joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001712
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
jmp 0x140013c80
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r14, rcx
lea rcx, str.ENTER_CreateINF__
call fcn.1400045d9
mov edx, 0x69
xor ecx, ecx
lea r8d, [rdx - 0x5f]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
test rax, rax
jne 0x140013cd3
xor al, al
jmp 0x140013e55
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140013ccc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x140013ccc
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
je 0x140013ccc
lea rcx, [rsp + 0x50]
call fcn.140001893
nop
lea rcx, [rsp + 0x50]
call fcn.1400030e9
test al, al
je 0x140013e2f
lea r9, [rsp + 0xa0]
xor r15d, r15d
cmp dword [rsp + 0xa0], r15d
cmove r9, r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140013df5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edx, eax
lea rcx, str.Create_INF_File_Failed:__d
call fcn.1400045d9
cmp ebx, 0x50
jne 0x140013e2f
lea rcx, str.Delete_previous_INF_file
call fcn.1400045d9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140013db2
lea rcx, str.Delete_FILE_FAILED.
call fcn.1400045d9
jmp 0x140013e2f
lea r9, [rsp + 0xa0]
cmp dword [rsp + 0xa0], r15d
cmove r9, r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140013e2f
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000124e
lea rcx, str.EXIT_CreateINF__
call fcn.1400045d9
test ebx, ebx
setne bl
jmp 0x140013e31
xor bl, bl
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
movzx eax, bl
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140001780
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x1400186f0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov dword [rsp + 0x58], 4
lea rax, [rsp + 0x30]
xor ebx, ebx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCStatus
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140018788
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x68], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LastSystemTransformation
mov dword [rsp + 0x58], 4
mov dword [rsp + 0x60], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140018788
mov eax, dword [rsp + 0x60]
mov ebx, 1
mov dword [rdi], eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140018798
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140001a23
Capabilities:
Query environment variable

Disassembly:
jmp 0x14006abb0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
je 0x14006ac2f
jmp 0x14006abeb
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], si
jne 0x14006abda
lea rax, [rax + rcx*2]
add rax, 2
cmp word [rax], si
jne 0x14006abd6
sub rax, rbx
add rax, 2
sar rax, 1
lea rbp, [rax + rax]
mov rcx, rbp
call fcn.140001e88
mov rdi, rax
test rax, rax
je 0x14006ac1f
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call fcn.140002ee1
mov rsi, rdi
xor ecx, ecx
call fcn.1400041fb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140001a32
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x1400222cc
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14002235a
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x14002235a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002235a
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140022341
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14002233b
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140022343
add rdx, 0x28
jmp 0x140022320
xor edx, edx
test rdx, rdx
jne 0x14002234c
xor al, al
jmp 0x140022360
cmp dword [rdx + 0x24], 0
jge 0x140022356
xor al, al
jmp 0x140022360
mov al, 1
jmp 0x140022360
xor al, al
jmp 0x140022360
add rsp, 0x18
ret
Function at 0x140001a78
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001d890
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
lea rcx, [0x14009a4c8]
mov esi, ebx
mov edi, ebx
call fcn.140003030
mov rbp, rax
test rax, rax
je 0x14001d94e
mov rdx, rax
lea rcx, str.RotationLockButtonPress_DevicePath____ws__n
call fcn.1400045d9
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14001d94e
xor r9d, r9d
mov byte [rsp + 0x50], 4
lea r8d, [rbx + 1]
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
je 0x14001d94e
xor r9d, r9d
mov byte [rsp + 0x50], 4
lea r8d, [rbx + 1]
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
je 0x14001d94e
lea edi, [rbx + 1]
jmp 0x14001d956
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x14001d96c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov eax, edi
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x140001a96
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x14000a890
sub rsp, 0x38
mov dword [rsp + 0x40], 1
call fcn.1400031e3
xor ecx, ecx
mov dword [rsp + 0x48], 4
test eax, eax
mov qword [rsp + 0x50], 0
setne cl
mov dword [rsp + 0x40], ecx
lea rcx, str.Start_RegDelForProgramAndFeature___n
call fcn.1400045d9
lea rax, [rsp + 0x50]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallPower_Management_Driver
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000a902
lea rcx, str.Error_RegDelForProgramAndFeature___RegOpenKeyEx_error____n
call fcn.1400045d9
jmp 0x14000a978
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.SystemComponent
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000a968
mov eax, dword [rsp + 0x48]
lea rdx, str.SystemComponent
mov rcx, qword [rsp + 0x50]
mov r9d, 4
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, str.RegDelForProgramAndFeature___Create_and_set_value_read_value:__x_n
jmp 0x14000a96f
lea rcx, str.RegDelForProgramAndFeature___Already_have_the_value_:__x_n
mov edx, dword [rsp + 0x40]
call fcn.1400045d9
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000a988
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, str.Exit_RegDelForProgramAndFeature___d___n
call fcn.1400045d9
xor eax, eax
add rsp, 0x38
ret
Function at 0x140001b45
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x140080610
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
test r11d, r11d
je 0x140080651
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x140080645
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x140080653
inc r9d
add rax, 0x28
cmp r9d, r11d
jb 0x140080633
xor eax, eax
ret

Function at 0x140001b5e
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
jmp 0x14001bc50
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rax, qword [0x1400b7010]
xor rax, rsp
mov qword [rbp + 0x550], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.140002adb
movups xmm0, xmmword [str.SOFTWAREMicrosoft_]
mov eax, dword [0x14009bc78]
lea rcx, [rbp + 0x164]
xor edx, edx
mov dword [rbp + 0x160], eax
mov r8d, 0x3ec
movaps xmmword [rbp + 0x150], xmm0
call fcn.140002adb
xor edx, edx
lea rcx, [rbp + 0x50]
mov r8d, 0x100
call fcn.140002adb
lea rdx, str.Windows_NTCurrentVersionProfileList_
mov dword [rsp + 0x30], 0x100
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, rbx
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x150]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14001bd28
xor eax, eax
jmp 0x14001bdfb
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.ProfileImagePath
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001bd21
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.140002adb
mov r8d, 0x100
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x14001bd21
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x14001bdb5
lea rdx, str._ntuser.dat
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14001bd21
lea edx, [rax + 1]
lea rcx, str.SeRestorePrivilege
call fcn.14000137a
test eax, eax
je 0x14001bd21
mov r8d, 1
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140002518
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
mov rcx, qword [rbp + 0x550]
xor rcx, rsp
call fcn.140003e09
mov rbx, qword [rsp + 0x678]
add rsp, 0x660
pop rbp
ret
Function at 0x140001bc2
Capabilities:
Set registry value

Disassembly:
jmp 0x140015e40
push rbx
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x1400b7010]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov esi, r9d
mov dword [rsp + 0x50], 0
mov r9, rcx
mov rdi, r8
mov rbx, rdx
lea rcx, [rsp + 0x60]
lea r8, str.IWTPAUTO.PMHELPER
lea rdx, str._s_s
call qword [sym.imp.USER32.dll_wsprintfA]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140015f00
mov rcx, qword [rsp + 0x58]
lea r9d, [rax + 3]
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140015f00
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140003e09
add rsp, 0x180
pop rdi
pop rsi
pop rbx
ret

Function at 0x140001c21
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400647c4
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov ebp, edx
lea r9, [0x1400a4050]
mov r14, rcx
lea r8, [0x1400a4048]
lea rdx, str.GetLocaleInfoEx
mov ecx, 0xd
call fcn.140063d00
mov rbx, rax
test rax, rax
je 0x140064827
mov rcx, rax
call qword [section..00cfg]
mov r9d, edi
mov r8, rsi
mov edx, ebp
mov rcx, r14
call rbx
jmp 0x140064841
xor edx, edx
mov rcx, r14
call fcn.140002865
mov ecx, eax
mov r9d, edi
mov r8, rsi
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140001d70
Capabilities:
Read .ini file

Disassembly:
jmp 0x140019510
sub rsp, 0x138
mov rax, qword [0x1400b7010]
xor rax, rsp
mov qword [rsp + 0x120], rax
xor edx, edx
mov dword [rsp + 0x20], 0xe8
lea r9, [rsp + 0x30]
xor r8d, r8d
lea ecx, [rdx + 8]
call fcn.14000382d
test eax, eax
jne 0x1400195c4
cmp dword [rsp + 0x4c], eax
jne 0x14001956a
call fcn.1400032c4
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140003e09
add rsp, 0x138
ret
lea r9, [0x1400b8650]
mov r8d, 0xdead
lea rdx, str.Status
lea rcx, str.LidCloseBeep
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
je 0x1400195ba
cmp eax, 0xdead
jne 0x1400195c4
lea r9, [0x1400b8540]
mov r8d, eax
lea rdx, str.Status
lea rcx, str.LidCloseBeep
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x1400195c4
mov ecx, 1
call fcn.140002bc1
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140003e09
add rsp, 0x138
ret
Function at 0x140001e3d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14007a684
sub rsp, 0x58
mov rax, qword [0x1400b7010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov r9, rdx
cmp rax, 0x20
mov r8, rcx
jae 0x14007a71c
mov byte [rsp + rax + 0x20], 0
inc rax
cmp rax, 0x20
jl 0x14007a6a3
mov al, byte [rdx]
jmp 0x14007a6d6
movzx edx, al
shr rdx, 3
movzx eax, al
and eax, 7
movzx ecx, byte [rsp + rdx + 0x20]
bts ecx, eax
inc r9
mov byte [rsp + rdx + 0x20], cl
mov al, byte [r9]
test al, al
jne 0x14007a6b7
jmp 0x14007a6fb
movzx eax, r9b
mov edx, 1
movzx ecx, r9b
and ecx, 7
shr rax, 3
shl edx, cl
test byte [rsp + rax + 0x20], dl
jne 0x14007a717
inc r8
mov r9b, byte [r8]
test r9b, r9b
jne 0x14007a6dc
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140003e09
add rsp, 0x58
ret
mov rax, r8
jmp 0x14007a705
call fcn.140001da2
int3
Function at 0x1400020d6
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x14001be90
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x78
xor esi, esi
mov dword [rbp - 0x28], 1
test ecx, ecx
mov qword [rsp + 0x30], rsi
mov eax, esi
mov dword [rsp + 0x28], esi
setne al
mov dword [rbp + 0x40], esi
xor r9d, r9d
mov dword [rbp + 0x30], eax
mov edx, 0xc0000000
mov dword [rbp + 0x28], esi
lea r8d, [rsi + 3]
mov dword [rsp + 0x20], 3
lea rcx, str..IBMPmDrv
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001c073
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea r9d, [rsi + 4]
mov dword [rsp + 0x28], esi
lea r8, [rbp + 0x30]
mov edx, 0x222404
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.SoftwareIBMIBMPM
mov edi, eax
mov rcx, 0xffffffff80000002
cmp dword [rbp + 0x30], esi
je 0x14001c06b
lea rax, [rbp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14001bf70
xor eax, eax
add rsp, 0x78
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14001c076
lea rax, [rbp - 0x28]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.CapaLidBeep
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x18]
test eax, eax
je 0x14001bfb7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c076
or dword [rbp + 0x28], 3
lea rax, [rbp + 0x28]
mov dword [rsp + 0x28], 4
lea rdx, str.SvcCtrlCodeCapa
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x18]
test eax, eax
je 0x14001bff5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c076
lea rax, [rbp - 0x24]
mov dword [rbp + 0x38], 1
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
lea rax, [rbp + 0x38]
mov dword [rbp - 0x20], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HibFileCreation
mov dword [rbp - 0x24], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14001c05f
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x38]
mov dword [rsp + 0x28], 4
lea rdx, str.HibFileCreation
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c076
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x14001c076
mov edi, dword [rbp + 0x28]
test rbx, rbx
je 0x14001c084
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
add rsp, 0x78
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400020f9
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001dc90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor ebx, ebx
mov r14, rcx
lea rcx, [0x14009a4f8]
mov byte [rsp + 0x68], bl
mov esi, ebx
mov edi, ebx
call fcn.140003030
mov rbp, rax
test rax, rax
je 0x14001dd2d
mov rdx, rax
lea rcx, str.SetSystemDockingTransformation_DevicePath____ws__n
call fcn.1400045d9
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14001dd2d
movzx eax, byte [r14]
lea r8d, [rbx + 1]
xor r9d, r9d
mov byte [rsp + 0x68], al
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
je 0x14001dd2d
lea edi, [rbx + 1]
jmp 0x14001dd35
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x14001dd4b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x140002239
Capabilities:
Clear file content

Disassembly:
jmp 0x14007ca24
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov ebp, 1
mov r8d, ebp
xor edx, edx
mov esi, ecx
call fcn.1400046c9
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14007ca65
call fcn.140002ad1
mov eax, dword [rax]
jmp 0x14007cb0b
xor edx, edx
mov ecx, esi
lea r8d, [rdx + 2]
call fcn.1400046c9
cmp rax, 0xffffffffffffffff
je 0x14007ca59
mov rdi, rbx
sub rdi, rax
test rdi, rdi
jle 0x14007cb4c
mov r15d, 0x1000
mov rdx, rbp
mov ecx, r15d
call fcn.1400032a1
mov rbx, rax
test rax, rax
jne 0x14007cab0
call fcn.140002ad1
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
jmp 0x14007cb39
mov edx, 0x8000
mov ecx, esi
call fcn.140001b9a
mov ebp, eax
mov r8d, edi
cmp rdi, r15
mov rdx, rbx
mov ecx, esi
cmovge r8d, r15d
call fcn.14000235b
cmp eax, 0xffffffff
je 0x14007cb24
cdqe
sub rdi, rax
test rdi, rdi
jg 0x14007cabe
mov edx, ebp
mov ecx, esi
call fcn.140001b9a
mov rcx, rbx
call fcn.1400041fb
xor r8d, r8d
mov rdx, r14
mov ecx, esi
call fcn.1400046c9
cmp rax, 0xffffffffffffffff
je 0x14007ca59
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
call fcn.140003f08
cmp dword [rax], 5
jne 0x14007cb39
call fcn.140002ad1
mov dword [rax], 0xd
call fcn.140002ad1
mov rcx, rbx
mov edi, dword [rax]
call fcn.1400041fb
mov eax, edi
jmp 0x14007cb0b
jns 0x14007caf2
xor r8d, r8d
mov rdx, rbx
mov ecx, esi
call fcn.1400046c9
cmp rax, 0xffffffffffffffff
je 0x14007ca59
mov ecx, esi
call fcn.140002266
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14007caf2
call fcn.140002ad1
mov dword [rax], 0xd
call fcn.140003f08
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
jmp 0x14007ca59
Function at 0x14000231f
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x14001db50
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCStatus
mov rcx, 0xffffffff80000002
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001dbb7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov ebx, 1
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov dword [rsp + 0x40], ebx
lea rdx, str.LastSystemTransformation
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 3]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001dbc7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x14000247d
Capabilities:
Set registry value

Disassembly:
jmp 0x140021230
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, str.Enter_UpdateCurrentModeRegValue___n
call fcn.1400045d9
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.CurrentMode
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ebx, ebx
lea rcx, str.Exit_UpdateCurrentModeRegValue___n
test eax, eax
sete bl
call fcn.1400045d9
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1400024f5
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400806d0
mov rax, rcx
mov ecx, 0x5a4d
cmp word [rax], cx
je 0x1400806e0
xor eax, eax
ret
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
xor eax, eax
cmp dword [rcx], 0x4550
jne 0x1400806fd
mov edx, 0x20b
cmp word [rcx + 0x18], dx
sete al
ret

Function at 0x14000259a
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140021820
push rbx
sub rsp, 0x30
mov rbx, rcx
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov dword [rsp + 0x48], 0x100
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14002186d
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.SystemFamily
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140021865
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400218a8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x30
pop rbx
ret