joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489c50
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.00494990
sub rsp, rax
mov rax, qword [0x004bb008]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x004bd100]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x489e5d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x489da9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x489da9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x489d89
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x489d18
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x489e1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x489e7c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x489e58
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x489e7c
jmp 0x489cee
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.00401ef0
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140004c5c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x14005b010]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
mov edi, eax
test eax, eax
je 0x140004d31
lea rcx, str.NTDLL.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140004cb5
lea rcx, str.VssTrace:_ERROR:_NTDLL.DLL_not_loaded_yet__n
jmp 0x140004d2b
lea rdx, [0x14004a988]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x140004cd6
lea rcx, str.VssTrace:_ERROR:_NTDLL_swprintf_not_found__n
jmp 0x140004d2b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9, rsi
lea rdx, str.VssTrace_pid:__d_:_ERROR_calling__s____GetLastError____0x_08lx__operation___s__m_dwTlsContextIndex__0x_08lx_._Returning_FALSE_in_DllMain..._n
mov r8d, eax
lea rcx, [rsp + 0x40]
mov eax, dword [0x14006ad90]
mov dword [rsp + 0x30], eax
lea rax, str.DLL_PROCESS_ATTACH
mov qword [rsp + 0x28], rax
mov rax, rbx
mov dword [rsp + 0x20], edi
call qword [case.0x140010c4b.0]
test eax, eax
jns 0x140004d1e
lea rcx, str.VssTrace:_ERROR:_NTDLL_StringCchPrintfW_failed__n
jmp 0x140004d2b
mov word [rsp + 0x1ce], bp
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140012560
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140004d60
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rbx, rcx
cmp dword [rcx], 0
je 0x140004749
mov eax, 0x8000ffff
jmp 0x1400047db
add rcx, 0x28
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140010c4b.0]
nop
call fcn.14000427c
and qword [rsp + 0x58], 0
lea rax, [0x14004ac48]
mov qword [rsp + 0x50], rax
mov r9d, 1
mov dword [rbx], r9d
lea rax, [rbx + 0x10]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r8, [0x14004aba0]
xor edx, edx
lea rcx, [0x140004c10]
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov ecx, eax
test eax, eax
je 0x1400047c5
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x1400047db
xor eax, eax
jmp 0x1400047db
add rsp, 0x70
pop rbx
ret
sub rsp, 0x28
mov eax, 1
lock xadd dword [0x14006c1a0], eax
inc eax
cmp eax, 1
jne 0x140004dbc
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14006ad90], eax
cmp eax, 0xffffffff
jne 0x140004d92
lea rdx, [0x14004a878]
jmp 0x140004da7
xor edx, edx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140004dac
lea rdx, [0x14004a8b8]
call fcn.140004c5c
lea rcx, [0x14006ada0]
add rsp, 0x28
jmp 0x140004728
xor eax, eax
add rsp, 0x28
ret
Function at 0x140004ea4
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, dword [0x14006ad90]
mov rbx, rcx
mov rdx, rcx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140004ee0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rbx
lea rcx, str.TlsSetValue__d___p__failed:__d
mov r9d, eax
mov edx, edi
call fcn.140004c44
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400068fc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
xor edi, edi
mov r14, rdx
mov dword [rcx + 8], edi
mov rbx, rcx
mov rax, qword [rdx + 8]
mov qword [rcx + 0x28], rax
mov rax, qword [rdx]
mov qword [rcx + 0x10], rax
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x18], rax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x24], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
or dword [rbx + 4], 0xffffffff
xorps xmm0, xmm0
mov ecx, dword [0x14006ad90]
mov dword [rbx + 0x34], eax
mov eax, dword [r14 + 0x20]
mov dword [rbx + 0x38], eax
mov dword [rbx], edi
mov qword [rbx + 0x60], rdi
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x140006988
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140006988
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call fcn.140004ea4
test eax, eax
js 0x14000699a
mov qword [rbx + 0x60], rsi
jmp 0x14000699e
mov rsi, qword [rbx + 0x60]
test rsi, rsi
je 0x1400069a8
mov edi, dword [rsi + 0x30]
inc edi
mov dword [rbx + 0x30], edi
lea rdx, str.ENTER
cmp dword [rbx + 0x38], 0xff
mov r8d, 0xa0
mov rcx, rbx
cmovne r8d, dword [rbx + 0x38]
xor r9d, r9d
call fcn.140006ed4
mov rcx, r14
call fcn.140006548
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400069f8
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
lea rbx, [rcx + 0x40]
mov edi, 4
mov rcx, qword [rbx]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rbx], 0
lea rbx, [rbx + 8]
sub rdi, 1
jne 0x140006a13
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov r8d, 0x88888889
sub ebx, dword [rsi + 0x34]
mov eax, 0x10624dd3
mul ebx
mov eax, r8d
mov r10d, ebx
mov r11d, edx
shr r11d, 6
mul r11d
imul ecx, r11d, 0x3e8
shr edx, 5
imul eax, edx, 0x3c
sub r10d, ecx
sub r11d, eax
mov eax, 0x45e7b273
mul ebx
mov eax, r8d
mov r9d, edx
shr r9d, 0xe
mul r9d
mov eax, 0x95217cb1
shr edx, 5
imul ecx, edx, 0x3c
mul ebx
sub r9d, ecx
mov eax, r8d
mov ecx, edx
mov r8d, 0xa0
shr ecx, 0x15
mul ecx
shr edx, 5
imul eax, edx, 0x3c
lea rdx, str.EXIT
sub ecx, eax
mov eax, dword [rsi + 8]
cmp dword [rsi + 0x38], 0xff
mov dword [rsp + 0x48], eax
cmovne r8d, dword [rsi + 0x38]
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], r9d
lea r9, str.Time_spent:__02ld:_02ld:_02ld__04ld__total:__x__HRESULT:__x
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.140006fd8
mov rcx, qword [rsi + 0x60]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
jmp fcn.140004ea4
Function at 0x140006b58
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x840]
sub rsp, 0x940
mov rax, qword [0x14005b010]
xor rax, rsp
mov qword [rbp + 0x830], rax
mov eax, dword [0x14006c1a0]
mov rdi, rcx
neg eax
sbb ecx, ecx
and ecx, dword [0x14006adc4]
cmp ecx, dword [rdi + 4]
je 0x140006d4b
xor r15d, r15d
mov dword [rdi + 4], ecx
cmp dword [0x14006c1a0], r15d
je 0x140006c2d
mov ecx, dword [rdi + 0x24]
mov ebx, r15d
mov eax, dword [0x14006b6f8]
bt eax, ecx
jae 0x140006c26
mov r14, qword [rdi + 0x28]
lea rsi, [rcx + rcx*8]
lea r13, [0x14006b810]
shl rsi, 4
lea rdx, [r13 + 0x78]
add rdx, rsi
lea rcx, [rbp - 8]
call fcn.140004f78
mov rcx, rax
mov rdx, r14
call fcn.1400042dc
test eax, eax
je 0x140006bfe
lea eax, [r15 + 1]
jmp 0x140006c29
lea rdx, [r13 + 0x60]
add rdx, rsi
lea rcx, [rbp + 0x10]
call fcn.140004f78
mov rcx, rax
mov rdx, r14
call fcn.1400042dc
test eax, eax
je 0x140006c26
mov ebx, 1
mov eax, ebx
jmp 0x140006c29
mov eax, r15d
test eax, eax
jne 0x140006c6b
mov rcx, qword [rdi + 0x60]
test rcx, rcx
je 0x140006c3f
call fcn.140006b48
mov ebx, eax
jmp 0x140006c6b
cmp dword [0x14006c1a0], r15d
je 0x140006c68
cmp dword [0x14006ada0], r15d
je 0x140006c68
cmp dword [0x14006ada4], r15d
je 0x140006c68
cmp dword [0x14006ad94], r15d
mov ebx, 1
jne 0x140006c6b
mov ebx, r15d
mov dword [rdi], ebx
mov eax, dword [rdi + 4]
cmp dword [0x14006ad98], eax
je 0x140006d4b
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x800
call sub.msvcrt.dll_memset
lea rdx, [rbp + 0x30]
call fcn.14000747c
lea rax, str.base_stor_vssmodules_trace_fntracer.cpp
mov dword [rsp + 0x68], 0x24f
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x78]
lea rax, str.CVssFunctionTracer::UpdateLocalIsTracingEnabledFlag
mov dword [rsp + 0x6c], 0xb
mov qword [rsp + 0x58], rax
mov esi, 0x78
lea rax, str.TRCTRCC
mov dword [rsp + 0x70], 0xff
mov r8d, esi
mov qword [rsp + 0x60], rax
xor edx, edx
mov dword [rbp - 0x10], 0x1000000
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rdi + 4]
lea r8, str.TRACING_STARTED
mov dword [rsp + 0x48], ecx
lea rdx, [rsp + 0x50]
mov ecx, dword [0x14006ad98]
mov r9d, esi
mov dword [rsp + 0x40], ecx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x38], rcx
mov rcx, rdi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
lea rax, str.Tracing_started_or_updated._PID_d__CommandLine__s___UserName__s_._SQN__d_____d_
mov qword [rsp + 0x20], rax
call fcn.1400070a4
mov eax, dword [rdi + 4]
mov dword [0x14006ad98], eax
mov rcx, qword [rbp + 0x830]
xor rcx, rsp
call fcn.140012560
lea r11, [rsp + 0x940]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x140006d7c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
cmp dword [0x14006c1a0], 0
mov rbp, r8
mov r14d, edx
mov rdi, rcx
je 0x140006eb8
cmp dword [0x14006ada0], 0
je 0x140006eb8
cmp dword [0x14006ada4], 0
je 0x140006eb8
mov ecx, dword [0x14006ad90]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140006ddf
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140006ddf
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
test rbx, rbx
je 0x140006dfc
mov edx, dword [rdi + 0x1c]
mov rcx, rbx
call fcn.140006b00
test eax, eax
je 0x140006eb8
mov esi, dword [rbx + 0x30]
lea rdx, [0x140042a1b]
mov ecx, 0x3ea
call fcn.14001233c
mov rbx, rax
test rax, rax
jne 0x140006e1e
lea rcx, str.StaticTrace_failed_due_to_out_of_memory_condition
jmp 0x140006e7b
and qword [rsp + 0x50], 0
lea rax, [rsp + 0xb0]
and qword [rsp + 0x58], 0
lea r9, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x58]
mov rax, qword [rsp + 0xa8]
mov edx, 0x1f4
mov rcx, rbx
mov qword [rsp + 0x28], rax
call fcn.140005df8
cmp qword [rsp + 0x50], 1
jne 0x140006e78
mov rax, qword [rsp + 0x58]
mov ecx, 0x2e
mov dword [rax - 4], 0x2e002e
mov word [rax - 6], cx
mov rcx, rbx
mov eax, dword [rdi + 0x1c]
mov r9d, esi
mov r8d, dword [rdi + 0x18]
mov rdx, qword [rdi + 0x10]
mov qword [rsp + 0x40], rcx
lea rcx, str.STATIC
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rcx
mov rcx, qword [rdi]
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
call fcn.140004dcc
mov rcx, rbx
call fcn.1400110f8
mov rcx, rdi
call fcn.140006548
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000a53c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rbx, rcx
lea r14, str.base_stor_vssmodules_registry_registry.cxx
mov qword [rsp + 0x48], r14
lea r15, str.CVssRegistryValueIterator::ReadCurrentValueDetails
mov qword [rsp + 0x50], r15
lea r12, str.REGREGSC
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], 0x45e
mov dword [rsp + 0x64], 0xb
mov dword [rsp + 0x68], 0xff
xor esi, esi
mov dword [rbp - 0x18], 0x1000000
xor edx, edx
lea r8d, [rsi + 0x78]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x10]
call fcn.1400068fc
nop
cmp byte [rbx + 0x31], sil
je 0x14000a701
mov r8, qword [rbx + 0x20]
test r8, r8
je 0x14000a701
cmp byte [rbx + 0x30], sil
je 0x14000a60d
lea rcx, [rbp - 0x10]
call fcn.1400069f8
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0x28]
mov dword [rbp + 0x90], eax
lea rax, [rbx + 0x2c]
lea rcx, [rbx + 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x90]
mov edx, dword [rbx + 0xc]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test eax, eax
je 0x14000a66a
mov dword [rsp + 0x28], 0xb
mov r9, r15
mov r8, r12
mov rdx, r14
lea rcx, [rsp + 0x48]
cmp eax, 0x103
jne 0x14000a6a8
jmp 0x14000a673
mov byte [rbx + 0x30], 1
jmp 0x14000a5e8
mov dword [rsp + 0x20], 0x47e
call fcn.140006474
mov ecx, dword [rbx + 8]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rbx + 0xc]
mov dword [rsp + 0x20], ecx
lea r9, str.Unexpected_error:_dwIndex_out_of_scope__lu__lu
mov r8d, 0x8000ffff
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140007d50
int3
mov dword [rsp + 0x20], 0x47a
call fcn.140006474
mov rdx, rax
lea rcx, [rbx + 0x18]
call fcn.1400092d0
movzx r8d, di
or r8d, 0x80070000
test edi, edi
cmovle r8d, edi
mov ecx, dword [rbp + 0x90]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x28], eax
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
lea r9, str.RegEnumValue__p__lu__p__lu_..._
lea rcx, [rbp - 0x10]
call fcn.140007d50
int3
mov dword [rsp + 0x28], 0xb
mov dword [rsp + 0x20], 0x462
mov r9, r15
mov r8, r12
mov rdx, r14
lea rcx, [rsp + 0x48]
call fcn.140006474
lea r9, str.Unexpected_error:_noninitialized_iterator
mov r8d, 0x8000ffff
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140007d50
int3
Function at 0x1400101f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14005b010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
xor edi, edi
mov qword [rbp - 0x59], rdi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x41], rdi
mov dword [rbp - 0x39], edi
mov rdx, rcx
lea rcx, [rbp - 0x59]
call fcn.1400030d8
test al, al
jne 0x140010264
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400102ff
lea rcx, [rbp - 0x59]
call fcn.140012f44
lea rcx, [rbp - 0x59]
call fcn.140002774
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 1], 7
mov qword [rbp - 9], rdi
mov word [rbp - 0x19], di
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x140010291
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.1400053ec
nop
call fcn.140010170
mov rcx, rax
lea rdx, [rbp - 0x21]
call fcn.1400174dc
nop
cmp qword [rbp - 1], 8
jb 0x1400102cb
mov rcx, qword [rbp - 0x19]
call fcn.1400110f8
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
lea rcx, [rbp - 0x59]
call fcn.140001890
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140012560
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
lea rdx, str.file_does_not_exist_
lea rcx, [rbp - 0x21]
call fcn.1400050a8
nop
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 7]
call fcn.14000b9a0
lea rdx, [0x140059290]
lea rcx, [rbp + 7]
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x1400120c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14006c1b0], rbx
je 0x14001210c
cmp rax, rbx
jne 0x1400120ff
mov ebx, 1
mov esi, ebx
jmp 0x140012111
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400120e4
mov ebx, 1
mov eax, dword [0x14006c1b8]
cmp eax, ebx
jne 0x140012127
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14001218c
mov eax, dword [0x14006c1b8]
test eax, eax
jne 0x140012186
mov dword [0x14006c1b8], ebx
lea r15, [0x140041688]
lea rdi, [0x140041670]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140012178
test eax, eax
jne 0x14001217c
cmp qword [rdi], 0
je 0x14001216d
mov rax, qword [rdi]
mov rcx, qword [case.0x140010c4b.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14001214e
test eax, eax
je 0x14001218c
mov eax, 0xff
jmp 0x140012268
mov dword [0x14006b13c], ebx
mov eax, dword [0x14006c1b8]
cmp eax, ebx
jne 0x1400121b3
lea rdx, [0x140041668]
lea rcx, [0x140041620]
call sub.msvcrt.dll__initterm
mov dword [0x14006c1b8], 2
test esi, esi
jne 0x1400121c0
xor eax, eax
xchg qword [0x14006c1b0], rax
cmp qword [0x14006c1d0], 0
je 0x1400121f4
lea rcx, [0x14006c1d0]
call fcn.140012830
test eax, eax
je 0x1400121f4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14006c1d0]
mov r9, qword [case.0x140010c4b.0]
call r9
mov r8, qword [0x14006b150]
mov rdx, qword [0x14006b148]
mov ecx, dword [0x14006b140]
call fcn.140010d4c
mov dword [0x14006b138], eax
cmp dword [0x14006b158], 0
jne 0x140012224
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14006b13c], 0
jne 0x140012239
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14006b138]
jmp 0x140012268
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400fe000
add rsp, 0x28
jmp 0x1400120c0

Function at 0x140012348
Capabilities:
Print debug messages

Disassembly:
jmp 0x140012354
push rbx
sub rsp, 0x540
mov rax, qword [0x14005b010]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400123d1
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x1400123f1
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140012560
add rsp, 0x540
pop rbx
ret
Function at 0x140012354
Capabilities:
Print debug messages

Disassembly:
jmp 0x140012354
push rbx
sub rsp, 0x540
mov rax, qword [0x14005b010]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400123d1
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x1400123f1
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140012560
add rsp, 0x540
pop rbx
ret

Function at 0x14001272c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140012778
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140012770
cmp dword [rcx + 0x3c], edx
jl 0x140012770
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140012770
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140012778
mov rax, rdx
add rsp, 0x18
ret