joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400468e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400468ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400468fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400468e5
lea eax, [rcx + 1]
jmp 0x14004690b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14004691e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140046904
sub eax, 3
jb 0x14004693e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14004698d
sar eax, 1
movsxd rbp, eax
jb 0x140046974
jmp 0x14004694c
add ebx, ebx
jne 0x14004694a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140046974
inc ecx
add ebx, ebx
jne 0x14004695a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140046974
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14004696d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14004695c
add ecx, 2
jmp 0x140046979
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400468a2
jmp 0x1400468ed
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x31e00
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400469dd
cmp rsi, rcx
jae 0x1400469e5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400469c4
cmp al, 0x8f
ja 0x1400469c4
cmp byte [rsi - 2], 0xf
je 0x1400469ca
sub al, 0xe8
cmp al, 1
ja 0x1400469ae
cmp rsi, rcx
jae 0x1400469e5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400469b4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400469e5
lodsb al, byte [rsi]
jmp 0x1400469c4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x44000]
mov eax, dword [rdi]
or eax, eax
je 0x140046a42
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x46000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400469f2
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140046a3c
mov qword [rbx], rax
add rbx, 8
jmp 0x140046a12
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140046a7c
cmp al, 0xef
ja 0x140046a6e
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140046a4e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140046a5d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140046afb], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140046afb
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140046aeb
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0
Function at 0x401424
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.004011ac
add rsp, 0x28
jmp 0x40143c
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x004119c0], rdi
je 0x40149c
cmp rax, rdi
jne 0x40148f
mov r12d, 1
jmp 0x40149c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401475
mov eax, dword [0x004119b8]
cmp eax, 1
jne 0x4014b1
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x401518
mov eax, dword [0x004119b8]
cmp eax, ebx
jne 0x40150e
mov dword [0x004119b8], 1
lea r13, [0x00409598]
lea rdi, [0x00409580]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x401500
cmp eax, ebx
jne 0x401500
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x4014f5
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x4014de
cmp eax, ebx
je 0x401518
mov eax, 0xff
jmp 0x401660
mov dword [0x00411ad4], 1
mov eax, dword [0x004119b8]
cmp eax, 1
jne 0x401540
lea rdx, [0x00409578]
lea rcx, [0x00409560]
call sub.msvcrt.dll__initterm
mov dword [0x004119b8], 2
cmp r12d, ebx
jne 0x40154f
mov rax, rbx
xchg qword [0x004119c0], rax
cmp qword [0x004119c8], rbx
je 0x401577
lea rcx, [0x004119c8]
call fcn.004052fc
cmp eax, ebx
je 0x401577
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x004119c8]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x40158d
mov eax, 0xff
jmp 0x401660
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x401612
cmp word [rcx], bx
je 0x4015a8
cmp edx, ebx
jne 0x401612
cmp word [rcx], bx
je 0x4015be
cmp word [rcx], 0x20
ja 0x4015be
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x4015a8
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x00400000]
call fcn.00401680
mov dword [0x00411ad0], eax
cmp dword [0x0041160c], ebx
jne 0x4015fc
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x00411ad4], ebx
jne 0x401610
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x00411ad0]
jmp 0x401660
cmp word [rcx], 0x22
jne 0x401625
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x401599
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x40143c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.004011ac
add rsp, 0x28
jmp 0x40143c
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x004119c0], rdi
je 0x40149c
cmp rax, rdi
jne 0x40148f
mov r12d, 1
jmp 0x40149c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401475
mov eax, dword [0x004119b8]
cmp eax, 1
jne 0x4014b1
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x401518
mov eax, dword [0x004119b8]
cmp eax, ebx
jne 0x40150e
mov dword [0x004119b8], 1
lea r13, [0x00409598]
lea rdi, [0x00409580]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x401500
cmp eax, ebx
jne 0x401500
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x4014f5
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x4014de
cmp eax, ebx
je 0x401518
mov eax, 0xff
jmp 0x401660
mov dword [0x00411ad4], 1
mov eax, dword [0x004119b8]
cmp eax, 1
jne 0x401540
lea rdx, [0x00409578]
lea rcx, [0x00409560]
call sub.msvcrt.dll__initterm
mov dword [0x004119b8], 2
cmp r12d, ebx
jne 0x40154f
mov rax, rbx
xchg qword [0x004119c0], rax
cmp qword [0x004119c8], rbx
je 0x401577
lea rcx, [0x004119c8]
call fcn.004052fc
cmp eax, ebx
je 0x401577
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x004119c8]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x40158d
mov eax, 0xff
jmp 0x401660
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x401612
cmp word [rcx], bx
je 0x4015a8
cmp edx, ebx
jne 0x401612
cmp word [rcx], bx
je 0x4015be
cmp word [rcx], 0x20
ja 0x4015be
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x4015a8
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x00400000]
call fcn.00401680
mov dword [0x00411ad0], eax
cmp dword [0x0041160c], ebx
jne 0x4015fc
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x00411ad4], ebx
jne 0x401610
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x00411ad0]
jmp 0x401660
cmp word [rcx], 0x22
jne 0x401625
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x401599
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x402578
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x50
lea rax, [r11 - 0x10]
mov esi, r9d
mov rdi, r8
mov r9d, 1
xor r8d, r8d
xor bl, bl
mov qword [r11 - 0x38], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40266c
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov r9d, 0x10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov r8, rdi
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x40], 4
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
mov rdi, qword [rsp + 0x80]
test eax, eax
jne 0x402608
mov eax, dword [rsp + 0x44]
test esi, esi
je 0x402604
test eax, eax
je 0x402604
cmp eax, 1
jne 0x402608
mov dword [rdi], eax
mov bl, 1
mov dword [rsp + 0x40], 4
test bl, bl
jne 0x402661
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r8, [0x0040f470]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov r9d, 0x10
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x402661
mov eax, dword [rsp + 0x44]
test esi, esi
je 0x40265d
test eax, eax
je 0x40265d
cmp eax, 1
jne 0x402661
mov dword [rdi], eax
mov bl, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x68]
mov al, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x40295c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x4029a9
cmp rcx, 0xffffffffffffffff
je 0x4029a9
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x4029a1
cmp dword [rcx + 0x3c], edx
jl 0x4029a1
cmp dword [rcx + 0x3c], 0x10000000
jae 0x4029a1
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x4029a9
mov rax, rdx
add rsp, 0x18
ret
Function at 0x403050
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x004115d0]
jne 0x40306b
rol rcx, 0x10
test cx, 0xffff
jne 0x403067
ret 0
ror rcx, 0x10
jmp 0x40535c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x00411100]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x004111f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x4053e1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x00411100]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x405403
mov rax, qword [rsp + 0x88]
mov qword [0x004111f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00411198], rax
mov rax, qword [0x004111f8]
mov qword [0x00411070], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00411180], rax
mov dword [0x00411060], 0xc0000409
mov dword [0x00411064], 1
mov rax, qword [0x004115d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x004115d8]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00409b28]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x40326c
Capabilities:
Check os version

Disassembly:
sub rsp, 0x368
mov rax, qword [0x004115d0]
xor rax, rsp
mov qword [rsp + 0x350], rax
cmp qword [0x00411ae8], 0
jne 0x40331f
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40331f
cmp dword [rsp + 0x30], 2
jne 0x403311
cmp dword [rsp + 0x24], 6
jae 0x403311
mov rcx, qword [0x004118c8]
lea rdx, [rsp + 0x140]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40331f
lea rcx, [rsp + 0x140]
call fcn.00404508
mov qword [0x00411ae8], rax
cmp rax, qword [0x004118c8]
jne 0x40331f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40331f
mov rax, qword [0x004118c8]
mov qword [0x00411ae8], rax
mov rcx, qword [0x00411ae8]
mov rax, qword [0x004118c8]
test rcx, rcx
cmovne rax, rcx
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.00403050
add rsp, 0x368
ret
Function at 0x403748
Capabilities:
Accept command line arguments
Create process on windows
Persist via active setup registry key
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x590
mov rax, qword [0x004115d0]
xor rax, rsp
mov qword [rsp + 0x580], rax
lea rcx, [rsp + 0x162]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x160], si
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xa0]
lea rdx, [0x00409f80]
mov r8d, 0xba
call sub.msvcrt.dll_memcpy
lea rax, [rsp + 0x60]
lea r9d, [rsi + 1]
lea rdx, [rsp + 0xa0]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov edi, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x4039a8
mov r8d, 0x208
lea rcx, [rsp + 0x160]
xor edx, edx
mov dword [rsp + 0x54], r8d
mov dword [rsp + 0x50], esi
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x60]
lea r11, [rsp + 0x54]
lea rax, [rsp + 0x160]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x50]
lea rdx, [0x0040a040]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x403887
cmp dword [rsp + 0x50], 1
je 0x403836
cmp dword [rsp + 0x50], 2
jne 0x403887
mov eax, dword [rsp + 0x54]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x160]
shr rax, 1
mov dword [rsp + 0x58], esi
mov word [rsp + rax*2 + 0x15e], si
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
cmp rax, rsi
je 0x403887
mov r8, qword [rax]
lea rcx, [rsp + 0x160]
mov edx, 0x104
call fcn.00402838
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, 1
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x4039a8
mov rax, qword [0x0040a058]
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x370]
mov qword [rcx], rax
mov rax, qword [0x0040a060]
mov r8d, 0x104
mov qword [rcx + 8], rax
mov rax, qword [0x0040a068]
mov qword [rcx + 0x10], rax
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, esi
je 0x4039a8
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x370]
lea r8, [0x0040a070]
lea rcx, [rsp + 0x160]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.004031fc
cmp eax, esi
jl 0x4039a8
mov ebx, 0x68
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8, rbx
call sub.msvcrt.dll_memset
xor eax, eax
lea rdx, [rsp + 0x160]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0xa0], ebx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
je 0x4039a8
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.00403050
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x403bc4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x6f0
mov rax, qword [0x004115d0]
xor rax, rsp
mov qword [rsp + 0x6e0], rax
mov rbp, rcx
call sub.iertutil.dll_Ordinal_42
test eax, eax
je 0x403d8c
call sub.iertutil.dll_Ordinal_44
test eax, eax
jne 0x403d8c
mov edi, 0x104
lea rcx, [rsp + 0xd0]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x403d8c
lea r8, [0x0040a098]
lea rcx, [rsp + 0xd0]
mov rdx, rdi
call fcn.00403130
test eax, eax
js 0x403d8c
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r9d, r9d
lea r8d, [r9 + 1]
lea rcx, [rsp + 0xd0]
mov edx, 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x403d8c
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x403d83
mov eax, 0x1c81080
cmp dword [rsp + 0x44], eax
jb 0x403cb3
cmp dword [rsp + 0x4c], eax
jae 0x403d83
mov rax, qword [0x00411ae8]
test rax, rax
jne 0x403cc4
call fcn.0040326c
lea r8, [rsp + 0x2e0]
mov r9d, 0x200
mov edx, 0x2c3
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x403d83
mov rax, qword [0x00411ae8]
test rax, rax
jne 0x403cf9
call fcn.0040326c
lea r8, [rsp + 0x50]
mov r9d, 0x40
mov edx, 0x2d3
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x403d83
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x2e0]
mov r9d, 0x31
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x403d83
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x0040a0d0]
repne scasw ax, word [rdi]
not rcx
lea rsi, [rcx - 1]
lea rdx, [rcx + rcx]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x403d83
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r8, [0x0040a0d0]
lea rdx, [rsi + 1]
mov rcx, rdi
mov qword [rbp], rdi
call fcn.00402838
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x6e0]
xor rcx, rsp
call fcn.00403050
lea r11, [rsp + 0x6f0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x403dbc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x403e82
test rdx, rdx
je 0x403e82
xor r9d, r9d
lea rdx, [0x0040e118]
lea esi, [r9 + 1]
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x403e03
xor ebx, ebx
jmp 0x403e12
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
lea rdx, [0x0040e118]
xor r9d, r9d
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x403e39
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rbx, rbx
je 0x403e77
test rax, rax
je 0x403e77
mov ecx, 0xfecdfecd
cmp dword [rbx], ecx
jne 0x403e71
cmp dword [rax], ecx
jne 0x403e71
mov rdx, qword [rbx + 0x1c]
cmp rdx, qword [rax + 0x1c]
jne 0x403e68
mov rdx, qword [rbx + 0x24]
cmp rdx, qword [rax + 0x24]
jne 0x403e68
xor eax, eax
jmp 0x403e6d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403e73
xor esi, esi
mov eax, esi
jmp 0x403e84
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x403f70
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x004115d0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x00411af0]
test eax, eax
jne 0x404075
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x403fd3
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [rsp + 0x30]
mov edx, dword [rsp + 0x24]
xor eax, eax
lea r8d, [rax + 1]
mov dword [0x00411af0], eax
sub ecx, r8d
je 0x404055
cmp ecx, r8d
jne 0x404075
cmp edx, 5
jne 0x404043
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x40403c
sub ecx, r8d
je 0x404027
cmp ecx, r8d
je 0x404011
lea eax, [rdx + 0xf]
jmp 0x40406f
cmp word [rsp + 0x134], r8w
mov ecx, 0x10
cmovae eax, ecx
or eax, 4
jmp 0x40406f
mov edx, 8
lea ecx, [rdx - 6]
cmp word [rsp + 0x134], cx
cmovae eax, edx
jmp 0x404022
mov eax, 4
jmp 0x40406f
cmp edx, 4
ja 0x40408d
mov ecx, 2
mov eax, ecx
mov dword [0x00411af0], ecx
cmp edx, 4
jne 0x404075
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x40406c
cmp ecx, 0xa
je 0x40406c
cmp ecx, 0x5a
jne 0x404075
mov eax, r8d
mov dword [0x00411af0], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.00403050
add rsp, 0x158
ret
mov eax, 0x20
jmp 0x40406f
Function at 0x404af4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x58
lea rax, [r11 - 0x18]
lea r8, [0x0040a168]
lea rdx, [0x0040a190]
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], r9
and qword [r11 - 0x38], 0
mov r9d, 0x10
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
call sub.SHLWAPI.dll_SHRegGetValueW
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
add rsp, 0x58
ret

Function at 0x404b54
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
sub rsp, 0x38
lea rax, [r11 + 0x20]
mov r9d, 4
mov dword [r11 - 0x10], r9d
mov qword [r11 - 0x18], rax
call sub.SHLWAPI.dll_SHSetValueW
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
add rsp, 0x38
ret

Function at 0x405180
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov r11d, dword [r8]
mov rbx, rdx
mov r9, rcx
and r11d, 0xfffffff8
test byte [r8], 4
mov r10, rcx
je 0x4051af
mov eax, dword [r8 + 8]
movsxd r10, dword [r8 + 4]
neg eax
add r10, rcx
movsxd rcx, eax
and r10, rcx
movsxd rax, r11d
mov rdx, qword [rax + r10]
mov rax, qword [rbx + 0x10]
mov ecx, dword [rax + 8]
add rcx, qword [rbx + 8]
test byte [rcx + 3], 0xf
je 0x4051d3
movzx eax, byte [rcx + 3]
and eax, 0xfffffff0
cdqe
add r9, rax
xor r9, rdx
mov rcx, r9
add rsp, 0x20
pop rbx
jmp fcn.00403050

Function at 0x40556c
Capabilities:
Set registry value

Disassembly:
mov r9d, ecx
lea r8, [0x00409bb8]
lea rdx, [0x00409b60]
mov rcx, 0xffffffff80000001
jmp fcn.00404b54

Function at 0x405740
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
and dword [rsp + 0x40], 0
lea rax, [r11 + 0x10]
lea r9, [r11 + 0x18]
mov qword [r11 - 0x10], rax
lea rax, [r11 + 8]
lea r8, [0x00409bb8]
lea rdx, [0x00409b60]
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x48], 4
mov qword [r11 - 0x18], rax
call sub.SHLWAPI.dll_SHGetValueW
test eax, eax
jne 0x4057a8
cmp dword [rsp + 0x50], 4
jne 0x4057a0
mov eax, dword [rsp + 0x40]
cmp eax, 1
je 0x4057ac
cmp eax, 2
je 0x4057ac
cmp eax, 0xa
je 0x4057ac
xor eax, eax
mov dword [rsp + 0x40], eax
jmp 0x4057ac
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x4057ea
call fcn.004056a8
mov dword [rsp + 0x40], eax
test eax, eax
je 0x4057ea
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x4057e6
mov r9d, dword [rsp + 0x40]
lea r8, [0x00409bb8]
lea rdx, [0x00409b60]
mov rcx, 0xffffffff80000001
call fcn.00404b54
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret