joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c444
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [r11 - 0x28]
mov rbx, r8
mov rsi, rdx
mov qword [r11 - 0x30], rax
mov rdx, qword [rdx]
lea r9, [r11 - 0x24]
mov rdi, rcx
xor ebp, ebp
mov rcx, qword [rcx]
xor r8d, r8d
mov qword [r11 - 0x38], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x14001c4bc
lfence
mov eax, ecx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140001020
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rbx]
mov edx, 1
mov r8d, dword [rsp + 0x30]
shr r8d, 1
mov ecx, dword [rax - 0xc]
sub edx, dword [rax - 8]
sub ecx, r8d
or edx, ecx
jge 0x14001c4e7
lfence
mov edx, r8d
mov rcx, rbx
call fcn.140002d40
mov rax, qword [rbx]
lea rcx, [rsp + 0x30]
mov rdx, qword [rsi]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov rcx, qword [rdi]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbx]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test edx, edx
jns 0x14001c53d
cmp dword [rcx - 0xc], ebp
jl 0x14001c56f
lfence
mov rcx, qword [rbx]
mov eax, edx
mov dword [rcx - 0x10], ebp
mov rcx, qword [rbx]
mov word [rcx], bp
jmp 0x14001c4a2
test rcx, rcx
jne 0x14001c546
mov eax, ebp
jmp 0x14001c554
movsxd rdx, dword [rcx - 0xc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
js 0x14001c56f
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14001c56f
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
xor eax, eax
jmp 0x14001c4a2
mov ecx, 0x80070057
call fcn.1400327c0
int3
Function at 0x14001dde0
Capabilities:
Check if file exists
Create directory
Get file attributes
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x588]
sub rsp, 0x670
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rbp + 0x560], rax
mov rbx, rcx
mov edi, 0x206
xor r15d, r15d
lea rcx, [rsp + 0x32]
mov r8d, edi
mov word [rsp + 0x30], r15w
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8d, edi
mov word [rbp + 0x350], r15w
xor edx, edx
lea rcx, [rbp + 0x352]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov r13d, 0x104
sub rbx, rax
lea rcx, [rsp + 0x30]
mov sil, 1
mov r14d, r15d
mov edx, r13d
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14001de8e
movzx eax, word [rbx + rcx]
test ax, ax
je 0x14001de8e
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14001de6c
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r15w
je 0x14001dfe5
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001df5e
test al, 0x10
jne 0x14001dfde
mov r8, rdi
mov word [rbp + 0x140], r15w
xor edx, edx
lea rcx, [rbp + 0x142]
call sub.VCRUNTIME140.dll_memset
mov ebx, r15d
mov edi, 0x400
lea r9, [rsp + 0x30]
mov rdx, r13
lea rcx, [rbp + 0x140]
test ebx, ebx
jne 0x14001df0c
lea r8, str._s.bak
call fcn.14001e020
jmp 0x14001df1c
lea r8, str._s.bak__d
mov dword [rsp + 0x20], ebx
call fcn.14001e020
test eax, eax
js 0x14001dfe5
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001df3c
inc ebx
cmp ebx, edi
jl 0x14001deeb
cmp ebx, edi
je 0x14001dfe5
lea rdx, [rbp + 0x140]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14001dfe5
movzx eax, word [rsp + 0x30]
lea rbx, [rsp + 0x30]
cmp ax, 0x5c
jne 0x14001df7b
cmp word [rsp + 0x32], ax
movzx esi, sil
cmove esi, r15d
lea rdi, [rbp + 0x350]
jmp 0x14001dfd9
mov word [rdi], ax
add rbx, 2
add rdi, 2
cmp ax, 0x5c
jne 0x14001dfa5
test sil, sil
jne 0x14001dfad
inc r14d
cmp r14d, 3
sete sil
movzx eax, word [rbx]
test ax, ax
jne 0x14001df84
lea rcx, [rbp + 0x350]
mov word [rdi], r15w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001dfd6
xor edx, edx
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14001dfe5
movzx eax, word [rbx]
test ax, ax
jne 0x14001df84
mov eax, 1
jmp 0x14001dfe7
xor eax, eax
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.140001020
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14001e0c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov r14d, r9d
mov rdi, r8
mov rbx, rdx
mov r8, rcx
mov rsi, qword [rbp + 0x3e0]
xor r15d, r15d
test rcx, rcx
je 0x14001e2dc
cmp word [rcx], r15w
je 0x14001e2dc
test rdi, rdi
je 0x14001e2dc
test rsi, rsi
je 0x14001e2dc
mov word [rdi], r15w
mov dword [rsi], r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x40], r15
mov r12d, 0x104
mov edx, r12d
lea rcx, [rsp + 0x60]
lea r9, str.SOFTWAREMicrosoftNET_Framework_SetupNDP_
lea rax, [rsp + 0x60]
sub r9, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14001e18f
movzx eax, word [r9 + rcx]
test ax, ax
je 0x14001e18f
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14001e16c
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r15w
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.14001e310
test rbx, rbx
je 0x14001e1da
cmp word [rbx], r15w
je 0x14001e1da
lea r8, [0x14006d440]
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.14001e310
mov r8, rbx
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.14001e310
mov r9d, 0x20019
lea r8, [rsp + 0x60]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x30]
call fcn.140011100
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14001e2c5
mov dword [rsp + 0x50], r12d
lea r9, [rsp + 0x50]
lea r8, str.Version
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x30]
call fcn.1400155f0
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14001e2c5
mov rdx, r14
lea r8, [rbp + 0x170]
mov rcx, rdi
call fcn.140002250
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x54], 4
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, [0x14006ac58]
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001e2a4
cmp dword [rsp + 0x48], 4
jne 0x14001e2c0
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x14001e2c0
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x14001e2c0
mov dword [rsi], eax
mov ebx, r15d
jmp 0x14001e2ca
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x14001e2d8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14001e2e1
mov eax, 0x80004003
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.140001020
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140020450
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
lea r8, [rsp + 0x48]
mov rbp, rcx
lea rdx, [rsp + 0x50]
call fcn.1400152a0
mov rax, qword [0x140093720]
xor ebx, ebx
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdx, qword [0x140093718]
test rax, rax
jne 0x14002049c
test rdx, rdx
je 0x1400204b2
mov rax, rdx
mov qword [0x140093720], rdx
cmp qword [rax + 0x10], rbx
je 0x1400204b2
cmp qword [rax + 0x10], rsi
jb 0x1400204b2
cmp qword [rax + 0x10], rdi
jbe 0x140020561
mov qword [0x140093720], rdx
mov rax, rdx
test rdx, rdx
je 0x1400204f5
mov rcx, rdx
test rdx, rdx
je 0x1400204df
cmp qword [rcx + 0x10], rbx
je 0x1400204df
cmp qword [rcx + 0x10], rsi
jb 0x1400204df
cmp qword [rcx + 0x10], rdi
jbe 0x140020561
mov rax, qword [rax + 8]
mov qword [0x140093720], rax
mov rcx, rax
mov rdx, rax
test rax, rax
jne 0x1400204c4
movzx eax, bp
mov r8, rdi
sub rbp, rax
mov rdx, rsi
mov rcx, rbp
call fcn.1400205b0
test rax, rax
je 0x140020597
mov dword [rax], 0x52727464
lea rdx, [rax + 0xffa8]
mov qword [rax + 0x10], rbx
mov r8d, 0x2a7
mov rcx, qword [0x140093718]
mov qword [rax + 8], rcx
lea rcx, [rax + 0xff60]
mov qword [0x140093718], rax
mov qword [0x140093720], rax
mov qword [rdx], rbx
mov rbx, rcx
sub rcx, 0x60
lea rdx, [rdx - 0x60]
sub r8, 1
jne 0x140020549
mov qword [rax + 0x10], rbx
mov rbx, qword [rax + 0x10]
cmp rbx, rsi
jb 0x140020597
cmp rbx, rdi
ja 0x140020597
lfence
mov rdx, qword [rbx + 0x48]
mov rcx, qword [0x140093720]
mov qword [rcx + 0x10], rdx
mov edx, 0xcc
mov rcx, rbx
lea r8d, [rdx - 0x6c]
call sub.VCRUNTIME140.dll_memset
mov rax, rbx
jmp 0x140020599
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x140020690
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rsp + 0x50], rax
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x14002077d
mov esi, 0x10000
cmp rbx, qword [0x140093608]
jb 0x1400206f4
cmp rbx, qword [0x140093610]
ja 0x1400206f4
sub rbx, 0x8000000
jmp 0x140020774
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x14002077d
cmp dword [rsp + 0x40], esi
jne 0x140020758
cmp qword [rsp + 0x38], rsi
jb 0x140020758
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_VirtualAlloc
test rax, rax
jne 0x14002077f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x14002077d
sub rbx, rsi
jmp 0x140020774
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x1400206d6
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001020
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400239d8
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r12, rdx
mov qword [rsp + 0x70], rdx
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x40], 0x80030002
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x140023a56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140023d36
xor edx, edx
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
mov dword [rsp + 0x44], eax
test eax, eax
je 0x140023d19
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140023d0f
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140023cfc
mov dword [rsp + 0x80], ebx
mov dword [rsp + 0x50], ebx
lea r8, [rsp + 0x80]
mov rdx, rax
mov ecx, r14d
