joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140080e35
Capabilities:
Check if file exists
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, r8
mov rdi, rcx
test edx, edx
je 0x140080e94
xor eax, eax
xor ecx, ecx
cmp edx, 2
setne al
sete cl
lea r8d, [rax + rax*2]
mov eax, 0x40000000
mov edx, 0x80000000
cmove edx, eax
mov eax, ecx
shl eax, 7
xor ecx, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x30], 0
mov rcx, rdi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
setne al
jmp 0x140080ed4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140080ecb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140080ecb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14007a0fc
lea rcx, str.Unable_to_delete__s:__s
mov rdx, rdi
mov r8, rax
call fcn.140072785
mov qword [rsi], 0xffffffffffffffff
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x14008206c
Capabilities:
Get common file path
Set current directory

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov ebx, r9d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1400d80e0]
xor rax, rsp
mov qword [rsp + 0x130], rax
test r8b, r8b
je 0x1400820b4
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
dec eax
cmp eax, 0x103
setb bpl
jmp 0x1400820b6
xor ebp, ebp
mov dword [rdi], 0x88
xor eax, eax
test rsi, rsi
je 0x1400820ca
cmp byte [rsi], 0
cmovne rax, rsi
mov qword [rdi + 0x50], rax
mov rcx, rdi
test bl, bl
je 0x1400820dd
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
jmp 0x1400820e3
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov edi, eax
test rsi, rsi
je 0x140082104
mov ecx, 0x104
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
dec eax
cmp eax, 0x103
jb 0x140082104
mov byte [rsi], 0
test bpl, bpl
je 0x140082114
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test edi, edi
setne bl
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140084030
mov eax, ebx
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14008e6d8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14008e810
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14008e877
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008e877
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008e877
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008e877
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008e877
cmp dword [rcx + 0x84], 0xe
jbe 0x14008e877
cmp dword [rcx + 0xf8], 0
je 0x14008e877
mov ecx, ebx
call fcn.14008e75c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14008e9a4
cmp dword [rbp + 0x20], 0
je 0x14008e8c4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14008e7b8
int3

Function at 0x140094270
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x14009428d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1400942e8
test al, 7
jne 0x140094280
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400942a1
mov rdx, qword [rax - 8]
test dl, dl
je 0x140094312
test dh, dh
je 0x14009430c
shr rdx, 0x10
test dl, dl
je 0x140094306
test dh, dh
je 0x140094300
shr rdx, 0x10
test dl, dl
je 0x1400942fa
test dh, dh
je 0x1400942f4
shr edx, 0x10
test dl, dl
je 0x1400942ee
test dh, dh
jne 0x1400942a1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x140002790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140002808
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140002808
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400027f5
nop
cmp rbx, rcx
jae 0x140002808
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400027e0
cmp rbx, rcx
jae 0x140002808
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x14000280a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140003d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x60]
xor r15d, r15d
mov rax, qword [rsp + 0x68]
mov r13, rdx
mov r10, qword [rsp + 0x78]
mov qword [r14], r8
mov qword [r10], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140003f05
mov r12, qword [rsp + 0x70]
lea r8d, [r15 + 1]
mov rsi, qword [r10]
mov r9d, 0x3ff
mov r11d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x140003f05
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rax]
cmp r8w, dx
jae 0x140003dda
lea eax, [r11 + rcx]
cmp ax, r9w
ja 0x140003f25
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140003df0
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x140003df0
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140003e03
movzx r9d, al
mov r11d, r15d
mov ebx, r15d
jmp 0x140003e4e
mov r9d, eax
cmp eax, 0x800
jae 0x140003e1d
shr r9d, 6
mov r11d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x140003e4e
cmp eax, 0x10000
jae 0x140003e37
shr r9d, 0xc
mov r11d, 2
or r9b, 0xe0
mov ebx, r11d
jmp 0x140003e4e
shr r9d, 0x12
mov r11d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdi, r12
sub rdi, rsi
mov ecx, r8d
cmp rdi, rcx
jl 0x140003f05
test dx, dx
jne 0x140003e99
mov rcx, qword [rsp + 0x40]
test byte [rcx + 0x14], 2
je 0x140003e99
lea edx, [r8 + 3]
cmp rdi, rdx
jl 0x140003f05
mov byte [rsi], 0xef
inc qword [r10]
mov rcx, qword [r10]
mov byte [rcx], 0xbb
inc qword [r10]
mov rcx, qword [r10]
mov byte [rcx], 0xbf
inc qword [r10]
add qword [r14], 2
test bpl, bpl
jne 0x140003ea8
cmp r11d, 3
jae 0x140003eb4
mov rcx, qword [r10]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r10]
mov r9, qword [r10]
test r8d, r8d
jle 0x140003ee0
lea ecx, [r11 + r11*2]
add ecx, ecx
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r10]
mov r9, qword [r10]
test r8d, r8d
jg 0x140003ec2
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rax, qword [r14]
cmp rax, qword [rsp + 0x58]
jne 0x140003d8f
mov rax, qword [rsp + 0x50]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x48]
mov eax, 2
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005ef0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14008b040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx esi, dl
mov rdi, rcx
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rbp + 3]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140006082
cmp sil, 1
je 0x140005f6e
mov rdx, rbx
mov rcx, rdi
call fcn.1400055a0
test al, al
jne 0x14000607f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rdx, [rdi + 0x81]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x40], rbp
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140005340
nop
mov rax, qword [rsp + 0x40]
cmp dword [rax - 0x10], 0
je 0x140006052
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call fcn.1400048f0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x4c]
mov r8d, 2
lea rdx, [0x14007c34c]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140006052
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000604d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060a8
call fcn.140045b20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov rax, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000607f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400454d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14004cd2c
nop
int3
Function at 0x140006710
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14008b040]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.140002aa0
mov rcx, rax
test rax, rax
je 0x1400068b0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
call fcn.140006330
call fcn.140002aa0
mov rcx, rax
test rax, rax
je 0x1400068bb
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea r9, str.processlasso.log
mov r8, qword [rsp + 0x30]
lea rdx, [0x14007c318]
lea rcx, [rsp + 0x38]
call fcn.14000e1f0
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400067b2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rdx, [rbx - 0x18]
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400067d0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor esi, esi
call fcn.140002aa0
mov rcx, rax
test rax, rax
je 0x1400068bb
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], esi
lea r9, str.processlasso.log
mov r8, qword [rsp + 0x30]
lea rdx, str._s_s._u
lea rcx, [rsp + 0x40]
call fcn.14000e1f0
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000685d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14000685d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000684c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
inc esi
call fcn.140002aa0
mov rcx, rax
test rax, rax
je 0x1400068bb
jmp 0x1400067e3
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140006877
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140006893
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400454d0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x80004005
call fcn.140002830
nop
mov ecx, 0x80004005
call fcn.140002830
int3
Function at 0x14000bcc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x14000be51
mov r15, qword [rsp + 0x60]
lea r8d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r9d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x14000be51
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r8w, dx
jae 0x14000bd5b
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x14000be78
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x14000bd72
mov eax, ecx
add cx, r11w
cmp cx, r9w
ja 0x14000bd72
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x14000bd85
movzx r9d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x14000bdd2
mov r9d, eax
cmp eax, 0x800
jae 0x14000bd9f
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov r11d, r8d
jmp 0x14000bdd2
cmp eax, 0x10000
jae 0x14000bdb9
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov r11d, r10d
jmp 0x14000bdd2
shr r9d, 0x12
mov r10d, 3
movzx r11d, sil
or r9b, 0xf0
xor r11d, 1
add r11d, r11d
lea r8d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r8d
cmp rdx, rcx
jl 0x14000be51
add qword [r14], 2
test sil, sil
jne 0x14000bdf3
cmp r10d, 3
jae 0x14000bdff
mov rcx, qword [rbx]
mov r8d, r11d
mov byte [rcx], r9b
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jle 0x14000be2e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jg 0x14000be10
shr eax, 0xa
mov r8d, 1
test sil, sil
mov ecx, r8d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x14000bd0f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x14000be5f
Function at 0x140011ae0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14008b040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rdx
xor ebp, ebp
mov dword [r8], ebp
lea rdx, [rsp + 0x5c]
mov eax, dword [rcx + 8]
mov rdi, r8
mov qword [rsp + 0x40], rdx
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x5c], ebp
mov qword [rsp + 0x38], rdx
xor r9d, r9d
mov rdx, qword [rcx + 0x10]
xor r8d, r8d
mov rcx, qword [rcx]
xor bl, bl
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140011b9f
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x64]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], ebp
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov dword [rsp + 0x60], 4
mov dword [rsp + 0x64], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011b94
mov ecx, dword [rsp + 0x58]
mov bl, 1
mov dword [rdi], ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400454d0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400129e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x14008b040]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x60]
mov rbx, r9
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareProcessLasso
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
xor eax, eax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140012a85
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x5c]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.DateTimeFormat
mov dword [rsp + 0x58], 4
mov dword [rsp + 0x5c], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x140012a9a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400454d0
add rsp, 0x70
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400454d0
add rsp, 0x70
pop rbx
ret
Function at 0x140012ac0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1ff0]
mov eax, 0x20f0
call fcn.140046160
sub rsp, rax
mov rax, qword [0x14008b040]
xor rax, rsp
mov qword [rbp + 0x1fe0], rax
mov rsi, r8
mov r14d, dword [rbp + 0x2048]
mov dword [rsp + 0x28], r14d
xor r15d, r15d
mov qword [rsp + 0x20], r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, rax
cmp eax, 0x20
ja 0x140012ce4
call fcn.140002aa0
mov rcx, rax
test rax, rax
je 0x140012d0d
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
xor edx, edx
mov r8d, 0x1ffe
lea rcx, [rbp - 0x1e]
call fcn.14006cda0
mov word [rbp - 0x20], r15w
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 1]
xor r8d, r8d
lea rdx, str.https_shellopencommand
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140012cc8
mov dword [rsp + 0x38], 0x2000
mov dword [rsp + 0x3c], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140012bce
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140012cc8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x14007cc10]
lea rcx, [rbp - 0x20]
call fcn.1400475dc
test rax, rax
jne 0x140012bfe
lea rdx, [0x14007cc1c]
lea rcx, [rbp - 0x20]
call fcn.1400475dc
test rax, rax
je 0x140012c02
mov word [rax], r15w
mov r9, rsi
lea r8, [rbp - 0x20]
lea rdx, str._s___s_
lea rcx, [rsp + 0x40]
call fcn.14000e1f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov r8d, 3
mov rbx, qword [rsp + 0x40]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140013730
mov edx, r14d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WinExec]
test eax, eax
je 0x140012c8a
sub eax, 2
je 0x140012c8a
sub eax, 1
je 0x140012c8a
cmp eax, 8
je 0x140012c8a
mov edi, 0x22
jmp 0x140012cb3
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9, rsi
lea r8, str.iexplore.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, rax
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
cmp rcx, rax
je 0x140012cc8
call fcn.1400515e4
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140012ce4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, rdi
mov rcx, qword [rbp + 0x1fe0]
xor rcx, rsp
call fcn.1400454d0
mov rbx, qword [rsp + 0x2120]
add rsp, 0x20f0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002830
int3
Function at 0x1400139c0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x14008b040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r10, r8
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x40], rcx
mov rax, rdx
lea rcx, [rsp + 0x50]
mov rbx, r9
mov qword [rsp + 0x38], rcx
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
mov qword [rsp + 0x30], rcx
mov rdx, r10
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], ecx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140013a56
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x140013a6b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400454d0
add rsp, 0x70
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400454d0
add rsp, 0x70
pop rbx
ret

Function at 0x140013a90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14008b040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0xa0]
lea rax, [rsp + 0x30]
mov r14, rcx
mov qword [rsp + 0x20], rax
cmp rdx, 0xffffffff81000000
mov rbp, r8
mov rbx, r9
mov rsi, rdx
mov rcx, 0xffffffff80000001
mov r9d, 1
cmovne rcx, rdx
xor r8d, r8d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140013b58
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbx
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x3c], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140013b4e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400454d0
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140013b36
cmp rsi, 0xffffffff81000000
jne 0x140013b34
mov byte [rsp + 0x28], 0
mov r9, rbx
mov r8, rbp
mov qword [rsp + 0x20], rdi
mov rdx, 0xffffffff80000002
mov rcx, r14
call fcn.140013a90
jmp 0x140013b36