joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4562cf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x00b54450]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x460b60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00b5420c], 0
je 0x460b6e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x460b80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00b5420c], 0
je 0x460b95
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x460ba0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00b5420c], 0
je 0x460bd5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00b547e0]
aesenc xmm0, xmmword [0x00b547f0]
aesenc xmm0, xmmword [0x00b54800]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x460be0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00b5420c], 0
je 0x460c16
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00b547e0]
aesenc xmm0, xmmword [0x00b547f0]
aesenc xmm0, xmmword [0x00b54800]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x4624e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rdx, 2
jmp sym.sigtramp

Function at 0x4628e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x462914
mov rcx, 0x28
jmp 0x46291f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00b54450], rcx
pop rbp
ret
Function at 0x46a5e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46a6aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00b54450]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x46a68f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004ae7c0]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x46a67e
mov edi, 1
lea rsi, [0x004ae7c0]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00a6eba8]
lea rsi, [0x00a6e438]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x491e60
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x491e77
inc rax
cmp rax, 4
jge 0x491e8f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x491e74
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x491ea0
inc rax
cmp rax, 4
jge 0x491eae
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x491ed7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x491ebb
jmp 0x491e9d

Function at 0x49a100
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x49a16b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x49a124
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x49a141
cmp rdx, 0
je 0x49a18d
test rdx, 0xf
je 0x49a11d
test rdx, 7
jne 0x49a141
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x49a11d
ret
Function at 0x49d1a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x49d1df
jb 0x49d1f4
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x49d260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x49d334
jb 0x49d393
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 1
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 2
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 2
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 4
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 4
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 8
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 8
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x10
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 0x10
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x20
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 0x20
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x40
call sym._expand_key_256a
jmp 0x49d401
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 2
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 4
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 8
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 0x10
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 0x20
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 0x40
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 0x80
call sym._expand_key_192b
jmp 0x49d401
aeskeygenassist xmm1, xmm0, 1
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 2
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 4
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 8
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x10
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x20
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x40
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x80
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x1b
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x36
call sym._expand_key_128
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x49d40e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x49d540
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
shr rdx, 2
dec rdx
movdqu xmm15, xmmword [0x00a6e590]
movdqu xmm14, xmmword [0x00a6e5a0]
movdqu xmm0, xmmword [rsi]
movdqu xmm11, xmmword [rsi + 0x10]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x20]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x30]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x40]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x50]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x60]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x70]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x80]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x90]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xa0]
cmp rdx, 0xc
jb 0x49d62b
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xb0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xc0]
je 0x49d62b
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xd0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xe0]
aesenclast xmm0, xmm11
pshufb xmm0, xmm15
pshufd xmm11, xmm0, 0xff
movdqu xmm12, xmm0
psrad xmm11, 0x1f
pand xmm11, xmm14
psrld xmm12, 0x1f
pslldq xmm12, 4
pslld xmm0, 1
pxor xmm0, xmm11
pxor xmm0, xmm12
movdqu xmmword [rdi + 0xe0], xmm0
pshufd xmm1, xmm0, 0x4e
pxor xmm1, xmm0
movdqu xmmword [rdi + 0xf0], xmm1
movdqu xmm2, xmm0
movdqu xmm3, xmm1
mov rax, 7
movdqu xmm11, xmm2
movdqu xmm12, xmm2
movdqu xmm13, xmm3
pclmulqdq xmm11, xmm0, 0
pclmulqdq xmm12, xmm0, 0x11
pclmulqdq xmm13, xmm1, 0
pxor xmm13, xmm11
pxor xmm13, xmm12
movdqu xmm4, xmm13
pslldq xmm4, 8
psrldq xmm13, 8
pxor xmm11, xmm4
pxor xmm12, xmm13
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm11, xmm2
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm2, xmm11
pxor xmm2, xmm12
movdqu xmmword [rdi + 0xc0], xmm2
pshufd xmm3, xmm2, 0x4e
pxor xmm3, xmm2
movdqu xmmword [rdi + 0xd0], xmm3
dec rax
lea rdi, [rdi - 0x20]
jne 0x49d690
ret
Function at 0x4a02a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a04ab
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x4a03c4
cmp rdx, 0x40
ja 0x4a049d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x4a0334
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x4a03a0
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x00b54450]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x4a0495
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x4a03c7
mov r8, rcx
cmp r8, 0x40
jl 0x4a0445
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x00b54450]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x4a0488
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x4a0484
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_md5._digest_.Write
Function at 0x140002800
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140044088]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r8
mov dword [rsp + 0x58], r9d
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov rbx, rdx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002857
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400028a2
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rcx
mov rdx, rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400028cd
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1400028cd
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov r8, rdi
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140009e60
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140003ae0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140044088]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
nop
mov rdx, rdi
lea rcx, [rsp + 0x6c]
call fcn.1400102dc
test eax, eax
je 0x140003bad
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003b30
xor ebx, ebx
lea r9, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EventRegister]
mov dword [rsp + 0x28], 0x100104be
mov dword [rsp + 0x2c], 0x30202
mov qword [rsp + 0x30], rbx
test eax, eax
jne 0x140003bb0
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_EventWrite]
test eax, eax
jne 0x140003bb0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_EventUnregister]
jmp 0x140003bb0
or eax, 0xffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140009e60
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140003be0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140044088]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.14000cb70
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140006f60
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140003c62
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140003c62
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140009e60
add rsp, 0x250
pop rbx
ret
Function at 0x140003fa0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140044088]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebp, ebp
mov dword [rsp + 0x44], 4
lea rax, [r11 - 0x24]
mov dword [rsp + 0x40], ebp
mov qword [r11 - 0x38], rax
lea rdx, str.SOFTWAREOEMQuick_Access
lea rax, [r11 - 0x28]
mov dword [rsp + 0x48], ebp
mov rsi, rcx
mov qword [r11 - 0x40], rax
mov r8, rcx
mov qword [r11 - 0x48], rbp
lea r9d, [rbp + 0x10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140004035
xor r9d, r9d
lea rdx, str.SOFTWAREOEMQuick_Access
mov r8, rsi
call fcn.140002800
test eax, eax
jne 0x140004040
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.14000b230
cmp dword [rsp + 0x40], ebp
jbe 0x140004040
mov dil, 1
jmp 0x140004043
xor dil, dil
mov qword [rsp + 0x30], rbp
lea rdx, str.SOFTWAREOEMMetadataQuick_Access_Features
mov qword [rsp + 0x28], rbp
mov r9d, 0xffff
mov r8, rsi
mov qword [rsp + 0x20], rbp
mov rcx, 0xffffffff80000002
mov bl, 1
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400040f1
lea rax, [rsp + 0x44]
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x30], rax
lea rdx, str.SOFTWAREOEMMetadataQuick_Access_Features
lea rax, [rsp + 0x40]
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x28], rax
mov r9d, 0x10
mov r8, rsi
mov qword [rsp + 0x20], rbp
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400040e5
xor r9d, r9d
lea rdx, str.SOFTWAREOEMMetadataQuick_Access_Features
mov r8, rsi
call fcn.140002800
test eax, eax
jne 0x1400040ef
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.14000b230
cmp dword [rsp + 0x40], ebp
jbe 0x1400040ef
mov bl, 1
jmp 0x1400040f1
xor bl, bl
test dil, dil
je 0x1400040fc
mov al, 1
test bl, bl
jne 0x140004100
movzx eax, bpl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140009e60
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140004130
Capabilities:
Get file version info

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x140044088]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, rdx
mov rbp, rcx
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
jne 0x1400041a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Failed_to_get_file_version_info_size.___d_
mov edx, 0x40
mov r9d, eax
lea rcx, [rsp + 0x30]
call fcn.140001100
mov rcx, qword [0x140046b98]
test rcx, rcx
je 0x1400041a2
lea r9, [rsp + 0x30]
mov edx, 2
lea r8, str.get_os_version
call fcn.1400028f0
xor al, al
jmp 0x140004295
mov rcx, rsi
mov qword [rsp + 0xf0], rbx
call fcn.14000a474
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov rcx, rbx
test eax, eax
jne 0x14000420b
call fcn.14000a46c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Failed_to_get_file_version_info.___d_
mov edx, 0x40
mov r9d, eax
lea rcx, [rsp + 0x30]
call fcn.140001100
mov rcx, qword [0x140046b98]
test rcx, rcx
je 0x14000425b
lea r9, [rsp + 0x30]
jmp 0x14000424a
lea r9, [rsp + 0x28]
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
lea rdx, [0x14003caf8]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x14000425f
mov rcx, rbx
call fcn.14000a46c
mov rcx, qword [0x140046b98]
test rcx, rcx
je 0x14000425b
lea r9, str.Failed_to_query_version_value.
lea r8, str.get_os_version
mov edx, 2
call fcn.1400028f0
xor al, al
jmp 0x14000428d
mov rcx, qword [rsp + 0x20]
movzx eax, word [rcx + 0x12]
mov word [rdi], ax
movzx eax, word [rcx + 0x10]
mov word [rdi + 2], ax
movzx eax, word [rcx + 0x16]
mov word [rdi + 4], ax
movzx eax, word [rcx + 0x14]
mov rcx, rbx
mov word [rdi + 6], ax
call fcn.14000a46c
mov al, 1
mov rbx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140009e60
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006190
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140044088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x14000633a
cmp byte [rcx + 0x72], 0
je 0x14000633a
mov rax, qword [rcx]
mov ebx, 0xffff
mov edx, ebx
call qword [rax + 0x18]
cmp bx, ax
jne 0x1400061ee
xor al, al
jmp 0x14000633c
mov qword [rbp - 0x18], 0xf
mov qword [rbp - 0x20], 0
mov byte [rbp - 0x30], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x30]
call fcn.1400059c0
nop
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
nop dword [rax + rax]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, rcx
lea r8, [rbp - 0x30]
cmovae r8, rcx
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
call qword [r10 + 0x40]
test eax, eax
je 0x14000625e
sub eax, 1
jne 0x1400062d2
jmp 0x140006262
mov byte [rdi + 0x72], 0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, rcx
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x1400062af
lea rax, [rbp - 0x30]
cmp r9, 0x10
cmovae rax, rcx
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.1400117f4
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
cmp rbx, rax
jne 0x1400062df
cmp byte [rdi + 0x72], 0
je 0x1400062e3
test rbx, rbx
jne 0x140006220
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.140005d10
jmp 0x140006213
sub eax, 2
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
je 0x1400062e3
xor bl, bl
jmp 0x1400062e5
mov bl, 1
cmp r9, 0x10
jb 0x140006335
lea rax, [r9 + 1]
cmp rax, 0x1000
jb 0x140006330
test byte [rbp - 0x30], 0x1f
je 0x140006303
call fcn.140011344
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140006312
call fcn.140011344
int3
sub rcx, rax
cmp rcx, 8
jae 0x140006321
call fcn.140011344
int3
cmp rcx, 0x27
jbe 0x14000632d
call fcn.140011344
int3
mov rcx, rax
call fcn.140009e44
movzx eax, bl
jmp 0x14000633c
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140009e60
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret