joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001500
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x90], rcx
mov r12, rdx
call sub.msvcrt.dll_wcslen
mov r15, qword [rsp + 0x90]
mov rbp, rax
jmp 0x1400015a1
add rbp, 1
mov rax, rbx
sub rax, r15
sar rax, 1
sub rbp, rax
lea r10, [rbp + rbp]
lea ebp, [rdi - 1]
test r9d, r9d
jg 0x140001680
sub ebp, r9d
mov dword [rsp + 0x28], r9d
mov r8d, edi
mov rdx, rsi
movsxd rbp, ebp
mov qword [rsp + 0x38], r10
mov rcx, r13
mov qword [rsp + 0x30], r11
movzx ebp, word [rsi + rbp*2]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r9d, dword [rsp + 0x28]
test r9d, r9d
je 0x140001599
mov r11, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov rdx, rbx
lea rcx, [rbx + r11*2]
call sub.msvcrt.dll_memmove
mov word [rsi + rdi*2 - 2], bp
mov rbp, r14
lea rdx, section..rdata
mov rcx, r15
call sub.msvcrt.dll_wcsstr
mov rsi, rax
test rax, rax
je 0x1400016e8
lea r13, [rax + 4]
lea rdx, section..rdata
mov rcx, r13
call sub.msvcrt.dll_wcsstr
test rax, rax
je 0x1400016e8
xor edx, edx
lea rbx, [rax + 4]
xor r8d, r8d
mov rcx, r13
mov word [rax], dx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r9, rbx
sub r9, rsi
movsxd rdi, eax
sar r9, 1
not r9d
add r9d, edi
movsxd r11, r9d
lea r14, [r11 + rbp]
cmp r14, r12
jb 0x140001530
lea r12, [r12 + r12*2 + 0x30]
lea rax, [r14 + 1]
mov dword [rsp + 0x30], r9d
shr r12, 1
mov qword [rsp + 0x28], r11
cmp r14, r12
cmovae r12, rax
cmp r15, qword [rsp + 0x90]
lea rdx, [r12 + r12]
je 0x1400016b0
mov rcx, r15
call sub.msvcrt.dll_realloc
mov r11, qword [rsp + 0x28]
mov r9d, dword [rsp + 0x30]
test rax, rax
mov rcx, rax
je 0x1400016fc
add rbp, 1
mov rax, rcx
sub rax, r15
mov r15, rcx
add rsi, rax
add rbx, rax
lea r13, [rsi + 4]
jmp 0x140001534
lea rcx, [rbx + r11*2]
mov r8, r10
mov rdx, rbx
movsxd rbp, ebp
call sub.msvcrt.dll_memmove
movzx ebp, word [rsi + rbp*2]
mov r8d, edi
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x140001599
mov rcx, rdx
call sub.msvcrt.dll_malloc
mov rcx, rax
test rax, rax
je 0x1400016fc
add rbp, 1
mov rdx, r15
lea r8, [rbp + rbp]
call sub.msvcrt.dll_memcpy
mov r11, qword [rsp + 0x28]
mov r9d, dword [rsp + 0x30]
mov rcx, rax
jmp 0x14000165e
mov rax, r15
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 2
call qword [fcn.140002c90]
mov r8, r13
lea rdx, str.Substituting__s_results_in_too_large_a_command_line_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop word cs:[rax + rax]
nop
Function at 0x140001730
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, rcx
mov rbp, rdx
lea rdx, [rsp + 0x2c]
mov rsi, r8
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
mov eax, dword [rsp + 0x2c]
test eax, eax
jle 0x1400017b5
mov rdi, qword [rbx]
movzx ecx, word [rdi]
cmp cx, 0x5c
je 0x1400017a8
call qword [sym.imp.msvcrt.dll_isalpha]
test eax, eax
je 0x140001774
cmp word [rdi + 2], 0x3a
je 0x1400017a8
mov rdx, rbp
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
mov rdx, qword [rbx]
mov r8d, 0x1000
mov rcx, rsi
call fcn.140001450
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
jmp 0x140001790
mov ecx, 2
call qword [fcn.140002c90]
mov r8, rdi
lea rdx, str.Invalid_command_line:__s_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop dword [rax]

Function at 0x140001a20
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edi, r8d
mov rbx, rcx
mov r14, rdx
call sub.msvcrt.dll_wcscpy
test edi, edi
je 0x140001a53
js 0x140001a70
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140001b5c
mov eax, dword [section..data]
test eax, eax
js 0x140001b46
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rbp, qword [sym.imp.msvcrt.dll__waccess]
mov r13, qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r12, [0x14004a040]
jmp 0x140001a9e
mov rcx, rbx
call r13
test eax, eax
je 0x140001b5c
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov rsi, rax
mov eax, dword [section..data]
test eax, eax
jns 0x140001abb
mov rcx, rbx
call fcn.140001930
test eax, eax
jne 0x140001a61
mov r8d, 0x1000
mov rdx, r12
mov rcx, rbx
movsxd rsi, esi
call fcn.140001450
lea rsi, [rbx + rsi*2]
mov rcx, rbx
xor edx, edx
call rbp
xor ecx, ecx
mov word [rsi], cx
cmp eax, 0xffffffff
jne 0x140001a61
mov r8d, 0x1000
lea rdx, str.mingw_bin
mov rcx, rbx
call fcn.140001450
xor edx, edx
mov rcx, rbx
call rbp
xor edx, edx
mov word [rsi], dx
cmp eax, 0xffffffff
jne 0x140001a61
add edi, 1
jne 0x140001a90
mov ecx, 2
call qword [fcn.140002c90]
mov r8, r14
lea rdx, str.Top_level_not_found:__s_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call sub.msvcrt.dll_exit
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.140001930
mov ecx, 2
call qword [fcn.140002c90]
mov r8, r14
lea rdx, str.Invalid_executable_path:__s_n
mov rcx, rax
call sub.msvcrt.dll_fwprintf
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140001e70
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140002c90
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140002c90
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140001ee0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14004a124]
mov rbx, rcx
test esi, esi
jle 0x140002010
mov rax, qword [0x14004a128]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140001f2b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001fb5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001f10
mov rcx, rbx
call fcn.140002930
mov rdi, rax
test rax, rax
je 0x140002032
mov rax, qword [0x14004a128]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140002a70
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14004a128]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140002017
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001fae
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001fc0
add dword [0x14004a124], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14004a128]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001fae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001e70
nop dword [rax]
xor esi, esi
jmp 0x140001f38
mov rax, qword [0x14004a128]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001e70
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140001e70
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400025a0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14004a180]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14004a160]
test rbx, rbx
je 0x1400025fc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400025f3
test rsi, rsi
je 0x1400025f3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400025d8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140002930
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006d40]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002950
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002958
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002950
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400029ad
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400029a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002950
add rax, 0x28
cmp rax, r9
jne 0x140002990
xor eax, eax
ret

Function at 0x1400029b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006d40]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400029cf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400029d8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400029cf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002a70
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006d40]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140002a8f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002a98
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x14000bad8
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x1400ab2f8]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r12d, r12d
lea rax, [rsp + 0x30]
mov qword [rdx], r12
lea r8, [rsp + 0x30]
mov r14d, r12d
sub rcx, rax
mov r15, rdx
mov r9d, 0x104
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x14000bb4d
movzx eax, word [rcx + r8]
test ax, ax
je 0x14000bb4d
mov word [r8], ax
add r8, 2
sub r9, 1
jne 0x14000bb29
lea rax, [r8 - 2]
test r9, r9
lea rcx, [rsp + 0x30]
cmovne rax, r8
lea r8, [0x1400811a8]
mov word [rax], r12w
call fcn.14000708c
mov edi, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14000bbbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x14000bcb1
mov rcx, qword [rbp + 0x178]
mov edx, 0xc9
call fcn.14000890c
mov esi, eax
jmp 0x14000bc95
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r12d
mov rcx, rbx
mov dword [rsp + 0x20], r12d
call fcn.140008d3c
mov esi, eax
test eax, eax
jns 0x14000bbfa
mov rcx, qword [rbp + 0x178]
mov r9d, eax
mov edx, 0xcf
call fcn.1400088d0
mov rcx, rbx
call fcn.1400089a0
jmp 0x14000bc95
lea r8, [0x1400811b0]
lea rcx, [rsp + 0x30]
call fcn.14000708c
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14000bc3d
mov rcx, qword [rbp + 0x178]
mov edx, 0xd5
call fcn.14000890c
mov esi, eax
jmp 0x14000bbed
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140008d3c
mov esi, eax
test eax, eax
jns 0x14000bc71
mov rcx, qword [rbp + 0x178]
mov r9d, eax
mov edx, 0xd7
call fcn.1400088d0
mov rcx, rdi
call fcn.1400089a0
jmp 0x14000bbed
mov rcx, rdi
call fcn.1400089a0
movsxd rax, dword [rsp + 0x20]
mov rcx, rbx
movsxd r14, dword [rsp + 0x24]
shl rax, 0x1f
or r14, rax
call fcn.1400089a0
mov esi, r12d
test esi, esi
jns 0x14000bcb1
mov rcx, qword [rbp + 0x178]
mov r9d, esi
mov edx, 0x62
call fcn.1400088d0
mov eax, esi
jmp 0x14000bcb6
mov qword [r15], r14
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1400610e0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400269ec
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1400ab2f8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, rdx
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400044ac
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140005f9c
xor ebx, ebx
test al, al
je 0x140026a89
lea rdi, [rsi + 8]
test rdi, rdi
je 0x140026a89
cmp byte [rsi + 0x4c], bl
je 0x140026a89
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
nop dword [rax + rax]
test eax, eax
je 0x140026a89
cmp byte [rsp + 0x6c], bl
je 0x140026a89
lea rcx, [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
nop dword [rax + rax]
test eax, eax
je 0x140026a89
lea rdx, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
setne bl
lea rcx, [rsp + 0x20]
call fcn.140004768
mov al, bl
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400610e0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140026bbc
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x1400ab2f8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x220
mov r9d, 0x20
lea r8d, [r9 - 0x1e]
lea rdx, [0x1400839d8]
lea rcx, [rsp + 0x40]
call fcn.14000459c
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
nop dword [rax + rax]
test eax, eax
je 0x140026c2c
cmp dword [rsp + 0x34], 0
setne bl
xor dil, dil
jmp 0x140026c33
mov dil, 1
mov bl, byte [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140004768
test dil, dil
je 0x140026c46
xor al, al
jmp 0x140026c4c
mov al, bl
jmp 0x140026c4c
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400610e0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rdi
ret

Function at 0x140026e1c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor ebx, ebx
mov qword [rbp - 0x10], rbx
mov edx, 0x104
lea rcx, [rbp - 0x20]
call fcn.1400332c0
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
sub rdx, rcx
sar rdx, 1
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
je 0x140026ed5
mov rcx, qword [rbp - 0x18]
mov rax, rcx
mov rdx, qword [rbp - 0x20]
sub rax, rdx
sar rax, 1
cmp r8, rax
jbe 0x140026eb5
mov edx, r8d
lea rcx, [rbp - 0x20]
call fcn.1400332c0
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
sub rdx, rcx
sar rdx, 1
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov r8d, eax
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x20]
test r8d, r8d
je 0x140026ed5
sub rcx, rdx
sar rcx, 1
mov eax, r8d
cmp rax, rcx
ja 0x140026ed5
mov rcx, rdi
call fcn.140003804
nop
mov bl, 1
jmp 0x140026ed5
lea rcx, [rbp - 0x20]
call fcn.14001af44
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x14003be24
Capabilities:
Get system information on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1400ab2f8]
xor rax, rsp
mov qword [rbp + 0x80], rax
cmp dword [0x1400ac3e0], 0
je 0x14003be5a
mov eax, dword [0x1400ac3dc]
jmp 0x14003bee1
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x118
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
nop dword [rax + rax]
movzx eax, word [rsp + 0x30]
mov r9b, byte [rbp + 0x7a]
mov edx, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
mov word [rsp + 0x28], ax
movzx eax, word [rbp + 0x78]
mov word [rsp + 0x20], ax
call fcn.14003bf00
mov dword [0x1400ac3dc], eax
mov dword [0x1400ac3e0], 1
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400610e0
add rsp, 0x190
pop rbp
ret

Function at 0x14003cfd8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, r8
mov rsi, rdx
mov r14, rcx
and dword [rbp + 0x48], 0
and dword [rbp + 0x38], 0
cmp qword [rdx + 0x18], 8
jb 0x14003d006
mov rdx, qword [rdx]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x48]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14003d10d
mov ecx, dword [rbp + 0x38]
test ecx, ecx
je 0x14003d108
mov eax, dword [rbp + 0x48]
dec eax
cmp eax, 1
ja 0x14003d108
lea rbx, [rcx + 2]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.14003d338
mov r8, rbx
xor edx, edx
mov rdi, qword [rbp - 0x20]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, [rdi + rbx]
mov qword [rbp - 0x18], rax
cmp qword [rsi + 0x18], 8
jb 0x14003d089
mov rsi, qword [rsi]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x48]
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14003d0c2
mov rdx, rdi
mov rcx, r15
call fcn.140003804
nop
test rdi, rdi
je 0x14003d104
mov rdx, qword [rbp - 0x10]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003d0fc
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d0fc
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
nop dword [rax + rax]
int3
mov rcx, rdi
call fcn.140061408
mov eax, ebx
jmp 0x14003d10d
mov eax, 0x65e
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003d128
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
and dword [r9], 0
mov rsi, r9
cmp qword [rdx + 0x18], 8
mov rdi, r8
jb 0x14003d148
mov rdx, qword [rdx]
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14003d1eb
mov rbx, qword [rsp + 0x50]
lea ecx, [rax + 0x18]
call fcn.140061108
lea rcx, vtable.appv::utility::scope_guard_func_impl_class_std::_Binder_struct_std::_Unforced__long_int____cdecl___struct_HKEY______ptr64___struct_HKEY______ptr64____ptr64__.0
mov qword [rsp + 0x68], rax
mov qword [rax], rcx
mov rcx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rbx
cmp qword [rdi + 0x18], 8
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], 4
jb 0x14003d1b4
mov rdi, qword [rdi]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
lea rcx, [rsp + 0x58]
mov ebx, eax
call fcn.140006344
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x14003e6e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x14003e707
mov rcx, qword [rdx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
lea esi, [rax + 1]
xor ebp, ebp
mov word [rsp + 0x58], bp
mov edx, esi
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x20]
call fcn.14003d264
nop
cmp qword [rdi + 0x18], 8
jb 0x14003e73e
mov rdi, qword [rdi]
mov r8d, esi
mov rsi, qword [rsp + 0x20]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
test eax, eax
je 0x14003e782
lea rdx, [0x140084908]
test rsi, rsi
cmovne rdx, rsi
mov rcx, rbx
call fcn.140003804
nop
lea rcx, [rsp + 0x20]
call fcn.14001af44
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140041d34
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
and dword [rsp + 0x58], 0
mov ebx, edx
lea rdx, [rcx + 0x40]
mov dword [rsp + 0x40], r9d
cmp qword [rdx + 0x18], 8
jb 0x140041d58
mov rdx, qword [rdx]
mov rcx, qword [rcx + 0x60]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x140041dd3
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x140041da7
inc rax
jmp 0x140041dae
lea rax, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
mov rdx, rax
lea rcx, [0x1400ac650]
call fcn.140011b34
shl rax, 0x34
movabs rcx, 0x342500000000
or rax, rdi
or rax, rcx
jmp 0x140041e2b
cmp ebx, dword [rsp + 0x58]
je 0x140041e21
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x140041dfb
inc rax
jmp 0x140041e02
lea rax, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
mov rdx, rax
lea rcx, [0x1400ac650]
call fcn.140011b34
shl rax, 0x34
movabs rcx, 0x350500040002
jmp 0x140041dce
movabs rax, 0x8000000000
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140041f90
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
and dword [rax + 0x20], 0
mov esi, edx
and dword [rax + 8], 0
lea rdx, [rcx + 0x40]
cmp qword [rdx + 0x18], 8
mov rdi, r8
jb 0x140041fbb
mov rdx, qword [rdx]
mov rcx, qword [rcx + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0xea
je 0x140042041
test eax, eax
je 0x140042041
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x140042012
inc rax
jmp 0x140042019
lea rax, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
mov rdx, rax
lea rcx, [0x1400ac650]
call fcn.140011b34
shl rax, 0x34
movabs rcx, 0x312500000000
or rax, rbx
or rax, rcx
jmp 0x1400420f1
cmp esi, dword [rsp + 0x40]
je 0x14004208f
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x140042069
inc rax
jmp 0x140042070
lea rax, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
mov rdx, rax
lea rcx, [0x1400ac650]
call fcn.140011b34
shl rax, 0x34
movabs rcx, 0x320500040002
jmp 0x140042039
mov eax, dword [rsp + 0x58]
cmp eax, 0x4000
jb 0x1400420e5
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x1400420bc
inc rax
jmp 0x1400420c3
lea rax, str.admin_appman_appv_sharedclientconfigurationRegistryValue.h
mov rdx, rax
lea rcx, [0x1400ac650]
call fcn.140011b34
shl rax, 0x34
movabs rcx, 0x330500040003
jmp 0x140042039
mov dword [rdi], eax
movabs rax, 0x8000000000
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret