joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d360
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0xc1
call qword [0x140082d65]
loope 0x14000713d
invalid
add byte [rbx], dh
shr cl, 0x58
sldt word [rax]
xor eax, eax
jmp 0x1400080e3
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
add rax, 0x108
mov rdx, rax
mov rcx, qword [rsp + 0x108]
call fcn.14000d1f6
jmp 0x14000c9c8
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x38]
and eax, 1
test eax, eax
jne 0x140007179
jmp 0x14000b195
mov ecx, 0xc1
call qword [0x140083fdf]
xor eax, eax
jmp 0x1400080e3
mov ecx, 0xc1
call qword [0x140085858]
xor eax, eax
jmp 0x1400080e3
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 4]
cmp eax, 0x8664
je 0x140007cc2
pop rsi
fcos
invalid
jmp 0x1400083d2
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x38]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x48], 0
jmp 0x14000c244
test eax, eax
jne 0x14000df39
jmp 0x1400074b8
jmp 0x14000b672
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x48], eax
jb 0x140007ce7
jmp 0x14000ae63
test eax, eax
jne 0x14000d351
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x100]
add byte [rax], al
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
je 0x14000a350
jmp 0x14000de14
mov ecx, 0xc1
call qword [0x140089a43]
xor eax, eax
shr cl, 0xbd
invalid
invalid
invalid
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140007a63
jmp 0x140009bc4
Function at 0x14000d520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x28], eax
jmp 0x1400092df
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
je 0x14000bd95
jmp 0x14000c86d
cmp qword [rsp + 0x30], 0
je 0x14000d8ce
invalid
jmp 0x140007bce
cmp qword [rsp + 0x28], 0
jne 0x14000c12f
jmp 0x14000ce4a
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb4]
test byte [rsp + rsi*4], ah
add byte [rax], al
add byte [rbx - 0x7374b730], cl
and al, 0x88
add byte [rax], al
invalid
call fcn.140007f51
jmp 0x14000c69f
mov eax, dword [rsp + 0xb4]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x50]
mov edx, eax
call fcn.140007f51
jmp 0x14000932a
mov ecx, 0xc1
call qword [0x140085bf1]
add byte [rbx], dh
shr cl, 0x9b
invalid
invalid
invalid
cmp qword [rsp + 0x30], 0
je 0x14000b4f1
jmp 0x14000c973
lea rcx, [rsp + 0xb0]
call qword [0x140087012]
jmp 0x140009a5d
pop rcx
in eax, 0xff
invalid
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
add rax, qword [rsp + 0xa0]
and al, 0xa0
add byte [rax], al
add byte [rax - 0x77], cl
test byte [rax + rax*4], ah
add byte [rax], al
add cl, ch
js 0x14000bdca
add byte [rax], al
cmp qword [rsp + 0x40], rax
jne 0x14000a136
jmp 0x140008355
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x50]
add eax, dword [rcx + 0x10]
mov eax, eax
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x80], eax
jmp 0x14000d82a
lea rcx, [rsp + 0xb0]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x60]
jmp 0x140009a5d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
jmp 0x14000d503
cmp qword [rsp + 0x30], 0
movzx eax, word [rax + 6]
cmp dword [rsp + 0x48], eax
jae 0x14000ae63
jmp 0x140007ce7
mov rax, qword [rsp + 0x88]
cmp qword [rsp + 0x80], rax
ja 0x14000cc20
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
call qword [0x140089357]
mov qword [rsp + 0x28], rax
jmp 0x1400092df
Function at 0x14000d830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x28], eax
jmp 0x1400092df
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
je 0x14000bd95
jmp 0x14000c86d
cmp qword [rsp + 0x30], 0
je 0x14000d8ce
invalid
jmp 0x140007bce
cmp qword [rsp + 0x28], 0
jne 0x14000c12f
jmp 0x14000ce4a
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb4]
test byte [rsp + rsi*4], ah
add byte [rax], al
add byte [rbx - 0x7374b730], cl
and al, 0x88
add byte [rax], al
invalid
call fcn.140007f51
jmp 0x14000c69f
mov eax, dword [rsp + 0xb4]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x50]
mov edx, eax
call fcn.140007f51
jmp 0x14000932a
mov ecx, 0xc1
call qword [0x140085bf1]
add byte [rbx], dh
shr cl, 0x9b
invalid
invalid
invalid
cmp qword [rsp + 0x30], 0
je 0x14000b4f1
jmp 0x14000c973
lea rcx, [rsp + 0xb0]
call qword [0x140087012]
jmp 0x140009a5d
pop rcx
in eax, 0xff
invalid
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
add rax, qword [rsp + 0xa0]
and al, 0xa0
add byte [rax], al
add byte [rax - 0x77], cl
test byte [rax + rax*4], ah
add byte [rax], al
add cl, ch
js 0x14000bdca
add byte [rax], al
cmp qword [rsp + 0x40], rax
jne 0x14000a136
jmp 0x140008355
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x50]
add eax, dword [rcx + 0x10]
mov eax, eax
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x80], eax
jmp 0x14000d82a
lea rcx, [rsp + 0xb0]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x60]
jmp 0x140009a5d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
jmp 0x14000d503
cmp qword [rsp + 0x30], 0
movzx eax, word [rax + 6]
cmp dword [rsp + 0x48], eax
jae 0x14000ae63
jmp 0x140007ce7
mov rax, qword [rsp + 0x88]
cmp qword [rsp + 0x80], rax
ja 0x14000cc20
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
call qword [0x140089357]
mov qword [rsp + 0x28], rax
jmp 0x1400092df

Function at 0x14000d840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x14000d503
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x50]
add rax, 0x28
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
jmp 0x140007768

Function at 0x14000e830
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1401274ec
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140180d90]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 6
lea r8, [0x140180d88]
call fcn.140126a8c
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x14012752c
call qword [0x1401d0010]
jmp 0x140127532
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000e940
Capabilities:
Read file on windows

Disassembly:
jmp 0x14013ab74
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15d, r8d
mov r13, rdx
movsxd rsi, ecx
cmp esi, 0xfffffffe
jne 0x14013abb0
call fcn.140011200
and dword [rax], 0
call fcn.14000a4f0
mov dword [rax], 9
jmp 0x14013ac75
test ecx, ecx
js 0x14013ac5d
cmp esi, dword [0x1401bd48c]
jae 0x14013ac5d
mov r14, rsi
mov r12, rsi
sar r12, 6
lea rax, [0x1401bcfc0]
and r14d, 0x3f
shl r14, 6
mov rax, qword [rax + r12*8]
movzx ecx, byte [rax + r14 + 0x38]
and ecx, 1
je 0x14013ac5d
xor eax, eax
cmp r8d, 0x7fffffff
setbe al
test eax, eax
jne 0x14013ac11
call fcn.140011200
and dword [rax], 0
call fcn.14000a4f0
mov dword [rax], 0x16
jmp 0x14013ac70
mov ecx, esi
call fcn.14000d190
or ebx, 0xffffffff
lea rax, [0x1401bcfc0]
mov rax, qword [rax + r12*8]
test byte [rax + r14 + 0x38], 1
jne 0x14013ac43
call fcn.14000a4f0
mov dword [rax], 9
call fcn.140011200
and dword [rax], 0
jmp 0x14013ac52
mov r8d, r15d
mov rdx, r13
mov ecx, esi
call fcn.1400066f0
mov ebx, eax
mov ecx, esi
call fcn.1400030a0
mov eax, ebx
jmp 0x14013ac78
call fcn.140011200
and dword [rax], 0
call fcn.14000a4f0
mov dword [rax], 9
call fcn.14000fb40
or eax, 0xffffffff
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret

Function at 0x14000eeb0
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401273e0
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x140180d60]
mov ecx, 3
lea r8, [0x140180d58]
lea rdx, str.FlsAlloc
call fcn.140126a8c
test rax, rax
je 0x14012741c
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1401d0010]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x140010410
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400e874c
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400e8507
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400e8507
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400e8507
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400e8507
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400e8507
cmp dword [rcx + 0x84], 0xe
jbe 0x1400e8507
cmp dword [rcx + 0xf8], 0
je 0x1400e8507
mov ecx, ebx
call fcn.1400e8698
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140006510
cmp dword [rbp + 0x20], 0
je 0x1400e8554
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400e858c
int3
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x1400e84a0
Function at 0x140013f40
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140040d80
movzx eax, byte [rdx + 1]
mov r8, rdx
movzx r9d, byte [rdx]
movabs r11, 0x100000001b3
movabs r10, 0xcbf29ce484222325
xor r9, r10
movzx ecx, byte [r8 + 8]
imul r9, r11
xor rcx, r10
xor r9, rax
movzx eax, byte [rdx + 2]
imul rcx, r11
imul r9, r11
xor r9, rax
movzx eax, byte [rdx + 3]
movzx edx, byte [rdx + 4]
xor rdx, r10
imul rdx, r11
imul r9, r11
xor r9, rax
movzx eax, byte [r8 + 5]
xor rdx, rax
movzx eax, byte [r8 + 6]
imul rdx, r11
imul r9, r11
xor rdx, rax
movzx eax, byte [r8 + 7]
imul rdx, r11
shr r9, 1
xor rdx, rax
movzx eax, byte [r8 + 9]
xor rcx, rax
movzx eax, byte [r8 + 0xa]
imul rcx, r11
imul rdx, r11
xor rcx, rax
movzx eax, byte [r8 + 0xb]
imul rcx, r11
xor rcx, rax
imul rcx, r11
lea rax, [rcx + rcx]
movabs rcx, 0x7fffffffffffffff
and rdx, rcx
xor rax, rdx
xor rax, r9
ret

Function at 0x140043030
Capabilities:
Set console window title

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401b80a0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x14004308a
movzx ecx, word [rsp + 0x30]
mov eax, 0x4e20
add cx, 0x1e
mov word [rsp + 0x22], ax
mov word [rsp + 0x20], cx
mov rcx, rbx
mov edx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
xor eax, eax
lea r8, [rsp + 0x28]
mov dword [rsp + 0x28], eax
mov rcx, rbx
movzx eax, word [rsp + 0x30]
add ax, 0x1d
mov word [rsp + 0x2c], ax
mov eax, 0x32
mov word [rsp + 0x2e], ax
lea edx, [rax - 0x31]
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
mov rcx, qword [str.vulkaninfo]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140010cc0
add rsp, 0x50
pop rbx
ret
Function at 0x14013a3c4
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
movsxd r13, ecx
lea r10, [0x1401bcfc0]
mov rdi, r13
mov r15, r13
sar r15, 6
and edi, 0x3f
shl rdi, 6
mov r14, rdx
mov r9d, 0xa
mov rax, qword [r10 + r15*8]
mov rcx, qword [rax + rdi + 0x28]
mov qword [rsp + 0x98], rcx
test r8, r8
je 0x14013a41c
cmp word [rdx], r9w
jne 0x14013a41c
or byte [rax + rdi + 0x38], 4
jmp 0x14013a421
and byte [rax + rdi + 0x38], 0xfb
lea r12, [rdx + r8*2]
mov rsi, rdx
mov rbx, rdx
cmp rdx, r12
jae 0x14013a5d7
lea rbp, [rdx + 2]
mov edx, 0xd
movzx eax, word [rsi]
cmp ax, 0x1a
je 0x14013a5b9
cmp ax, dx
je 0x14013a463
mov word [rbx], ax
add rbx, 2
add rsi, 2
add rbp, 2
jmp 0x14013a504
cmp rbp, r12
jae 0x14013a489
cmp word [rbp], r9w
jne 0x14013a484
add rsi, 4
mov word [rbx], r9w
add rbp, 4
add rbx, 2
jmp 0x14013a504
mov word [rbx], dx
jmp 0x14013a452
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov r8d, 2
lea rdx, [rsp + 0x80]
add rsi, 2
add rbp, 2
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14013a59d
cmp dword [rsp + 0x90], 0
je 0x14013a59d
lea r10, [0x1401bcfc0]
mov r9d, 0xa
mov rax, qword [r10 + r15*8]
test byte [rax + rdi + 0x38], 0x48
je 0x14013a54e
movzx eax, word [rsp + 0x80]
cmp ax, r9w
jne 0x14013a512
mov word [rbx], r9w
add rbx, 2
mov edx, 0xd
mov rcx, qword [rsp + 0x98]
cmp rsi, r12
jb 0x14013a43d
jmp 0x14013a5d7
mov ecx, 0xd
mov word [rsp + 0x88], ax
mov word [rbx], cx
add rbx, 2
xor edx, edx
mov rcx, qword [r10 + r15*8]
mov al, byte [rsp + rdx + 0x88]
add rcx, rdi
mov byte [rcx + rdx + 0x3a], al
inc rdx
cmp rdx, 2
jl 0x14013a528
mov rax, qword [r10 + r15*8]
mov byte [rax + rdi + 0x3c], r9b
jmp 0x14013a4f7
cmp word [rsp + 0x80], r9w
jne 0x14013a55e
cmp rbx, r14
je 0x14013a4ef
mov rdx, 0xfffffffffffffffe
mov ecx, r13d
lea r8d, [rdx + 3]
call fcn.140013ca0
mov r9d, 0xa
lea r10, [0x1401bcfc0]
cmp word [rsp + 0x80], r9w
je 0x14013a4f7
lea edx, [r9 + 3]
mov word [rbx], dx
add rbx, 2
jmp 0x14013a4fc
mov edx, 0xd
lea r10, [0x1401bcfc0]
mov word [rbx], dx
add rbx, 2
lea r9d, [rdx - 3]
jmp 0x14013a4fc
mov rcx, qword [r10 + r15*8]
mov al, byte [rcx + rdi + 0x38]
test al, 0x40
jne 0x14013a5cd
or al, 2
mov byte [rcx + rdi + 0x38], al
jmp 0x14013a5d7
movzx ecx, word [rsi]
mov word [rbx], cx
add rbx, 2
sub rbx, r14
sar rbx, 1
lea rax, [rbx + rbx]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400010a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140110980]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx eax, byte [rdx]
mov r11, rcx
mov r10, qword [rsp + 0x88]
shl eax, 0x18
mov dword [rsp + 0x38], eax
movzx eax, word [rdx + 1]
mov dword [rsp + 0x3c], eax
mov rax, qword [rdx + 3]
add rdx, 0xb
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov qword [r10], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], r10
movzx ecx, word [rax]
mov dword [r10 + 8], ecx
lea rcx, str.ETW0
mov qword [r10 + 0x10], rdx
mov dword [r10 + 0xc], 2
movzx eax, word [rdx]
lea rdx, [rsp + 0x38]
mov dword [r10 + 0x18], eax
lea rax, [0x1400f227e]
sub eax, ecx
mov dword [r10 + 0x1c], 1
mov rcx, qword [r11 + 0x20]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c2d60
add rsp, 0x58
ret
Function at 0x140005b50
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x140110980]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rdi, rcx
xor esi, esi
mov qword [rbp + 0x27], rsi
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rcx + 0x30]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140005c67
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x140005c27
lea edx, [rsi + 0x32]
mov eax, edx
mov rcx, r8
cmp word [rcx], si
je 0x140005bd2
add rcx, 2
sub rax, 1
jne 0x140005bc3
test rax, rax
je 0x140005c27
sub edx, eax
add edx, edx
neg rax
sbb r9d, r9d
and r9d, edx
add r9d, 2
mov rcx, qword [rbp + 0x27]
test rcx, rcx
je 0x140005cac
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x140005c7b
lea rcx, str.Unable_to_add_an_entry_for_the_UE_V_agent_service_to_the_App_V_4.x_ServiceInclusions_registry_key__error_code_0x_X_
jmp 0x140005c73
test byte [0x140111b01], 2
je 0x140005c7b
lea rax, str.Unexpected_error_getting_the_length_of_the_UE_V_registry_value
mov qword [rbp + 0x3f], rax
mov qword [rbp + 0x47], 0x7e
lea rax, [rbp + 0x2f]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea rdx, [0x1400daaa8]
lea rcx, [0x14010a1c0]
call fcn.140002dbc
jmp 0x140005c7b
cmp eax, 2
je 0x140005c7b
lea rcx, str.An_unexpected_error_occurred_opening_the_App_V_4.x_product_registry_key__error_code_0x_X_
mov edx, eax
call fcn.140006c58
nop
lea rcx, [rbp + 0x27]
call fcn.140006130
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400c2d60
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rdx, str.Attempting_to_use_an_invalid_handle.
lea rcx, [rbp + 0x2f]
call fcn.1400061b0
nop
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 0x19]
call fcn.140005a44
lea rdx, [0x140106f30]
lea rcx, [rbp - 0x19]
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x14001ab9c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140110980]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov ebx, edx
mov rdi, rcx
and qword [rbp + 0x47], 0
lea rax, [rbp + 0x47]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftUEVAgentConfiguration
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001ac56
mov dword [rbp + 0x37], 4
mov rcx, qword [rbp + 0x47]
test rcx, rcx
je 0x14001ac92
lea rax, [rbp + 0x37]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3b]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001ac65
mov edx, dword [rbp + 0x3b]
cmp edx, 4
jne 0x14001ac48
mov ebx, dword [rbp + 0x3f]
jmp 0x14001ac65
lea rcx, str.AgentService.Util::GetDwordConfigValue:_Unexpected_value_type__type__0x_X
call fcn.140004610
jmp 0x14001ac65
mov edx, eax
lea rcx, str.AgentService.Util::GetDwordConfigValue:_Failed_to_open_configuration_key__status__0x_X
call fcn.140004544
nop
lea rcx, [rbp + 0x47]
call fcn.140006130
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400c2d60
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
lea rdx, str.Attempting_to_use_an_invalid_handle.
lea rcx, [rbp - 0x29]
call fcn.1400061b0
nop
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 9]
call fcn.140005a44
lea rdx, [0x140106f30]
lea rcx, [rbp - 9]
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x14001e548
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x250
mov rax, qword [0x140110980]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov r15, r8
xor r13d, r13d
mov qword [r8], r13
mov r9d, 0x104
lea rdx, [rsp + 0x30]
lea rax, [rsp + 0x30]
sub rcx, rax
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x14001e5bd
movzx eax, word [rcx + rdx]
test ax, ax
je 0x14001e5bd
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x14001e59b
lea rax, [rdx - 2]
test r9, r9
cmovne rax, rdx
mov word [rax], r13w
lea r8, [0x1400e1be0]
lea rcx, [rsp + 0x30]
call fcn.14001c6f0
lea r8, [rsp + 0x30]
xor edx, edx
mov ebx, 0x1f0003
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
setne r12b
test rax, rax
jne 0x14001e633
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x14001e70c
mov rcx, qword [rbp + 0x178]
mov edx, 0xc9
call fcn.14001e144
mov esi, eax
jmp 0x14001e70f
mov dword [rsp + 0x24], r13d
mov dword [rsp + 0x20], r13d
lea rdx, [rsp + 0x24]
mov rcx, rdi
call fcn.14001e3d0
mov esi, eax
test eax, eax
jns 0x14001e669
mov rcx, qword [rbp + 0x178]
mov r9d, eax
mov edx, 0xcf
call fcn.14001e120
jmp 0x14001e70f
lea r8, [0x1400e1be8]
lea rcx, [rsp + 0x30]
call fcn.14001c6f0
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
setne r14b
test rax, rax
jne 0x14001e6b3
mov rcx, qword [rbp + 0x178]
mov edx, 0xd5
call fcn.14001e144
mov esi, eax
jmp 0x14001e6da
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14001e3d0
mov esi, eax
test eax, eax
jns 0x14001e6ea
mov rcx, qword [rbp + 0x178]
mov r9d, eax
mov edx, 0xd7
call fcn.14001e120
test r14b, r14b
je 0x14001e70f
mov rcx, rbx
call fcn.14001e1ac
nop
jmp 0x14001e70f
test r14b, r14b
je 0x14001e6f8
mov rcx, rbx
call fcn.14001e1ac
nop
movsxd rcx, dword [rsp + 0x20]
shl rcx, 0x1f
movsxd rax, dword [rsp + 0x24]
or rax, rcx
mov qword [r15], rax
mov esi, r13d
test r12b, r12b
je 0x14001e71d
mov rcx, rdi
call fcn.14001e1ac
nop
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1400c2d60
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret