joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff670d658d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x7ff670e2f670]
mov edi, ecx
cmp byte [rbx + 0x4a25], 0
jne 0x7ff670d65922
cmp byte [rbx + 0x4a26], 0
jne 0x7ff670d65922
movsx r9d, word [rbx + 0x5b1a]
lea r8, [0x7ff670dc86d8]
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.7ff670d538b0
test dil, 1
je 0x7ff670d65a48
jmp 0x7ff670d659ab
movss xmm1, dword [rbx + 0x3898]
lea r8, [0x7ff670dc86d8]
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x7ff670e138c0]
xor eax, eax
mulss xmm1, dword [0x7ff670e138a8]
addss xmm0, dword [rbx + 0xdfc]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x4788], rax
mov dword [rbx + 0x4774], 1
movss dword [rbx + 0x4780], xmm0
movss dword [rbx + 0x4784], xmm1
movss xmm0, dword [rbx + 0x38f4]
mulss xmm0, dword [0x7ff670e137f4]
or dword [rbx + 0x4770], 0x41
movss dword [rbx + 0x47d0], xmm0
movsx r9d, word [rbx + 0x5b1a]
call fcn.7ff670d538b0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x7ff670d65a00
lea r11, [0x7ff670dc98f0]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x7ff670d659e3
cmp byte [r8], r9b
jne 0x7ff670d659e3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x7ff670d659d0
not ecx
call fcn.7ff670d5ce50
test rax, rax
je 0x7ff670d65a48
cmp byte [rax + 0x96], 0
je 0x7ff670d65a48
mov byte [rax + 0x9d], 1
lea r8, [0x7ff670dc86d8]
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b1a]
mov edx, 0x10
movsx r9d, word [rbx + 0x5b1a]
call fcn.7ff670d538b0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.7ff670d5f700
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff670d6afb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5bc8], 0
lea rbx, [rcx + 0x5bd0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x7ff670d6b057
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x7ff670d6b00a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.7ff670d6d820
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.7ff670d54120
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5bc8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5bd8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x7ff670e2f668]
cmovne rcx, rax
call qword [sym.imp.ucrtbase.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x7ff670d6b05f
mov rcx, rbx
call fcn.7ff670d54120
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff670d6b700
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x7ff670e2f670]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x7ff670d6b764
lea r10, [0x7ff670dc98f0]
cmp r8b, 0x23
jne 0x7ff670d6b747
cmp byte [rdx], r8b
jne 0x7ff670d6b747
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x7ff670d6b734
mov eax, dword [r14 + 0x5b78]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x7ff670d6b7c5
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x7ff670d6b78a
cmp edi, eax
jl 0x7ff670d6b7a4
mov r8d, 0x6fd
lea rdx, [0x7ff670dc45a0]
lea rcx, [0x7ff670dc9468]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rax, qword [r14 + 0x5b80]
cmp dword [rax + rbp + 8], ebx
je 0x7ff670d6b7e2
mov eax, dword [r14 + 0x5b78]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x7ff670d6b781
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x7ff670d6b7ef
cmp edi, dword [r14 + 0x5b78]
jl 0x7ff670d6b809
mov r8d, 0x6fd
lea rdx, [0x7ff670dc45a0]
lea rcx, [0x7ff670dc9468]
call qword [sym.imp.ucrtbase.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5b80]
lea rax, [rax + rcx*8]
jmp 0x7ff670d6b7c7
Function at 0x7ff670d8be20
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.7ff670d63270
cmp byte [rax], 0
je 0x7ff670d8beb9
xor edx, edx
mov ecx, 0x210
call fcn.7ff670d64490
test al, al
je 0x7ff670d8beb9
mov ecx, 0xa0
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x7ff670d8beb9
mov rbx, qword [0x7ff670e2f670]
test rbx, rbx
jne 0x7ff670d8be88
mov r8d, 0xf50
lea rdx, [0x7ff670dc4730]
lea rcx, [0x7ff670dc4c60]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rbx, qword [0x7ff670e2f670]
cmp byte [rbx + 0x37a9], 0
je 0x7ff670d8bea5
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.7ff670d53100
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov ecx, 0x214
call fcn.7ff670d63270
cmp byte [rax], 0
je 0x7ff670d8bf4c
xor edx, edx
mov ecx, 0x214
call fcn.7ff670d64490
test al, al
je 0x7ff670d8bf4c
mov ecx, 0xa1
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x7ff670d8bf4c
mov rbx, qword [0x7ff670e2f670]
test rbx, rbx
jne 0x7ff670d8bf1b
mov r8d, 0xf50
lea rdx, [0x7ff670dc4730]
lea rcx, [0x7ff670dc4c60]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rbx, qword [0x7ff670e2f670]
cmp byte [rbx + 0x37a9], 0
je 0x7ff670d8bf38
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.7ff670d53100
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov ecx, 0x212
call fcn.7ff670d63270
cmp byte [rax], 0
je 0x7ff670d8bfdf
xor edx, edx
mov ecx, 0x212
call fcn.7ff670d64490
test al, al
je 0x7ff670d8bfdf
mov ecx, 0x5b
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x7ff670d8bfdf
mov rbx, qword [0x7ff670e2f670]
test rbx, rbx
jne 0x7ff670d8bfae
mov r8d, 0xf50
lea rdx, [0x7ff670dc4730]
lea rcx, [0x7ff670dc4c60]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rbx, qword [0x7ff670e2f670]
cmp byte [rbx + 0x37a9], 0
je 0x7ff670d8bfcb
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.7ff670d53100
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov ecx, 0x216
call fcn.7ff670d63270
cmp byte [rax], 0
je 0x7ff670d8c072
xor edx, edx
mov ecx, 0x216
call fcn.7ff670d64490
test al, al
je 0x7ff670d8c072
mov ecx, 0x5c
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x7ff670d8c072
mov rbx, qword [0x7ff670e2f670]
test rbx, rbx
jne 0x7ff670d8c041
mov r8d, 0xf50
lea rdx, [0x7ff670dc4730]
lea rcx, [0x7ff670dc4c60]
call qword [sym.imp.ucrtbase.dll__wassert]
mov rbx, qword [0x7ff670e2f670]
cmp byte [rbx + 0x37a9], 0
je 0x7ff670d8c05e
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.7ff670d53100
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x7ff670d90080
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.kernel32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x7ff670e43a80], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x7ff670d900dd
xor edx, edx
call qword [sym.imp.kernel32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.7ff670d51b20]
call qword [sym.imp.kernel32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x7ff670d92340
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], r9d
push rdi
push r14
push r15
sub rsp, 0x60
mov rbx, qword [rsp + 0xa0]
lea r9, [rax + 0x20]
xor r14d, r14d
mov qword [rax - 0x48], r14
mov qword [rax - 0x50], r14
mov dword [rax - 0x58], r14d
mov dword [rax + 0x20], r14d
call qword [sym.imp.ws2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov rdx, qword [0x7ff670e25138]
lea rbp, [0x7ff670e25130]
movabs r15, 0x4d54ee85da812030
mov dword [rsp + 0x44], r14d
add rdx, r15
mov edi, eax
cmp rdx, 1
jbe 0x7ff670d923c6
mov rcx, qword [0x7ff670e25130]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, rbp
call r8
jmp 0x7ff670d923cb
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x48], rbp
movups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x7ff670d9240e
mov eax, dword [rbx]
mov r8d, eax
jmp 0x7ff670d9243e
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x7ff670d92480
mov rcx, qword [0x7ff670e25138]
add rcx, r15
mov dword [rsp + 0x44], r14d
cmp rcx, 1
jbe 0x7ff670d92474
mov rax, qword [0x7ff670e25130]
mov edx, 0x2746
mov rcx, rbp
call qword [rax + 0x30]
mov dword [rsp + 0x40], 0x2746
jmp 0x7ff670d924ef
mov al, 1
mov dword [rsp + 0x40], 0x2746
jmp 0x7ff670d924ef
cmp r9, 1
jne 0x7ff670d924b3
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x7ff670d92513
mov rcx, qword [0x7ff670e25138]
add rcx, r15
mov dword [rsp + 0x44], r14d
cmp rcx, 1
jbe 0x7ff670d924e5
mov rax, qword [0x7ff670e25130]
mov edx, 0x274d
mov rcx, rbp
call qword [rax + 0x30]
jmp 0x7ff670d924e7
mov al, 1
mov dword [rsp + 0x40], 0x274d
movzx eax, al
mov qword [rsp + 0x48], rbp
add rax, 2
movups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x7ff670d9251e
mov eax, 0xffffffff
jmp 0x7ff670d9253b
mov eax, dword [rsp + 0x98]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rsp + 0x50], r14
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbx + 0x10], xmm0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x7ff670da23c0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1f0
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x7ff670e43b50], eax
inc eax
cmp eax, 1
jne 0x7ff670da23fb
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.ws2_32.dll_WSAStartup]
xchg dword [0x7ff670e43b54], eax
test bl, bl
je 0x7ff670da249f
xor ebx, ebx
lock xadd dword [0x7ff670e43b54], ebx
test ebx, ebx
je 0x7ff670da249f
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x200], rsi
add rcx, qword [0x7ff670e25138]
lea rsi, [0x7ff670e25130]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x7ff670da2454
mov rax, qword [0x7ff670e25130]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x7ff670da2456
mov al, 1
lea rcx, [0x7ff670e0adf0]
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, [0x7ff670e0add8]
mov rsi, qword [rsp + 0x200]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x7ff670da24b3
mov rbx, qword [rsp + 0x208]
mov rax, rdi
add rsp, 0x1f0
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, [0x7ff670e0ae40]
lea rcx, [rsp + 0x38]
call fcn.7ff670d8fbe0
int3

Function at 0x7ff670da3940
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x7ff670da3a09
cmp byte [rcx + 0x71], 0
je 0x7ff670da3a09
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x7ff670da39fc
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.msvcp140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x7ff670da39b8
sub eax, 1
je 0x7ff670da39bc
cmp eax, 2
jne 0x7ff670da39fc
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x7ff670da39ea
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.ucrtbase.dll_fwrite]
cmp rdi, rax
jne 0x7ff670da39fc
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x7ff670daabc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x7ff670e25080]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x7ff670e0cc48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyExA]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, [0x7ff670e0cc38]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.advapi32.dll_RegQueryValueExA]
mov eax, dword [rsp + 0x78]
mov ecx, eax
call fcn.7ff670dbe860
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, [0x7ff670e0cc38]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.advapi32.dll_RegQueryValueExA]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x38]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0
jmp 0x7ff670daacb7
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x30], eax
jae 0x7ff670daacf3
mov rax, qword [rsp + 0x40]
add rax, 8
mov r9, rax
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [0x7ff670e43970]
call fcn.7ff670dae8a0
mov rax, qword [rsp + 0x40]
add rax, 0x14
mov qword [rsp + 0x40], rax
jmp 0x7ff670daacad
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.7ff670dbdfe4
cmp qword [rsp + 0x50], 0
jne 0x7ff670daad1a
mov qword [rsp + 0x60], 0
jmp 0x7ff670daad2d
mov qword [rsp + 0x38], 0x8123
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.7ff670dbe840
add rsp, 0xa8
ret
Function at 0x7ff670dab7f0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x7ff670e25080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x7ff670e43a98], eax
jle 0x7ff670dab867
lea rcx, [0x7ff670e43a98]
call fcn.7ff670dbe104
cmp dword [0x7ff670e43a98], 0xffffffff
jne 0x7ff670dab867
lea rdx, [0x7ff670e0ccc0]
lea rcx, [0x7ff670e43aa0]
call fcn.7ff670d89f90
lea rcx, [0x7ff670dc2530]
call fcn.7ff670dbe3a4
nop
lea rcx, [0x7ff670e43a98]
call fcn.7ff670dbe098
lea rcx, [0x7ff670e43aa0]
call fcn.7ff670d89ee0
lea r8, [rsp + 0x38]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyA]
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x60]
call fcn.7ff670d89ee0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.advapi32.dll_RegDeleteKeyA]
test eax, eax
jne 0x7ff670dab8d2
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.advapi32.dll_RegCloseKey]
test eax, eax
jne 0x7ff670dab8d2
mov dword [rsp + 0x20], 1
jmp 0x7ff670dab8da
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.7ff670dbe840
add rsp, 0x58
ret
Function at 0x7ff670dab900
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x7ff670e25080]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rdx, [0x7ff670e0ccc0]
lea rcx, [rsp + 0x68]
call fcn.7ff670d89f90
nop
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x68]
call fcn.7ff670d89f10
lea rcx, [rsp + 0x68]
call fcn.7ff670d89ee0
lea r8, [rsp + 0x58]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegCreateKeyA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x7ff670dab98a
mov byte [rsp + 0x34], 0
lea rcx, [rsp + 0x68]
call fcn.7ff670d89f30
movzx eax, byte [rsp + 0x34]
jmp 0x7ff670dabb40
mov byte [rsp + 0x60], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x7ff670e07580]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x7ff670dab9e0
mov byte [rsp + 0x35], 0
lea rcx, [rsp + 0x68]
call fcn.7ff670d89f30
movzx eax, byte [rsp + 0x35]
jmp 0x7ff670dabb40
mov byte [rsp + 0x61], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x61]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x7ff670e0ccb0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x7ff670daba36
mov byte [rsp + 0x36], 0
lea rcx, [rsp + 0x68]
call fcn.7ff670d89f30
movzx eax, byte [rsp + 0x36]
jmp 0x7ff670dabb40
mov byte [rsp + 0x62], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x62]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x7ff670e0ccf4]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x7ff670daba8c
mov byte [rsp + 0x37], 0
lea rcx, [rsp + 0x68]
call fcn.7ff670d89f30
movzx eax, byte [rsp + 0x37]
jmp 0x7ff670dabb40
mov rcx, qword [rsp + 0xa0]
call fcn.7ff670d8a480
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0xa0]
call fcn.7ff670d89ee0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x7ff670e0cce8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.advapi32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x7ff670dabb07
mov byte [rsp + 0x38], 0
lea rcx, [rsp + 0x68]
call fcn.7ff670d89f30
movzx eax, byte [rsp + 0x38]
jmp 0x7ff670dabb40
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.advapi32.dll_RegCloseKey]
test eax, eax
jne 0x7ff670dabb20
mov dword [rsp + 0x3c], 1
jmp 0x7ff670dabb28
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x39], al
lea rcx, [rsp + 0x68]
call fcn.7ff670d89f30
movzx eax, byte [rsp + 0x39]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.7ff670dbe840
add rsp, 0x98
ret
Function at 0x7ff670db1960
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x118
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov rcx, rax
call fcn.7ff670db2240
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x38]
mov eax, dword [rax + 0x50]
mov edx, eax
mov rcx, qword [rsp + 0x38]
call fcn.7ff670db22e0
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x40]
call fcn.7ff670db21e0
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x38]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsp + 0x50]
call fcn.7ff670db21e0
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
mov r9, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0xd0]
call fcn.7ff670db23c0
mov qword [rsp + 0x28], 0
jmp 0x7ff670db1a59
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x38]
movzx eax, word [rax + 6]
cmp qword [rsp + 0x28], rax
jae 0x7ff670db1be3
imul rax, qword [rsp + 0x28], 0x28
mov rcx, qword [rsp + 0x120]
add rax, qword [rcx + 0x40]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov rcx, rax
call fcn.7ff670d93820
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0xc]
add rax, rcx
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x120]
add rax, qword [rcx + 0x30]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x120]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x70]
call fcn.7ff670db21e0
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0xc]
mov qword [rsp + 0x78], rax
mov r8, qword [rsp + 0x78]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x80]
call fcn.7ff670db2190
mov rax, qword [rax]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0xf8]
mov rcx, qword [rsp + 0x90]
call fcn.7ff670db21e0
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x14]
mov qword [rsp + 0x98], rax
mov r8, qword [rsp + 0x98]
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0xa0]
call fcn.7ff670db2190
mov rax, qword [rax]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov r9, qword [rsp + 0xb0]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x108]
call fcn.7ff670db23c0
jmp 0x7ff670db1a4c
add rsp, 0x118
ret