call fcn.140015570
mov dword [rsp + 0x40], eax
lea r9, [rsp + 0x50]
mov r8, r15
mov edx, r14d
mov ecx, dword [rsp + 0x80]
call fcn.140023fc0
mov dword [rsp + 0x40], eax
test eax, eax
js 0x140023b6f
mov edx, dword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140023b67
lfence
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x78]
mov r8d, r14d
xor edx, edx
mov ecx, dword [rsp + 0x80]
call fcn.140023d80
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x140023b6f
lfence
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsp + 0x48], rbx
jmp 0x140023b6f
mov dword [rsp + 0x40], 0x8007000e
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x140023d04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140023d2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140023d2b
lea rcx, [0x140067c00]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140023d4b
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x48]
mov qword [r12], rax
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140001020
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400242fc
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
mov r14b, r8b
mov rsi, rdx
mov rdi, rcx
lea rdx, [0x140067c00]
lea rcx, [rbp + 0x38]
call fcn.140002f00
lea rdx, [rbp + 0x38]
mov rcx, rsi
call fcn.1400068a0
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
or r15d, 0xffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14002435b
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rdi, rdi
jne 0x14002437b
mov ebx, 0x80070057
lfence
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14002438f
xor ebx, ebx
jmp 0x14002445b
and qword [rbp + 0x30], 0
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.140002f00
nop
lea rcx, [rbp + 0x30]
call fcn.140022420
test eax, eax
jne 0x1400243d8
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400243d1
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, 0x8007000e
jmp 0x140024365
mov rcx, qword [rbp + 0x30]
call fcn.140058794
mov ebx, eax
test eax, eax
jne 0x14002442f
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14002442f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140024453
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140024453
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140024453
lfence
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
test ebx, ebx
js 0x140024365
lea r8, str.privateregistry.bin
mov rdx, rdi
mov rcx, rsi
call fcn.140008720
test r14b, r14b
je 0x140024365
call fcn.140024500
test al, al
jne 0x140024365
mov rcx, qword [rsi]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140024365
call fcn.14000a7e0
test eax, eax
jne 0x140024365
lfence
lea rdx, [0x140067c00]
lea rcx, [rbp + 0x48]
call fcn.140002f00
nop
lea rdx, [rbp + 0x48]
mov rcx, rsi
call fcn.1400068a0
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400244e5
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str.privateregistry.user.bin
mov rdx, rdi
mov rcx, rsi
call fcn.140008720
jmp 0x140024368
Function at 0x14002491c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test rdx, rdx
je 0x140024b75
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x990]
sub rsp, 0xa90
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rbp + 0x980], rax
xor r15d, r15d
mov esi, r9d
cmp qword [0x140093328], r15
mov rdi, rdx
mov r14d, ecx
jne 0x140024b50
mov dl, r8b
mov rcx, rdi
call fcn.14002d220
test al, al
je 0x1400249c8
mov rdx, qword [str.Microsoft.Internal.Performance.CodeMarkers.dll]
lea rax, [rsp + 0x60]
sub rdx, rax
lea rcx, [rsp + 0x60]
mov ebx, 0x104
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x1400249b4
movzx eax, word [rdx + rcx]
test ax, ax
je 0x1400249b4
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x140024992
test rbx, rbx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r15w
jmp 0x140024a8a
cmp byte [rbp + 0x9e0], r15b
je 0x140024b50
mov ebx, 0x104
lea rdx, [rbp + 0x370]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
js 0x140024b50
lea ecx, [rbx - 4]
mov r8d, 3
mov qword [rsp + 0x40], rcx
lea rax, [rbp + 0x580]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x170]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x780]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x54]
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x370]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s
test eax, eax
jne 0x140024b50
lea rax, str..dll
mov edx, ebx
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x170]
mov rax, qword [str.Microsoft.VisualStudio.CodeMarkers]
lea r8, [rsp + 0x54]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__wmakepath_s
test eax, eax
jne 0x140024b50
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140024b50
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140024b50
mov rcx, rax
call fcn.1400154b0
mov rax, qword [0x140093320]
test rax, rax
je 0x140024abd
mov rcx, rdi
call rax
cmp qword [0x140092f90], r15
je 0x140024b12
cmp qword [0x140093308], r15
je 0x140024b12
cmp qword [0x140093300], r15
je 0x140024af3
mov rcx, qword [0x1400932d8]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov rdx, rdi
mov ecx, r14d
call qword [0x140093300]
jmp 0x140024b12
cmp qword [0x1400932f8], r15
je 0x140024b12
mov rcx, qword [0x1400932d8]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov ecx, r14d
call qword [0x1400932f8]
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], r15d
lea r8, str.AutoStartupLoggingEndMarker
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.140024b80
mov edx, dword [rsp + 0x50]
test eax, eax
cmovne edx, r15d
test edx, edx
mov dword [rsp + 0x50], edx
cmovne esi, edx
test esi, esi
je 0x140024b50
mov ecx, esi
call fcn.14005ed50
mov rcx, qword [rbp + 0x980]
xor rcx, rsp
call fcn.140001020
mov rbx, qword [rsp + 0xad0]
add rsp, 0xa90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140024b80
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rsp + 0x40], rax
and qword [rsp + 0x30], 0
mov rbx, r8
lea r8, [rsp + 0x30]
mov rdi, r9
call fcn.14002d320
test eax, eax
jne 0x140024c08
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x140024bbf
lea eax, [rcx + 2]
jmp 0x140024c08
and dword [rsp + 0x38], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbx
mov dword [rsp + 0x3c], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x38], 4
mov eax, SafeArrayGetDim
cmovne ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001020
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x1400262b4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r8
mov r14, rdx
mov rbp, rcx
xor ecx, ecx
movabs r12, 0xcbf29ce484222325
movzx eax, byte [r8 + rcx]
xor r12, rax
movabs rdx, 0x100000001b3
imul r12, rdx
inc rcx
cmp rcx, 4
jb 0x1400262dd
mov rax, qword [rbp + 0x30]
and rax, r12
add rax, rax
mov rcx, qword [rbp + 0x18]
mov rdi, qword [rcx + rax*8 + 8]
lea rdx, [rbp + 8]
mov r15, qword [rdx]
cmp rdi, r15
jne 0x140026320
mov rdi, r15
jmp 0x14002635d
mov rdx, qword [rcx + rax*8]
mov eax, dword [r8]
jmp 0x140026332
cmp rdi, rdx
je 0x140026352
mov rdi, qword [rdi + 8]
cmp eax, dword [rdi + 0x10]
jne 0x140026329
mov r15, qword [rdi]
mov rax, rdi
mov rdi, r15
test rax, rax
je 0x140026359
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x1400264c4
mov r15, rdi
xor eax, eax
jmp 0x140026340
lea rdx, [rbp + 8]
movabs rax, 0x7ffffffffffffff
cmp qword [rbp + 0x10], rax
jne 0x14002637b
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x30], rdx
and qword [rsp + 0x38], 0
lfence
mov ecx, SafeArrayAllocDescriptor
call fcn.140002eb0
mov rsi, rax
mov qword [rsp + 0x38], rax
mov ecx, dword [r13]
mov dword [rax + 0x10], ecx
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov rcx, qword [r13 + 8]
sub rcx, 0x18
call fcn.140002a70
add rax, 0x18
mov qword [rbx], rax
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1400263d3
cvtsi2ss xmm0, rcx
jmp 0x1400263e8
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbp + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400263fb
cvtsi2ss xmm1, rcx
jmp 0x140026410
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbp]
seta al
test al, al
je 0x14002646a
mov rcx, rbp
call fcn.1400264e0
mov rcx, qword [rbp + 0x30]
and rcx, r12
add rcx, rcx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rdi, qword [rbp + 8]
cmp rax, rdi
je 0x140026460
mov r8, qword [rdx + rcx*8]
mov ecx, dword [rsi + 0x10]
jmp 0x140026458
mov rdi, rax
cmp rax, r8
je 0x14002649e
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x14002644c
mov rdi, qword [rax]
mov qword [rsp + 0x20], rdi
mov r15, qword [rsp + 0x20]
mov rdx, qword [rdi + 8]
inc qword [rbp + 0x10]
mov qword [rsi], r15
mov qword [rsi + 8], rdx
mov qword [rdx], rsi
mov qword [rdi + 8], rsi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, r12
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rbp + 8]
jne 0x1400264a5
mov qword [rcx + rax*8], rsi
jmp 0x1400264b7
mov qword [rsp + 0x20], rax
jmp 0x140026465
cmp r8, r15
jne 0x1400264b0
mov qword [rcx + rax*8], rsi
jmp 0x1400264bc
cmp qword [rcx + rax*8 + 8], rdx
jne 0x1400264bc
mov qword [rcx + rax*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret