joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400475b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov rbx, rcx
mov rsi, rdx
mov rcx, rsi
call fcn.1400061e0
xor al, 1
je 0x1400475f6
mov rcx, rsi
call fcn.140058c80
mov edi, eax
mov edx, edi
mov rcx, rbx
call fcn.140006b80
mov rcx, rsi
call fcn.1400061e0
xor al, 1
jne 0x1400475d6
mov rbx, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret

Function at 0x140047ff0
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x140
mov qword [rbp - 0x118], rbx
mov qword [rbp - 0x110], rsi
mov qword [rbp - 0x108], rdi
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rsi, rcx
call fcn.140048100
mov qword [rbp - 0x100], rax
cmp rax, 0xffffffffffffffff
jne 0x14004802f
ud2
lea rax, str.Aborting_from
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x80], 0xe
mov rcx, qword [rbp + 0x18]
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
lea rbx, [0x1400a6440]
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x60], 1
mov rdx, rsi
lea rdi, [rbp - 0xc0]
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], 0x40
lea rcx, [rbp - 0x20]
call fcn.140005e60
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rax, [0x1400b5340]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 2
mov rbx, qword [rbp + 0x20]
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rsi, [rbp - 0x80]
mov rdx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
xor ecx, ecx
mov qword [rbp - 0x120], rcx
mov r9, rcx
mov r8d, dword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp - 0x100]
call sub.KERNEL32.dll_WriteFile
add rsi, 0x10
lea rax, [rbp - 0x20]
cmp rsi, rax
jb 0x1400480b9
call sub.MSVCR120.dll_abort
int3
Function at 0x1400497a0
Capabilities:
Create pipe

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x110
mov qword [rbp - 0xf0], rbx
mov qword [rbp - 0xe8], rsi
mov qword [rbp - 0xe0], rdi
mov qword [rbp - 0xd8], r12
mov qword [rbp - 0xd0], r13
mov qword [rbp - 0xc8], r14
mov qword [rbp - 0xc0], r15
mov qword [rbp + 0x10], rcx
xor eax, eax
mov qword [rbp - 0xb0], rax
mov qword [rbp - 0xa8], rax
xor r9d, r9d
mov r8, rax
lea rdx, [rbp - 0xa8]
lea rcx, [rbp - 0xb0]
call sub.KERNEL32.dll_CreatePipe
test eax, eax
jne 0x14004988c
call fcn.140049bc0
mov rsi, rax
lea rax, str.Error_creating_pipe__
mov qword [rbp - 0x98], rax
mov qword [rbp - 0xa0], 0x15
lea r8, [rbp - 0xa0]
mov qword [rbp - 0xb8], r8
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1400287b0
mov qword [rbp - 0x90], rax
mov qword [rbp - 0x88], rdx
lea rdx, [rbp - 0x90]
mov r8, qword [rbp - 0xb8]
mov ecx, 0x29
call fcn.14005a500
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
lea r8, [rbp - 0x80]
xor edx, edx
mov rcx, rsi
call fcn.140049c10
mov rcx, rax
call fcn.140019e30
xor eax, eax
mov rdi, qword [rbp + 0x10]
mov ecx, 6
rep stosq qword [rdi], rax
mov rsi, qword [rbp + 0x10]
mov r8, qword [rbp - 0xb0]
lea rax, [0x1400b58f0]
mov qword [rbp - 0x48], rax
mov edx, 1
mov qword [rbp - 0x50], rdx
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call fcn.14002a380
add rsp, 0x20
mov rbx, qword [rbp + 0x10]
lea rsi, [rbx + 0x18]
mov r8, qword [rbp - 0xa8]
lea rax, [0x1400b5900]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 1
lea rdx, [rbp - 0x40]
mov rcx, rsi
sub rsp, 0x20
