joyce8/EMBER2024-capa huggingface dataset:
Function at 0x527180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52724c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xf59c245d1c11654e
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x6c1487f5
movabs rdx, 0x502090403070708
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x309030908030603
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x5271e5
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x43]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0x10
jge 0x52721c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x52723f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x43]
cmp rsi, 0xb
jb 0x5271cb
jmp 0x527233
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456420
mov eax, edi
mov ecx, 0xb
call fcn.00456420
nop
call fcn.00454140
jmp fcn.00527180

Function at 0x52df60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52e032
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8468639b97865468
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xadaa65b162846863
mov qword [rsp + 0x30], rdx
movabs rdx, 0x30904000b0c000b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x2030b0107090309
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x52dfcc
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2e]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0xe
jge 0x52dffe
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x52e025
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2e]
cmp rsi, 0xd
jb 0x52dfb2
jmp 0x52e015
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00456420
mov eax, edi
mov ecx, 0xd
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0052df60
Function at 0x535fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5360ec
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x1120a161b0c5ad0d
mov qword [rsp + 0x44], rdx
movabs rdx, 0x1d071d721120a161
mov qword [rsp + 0x48], rdx
movabs rdx, 0x6eb56e6e61a70795
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd96c70c66fcc20fb
mov qword [rsp + 0x58], rdx
movabs rdx, 0x440474ca75128434
mov qword [rsp + 0x60], rdx
movabs rdx, 0x23020212001e0d16
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x211b12010d0d1218
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe051d02090b0a07
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xe02121c141b0c1c
mov qword [rsp + 0x34], rdx
movabs rdx, 0x2220050320160c03
mov qword [rsp + 0x3c], rdx
xor eax, eax
jmp 0x536086
movzx r9d, byte [rsp + rsi + 0x44]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x41]
mov byte [rsp + rdi + 0x44], dl
mov byte [rsp + rsi + 0x44], r8b
add rax, 2
cmp rax, 0x28
jge 0x5360bc
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x24
jae 0x5360df
movzx r8d, byte [rsp + rdi + 0x44]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x41]
cmp rsi, 0x24
jb 0x53606c
jmp 0x5360d3
xor eax, eax
lea rbx, [rsp + 0x44]
mov ecx, 0x24
call fcn.00444780
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00456420
mov eax, edi
mov ecx, 0x24
call fcn.00456420
nop
call fcn.00454140
jmp fcn.00535fc0

Function at 0x53eb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53ec6a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x8536f93433b3a2dd
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x388536f93433b3a2
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd746f5686f767be5
mov qword [rsp + 0x38], rdx
movabs rdx, 0x20e02000d050209
mov qword [rsp + 0x19], rdx
movabs rdx, 0xe020c000d02020e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd010b091001070a
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x53ec0d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 - 0x29]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 - 0x29]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x16
jge 0x53ec3a
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x53ec5d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x53ebf0
jmp 0x53ec51
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456420
mov eax, edi
mov ecx, 0x11
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0053eb80
Function at 0x53ec80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53ed6a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x37672334336d2530
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x5537672334336d25
mov qword [rsp + 0x30], rdx
movabs rdx, 0x771d658b36622e39
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa08020f05010f0a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x100d06000a08020f
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x50502090c00000f
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x53ed0d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 0x14]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 0x14]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x14
jge 0x53ed3a
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x53ed5d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x53ecf0
jmp 0x53ed51
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456420
mov eax, edi
mov ecx, 0x11
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0053ec80

Function at 0x53f760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53f84a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xab361134abba31a5
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x38ab361134abba31
mov qword [rsp + 0x30], rdx
movabs rdx, 0xaf4a916f9362caf7
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70d0c0e0f100f09
mov qword [rsp + 0x19], rdx
movabs rdx, 0x903020d0903070d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd09000a0a100510
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x53f7ed
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 - 0x28]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 - 0x28]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x16
jge 0x53f81a
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x53f83d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x53f7d0
jmp 0x53f831
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456420
mov eax, edi
mov ecx, 0x11
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0053f760
Function at 0x1400012dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140003638], rbx
je 0x140001328
cmp rax, rbx
jne 0x14000131b
mov ebx, 1
mov esi, ebx
jmp 0x14000132d
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001300
mov ebx, 1
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x140001343
mov ecx, 0x1f
call fcn.140173000
jmp 0x1400013a8
mov eax, dword [0x140003640]
test eax, eax
jne 0x1400013a2
mov dword [0x140003640], ebx
lea r15, [0x1400022c0]
lea rdi, [0x1400022a8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140001394
test eax, eax
jne 0x140001398
cmp qword [rdi], 0
je 0x140001389
mov rax, qword [rdi]
mov rcx, qword [0x140002288]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000136a
test eax, eax
je 0x1400013a8
mov eax, 0xff
jmp 0x140001484
mov dword [0x140003044], ebx
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x1400013cf
lea rdx, [0x1400022a0]
lea rcx, [0x140002290]
call sub.msvcrt.dll__initterm
mov dword [0x140003640], 2
test esi, esi
jne 0x1400013dc
xor eax, eax
xchg qword [0x140003638], rax
cmp qword [0x140003648], 0
je 0x140001410
lea rcx, [0x140003648]
call fcn.140001650
test eax, eax
je 0x140001410
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140003648]
mov r9, qword [0x140002288]
call r9
mov r8, qword [0x140003058]
mov rdx, qword [0x140003050]
mov ecx, dword [0x140003048]
call fcn.14000119c
mov dword [0x140003040], eax
cmp dword [0x140003060], 0
jne 0x140001440
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140003044], 0
jne 0x140001455
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140003040]
jmp 0x140001484
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400016d0
add rsp, 0x28
jmp 0x1400012dc

Function at 0x140001550
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000159c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001594
cmp dword [rcx + 0x3c], edx
jl 0x140001594
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001594
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000159c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004057c0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x004057d0]
mov dword [rax], 1
mov rax, qword [0x004057e0]
mov dword [rax], 1
mov rax, qword [0x004057b0]
mov dword [rax], 1
mov rax, qword [0x004056a0]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x004057a0]
mov dword [0x00408008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x00405760]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x00405650]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x401667
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
jne 0x4016a8
mov eax, 0
jmp 0x401737
mov dword [rbp - 0x60], 0x130
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0xd0]
mov rdx, rax
call sym.Process32First
mov dword [rbp + 0xdc], eax
jmp 0x401716
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x4016fd
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 0x58]
jmp 0x401737
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0xd0]
mov rdx, rax
call sym.Process32Next
mov dword [rbp + 0xdc], eax
cmp dword [rbp + 0xdc], 0
jne 0x4016ca
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret

Function at 0x4017a3
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rdx, str.Launching_Pixel_Gun_3D_via_Steam...
mov ecx, 0xb
call dbg.log
lea rcx, str.start_steam:__rungameid_2524890
call sym.system
nop
add rsp, 0x20
pop rbp
ret
Function at 0x401ab4
Capabilities:
Set console window title

Disassembly:
push rbp
sub rsp, 0x260
lea rbp, [rsp + 0x80]
call sym.__main
lea rcx, str.PG3D_Injector_by_Dari
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call rax
lea rax, [rbp + 0xc0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0xc0]
mov edx, 0x5c
mov rcx, rax
call sym.strrchr
mov qword [rbp + 0x1d0], rax
cmp qword [rbp + 0x1d0], 0
je 0x401b26
mov rax, qword [rbp + 0x1d0]
mov byte [rax], 0
lea rdx, [rbp + 0xc0]
lea rax, [rbp - 0x50]
lea rcx, str.AsteroidPC.dll
mov qword [rsp + 0x20], rcx
mov r9, rdx
lea r8, str._s_s
mov edx, 0x104
mov rcx, rax
call dbg.snprintf
lea rax, [rbp - 0x50]
mov rcx, rax
call dbg.fileExists
xor eax, 1
test al, al
je 0x401bb0
lea rdx, str.DLL_file_not_found.
mov ecx, 0xc
call dbg.log
lea rdx, str.AsteroidPC.dll
lea rcx, str._s__n
call sym.printf
lea rdx, str.Ensure_that_the_DLL_is_in_the_same_folder_as_the_injector.
mov ecx, 0xb
call dbg.log
mov ecx, 0xa
call dbg.countdown
mov eax, 1
jmp 0x401cfd
lea rdx, str.Checking_if_Pixel_Gun_3D_is_already_running...
mov ecx, 0xb
call dbg.log
lea rcx, str.Pixel_Gun_3D.exe
call dbg.GetProcessID
mov dword [rbp + 0x1dc], eax
cmp dword [rbp + 0x1dc], 0
jne 0x401c2c
lea rdx, str.Pixel_Gun_3D_not_found._Launching_the_game...
mov ecx, 0xe
call dbg.log
call dbg.launchGame
lea rdx, str.Waiting_for_Pixel_Gun_3D_to_start...
mov ecx, 0xe
call dbg.log
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rcx, str.Pixel_Gun_3D.exe
call dbg.GetProcessID
mov dword [rbp + 0x1dc], eax
cmp dword [rbp + 0x1dc], 0
je 0x401bf2
lea rdx, str.Pixel_Gun_3D_process_found_
mov ecx, 0xb
call dbg.log
mov eax, dword [rbp + 0x1dc]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x1c8], rax
cmp qword [rbp + 0x1c8], 0
jne 0x401c8c
lea rdx, str.Error_opening_Pixel_Gun_3D_process.
mov ecx, 0xc
call dbg.log
mov ecx, 0xa
call dbg.countdown
mov eax, 1
jmp 0x401cfd
lea rax, [rbp - 0x50]
mov rcx, qword [rbp + 0x1c8]
mov rdx, rax
call dbg.injectDLL
xor eax, 1
test al, al
je 0x401cdb
lea rdx, str.DLL_injection_failed.
mov ecx, 0xc
call dbg.log
mov rax, qword [rbp + 0x1c8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0xa
call dbg.countdown
mov eax, 1
jmp 0x401cfd
mov rax, qword [rbp + 0x1c8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0xa
call dbg.countdown
mov eax, 0
add rsp, 0x260
pop rbp
ret
Function at 0x140002ea0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor eax, eax
test eax, eax
jne 0x140002eae
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x140002ee0
mov r8, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x10]
call fcn.140004540
jmp 0x140002f63
movzx eax, byte [0x14001fc90]
test eax, eax
jne 0x140002f25
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140002f1e
lea rdx, str.RegDeleteKeyExW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001fc88], rax
mov byte [0x14001fc90], 1
cmp qword [0x14001fc88], 0
je 0x140002f50
xor r9d, r9d
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 8]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [0x14001fc88]
jmp 0x140002f63
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rsp, 0x38
ret

Function at 0x140004240
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov rax, qword [0x14001f010]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x2a0]
mov eax, dword [rax + 8]
or eax, 0x2001f
mov r9d, eax
mov r8, qword [rsp + 0x2a8]
mov rax, qword [rsp + 0x2a0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x48]
call fcn.140003a00
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x1400042d3
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0x48]
call fcn.140001540
mov eax, dword [rsp + 0x60]
jmp 0x1400043b7
mov dword [rsp + 0x44], 0x100
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140004360
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x48]
call fcn.140004240
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x140004353
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x64], eax
lea rcx, [rsp + 0x48]
call fcn.140001540
mov eax, dword [rsp + 0x64]
jmp 0x1400043b7
mov dword [rsp + 0x44], 0x100
jmp 0x1400042db
mov dword [rsp + 0x68], 0
cmp qword [rsp + 0x48], 0
je 0x140004388
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2a0]
call fcn.140002ea0
mov dword [rsp + 0x6c], eax
lea rcx, [rsp + 0x48]
call fcn.140001540
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400084e0
add rsp, 0x298
ret
Function at 0x140004540
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x1400045cc
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14000457f
mov eax, 1
jmp 0x1400045ee
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400045ca
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x38]
jmp 0x1400045ee
jmp 0x1400045e9
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0
je 0x1400045e9
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1400045ee
mov eax, 1
add rsp, 0x48
ret
Function at 0x140005dc0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
xor eax, eax
test eax, eax
jne 0x140005dd3
cmp qword [rsp + 0x80], 0
je 0x140005dee
mov dword [rsp + 0x38], 1
jmp 0x140005df6
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x140005e0f
mov eax, 0xd
jmp 0x140005eb8
xor eax, eax
test eax, eax
jne 0x140005dd9
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], 0xffffffffffffffff
inc qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
cmp word [rax + rcx*2], 0
jne 0x140005e3d
mov rax, qword [rsp + 0x40]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x30], 1
jne 0x140005e2a
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x68
ret

Function at 0x140005ec0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
test eax, eax
jne 0x140005ed8
cmp qword [rsp + 0x70], 0
je 0x140005ef0
mov dword [rsp + 0x30], 1
jmp 0x140005ef8
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x140005f0e
mov eax, 0xd
jmp 0x140005f72
xor eax, eax
test eax, eax
jne 0x140005ede
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
cmp word [rax + rcx*2], 0
jne 0x140005f27
mov rax, qword [rsp + 0x38]
inc eax
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x78]
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x58
ret
Function at 0x14000c834
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14000c608
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c608
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c608
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c608
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c608
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c608
cmp dword [rcx + 0xf8], esi
je 0x14000c608
mov ecx, r14d
call fcn.14000c750
mov ecx, 2
call fcn.14000df30
nop
cmp byte [0x140020550], 0
jne 0x14000c6d2
mov r15d, 1
mov eax, r15d
xchg dword [0x140020540], eax
test ebx, ebx
jne 0x14000c67b
mov rdi, qword [0x14001f010]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140020548]
cmp rcx, rax
je 0x14000c672
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140008dd8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140020790]
jmp 0x14000c687
cmp ebx, r15d
jne 0x14000c68d
lea rcx, [0x1400207a8]
call fcn.14000d1a0
nop
test ebx, ebx
jne 0x14000c6a4
lea rdx, [0x140014438]
lea rcx, [0x140014418]
call fcn.14000d4bc
lea rdx, [0x140014448]
lea rcx, [0x140014440]
call fcn.14000d4bc
movzx eax, byte [0x140020550]
test esi, esi
cmove eax, r15d
mov byte [0x140020550], al
jmp 0x14000c6d2
mov ecx, 2
call fcn.14000df84
test esi, esi
jne 0x14000c6e9
mov ecx, r14d
call fcn.14000c704
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000c598
Function at 0x140004b7c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004bc6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004bc6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004bc6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004bc6
cmp dword [rcx + 0x84], 0xe
jbe 0x140004bc6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004bc8
xor al, al
add rsp, 0x28
ret
Function at 0x14000a750
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rsi, qword [rcx + 0x10]
mov rbx, rcx
mov eax, 2
lea rcx, [rsi + 2]
mul rcx
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call fcn.14003f874
cmp qword [rbx + 0x18], 7
mov rdi, rax
jbe 0x14000a792
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor ecx, ecx
xorps xmm0, xmm0
mov dword [rdi + rsi*2], ecx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], 3
mov qword [rsp + 0x40], 0x54
mov qword [rsp + 0x30], rdi
movdqu xmmword [rsp + 0x48], xmm0
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rcx, rdi
mov ebx, eax
call fcn.14003f830
mov rsi, qword [rsp + 0x78]
test ebx, ebx
mov rbx, qword [rsp + 0x70]
sete al
add rsp, 0x60
pop rdi
ret