joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003f58
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800210e0]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180003f68
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021230]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180003f78
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021380]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180003f88
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800214d0]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180003f98
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021620]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180003fa8
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021770]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180003fb8
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800218c0]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180003fc8
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021a10]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180003fd8
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021b60]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180003fe8
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021cb0]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180003ff8
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021e00]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180004008
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021f50]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180004018
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800220a0]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180004028
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800221f0]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180004038
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180022340]
xor edx, edx
jmp fcn.180002ab4

Function at 0x180004048
Capabilities:
Check if file exists

Disassembly:
lea r8, str.test.old.cs_Test.CustomActions.MyAction
xor edx, edx
jmp fcn.180002ab4
Function at 0x180004230
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
sub rsp, 0x290
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x288], rbx
mov qword [rbp + 0x290], rsi
mov qword [rbp + 0x298], rdi
mov rax, qword [0x180031008]
xor rax, rbp
mov qword [rbp + 0x260], rax
or rbx, 0xffffffffffffffff
mov qword [rbp], rcx
xor r8d, r8d
mov rdx, rcx
inc rbx
cmp word [rcx + rbx*2], r8w
jne 0x180004272
lea rsi, [rbx + 0x107]
lea rax, [rsi + rsi]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18000429a
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180005170
sub rsp, rcx
lea rdi, [rsp + 0x20]
test rdi, rdi
jne 0x1800042ba
xor al, al
jmp 0x180004395
mov r8, rdx
mov rcx, rdi
mov rdx, rsi
call fcn.18000164c
lea r8, [0x180022c48]
mov rdx, rsi
mov rcx, rdi
call fcn.18000157c
lea rdx, [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180004386
inc rbx
lea rbx, [rdi + rbx*2]
lea r8, [rbp + 0x3c]
mov edx, 0x106
mov rcx, rbx
call fcn.18000164c
test byte [rbp + 0x10], 0x10
je 0x180004355
movzx ecx, word [rbp + 0x3c]
cmp cx, word [0x180022c50]
movzx eax, word [rbp + 0x3e]
jne 0x18000432c
cmp ax, word [0x180022c52]
je 0x18000435e
cmp cx, word [0x180022c54]
jne 0x18000434b
cmp ax, word [0x180022c56]
jne 0x18000434b
movzx eax, word [rbp + 0x40]
cmp ax, word [0x180022c58]
je 0x18000435e
mov rcx, rdi
call fcn.180004230
jmp 0x18000435e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp + 0x10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18000437c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
or rsi, 0xffffffffffffffff
cmp rsi, 0xffffffffffffffff
jne 0x1800042fb
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
mov rcx, qword [rbp + 0x260]
xor rcx, rbp
call fcn.1800051e0
mov rbx, qword [rbp + 0x288]
mov rsi, qword [rbp + 0x290]
mov rdi, qword [rbp + 0x298]
lea rsp, [rbp + 0x270]
pop rbp
ret

Function at 0x1800043c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1800043e0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800043e0
test al, 0x10
je 0x1800043e0
mov al, 1
jmp 0x1800043e2
xor al, al
add rsp, 0x28
ret
Function at 0x180006dd0
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, str.FlsAlloc
xor ecx, ecx
lea r8, [0x180023f28]
lea rdx, str.FlsAlloc
call fcn.180006bf8
mov rbx, rax
test rax, rax
je 0x180006e10
mov rcx, rax
call fcn.1800060a0
mov rcx, rdi
call rbx
jmp 0x180006e16
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180006e78
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, str.FlsGetValue
mov ecx, 2
lea r8, [0x180023f50]
lea rdx, str.FlsGetValue
call fcn.180006bf8
mov rdi, rax
test rax, rax
je 0x180006eb9
mov rcx, rax
call fcn.1800060a0
mov ecx, ebx
call rdi
jmp 0x180006ec1
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180006ecc
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, str.FlsSetValue
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x180023f68]
call fcn.180006bf8
mov rsi, rax
test rax, rax
je 0x180006f18
mov rcx, rax
call fcn.1800060a0
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x180006f23
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002c94
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r9, dword [rcx + 0x3c]
lea rbx, [rcx + 0x18]
add rbx, r9
xor r10d, r10d
xor edi, edi
mov r14, r8
mov r15, rdx
mov rbp, rcx
movzx eax, word [r9 + rcx + 0x14]
movzx esi, word [r9 + rcx + 6]
add rbx, rax
test esi, esi
je 0x140002d14
cmp dword [rbx], 0x45474150
je 0x140002cee
cmp dword [rbx], 0x7865742e
jne 0x140002d0a
cmp byte [rbx + 4], 0x74
jne 0x140002d0a
mov ecx, dword [rbx + 0xc]
mov r9, r14
mov edx, dword [rbx + 8]
add rcx, rbp
mov r8, r15
call fcn.140002c20
mov r10, rax
test rax, rax
jne 0x140002d14
inc edi
add rbx, 0x28
cmp edi, esi
jb 0x140002cd8
mov rbx, qword [rsp + 0x40]
mov rax, r10
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140002d30
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x150
xor ebp, ebp
lea r9, [rax + 0x18]
and dword [rax + 0x18], ebp
mov rsi, rdx
mov r14, rcx
xor r8d, r8d
xor edx, edx
lea edi, [rbp + 0xb]
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x140002dac
mov edx, dword [rsp + 0x180]
xor ecx, ecx
mov r8d, 0x6e556353
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x140002dac
mov r8d, dword [rsp + 0x180]
xor r9d, r9d
mov rdx, rax
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
jns 0x140002dc6
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
xor edi, edi
cmp dword [rbx], edi
jbe 0x140002e88
mov eax, edi
lea rcx, [rsp + 0x20]
imul rax, rax, 0x128
mov edx, 2
add rax, 8
add rax, rbx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140002dea
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rsp + 0x48]
call fcn.140002ed8
mov rcx, rax
mov rdx, r14
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x140002e78
inc edi
cmp edi, dword [rbx]
jb 0x140002dd0
jmp 0x140002e88
mov rbp, qword [rsp + 0x30]
test rsi, rsi
je 0x140002e88
mov ecx, dword [rsp + 0x38]
mov dword [rsi], ecx
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbp
jmp 0x140002dae
Function at 0x140002e9c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r8, rcx
test edx, edx
jne 0x140002ea6
xor eax, eax
ret
movzx eax, byte [rcx]
xor eax, 0x4f9ace2f
imul ecx, eax, 0x1000193
cmp edx, 1
jbe 0x140002ed3
inc r8
dec edx
movzx eax, byte [r8]
inc r8
xor eax, ecx
imul ecx, eax, 0x1000193
sub rdx, 1
jne 0x140002ebe
mov eax, ecx
ret

Function at 0x140002f90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov edi, r8d
mov ebx, ecx
mov edx, r8d
mov rcx, rsi
call fcn.140002e9c
xor ebx, eax
test edi, edi
je 0x140002fef
mov r8d, edi
imul ebx, ebx, 0x41c64e6d
mov eax, 0x80808081
add ebx, 0x3039
mov ecx, ebx
shr ecx, 0x10
and ecx, 0x7fff
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
xor byte [rsi], cl
inc rsi
sub r8, 1
jne 0x140002fbb
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400105c8
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x1400b1598]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r12d, r12d
lea rax, [rsp + 0x30]
mov qword [rdx], r12
lea r8, [rsp + 0x30]
mov r14d, r12d
sub rcx, rax
mov r15, rdx
mov r9d, 0x104
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x14001063d
movzx eax, word [rcx + r8]
test ax, ax
je 0x14001063d
mov word [r8], ax
add r8, 2
sub r9, 1
jne 0x140010619
lea rax, [r8 - 2]
test r9, r9
lea rcx, [rsp + 0x30]
cmovne rax, r8
lea r8, [0x1400869f0]
mov word [rax], r12w
call fcn.140007bcc
mov edi, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x1400106ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x1400107a1
mov rcx, qword [rbp + 0x178]
mov edx, 0xc9
call fcn.1400094ac
mov esi, eax
jmp 0x140010785
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r12d
mov rcx, rbx
mov dword [rsp + 0x20], r12d
call fcn.140009a58
mov esi, eax
test eax, eax
jns 0x1400106ea
mov rcx, qword [rbp + 0x178]
mov r9d, eax
mov edx, 0xcf
call fcn.140009470
mov rcx, rbx
call fcn.140009584
jmp 0x140010785
lea r8, [0x1400869f8]
lea rcx, [rsp + 0x30]
call fcn.140007bcc
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14001072d
mov rcx, qword [rbp + 0x178]
mov edx, 0xd5
call fcn.1400094ac
mov esi, eax
jmp 0x1400106dd
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140009a58
mov esi, eax
test eax, eax
jns 0x140010761
mov rcx, qword [rbp + 0x178]
mov r9d, eax
mov edx, 0xd7
call fcn.140009470
mov rcx, rdi
call fcn.140009584
jmp 0x1400106dd
mov rcx, rdi
call fcn.140009584
movsxd rax, dword [rsp + 0x20]
mov rcx, rbx
movsxd r14, dword [rsp + 0x24]
shl rax, 0x1f
or r14, rax
call fcn.140009584
mov esi, r12d
test esi, esi
jns 0x1400107a1
mov rcx, qword [rbp + 0x178]
mov r9d, esi
mov edx, 0x62
call fcn.140009470
mov eax, esi
jmp 0x1400107a6
mov qword [r15], r14
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140066030
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14002b6ec
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1400b1598]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, rdx
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.140004fec
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140006adc
xor ebx, ebx
test al, al
je 0x14002b789
lea rdi, [rsi + 8]
test rdi, rdi
je 0x14002b789
cmp byte [rsi + 0x4c], bl
je 0x14002b789
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
nop dword [rax + rax]
test eax, eax
je 0x14002b789
cmp byte [rsp + 0x6c], bl
je 0x14002b789
lea rcx, [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
nop dword [rax + rax]
test eax, eax
je 0x14002b789
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
setne bl
lea rcx, [rsp + 0x20]
call fcn.1400052a8
mov al, bl
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140066030
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14002b8bc
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x1400b1598]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x220
mov r9d, 0x20
lea r8d, [r9 - 0x1e]
lea rdx, [0x1400863f8]
lea rcx, [rsp + 0x40]
call fcn.1400050dc
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
nop dword [rax + rax]
test eax, eax
je 0x14002b92c
cmp dword [rsp + 0x34], 0
setne bl
xor dil, dil
jmp 0x14002b933
mov dil, 1
mov bl, byte [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400052a8
test dil, dil
je 0x14002b946
xor al, al
jmp 0x14002b94c
mov al, bl
jmp 0x14002b94c
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140066030
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rdi
ret

Function at 0x14002bb1c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor ebx, ebx
mov qword [rbp - 0x10], rbx
mov edx, 0x104
lea rcx, [rbp - 0x20]
call fcn.140037fc0
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
sub rdx, rcx
sar rdx, 1
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
je 0x14002bbd5
mov rcx, qword [rbp - 0x18]
mov rax, rcx
mov rdx, qword [rbp - 0x20]
sub rax, rdx
sar rax, 1
cmp r8, rax
jbe 0x14002bbb5
mov edx, r8d
lea rcx, [rbp - 0x20]
call fcn.140037fc0
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
sub rdx, rcx
sar rdx, 1
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov r8d, eax
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x20]
test r8d, r8d
je 0x14002bbd5
sub rcx, rdx
sar rcx, 1
mov eax, r8d
cmp rax, rcx
ja 0x14002bbd5
mov rcx, rdi
call fcn.140004344
nop
mov bl, 1
jmp 0x14002bbd5
lea rcx, [rbp - 0x20]
call fcn.14001fc44
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x140040b24
Capabilities:
Get system information on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1400b1598]
xor rax, rsp
mov qword [rbp + 0x80], rax
cmp dword [0x1400b26f0], 0
je 0x140040b5a
mov eax, dword [0x1400b26ec]
jmp 0x140040be1
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x118
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
nop dword [rax + rax]
movzx eax, word [rsp + 0x30]
mov r9b, byte [rbp + 0x7a]
mov edx, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
mov word [rsp + 0x28], ax
movzx eax, word [rbp + 0x78]
mov word [rsp + 0x20], ax
call fcn.140040c00
mov dword [0x1400b26ec], eax
mov dword [0x1400b26f0], 1
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140066030
add rsp, 0x190
pop rbp
ret

Function at 0x140041cd8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, r8
mov rsi, rdx
mov r14, rcx
and dword [rbp + 0x48], 0
and dword [rbp + 0x38], 0
cmp qword [rdx + 0x18], 8
jb 0x140041d06
mov rdx, qword [rdx]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x48]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140041e0d
mov ecx, dword [rbp + 0x38]
test ecx, ecx
je 0x140041e08
mov eax, dword [rbp + 0x48]
dec eax
cmp eax, 1
ja 0x140041e08
lea rbx, [rcx + 2]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.140042038
mov r8, rbx
xor edx, edx
mov rdi, qword [rbp - 0x20]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, [rdi + rbx]
mov qword [rbp - 0x18], rax
cmp qword [rsi + 0x18], 8
jb 0x140041d89
mov rsi, qword [rsi]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x48]
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140041dc2
mov rdx, rdi
mov rcx, r15
call fcn.140004344
nop
test rdi, rdi
je 0x140041e04
mov rdx, qword [rbp - 0x10]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x140041dfc
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041dfc
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
nop dword [rax + rax]
int3
mov rcx, rdi
call fcn.140066358
mov eax, ebx
jmp 0x140041e0d
mov eax, 0x65e
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140041e28
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
and dword [r9], 0
mov rsi, r9
cmp qword [rdx + 0x18], 8
mov rdi, r8
jb 0x140041e48
mov rdx, qword [rdx]
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140041eeb
mov rbx, qword [rsp + 0x50]
lea ecx, [rax + 0x18]
call fcn.140066058
lea rcx, vtable.appv::utility::scope_guard_func_impl_class_std::_Binder_struct_std::_Unforced__long_int____cdecl___struct_HKEY______ptr64___struct_HKEY______ptr64____ptr64__.0
mov qword [rsp + 0x68], rax
mov qword [rax], rcx
mov rcx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rbx
cmp qword [rdi + 0x18], 8
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], 4
jb 0x140041eb4
mov rdi, qword [rdi]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
lea rcx, [rsp + 0x58]
mov ebx, eax
call fcn.140006e84
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400433e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x140043407
mov rcx, qword [rdx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
lea esi, [rax + 1]
xor ebp, ebp
mov word [rsp + 0x58], bp
mov edx, esi
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x20]
call fcn.140041f64
nop
cmp qword [rdi + 0x18], 8
jb 0x14004343e
mov rdi, qword [rdi]
mov r8d, esi
mov rsi, qword [rsp + 0x20]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
test eax, eax
je 0x140043482
lea rdx, [0x1400865c8]
test rsi, rsi
cmovne rdx, rsi
mov rcx, rbx
call fcn.140004344
nop
lea rcx, [rsp + 0x20]
call fcn.14001fc44
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140046a34
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
and dword [rsp + 0x58], 0
mov ebx, edx
lea rdx, [rcx + 0x40]
mov dword [rsp + 0x40], r9d
cmp qword [rdx + 0x18], 8
jb 0x140046a58
mov rdx, qword [rdx]
mov rcx, qword [rcx + 0x60]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x140046ad3
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x140046aa7
inc rax
jmp 0x140046aae
lea rax, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
mov rdx, rax
lea rcx, [0x1400b2950]
call fcn.140016834
shl rax, 0x34
movabs rcx, 0x342500000000
or rax, rdi
or rax, rcx
jmp 0x140046b2b
cmp ebx, dword [rsp + 0x58]
je 0x140046b21
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x140046afb
inc rax
jmp 0x140046b02
lea rax, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
mov rdx, rax
lea rcx, [0x1400b2950]
call fcn.140016834
shl rax, 0x34
movabs rcx, 0x350500040002
jmp 0x140046ace
movabs rax, 0x8000000000
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret