joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e948
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0x11b0
call fcn.1400200f4
sub rsp, rax
mov rax, qword [0x1400280c8]
xor rax, rsp
mov qword [rsp + 0x11a0], rax
mov rdi, qword [rsp + 0x1200]
and qword [rsp + 0x38], 0
mov rbx, rcx
and qword [rdi], 0
mov rsi, r8
mov r12, rdx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x1154
mov rbp, r9
call fcn.140014860
lea rcx, [rsp + 0x48]
or r9, 0xffffffffffffffff
mov r8, rbx
mov edx, 0x80
mov dword [rsp + 0x40], 0x1154
mov dword [rsp + 0x44], 7
call fcn.140014938
lea rax, [rsp + 0x30]
lea rdx, str.Path
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x148]
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x30], 0x1048
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000ea7f
lea rax, [rsp + 0x30]
lea rdx, str.Priority
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1190]
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000ea7f
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov r8, rbp
mov rcx, rsi
call fcn.14000e888
mov ebx, eax
test eax, eax
js 0x14000ea7f
mov rax, qword [rsp + 0x38]
xor edx, edx
xor ebx, ebx
mov qword [rdi], rax
mov qword [rsp + 0x38], rdx
jmp 0x14000ea84
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14000ea9c
mov rax, qword [rdx + 8]
movsxd rcx, dword [rax + 4]
lea rcx, [rcx + rdx + 8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
mov rcx, qword [rsp + 0x11a0]
xor rcx, rsp
call fcn.1400146fc
add rsp, 0x11b0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000f0f8
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov rcx, qword [rcx + 0x258]
xor edi, edi
mov esi, edx
cmp rcx, 0xffffffffffffffff
jne 0x14000f123
lea edi, [rcx + 2]
jmp 0x14000f1fd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rbx + 0x258], 0xffffffffffffffff
test esi, esi
je 0x14000f1fd
cmp dword [rbx + 0x18], edi
jne 0x14000f1fd
and qword [rsp + 0x30], rdi
and dword [rsp + 0x28], edi
lea rcx, [rbx + 0x34]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 0x80070000
mov qword [rbx + 0x258], rax
cmp rax, 0xffffffffffffffff
jne 0x14000f18e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, esi
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14000f1fd
mov rdx, qword [rbx + 0x248]
mov rcx, qword [rbx + 0x258]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14000f1c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, esi
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14000f1fd
mov rcx, qword [rbx + 0x258]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14000f1e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, esi
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14000f1fd
mov rcx, qword [rbx + 0x28]
mov rdx, qword [rbx + 0x248]
mov r9, qword [rcx]
mov r8, rdx
call qword [r9 + 0xa0]
mov rcx, qword [rbx + 0x258]
cmp rcx, 0xffffffffffffffff
je 0x14000f218
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rbx + 0x258], 0xffffffffffffffff
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x14000ffc8
Capabilities:
Get user security identifier

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
push r12
push r13
push r14
sub rsp, 0x50
and qword [rax - 0x20], 0
mov ebp, 0x44
mov r13, rdx
mov r14, rcx
lea edx, [rbp - 0x43]
mov rcx, rbp
mov r12, r8
mov dword [rax - 0x28], ebp
mov dword [rax + 0x20], 0xff
call fcn.14001f3f4
mov rdi, rax
test rax, rax
jne 0x14001001b
mov ebx, 0x8007000e
jmp 0x14001013c
mov edx, dword [rsp + 0x88]
lea rcx, [rsp + 0x48]
call fcn.140010304
mov ebx, eax
test eax, eax
js 0x14001013c
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov r8, rdi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x140010134
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140010122
cmp dword [rsp + 0x40], ebp
jbe 0x1400100bf
mov edx, dword [rsp + 0x40]
lea r8d, [rax - 0x79]
mov rcx, rdi
call fcn.14001f428
mov rbp, rax
test rax, rax
jne 0x1400100bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14001013c
mov rdi, rbp
cmp dword [rsp + 0x88], 0xff
jbe 0x1400100e3
mov edx, dword [rsp + 0x88]
lea rcx, [rsp + 0x48]
call fcn.140010304
mov ebx, eax
test eax, eax
js 0x14001013c
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov r8, rdi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x140010134
