joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001110
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
xor eax, eax
mov r8d, eax
mov r9, qword gs:[0x30]
mov rax, qword [r9 + 0x60]
mov rax, qword [rax + 0x18]
mov r9, rax
add r9, 0x20
mov rax, qword [rax + 0x20]
cmp rax, r9
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r8
je 0x1400012ab
mov rax, qword [rsp + 0x60]
cmp rax, 0
setne cl
mov rdx, qword [rsp + 0x58]
cmp rdx, 0
sete r8b
mov r9, qword [rsp + 0x50]
mov byte [rsp + 0x3f], cl
mov byte [rsp + 0x3e], r8b
mov qword [rsp + 0x30], r9
mov rax, qword [rsp + 0x30]
mov cx, word [rax + 0x48]
mov rdx, qword [rax + 0x50]
mov r8, qword [rax + 0x20]
mov r9, qword [rsp + 0x60]
cmp r8, r9
sete r10b
mov r11b, byte [rsp + 0x3f]
and r11b, r10b
test r11b, 1
mov qword [rsp + 0x28], rax
mov word [rsp + 0x26], cx
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x10], r8
jne 0x1400011c8
jmp 0x1400011db
mov rax, qword [rsp + 0x28]
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x40], rax
jmp 0x1400012ab
mov al, byte [rsp + 0x3e]
test al, 1
jne 0x140001287
jmp 0x1400011e9
mov ax, word [rsp + 0x26]
shr ax, 1
movzx ecx, ax
cmp ax, 0
mov dword [rsp + 0xc], ecx
je 0x140001287
xor eax, eax
mov dword [rsp + 8], eax
jmp 0x14000120b
mov eax, dword [rsp + 8]
mov ecx, eax
mov edx, ecx
mov r8, qword [rsp + 0x18]
mov r9w, word [r8 + rdx*2]
mov r10w, r9w
add r10w, 0xffbf
mov r11w, r9w
add r11w, 0x20
cmp r10w, 0x1a
cmovb r9w, r11w
mov rsi, qword [rsp + 0x58]
cmp word [rsi + rdx*2], r9w
sete bl
cmp r9w, 0
setne dil
mov bpl, bl
and bpl, dil
add eax, 1
mov ecx, dword [rsp + 0xc]
cmp eax, ecx
setb dil
and bpl, dil
test bpl, 1
mov byte [rsp + 7], bl
mov dword [rsp + 8], eax
jne 0x14000120b
mov al, byte [rsp + 7]
test al, 1
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x40], rcx
jne 0x1400012ab
jmp 0x140001287
xor eax, eax
mov ecx, eax
mov rdx, qword [rsp + 0x28]
mov r8, qword [rdx]
mov r9, qword [rsp + 0x48]
cmp r8, r9
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rcx
jne 0x140001187
mov rax, qword [rsp + 0x40]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400013d7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x80
lea rax, [0x140003010]
xor edx, edx
mov qword [rsp + 0x78], rcx
mov rcx, rax
call fcn.140001110
xor r8d, r8d
mov ecx, r8d
movsxd rdx, dword [rax + 0x3c]
mov r9, rax
add r9, rdx
cmp dword [rax + rdx], 0x4550
mov rdx, rcx
cmove rdx, r9
mov r8d, dword [rdx + 0x88]
mov edx, r8d
mov r9, rax
add r9, rdx
mov r8d, dword [rax + rdx + 0x20]
mov r10d, r8d
mov r11, rax
add r11, r10
mov r8d, dword [rax + rdx + 0x18]
cmp r8d, 0
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x6c], r8d
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], rcx
je 0x14000157f
xor eax, eax
mov rcx, qword [rsp + 0x58]
mov edx, dword [rcx + 0x24]
mov r8d, edx
mov r9, qword [rsp + 0x70]
add r9, r8
mov qword [rsp + 0x48], r9
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x48]
xor edx, edx
mov r8d, eax
mov r9d, r8d
mov r10, qword [rsp + 0x60]
mov r8d, dword [r10 + r9*4]
mov r9d, r8d
mov r11, qword [rsp + 0x70]
add r11, r9
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x2c], edx
mov eax, dword [rsp + 0x2c]
mov ecx, eax
mov edx, ecx
mov r8, qword [rsp + 0x30]
mov r9b, byte [r8 + rdx]
mov r10, qword [rsp + 0x78]
mov r11b, byte [r10 + rdx]
cmp r9b, r11b
sete bl
cmp r9b, 0
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x27], bl
mov byte [rsp + 0x26], r11b
je 0x14000150c
mov al, byte [rsp + 0x26]
cmp al, 0
setne cl
mov edx, dword [rsp + 0x28]
add edx, 1
mov r8b, byte [rsp + 0x27]
and r8b, cl
cmp edx, 0x20
setb cl
and r8b, cl
test r8b, 1
mov dword [rsp + 0x2c], edx
jne 0x1400014ae
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140001548
jmp 0x140001516
xor eax, eax
mov ecx, eax
mov rdx, qword [rsp + 0x38]
add rdx, 2
mov eax, dword [rsp + 0x40]
add eax, 1
mov r8d, dword [rsp + 0x6c]
cmp eax, r8d
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
jb 0x140001477
jmp 0x14000157f
mov rax, qword [rsp + 0x38]
mov cx, word [rax]
mov rdx, qword [rsp + 0x58]
mov r8d, dword [rdx + 0x1c]
mov r9d, r8d
mov r10, qword [rsp + 0x70]
add r10, r9
movzx r8d, cx
mov r9d, r8d
mov r8d, dword [r10 + r9*4]
mov r9d, r8d
mov r10, qword [rsp + 0x70]
add r10, r9
mov qword [rsp + 0x50], r10
mov rax, qword [rsp + 0x50]
add rsp, 0x80
pop rbx
ret
Function at 0x1400019df
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0xd0
xor eax, eax
xor r8d, r8d
mov r9d, r8d
mov r10, qword [rdx + 0x38]
mov rdx, qword [rdx + 0x80]
movsxd r11, dword [rcx + 0x3c]
mov rsi, rcx
add rsi, r11
cmp dword [rcx + r11], 0x4550
cmove r9, rsi
cmp dword [r9 + 0x94], 0
mov qword [rsp + 0xc8], r10
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xb8], rdx
mov qword [rsp + 0xb0], r9
mov dword [rsp + 0xac], eax
je 0x140001cad
xor eax, eax
mov rcx, qword [rsp + 0xb0]
mov edx, dword [rcx + 0x90]
mov r8d, edx
mov r9, qword [rsp + 0xc0]
add r9, r8
mov r10, qword [rsp + 0xc0]
mov edx, dword [r10 + r8 + 0xc]
cmp edx, 0
mov dword [rsp + 0xa8], edx
mov qword [rsp + 0xa0], r9
mov dword [rsp + 0xac], eax
je 0x140001cad
mov rax, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0xa8]
mov dword [rsp + 0x9c], ecx
mov qword [rsp + 0x90], rax
jmp 0x140001aea
xor eax, eax
mov rcx, qword [rsp + 0x88]
add rcx, 0x14
mov rdx, qword [rsp + 0x88]
mov r8d, dword [rdx + 0x20]
cmp r8d, 0
mov qword [rsp + 0x90], rcx
mov dword [rsp + 0x9c], r8d
mov dword [rsp + 0xac], eax
je 0x140001cad
mov rax, qword [rsp + 0x90]
mov ecx, dword [rsp + 0x9c]
mov ecx, ecx
mov edx, ecx
mov r8, qword [rsp + 0xc0]
add r8, rdx
mov rcx, r8
mov rdx, qword [rsp + 0xc8]
mov qword [rsp + 0x88], rax
call rdx
mov r9d, 1
cmp rax, 0
mov qword [rsp + 0x80], rax
mov dword [rsp + 0xac], r9d
je 0x140001cad
mov rax, qword [rsp + 0x88]
mov ecx, dword [rax]
cmp ecx, 0
mov dword [rsp + 0x7c], ecx
je 0x140001b88
mov eax, dword [rsp + 0x7c]
mov ecx, eax
mov edx, ecx
mov r8, qword [rsp + 0xc0]
add r8, rdx
mov rdx, qword [rsp + 0x88]
mov ecx, dword [rdx + 0x10]
mov r9d, ecx
mov r10, qword [rsp + 0xc0]
add r10, r9
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], r10
jmp 0x140001bad
mov rax, qword [rsp + 0x88]
mov ecx, dword [rax + 0x10]
mov edx, ecx
mov r8, qword [rsp + 0xc0]
add r8, rdx
mov rdx, r8
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x68], r8
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx]
cmp rdx, 0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdx
je 0x140001aaf
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rdx
jmp 0x140001bf3
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0xc0]
add r8, rdx
add r8, 2
mov r9, rdx
and r9, 0xffff
cmp rdx, 0
cmovl r8, r9
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x30], rcx
mov rcx, rdx
mov rdx, r8
mov r8, qword [rsp + 0xb8]
mov qword [rsp + 0x28], rax
call r8
mov r10d, 1
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
cmp rax, 0
mov dword [rsp + 0x24], r10d
je 0x140001c99
xor eax, eax
mov rcx, qword [rsp + 0x28]
add rcx, 8
mov rdx, qword [rsp + 0x30]
add rdx, 8
mov r8, qword [rsp + 0x28]
mov r9, qword [r8 + 8]
cmp r9, 0
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], r9
mov dword [rsp + 0x24], eax
jne 0x140001bf3
mov eax, dword [rsp + 0x24]
cmp eax, 0
mov dword [rsp + 0xac], eax
je 0x140001aaf
mov eax, dword [rsp + 0xac]
add rsp, 0xd0
pop rsi
ret
Function at 0x1400028bd
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 0xc0]
mov qword [rsp + 0x30], rax
mov rdx, qword gs:[0x30]
mov rax, qword [rdx + 0x60]
mov rax, qword [rax + 0x18]
mov rdx, rax
add rdx, 0x20
mov rax, qword [rax + 0x20]
cmp rax, rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x18], rax
je 0x140002979
mov rax, qword [rsp + 0x30]
cmp rax, 0
setne cl
mov rdx, qword [rsp + 0x18]
mov byte [rsp + 0x17], cl
mov qword [rsp + 8], rdx
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x20], rcx
sete dl
mov r8b, byte [rsp + 0x17]
and r8b, dl
test r8b, 1
mov qword [rsp], rax
jne 0x140002952
mov rax, qword [rsp]
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x20]
cmp rcx, rdx
mov qword [rsp + 8], rcx
je 0x140002979
jmp 0x140002917
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x70]
mov edx, ecx
mov r8, qword [rsp + 0x30]
add r8, rdx
mov rdx, qword [rsp]
mov qword [rdx + 0x28], r8
mov ecx, dword [rax + 0xe8]
mov r8d, ecx
mov qword [rdx + 0x30], r8
add rsp, 0x38
ret
Function at 0x14000426c
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140011008]
xor rax, rsp
mov qword [rbp - 8], rax
xor edi, edi
lea rax, [rbp - 0x18]
lea rcx, [rbp - 0x10]
mov qword [r11 - 0x38], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
lea esi, [rdi + 1]
lea r8d, [rdi + 0x12]
xor r9d, r9d
mov dl, sil
mov dword [rsp + 0x28], edi
mov ebx, edi
mov dword [rbp - 0x20], edi
mov dword [rsp + 0x20], edi
mov dword [rbp - 0x10], edi
mov word [rbp - 0xc], 0x500
mov qword [rbp - 0x18], rdi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400042fd
mov rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1400042fd
cmp dword [rbp - 0x20], edi

Function at 0x14000433c
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140011008]
xor rax, rsp
mov qword [rbp - 8], rax
xor edi, edi
lea rax, [rbp - 0x18]
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
lea r8d, [rdi + 0x20]
mov r9d, 0x220
mov dl, 2
mov dword [rsp + 0x28], edi
mov ebx, edi
mov dword [rbp - 0x1c], edi
mov dword [rbp - 0x10], edi
mov dword [rsp + 0x20], edi
mov word [rbp - 0xc], 0x500
mov qword [rbp - 0x18], rdi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400043e7
mov rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x1c]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1400043e7
cmp dword [rbp - 0x1c], edi
je 0x1400043e7
lea rdx, [rbp - 0x20]
xor ecx, ecx
mov dword [rbp - 0x20], 0x1000
call fcn.14000cb54
test eax, eax
jne 0x1400043e7
cmp dword [rbp - 0x20], 0x3000
setae bl
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400043f6
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14000faa0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400044dc
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140011008]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x32]
xor edi, edi
xor edx, edx
mov r8d, 0x1fe
mov word [rsp + 0x30], di
call sub.msvcrt.dll_memset
lea rdx, [0x140001240]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r8, [rsp + 0x30]
mov r9d, 0x100
mov rcx, rax
mov edx, 0x3e9
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x14000458e
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x140004555
lea eax, [rax*2 + 2]
lea rdx, [0x140001218]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140004594
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000faa0
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
Function at 0x1400045bc
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x140011008]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov rsi, rcx
mov r14, rdx
lea rcx, [rsp + 0x64]
xor edx, edx
mov r8d, 0x218
mov dword [rsp + 0x60], 0x40
call sub.msvcrt.dll_memset
mov r12d, 0x10e
lea rcx, [rsp + 0x60]
mov edx, r12d
mov r8, r14
call fcn.140004148
or rdi, 0xffffffffffffffff
xor r15d, r15d
mov ebx, eax
test eax, eax
jne 0x14000468d
lea r8, [0x140001250]
lea rcx, [rsp + 0x60]
mov edx, r12d
call fcn.140004148
mov ebx, eax
test eax, eax
jne 0x14000468d
lea rcx, [rsp + 0x60]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140004653
lea eax, [rax*2 + 2]
lea rdx, [0x140001260]
mov r9d, 2
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test ebx, ebx
jne 0x1400047bb
lea rax, [rsp + 0x5c]
lea r9, [0x140001280]
lea rdx, [0x140001290]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov rcx, rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400047bb
mov rcx, qword [rsp + 0x50]
lea r9d, [rax + 4]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], r9d
lea rdx, [0x1400012a8]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x1400047b0
lea rcx, [rbp + 0x184]
xor edx, edx
mov r8d, 0x218
mov dword [rbp + 0x180], 0x40
call sub.msvcrt.dll_memset
lea rcx, [rbp + 0x180]
mov r8, r14
mov rdx, r12
call fcn.140004148
mov ebx, eax
test eax, eax
jne 0x1400047b0
lea r8, [0x1400012b8]
lea rcx, [rbp + 0x180]
mov rdx, r12
call fcn.140004148
mov ebx, eax
test eax, eax
jne 0x1400047b0
lea rax, [rbp + 0x180]
inc rdi
cmp word [rax + rdi*2], r15w
jne 0x140004772
mov rcx, qword [rsp + 0x50]
lea eax, [rdi*2 + 2]
lea rdx, [0x1400012c8]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x180]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.14000faa0
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400050a4
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
xor ecx, ecx
xor esi, esi
mov r14, r9
mov r15d, r8d
mov r12, rdx
lea ebp, [rbx + 1]
mov qword [rax + 8], rcx
test r8d, r8d
je 0x140005169
mov rdi, r9
test ebp, ebp
je 0x140005105
lea r8, [rsp + 0x60]
lea rdx, [0x140003818]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000514b
mov rcx, qword [rsp + 0x60]
xor ebp, ebp
test r14, r14
je 0x14000513e
mov rdx, qword [rdi]
test rdx, rdx
je 0x14000513e
lea rax, [0x140001218]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000514b
mov rcx, qword [rsp + 0x60]
inc esi
add rdi, 8
cmp esi, r15d
jae 0x14000515e
jmp 0x1400050e1
mov rcx, qword [rsp + 0x60]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test rcx, rcx
je 0x140005169
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000544c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
and qword [rbp - 8], 0
and qword [rbp - 0x10], 0
and dword [rbp + 0x38], 0
and dword [rbp + 0x20], 0
lea rcx, [rbp - 8]
mov rdi, rdx
mov dword [rbp + 0x30], 4
call fcn.14000d238
mov ebx, eax
test eax, eax
jne 0x140005539
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
lea rdx, [0x1400034a0]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400054ca
mov rcx, qword [rbp - 8]
lea r8, [rbp - 0x10]
lea rdx, [0x1400034a0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000552b
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x30]
lea r9, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400054f9
inc dword [rbp + 0x20]
jmp 0x140005500
mov dword [rbp + 0x20], 1
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x20]
mov r9d, 4
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140005539
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140005548
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
Function at 0x140006bd0
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, rcx
mov ecx, 0x20
mov ebp, r9d
mov rsi, r8
mov rdi, rdx
mov dword [rax - 0x18], 0x8007000e
call fcn.140004210
mov rbx, rax
test rax, rax
je 0x140006ce9
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx + 8], rax
test rax, rax
je 0x140006ce1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x140006cd7
mov eax, dword [rsp + 0x70]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x140006720]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rbx + 0x1c], eax
mov qword [rbx], r14
mov dword [rbx + 0x18], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140006cb5
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140006c9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x30], ecx
jmp 0x140006caa
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006ccd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rbx
call fcn.14000423c
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140006e84
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov r14, r8
mov rdi, rdx
and qword [rbp - 8], rbx
and qword [rbp - 0x10], rbx
and qword [rbp + 0x20], rbx
mov rsi, rcx
cmp dword [rcx], ebx
je 0x140007011
add rcx, 8
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rsi + 0x30], 7
jge 0x140006ed7
mov ebx, 0x8007139f
jmp 0x140006fe2
test rdi, rdi
je 0x140006fdd
test r14, r14
je 0x140006fdd
mov rdx, qword [rsi + 0x40]
sub rdx, rdi
movzx eax, word [rdi]
movzx ecx, word [rdi + rdx]
sub eax, ecx
jne 0x140006f03
add rdi, 2
test ecx, ecx
jne 0x140006ef0
test eax, eax
je 0x140006f11
mov ebx, 0x80070005
jmp 0x140006fe2
lea rax, [rbp - 8]
lea rdx, [0x140003670]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006fcd
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
mov edi, 0x2001f
mov r9d, edi
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006fcd
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x20]
lea rdx, [0x140003680]
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140006fa1
mov rcx, qword [rbp - 0x10]
lea r8, [rbp + 0x20]
lea rdx, [0x140003680]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140006fcd
mov rcx, qword [rbp + 0x20]
lea rax, [rbp + 0x3c]
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rdx, [0x1400036a8]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140006fe2
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140006fe2
mov ebx, 0x80070057
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x140006ff1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140007000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140007016
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140007016
mov ebx, 0x8007000e
cmp dword [rsi], 0
je 0x140007025
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x140009830
Capabilities:
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x140011008]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edi, edi
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400098d7
cmp dword [rbx + 0x10], 0
jne 0x1400098ce
cmp qword [rbx], 0
je 0x1400098ce
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call sub.msvcrt.dll_memset
mov rdx, qword [rbx]
lea r9, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rsi
mov dword [rsp + 0x20], 0x104
call fcn.1400095b4
test eax, eax
je 0x1400098c9
lea rcx, [rsp + 0x30]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x1400098c9
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400098ce
mov edi, 1
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x140009861
mov eax, edi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000faa0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret