joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100004950
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor r13d, r13d
mov rdi, rdx
lea rsi, [0x1000da348]
mov ebx, r13d
cmp qword [0x1000da340], r13
je 0x1000049ae
or r9d, 0xffffffff
mov r8, rsi
mov rcx, rdi
or edx, r9d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
jne 0x1000049ae
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1000da310]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1000da2f0]
call fcn.1000010f8
mov rcx, qword [0x1000da340]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [0x1000da340], r13
mov edx, 0x104
mov rcx, rsi
sub rdi, rsi
lea rax, [rdx + 0x7ffffefa]
cmp rax, r13
je 0x100004a09
movzx eax, word [rcx + rdi]
cmp ax, r13w
je 0x100004a09
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000049e6
cmp rdx, r13
je 0x100020e7f
cmp ebx, r13d
mov word [rcx], r13w
jl 0x100004b22
mov r8d, 3
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x100020f05
lea rdx, [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, r13d
je 0x100020efb
mov r12d, dword [rsp + 0x88]
xor ecx, ecx
add r12d, 2
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
cmp rax, r13
je 0x100020efb
lea r9, [rsp + 0x70]
mov r8d, r12d
mov rdx, rax
mov rcx, rbp
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r13d
je 0x100020ee1
cmp dword [rsp + 0x70], 2
jb 0x100020ee1
or dword [rsp + 0x80], 0xffffffff
lea eax, [r12 - 2]
lea r8, [rsp + 0x80]
mov byte [rax + rdi], r13b
lea eax, [r12 - 1]
mov edx, r12d
mov rcx, rdi
mov byte [rax + rdi], r13b
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cmp eax, r13d
je 0x100020e8d
mov qword [0x1000da340], rdi
jmp 0x100004aff
cmp ebx, r13d
jl 0x100004b17
lea rcx, [0x1000da2f0]
mov rdx, rdi
call fcn.100004b3c
mov ebx, eax
jmp 0x100004b17
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100004b22
lea rcx, [0x1000da310]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
jmp 0x10000499b
sub rcx, 2
mov ebx, 0x8007007a
jmp 0x100004a12
lea rdx, [r12 + r12]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
cmp rax, r13
je 0x100020ec7
mov r8d, r12d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_SHAnsiToUnicode]
neg eax
sbb ebx, ebx
not ebx
and ebx, 0x80004005
jl 0x100020ecc
mov qword [0x1000da340], rsi
jmp 0x100020ecc
mov ebx, 0x8007000e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [0x1000da340]
jmp 0x100004aff
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r13d
cmovle ebx, eax
jmp 0x100004b17
mov ebx, 0x8007000e
jmp 0x100004b17
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r13d
cmovle ebx, eax
jmp 0x100004b22
Function at 0x100005f90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rbx, rcx
lea rax, [0x1000a9ab0]
mov qword [rcx], rax
mov qword [rcx + 0x88], rsi
mov qword [rcx + 0x90], rsi
mov qword [rcx + 0x98], rsi
mov dword [rcx + 0xa0], esi
mov qword [rcx + 0xe8], rsi
mov qword [rcx + 0xf0], rsi
mov qword [rcx + 0xf8], rsi
mov dword [rcx + 0x100], esi
mov qword [rcx + 0x108], rsi
mov qword [rcx + 0x110], rsi
mov qword [rcx + 0x118], rsi
mov dword [rcx + 0x120], esi
lea ecx, [rsi + 1]
mov eax, 0x3f800000
mov byte [rbx + 0x3c], 0xff
mov qword [rbx + 0xd8], rdx
mov qword [rbx + 0xe0], r8
mov dword [rbx + 8], ecx
mov dword [rbx + 0x48], ecx
mov dword [rbx + 0x14], eax
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x44], 0x1006
call fcn.100001210
cmp al, sil
je 0x100021edd
mov eax, dword [0x1000da584]
mov qword [rsp + 0x20], rbx
cmp eax, 0xffffffff
je 0x100021ecd
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
mov eax, dword [0x1000da584]
mov edi, dword [rdx + 0xa4]
mov dword [rsp + 0x28], edi
lea ecx, [rdi + 1]
mov dword [rdx + 0xa4], ecx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
cmp eax, 0xffffffff
je 0x100021ed5
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rcx, [rax + 0xa8]
lea rdx, [rsp + 0x20]
call fcn.1000060d0
cmp eax, esi
jl 0x100021edd
mov rsi, qword [rsp + 0x48]
mov dword [rbx + 0x54], edi
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, rsi
jmp 0x10000605f
mov rax, rsi
jmp 0x10000608e
mov edi, esi
jmp 0x1000060a7

Function at 0x100006290
Capabilities:
Check if file exists
Get common file path
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x258
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov esi, edx
mov rbx, r8
lea rdx, [rsp + 0x30]
mov r8d, 0x103
mov rbp, r9
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x102
jbe 0x10002006c
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
mov edi, eax
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1000031d0
add rsp, 0x258
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
je 0x1000062d6
lea rdx, [rsp + 0x30]
mov ecx, 0x104
sub rdx, rbx
lea rax, [rcx + 0x7ffffefa]
cmp rax, rdi
je 0x1000200ae
movzx eax, word [rdx + rbx]
cmp ax, di
je 0x1000200ae
mov word [rbx], ax
add rbx, 2
sub rcx, 1
jne 0x10002008c
cmp rcx, rdi
jne 0x1000200b7
sub rbx, 2
mov word [rbx], di
jmp 0x1000062f2
Function at 0x100006514
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x100021b4c
cmp dword [rsp + 0x24], 6
jb 0x100021b4c
mov eax, 1
jmp 0x10000656f
test eax, eax
setne al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1000031d0
add rsp, 0x158
ret
xor eax, eax
jmp 0x10000656f

Function at 0x1000065a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [r11 - 0x10]
mov rsi, r8
mov r9d, 1
xor r8d, r8d
xor bl, bl
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdi, qword [rsp + 0x70]
test eax, eax
je 0x100021bc7
and dword [rdi], 0
mov rsi, qword [rsp + 0x58]
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], 0x10
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x1000065d9
jmp 0x1000065dc

Function at 0x10000a740
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
lea rsi, [rcx + 0x30]
xor ebx, ebx
mov rdi, rcx
cmp qword [rsi], rbx
je 0x100011ecd
add rdi, 0x38
cmp qword [rdi], rbx
je 0x100011ef4
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea r9d, [rbx + 1]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
cmp eax, ebx
jne 0x10000a761
jmp 0x10002adc0
mov rcx, qword [rsi]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, ebx
jne 0x10000a76e
jmp 0x10002adee
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x80090016
jne 0x10002adee
lea r9d, [rbx + 1]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x20], 0xf0000008
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
cmp eax, ebx
jne 0x10000a761
call sub.KERNEL32.dll_GetLastError
cmp eax, ebx
je 0x10002ae0c
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
mov ebx, ecx
jmp 0x10000a76e
mov ebx, 0x80004005
jmp 0x10000a76e
Function at 0x10000a998
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x1000200e6
mov r8, rbx
mov edx, 0x104
mov rcx, rdi
call fcn.100001010
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1000031d0
mov rbx, qword [rsp + 0x470]
add rsp, 0x450
pop rdi
ret
lea r9, [0x1000aed74]
lea r8, [rsp + 0x230]
lea rcx, str.GADGETS_USER
mov edx, 0x801c
call fcn.100006290
test eax, eax
js 0x10000a9db
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8, rbx
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x100020138
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100020142
mov eax, 0x80004005
jmp 0x10000a9db
lea rbx, [rsp + 0x20]
jmp 0x10000a9cb
Function at 0x10000c7e0
Capabilities:
Hash data via wincrypt
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
call fcn.10000a740
mov ebx, eax
test eax, eax
js 0x10000c936
mov r14, qword [rsi + 0x18]
lea r9, [0x100006d30]
lea rcx, [rsi + 0x10]
lea r8, [r14 - 1]
xor edi, edi
xor edx, edx
mov byte [rsp + 0x20], dil
call fcn.10000701c
test r14, r14
je 0x10000c936
mov rax, qword [rsi + 0x10]
xor r12d, r12d
mov rbp, qword [rax + rdi*8]
and dword [rsp + 0x70], r12d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [r12 + 8]
mov rcx, rax
mov r8d, 0x4000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x10002ad86
mov rcx, rsi
call fcn.10000a740
mov ebx, eax
test eax, eax
js 0x10000c904
and qword [rsp + 0x30], r12
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbp
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x10002ad90
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov r8d, 0x4000
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10002ad9a
mov r8d, dword [rsp + 0x70]
test r8d, r8d
setne al
test al, al
je 0x10000c904
mov rcx, qword [rsi + 0x38]
xor r9d, r9d
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x10000c8b7
jmp 0x10002ad9a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r12, r12
je 0x10000c926
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc rdi
test ebx, ebx
js 0x10000c936
cmp rdi, r14
jb 0x10000c838
mov rbp, qword [rsi + 0x18]
test rbp, rbp
je 0x10000c96b
mov r12, qword [rsi + 0x10]
xor edi, edi
test rbp, rbp
je 0x10000c966
mov rcx, qword [r12 + rdi*8]
test rcx, rcx
je 0x10000c95e
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [r12 + rdi*8], 0
inc rdi
cmp rdi, rbp
jb 0x10000c94a
and qword [rsi + 0x18], 0
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ebx, 0x8007000e
jmp 0x10000c926
mov ebx, 0x80070006
jmp 0x10000c904
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x10002adb6
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10000c904
mov ebx, 0x80004005
jmp 0x10000c904
Function at 0x10000ed30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
xor esi, esi
movaps xmmword [rsp + 0x20], xmm6
mov rdi, rcx
cmp qword [rcx + 8], rsi
jbe 0x10000ee1f
xor ebp, ebp
mov rax, qword [rdi]
mov rbx, qword [rax + rbp]
inc dword [rbx + 0x44]
cmp qword [rbx + 8], 0
jne 0x10000ed7d
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test byte [rbx + 0x20], 2
jne 0x1000238e0
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x50]
xorps xmm6, xmm6
test rax, rax
jle 0x10000edc3
mov rcx, qword [rsp + 0x58]
pxor xmm1, xmm1
pxor xmm0, xmm0
sub rcx, qword [rbx + 8]
cvtsi2sd xmm0, rax
cvtsi2sd xmm1, rcx
divsd xmm1, xmm0
cvtsd2ss xmm6, xmm1
divss xmm6, dword [rbx + 0x10]
mov rax, qword [rbx]
mov rcx, rbx
movaps xmm1, xmm6
call qword [rax + 8]
comiss xmm6, dword [0x1000ac158]
jae 0x10000ede9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
test al, al
je 0x10000edf9
mov r8b, 1
mov edx, 1
mov rcx, rbx
call fcn.10000ee40
add dword [rbx + 0x44], 0xffffffff
jne 0x10000ee0d
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + 0x10]
inc esi
add rbp, 8
mov eax, esi
cmp rax, qword [rdi + 8]
jb 0x10000ed58
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x1000238ed
xor eax, eax
jmp 0x1000238f0
mov eax, dword [rcx + 0x44]
bt eax, 0x1e
jae 0x10000ed7d
test rcx, rcx
je 0x10002390c
mov edx, 0x40000000
mov r8d, edx
call fcn.10000123c
mov byte [rbx + 0x40], 1
jmp 0x10000ed7d
Function at 0x10000ee40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
cmp byte [rcx + 0x41], 0
mov dil, r8b
mov esi, edx
mov rbx, rcx
jne 0x10000ef06
mov byte [rcx + 0x41], 1
mov qword [rsp + 0x60], rcx
call fcn.100001210
test al, al
je 0x10000ee97
mov ecx, dword [0x1000da584]
cmp ecx, 0xffffffff
je 0x10002393e
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rcx, [rax + 0xc8]
mov rdx, rbx
call fcn.10000ef1c
cmp byte [rbx + 0x40], 0
jne 0x100023945
test byte [rbx + 0x20], 4
jne 0x10000eedd
mov rax, qword [rbx + 0x18]
and dword [rsp + 0x30], 0
lea rcx, [rsp + 0x20]
mov edx, 1
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x38
mov dword [rsp + 0x24], 0x8010
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x40], rbx
call fcn.100001aa0
test dil, dil
je 0x10000eeef
mov rcx, qword [rbx + 0x38]
test rcx, rcx
jne 0x100023965
mov rax, qword [rbx + 0x30]
test rax, rax
jne 0x100023971
add dword [rbx + 0x44], 0xffffffff
je 0x100023986
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
xor eax, eax
jmp 0x10000ee88
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x10000eea1
xor r8d, r8d
mov edx, 0x40000000
call fcn.10000123c
nop
jmp 0x10000eea1
mov rax, qword [rcx]
call qword [rax + 0x20]
nop
jmp 0x10000eeef
mov r8, qword [rbx + 0x28]
mov rdx, qword [rbx + 0x18]
lea rcx, [rsp + 0x60]
call rax
nop
jmp 0x10000eefc
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + 0x10]
nop
jmp 0x10000ef06

Function at 0x10000ef1c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbp, rdx
mov rbx, rcx
cmp qword [rcx + 8], rdi
jbe 0x10000ef67
xor esi, esi
mov rax, qword [rbx]
cmp qword [rsi + rax], rbp
jne 0x1000238ce
mov edx, edi
mov r8d, 1
mov rcx, rbx
call fcn.1000032d0
jmp 0x10000ef5f
mov eax, edi
cmp rax, qword [rbx + 8]
jb 0x10000ef40
cmp qword [rbx + 8], 0
jne 0x10000efa9
call fcn.100001210
test al, al
je 0x10000efa9
mov ecx, dword [0x1000da584]
cmp ecx, 0xffffffff
je 0x1000238d9
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0x98]
cmp rcx, 0xffffffffffffffff
je 0x10000efa9
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov byte [rbx + 0xa0], 0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
inc edi
add rsi, 8
jmp 0x10000ef5f
xor ebx, ebx
jmp 0x10000ef8f

Function at 0x10000f2ac
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
lea rax, [0x1000adcc0]
mov rbx, rcx
mov qword [rcx], rax
call fcn.100001210
test al, al
je 0x10000f2ec
mov ecx, dword [0x1000da584]
cmp ecx, 0xffffffff
je 0x100023915
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rcx, [rax + 0xc8]
mov rdx, rbx
call fcn.10000ef1c
mov rcx, qword [rbx + 0x38]
test rcx, rcx
jne 0x10002391c
add rsp, 0x20
pop rbx
ret
xor eax, eax
jmp 0x10000f2dd
add dword [rcx + 0x44], 0xffffffff
jne 0x10000f2f9
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x10]
nop
jmp 0x10000f2f9
Function at 0x10000f500
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov r8, rcx
lea r9, [0x1000aedbc]
lea rcx, [0x1000aee3c]
mov edx, 0x26
call fcn.100006290
mov rcx, rbx
mov edi, eax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000200bf
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1000200dc
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x10000f53b
mov edi, 0x80004005
jmp 0x10000f53b

Function at 0x100012de0
Capabilities:
Get thread local storage value

Disassembly:
mov r12, rbx
mov edi, 1
mov rcx, qword [rsi + 0xc8]
mov rcx, qword [r12 + rcx]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp rax, r13
je 0x100012e46
add ebp, edi
add r12, 8
mov eax, ebp
cmp rax, qword [rsi + 0xd0]
jae 0x100012e43
jmp 0x100012d9f
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r13, rcx
mov ecx, dword [0x1000da584]
or edi, 0xffffffff
cmp ecx, edi
je 0x100021e09
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
cmp rax, rbx
je 0x100021e09
mov ecx, dword [0x1000da584]
cmp ecx, edi
je 0x100021e01
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ebp, ebx
cmp qword [rsi + 0xd0], rbx
ja 0x100012d97
mov dil, bl
cmp dil, bl
setne bl
mov eax, ebx
jmp 0x100012e50
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rsi, rbx
jmp 0x100012e34
xor eax, eax
jmp 0x100012e50

Function at 0x100013970
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
and qword [rsp + 0x20], 0
mov rdi, r9
mov rax, r8
test rdx, rdx
je 0x100029cac
test rax, rax
je 0x100029cac
test r9, r9
je 0x100029cac
mov r8, rdx
lea rcx, [rsp + 0x30]
mov rdx, rax
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x100029cac
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100013a2a
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.100007e60
mov rcx, qword [rsp + 0x20]
mov ebx, eax
test eax, eax
js 0x1000139fe
mov qword [rdi], rcx
xor ecx, ecx
test rcx, rcx
jne 0x100029cb6
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1000031d0
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret
mov ebx, 0x80070002
jmp 0x100013a07
mov ebx, 0x80070057
jmp 0x100013a07
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
jmp 0x100013a07
Function at 0x100014bc4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rbp, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
mov r12, rdx
lea rdi, [rbp + 1]
mov rbx, rcx
cmp rdi, r8
jbe 0x100014c28
cmp qword [rcx], 0
jne 0x100023845
movsxd rax, dword [rcx + 0x18]
cmp rax, rdi
cmova rdi, rax
mov eax, 8
mul rdi
test rdx, rdx
jne 0x100014c3c
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x100014c3c
jmp 0x100014c24
mov qword [rbx + 0x10], rdi
mov rax, qword [rbx]
xor ecx, ecx
mov qword [rax + rbp*8], rcx
mov rax, qword [rbx]
mov qword [rax + rbp*8], r12
inc qword [rbx + 8]
call fcn.100001210
test al, al
je 0x100014ca4
mov ecx, dword [0x1000da584]
cmp ecx, 0xffffffff
je 0x1000238c7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0x98]
cmp rcx, 0xffffffffffffffff
je 0x100014ca4
cmp byte [rbx + 0xa0], 0
jne 0x100014ca4
and dword [rsp + 0x50], 0
xor eax, eax
lea r9, [0x10000ec9c]
and dword [rsp + 0x28], eax
and qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
lea r8d, [rax + 0x14]
mov dword [rsp + 0x54], eax
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov byte [rbx + 0xa0], 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
movsxd rcx, dword [rcx + 0x18]
test rcx, rcx
jne 0x100023870
mov edx, 0x400
mov rcx, rbp
shr rcx, 3
cmp rcx, rdx
mov rax, rcx
cmova rcx, rdx
mov edx, 4
cmp rax, rdx
cmovb rcx, rdx
lea rax, [r8 + rcx]
cmp rdi, rax
cmovb rdi, rax
mov eax, 8
mul rdi
test rdx, rdx
jne 0x100014c3c
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x100014c3c
mov r8, qword [rbx + 8]
mov rdx, qword [rbx]
mov rcx, rax
shl r8, 3
call sub.msvcrt.dll_memmove
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rsi
jmp 0x100014c24
xor ebx, ebx
jmp 0x100014c5d
Function at 0x100014e80
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x4a0
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rsi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x34]
xor edi, edi
xor edx, edx
mov r8d, 0x24c
and dword [rsp + 0x30], edi
call sub.msvcrt.dll_memset
and dword [rsp + 0x20], edi
lea r9, [0x1000aed14]
lea rcx, [rsp + 0x280]
mov r8, rbx
mov edx, 0x104
call fcn.100019880
test eax, eax
js 0x100014f02
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x100014f29
mov eax, edi
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1000031d0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test byte [rsp + 0x30], 0x10
je 0x100014f40
cmp qword [rsi + 0x198], 0
ja 0x1000253f4
inc edi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100014f29
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
jmp 0x100014f02
lea rdx, [rsp + 0x5c]
mov rcx, rsi
call fcn.10005221c
test al, al
je 0x100014f3e
jmp 0x100014f40
Function at 0x100017508
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
xor ebx, ebx
mov rbp, r9
add eax, eax
mov r12, r8
mov rsi, rcx
mov edi, ebx
mov qword [r11 + 0x20], rbx
mov word [r9], bx
mov dword [rsp + 0x70], eax
cmp rdx, rbx
je 0x100021c20
lea rax, [r11 + 0x20]
lea r9d, [rbx + 1]
xor r8d, r8d
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x100021c19
movzx edi, ax
or edi, 0x80070000
cmp eax, ebx
cmovle edi, eax
jmp 0x100017570
mov rcx, qword [rsp + 0x68]
cmp rcx, rbx
jne 0x100021c79
mov rbp, qword [rsp + 0x60]
cmp edi, ebx
mov rbx, qword [rsp + 0x50]
setge al
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x68]
jmp 0x100021c25
mov qword [rsp + 0x68], rcx
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r12
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x100017560
cmp dword [rsp + 0x58], 1
je 0x100021c5e
mov edi, 0x80004005
jmp 0x100017570
cmp dword [rsp + 0x70], ebx
jbe 0x100017570
mov eax, dword [rsp + 0x70]
shr rax, 1
mov word [rbp + rax*2 - 2], bx
jmp 0x100017570
cmp rcx, rsi
je 0x10001757e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x10001757e