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14001013c
mov qword [r12], rdi
xor edi, edi
xor ebx, ebx
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001014b
call fcn.140010460
test rdi, rdi
je 0x140010158
mov rcx, rdi
call fcn.14001f46c
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x140010178
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [rdx + 8]
and qword [r11 + 0x18], 0
and dword [rsp + 0x78], 0
mov rdi, rcx
test rax, rax
je 0x1400101ae
lea r8, [r11 + 0x18]
mov rdx, rax
xor ecx, ecx
call fcn.14000ffc8
mov ebx, eax
test eax, eax
jmp 0x140010214
mov r9d, dword [rdx + 0x1c]
mov r8d, dword [rdx + 0x18]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov eax, dword [rdx + 0x34]
lea rcx, [rdx + 0x10]
mov dword [rsp + 0x48], eax
mov eax, dword [rdx + 0x30]
mov dword [rsp + 0x40], eax
mov eax, dword [rdx + 0x2c]
mov dword [rsp + 0x38], eax
mov eax, dword [rdx + 0x28]
mov dword [rsp + 0x30], eax
mov eax, dword [rdx + 0x24]
mov dword [rsp + 0x28], eax
mov eax, dword [rdx + 0x20]
mov dl, byte [rdx + 0x16]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140010216
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010251
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140010248
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010251
xor ebx, ebx
cmp dword [rsp + 0x78], ebx
sete bl
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140010264
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x1400109f0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
and qword [rdx], 0
mov rbx, rdx
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140010a23
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x140010a2d
mov rax, qword [rsp + 0x38]
xor ecx, ecx
mov qword [rbx], rax
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x140010a38
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbp, rdx
mov rdi, rcx
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
jne 0x140010af8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140010af8
movzx eax, word [rdi]
xor edx, edx
mov rcx, rdi
cmp ax, dx
je 0x140010af3
lea r8d, [rsi + 0x5c]
cmp ax, r8w
cmove rsi, rcx
add rcx, 2
mov ax, word [rcx]
cmp ax, dx
jne 0x140010a86
cmp rsi, rdx
je 0x140010af3
mov word [rsi], dx
mov rcx, rdi
mov rdx, rbp
call fcn.140010a38
mov ebx, eax
mov eax, 0x5c
mov word [rsi], ax
test ebx, ebx
js 0x140010af8
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140010aef
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140010adf
mov ebx, 1
jmp 0x140010af8
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140010af8
xor ebx, ebx
jmp 0x140010af8
mov ebx, 0x80070003
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140010c4c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010cc4
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r9, rdi
xor r8d, r8d
mov rcx, rax
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x140010ca5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelf]
test eax, eax
je 0x140010cc4
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400110d0
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor ebx, ebx
mov r13, rdx
lea rdx, [rax + 0x20]
and dword [rax + 0x20], ebx
and qword [rax - 0x20], rbx
and dword [rax - 0x28], ebx
mov r12, r8
mov rbp, rcx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
jne 0x140011128
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400111c6
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
jne 0x140011142
mov ebx, 0x8007000e
jmp 0x1400111b8
mov edx, dword [rsp + 0x68]
mov r9, rax
mov r8d, esi
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x140011170
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400111b8
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x140021cb0]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1400111a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400111b8
mov rdx, qword [rsp + 0x28]
mov ecx, dword [rdx + 8]
mov dword [r13], ecx
mov ecx, dword [rdx + 0xc]
mov dword [r12], ecx
test rdi, rdi
je 0x1400111c6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret

Function at 0x1400111e4
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
cmp r9d, ebx
je 0x14001123b
mov rdx, rcx
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
cmp eax, ebx
jne 0x140011229
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
mov ebx, ecx
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8d, ebx
cmp edi, ebx
sete r8b
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, ebx
jne 0x140011229
cmp edi, ebx
jne 0x140011213
xor edx, edx
mov rcx, rsi
call fcn.140010954
cmp eax, ebx
je 0x140011213
mov ebx, 1
jmp 0x140011229
Function at 0x140011268
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140011307
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400112f9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400112a5
mov ebx, 0x80070005
jmp 0x140011307
test al, 0x10
je 0x1400112b0
mov ebx, 0x8000ffff
jmp 0x140011307
test al, 1
jne 0x1400112bc
test al, 2
jne 0x1400112bc
test al, 4
je 0x140011307
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1400112e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140011307
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140011307
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140011314
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x50
and qword [rax - 0x20], 0
and qword [rax - 0x28], 0
mov r14, rcx
mov r13, rdx
mov ebp, 0x104
lea rcx, [rax - 0x20]
mov rdx, rbp
mov rsi, r9
mov r12, r8
or rdi, 0xffffffffffffffff
call fcn.14001035c
mov ebx, eax
test eax, eax
js 0x14001144e
mov rdx, qword [rsp + 0x48]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebp, ebp
cmp rdi, 0xffffffffffffffff
jne 0x140011411
mov r8, qword [rsp + 0x48]
lea rdx, str._s_S_05d._S
lea rcx, [rsp + 0x40]
mov r9, r14
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], ebp
call fcn.1400108e4
mov ebx, eax
test eax, eax
js 0x14001144e
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x40]
lea eax, [rdi + 2]
mov r8d, eax
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140011403
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x80070050
jne 0x1400113ff
xor ebx, ebx
jmp 0x140011403
test ebx, ebx
js 0x14001143f
inc ebp
cmp ebp, 0x3e8
jl 0x140011375
test r12, r12
je 0x14001142e
mov rdx, qword [rsp + 0x40]
mov r9d, 0xfde9
xor r8d, r8d
mov rcx, r12
call fcn.140010590
mov ebx, eax
test rsi, rsi
je 0x140011436
mov qword [rsi], rdi
test ebx, ebx
js 0x14001143f
test rsi, rsi
jne 0x14001144e
cmp rdi, 0xffffffffffffffff
je 0x14001144e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14001145d
call fcn.140010460
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001146c
call fcn.140010460
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x140011e90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13, rcx
mov rcx, rdx
mov r14, r9
mov r15, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ebx, ebx
mov r11d, eax
or r10d, 0xffffffff
mov r9, r15
add r11d, r11d
lea rdi, [0x1400295b0]
cmp dword [0x1400299b0], ebx
jne 0x140011f1c
mov dword [0x1400299b0], 1
mov ecx, ebx
mov r8, rdi
mov eax, ecx
mov edx, 8
test al, 1
je 0x140011f03
shr eax, 1
xor eax, 0xedb88320
jmp 0x140011f05
shr eax, 1
dec edx
cmp edx, ebx
jg 0x140011ef6
inc ecx
mov dword [r8], eax
add r8, 4
cmp ecx, 0xff
jle 0x140011eef
cmp r11d, ebx
jbe 0x140011f47
mov edx, r11d
movzx ecx, byte [r9]
mov eax, r10d
inc r9
xor rcx, rax
movzx eax, cl
mov ecx, r10d
mov r10d, dword [rdi + rax*4]
shr ecx, 8
xor r10d, ecx
sub rdx, 1
jne 0x140011f24
xor edx, edx
not r10d
mov r12d, ebx
mov eax, r10d
div dword [r13 + 0x18]
mov edi, edx
cmp dword [r13 + 0x18], ebx
jbe 0x140011f92
mov rbp, qword [r13 + 0x10]
mov eax, edi
lea rsi, [rax + rax*2]
mov rcx, qword [rbp + rsi*8 + 8]
cmp dword [rsp + 0x60], ebx
je 0x140011fb6
cmp rcx, rbx
je 0x140011f85
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, ebx
je 0x140011fdf
cmp qword [rbp + rsi*8 + 8], rbx
jne 0x140011fc8
cmp dword [rbp + rsi*8], ebx
jne 0x140011fc8
mov ebx, 1
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp rcx, rbx
je 0x140011fdf
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, ebx
je 0x140011fdf
inc edi
cmp edi, dword [r13 + 0x18]
jb 0x140011fd4
sub edi, dword [r13 + 0x18]
inc r12d
cmp r12d, dword [r13 + 0x18]
jb 0x140011f5e
jmp 0x140011f92
mov dword [r14], edi
jmp 0x140011f97
Function at 0x140012740
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x270
mov rax, qword [0x1400280c8]
xor rax, rsp
mov qword [rsp + 0x260], rax
and qword [rsp + 0x40], 0
mov rdi, rcx
mov ebp, 0x80070000
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x48], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x14001282f
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140012842
mov rcx, qword [rsp + 0x40]
call fcn.140012740
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140012842
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x40], 0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140012842
jmp 0x140012837
cmp ebx, 0x80070103
je 0x140012840
test ebx, ebx
jne 0x140012842
jmp 0x140012772
xor ebx, ebx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140012852
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400146fc
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14001287c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x1400280c8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov r8, rdx
lea rcx, [rsp + 0x20]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.140014938
cmp eax, 0x50
jne 0x1400128c0
mov eax, 0x8007007a
jmp 0x140012902
xor edi, edi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov r11d, eax
cmp eax, edi
jne 0x140012923
lea rcx, [rsp + 0x20]
mov edx, 0x5c
call fcn.140015514
cmp rax, rdi
je 0x1400128f4
mov word [rax], di
cmp di, word [rax + 2]
je 0x1400128d7
cmp word [rsp + 0x20], di
je 0x140012900
cmp rax, rdi
jne 0x1400128c2
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400146fc
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret
cmp eax, 2
je 0x14001293e
cmp eax, 3
je 0x14001293e
movzx eax, ax
or eax, 0x80070000
cmp r11d, edi
cmovle eax, r11d
jmp 0x140012940
mov eax, edi
cmp eax, 1
jne 0x140012902
jmp 0x1400128c2
Function at 0x14001294c
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
and qword [r11 + 0x18], 0
lea rax, [r11 + 0x18]
mov r9d, 0x2001f
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x140012988
lea ebx, [rax - 1]
jmp 0x1400129d5
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400129d5
mov rcx, qword [rsp + 0x50]
call fcn.140012740
mov ebx, eax
test eax, eax
js 0x1400129d5
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x50], 0
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400129e5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400130c0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 + 0x18], r8
push rdi
sub rsp, 0x50
lea rax, [r11 + 0x18]
xor ebx, ebx
mov r8d, edx
and qword [r11 - 0x10], rbx
and dword [rsp + 0x40], ebx
mov qword [r11 - 0x28], rax
and dword [rsp + 0x28], ebx
lea rax, [r11 - 0x10]
mov ebp, r9d
mov rdx, rcx
xor r9d, r9d
mov ecx, 0x900
mov qword [r11 - 0x38], rax
xor edi, edi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov esi, eax
test eax, eax
jne 0x140013131
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400131bf
test esi, esi
je 0x14001317e
mov rcx, qword [0x1400280a8]
and qword [rsp + 0x20], 0
mov r8d, esi
mov edx, edi
lea r9, [rsp + 0x40]
sub r8d, edi
add rdx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140013176
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400131bf
add edi, dword [rsp + 0x40]
cmp edi, esi
jb 0x140013135
test ebp, ebp
je 0x1400131bf
mov rdx, qword [0x1400280b8]
mov rcx, qword [0x1400280a8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400131bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400131cf
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1400131e8
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
mov ebp, r8d
mov r8, rdx
mov rdx, rcx
lea rcx, [rax - 0x18]
xor edi, edi
and dword [rax + 0x20], edi
call fcn.140010794
mov ebx, eax
test eax, eax
js 0x1400132bd
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test eax, eax
je 0x14001327c
mov rcx, qword [0x1400280a8]
and qword [rsp + 0x20], 0
mov r8d, esi
mov edx, edi
lea r9, [rsp + 0x68]
sub r8d, edi
add rdx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140013274
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400132bd
add edi, dword [rsp + 0x68]
cmp edi, esi
jb 0x140013233
test ebp, ebp
je 0x1400132bd
mov rdx, qword [0x1400280b8]
mov rcx, qword [0x1400280a8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400132bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400132cc
call fcn.140010460
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret