joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b6b50
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x180
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r12d, edx
mov edi, 1
mov dword [rsp + 0x20], edi
xor ebx, ebx
mov dword [rsp + 0x24], ebx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
mov eax, edi
test eax, eax
je 0x1400b6bdc
test edi, edi
je 0x1400b6bdc
cmp rsi, 0xffffffffffffffff
je 0x1400b6beb
test r12b, 1
je 0x1400b6bc0
test byte [rsp + 0x30], 0x10
jne 0x1400b6bc7
add ebx, 1
mov dword [rsp + 0x24], ebx
test r12d, r12d
je 0x1400b6bdc
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x1400b6ba5
cmp rsi, 0xffffffffffffffff
je 0x1400b6beb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
je 0x1400b6bf3
test ebx, ebx
jne 0x1400b6bf5
xor edi, edi
mov dword [rsp + 0x20], edi
mov eax, edi
jmp 0x1400b6c01
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400c2a20
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x1400b6c60
Capabilities:
Get file size
Read file on windows

Disassembly:
push r12
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rdi
mov edi, edx
mov rbx, rcx
xor r12d, r12d
mov qword [rsp + 0x40], r12
test rcx, rcx
je 0x1400b6d4c
call fcn.1400b6a90
test eax, eax
je 0x1400b6d4c
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400b6d4c
test edi, edi
je 0x1400b6cf7
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, edi
jae 0x1400b6d04
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
jmp 0x1400b6d04
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [rdi + 1]
mov ebx, eax
mov ecx, eax
call fcn.14008c4a0
mov r12, rax
mov qword [rsp + 0x40], rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.1400c2840
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov r8d, edi
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, r12
jmp 0x1400b6d56
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
Function at 0x1400b7240
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov rax, rsp
push r13
push r14
push r15
sub rsp, 0x120
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rsi, r9
mov rbx, rdx
mov rdi, rcx
xor r14d, r14d
mov dword [rsp + 0x50], r14d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r13, rax
xor edx, edx
lea r8d, [r14 + 0x68]
lea rcx, [rsp + 0x80]
call fcn.1400c2840
xor r11d, r11d
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x70], r11
mov dword [rsp + 0x80], 0x68
movzx ecx, word [rsp + 0x160]
mov word [rsp + 0xc0], cx
mov edx, dword [rsp + 0xbc]
mov r15d, 1
cmp cx, 5
cmovne edx, r15d
mov dword [rsp + 0xbc], edx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov r12d, eax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x1400b7336
xor ecx, ecx
call fcn.1400b71d0
jmp 0x1400b73c9
mov ebx, r14d
mov dword [rsp + 0x58], ebx
mov edi, dword [rsp + 0x168]
nop
nop
nop
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400b73a7
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xf0]
call qword [sym.imp.USER32.dll_PeekMessageA]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0x32
mov dword [rsp + 0x58], ebx
test edi, edi
je 0x1400b73a5
cmp ebx, edi
jb 0x1400b73a5
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400b73a7
jmp 0x1400b7350
test rsi, rsi
je 0x1400b73c9
mov dword [rsp + 0x54], r14d
lea rdx, [rsp + 0x54]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov r11d, dword [rsp + 0x54]
mov dword [rsi], r11d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.USER32.dll_SetForegroundWindow]
nop
mov eax, r12d
jmp 0x1400b73f2
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x1400b7450
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x130], rax
movzx esi, r9w
mov edi, r8d
mov r13, rdx
mov r12, rcx
xor ebx, ebx
mov dword [rsp + 0x50], ebx
lea rcx, [r11 - 0x58]
mov rax, qword [str.landesk0]
mov qword [rcx], rax
movzx eax, byte [0x140119cc0]
mov byte [rcx + 8], al
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x10000000
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [r11 - 0x58]
call qword [sym.imp.USER32.dll_CreateDesktopA]
mov r14, rax
xor edx, edx
lea r8d, [rbx + 0x68]
lea rcx, [rsp + 0x80]
call fcn.1400c2840
xor r11d, r11d
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x68], r11
mov dword [rsp + 0x80], 0x68
mov word [rsp + 0xc0], si
lea rax, [rsp + 0x120]
mov qword [rsp + 0x90], rax
mov r8d, dword [rsp + 0xbc]
mov r15d, 1
cmp si, 5
cmovne r8d, r15d
mov dword [rsp + 0xbc], r8d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x1400b7585
xor ecx, ecx
call fcn.1400b71d0
jmp 0x1400b75e7
mov dword [rsp + 0x54], ebx
nop
nop
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400b75e7
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xf0]
call qword [sym.imp.USER32.dll_PeekMessageA]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0x32
mov dword [rsp + 0x54], ebx
test edi, edi
je 0x1400b75e5
cmp ebx, edi
jb 0x1400b75e5
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400b75e7
jmp 0x1400b7590
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.USER32.dll_CloseDesktop]
nop
mov eax, esi
jmp 0x1400b760f
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b7660
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rcx
mov dword [rsp + 0x48], 0
test rcx, rcx
je 0x1400b76fd
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
je 0x1400b76fd
lea rdx, [rcx + 1]
lea ecx, [rax + 0x42]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rax
nop
nop
nop
movzx eax, byte [rbx]
mov byte [rdx], al
add rbx, 1
add rdx, 1
test al, al
jne 0x1400b76c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
xor eax, eax
jmp 0x1400b7705
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b7e40
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x1c0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_Explorer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400b800f
mov byte [rsp + 0xa0], al
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0xa1]
call fcn.1400c2840
mov dword [rsp + 0x4c], 0x104
mov dword [rsp + 0x48], 1
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.Version
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400b8003
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x5c], ebx
mov byte [rsp + 0x88], al
xor eax, eax
mov qword [rsp + 0x89], rax
mov qword [rsp + 0x91], rax
mov word [rsp + 0x99], ax
mov byte [rsp + 0x9b], al
mov byte [rsp + 0x70], al
mov qword [rsp + 0x71], rax
mov qword [rsp + 0x79], rax
mov word [rsp + 0x81], ax
mov byte [rsp + 0x83], al
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x50], rcx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x60], rdx
movzx r8d, byte [rax]
test r8b, r8b
je 0x1400b7fd9
cmp r8b, 0x2e
je 0x1400b7fa0
mov byte [rcx], r8b
add rcx, 1
mov qword [rsp + 0x50], rcx
add rax, 1
mov qword [rsp + 0x40], rax
jmp 0x1400b7f74
movzx ecx, byte [rax]
test cl, cl
je 0x1400b7fd9
cmp cl, 0x2e
jne 0x1400b7fb7
add rax, 1
mov qword [rsp + 0x40], rax
jmp 0x1400b7fa0
movzx ecx, byte [rax]
test cl, cl
je 0x1400b7fd9
cmp cl, 0x2e
je 0x1400b7fd9
mov byte [rdx], cl
add rdx, 1
mov qword [rsp + 0x60], rdx
add rax, 1
mov qword [rsp + 0x40], rax
jmp 0x1400b7fb7
lea rcx, [rsp + 0x88]
call fcn.1400c2e70
mov ebx, eax
lea rcx, [rsp + 0x70]
call fcn.1400c2e70
movzx ecx, bx
shl ecx, 0x10
movzx eax, ax
or ecx, eax
mov ebx, ecx
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov eax, ebx
jmp 0x1400b8017
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0x1c0
pop rbx
ret
Function at 0x1400b8780
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0x150
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x168], rbx
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov byte [rsp + 0x30], bl
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x31]
call fcn.1400c2840
test rdi, rdi
je 0x1400b87e9
cmp byte [rdi], bl
je 0x1400b87e9
mov r8d, 0x104
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400b85c0
jmp 0x1400b87fc
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [0x1400e5fac]
lea rcx, [rsp + 0x30]
call fcn.1400c2e00
test rax, rax
je 0x1400b8834
mov byte [rax + 2], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x1400b882b
cmp eax, 5
jne 0x1400b8830
mov ebx, 1
mov dword [rsp + 0x20], ebx
mov eax, ebx
jmp 0x1400b883c
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400c2a20
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x1400b8c10
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x168
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbp, rdx
xor ebx, ebx
mov rsi, rcx
mov rcx, rdx
lea rdx, [rsp + 0x40]
mov r12d, r9d
mov r13d, r8d
mov dword [rsp + 0x30], ebx
sub rdx, rcx
nop
movzx eax, byte [rcx]
add rcx, 1
test al, al
mov byte [rdx + rcx - 1], al
jne 0x1400b8c50
lea r8, [rsp + 0x30]
mov r9d, 1
mov edx, r12d
mov rcx, rbp
call fcn.1400b34a0
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x1400b8cfc
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x1400b8d2b
lea r8, [rsp + 0x30]
xor r9d, r9d
mov edx, r13d
mov rcx, rsi
mov dword [rsp + 0x30], ebx
call fcn.1400b3410
test rax, rax
je 0x1400b8cec
mov esi, dword [rsp + 0x30]
lea r9, [rsp + 0x34]
mov rdx, rax
mov rcx, rdi
mov r8d, esi
mov dword [rsp + 0x34], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400b8cd1
cmp dword [rsp + 0x34], esi
je 0x1400b8cf1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x70
mov rcx, rdi
test eax, eax
cmovne ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b8d00
mov ebx, 0x714
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b8d00
mov ebx, dword [rsp + 0x30]
test ebx, ebx
jne 0x1400b8d29
test r12d, r12d
je 0x1400b8d29
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.1400c1f80
test eax, eax
je 0x1400b8d29
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.1400b8880
jmp 0x1400b8d2b
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0x168
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400ba390
Capabilities:
Encode data using xor

Disassembly:
cmp r8, 0xc
jl 0x1400ba51c
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
sub rsp, 0x30
mov rbp, rdx
mov r13, r8
lea rdx, [rsp + 0x20]
mov r8, r9
mov qword [rsp + 0x50], rbx
mov rdi, r9
mov r12, rcx
mov qword [rsp + 0x58], rsi
call fcn.1400ba2f0
xor ebx, ebx
nop
call fcn.1400c2ab0
lea rdx, [rsp + 0x20]
mov rcx, r12
sar eax, 7
movzx r8d, al
call fcn.1400ba230
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.1400ba210
add rbx, 1
cmp rbx, 0xa
mov byte [rbx + rbp - 1], al
jl 0x1400ba3d0
lea rdx, [rsp + 0x20]
mov r8, rdi
mov rcx, r12
call fcn.1400ba2f0
mov esi, 0xa
nop
nop
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.1400ba210
movzx edi, byte [rbp]
lea rdx, [rsp + 0x20]
movzx r8d, dil
mov rcx, r12
movzx ebx, al
call fcn.1400ba230
xor dil, bl
add rbp, 1
sub rsi, 1
mov byte [rbp - 1], dil
jne 0x1400ba420
mov esi, dword [rsp + 0x70]
lea rdx, [rsp + 0x20]
mov rcx, r12
mov edi, esi
shr edi, 0x10
mov byte [rbp], dil
call fcn.1400ba210
lea rdx, [rsp + 0x20]
movzx r8d, dil
mov rcx, r12
movzx ebx, al
call fcn.1400ba230
xor dil, bl
lea rdx, [rsp + 0x20]
shr esi, 0x18
mov rcx, r12
mov byte [rbp], dil
mov byte [rbp + 1], sil
call fcn.1400ba210
lea rdx, [rsp + 0x20]
movzx r8d, sil
mov rcx, r12
movzx ebx, al
call fcn.1400ba230
xor sil, bl
sub r13, 0xc
mov byte [rbp + 1], sil
mov rsi, qword [rsp + 0x58]
add rbp, 2
test r13, r13
jle 0x1400ba509
nop
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.1400ba210
movzx edi, byte [rbp]
lea rdx, [rsp + 0x20]
movzx r8d, dil
mov rcx, r12
movzx ebx, al
call fcn.1400ba230
xor dil, bl
sub r13, 1
mov byte [rbp], dil
add rbp, 1
test r13, r13
jg 0x1400ba4d0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret 0
Function at 0x1400bbd30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov edi, dword [rcx + 0x44]
mov qword [rsp + 0x40], r12
mov rbp, rcx
mov qword [rsp + 0x48], r13
nop
mov edx, dword [rbp + 0x94]
mov ebx, dword [rbp + 0x58]
mov eax, dword [rbp + 0x44]
sub ebx, dword [rbp + 0x9c]
lea ecx, [rdi + rax - 0x106]
sub ebx, edx
cmp edx, ecx
jb 0x1400bbdec
mov rcx, qword [rbp + 0x50]
mov r8, rdi
lea rdx, [rcx + rdi]
call fcn.1400c1a10
mov r8d, dword [rbp + 0x74]
mov rax, qword [rbp + 0x68]
sub dword [rbp + 0x98], edi
sub dword [rbp + 0x94], edi
sub dword [rbp + 0x84], edi
lea rdx, [rax + r8*2]
nop
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, edi
jb 0x1400bbdb0
sub eax, edi
jmp 0x1400bbdb2
xor eax, eax
add r8d, 0xffffffff
mov word [rdx], ax
jne 0x1400bbda0
mov rax, qword [rbp + 0x60]
mov edx, edi
lea rcx, [rax + rdi*2]
nop
nop
nop
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, edi
jb 0x1400bbde0
sub eax, edi
jmp 0x1400bbde2
xor eax, eax
add edx, 0xffffffff
mov word [rcx], ax
jne 0x1400bbdd0
add ebx, edi
mov rsi, qword [rbp]
cmp dword [rsi + 8], 0
je 0x1400bbecb
mov eax, dword [rbp + 0x94]
mov r13d, dword [rbp + 0x9c]
add r13, rax
mov eax, dword [rsi + 8]
add r13, qword [rbp + 0x50]
cmp eax, ebx
mov r12d, eax
cmova r12d, ebx
test r12d, r12d
je 0x1400bbe72
sub eax, r12d
mov dword [rsi + 8], eax
mov rax, qword [rsi + 0x28]
mov ecx, dword [rax + 0x2c]
cmp ecx, 1
jne 0x1400bbe44
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.1400becf0
mov dword [rsi + 0x4c], eax
jmp 0x1400bbe5a
cmp ecx, 2
jne 0x1400bbe5a
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.1400bae40
mov dword [rsi + 0x4c], eax
mov rdx, qword [rsi]
mov r8d, r12d
mov rcx, r13
mov ebx, r12d
call fcn.1400c1a10
add qword [rsi], rbx
add dword [rsi + 0xc], r12d
add dword [rbp + 0x9c], r12d
mov r9d, dword [rbp + 0x9c]
cmp r9d, 3
jb 0x1400bbeb4
mov eax, dword [rbp + 0x94]
mov rdx, qword [rbp + 0x50]
mov ecx, dword [rbp + 0x80]
movzx r8d, byte [rax + rdx]
add eax, 1
mov dword [rbp + 0x70], r8d
movzx eax, byte [rax + rdx]
shl r8d, cl
xor r8d, eax
and r8d, dword [rbp + 0x7c]
mov dword [rbp + 0x70], r8d
cmp r9d, 0x106
jae 0x1400bbecb
mov rax, qword [rbp]
cmp dword [rax + 8], 0
jne 0x1400bbd50
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c1860
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x198
mov rax, qword [0x1401620c0]
mov qword [rsp + 0x150], rax
mov rax, qword [0x140169510]
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
test rax, rax
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov rdi, r9
mov esi, r8d
mov r12, rdx
mov rbp, rcx
mov r13d, 1
jne 0x1400c1976
cmp dword [0x140169508], eax
jne 0x1400c1976
lea rax, [rsp + 0x38]
mov qword [r11 - 8], rbx
lea rdx, str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400c1949
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [0x1400e4ec8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
test eax, eax
cmove ebx, r13d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1400c1949
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140169510], rax
jmp 0x1400c1950
mov rax, qword [0x140169510]
test rax, rax
mov rbx, qword [rsp + 0x190]
jne 0x1400c1976
lea rcx, str.hhctrl.ocx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov qword [0x140169510], rax
je 0x1400c199e
mov r10, qword [0x1401694f8]
test r10, r10
jne 0x1400c19a9
lea edx, [r10 + 0xe]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r10, rax
mov qword [0x1401694f8], rax
jne 0x1400c19a9
mov dword [0x140169508], r13d
xor eax, eax
jmp 0x1400c19b8
mov r9, rdi
mov r8d, esi
mov rdx, r12
mov rcx, rbp
call r10
mov r13, qword [rsp + 0x168]
mov r12, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x178]
mov rsi, qword [rsp + 0x180]
mov rbp, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x150]
call fcn.1400c2a20
add rsp, 0x198
ret
Function at 0x1400c45f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
sub rsp, 0x30
xor ebx, ebx
test r8, r8
mov rbp, r9
mov rsi, r8
mov r12d, edx
mov r13, rcx
jne 0x1400c463c
call fcn.1400ca700
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov dword [rax], SafeArrayGetElement
call fcn.1400c7410
xor eax, eax
jmp 0x1400c46e2
mov qword [rsp + 0x50], rdi
call fcn.140006a20
mov edx, 0x2d8
mov ecx, 1
call fcn.1400d1f10
test rax, rax
mov rdi, rax
je 0x1400c46c8
call fcn.1400cc360
mov rcx, rdi
mov rdx, qword [rax + 0xc0]
call fcn.1400cc140
mov rcx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x70]
test rcx, rcx
lea r8, [rsp + 0x60]
mov rdx, r12
cmovne r8, rcx
mov r9, rdi
mov rcx, r13
mov qword [rsp + 0x28], r8
lea r8, [0x1400c4550]
mov qword [rdi + 0x90], rsi
mov qword [rdi + 0x98], rbp
mov qword [rdi + 8], 0xffffffffffffffff
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x1400c46dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.1400c79f0
test ebx, ebx
je 0x1400c46db
mov ecx, ebx
call fcn.1400ca760
xor eax, eax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rsi
ret

Function at 0x1400c7410
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x140169588]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.1400cc040
test rax, rax
je 0x1400c7464
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x1400c74f9
mov ecx, 2
call fcn.1400d3a70
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.1400c2840
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1400c74e5
test ebx, ebx
jne 0x1400c74e5
lea ecx, [rax + 2]
call fcn.1400d3a70
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret