joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004c0ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x60], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14004c130
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14004c130
call fcn.140038b8c
mov ebx, eax
jmp 0x14004c239
mov r8, r15
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14004c151
call fcn.140038b8c
jmp 0x14004c228
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14004c147
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14004c18c
mov ebx, 0x8007000e
jmp 0x14004c22a
mov ecx, eax
test eax, eax
je 0x14004c1be
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14004c271
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14004c1be
lea rcx, [rsp + 0x60]
call fcn.140037654
jmp 0x14004c1c8
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x14004c1da
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x14004c182
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14004c147
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.14004bf14
mov ebx, eax
test rsi, rsi
je 0x14004c239
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x14004c250
lea rcx, [rsp + 0x60]
call fcn.1400376ac
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14005f5e0
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140034ce8
int3
Function at 0x14004c790
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [0x1403e59f0], 0
jne 0x14004c90c
cmp qword [0x1403e59e8], 0
jne 0x14004c90c
cmp dword [0x1403e59e4], 0
jne 0x14004c90c
cmp dword [0x1403e59e0], 0
jne 0x14004c90c
lea rdx, [0x1403e59f0]
call fcn.140049920
test eax, eax
js 0x14004c911
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1403e59e8], rax
test rax, rax
jne 0x14004c825
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovns ecx, eax
mov eax, ecx
jmp 0x14004c911
lea rcx, [0x14004cc20]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1403e59e4], eax
test eax, eax
je 0x14004c800
lea rax, [0x1403e59e0]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14004c9c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x14004c894
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
jmp 0x14004c8f4
mov edi, 1
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x14037f368]
mov r8d, edi
xor edx, edx
lea rcx, [0x1402f8498]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x14004c8e1
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov r8d, edi
mov edx, edi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
xor edi, edi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14004c8f4
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
test rbx, rbx
je 0x14004c908
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x50], 0
mov eax, edi
jmp 0x14004c911
mov eax, 0x800704df
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14007345c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400731c0
Function at 0x1400881c8
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rbx, rcx
xor edi, edi
mov dword [rcx + 0x30], edi
lea rax, [0x1402c1338]
mov qword [rcx], rax
lea rax, [0x1402c1358]
mov qword [rcx + 8], rax
lea rax, [0x1402c13c8]
mov qword [rcx + 0x10], rax
lea rax, [0x1402c13e8]
mov qword [rcx + 0x18], rax
lea rax, [0x1402c1410]
mov qword [rcx + 0x20], rax
lea rax, [0x1402c1018]
mov qword [rcx + 0x28], rax
lea rax, [rcx + 0x38]
mov qword [r11 + 0x10], rax
mov qword [rax], rdi
lea esi, [rdi + 1]
mov dword [rcx + 0x40], esi
mov dword [rcx + 0x44], edi
cmp dword [0x1403e12e0], 0xffffffff
jne 0x140088257
lea rcx, [r11 - 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [rsp + 0x58]
sbb eax, eax
and eax, 0xfa0
mov dword [0x1403e12e0], eax
lea rax, [rbx + 0x48]
mov qword [rsp + 0x98], rax
mov qword [rax], rdi
mov qword [rbx + 0x50], rdi
mov word [rbx + 0x58], di
lea rax, [rbx + 0x60]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rax], rdi
mov byte [rbx + 0x68], dil
mov qword [rbx + 0x70], rdi
mov qword [rbx + 0x78], rdi
mov qword [rbx + 0x80], rdi
mov eax, 0xffff
mov word [rbx + 0x88], ax
mov qword [rbx + 0x90], rdi
mov qword [rbx + 0x98], rdi
mov qword [rbx + 0xa0], rdi
lea rax, [rbx + 0xa8]
mov qword [rsp + 0x20], rax
mov qword [rax], rdi
lea rax, [rbx + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rax], rdi
lea rax, [rbx + 0xb8]
mov qword [rsp + 0x30], rax
mov qword [rax], rdi
mov byte [rbx + 0xc0], dil
mov rax, rbx
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x14008e030
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rdx
mov rdi, rcx
mov dword [rcx], 0
cmp dword [0x1403e12e0], 0xffffffff
jne 0x14008e070
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, 1
cmp eax, dword [rsp + 0x50]
sbb eax, eax
and eax, 0xfa0
mov dword [0x1403e12e0], eax
mov qword [rdi + 0x18], rbx
mov qword [rsp + 0x20], rdi
mov rcx, rdi
call fcn.14004d280
test al, al
setne bl
mov byte [rsp + 0x28], bl
and qword [rdi + 0x40], 0
and qword [rdi + 0x38], 0
and qword [rdi + 0x30], 0
and qword [rdi + 0x28], 0
call fcn.14008ea44
and qword [rdi + 0x10], 0
and qword [rdi + 8], 0
mov eax, dword [0x1402c1228]
mov dword [rdi + 0x20], eax
test bl, bl
je 0x14008e0c5
mov dword [rdi], 0
mov byte [rsp + 0x28], 0
mov rax, rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x14008e7f4
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1403e2b20]
test rax, rax
jne 0x14008e81a
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x1403e2b20], rax
add rsp, 0x58
ret
Function at 0x14008ea44
Capabilities:
Check os version

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
cmp qword [0x1403e2b10], 0
jne 0x14008eab4
call fcn.14008e7f4
mov qword [0x1403e2b10], rax
xor ecx, ecx
jmp 0x14008ea7c
inc ecx
shr rax, 1
cmp rax, 1
jne 0x14008ea77
mov dword [0x1403e2b18], ecx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], DllRegisterServer
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x14008eaad
cmp dword [rsp + 0x24], 5
mov byte [0x1403e2b1c], 1
jae 0x14008eab4
mov byte [0x1403e2b1c], 0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14005f5e0
add rsp, 0xd8
ret

Function at 0x14008f340
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x50
and dword [rcx + 8], 0
lea rax, [0x1402c1870]
mov qword [rcx], rax
mov rbx, rcx
mov dword [rcx + 0x10], 0
mov esi, 1
cmp dword [0x1403e12e0], 0xffffffff
jne 0x14008f38c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [rsp + 0x40]
sbb eax, eax
and eax, 0xfa0
mov dword [0x1403e12e0], eax
and qword [rbx + 0x18], 0
and dword [rbx + 0x20], 0
and dword [rbx + 0x24], 0
and dword [rbx + 0x28], 0
and qword [rbx + 0x30], 0
and qword [rbx + 0x38], 0
and qword [rbx + 0x40], 0
and qword [rbx + 0x48], 0
and qword [rbx + 0x50], 0
lock add dword [0x1403e2abc], esi
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rsi
ret

Function at 0x1400915dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x860
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rdi, rcx
xor ebx, ebx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 1]
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftC_Compiler
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14009162d
xor eax, eax
jmp 0x14009169d
mov dword [rsp + 0x30], 0x800
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14009168f
cmp dword [rsp + 0x34], 1
jne 0x14009168f
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400916be
mov qword [rsp + 0x40], rbx
mov rbx, rax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.14005f5e0
mov rbx, qword [rsp + 0x878]
add rsp, 0x860
pop rdi
ret
mov ecx, 0x8007000e
call fcn.140034ce8
int3
Function at 0x14016cea0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1403ba4b8], eax
add rsp, 0x28
ret

Function at 0x140211088
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rsp + 0x48], rax
and qword [rsp + 0x20], 0
mov rdi, rcx
and dword [rcx], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x20]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ebx, eax
test eax, eax
je 0x140211115
lea r8, [rsp + 0x28]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140211115
and dword [rsp + 0x40], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov eax, 1
mov dword [rsp + 0x30], eax
mov r8, rdi
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
call qword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
mov ebx, eax
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140211125
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14005f5e0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140211570
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp dword [rcx], 0
mov rbx, rdx
je 0x140211602
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140211602
lea r8, [rsp + 0x30]
mov edx, 0x20
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140211602
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
and qword [rsp + 0x28], 0
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, qword [rsp + 0x30]
xor edx, edx
and dword [rsp + 0x4c], 0
and qword [rsp + 0x20], 0
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x40], 1
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005f5e0
add rsp, 0x60
pop rbx
ret
Function at 0x14021188c
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor esi, esi
mov edi, ecx
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
lea edx, [rsi + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ebx, eax
test eax, eax
je 0x140211930
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140211930
mov rcx, qword [rsp + 0x38]
lea r9d, [rsi + 0x10]
mov qword [rsp + 0x44], rcx
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
neg edi
mov qword [rsp + 0x28], rsi
sbb eax, eax
mov dword [rsp + 0x40], 1
and eax, 2
mov qword [rsp + 0x20], rsi
xor edx, edx
mov dword [rsp + 0x4c], eax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
cmovne ebx, esi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140211940
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005f5e0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x140212514
Capabilities:
Get hostname

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x28
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x14021254d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovns ecx, eax
mov eax, ecx
jmp 0x14021254f
xor eax, eax
add rsp, 0x28
ret

Function at 0x140212554
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rdx
mov rdi, rcx
mov rcx, rbp
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ebx, ebx
mov esi, eax
test eax, eax
jne 0x14021258e
mov rcx, rdi
call fcn.140038c18
jmp 0x1402125f1
test esi, esi
js 0x140212608
mov rdx, qword [rdi]
mov ecx, 1
mov eax, dword [rdx - 0xc]
sub ecx, dword [rdx - 8]
sub eax, esi
or ecx, eax
jge 0x1402125b3
mov edx, esi
mov rcx, rdi
call fcn.140034b68
mov rdx, qword [rdi]
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1402125cb
mov eax, ebx
jmp 0x1402125d8
movsxd rdx, dword [rcx - 0xc]
call fcn.14006c1e4
test eax, eax
js 0x140212608
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x140212608
mov dword [rcx - 0x10], eax
mov rcx, qword [rdi]
mov edx, eax
mov word [rcx + rdx*2], bx
mov ebx, 1
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.140034ce8
int3
Function at 0x140214094
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
and qword [rbp - 8], 0
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
lea r9, [0x1402f12c0]
mov r15d, 1
mov r8d, r15d
xor edx, edx
lea rcx, [0x1402f1290]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
jns 0x1402140eb
cmp eax, 0x80040154
cmove ebx, r15d
jmp 0x1402141aa
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x38]
mov rax, qword [rax + 0x38]
call qword [0x1402b6c58]
mov ebx, eax
test eax, eax
js 0x1402141aa
test byte [rbp + 0x38], 7
je 0x140214171
lea r8, [rbp - 0x10]
mov edx, r15d
mov rcx, qword [rbp - 8]
call fcn.140213fec
mov ebx, eax
test eax, eax
js 0x1402141aa
lea r8, [rbp + 0x40]
mov edx, 2
mov rcx, qword [rbp - 8]
call fcn.140213fec
mov ebx, eax
test eax, eax
js 0x1402141aa
lea r8, [rbp + 0x48]
mov edx, 4
mov rcx, qword [rbp - 8]
call fcn.140213fec
mov ebx, eax
test eax, eax
js 0x1402141aa
mov ebx, dword [rbp + 0x40]
mov esi, dword [rbp + 0x48]
mov r14d, dword [rbp - 0x10]
test r14d, r14d
jne 0x140214176
test ebx, ebx
jne 0x140214176
test esi, esi
jne 0x140214176
mov ebx, r15d
jmp 0x1402141aa
mov r15, qword [rbp - 8]
and qword [rbp - 8], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140214194
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1402b6c58]
mov qword [rdi], r15
mov eax, dword [rbp + 0x38]
mov dword [rdi + 8], eax
mov byte [rdi + 0xc], r14b
mov byte [rdi + 0xd], bl
mov byte [rdi + 0xe], sil
xor ebx, ebx
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1402141c0
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [0x1402b6c58]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140216064
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x7f70]
mov eax, 0x8070
call fcn.140245900
sub rsp, rax
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rbp + 0x7f68], rax
lea rcx, [0x1403e4838]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
and qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftVisualStudio16.0DebuggerSymbolStoreIsServerCache
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1402161be
xor ebx, ebx
mov dword [rsp + 0x4c], 0x3fff
xor edx, edx
mov r8d, 0x7ffe
lea rcx, [rsp + 0x60]
call fcn.1400612f0
and dword [rsp + 0x44], 0
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test eax, eax
jne 0x1402161a8
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call fcn.14005d7b8
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov rcx, qword [0x1403e4830]
call fcn.1402161f0
test al, al
jne 0x140216182
cmp dword [rsp + 0x44], edi
setne r8b
lea rdx, [rsp + 0x60]
mov rcx, qword [0x1403e4830]
call fcn.1402166e8
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1402161a8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1402b6c58]
inc ebx
test edi, edi
je 0x1402160da
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [0x1403e4838]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbp + 0x7f68]
xor rcx, rsp
call fcn.14005f5e0
lea r11, [rsp + 0x8070]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1402165c4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
lea rcx, [0x1403e4838]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [0x1403e4830]
cmp qword [rax + 8], 0
jbe 0x1402166c8
mov rcx, rbx
call fcn.140216064
and qword [rsp + 0x80], 0
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftVisualStudio16.0DebuggerSymbolStoreIsServerCache
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1402166c8
mov rdi, qword [0x1403e4830]
mov rcx, rdi
call fcn.1400a6860
mov rsi, rax
test rax, rax
je 0x1402166b9
mov rbx, rsi
mov rdx, rsi
mov rcx, rdi
call fcn.1400a4a9c
mov rsi, rax
xor eax, eax
cmp byte [rbx + 8], al
setne al
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x1402166b9
mov rdi, qword [0x1403e4830]
jmp 0x140216662
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [0x1403e4838]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140217b2c
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub rsp, 0x248
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rsp + 0x230], rax
call fcn.140212c30
test al, al
jne 0x140217b9b
mov edx, 0x105
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140217b9b
lea r8, str.WebServices.dll
mov edx, 0x105
lea rcx, [rsp + 0x20]
call fcn.140070f60
test eax, eax
jne 0x140217b9b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140217b9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140217b9b
xor al, al
jmp 0x140217b9d
mov al, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14005f5e0
add rsp, 0x248
ret

Function at 0x14021a654
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
mov dword [0x1403bb450], eax
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x140002040
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140002070
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140002098
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000209a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400020f3
test ecx, ecx
jle 0x1400020d3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400020f3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400020f3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
sbb dword [rax + 0x3c2513c], esp
invalid