joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2d600
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rax, str._Volume::loadClusterRange_:_entry
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 4
mov dx, 5
mov cx, 0xb3
call fcn.00011a90
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0x34]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xa8]
call fcn.00015500
mov rcx, rax
call fcn.00012e50
mov rcx, qword [rsp + 0x58]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x60]
call fcn.00022bb0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax + 0x88]
call sub.ntdll.dll_NtReadFile
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x2d70d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax + 0x88]
call sub.ntdll.dll_NtWaitForSingleObject
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x2d70d
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x50], eax
xor eax, eax
add rsp, 0x88
ret
Function at 0x316e0
Capabilities:
Inspect section memory permissions

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
cmp qword [rsp + 0xe0], 0
jne 0x31736
lea rax, str.File_name_is_NULL
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 7
mov cx, 0x4f
call fcn.00011a90
mov rax, 0xffffffffffffffff
jmp 0x3195e
mov dword [rsp + 0x60], 0x120089
mov eax, dword [rsp + 0xe8]
and eax, 0x80000000
test eax, eax
jne 0x3175e
mov eax, dword [rsp + 0xe8]
and eax, 0x10000000
test eax, eax
je 0x3176b
mov eax, dword [rsp + 0x60]
or eax, 0x120089
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0xe8]
and eax, 0x40000000
test eax, eax
jne 0x3178b
mov eax, dword [rsp + 0xe8]
and eax, 0x10000000
test eax, eax
je 0x31798
mov eax, dword [rsp + 0x60]
or eax, 0x120116
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0xe8]
and eax, 0x20000000
test eax, eax
jne 0x317b8
mov eax, dword [rsp + 0xe8]
and eax, 0x10000000
test eax, eax
je 0x317c5
mov eax, dword [rsp + 0x60]
or eax, 0x1200a0
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], 1
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 1
je 0x317fd
cmp dword [rsp + 0x64], 2
je 0x31807
cmp dword [rsp + 0x64], 3
je 0x31811
cmp dword [rsp + 0x64], 4
je 0x317fd
cmp dword [rsp + 0x64], 5
je 0x3181b
jmp 0x31825
mov dword [rsp + 0x68], 3
jmp 0x31856
mov dword [rsp + 0x68], 0
jmp 0x31856
mov dword [rsp + 0x68], 1
jmp 0x31856
mov dword [rsp + 0x68], 5
jmp 0x31856
lea rax, str.Invalid_file_creation_disposition
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 7
mov cx, 0x77
call fcn.00011a90
mov rax, 0xffffffffffffffff
jmp 0x3195e
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0xa8]
call sub.ntdll.dll_RtlInitUnicodeString
mov dword [rsp + 0x78], 0x30
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x90], 0x40
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x70], 0xffffffffffffffff
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x60
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x108]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0x78]
mov edx, dword [rsp + 0x60]
lea rcx, [rsp + 0x70]
call sub.ntdll.dll_NtCreateFile
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0
jl 0x3192b
cmp dword [rsp + 0xb8], 0
jge 0x31959
lea rax, str.File_creation_failed
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 7
mov cx, 0x92
call fcn.00011a90
mov rax, 0xffffffffffffffff
jmp 0x3195e
mov rax, qword [rsp + 0x70]
add rsp, 0xd8
ret
Function at 0x31980
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x80], 0xffffffffffffffff
jne 0x319cf
lea rax, [0x0003aa68]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 7
mov cx, 0xcc
call fcn.00011a90
xor eax, eax
jmp 0x31a74
mov rax, qword [rsp + 0x98]
mov dword [rax], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call sub.ntdll.dll_NtReadFile
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x31a38
cmp dword [rsp + 0x58], 0
jge 0x31a61
lea rax, str.Read_file_failed
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 7
mov cx, 0xe0
call fcn.00011a90
xor eax, eax
jmp 0x31a74
mov rax, qword [rsp + 0x98]
mov ecx, dword [rsp + 0x60]
mov dword [rax], ecx
mov eax, 1
add rsp, 0x78
ret

Function at 0x31bc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x80], 0xffffffffffffffff
jne 0x31c0f
lea rax, [0x0003aaa8]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 7
mov cx, 0x106
call fcn.00011a90
xor eax, eax
jmp 0x31cb4
mov rax, qword [rsp + 0x98]
mov dword [rax], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call sub.ntdll.dll_NtWriteFile
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x31c78
cmp dword [rsp + 0x58], 0
jge 0x31ca1
lea rax, str.Write_file_failed
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 7
mov cx, 0x11b
call fcn.00011a90
xor eax, eax
jmp 0x31cb4
mov rax, qword [rsp + 0x98]
mov ecx, dword [rsp + 0x60]
mov dword [rax], ecx
mov eax, 1
add rsp, 0x78
ret
Function at 0x327c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x98]
mov qword [rax], 0xffffffffffffffff
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffffffffffff
call sub.ntdll.dll_RtlCreateUserThread
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x32855
mov rax, qword [rsp + 0x98]
cmp qword [rax], 0xffffffffffffffff
jne 0x328ab
lea rax, str._CreateThread_:_Thread_creation_failed
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 8
mov cx, 0x356
call fcn.00011a90
mov rax, qword [rsp + 0x98]
cmp qword [rax], 0xffffffffffffffff
je 0x328a7
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call fcn.00031670
mov rax, qword [rsp + 0x98]
mov qword [rax], 0xffffffffffffffff
xor eax, eax
jmp 0x328b6
mov rax, qword [rsp + 0x98]
mov rax, qword [rax]
add rsp, 0x68
ret

Function at 0x328c0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
lea rax, [0x0003adac]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 4
mov dx, 8
mov cx, 0x4b
call fcn.00011a90
cmp qword [rsp + 0x70], 0xffffffffffffffff
jne 0x32927
lea rax, str.Invalid_handle_provided_as_a_parameter
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 8
mov cx, 0x4e
call fcn.00011a90
xor eax, eax
jmp 0x329e2
cmp qword [rsp + 0x78], 0
jne 0x3295b
lea rax, str.NULL_pointer_provided_as_a_parameter
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 8
mov cx, 0x54
call fcn.00011a90
xor eax, eax
jmp 0x329e2
mov rax, qword [rsp + 0x78]
mov qword [rax], 0
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.0001be70
mov dword [rsp + 0x20], 5
mov r9d, 0x18
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x329d0
lea rax, str.NtQueryInformationFile_failed
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 8
mov cx, 0x64
call fcn.00011a90
xor eax, eax
jmp 0x329e2
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov eax, 1
add rsp, 0x68
ret
Function at 0x334c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
lea rax, [0x0003ae28]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 4
mov dx, 8
mov cx, 0x71
call fcn.00011a90
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetServicesiaStorAfsService
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x78], 0x40
lea rax, [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x38], 0xffffffffffffffff
lea r8, [rsp + 0x60]
mov edx, 0xf003f
lea rcx, [rsp + 0x38]
call sub.ntdll.dll_NtOpenKey
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jge 0x33592
lea rax, str.Opening_iaStorAfsService_registry_key_failed
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 8
mov cx, 0x7d
call fcn.00011a90
xor al, al
jmp 0x33738
mov dword [rsp + 0x30], 0
lea rdx, str.DumpMemoryLevel
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call sub.ntdll.dll_NtQueryValueKey
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0xc0000023
je 0x3361b
lea rax, str.Checking_DumpMemoryLevel_registry_key_size_failed
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 8
mov cx, 0x88
call fcn.00011a90
mov rcx, qword [rsp + 0x38]
call fcn.00031670
xor al, al
jmp 0x33738
mov eax, dword [rsp + 0x30]
add rax, 2
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov ecx, eax
call fcn.00031600
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x33675
lea rax, [0x0003af48]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 8
mov cx, 0x92
call fcn.00011a90
mov rcx, qword [rsp + 0x38]
call fcn.00031670
xor al, al
jmp 0x33738
mov eax, dword [rsp + 0x30]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.0001be70
mov dword [rsp + 0x48], 0
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
mov r8d, 2
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call sub.ntdll.dll_NtQueryValueKey
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jge 0x33705
lea rax, str.Reading_DumpMemoryLevel_registry_key_failed
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 8
mov cx, 0x9f
call fcn.00011a90
mov rcx, qword [rsp + 0x40]
call fcn.00031570
mov rcx, qword [rsp + 0x38]
call fcn.00031670
xor al, al
jmp 0x33738
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax + 0xc]
mov rcx, qword [rsp + 0xa0]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x40]
call fcn.00031570
mov rcx, qword [rsp + 0x38]
call fcn.00031670
mov al, 1
add rsp, 0x98
ret
Function at 0x338f0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x78
lea rax, [0x0003b344]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 4
mov dx, 8
mov cx, 0x2b7
call fcn.00011a90
mov eax, dword [0x0003f220]
mov dword [rsp + 0x54], eax
xor eax, eax
lea rcx, [0x0003f250]
xchg dword [rcx], eax
mov dword [rsp + 0x50], 0
jmp 0x33942
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
cmp dword [rsp + 0x50], eax
jge 0x33a40
mov qword [rsp + 0x60], 0xffffffffffffffff
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x18
lea rcx, [0x0003f1c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x000329f0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffffffffffff
call sub.ntdll.dll_RtlCreateUserThread
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jl 0x339cc
cmp qword [rsp + 0x60], 0xffffffffffffffff
jne 0x33a1e
lea rax, str.Thread_creation_failed
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 8
mov cx, 0x2cc
call fcn.00011a90
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x18
lea rcx, [0x0003f1c0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.00032de0
mov rcx, qword [rsp + 0x60]
call fcn.00031670
jmp 0x33938
lea rax, [0x0003f224]
lock inc dword [rax]
mov rcx, qword [rsp + 0x60]
call fcn.00031670
mov qword [rsp + 0x60], 0xffffffffffffffff
jmp 0x33938
mov eax, dword [0x0003f224]
add rsp, 0x78
ret
Function at 0x340a0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x88
lea rax, [0x0003af64]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 4
mov dx, 8
mov cx, 0xaf
call fcn.00011a90
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.000334c0
movzx eax, al
cmp eax, 1
jne 0x34209
cmp dword [rsp + 0x30], 3
jbe 0x340fc
cmp dword [rsp + 0x30], 7
jne 0x34209
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetControlCrashControl
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x40
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x38], 0xffffffffffffffff
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x38]
call sub.ntdll.dll_NtOpenKey
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jge 0x34192
lea rax, str.Opening_CrashControl_registry_key_failed
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 8
mov cx, 0xc8
call fcn.00011a90
jmp 0x34209
lea rdx, str.CrashDumpEnabled
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov qword [rsp + 0x28], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call sub.ntdll.dll_NtSetValueKey
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jge 0x341ff
lea rax, str.Setting_CrashControl_registry_key_failed
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8d, 2
mov dx, 8
mov cx, 0xd0
call fcn.00011a90
mov rcx, qword [rsp + 0x38]
call fcn.00031670
add rsp, 0x88
ret
Function at 0x344a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [rsp + 0xa0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x78], 0x40
lea rax, [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x38], 0xffffffffffffffff
lea r8, [rsp + 0x60]
mov edx, 0xf003f
lea rcx, [rsp + 0x38]
call sub.ntdll.dll_NtOpenKey
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jge 0x34534
mov eax, 0x57
jmp 0x34679
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0xa0]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call sub.ntdll.dll_NtQueryValueKey
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0xc0000023
je 0x345a0
mov rcx, qword [rsp + 0x38]
call fcn.00031670
mov eax, 0x57
jmp 0x34679
mov eax, dword [rsp + 0x30]
add rax, 2
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov ecx, eax
call fcn.00031600
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x345d8
mov rcx, qword [rsp + 0x38]
call fcn.00031670
mov eax, 0x57
jmp 0x34679
mov eax, dword [rsp + 0x30]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.0001be70
mov dword [rsp + 0x48], 0
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
mov r8d, 2
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call sub.ntdll.dll_NtQueryValueKey
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jge 0x34646
mov rcx, qword [rsp + 0x40]
call fcn.00031570
mov rcx, qword [rsp + 0x38]
call fcn.00031670
mov eax, 0x57
jmp 0x34679
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax + 0xc]
mov rcx, qword [rsp + 0xa8]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x40]
call fcn.00031570
mov rcx, qword [rsp + 0x38]
call fcn.00031670
xor eax, eax
add rsp, 0x98
ret
Function at 0x347d0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
mov rdx, qword [rax]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x40
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x38], 0xffffffffffffffff
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x38]
call sub.ntdll.dll_NtOpenKey
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x3485a
mov eax, 0x57
jmp 0x348c7
mov rax, qword [rsp + 0x90]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov qword [rsp + 0x28], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call sub.ntdll.dll_NtSetValueKey
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x348bb
mov rcx, qword [rsp + 0x38]
call fcn.00031670
mov eax, 0x57
jmp 0x348c7
mov rcx, qword [rsp + 0x38]
call fcn.00031670
xor eax, eax
add rsp, 0x88
ret
Function at 0x1402c732c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x1402ae00e
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x1402adff1
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1402adfdc

Function at 0x1402c7340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x1402ae046
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x1402ae029
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1402ae014

Function at 0x1402d4f6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402d4fb6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402d4fb6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402d4fb6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402d4fb6
cmp dword [rcx + 0x84], 0xe
jbe 0x1402d4fb6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1402d4fb8
xor al, al
add rsp, 0x28
ret

Function at 0x1402e936c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1402e9163
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402e9163
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402e9163
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402e9163
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402e9163
cmp dword [rcx + 0x84], 0xe
jbe 0x1402e9163
cmp dword [rcx + 0xf8], 0
je 0x1402e9163
mov ecx, ebx
call fcn.1402e9274
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1402e8ebc
nop
cmp dword [rbp + 0x20], 0
je 0x1402e91b1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1402e91bc
int3
xor r8d, r8d
xor edx, edx
jmp 0x1402e90f4
Function at 0x14032b204
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14032b234
xor eax, eax
jmp 0x14032b2f7
mov rbp, rbx
cmp word [rax], si
je 0x14032b259
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14032b240
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14032b23c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140327360
movsxd r14, eax
test eax, eax
jne 0x14032b297
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14032b22d
mov rcx, r14
call fcn.1403200fc
mov rdi, rax
test rax, rax
jne 0x14032b2b0
xor ecx, ecx
call fcn.140320164
jmp 0x14032b28c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140327360
test eax, eax
jne 0x14032b2e1
mov rcx, rdi
call fcn.140320164
jmp 0x14032b2eb
xor ecx, ecx
call fcn.140320164
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14032b314
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14032b39b
mov rsi, rbx
cmp word [rax], bp
je 0x14032b35a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14032b344
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14032b340
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1403200fc
mov rdi, rax
test rax, rax
je 0x14032b388
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1402d5a20
mov rbp, rdi
xor ecx, ecx
call fcn.140320164
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret