x40]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rsp + 0x50]
add r9, rdx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x140008fce
dec eax
jne 0x140009043
jmp 0x140008fd5
mov byte [rdi + 0x82], 0
lea rax, [rsp + 0x40]
mov r9, qword [rsp + 0x40]
mov r10, qword [rsp + 0x58]
cmp r10, 0x10
cmovae rax, r9
mov rbx, qword [rsp + 0x38]
sub rbx, rax
je 0x14000901c
lea rcx, [rsp + 0x40]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call fcn.140029368
cmp rbx, rax
jne 0x140009048
cmp byte [rdi + 0x82], 0
je 0x14000904c
test rbx, rbx
jne 0x140008f84
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rsp + 0x40]
call fcn.14000a330
jmp 0x140008f84
sub eax, 2
je 0x14000904c
xor bl, bl
jmp 0x14000904e
mov bl, 1
cmp qword [rsp + 0x58], 0x10
jb 0x140009060
mov rcx, qword [rsp + 0x40]
call fcn.14002757c
movzx eax, bl
jmp 0x140009067
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140028900
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000be50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rax, qword [0x140084220]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r14d, dx
mov rbx, rcx
mov esi, 0xffff
cmp si, dx
jne 0x14000be9a
xor eax, eax
jmp 0x14000c068
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14000bed7
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x14000bed7
lea ecx, [r9 - 1]
mov dword [rax], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], r14w
movzx eax, r14w
jmp 0x14000c068
cmp qword [rcx + 0x90], 0
je 0x14000c065
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x80]
cmp qword [r8], rax
jne 0x14000bf13
mov rdx, qword [rcx + 0x70]
mov rcx, qword [rcx + 0x68]
mov qword [r8], rcx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
sub rdx, rcx
sar rdx, 1
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp qword [rbx + 0x78], 0
jne 0x14000bf3c
mov rdx, qword [rbx + 0x90]
movzx ecx, r14w
call fcn.140029ae4
cmp ax, si
je 0x14000c065
movzx esi, r14w
jmp 0x14000c065
mov word [rbp - 1], r14w
mov qword [rbp + 0x1f], reloc.OLEAUT32.dll_SafeArrayDestroy
xor eax, eax
mov qword [rbp + 0x17], rax
mov byte [rbp + 7], al
xor r8d, r8d
lea edx, [rax + 8]
lea rcx, [rbp + 7]
call fcn.14000a450
nop
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdx, qword [rbp + 7]
lea r8, [rbp + 7]
cmovae r8, qword [rbp + 7]
mov rcx, qword [rbx + 0x78]
mov r10, qword [rcx]
add rdx, qword [rbp + 0x17]
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 1]
lea r8, [rbp - 1]
lea rdx, [rbx + 0x84]
call qword [r10 + 0x38]
test eax, eax
js 0x14000c055
cmp eax, 1
jg 0x14000c037
lea rax, [rbp + 7]
mov r9, qword [rbp + 7]
mov r10, qword [rbp + 0x1f]
cmp r10, 0x10
cmovae rax, r9
mov rdi, qword [rbp - 9]
sub rdi, rax
je 0x14000c002
lea rcx, [rbp + 7]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rbx + 0x90]
mov r8, rdi
mov edx, 1
call fcn.140029368
cmp rdi, rax
jne 0x14000c055
mov byte [rbx + 0x82], 1
lea rax, [rbp - 1]
cmp qword [rbp - 0x11], rax
jne 0x14000c051
test rdi, rdi
jne 0x14000bf62
cmp qword [rbp + 0x17], 0x20
jae 0x14000c055
xor r8d, r8d
lea edx, [rdi + 8]
lea rcx, [rbp + 7]
call fcn.14000a330
jmp 0x14000bf62
cmp eax, 3
jne 0x14000c055
mov rdx, qword [rbx + 0x90]
movzx ecx, word [rbp - 1]
call fcn.140029ae4
cmp ax, si
je 0x14000c055
movzx esi, r14w
cmp qword [rbp + 0x1f], 0x10
jb 0x14000c065
mov rcx, qword [rbp + 7]
call fcn.14002757c
movzx eax, si
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140028900
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000e7f0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14000e81e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140011950
cmp byte [0x1400882f0], 0
jne 0x14000e869
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000e859
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1400882f0], 1
mov qword [0x1400882e8], rax
jmp 0x14000e870
mov rax, qword [0x1400882e8]
mov byte [0x1400882f0], 1
jmp 0x14000e870
mov rax, qword [0x1400882e8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000e88f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400119c4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x1400119df
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x1400119df
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x1400119df
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
jmp 0x1400e3989
scasb al, byte [rdi]
adc eax, 0x33bfb6a0
jl 0x1400e39b4
jo 0x1400e39e9
pop rdx
mov al, reloc.OLEAUT32.dll_SafeArrayAccessData
cmp ch, 0x63
invalid
test byte [rsp + rdi*2], bh
cmp ebp, dword [rdi + rbp*8 - 0x8e93f3e]
enter 0xffffffffffffb83c, 0xfffffffffffffffe
push rbx
invalid
out dx, eax
ret 0x16c0
div eax
mov ebx, 0x4abcf27b
cmpsb byte [rsi], byte [rdi]
fprem
pop rdi
call qword [rsi]
popfq
or eax, 0x97d4febe
cdq
push rbx
sar byte [rbp + rsi - 0x6291dc7f], 1
loopne 0x1400e39af
jle 0x1400e39e6
pop rbp
pop rcx
jae 0x1400e3a57
mov eax, edi
invalid
scasd eax, dword [rdi]
invalid
Function at 0x14000f910
Capabilities:
Create service

Disassembly:
push rdi
sub rsp, 0xa90
mov rax, qword [0x140084220]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rdi, rcx
call fcn.14000fbf0
test eax, eax
je 0x14000f941
mov eax, 1
jmp 0x14000fa48
lea rdx, [rsp + 0x72]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000fb3e
cmp eax, 0x104
je 0x14000fb3e
lea ecx, [rax + 1]
mov r8d, 0x22
mov word [rsp + 0x70], r8w
mov word [rsp + rcx*2 + 0x70], r8w
lea ecx, [rax + 2]
add rcx, rcx
cmp rcx, 0x20c
jae 0x14000fb87
mov qword [rsp + 0xaa8], rbx
mov qword [rsp + 0xab0], rsi
xor esi, esi
mov word [rsp + rcx + 0x70], si
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14000fa61
lea rdx, [rsp + 0x280]
mov r8d, 0x400
mov ecx, 0xd80a
call fcn.14000d9a0
test eax, eax
jne 0x14000fa1f
lea r8, str.Could_not_open_Service_Manager
lea rcx, [rsp + 0x280]
mov edx, 0x400
call fcn.14002a988
test eax, eax
je 0x14000fa1f
cmp eax, 0xc
je 0x14000fb5b
cmp eax, 0x16
je 0x14000fb50
cmp eax, 0x22
je 0x14000fb50
cmp eax, 0x50
jne 0x14000fb45
lea r8, [rdi + 0x68]
xor r9d, r9d
lea rdx, [rsp + 0x280]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rbx, qword [rsp + 0xaa8]
mov rsi, qword [rsp + 0xab0]
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.140028900
add rsp, 0xa90
pop rdi
ret
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
lea rax, str.RPCSS
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x70]
add rdi, 0x68
mov r9d, 0xf01ff
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov r8, rdi
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x14000fb22
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rsp + 0x280]
mov r8d, 0x400
mov ecx, 0xd80b
call fcn.14000d9a0
test eax, eax
jne 0x14000fb17
lea r8, str.Could_not_start_service
lea rcx, [rsp + 0x280]
mov edx, 0x400
call fcn.14002a988
test eax, eax
je 0x14000fb17
cmp eax, 0xc
je 0x14000fb7c
cmp eax, 0x16
je 0x14000fb71
cmp eax, 0x22
je 0x14000fb71
cmp eax, 0x50
jne 0x14000fb66
xor r9d, r9d
mov r8, rdi
jmp 0x14000fa26
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x14000fa38
xor eax, eax
jmp 0x14000fa48
mov ecx, 0x80004005
call fcn.140003230
int3
mov ecx, 0x80070057
call fcn.140003230
int3
mov ecx, 0x8007000e
call fcn.140003230
int3
mov ecx, 0x80004005
call fcn.140003230
int3
mov ecx, 0x80070057
call fcn.140003230
int3
mov ecx, 0x8007000e
call fcn.140003230
int3
call fcn.14002a708
int3
Function at 0x1400116b0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140084220]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor eax, eax
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
or r9d, 0x2001f
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x50], rbp
call fcn.14000ffc0
mov ebx, eax
test eax, eax
jne 0x1400117d7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400117b1
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.1400116b0
mov ebx, eax
test eax, eax
jne 0x1400117d7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140011760
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400117c6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x48], ebp
call fcn.14000e7f0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400117e7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140028900
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140011950
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14000e81e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140011950
cmp byte [0x1400882f0], 0
jne 0x14000e869
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000e859
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x1400882f0], 1
mov qword [0x1400882e8], rax
jmp 0x14000e870
mov rax, qword [0x1400882e8]
mov byte [0x1400882f0], 1
jmp 0x14000e870
mov rax, qword [0x1400882e8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000e88f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400119c4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x1400119df
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x1400119df
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x1400119df
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
jmp 0x1400e3989
scasb al, byte [rdi]
adc eax, 0x33bfb6a0
jl 0x1400e39b4
jo 0x1400e39e9
pop rdx
mov al, reloc.OLEAUT32.dll_SafeArrayAccessData
cmp ch, 0x63
invalid
test byte [rsp + rdi*2], bh
cmp ebp, dword [rdi + rbp*8 - 0x8e93f3e]
enter 0xffffffffffffb83c, 0xfffffffffffffffe
push rbx
invalid
out dx, eax
ret 0x16c0
div eax
mov ebx, 0x4abcf27b
cmpsb byte [rsi], byte [rdi]
fprem
pop rdi
call qword [rsi]
popfq
or eax, 0x97d4febe
cdq
push rbx
sar byte [rbp + rsi - 0x6291dc7f], 1
loopne 0x1400e39af
jle 0x1400e39e6
pop rbp
pop rcx
jae 0x1400e3a57
mov eax, edi
invalid
scasd eax, dword [rdi]
invalid