joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41034d
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
call fcn.00410080
mov dword [rbp - 4], eax
add qword [rbp + 0x10], 1
mov eax, dword [rbp - 4]
cmp eax, 0x11
je 0x4103be
cmp eax, 0x13
je 0x4103dc
cmp eax, 0xf
je 0x4103aa
mov rax, qword [sym.imp.msvcrt.dll___iob_func]
call rax
add rax, 0x60
mov r9, rax
mov r8d, 0x1f
mov edx, 1
lea rcx, str._reladdr__not_relative_address_n
call sub.msvcrt.dll_fwrite
mov eax, 0
jmp 0x4103f8
mov rax, qword [rbp + 0x10]
movzx eax, byte [rax]
xor eax, 0xffffff80
movzx eax, al
sub eax, 0x7f
cdqe
jmp 0x4103f8
mov rax, qword [0x00527be0]
mov rax, qword [rax]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x58]
mov rcx, qword [rbp + 0x10]
call rax
add rax, 2
jmp 0x4103f8
mov rax, qword [0x00527be0]
mov rax, qword [rax]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x40]
mov rcx, qword [rbp + 0x10]
call rax
add rax, 4
add rsp, 0x30
pop rbp
ret
Function at 0x41b2bb
Capabilities:
Hash data with crc32

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
not dword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x20]
add rax, rdx
mov qword [rbp - 8], rax
jmp 0x41b316
mov rax, qword [rbp + 0x18]
movzx eax, byte [rax]
movzx eax, al
xor eax, dword [rbp + 0x10]
movzx eax, al
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x004fdc20]
mov eax, dword [rdx + rax]
mov edx, dword [rbp + 0x10]
shr edx, 8
xor eax, edx
mov dword [rbp + 0x10], eax
add qword [rbp + 0x18], 1
mov rax, qword [rbp + 0x18]
cmp rax, qword [rbp - 8]
jb 0x41b2e2
mov eax, dword [rbp + 0x10]
not eax
add rsp, 0x10
pop rbp
ret

Function at 0x41d535
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x10], 0
je 0x41d556
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
jmp 0x41d566
lea rcx, str.GNUTARGET
call sub.msvcrt.dll_getenv
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x41d584
mov rax, qword [rbp - 8]
lea rdx, str.default
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x41d5d2
mov rax, qword [0x004dabb0]
test rax, rax
je 0x41d59d
mov rax, qword [0x004dabb0]
mov qword [rbp - 0x10], rax
jmp 0x41d5ab
mov rax, qword [0x004daba0]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
cmp qword [rbp + 0x18], 0
je 0x41d5cc
mov rax, qword [rbp + 0x18]
mov rdx, qword [rbp - 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp + 0x18]
movzx edx, byte [rax + 0x43]
or edx, 4
mov byte [rax + 0x43], dl
mov rax, qword [rbp - 0x10]
jmp 0x41d61c
cmp qword [rbp + 0x18], 0
je 0x41d5e7
mov rax, qword [rbp + 0x18]
movzx edx, byte [rax + 0x43]
and edx, 0xfffffffb
mov byte [rax + 0x43], dl
mov rax, qword [rbp - 8]
mov rcx, rax
call fcn.0041d410
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x41d605
mov eax, 0
jmp 0x41d61c
cmp qword [rbp + 0x18], 0
je 0x41d618
mov rax, qword [rbp + 0x18]
mov rdx, qword [rbp - 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x10]
add rsp, 0x30
pop rbp
ret
Function at 0x43f166
Capabilities:
Hash data using djb2

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0x1505
jmp 0x43f199
mov eax, dword [rbp - 0xc]
shl eax, 5
mov edx, eax
mov eax, dword [rbp - 0xc]
add edx, eax
movzx eax, byte [rbp - 0xd]
add eax, edx
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 1]
mov qword [rbp - 8], rdx
movzx eax, byte [rax]
mov byte [rbp - 0xd], al
cmp byte [rbp - 0xd], 0
jne 0x43f183
mov eax, dword [rbp - 0xc]
add rsp, 0x10
pop rbp
ret
Function at 0x47c64c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x18]
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call fcn.0047c56b
test eax, eax
jne 0x47c686
mov eax, 0
jmp 0x47c6ee
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov qword [rbp - 8], rax
sub qword [rbp - 8], 1
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
movzx eax, al
and eax, 0x7f
xor eax, 0x40
sub eax, 0x40
movsxd rdx, eax
mov rax, qword [rbp + 0x20]
mov qword [rax], rdx
jmp 0x47c6df
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
shl rax, 7
mov rdx, rax
sub qword [rbp - 8], 1
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
movzx eax, al
and eax, 0x7f
or rdx, rax
mov rax, qword [rbp + 0x20]
mov qword [rax], rdx
mov rax, qword [rbp - 8]
cmp rax, qword [rbp - 0x10]
ja 0x47c6b5
mov eax, 1
add rsp, 0x30
pop rbp
ret
Function at 0x492bc4
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x20]
jge 0x492c1f
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_ferror
test eax, eax
je 0x492c1f
mov ecx, 1
call fcn.00412d5d
mov rax, qword [rbp - 8]
jmp 0x492c37
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x20]
jge 0x492c33
mov ecx, 0x12
call fcn.00412d5d
mov rax, qword [rbp - 8]
add rsp, 0x30
pop rbp
ret
Function at 0x4d255b
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, dword [0x004f7490]
mov dword [0x005417ac], eax
mov eax, dword [0x005417ac]
mov dword [0x005417a8], eax
mov qword [0x00541790], 0
lea rcx, str.POSIXLY_CORRECT
call sub.msvcrt.dll_getenv
mov qword [0x005417a0], rax
mov rax, qword [rbp + 0x20]
movzx eax, byte [rax]
cmp al, 0x2d
jne 0x4d25c0
mov dword [0x00541798], 2
add qword [rbp + 0x20], 1
jmp 0x4d25fe
mov rax, qword [rbp + 0x20]
movzx eax, byte [rax]
cmp al, 0x2b
jne 0x4d25dc
mov dword [0x00541798], 0
add qword [rbp + 0x20], 1
jmp 0x4d25fe
mov rax, qword [0x005417a0]
test rax, rax
je 0x4d25f4
mov dword [0x00541798], 0
jmp 0x4d25fe
mov dword [0x00541798], 1
mov rax, qword [rbp + 0x20]
add rsp, 0x20
pop rbp
ret
Function at 0x4d7e00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x00541e04]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x4d7f20
mov rax, qword [0x00541e08]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x4d7e4c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x4d7f06
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x4d7e30
mov rcx, rsi
call fcn.004d8a40
test rax, rax
mov r12, rax
je 0x4d7f58
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x00541e08]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.004d8b90
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x00541e08]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4d7f3b
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4d7eff
sub eax, 0x40
and eax, 0xffffffbf
je 0x4d7eff
add rbx, qword [0x00541e08]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4d7f27
add dword [0x00541e04], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x4d7e57
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004d7d90
mov rax, qword [0x00541e08]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.004d7d90
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.004d7d90
nop
nop dword [rax + rax]

Function at 0x4d86b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x005420e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x005420c0]
test rbx, rbx
je 0x4d8704
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4d86fb
test rsi, rsi
je 0x4d86fb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4d86e0
lea rcx, [0x005420e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x4d8a40
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00527900]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x4d8a60
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.004d8920
test eax, eax
je 0x4d8a58
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x4d8abd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x4d8ab4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x4d8a58
add rdx, 0x28
cmp rdx, r9
jne 0x4d8aa0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x4d8d80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rbx, rcx
call sub.msvcrt.dll__errno
test rbx, rbx
mov dword [rax], 0
je 0x4d8f0c
cmp byte [rbx], 0
je 0x4d8ed4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4d8ef0
test al, 0x10
je 0x4d8ed4
lea rdi, [rsp + 0x20]
mov r8d, 0x104
mov rdx, rbx
mov rcx, rdi
mov rsi, rdi
call sub.msvcrt.dll__fullpath
mov edx, dword [rsi]
add rsi, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4d8dde
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rsi + 2]
mov ecx, eax
cmove rsi, rdx
add cl, al
sbb rsi, 3
sub rsi, rdi
lea rcx, [rsi + 0x24b]
call sub.msvcrt.dll_malloc
test rax, rax
mov rbx, rax
je 0x4d8eff
lea r9, [rax + 0x244]
lea rbp, [rsi + 1]
mov rdx, rdi
mov rcx, r9
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp byte [rbx + 0x244], 0
mov r9, rax
je 0x4d8e70
movzx eax, byte [rbx + rsi + 0x243]
cmp al, 0x2f
je 0x4d8e70
cmp al, 0x5c
je 0x4d8e70
mov r8d, 0x5c
mov word [r9 + rsi], r8w
mov rsi, rbp
mov eax, 0x2a
xor edx, edx
xor ecx, ecx
mov word [r9 + rsi], ax
mov word [rbx + 0x12c], dx
lea rdx, [rbx + 0x130]
mov word [rbx + 0x12e], cx
xor eax, eax
mov ecx, 0x20
mov rdi, rdx
mov qword [rbx + 0x238], 0xffffffffffffffff
mov dword [rbx + 0x240], 0
mov dword [rbx + 0x128], 0
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov rax, rbx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ebx, ebx
call sub.msvcrt.dll__errno
mov dword [rax], 0x14
mov rax, rbx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 2
jmp 0x4d8ec5
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x4d8ec5
call sub.msvcrt.dll__errno
mov dword [rax], 0xe
jmp 0x4d8ec5
Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
rcr byte [rbp + 0x72], 0x9f
adc dword [rsi - 0x7f], eax
xlatb
adc eax, 0xc5fd087b
xor al, 0x72
movsd dword [rdi], dword [rsi]
jp 0x14001ac9f
call 0x137f99fcc
pop rbp
invalid
neg dword [rbp + 0x37]
push rax
outsd dx, dword [rsi]
mov esi, dword [rsi*2 - 0x192b6948]
shl byte [rax + 0x31], cl
xor byte [0x17fcfbbc8], ah
jl 0x14001acbb
xor byte [rsi], dl
cmp dword [rbp], ebx
adc dl, al
push 0x48
mov edi, 0x5314f7fe
xor al, 0xd1
invalid
mov ebp, 0x42f5e246
cld
sub dl, byte [rdx + 0x27]
mov cs, word [rdx + 0x4fc52bea]
inc ecx
inc r9
invalid
jp 0x14001acad
invalid
add esi, edi
jbe 0x14001acb2
out dx, eax
fist dword [rdi - 0xd447988]
jb 0x14001ac53
outsd dx, dword [rsi]
xchg r14d, eax
jbe 0x14001acef
invalid
int1
int1
test al, 0x98
jo 0x14001ac69
push rsi
invalid
invalid
push rsi
jne 0x14001ad79
jp 0x14001ad17
mov ecx, 0x5c932477
int1
jae 0x14001ad45
cmp eax, 0xcdfd98f1
cmp eax, 0xf8927ba3
jb 0x14001ad1e
int1
cwde
std
int 0x3d
movabs dword [0xee470a7244f8927b], eax
out dx, al
js 0x14001ad07
out dx, eax
jne 0x14001ad5d
cmp cl, byte [rcx]
loopne 0x14001acd9
call 0x10a3c34fb
invalid
xchg edi, eax
invalid
in al, 0x32
cdq
add rax, 0x765f7314
mov ds, word [rdi - 0x78a05ee1]
ret 0xe7f
xchg edx, eax
cmp dword [rdi], eax
add dword [rsi - 0x54], ebp
invalid
Function at 0x1000064ac
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp qword [rcx], 0
mov rbx, rcx
mov dil, 1
je 0x10000659d
mov r8, qword [rbx]
mov r9, qword [rbx + 8]
and qword [rsp + 0x50], 0
lea rcx, [rsp + 0x60]
mov edx, 0x100
call fcn.100004fe0
test eax, eax
js 0x1000065c9
and qword [rsp + 0x40], 0
mov rbp, qword [rbx + 0x10]
mov rsi, qword [rbx + 0x18]
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
add rbx, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100006585
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100006588
xor dil, dil
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbx], 0
jne 0x1000064e5
mov al, dil
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.100017610
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
xor al, al
jmp 0x1000065a0

Function at 0x1000065d4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x220], rax
xor esi, esi
mov rdi, rcx
mov bl, 1
cmp qword [rcx], rsi
je 0x10000664d
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
lea rcx, [rsp + 0x20]
mov edx, 0x100
call fcn.100004fe0
cmp eax, esi
jl 0x100006674
lea rdx, [rsp + 0x20]
mov rcx, 0xffffffff80000000
add rdi, 0x20
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, 0x3fa
je 0x100006648
cmp eax, 2
je 0x100006648
movzx ebx, bl
cmp eax, esi
cmovne ebx, esi
cmp qword [rdi], rsi
jne 0x100006604
mov al, bl
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.100017610
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor al, al
jmp 0x10000664f
Function at 0x100006cd4
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0xf0
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor r12d, r12d
lea rsi, [0x10001bfa8]
lea rdi, [0x1000019a8]
mov ebp, r12d
lea r14, [0x10001d680]
mov r9d, dword [rdi]
lea r8, [0x100001ac0]
lea rcx, [0x10001da70]
mov edx, 0x28
lea rbx, [0x10001bd60]
call fcn.100004fe0
cmp eax, r12d
jl 0x100006ea5
mov r8, qword [rsi]
cmp r8, r12
je 0x100006d9d
mov r9d, 0x28
mov rcx, r14
mov edx, r12d
sub r8, r14
lea rax, [r9 + 0x7fffffd6]
cmp rax, r12
je 0x100006d82
movzx eax, word [r8 + rcx]
cmp ax, r12w
je 0x100006d82
mov word [rcx], ax
add rcx, 2
sub r9, 1
jne 0x100006d5e
cmp r9, r12
jne 0x100006d90
sub rcx, 2
mov edx, 0x8007007a
cmp edx, r12d
mov word [rcx], r12w
jl 0x100006ed2
cmp qword [0x10001bd60], r12
je 0x100006e04
lea rax, [rbx + 8]
cmp qword [rax], r12
je 0x100006dff
cmp qword [rbx + 0x10], r12
je 0x100006dff
mov r8, qword [rbx]
mov r9, qword [rax]
lea rcx, [rsp + 0x40]
mov edx, 0x50
mov rbx, rax
call fcn.100004fe0
cmp eax, r12d
jl 0x100006ea5
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, 0x3fa
je 0x100006dfb
cmp eax, 2
je 0x100006dfb
cmp eax, r12d
je 0x100006dfb
inc ebp
add rbx, 0x20
cmp qword [rbx], r12
jne 0x100006da6
lea rax, [0x1000019b8]
add rdi, 0x10
add rsi, 8
cmp rdi, rax
jl 0x100006d1c
lea rax, [rsp + 0x30]
lea rdx, [0x100001b10]
mov r9d, 0x2011f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x100006e77
mov rcx, qword [rsp + 0x30]
lea rdx, [0x100001b78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x100001ba0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.10000aa2c
cmp al, r12b
je 0x100006e8d
lea rcx, [0x10001bf60]
call fcn.1000065d4
call fcn.10000aa2c
cmp al, r12b
je 0x100006ea3
lea rcx, [0x10001be08]
call fcn.1000065d4
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.100017610
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
mov eax, edx
jmp 0x100006ea5

Function at 0x100006edc
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0x20]
lea rcx, [0x100001c28]
mov r8d, 0x40
mov byte [0x10001db84], 1
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x100006f4f
movzx ecx, word [rsp + 0x20]
lea r8, [rsp + 0x20]
test ecx, ecx
je 0x100006f4d
mov r9d, dword [0x10001db6c]
and ecx, 0x1f
add r8, 2
mov edx, 1
shl edx, cl
movzx ecx, word [r8]
or r9d, edx
test ecx, ecx
jne 0x100006f2d
mov dword [0x10001db6c], r9d
mov al, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.100017610
add rsp, 0xb8
ret
Function at 0x10000a190
Capabilities:
Access the windows event log

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
mov rbx, r9
xor r9d, r9d
mov rax, r8
mov qword [r11 - 0x18], r9
mov qword [r11 - 0x20], rax
mov dword [r11 - 0x28], r9d
movzx r10d, dx
xor r8d, r8d
mov word [r11 - 0x30], r10w
mov qword [r11 - 0x38], r9
mov r9d, ecx
lea edx, [r8 + 2]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]

Function at 0x10000a1e4
Capabilities:
Compare security identifiers

Disassembly:
push rbx
sub rsp, 0x50
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorOwner]
test eax, eax
jne 0x10000a219
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100002230]
mov edx, eax
call fcn.10000a89c
xor al, al
jmp 0x10000a353
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x10000a212
cmp byte [0x10001e2ca], 0
jne 0x10000a242
lea rcx, [rsp + 0x20]
call fcn.1000053d0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
jmp 0x10000a24b
lea rdx, [0x10001e2d0]
xor eax, eax
test eax, eax
je 0x10000a258
lea rcx, [0x1000022f0]
jmp 0x10000a20b
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10000a269
mov al, 1
jmp 0x10000a353
cmp byte [0x10001e2c9], 0
jne 0x10000a283
lea rcx, [rsp + 0x20]
call fcn.1000052bc
mov rdx, qword [rsp + 0x20]
jmp 0x10000a28c
lea rdx, [0x10001e3d0]
xor eax, eax
test eax, eax
je 0x10000a29c
lea rcx, [0x100002390]
jmp 0x10000a20b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10000a262
lea rbx, [0x10001e4d0]
cmp byte [0x10001e2c8], al
jne 0x10000a32e
and dword [rsp + 0x20], eax
lea rdx, [0x100001a90]
lea rcx, [rsp + 0x38]
call qword [0x10001a880]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x38]
xor edx, edx
call qword [0x10001a8d0]
cmp eax, 0xc0000023
je 0x10000a2f0
mov eax, 0xd
jmp 0x10000a334
cmp dword [rsp + 0x20], 0x100
jbe 0x10000a301
mov eax, 0xea
jmp 0x10000a334
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x38]
mov rdx, rbx
call qword [0x10001a8d0]
test eax, eax
jns 0x10000a327
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov rbx, qword [rsp + 0x28]
jmp 0x10000a330
mov byte [0x10001e2c8], 1
xor eax, eax
test eax, eax
je 0x10000a340
lea rcx, [0x100002420]
jmp 0x10000a20b
mov rcx, qword [rsp + 0x28]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
add rsp, 0x50
pop rbx
ret
Function at 0x10000a48c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0xa90
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rsi, rcx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x20a
xor edi, edi
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x50]
mov r12d, 0x105
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x270]
mov ebp, 0x401
mov dword [rsp + 0x48], r12d
lea r8, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x260], rax
mov dword [rsp + 0x268], ebp
mov r9d, r12d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x10000a677
mov rdx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x10000a5fa
mov rcx, qword [rsp + 0x30]
call fcn.10000a360
test al, al
jne 0x10000a5e1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11, qword [rsp + 0x40]
lea rdx, [0x100002208]
xor ecx, ecx
mov qword [rsp + 0x38], r11
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x10000a591
lea edx, [rbx + 1]
lea r8, [rsp + 0x38]
mov r9, rax
mov ecx, 0x403
call fcn.10000a190
movsxd rdx, dword [rsp + 0x268]
mov r9, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x260]
lea r8, [0x1000025e0]
call fcn.100004fe0
test eax, eax
js 0x10000a5c5
mov rcx, qword [rsp + 0x260]
xor edx, edx
call fcn.10000a89c
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
call fcn.10000e518
test al, al
jne 0x10000a5e3
xor edx, edx
lea rcx, [0x1000026b0]
jmp 0x10000a629
inc edi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, qword [rsp + 0x40]
mov edx, edi
jmp 0x10000a502
movsxd rdx, dword [rsp + 0x268]
mov r9, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x260]
lea r8, [0x100002570]
call fcn.100004fe0
test eax, eax
js 0x10000a62e
mov rcx, qword [rsp + 0x260]
mov edx, ebx
call fcn.10000a89c
cmp dword [rsp + 0x268], ebp
jle 0x10000a645
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x48], r12d
lea rax, [rsp + 0x270]
mov dword [rsp + 0x268], ebp
mov qword [rsp + 0x260], rax
jle 0x10000a673
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x10000a673
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor al, al
jmp 0x10000a6d0
cmp eax, 0x103
je 0x10000a689
mov edx, eax
lea rcx, [0x100002720]
jmp 0x10000a629
cmp dword [rsp + 0x268], ebp
jle 0x10000a6a0
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x48], r12d
lea rcx, [rsp + 0x270]
mov dword [rsp + 0x268], ebp
mov qword [rsp + 0x260], rcx
jle 0x10000a6ce
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x10000a6ce
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov al, 1
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.100017610
lea r11, [rsp + 0xa90]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret