joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400081d0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x430
mov rdx, qword [0x14002ea50]
lea rcx, [rsp + 0x20]
add rdx, 0x47c
call fcn.140001ee0
lea rcx, [rsp + 0x20]
call fcn.140001f50
lea rdx, str.kmkze.msc
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
lea rdx, str.readme.html
lea rcx, [rsp + 0x20]
mov word [rsp + rbx*2 + 0x20], di
call fcn.140001d68
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.osk.exe
mov word [rsp + rbx*2 + 0x20], di
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [rsp + 0x440]
add rsp, 0x430
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14002ea50]
lea rdi, str.dismcore.dll
cmp dword [rax + 8], 0x4a61
sbb rbx, rbx
add rbx, 2
mov rcx, qword [rdi]
xor edx, edx
call fcn.140008280
lea rdi, [rdi + 8]
sub rbx, 1
jne 0x14000890a
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
sub rsp, 0x438
mov rdx, qword [0x14002ea50]
lea rcx, [rsp + 0x20]
add rdx, 0x272
call fcn.140001ee0
lea rdx, str.dccw.exe
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rdx, str..local
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rcx, [rsp + 0x20]
call fcn.140009e18
add rsp, 0x438
ret
sub rsp, 0x438
mov rdx, qword [0x14002ea50]
lea rcx, [rsp + 0x20]
add rdx, 0x47c
call fcn.140001ee0
lea rdx, str.iscsiexe.dll
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rsp, 0x438
ret
sub rsp, 0x28
sub ecx, 0x16
je 0x14000a147
sub ecx, 1
je 0x14000a13e
sub ecx, 7
je 0x14000a12c
sub ecx, 6
je 0x14000a13e
sub ecx, 1
je 0x14000a123
sub ecx, 1
je 0x14000a11a
sub ecx, 0x25
je 0x14000a12c
sub ecx, 1
je 0x14000a111
cmp ecx, 1
jne 0x14000a14c
lea rdx, str.wbem_
lea rcx, str.ATL.dll
jmp 0x14000a135
add rsp, 0x28
jmp 0x14000983c
add rsp, 0x28
jmp 0x1400081d0
add rsp, 0x28
jmp 0x140008fbc
xor edx, edx
lea rcx, str.wow64log.dll
add rsp, 0x28
jmp fcn.140008280
add rsp, 0x28
jmp 0x1400088e4
call fcn.1400087e0
add rsp, 0x28
ret
Function at 0x14000983c
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x430
mov rdx, qword [0x14002ea50]
lea rcx, [rsp + 0x20]
add rdx, 0x47c
call fcn.140001ee0
lea rcx, [rsp + 0x20]
call fcn.140001f50
lea rdx, str.kmkze.msc
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
lea rdx, str.readme.html
lea rcx, [rsp + 0x20]
mov word [rsp + rbx*2 + 0x20], di
call fcn.140001d68
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.osk.exe
mov word [rsp + rbx*2 + 0x20], di
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [rsp + 0x440]
add rsp, 0x430
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14002ea50]
lea rdi, str.dismcore.dll
cmp dword [rax + 8], 0x4a61
sbb rbx, rbx
add rbx, 2
mov rcx, qword [rdi]
xor edx, edx
call fcn.140008280
lea rdi, [rdi + 8]
sub rbx, 1
jne 0x14000890a
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
sub rsp, 0x438
mov rdx, qword [0x14002ea50]
lea rcx, [rsp + 0x20]
add rdx, 0x272
call fcn.140001ee0
lea rdx, str.dccw.exe
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rdx, str..local
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rcx, [rsp + 0x20]
call fcn.140009e18
add rsp, 0x438
ret
sub rsp, 0x438
mov rdx, qword [0x14002ea50]
lea rcx, [rsp + 0x20]
add rdx, 0x47c
call fcn.140001ee0
lea rdx, str.iscsiexe.dll
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rsp, 0x438
ret
sub rsp, 0x28
sub ecx, 0x16
je 0x14000a147
sub ecx, 1
je 0x14000a13e
sub ecx, 7
je 0x14000a12c
sub ecx, 6
je 0x14000a13e
sub ecx, 1
je 0x14000a123
sub ecx, 1
je 0x14000a11a
sub ecx, 0x25
je 0x14000a12c
sub ecx, 1
je 0x14000a111
cmp ecx, 1
jne 0x14000a14c
lea rdx, str.wbem_
lea rcx, str.ATL.dll
jmp 0x14000a135
add rsp, 0x28
jmp 0x14000983c
add rsp, 0x28
jmp 0x1400081d0
add rsp, 0x28
jmp 0x140008fbc
xor edx, edx
lea rcx, str.wow64log.dll
add rsp, 0x28
jmp fcn.140008280
add rsp, 0x28
jmp 0x1400088e4
call fcn.1400087e0
add rsp, 0x28
ret
Function at 0x14000a0d0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x430
mov rdx, qword [0x14002ea50]
lea rcx, [rsp + 0x20]
add rdx, 0x47c
call fcn.140001ee0
lea rcx, [rsp + 0x20]
call fcn.140001f50
lea rdx, str.kmkze.msc
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
lea rdx, str.readme.html
lea rcx, [rsp + 0x20]
mov word [rsp + rbx*2 + 0x20], di
call fcn.140001d68
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.osk.exe
mov word [rsp + rbx*2 + 0x20], di
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [rsp + 0x440]
add rsp, 0x430
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14002ea50]
lea rdi, str.dismcore.dll
cmp dword [rax + 8], 0x4a61
sbb rbx, rbx
add rbx, 2
mov rcx, qword [rdi]
xor edx, edx
call fcn.140008280
lea rdi, [rdi + 8]
sub rbx, 1
jne 0x14000890a
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
sub rsp, 0x438
mov rdx, qword [0x14002ea50]
lea rcx, [rsp + 0x20]
add rdx, 0x272
call fcn.140001ee0
lea rdx, str.dccw.exe
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rdx, str..local
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rcx, [rsp + 0x20]
call fcn.140009e18
add rsp, 0x438
ret
sub rsp, 0x438
mov rdx, qword [0x14002ea50]
lea rcx, [rsp + 0x20]
add rdx, 0x47c
call fcn.140001ee0
lea rdx, str.iscsiexe.dll
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rsp, 0x438
ret
sub rsp, 0x28
sub ecx, 0x16
je 0x14000a147
sub ecx, 1
je 0x14000a13e
sub ecx, 7
je 0x14000a12c
sub ecx, 6
je 0x14000a13e
sub ecx, 1
je 0x14000a123
sub ecx, 1
je 0x14000a11a
sub ecx, 0x25
je 0x14000a12c
sub ecx, 1
je 0x14000a111
cmp ecx, 1
jne 0x14000a14c
lea rdx, str.wbem_
lea rcx, str.ATL.dll
jmp 0x14000a135
add rsp, 0x28
jmp 0x14000983c
add rsp, 0x28
jmp 0x1400081d0
add rsp, 0x28
jmp 0x140008fbc
xor edx, edx
lea rcx, str.wow64log.dll
add rsp, 0x28
jmp fcn.140008280
add rsp, 0x28
jmp 0x1400088e4
call fcn.1400087e0
add rsp, 0x28
ret
Function at 0x14000af48
Capabilities:
Create process on windows
Spoof parent pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov rdi, rdx
mov qword [rbp + 0x77], 0x30
mov edx, 0x18
lea rcx, [rbp - 0x39]
mov ebx, 0xc0000001
call fcn.140001ae8
lea rcx, [rbp - 0x19]
mov edx, 0x70
call fcn.140001ae8
mov dword [rbp - 0x19], edx
mov rcx, qword [rbp + 0x77]
cmp rcx, 0x400
ja 0x14000b097
call fcn.14000c8ac
mov qword [rbp + 0x4f], rax
test rax, rax
je 0x14000b088
xor r8d, r8d
lea r9, [rbp + 0x77]
mov rcx, rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x14000b070
and qword [rsp + 0x30], 0
lea r9, [rbp + 0x67]
and qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rbp + 0x4f]
mov r8d, 0x20000
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x14000b070
mov eax, 5
mov dword [rbp + 0x23], 1
mov word [rbp + 0x27], ax
lea rcx, [rbp - 0x39]
mov rax, qword [0x14002ea50]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
add rax, 0x68
lea rcx, [rbp - 0x19]
xor r8d, r8d
mov qword [rsp + 0x40], rcx
mov rdx, rdi
mov qword [rsp + 0x38], rax
xor ecx, ecx
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80400
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000b070
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov rcx, qword [rbp + 0x4f]
test rcx, rcx
je 0x14000b083
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, qword [rbp + 0x4f]
call fcn.14000c8c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14000af92
lea r11, [rsp + 0xe0]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14000b320
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x430
xor ebx, ebx
mov rsi, r9
mov rdi, rcx
test rdx, rdx
je 0x14000b3e2
test r8d, r8d
je 0x14000b3e2
test rcx, rcx
je 0x14000b3e2
call fcn.14000c9c8
test eax, eax
je 0x14000b3d5
mov edx, 0x410
lea rcx, [rsp + 0x20]
call fcn.140001ae8
mov rdx, qword [0x14002ea50]
lea rcx, [rsp + 0x20]
add rdx, 0x47c
call fcn.140001ee0
lea rdx, str.update.msu
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rcx, [rsp + 0x20]
call fcn.1400033c4
mov rbp, rax
test rax, rax
je 0x14000b3d5
test rsi, rsi
jne 0x14000b3bd
mov rcx, rdi
call fcn.140001c94
mov rsi, rax
mov r8, rsi
mov rdx, rdi
mov rcx, rbp
call fcn.1400034f4
mov rcx, rbp
mov ebx, eax
call fcn.140003604
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
jmp 0x14000b3e4
xor eax, eax
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000b400
Capabilities:
Delete file

Disassembly:
sub rsp, 0x438
mov edx, 0x410
lea rcx, [rsp + 0x20]
call fcn.140001ae8
mov rdx, qword [0x14002ea50]
lea rcx, [rsp + 0x20]
add rdx, 0x47c
call fcn.140001ee0
lea rdx, str.update.msu
lea rcx, [rsp + 0x20]
call fcn.140001d68
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rsp, 0x438
ret

Function at 0x14000b958
Capabilities:
Create thread
Terminate thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x10]
mov r9, rcx
mov qword [r11 - 0x10], rax
lea r8, [0x14000b578]
xor ebx, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14000ba0e
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x14000b454]
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
je 0x14000b9e5
mov edx, 0x3a98
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000b9dc
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x2710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000ba05
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x14002ea00]
cmp ecx, 1
mov rsi, qword [rsp + 0x50]
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000c9c8
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov edi, r8d
mov dword [rax + 0x10], ebx
mov rsi, rdx
test rdx, rdx
je 0x14000ca46
test r8d, r8d
je 0x14000ca46
mov qword [rax - 0x18], rbx
xor r9d, r9d
mov dword [rax - 0x20], ebx
xor r8d, r8d
mov edx, 0x40000000
mov dword [rax - 0x28], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14000ca46
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x58], edi
sete bl
mov eax, ebx
jmp 0x14000ca48
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x14000ca60
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor eax, eax
mov rbx, r9
mov rdi, rcx
test rdx, rdx
je 0x14000ca84
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
jmp 0x14000ca8d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14000cabc
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x80
and qword [rbp + 0x10], 0
lea rcx, [rbp - 0x60]
and qword [rbp + 0x18], 0
call qword [sym.imp.ntdll.dll_RtlFormatCurrentUserKeyPath]
mov ebx, eax
test eax, eax
js 0x14000cba9
and qword [rbp - 0x28], 0
lea rax, [rbp - 0x60]
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x30]
mov dword [rbp - 0x30], 0x30
mov edx, 0x2000000
mov dword [rbp - 0x18], 0x40
lea rcx, [rbp + 0x10]
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov ebx, eax
test eax, eax
js 0x14000cb9f
lea rdx, str.Environment
lea rcx, [rbp - 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbp + 0x10]
lea r8, [rbp - 0x30]
mov qword [rbp - 0x28], rax
lea rcx, [rbp + 0x18]
lea rax, [rbp - 0x50]
mov edx, 0x2000000
mov qword [rbp - 0x20], rax
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov ebx, eax
test eax, eax
js 0x14000cb95
lea rdx, str.Path
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x18]
lea rdx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov rcx, qword [rbp + 0x18]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [rbp - 0x60]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rbp
ret
Function at 0x14000cbbc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, qword [rsp + 0x90]
mov r14, r9
and dword [rax + 0x20], 0
mov ebp, r8d
and qword [r9], 0
mov rbx, rdx
mov rsi, qword [rsp + 0x98]
mov r12, rcx
and dword [r15], 0
test rsi, rsi
jne 0x14000cc09
call fcn.140002e48
mov rsi, qword [rax + 0x30]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor r9d, r9d
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
and dword [rsp + 0x20], 0
mov rcx, r12
lea r8d, [r9 + 2]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
cmp eax, 0xc0000023
jne 0x14000ccff
mov r8d, dword [rsp + 0x88]
mov edx, 8
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x14000ccfa
mov ecx, dword [rsp + 0x88]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov rcx, r12
mov r8d, 2
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
test eax, eax
js 0x14000ccea
cmp dword [rdi + 4], ebp
jne 0x14000cce5
mov r8d, dword [rdi + 8]
mov edx, 8
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x14000ccde
mov r8d, dword [rdi + 8]
lea rdx, [rdi + 0xc]
mov rcx, rax
call fcn.140019ce0
mov qword [r14], rbx
xor ebx, ebx
mov eax, dword [rdi + 8]
mov dword [r15], eax
jmp 0x14000ccea
mov ebx, 0xc0000017
jmp 0x14000ccea
mov ebx, 0xc0000024
mov r8, rdi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14000ccff
mov ebx, 0xc0000017
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000cd18
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
and qword [rbp + 0x77], 0
xor edi, edi
mov rsi, rdx
test rcx, rcx
jne 0x14000cd42
xor eax, eax
jmp 0x14000ce85
xor r9d, r9d
lea rdx, [rbp - 0x29]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x14000ce73
and dword [rsp + 0x50], edi
lea rax, [rbp - 0x29]
and qword [rsp + 0x48], rdi
lea r9, [rbp - 0x19]
and qword [rbp + 0x17], rdi
lea r8, [rbp + 0xf]
mov dword [rsp + 0x40], 0x60
lea rcx, [rbp + 0x77]
mov qword [rbp + 0x1f], rax
xorps xmm0, xmm0
mov eax, 1
mov dword [rbp + 0xf], 0x30
mov dword [rsp + 0x38], eax
mov edx, 0x100001
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], rdi
mov dword [rbp + 0x27], 0x40
movdqu xmmword [rbp + 0x2f], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
lea rcx, [rbp - 0x29]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test ebx, ebx
js 0x14000ce73
mov edx, 0x18
lea rcx, [rbp - 9]
call fcn.140001ae8
mov rcx, qword [rbp + 0x77]
lea r8, [rbp - 9]
mov r9d, edx
mov dword [rsp + 0x20], 5
lea rdx, [rbp - 0x19]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov dword [rbp + 0x67], eax
test eax, eax
js 0x14000ce73
mov eax, dword [rbp - 1]
lea r9, [rbp + 0x67]
mov edx, 0x3000
mov qword [rbp + 0x7f], rax
lea rcx, [rbp + 0x7f]
call fcn.14000c7e4
cmp dword [rbp + 0x67], 0
mov rdi, rax
jl 0x14000ce73
and qword [rsp + 0x40], 0
xor r9d, r9d
and qword [rsp + 0x38], 0
xor r8d, r8d
mov ecx, dword [rbp - 1]
xor edx, edx
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp + 0x77]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
js 0x14000ce69
test rsi, rsi
je 0x14000ce73
mov eax, dword [rbp - 1]
mov dword [rsi], eax
jmp 0x14000ce73
mov rcx, rdi
call fcn.14000c85c
xor edi, edi
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14000ce82
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, rdi
mov rbx, qword [rsp + 0xf8]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000ce98
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x90
mov r10, rcx
mov r11, rdx
mov edx, 0x70
lea rcx, [rsp + 0x20]
mov rbx, r8
call fcn.140001ae8
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x24], 0x440
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov dword [rsp + 0x50], r9d
mov qword [rsp + 0x30], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
neg eax
sbb rax, rax
and rax, qword [rsp + 0x88]
add rsp, 0x90
pop rbx
ret
Function at 0x14000cefc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
call fcn.14000ce98
mov rdi, rax
test rax, rax
je 0x14000cf46
mov edx, dword [rsp + 0x50]
test edx, edx
je 0x14000cf38
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0x102
cmp eax, edx
jne 0x14000cf38
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000d04c
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r8d, [rdx + 1]
mov edi, edx
shr r8d, 1
mov rdx, rcx
mov r10, rcx
call fcn.14000d01c
mov rcx, r10
movzx ebx, ax
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
xor edx, edx
test rax, rax
je 0x14000d099
movzx ecx, word [rax + 0x58]
movzx eax, word [rax + 0x5a]
cmp bx, cx
adc cx, dx
sub bx, cx
cmp bx, ax
adc ax, dx
sub bx, ax
jmp 0x14000d09b
mov ebx, edx
movzx eax, bx
mov rbx, qword [rsp + 0x30]
add eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x14000d0ac
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
call fcn.14000d04c
mov rcx, rbx
mov esi, eax
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x14000d0d8
mov edi, dword [rax + 0x58]
mov rbx, qword [rsp + 0x30]
cmp esi, edi
mov rsi, qword [rsp + 0x38]
sete al
add rsp, 0x20
pop rdi
ret

Function at 0x14000d0f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
and dword [rsp + 0x58], 0
mov rsi, r9
mov rbx, r8
mov rdi, rdx
test r8, r8
je 0x14000d116
and dword [r8], 0
test rdi, rdi
jne 0x14000d122
mov eax, 0xc00000f0
jmp 0x14000d17e
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov qword [rsp + 0x20], 0xa
mov r8d, 3
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
mov ecx, eax
test eax, eax
js 0x14000d17c
mov rdx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.ntdll.dll_LdrAccessResource]
mov ecx, eax
test eax, eax
js 0x14000d17c
test rbx, rbx
je 0x14000d17c
mov eax, dword [rsp + 0x58]
mov dword [rbx], eax
mov eax, ecx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14000d4f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rsi, rdx
mov r14, rcx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ebx, ebx
test eax, eax
je 0x14000d605
lea rax, [rbp + 0x1a8]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000d556
cmp eax, 2
je 0x14000d605
xor eax, eax
jmp 0x14000d60a
mov rcx, rsi
call fcn.140001f20
mov rdi, rax
mov eax, 0x5c
cmp word [rdi - 2], ax
je 0x14000d576
mov word [rdi], ax
add rdi, 2
mov word [rdi], bx
mov r15d, 0x104
jmp 0x14000d5a0
mov r9, r15
lea r8, [rsp + 0x50]
mov rdx, r15
mov rcx, rdi
call fcn.140002000
mov rdx, rsi
mov rcx, r14
call fcn.14000d4f0
test eax, eax
je 0x14000d5df
mov rcx, qword [rbp + 0x1a8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x1a0]
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x1a0], r15d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14000d57e
mov word [rdi - 2], bx
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete bl
mov eax, ebx
jmp 0x14000d60a
mov eax, 1
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret