joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d5fc
Capabilities:
Set registry value

Disassembly:
push rbx
mov eax, 0x17f0
call fcn.14003ad30
sub rsp, rax
mov rax, qword [0x14004de00]
xor rax, rsp
mov qword [rsp + 0x17e0], rax
mov qword [rsp + 0x60], rdx
mov rbx, r8
mov rdx, rcx
lea rcx, [rsp + 0x70]
lea r8, str.SOFTWAREej_technologiesexe4jjvms2_
mov dword [rsp + 0x58], r9d
call fcn.14000d590
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000d70f
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
lea rdx, str.LastWriteTime
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbx
call fcn.14001bd50
mov rcx, qword [rsp + 0x50]
lea rdx, str.Version
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov r9d, 4
lea rdx, str.Machine
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x17e0]
xor rcx, rsp
call fcn.14001c510
add rsp, 0x17f0
pop rbx
ret
Function at 0x14000d728
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x17d0
call fcn.14003ad30
sub rsp, rax
mov rax, qword [0x14004de00]
xor rax, rsp
mov qword [rsp + 0x17c0], rax
mov qword [rsp + 0x40], rdx
mov rdi, r8
mov rdx, rcx
lea rcx, [rsp + 0x50]
lea r8, str.SOFTWAREej_technologiesexe4jjvms2_
mov rsi, r9
xor bl, bl
call fcn.14000d590
lea r11, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000d8d8
and dword [rsi], eax
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x34]
lea rdx, str.LastWriteTime
xor r8d, r8d
mov dword [rsp + 0x30], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000d8cd
cmp dword [rsp + 0x30], 8
jne 0x14000d8cd
lea r8d, [rax + 8]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14001fa60
test eax, eax
jne 0x14000d8cd
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.Version
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], 0x1770
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
test bl, bl
je 0x14000d8cd
mov ebx, 1
cmp dword [rsp + 0x30], ebx
jae 0x14000d84d
mov byte [rdi], 0
jmp 0x14000d85c
mov eax, dword [rsp + 0x30]
cmp byte [rax + rdi - 1], 0
je 0x14000d85c
mov byte [rax + rdi], 0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.Machine
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000d890
cmp dword [rsp + 0x30], 4
je 0x14000d892
xor bl, bl
lea rdx, str.1.7.
mov rcx, rdi
call fcn.14001e290
test eax, eax
je 0x14000d8cb
lea rdx, str.1.6.
mov rcx, rdi
call fcn.14001e290
test eax, eax
je 0x14000d8cb
lea rdx, str.1.5.
mov rcx, rdi
call fcn.14001e290
test eax, eax
jne 0x14000d8cd
xor bl, bl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rcx, qword [rsp + 0x17c0]
xor rcx, rsp
call fcn.14001c510
add rsp, 0x17d0
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000d8f8
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor r8d, r8d
xor edx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ebx, ebx
movsxd rsi, eax
test eax, eax
jle 0x14000d97a
mov rcx, rsi
call fcn.14001b160
mov r8d, esi
mov rcx, rdi
mov rdx, rax
mov rbx, rax
mov byte [rax], 0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [rsi - 1]
cmp eax, ecx
je 0x14000d95d
mov rcx, rbx
call fcn.14001c17c
lea rcx, str.error_reading__S
mov rdx, rdi
xor ebx, ebx
call fcn.140016394
jmp 0x14000d96f
lea rcx, str._S_is__S
mov r8, rbx
mov rdx, rdi
call fcn.140016394
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d990
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x14004de00]
xor rax, rsp
mov qword [rsp + 0x40], rax
and qword [rsp + 0x20], 0
mov rbx, rcx
mov rdx, rcx
lea rcx, [rsp + 0x20]
lea r8, [0x140040c14]
call fcn.140020100
mov r9, qword [rsp + 0x20]
test eax, eax
jne 0x14000db36
test r9, r9
je 0x14000db36
lea esi, [rax + 1]
lea r8d, [rax + 2]
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.14001ffa8
cmp rax, 2
jne 0x14000db20
cmp byte [rsp + 0x30], 0x4d
jne 0x14000db20
cmp byte [rsp + 0x31], 0x5a
jne 0x14000db20
mov rcx, qword [rsp + 0x20]
lea edx, [rsi + 0x3b]
xor r8d, r8d
call fcn.14001fbdc
test eax, eax
je 0x14000da42
mov rcx, qword [rsp + 0x20]
call fcn.14001ee5c
lea rcx, str.no_PE32_file_2__S
mov rdx, rbx
call fcn.140016394
jmp 0x14000db48
mov r9, qword [rsp + 0x20]
lea rcx, [rsp + 0x2c]
mov r8, rsi
mov edx, 4
call fcn.14001ffa8
mov rcx, qword [rsp + 0x20]
cmp rax, rsi
je 0x14000da71
call fcn.14001ee5c
lea rcx, str.no_PE32_file_3__S
jmp 0x14000da35
mov edx, dword [rsp + 0x2c]
xor r8d, r8d
call fcn.14001fbdc
test eax, eax
je 0x14000da94
mov rcx, qword [rsp + 0x20]
call fcn.14001ee5c
lea rcx, str.no_PE32_file_4__S
jmp 0x14000da35
mov r9, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r8d, 4
mov rdx, rsi
call fcn.14001ffa8
cmp rax, 4
jne 0x14000db0a
cmp byte [rsp + 0x30], 0x50
jne 0x14000db0a
cmp byte [rsp + 0x31], 0x45
jne 0x14000db0a
cmp byte [rsp + 0x32], 0
jne 0x14000db0a
cmp byte [rsp + 0x33], 0
jne 0x14000db0a
mov r9, qword [rsp + 0x20]
lea edx, [rax - 2]
lea rcx, [rsp + 0x28]
mov r8, rsi
call fcn.14001ffa8
mov rcx, qword [rsp + 0x20]
cmp rax, rsi
je 0x14000dafe
call fcn.14001ee5c
lea rcx, str.no_PE32_file_6__S
jmp 0x14000da35
call fcn.14001ee5c
movzx eax, word [rsp + 0x28]
jmp 0x14000db4a
mov rcx, qword [rsp + 0x20]
call fcn.14001ee5c
lea rcx, str.no_PE32_file_5__S
jmp 0x14000da35
mov rcx, qword [rsp + 0x20]
call fcn.14001ee5c
lea rcx, str.no_PE32_file__S
jmp 0x14000da35
lea rcx, str.could_not_open__S__d__p
mov r8d, eax
mov rdx, rbx
call fcn.140016394
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001c510
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
Function at 0x14000dc3c
Capabilities:
Check os version
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1840
call fcn.14003ad30
sub rsp, rax
mov rax, qword [0x14004de00]
xor rax, rsp
mov qword [rsp + 0x1830], rax
mov rdi, rcx
mov ebx, 0x94
lea rcx, [rsp + 0x20]
mov r8, rbx
xor edx, edx
call fcn.14001e190
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x24], 6
jb 0x14000dc9f
jne 0x14000dd55
cmp dword [rsp + 0x28], 4
jae 0x14000dd55
mov rcx, rdi
call fcn.14001bd50
lea rcx, [rax + 0x64]
call fcn.14001b160
lea rdx, str._sucrtbase.dll
mov r8, rdi
mov rcx, rax
mov rbx, rax
call fcn.14001d218
mov rcx, rbx
call fcn.14000651c
test al, al
je 0x14000dd4d
lea rcx, str.Preloading_ucrtbase.dll_4
call fcn.140016394
lea rdx, [rsp + 0xc0]
mov ecx, 0x1770
mov byte [rsp + 0xc0], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.ucrtbase.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14000dd2d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14000dd2d
lea rcx, str.Could_not_preload_ucrtbase.dll
call fcn.140016394
lea rcx, [rsp + 0xc0]
call fcn.14001bd50
test rax, rax
je 0x14000dd4d
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rcx, rbx
call fcn.14001c17c
mov rcx, qword [rsp + 0x1830]
xor rcx, rsp
call fcn.14001c510
mov rbx, qword [rsp + 0x1858]
add rsp, 0x1840
pop rdi
ret
Function at 0x14000e22c
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov rax, qword [0x14004de00]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rdi, rcx
mov ecx, 0x7d0
call fcn.14001b160
mov rcx, rdi
mov r13, rax
call fcn.14000dd78
mov rdx, rdi
movsxd rbx, eax
mov rcx, r13
mov r8, rbx
call fcn.14001c1a0
xor r15d, r15d
mov rcx, r13
mov byte [rbx + r13], r15b
call fcn.140019164
mov rcx, r13
mov r14, rax
call fcn.14000dc3c
lea r12, [0x1400406d8]
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebp, eax
cmp eax, r15d
cmovl ebp, r15d
lea edi, [rbp + 0x1770]
movsxd rbx, edi
mov rcx, rbx
call fcn.14001b160
mov rcx, r13
mov rsi, rax
call fcn.14001bd50
lea rcx, [rax + rbx + 1]
call fcn.14001b160
mov rdx, r13
mov rcx, rax
mov rbx, rax
call fcn.14001c3c0
lea rdx, [0x14003e2ac]
mov rcx, rbx
call fcn.14001c320
mov r8d, edi
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, r15d
jbe 0x14000e322
mov rdx, rsi
mov rcx, rbx
call fcn.14001c320
jmp 0x14000e325
mov byte [rsi], r15b
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp eax, r15d
je 0x14000e349
lea rcx, str.Setting_PATH__d__S
mov r8, rbx
mov edx, ebp
call fcn.140016394
jmp 0x14000e361
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Setting_PATH__S_failed_with_error__d
mov rdx, rbx
mov r8d, eax
call fcn.140016394
mov ecx, 0x5dc6
call fcn.14001b160
lea rdx, str.PATH_s
mov r8, rbx
mov rcx, rax
mov rbp, rax
call fcn.14001d218
mov rcx, rbp
call fcn.140020408
mov r8d, 0xc8
lea rdx, [rsp + 0x20]
lea ecx, [r8 - 0x30]
mov rdi, r15
call fcn.140004538
lea rcx, [rsp + 0x20]
call fcn.14001bd50
cmp rax, r15
jbe 0x14000e3be
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.14000db64
mov rdi, rax
lea r12, str.server
cmp rdi, r15
jne 0x14000e452
mov rdx, qword [r12]
mov rcx, r13
call fcn.14000db64
add r12, 8
mov rdi, rax
lea rax, str.i4j_jres
cmp r12, rax
jl 0x14000e3c5
cmp rdi, r15
jne 0x14000e452
mov rcx, r14
call fcn.140019240
lea rcx, [0x1400406d8]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp eax, r15d
je 0x14000e420
lea rcx, str.Setting_PATH__S
mov rdx, rsi
call fcn.140016394
jmp 0x14000e438
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Setting_PATH__S_failed_with_error__d
mov rdx, rsi
mov r8d, eax
call fcn.140016394
lea rdx, str.PATH_s
mov r8, rsi
mov rcx, rbp
call fcn.14001d218
mov rcx, rbp
call fcn.140020408
mov rcx, rbx
call fcn.14001c17c
mov rcx, rsi
call fcn.14001c17c
mov rcx, rbp
call fcn.14001c17c
mov rcx, r13
call fcn.14001c17c
mov rax, rdi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14001c510
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400132a4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x46c8
call fcn.14003ad30
sub rsp, rax
mov rax, qword [0x14004de00]
xor rax, rsp
mov qword [rsp + 0x46b0], rax
mov r12, qword [rsp + 0x4720]
mov r13, qword [rsp + 0x4728]
mov ebx, edx
mov rdi, r8
mov rsi, rcx
lea rdx, [rsp + 0x60]
mov r8d, 0x1770
mov ecx, 0xa0
mov rbp, r9
call fcn.140004538
lea rdx, [rsp + 0x60]
lea rcx, str.checking_app_id__S___d___p_
mov r9, rsi
mov r8d, ebx
call fcn.140016394
lea rcx, [rsp + 0x60]
call fcn.14001bd50
test rax, rax
je 0x140013482
lea rax, [rsp + 0x48]
or ebx, 0x20019
lea rdx, str.SOFTWAREej_technologiesinstall4jinstallations
xor r8d, r8d
mov rcx, rsi
mov r9d, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140013474
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f40]
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x40], 0x1770
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140013459
cmp dword [rsp + 0x40], eax
jbe 0x140013459
lea rdx, [rsp + 0x2f40]
lea rcx, str.found_installations:__S
call fcn.140016394
lea rcx, [rsp + 0x2f40]
lea rdx, [0x14003e2ac]
call fcn.14001d05c
mov rbx, rax
test rax, rax
je 0x140013467
mov rcx, rax
call fcn.14001bd50
test rax, rax
je 0x140013467
lea rdx, str._sjre
lea rcx, [rsp + 0x17d0]
mov r8, rbx
call fcn.14001d218
lea rdx, [rsp + 0x17d0]
mov rcx, rdi
call fcn.14000d4d0
test al, al
je 0x14001343a
mov byte [rsp + 0x30], 1
mov r9, r13
mov r8, r12
mov rdx, rbp
mov rcx, rdi
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
call fcn.140012fd8
test al, al
jne 0x140013455
lea rcx, str.java_version_did_not_match_in__S
jmp 0x140013441
lea rcx, str.did_not_find_java_in__S
lea rdx, [rsp + 0x17d0]
call fcn.140016394
xor ecx, ecx
jmp 0x1400133b9
mov al, 1
jmp 0x140013484
lea rcx, str.could_not_query_value_node__d
xor edx, edx
call fcn.140016394
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140013482
lea rcx, str.could_not_open_installation_node__d
mov edx, eax
call fcn.140016394
xor al, al
mov rcx, qword [rsp + 0x46b0]
xor rcx, rsp
call fcn.14001c510
add rsp, 0x46c8
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140013528
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x17c0
call fcn.14003ad30
sub rsp, rax
mov rax, qword [0x14004de00]
xor rax, rsp
mov qword [rsp + 0x17b0], rax
mov r14, qword [rsp + 0x1820]
mov rax, r8
mov r12, rdx
mov rbp, rcx
lea rdx, [rsp + 0x40]
mov r8d, 0x1770
mov rcx, rax
mov r13, r9
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400135ef
lea rcx, [rsp + 0x40]
xor esi, esi
call fcn.14001bd50
lea ebx, [rsi + 1]
test rax, rax
je 0x1400135b6
lea rdi, [rsp + 0x40]
cmp byte [rdi], 0x2f
jne 0x14001359f
mov byte [rdi], 0x5c
lea rcx, [rsp + 0x40]
add esi, ebx
add rdi, rbx
call fcn.14001bd50
movsxd rcx, esi
cmp rcx, rax
jb 0x140013597
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.14000d4d0
test al, al
je 0x1400135e9
mov byte [rsp + 0x30], bl
mov r9, r14
mov r8, r13
mov rdx, r12
mov rcx, rbp
mov byte [rsp + 0x28], bl
mov byte [rsp + 0x20], 0
call fcn.140012fd8
test al, al
jne 0x1400135eb
xor ebx, ebx
mov al, bl
jmp 0x1400135f1
xor al, al
mov rcx, qword [rsp + 0x17b0]
xor rcx, rsp
call fcn.14001c510
add rsp, 0x17c0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140013964
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
lea rax, [r11 - 0x40]
mov r12, r9
mov r14, r8
xor bpl, bpl
xor r8d, r8d
mov qword [r11 - 0x68], rax
mov byte [r9], bpl
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140013b58
mov edi, 0x1770
mov rcx, rdi
mov dword [rsp + 0xa8], edi
mov dword [rsp + 0x40], edi
call fcn.14001b160
mov rcx, rdi
mov r13, rax
call fcn.14001b160
mov rcx, rdi
mov rsi, rax
call fcn.14001b160
mov rcx, rdi
mov rbx, rax
call fcn.14001b160
xor r15d, r15d
mov rdi, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
and qword [rsp + 0x20], r15
xor edx, edx
jmp 0x140013b0f
mov byte [rbx], 0
mov rcx, rsi
mov byte [rdi], 0
call fcn.14001bd50
inc eax
movsxd r8, eax
test eax, eax
jle 0x140013a4d
mov rdx, rsi
mov rcx, rbx
sub rdx, rbx
movzx eax, byte [rdx + rcx]
mov r9d, 0x5c
cmp al, 0x2f
cmove eax, r9d
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x140013a32
lea rdx, str.i4j_jres
mov rcx, rbx
call fcn.14001e728
test rax, rax
setne al
cmp byte [rsp + 0xc0], 0
je 0x140013a70
test al, al
je 0x140013a7e
cmp byte [rsp + 0xc8], 0
je 0x140013ad4
test al, al
je 0x140013ad4
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
mov byte [rsp + 0x30], 1
mov rdx, rdi
mov rcx, rbx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
call fcn.140012fd8
test al, al
je 0x140013ad4
mov rdx, r12
mov rcx, rdi
call fcn.140012210
test al, al
je 0x140013ad4
mov rdx, rdi
mov rcx, r12
call fcn.14001c3c0
mov rdx, rbx
mov rcx, r14
call fcn.14001c3c0
mov bpl, 1
lea rax, [rsp + 0x50]
inc r15d
mov dword [rsp + 0xa8], 0x1770
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xa8]
mov dword [rsp + 0x40], 0x1770
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
and qword [rsp + 0x20], 0
mov edx, r15d
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x140013a12
mov rcx, rbx
call fcn.14001c17c
mov rcx, rdi
call fcn.14001c17c
mov rcx, r13
call fcn.14001c17c
mov rcx, rsi
call fcn.14001c17c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x60]
mov al, bpl
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140015960
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r10, rdx
test r8d, r8d
jle 0x140015994
mov r9d, r8d
mov r8d, dword [rcx]
movsx eax, byte [r10]
inc r10
xor rax, r8
shr r8d, 8
movzx edx, al
lea rax, [0x14004d4a0]
mov eax, dword [rax + rdx*4]
xor eax, r8d
sub r9, 1
mov dword [rcx], eax
jne 0x14001596b
repz ret

Function at 0x140015db4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.14001bd50
cmp eax, 3
jl 0x140015e73
cmp byte [rbx + 1], 0x2d
jne 0x140015e73
mov rcx, qword [0x14004d498]
lea rdi, [0x14004d498]
jmp 0x140015e48
mov rsi, qword [rdi]
mov rcx, rsi
call fcn.14001bd50
mov rbp, rax
lea ecx, [rax + 1]
movsxd rcx, ecx
call fcn.14001b160
test ebp, ebp
jle 0x140015e2a
movsxd r8, ebp
mov rdx, rax
sub rsi, rax
mov cl, byte [rsi + rdx]
xor cl, 0xbb
mov byte [rdx], cl
inc rdx
sub r8, 1
jne 0x140015e19
movsxd r8, ebp
mov rdx, rax
mov rcx, rbx
mov byte [r8 + rax], 0
call fcn.14001d160
test eax, eax
je 0x140015e73
add rdi, 8
mov rcx, qword [rdi]
call fcn.14001bd50
test rax, rax
jne 0x140015df3
movsx ecx, byte [rbx]
sub ecx, 0x41
je 0x140015ea9
sub ecx, 4
je 0x140015e9d
sub ecx, 7
je 0x140015ea9
sub ecx, 7
je 0x140015ea9
sub ecx, 1
je 0x140015e8d
cmp ecx, 3
je 0x140015ea9
mov eax, 0xfffffffd
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.1400157c4
add eax, 0xfffffffc
cmp eax, 1
jmp 0x140015eb7
mov dl, 1
mov rcx, rbx
call fcn.140015d24
jmp 0x140015e78
mov rcx, rbx
call fcn.1400157c4
add eax, 0xfffffffe
cmp eax, 2
ja 0x140015e73
mov rcx, rbx
call fcn.140015c08
neg al
sbb eax, eax
and eax, 2
add eax, 0xfffffffd
jmp 0x140015e78
Function at 0x140016414
Capabilities:
Set registry value

Disassembly:
mov eax, 0x17e8
call fcn.14003ad30
sub rsp, rax
mov rax, qword [0x14004de00]
xor rax, rsp
mov qword [rsp + 0x17d0], rax
call fcn.1400065fc
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov rdx, rax
call fcn.140007b00
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, str.SOFTWAREej_technologiesexe4jpids_
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400164c6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x58]
mov r9d, 4
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x17d0]
xor rcx, rsp
call fcn.14001c510
add rsp, 0x17e8
ret

Function at 0x1400164e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
mov eax, 0x17d0
call fcn.14003ad30
sub rsp, rax
mov rax, qword [0x14004de00]
xor rax, rsp
mov qword [rsp + 0x17c0], rax
call fcn.1400065fc
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov rdx, rax
call fcn.140007b00
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREej_technologiesexe4jpids_
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x140016590
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x140016585
cmp dword [rsp + 0x30], 4
cmove ebx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x17c0]
xor rcx, rsp
call fcn.14001c510
add rsp, 0x17d0
pop rbx
ret
Function at 0x1400168f8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
call fcn.140016600
mov rcx, rbx
mov rsi, rax
call fcn.14001c868
lea rbp, str.__i4j_empty_command_line
test rax, rax
mov edx, 0x40000000
mov rcx, rsi
cmovne rbp, rbx
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor ebx, ebx
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400169c7
mov ecx, ebx
inc ebx
cmp ecx, 0x32
jge 0x1400169ab
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140016963
cmp rdi, 0xffffffffffffffff
jne 0x1400169c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error_mailslot_CreateFile__d
mov edx, eax
call fcn.140016394
jmp 0x140016a28
mov rcx, rbp
call fcn.14001c868
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov rbx, rax
mov rdx, rbp
mov rcx, rdi
add ebx, ebx
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140016a08
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error_mailslot_WriteFile__d
mov edx, eax
call fcn.140016394
jmp 0x140016a1f
mov edx, dword [rsp + 0x60]
cmp edx, ebx
je 0x140016a1f
lea rcx, str.error_mailslot_WriteFile_length__d__d
mov r8d, ebx
call fcn.140016394
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
jmp fcn.14001c17c