joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cc8c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x14000cca9
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14000cd01
cmp qword [rcx + rdx*8], r8
jne 0x14000ccf6
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14000ccfa
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14000cd0e
cmp qword [rcx + rdx*8], r8
jne 0x14000cd0e
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.140018814
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000cd40
Capabilities:
Create service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x14002d670]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000cd9b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rdx, str.Failed_InstallService
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140008768
jmp 0x14000ce6c
mov ebx, 3
xor edx, edx
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14000cdc4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rdx, str.Failed_OpenSCManager
jmp 0x14000cd83
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x70]
and qword [rsp + 0x58], 0
lea r8, str.Remediates_Windows_Update_Components
and qword [rsp + 0x50], 0
lea rdx, str.Windows_Remediation_Service
and qword [rsp + 0x48], 0
mov r9d, 4
and qword [rsp + 0x40], 0
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CreateServiceW]
mov rbx, rax
test rax, rax
jne 0x14000ce47
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
lea rdx, str.Failed_CreateService
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140008768
jmp 0x14000ce55
lea rdx, str.Installed_service
xor ecx, ecx
call fcn.140008980
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test rbx, rbx
je 0x14000ce6c
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140018830
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret
Function at 0x14000ce90
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
sub rsp, 0x50
mov rax, qword [0x14002d670]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
xor edx, edx
mov qword [r11 - 0x38], rax
xor ecx, ecx
mov qword [r11 - 0x30], rax
mov ebp, 0xe10
mov qword [r11 - 0x28], rax
lea r8d, [rax + 1]
mov dword [rsp + 0x38], eax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14000cf01
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
lea rdx, str.Failed_OpenSCManager
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140008768
jmp 0x14000d01e
mov r8d, 0x10024
lea rdx, str.Windows_Remediation_Service
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000cf44
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rdx, str.Failed_OpenService
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140008768
jmp 0x14000d007
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x14000cfda
lea rdx, str.Stopping_service
xor ecx, ecx
call fcn.140008980
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000cf8f
mov eax, dword [rsp + 0x24]
cmp eax, 3
jne 0x14000cfa5
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
sub ebp, 1
je 0x14000cfa1
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
jne 0x14000cf76
mov eax, dword [rsp + 0x24]
cmp eax, 1
jne 0x14000cfba
lea rdx, str.Service_stopped
xor ecx, ecx
call fcn.140008980
jmp 0x14000cfda
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
lea rdx, str.Stop_service_failed
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140008768
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
test eax, eax
jne 0x14000cff9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rdx, str.Failed_to_delete_service
jmp 0x14000cf2c
lea rdx, str.Service_removed
xor ecx, ecx
call fcn.140008980
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test rbx, rbx
je 0x14000d01e
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140018830
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
Function at 0x140010c04
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [rcx + 0x20]
lea r8, str.RefreshAfter
xor eax, eax
mov dword [rbp + 0x38], 8
mov qword [rbp - 0x10], rax
mov rsi, rcx
mov rcx, qword [rcx + 0x70]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x30], rax
xor r14d, r14d
lea rax, [rbp - 0x10]
xor edi, edi
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rdi
lea r9d, [r14 + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0x140010c69
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
cmp edi, 0x80070002
jne 0x140010c77
xor edi, edi
xor ebx, ebx
jmp 0x140010cc3
test edi, edi
js 0x140010ca5
xor eax, eax
lea rcx, [rbp + 0x40]
mov qword [rbp + 0x40], rax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
mov eax, dword [rbp + 0x44]
mov dword [rbp + 0x4c], eax
mov eax, dword [rbp + 0x40]
mov dword [rbp + 0x48], eax
mov rax, qword [rbp - 0x10]
cmp qword [rbp + 0x48], rax
seta r14b
xor edi, edi
mov ebx, edi
test edi, edi
jns 0x140010cb9
lea rdx, str.OneSettings_IsTimeToRequery_failed
mov ecx, edi
call fcn.140008768
cmp r14d, 1
jne 0x140010d49
lea rdx, str.OneSettings_requery_is_TRUE
mov ecx, edi
call fcn.140008980
test edi, edi
js 0x140010d4e
cmp qword [rsi + 0x78], 0
je 0x140010cf0
cmp qword [rsi + 0x80], 0
je 0x140010cf0
cmp qword [rsi + 0x88], 0
jne 0x140010d0a
mov rdx, qword [rsi]
mov rcx, rsi
call fcn.140011328
mov ebx, eax
test eax, eax
jns 0x140010d0a
lea rdx, str.OneSettings_OpenWebRequest_failed
jmp 0x140010d20
mov rcx, rsi
call fcn.140011c04
mov ebx, eax
cmp eax, 1
jbe 0x140010d29
lea rdx, str.OneSettings_GetCloudSettings_failed
mov ecx, eax
call fcn.140008768
jmp 0x140010d4e
mov rcx, rsi
call fcn.140012148
mov ebx, eax
test eax, eax
jns 0x140010d4e
lea rdx, str.OneSettings_UpdateNextRefreshTime_failed
mov ecx, eax
call fcn.140008768
xor ebx, ebx
jmp 0x140010d4e
mov ebx, 1
mov rcx, rsi
call fcn.140012ba0
mov eax, ebx
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140011328
Capabilities:
Initialize winhttp library
Prepare http request

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
mov eax, 0x1050
call fcn.140019980
sub rsp, rax
mov rax, qword [0x14002d670]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
call fcn.1400122f8
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x1000
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, qword [rdi + 0x18]
xor r9d, r9d
and dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rdi + 0x78], rax
mov r14d, 0x80070000
test rax, rax
jne 0x1400113b7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
mov ebx, 0x80004005
or ecx, r14d
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovs ebx, ecx
test ebx, ebx
js 0x1400114b5
mov rcx, qword [rdi + 0x78]
mov edx, 0x2710
mov r9d, edx
mov dword [rsp + 0x20], edx
mov r8d, edx
call qword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
test eax, eax
jne 0x1400113ef
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
mov ebx, 0x80004005
or ecx, r14d
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovs ebx, ecx
test ebx, ebx
js 0x1400114b5
mov rcx, qword [rdi + 0x78]
mov r8d, 0x1bb
xor r9d, r9d
mov rdx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rdi + 0x80], rax
test rax, rax
jne 0x140011434
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
mov ebx, 0x80004005
or ecx, r14d
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovs ebx, ecx
test ebx, ebx
js 0x1400114b5
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400114dc
lea r8, [rsp + 0x40]
xor ecx, ecx
lea rdx, str.The_following_query_string_will_be_used:__s
mov ebx, eax
call fcn.140008980
test ebx, ebx
js 0x1400114b5
mov rcx, qword [rdi + 0x80]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x30], 0x800000
lea rdx, [0x14001fd98]
and qword [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rdi + 0x88], rax
test rax, rax
jne 0x1400114b5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
mov ebx, 0x80004005
or ecx, r14d
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovs ebx, ecx
mov eax, ebx
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140018830
mov rbx, qword [rsp + 0x1080]
add rsp, 0x1050
pop r14
pop rdi
pop rsi
ret
Function at 0x1400135e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov r15, r9
lea rax, [rbp + 0x30]
xor edi, edi
mov qword [r11 - 0x38], rax
xor ebx, ebx
lea rdx, str.SOFTWAREMicrosoftReliability_AnalysisRAC
and qword [rbp + 0x30], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea r9d, [rdi + 1]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov r14d, 0x80070000
test eax, eax
jne 0x140013670
xor esi, esi
mov rdi, qword [rbp + 0x30]
and qword [rbp + 0x30], rbx
mov ecx, esi
call fcn.1400091f4
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140013665
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
and qword [rbp + 0x30], rbx
test esi, esi
jns 0x140013688
mov ecx, esi
jmp 0x140013743
movzx esi, ax
or esi, r14d
test eax, eax
cmovle esi, eax
test esi, esi
je 0x140013643
mov ecx, esi
call fcn.1400091d8
jmp 0x14001364b
and dword [rbp + 0x40], ebx
lea rax, [rbp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x38]
lea rdx, str.RacSampleNumber
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x1400136c3
movzx esi, ax
or esi, r14d
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x140013669
test rbx, rbx
jne 0x140013701
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x1400136f7
mov ebx, eax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x14001368b
mov esi, 0x8007000e
jmp 0x140013669
mov esi, 0x8000ffff
jmp 0x140013669
cmp dword [rbp + 0x38], 4
je 0x140013711
mov esi, 0x8007000d
jmp 0x140013669
xor r14d, r14d
cmp dword [rbp + 0x40], 4
je 0x14001372b
mov esi, 0x8007000d
mov ecx, esi
mov r14d, esi
call fcn.1400091d8
jmp 0x140013730
mov eax, dword [rbx]
mov dword [r15], eax
mov ecx, r14d
call fcn.1400091f4
mov esi, r14d
test r14d, r14d
jns 0x140013748
mov ecx, r14d
call fcn.1400091d8
mov ecx, esi
call fcn.1400091f4
test rbx, rbx
je 0x140013768
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test rdi, rdi
je 0x140013776
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140232fe0
Capabilities:
Check mutex on windows
Get hostname

Disassembly:
push rsi
sub rsp, 0x240
mov esi, ecx
mov dword [rsp + 0x24], 0x104
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
call fcn.1402fe0d0
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r8, [rsp + 0x30]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1402360c8
jmp 0x1402360d9
cmp esi, 0x60412da5
jae 0x140233b10
jmp 0x140234093

Function at 0x14027bc20
Capabilities:
Set current directory

Disassembly:
push rsi
sub rsp, 0x170
mov rsi, rcx
mov qword [rsp + 0x58], rsi
xor ecx, ecx
call fcn.140232810
mov ecx, eax
call fcn.140300cd0
mov rax, qword [str.P:HfrefChoyvpQbjaybnqf_]
mov qword [rsp + 0x30], rax
mov rax, qword [0x1403124a8]
mov qword [rsp + 0x38], rax
mov rax, qword [0x1403124b0]
mov qword [rsp + 0x40], rax
mov ax, word [0x1403124b8]
mov word [rsp + 0x48], ax
mov al, byte [0x1403124ba]
mov byte [rsp + 0x4a], al
lea rcx, [rsp + 0x30]
call fcn.140301790
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.14027bb60
mov rcx, rsi
mov edx, 0x104
mov r8, rax
call fcn.1402fcdd0
mov rcx, rsi
add rcx, 0x104
mov edx, 8
call fcn.14027bac0
mov rcx, rsi
add rcx, 0x10d
mov edx, 8
call fcn.14027bac0
mov rax, rsi
add rax, 0x10d
mov rdx, rsi
add rdx, 0x104
mov rcx, rsi
add rcx, 0x116
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, str._s_s_s.exe
mov edx, 0x104
mov r9, rsi
call fcn.1402fcdd0
mov rax, rsi
add rax, 0x10d
mov rdx, rsi
add rdx, 0x104
mov rcx, rsi
add rcx, 0x116
add rcx, 0x104
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, str._s_s_s.dat
mov edx, 0x104
mov r9, rsi
call fcn.1402fcdd0
mov rax, rsi
add rax, 0x104
mov rcx, rsi
add rcx, 0x116
add rcx, 0x208
mov qword [rsp + 0x20], rax
lea r8, str._s_sedge.xml
mov edx, 0x104
mov r9, rsi
call fcn.1402fcdd0
mov rax, rsi
add rax, 0x104
mov rcx, rsi
add rcx, 0x116
add rcx, 0x30c
mov qword [rsp + 0x20], rax
lea r8, str._s_sedge.jpg
mov edx, 0x104
mov r9, rsi
call fcn.1402fcdd0
mov rax, rsi
add rax, 0x104
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r8, str._s_s_
mov edx, 0x104
mov r9, rsi
call fcn.1402fcdd0
lea rcx, [rsp + 0x60]
call fcn.140301a50
cmp eax, 0
je 0x14027bdeb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x14027bdf6
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rax, rsi
add rsp, 0x170
pop rsi
ret
Function at 0x14027be10
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x88
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x48], 4
lea rcx, [rsp + 0x50]
lea rdx, [0x1403124c0]
mov r8d, 0x2a
call fcn.1402fda30
lea rcx, [rsp + 0x50]
call fcn.140301790
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.14027bb60
lea r10, [rsp + 0x40]
mov rcx, 0xffffffff80000001
mov rdx, rax
xor r8d, r8d
mov r9d, 1
mov qword [rsp + 0x20], r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 0
jne 0x14027bed6
lea r10, [rsp + 0x4c]
mov rcx, qword [rsp + 0x40]
lea rdx, str.IsStatus
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0
jne 0x14027becb
cmp dword [rsp + 0x3c], 4
jne 0x14027bec9
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
call fcn.140301608
jmp 0x14027becb
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x88
ret

Function at 0x14027bee0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0xa8
lea rax, str.IsStatus
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x5c], 1
lea rcx, [rsp + 0x70]
lea rdx, str.FbsgjnerZvpebfbsgVagrearg_RkcybereZnva
mov r8d, 0x2a
call fcn.1402fda30
lea rcx, [rsp + 0x70]
call fcn.140301790
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.14027bb60
lea r10, [rsp + 0x50]
mov rcx, 0xffffffff80000001
mov rdx, rax
xor r8d, r8d
mov r9d, 0x20006
mov qword [rsp + 0x20], r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 0
jne 0x14027bfa9
lea rax, [rsp + 0x5c]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov r9d, 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 0
jne 0x14027bf99
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x58], 1
jmp 0x14027c062
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14027c05a
lea rcx, [rsp + 0x70]
call fcn.140301790
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.14027bb60
lea r10, [rsp + 0x50]
lea r11, [rsp + 0x6c]
mov rcx, 0xffffffff80000001
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x20006
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, 0
jne 0x14027c058
lea rax, [rsp + 0x5c]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov r9d, 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 0
jne 0x14027c04d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x58], 1
jmp 0x14027c062
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14027c05a
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
add rsp, 0xa8
ret
Function at 0x14027c070
Capabilities:
Enumerate processes

Disassembly:
push rsi
sub rsp, 0x170
mov esi, edx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x28], 0
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x30], rax
mov rax, 0xffffffffffffffff
cmp rax, qword [rsp + 0x30]
je 0x1402913ed
jmp 0x1402913fe
cmp esi, 0x76ffea15
jae 0x1402833ce
jmp 0x140283203
cmp esi, 0x47bdcb08
jae 0x140283214
jmp 0x14027e121
Function at 0x1402e1530
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x44], 0
mov rcx, qword [rsp + 0x50]
mov edx, 0xc0000000
mov r8d, 3
xor r9d, r9d
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x68
ret

Function at 0x1402e1820
Capabilities:
Terminate process

Disassembly:
push rsi
mov eax, 0x16f0
call fcn.1402fcf30
sub rsp, rax
mov esi, ecx
call fcn.14027be10
mov ecx, 0xbef9a4f
call fcn.140232fe0
call fcn.1402e15c0
mov dword [rsp + 0x6c], eax
mov ecx, 0xb21c563b
call fcn.1402697f0
cmp eax, 0
jne 0x1402eab06
jmp 0x1402eab17
cmp esi, 0x61a1b13c
jae 0x1402e4a34
jmp 0x1402e5edb

Function at 0x1402fd6ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402fd736
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402fd736
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402fd736
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402fd736
cmp dword [rcx + 0x84], 0xe
jbe 0x1402fd736
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1402fd738
xor al, al
add rsp, 0x28
ret

Function at 0x140301608
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140301473
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140301473
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140301473
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140301473
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140301473
cmp dword [rcx + 0x84], 0xe
jbe 0x140301473
cmp dword [rcx + 0xf8], 0
je 0x140301473
mov ecx, ebx
call fcn.140301524
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140301300
nop
cmp dword [rbp + 0x20], 0
je 0x1403014c1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1403014cc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140301404
Function at 0x140301a50
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
test rcx, rcx
jne 0x140301a6f
call fcn.14030792c
jmp 0x140301b24
and qword [rbp - 0x30], 0
lea rcx, [rbp - 0x50]
and qword [rbp - 0x28], 0
xor edx, edx
and qword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov byte [rbp - 8], 0
call fcn.1403019b4
mov rax, qword [rbp - 0x48]
mov r9d, 0xfde9
cmp dword [rax + 0xc], r9d
jne 0x140301aba
cmp byte [rbp - 0x38], 0
je 0x140301aef
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140301aef
call fcn.140306a44
test eax, eax
jne 0x140301adb
cmp byte [rbp - 0x38], al
je 0x140301ad3
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140301aef
cmp byte [rbp - 0x38], 0
je 0x140301aec
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
xor r9d, r9d
lea r8, [rbp + 0x10]
mov rcx, rbx
lea rdx, [rbp - 0x30]
call fcn.140301838
test eax, eax
je 0x140301b08
or ebx, 0xffffffff
jmp 0x140301b13
mov rcx, qword [rbp - 0x20]
call fcn.14030792c
mov ebx, eax
cmp byte [rbp - 8], 0
je 0x140301b22
mov rcx, qword [rbp - 0x20]
call fcn.140306e50
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rbp
ret