call fcn.14002a380
add rsp, 0x20
mov rax, rbx
mov rbx, qword [rbp - 0xf0]
mov rsi, qword [rbp - 0xe8]
mov rdi, qword [rbp - 0xe0]
mov r12, qword [rbp - 0xd8]
mov r13, qword [rbp - 0xd0]
mov r14, qword [rbp - 0xc8]
mov r15, qword [rbp - 0xc0]
mov rsp, rbp
pop rbp
ret
Function at 0x14004daa0
Capabilities:
Delete registry key

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x2e0
mov qword [rbp - 0x2b8], rbx
mov qword [rbp - 0x2b0], rsi
mov qword [rbp - 0x2a8], rdi
mov qword [rbp - 0x2a0], r12
mov qword [rbp - 0x298], r13
mov qword [rbp - 0x290], r14
mov qword [rbp - 0x288], r15
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov ecx, dword [rbp + 0x10]
call fcn.14005df10
test al, al
je 0x14004dbbc
call fcn.14005df40
mov rax, qword [rbp + 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x150], rax
mov qword [rbp - 0x148], rdx
lea rdx, [rbp - 0x150]
lea rcx, [rbp - 0x260]
call fcn.1400290b0
xor r9d, r9d
mov r8d, dword [rbp + 0x10]
mov qword [rbp - 0x280], r8
mov qword [rbp - 0x278], r9
lea rcx, [rbp - 0x260]
sub rsp, 0x20
call fcn.140013810
add rsp, 0x20
mov rdx, rax
mov r9, qword [rbp - 0x278]
mov r8, qword [rbp - 0x280]
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
mov eax, dword [0x1400be540]
mov rbx, qword gs:[0x58]
mov rsi, qword [rbx + rax*8]
mov edi, 0x198
call qword [rsi + rdi]
add rsp, 0x20
mov dword [rbp - 0x270], eax
sub rsp, 8
call fcn.14004db9f
add rsp, 8
jmp 0x14004dbb4
mov esi, dword [rbp - 0x270]
jmp 0x14004dc05
mov rax, qword [rbp + 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x140]
call fcn.1400290b0
lea rcx, [rbp - 0x140]
call fcn.140013810
mov rdx, rax
mov rcx, qword [rbp + 0x20]
call sub.ADVAPI32.dll_RegDeleteKeyW
mov esi, eax
lea rcx, [rbp - 0x140]
call fcn.140013830
mov r9d, esi
mov rax, rbp
mov qword [rbp - 0x20], rax
lea rdx, [0x14004dc80]
mov qword [rbp - 0x18], rdx
lea r8, [rbp - 0x20]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], 0x16
lea rdx, [rbp - 0x10]
mov ecx, 0x163
sub rsp, 0x20
call fcn.14004d370
add rsp, 0x20
mov rbx, qword [rbp - 0x2b8]
mov rsi, qword [rbp - 0x2b0]
mov rdi, qword [rbp - 0x2a8]
mov r12, qword [rbp - 0x2a0]
mov r13, qword [rbp - 0x298]
mov r14, qword [rbp - 0x290]
mov r15, qword [rbp - 0x288]
mov rsp, rbp
pop rbp
ret
Function at 0x14004dd30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1c0
mov qword [rbp - 0x198], rbx
mov qword [rbp - 0x190], rsi
mov qword [rbp - 0x188], rdi
mov qword [rbp - 0x180], r12
mov qword [rbp - 0x178], r13
mov qword [rbp - 0x170], r14
mov qword [rbp - 0x168], r15
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp - 0x150], 0xffffffff
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x140]
call fcn.1400290b0
push 0
push 0
lea r9, [rbp - 0x150]
xor r8d, r8d
mov qword [rbp - 0x160], r8
mov qword [rbp - 0x158], r9
lea rcx, [rbp - 0x140]
sub rsp, 0x20
call fcn.140013810
add rsp, 0x20
mov rdx, rax
mov r9, qword [rbp - 0x158]
mov r8, qword [rbp - 0x160]
mov rcx, qword [rbp + 0x18]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov r9d, eax
mov rax, rbp
mov qword [rbp - 0x20], rax
lea rbx, [0x14004de90]
mov qword [rbp - 0x18], rbx
lea r8, [rbp - 0x20]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], 0x16
lea rdx, [rbp - 0x10]
mov ecx, 0x1ef
call fcn.14004d370
sub rsp, 8
call fcn.14004de38
add rsp, 8
jmp 0x14004de4d
mov eax, dword [rbp - 0x150]
mov rbx, qword [rbp - 0x198]
mov rsi, qword [rbp - 0x190]
mov rdi, qword [rbp - 0x188]
mov r12, qword [rbp - 0x180]
mov r13, qword [rbp - 0x178]
mov r14, qword [rbp - 0x170]
mov r15, qword [rbp - 0x168]
mov rsp, rbp
pop rbp
ret

Function at 0x14004df10
Capabilities:
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1b0
mov qword [rbp - 0x188], rbx
mov qword [rbp - 0x180], rsi
mov qword [rbp - 0x178], rdi
mov qword [rbp - 0x170], r12
mov qword [rbp - 0x168], r13
mov qword [rbp - 0x160], r14
mov qword [rbp - 0x158], r15
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rdx, qword [r9 + 8]
mov rax, qword [r9]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x140]
call fcn.1400290b0
push qword [rbp + 0x10]
push qword [rbp + 0x18]
mov r9d, dword [rbp + 0x20]
xor r8d, r8d
mov qword [rbp - 0x150], r8
mov qword [rbp - 0x148], r9
lea rcx, [rbp - 0x140]
sub rsp, 0x20
call fcn.140013810
add rsp, 0x20
mov rdx, rax
mov r9, qword [rbp - 0x148]
mov r8, qword [rbp - 0x150]
mov rcx, qword [rbp + 0x30]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegSetValueExW
add rsp, 0x30
mov r9d, eax
mov rax, rbp
mov qword [rbp - 0x20], rax
lea rbx, [0x14004e060]
mov qword [rbp - 0x18], rbx
lea r8, [rbp - 0x20]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], 0x16
lea rdx, [rbp - 0x10]
mov ecx, 0x2de
call fcn.14004d370
sub rsp, 8
call fcn.14004e014
add rsp, 8
jmp 0x14004e029
mov rbx, qword [rbp - 0x188]
mov rsi, qword [rbp - 0x180]
mov rdi, qword [rbp - 0x178]
mov r12, qword [rbp - 0x170]
mov r13, qword [rbp - 0x168]
mov r14, qword [rbp - 0x160]
mov r15, qword [rbp - 0x158]
mov rsp, rbp
pop rbp
ret
Function at 0x14004e450
Capabilities:
Delete registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1a0
mov qword [rbp - 0x178], rbx
mov qword [rbp - 0x170], rsi
mov qword [rbp - 0x168], rdi
mov qword [rbp - 0x160], r12
mov qword [rbp - 0x158], r13
mov qword [rbp - 0x150], r14
mov qword [rbp - 0x148], r15
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x140]
call fcn.1400290b0
lea rcx, [rbp - 0x140]
sub rsp, 0x20
call fcn.140013810
add rsp, 0x20
mov rdx, rax
mov rcx, qword [rbp + 0x18]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegDeleteValueW
add rsp, 0x20
mov r9d, eax
mov rax, rbp
mov qword [rbp - 0x20], rax
lea rbx, [0x14004e570]
mov qword [rbp - 0x18], rbx
lea r8, [rbp - 0x20]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], 0x16
lea rdx, [rbp - 0x10]
mov ecx, 0x16e
call fcn.14004d370
sub rsp, 8
call fcn.14004e524
add rsp, 8
jmp 0x14004e539
mov rbx, qword [rbp - 0x178]
mov rsi, qword [rbp - 0x170]
mov rdi, qword [rbp - 0x168]
mov r12, qword [rbp - 0x160]
mov r13, qword [rbp - 0x158]
mov r14, qword [rbp - 0x150]
mov r15, qword [rbp - 0x148]
mov rsp, rbp
pop rbp
ret
Function at 0x14004ef70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1f0
mov qword [rbp - 0x1c8], rbx
mov qword [rbp - 0x1c0], rsi
mov qword [rbp - 0x1b8], rdi
mov qword [rbp - 0x1b0], r12
mov qword [rbp - 0x1a8], r13
mov qword [rbp - 0x1a0], r14
mov qword [rbp - 0x198], r15
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rdx, qword [rbp + 0x18]
mov dword [rdx], 0
mov dword [rbp - 0x180], 0xffffffff
mov dword [rbp - 0x17c], 4
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x170]
call fcn.1400290b0
lea rbx, [rbp - 0x17c]
push rbx
push qword [rbp + 0x18]
lea r9, [rbp - 0x180]
xor r8d, r8d
mov qword [rbp - 0x190], r8
mov qword [rbp - 0x188], r9
lea rcx, [rbp - 0x170]
sub rsp, 0x20
call fcn.140013810
add rsp, 0x20
mov rdx, rax
mov r9, qword [rbp - 0x188]
mov r8, qword [rbp - 0x190]
mov rcx, qword [rbp + 0x28]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov r9d, eax
lea rax, [0x14004e9c0]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
lea r8, [rbp - 0x50]
lea rdx, str.stdwindows_registry.d
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x40], 0x16
lea rdx, [rbp - 0x40]
mov ecx, 0x281
call fcn.14004d370
sub rsp, 8
call fcn.14004f0a3
add rsp, 8
jmp 0x14004f0b8
mov eax, dword [rbp - 0x180]
cmp eax, dword [rbp + 0x10]
sete dl
movzx edx, dl
lea rbx, [0x14004f1b0]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x30], 0
lea rcx, [rbp - 0x30]
sub rsp, 0x20
call fcn.140002cb0
add rsp, 0x20
mov rdx, qword [rbp + 0x18]
mov esi, dword [rbp - 0x180]
cmp esi, 4
je 0x14004f170
cmp esi, 5
je 0x14004f101
jmp 0x14004f109
mov eax, dword [rdx]
bswap eax
mov dword [rdx], eax
jmp 0x14004f170
sub rsp, 0x20
call fcn.14004d7e0
add rsp, 0x20
mov rsi, rax
sub rsp, 8
lea rdx, str.Cannot_read_the_given_value_as_a_32_bit_integer
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x20], 0x2f
lea rbx, [rbp - 0x20]
push rbx
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], 0x16
lea r9, [rbp - 0x10]
mov r8d, 0x297
xor edx, edx
mov rcx, rsi
sub rsp, 0x20
call fcn.140041430
add rsp, 0x30
mov rcx, rax
sub rsp, 0x20
call fcn.140019e30
mov rbx, qword [rbp - 0x1c8]
mov rsi, qword [rbp - 0x1c0]
mov rdi, qword [rbp - 0x1b8]
mov r12, qword [rbp - 0x1b0]
mov r13, qword [rbp - 0x1a8]
mov r14, qword [rbp - 0x1a0]
mov r15, qword [rbp - 0x198]
mov rsp, rbp
pop rbp
ret
Function at 0x14004f210
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1f0
mov qword [rbp - 0x1c8], rbx
mov qword [rbp - 0x1c0], rsi
mov qword [rbp - 0x1b8], rdi
mov qword [rbp - 0x1b0], r12
mov qword [rbp - 0x1a8], r13
mov qword [rbp - 0x1a0], r14
mov qword [rbp - 0x198], r15
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rdx, qword [rbp + 0x18]
mov qword [rdx], 0
mov dword [rbp - 0x180], 0xffffffff
mov dword [rbp - 0x17c], 8
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x170]
call fcn.1400290b0
lea rbx, [rbp - 0x17c]
push rbx
push qword [rbp + 0x18]
lea r9, [rbp - 0x180]
xor r8d, r8d
mov qword [rbp - 0x190], r8
mov qword [rbp - 0x188], r9
lea rcx, [rbp - 0x170]
sub rsp, 0x20
call fcn.140013810
add rsp, 0x20
mov rdx, rax
mov r9, qword [rbp - 0x188]
mov r8, qword [rbp - 0x190]
mov rcx, qword [rbp + 0x28]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov r9d, eax
lea rax, [0x14004e9c0]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
lea r8, [rbp - 0x50]
lea rdx, str.stdwindows_registry.d
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x40], 0x16
lea rdx, [rbp - 0x40]
mov ecx, 0x2a5
call fcn.14004d370
sub rsp, 8
call fcn.14004f344
add rsp, 8
jmp 0x14004f359
mov eax, dword [rbp - 0x180]
cmp eax, dword [rbp + 0x10]
sete dl
movzx edx, dl
lea rbx, [0x14004f440]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x30], 0
lea rcx, [rbp - 0x30]
sub rsp, 0x20
call fcn.140002cb0
add rsp, 0x20
mov esi, dword [rbp - 0x180]
cmp esi, 0xb
je 0x14004f3fe
sub rsp, 0x20
call fcn.14004d7e0
add rsp, 0x20
mov rsi, rax
sub rsp, 8
lea rax, str.Cannot_read_the_given_value_as_a_64_bit_integer
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], 0x2f
lea rdx, [rbp - 0x20]
push rdx
lea rbx, str.stdwindows_registry.d
mov qword [rbp - 8], rbx
mov qword [rbp - 0x10], 0x16
lea r9, [rbp - 0x10]
mov r8d, 0x2b0
xor edx, edx
mov rcx, rsi
sub rsp, 0x20
call fcn.140041430
add rsp, 0x30
mov rcx, rax
sub rsp, 0x20
call fcn.140019e30
mov rbx, qword [rbp - 0x1c8]
mov rsi, qword [rbp - 0x1c0]
mov rdi, qword [rbp - 0x1b8]
mov r12, qword [rbp - 0x1b0]
mov r13, qword [rbp - 0x1a8]
mov r14, qword [rbp - 0x1a0]
mov r15, qword [rbp - 0x198]
mov rsp, rbp
pop rbp
ret
Function at 0x14004f4a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1e0
mov qword [rbp - 0x1b8], rbx
mov qword [rbp - 0x1b0], rsi
mov qword [rbp - 0x1a8], rdi
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov rdi, r8
mov rsi, r9
mov r10, qword [rbp + 0x18]
mov qword [r10], 0
mov qword [r10 + 8], 0
mov dword [rbp - 0x1a0], 0xffffffff
mov edx, 0x64
xor ecx, ecx
call fcn.14005e4a0
mov qword [rbp - 0x190], rax
mov qword [rbp - 0x188], rdx
mov rcx, qword [rbp - 0x190]
call fcn.140028830
mov dword [rbp - 0x180], eax
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x170]
call fcn.1400290b0
lea rcx, [rbp - 0x170]
sub rsp, 0x20
call fcn.140013810
add rsp, 0x20
lea r8, [rbp - 0x1a0]
mov r9, qword [rbp - 0x188]
lea rdx, [rbp - 0x180]
push rdx
push r9
mov r9, r8
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov edi, eax
cmp edi, 0xea
jne 0x14004f5e5
lea rdx, [rbp - 0x190]
mov ecx, dword [rbp - 0x180]
sub rsp, 0x20
call fcn.14005e4e0
add rsp, 0x20
lea rcx, [rbp - 0x170]
sub rsp, 0x20
call fcn.140013810
add rsp, 0x20
lea r8, [rbp - 0x1a0]
mov r9, qword [rbp - 0x188]
lea rdx, [rbp - 0x180]
push rdx
push r9
mov r9, r8
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov edi, eax
mov r9d, edi
lea rax, [0x14004e9c0]
mov qword [rbp - 0x48], rax
xor ebx, ebx
mov qword [rbp - 0x50], rbx
lea r8, [rbp - 0x50]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x40], 0x16
lea rdx, [rbp - 0x40]
mov ecx, 0x2c7
sub rsp, 0x20
call fcn.14004d370
add rsp, 0x20
mov eax, dword [rbp - 0x1a0]
cmp eax, dword [rbp + 0x10]
sete dl
movzx edx, dl
lea rsi, [0x14004f740]
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x30], rbx
lea rcx, [rbp - 0x30]
sub rsp, 0x20
call fcn.140002cb0
add rsp, 0x20
mov ebx, dword [rbp - 0x1a0]
cmp ebx, 3
je 0x14004f662
jmp 0x14004f697
lea rdx, [rbp - 0x190]
mov ecx, dword [rbp - 0x180]
sub rsp, 0x20
call fcn.14005e4e0
add rsp, 0x20
mov rdx, qword [rbp - 0x188]
mov rax, qword [rbp - 0x190]
mov rsi, qword [rbp + 0x18]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
jmp 0x14004f6fe
sub rsp, 0x20
call fcn.14004d7e0
add rsp, 0x20
mov rsi, rax
sub rsp, 8
lea rbx, str.Cannot_read_the_given_value_as_a_string
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x20], 0x27
lea rdi, [rbp - 0x20]
push rdi
lea rax, str.stdwindows_registry.d
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], 0x16
lea r9, [rbp - 0x10]
mov r8d, 0x2d3
xor edx, edx
mov rcx, rsi
sub rsp, 0x20
call fcn.140041430
add rsp, 0x30
mov rcx, rax
sub rsp, 0x20
call fcn.140019e30
sub rsp, 8
call fcn.14004f70d
add rsp, 8
jmp 0x14004f722
mov rbx, qword [rbp - 0x1b8]
mov rsi, qword [rbp - 0x1b0]
mov rdi, qword [rbp - 0x1a8]
mov rsp, rbp
pop rbp
ret
Function at 0x140050c60
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 8], rsi
mov rsi, rcx
mov r8, rsi
xor edx, edx
mov ecx, 1
call fcn.14005fc60
xor al, 1
je 0x140050c9a
call fcn.140033010
mov r8, rsi
xor edx, edx
mov ecx, 1
call fcn.14005fc60
xor al, 1
jne 0x140050c82
mov rsi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
Function at 0x140051e30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne al
mov rsp, rbp
pop rbp
ret

Function at 0x140051f80
Capabilities:
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
call sub.KERNEL32.dll_GetFileAttributesW
mov rsp, rbp
pop rbp
ret

Function at 0x140058220
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov rbx, rcx
mov rsi, rdx
mov rcx, rsi
call fcn.1400061e0
xor al, 1
je 0x140058266
mov rcx, rsi
call fcn.140047440
mov edi, eax
mov edx, edi
mov rcx, rbx
call fcn.140064ef0
mov rcx, rsi
call fcn.1400061e0
xor al, 1
jne 0x140058246
mov rbx, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
Function at 0x14005c300
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
cmp qword [0x1400becd8], 0
jne 0x14005c4ec
lea rcx, str.dbghelp.dll
call sub.KERNEL32.dll_LoadLibraryA
mov qword [0x1400becd8], rax
test rax, rax
je 0x14005c4f8
lea rdx, str.SymInitialize
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400bec50], rax
lea rdx, str.SymCleanup
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400bec58], rax
lea rdx, str.StackWalk64
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400bec60], rax
lea rdx, str.SymGetOptions
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400bec68], rax
lea rdx, str.SymSetOptions
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400bec70], rax
lea rdx, str.SymFunctionTableAccess64
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400bec78], rax
lea rdx, str.SymGetLineFromAddr64
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400bec80], rax
lea rdx, str.SymGetModuleBase64
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400bec88], rax
lea rdx, str.SymGetModuleInfo64
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400bec90], rax
lea rdx, str.SymGetSymFromAddr64
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400bec98], rax
lea rdx, str.UnDecorateSymbolName
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400beca0], rax
lea rdx, str.SymLoadModule64
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400beca8], rax
lea rdx, str.SymGetSearchPath
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400becb0], rax
lea rdx, str.SymSetSearchPath
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400becb8], rax
lea rdx, str.SymUnloadModule64
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400becc0], rax
lea rdx, str.SymRegisterCallback64
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400becc8], rax
lea rdx, str.ImagehlpApiVersion
mov rcx, qword [0x1400becd8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400becd0], rax
lea rax, [0x1400bec50]
mov rsp, rbp
pop rbp
ret
xor eax, eax
mov rsp, rbp
pop rbp
ret