joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010d8b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
and dword [rax - 0x28], 0
and dword [rax - 0x24], 0
and qword [rax - 0x20], 0
and qword [rax - 0x38], 0
and qword [rax - 0x30], 0
mov r13, rcx
xor ecx, ecx
mov rbp, r8
mov r12, rdx
mov qword [rax + 0x20], rcx
xor esi, esi
lea rbx, [0x100049300]
test rcx, rcx
je 0x10010d912
call fcn.100274cac
and qword [rsp + 0x88], 0
mov r8d, dword [rbx - 8]
mov rcx, qword [r13 + 0x20]
lea r9, [rsp + 0x88]
mov rdx, r12
call fcn.100275320
mov edi, eax
test eax, eax
js 0x10010d9ec
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call fcn.10005c2cc
mov edi, eax
test eax, eax
js 0x10010d9ec
mov rcx, qword [rsp + 0x88]
lea rdx, [rsp + 0x38]
call fcn.10005c2cc
mov edi, eax
test eax, eax
js 0x10010d9ec
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.10010f684
mov edi, eax
test eax, eax
js 0x10010d9ec
inc esi
add rbx, 0x10
cmp esi, 2
jae 0x10010d994
mov rcx, qword [rsp + 0x88]
jmp 0x10010d8ff
and dword [rsp + 0x20], 0
and dword [rsp + 0x24], 0
and qword [rsp + 0x28], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.10011089c
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.10011089c
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.1001106c8
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x10010da1d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10010da1d
mov rcx, qword [0x1004a9500]
lea rax, [0x1004a9500]
cmp rcx, rax
je 0x10010da1d
test byte [rcx + 0x3c], 2
je 0x10010da1d
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a318]
mov edx, 0x12
mov r9d, edi
call fcn.10005c358
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x10010da38
call fcn.100274cac
and qword [rsp + 0x88], 0
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x10010da57
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x10010da76
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.1001106c8
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x10010daa0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x100116e58
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r13, rdx
mov r15, rcx
xor edi, edi
and qword [rax - 0x38], rdi
and qword [rax - 0x30], rdi
lea rdx, [rax - 0x30]
mov rcx, r13
mov r12, r9
mov r14, r8
or rbx, 0xffffffffffffffff
call fcn.100085208
mov rsi, qword [rsp + 0x58]
mov ebp, eax
test eax, eax
js 0x100116fe1
and qword [rsp + 0x30], rdi
and dword [rsp + 0x28], edi
lea r8d, [rbx + 2]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rsi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x100116fba
cmp rax, 0xffffffffffffffff
je 0x100116fba
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp eax, 0xffffffff
je 0x100116fbe
cmp dword [rsp + 0x40], edi
je 0x100116f0e
mov ebp, 0x80070057
jmp 0x100116fe1
cmp ebp, 0x100000
ja 0x100116f04
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x100116f3c
mov ebp, 0x8007000e
jmp 0x100116fe1
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, ebp
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100116fbe
cmp dword [rsp + 0x44], ebp
je 0x100116f67
mov ebp, 0x8000ffff
jmp 0x100116fe1
mov rcx, qword [r15 + 0xb8]
lea rdx, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
mov r8d, ebp
mov rdx, rdi
call qword [rax + 0x18]
mov ebp, eax
test eax, eax
js 0x100116fe1
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov r9, r12
mov r8, r14
call fcn.1001181c0
mov ebp, eax
test eax, eax
js 0x100116fe1
lea rdx, [r12 + 0x38]
mov rcx, r13
call fcn.10005c2cc
mov ebp, eax
jmp 0x100116fdd
or rbx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100116fcf
mov ebp, 0x80004005
jmp 0x100116fe1
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
test ebp, ebp
jns 0x100117012
mov rcx, qword [0x1004a9500]
lea rax, [0x1004a9500]
cmp rcx, rax
je 0x100117012
test byte [rcx + 0x3c], 2
je 0x100117012
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a248]
mov edx, 0x21
mov r9d, ebp
call fcn.10005c358
test rsi, rsi
je 0x10011702c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x100117042
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rsp + 0x50], 0
test rdi, rdi
je 0x10011705b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x10011706f
cmp rbx, 0xffffffffffffffff
je 0x10011706f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x60]
mov eax, ebp
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100128318
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
test edx, edx
je 0x1001283f7
cmp dword [rcx + 0x20], 0
jne 0x1001283f7
mov rcx, qword [0x1004a9500]
lea rbx, [0x1004a9500]
cmp rcx, rbx
je 0x100128371
mov eax, dword [rcx + 0x3c]
mov edx, 0x8000004
and eax, edx
cmp eax, edx
jne 0x100128371
mov r9, qword [rdi + 0x10]
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a148]
mov edx, 0xf
call fcn.100112790
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x10012838b
cmp rcx, 0xffffffffffffffff
je 0x10012838b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rdi + 8], 0xffffffffffffffff
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001283a3
mov rdx, qword [rdi + 0x10]
jmp 0x1001284e2
mov rax, qword [0x1004a9500]
cmp rax, rbx
je 0x1001284ea
mov eax, dword [rax + 0x3c]
mov ecx, 0x1000004
and eax, ecx
cmp eax, ecx
jne 0x1001284ea
mov rbx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1004a9500]
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a148]
mov edx, 0x10
mov r9, rbx
mov dword [rsp + 0x20], eax
call fcn.1000d529c
jmp 0x1001284ea
mov rax, qword [rcx + 8]
test rax, rax
je 0x1001284ea
cmp rax, 0xffffffffffffffff
je 0x1001284ea
test rax, rax
je 0x1001284ea
cmp dword [rcx], 0
lea rbx, [0x1004a9500]
jne 0x100128478
cmp dword [rcx + 0x20], 0
jne 0x100128478
mov rcx, qword [0x1004a9500]
cmp rcx, rbx
je 0x100128458
mov eax, dword [rcx + 0x3c]
mov edx, 0x8000004
and eax, edx
cmp eax, edx
jne 0x100128458
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a148]
mov edx, 0x11
call fcn.100126004
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x100128467
cmp rcx, 0xffffffffffffffff
jne 0x100128469
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
test eax, eax
sete cl
mov dword [rdi], ecx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x100128492
cmp rcx, 0xffffffffffffffff
je 0x100128492
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rdi + 8], 0xffffffffffffffff
cmp dword [rdi + 0x20], 0
jne 0x1001284ea
cmp dword [rdi], 0
je 0x1001284de
mov r10, qword [0x1004a9500]
cmp r10, rbx
je 0x10012839a
mov eax, dword [r10 + 0x3c]
mov ecx, 0x1000004
and eax, ecx
cmp eax, ecx
jne 0x10012839a
mov r9, qword [rdi + 0x10]
mov rcx, qword [r10 + 0x30]
lea r8, [0x10003a148]
mov edx, 0x12
call fcn.100112790
jmp 0x10012839a
mov rdx, qword [rdi + 0x18]
mov rcx, rdi
call fcn.100128f18
mov dword [rdi + 0x20], 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x100128c6c
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 8]
xor ebx, ebx
mov rdi, rdx
test rax, rax
je 0x100128cc9
cmp rax, 0xffffffffffffffff
je 0x100128cc9
test rax, rax
je 0x100128cc9
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x100128c9a
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x100128cc1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100128cc9
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100128cc3
mov dword [rdi], eax
test ebx, ebx
jns 0x100128cff
jmp 0x100128cce
mov ebx, 0x80004005
mov rcx, qword [0x1004a9500]
lea rax, [0x1004a9500]
cmp rcx, rax
je 0x100128cff
test byte [rcx + 0x3c], 2
je 0x100128cff
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a148]
mov edx, 0x13
mov r9d, ebx
call fcn.10005c358
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100128e30
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x50
and qword [r11 - 0x28], 0
xor eax, eax
xor ebx, ebx
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x10], rax
mov rax, qword [rcx + 8]
mov edi, r8d
test rax, rax
je 0x100128ed4
cmp rax, 0xffffffffffffffff
je 0x100128ed4
test rax, rax
je 0x100128ed4
mov rcx, qword [rcx + 8]
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x40], eax
test rcx, rcx
je 0x100128e82
cmp rcx, 0xffffffffffffffff
jne 0x100128e84
xor ecx, ecx
neg r9d
lea r8, [rsp + 0x30]
lea r9, [rsp + 0x60]
sbb rax, rax
and rax, r8
mov r8d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100128ec3
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100128ed4
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100128ece
cmp dword [rsp + 0x60], edi
je 0x100128f0a
mov ebx, 0x8004e109
test ebx, ebx
jns 0x100128f0a
jmp 0x100128ed9
mov ebx, 0x80004005
mov rcx, qword [0x1004a9500]
lea rax, [0x1004a9500]
cmp rcx, rax
je 0x100128f0a
test byte [rcx + 0x3c], 2
je 0x100128f0a
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a148]
mov edx, 0x16
mov r9d, ebx
call fcn.10005c358
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x100128f18
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x20
mov rcx, rdx
mov rdi, rdx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10012900e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbp, [0x1004a9500]
cmp eax, 5
jne 0x100128f62
lea edx, [rbx + 1]
mov rcx, rdi
call fcn.1000b9044
mov ebx, eax
test eax, eax
js 0x100128f7f
jmp 0x100128f7b
test eax, eax
jne 0x100128f6d
mov ebx, 0x80004005
jmp 0x100128f7f
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x100128fa9
mov rcx, qword [0x1004a9500]
cmp rcx, rbp
je 0x100128fb0
test byte [rcx + 0x3c], 2
je 0x100128fb0
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a148]
mov edx, 0x1e
mov r9d, ebx
call fcn.10005c358
mov rcx, qword [0x1004a9500]
test ebx, ebx
js 0x100128feb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100128fe0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100128fd2
mov ebx, 0x80004005
jmp 0x100128fe4
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x10012900e
mov rcx, qword [0x1004a9500]
cmp rcx, rbp
je 0x10012900e
test byte [rcx + 0x3c], 2
je 0x10012900e
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a148]
mov edx, 0x1f
mov r9d, ebx
call fcn.10005c358
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x10012909c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov esi, r8d
mov r12, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [rbp + 0x68], 0
mov dword [rbp + 0x68], 1
mov edi, eax
mov eax, dword [0x1004c64a8]
lea r14, [0x1004a9500]
cmove eax, edi
xor ebx, ebx
mov dword [0x1004c64a8], eax
mov rax, qword [rbp + 8]
test rax, rax
je 0x10012914c
cmp rax, 0xffffffffffffffff
je 0x10012914c
test rax, rax
je 0x10012914c
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x100129107
xor ecx, ecx
and qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
mov r8d, esi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10012913b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10012914c
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100129146
cmp dword [rsp + 0x50], esi
je 0x10012917b
mov ebx, 0x8004e10a
test ebx, ebx
js 0x100129151
jmp 0x10012917b
mov ebx, 0x80004005
mov rcx, qword [0x1004a9500]
cmp rcx, r14
je 0x100129182
test byte [rcx + 0x3c], 2
je 0x100129182
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a148]
mov edx, 0x17
mov r9d, ebx
call fcn.10005c358
mov rcx, qword [0x1004a9500]
test ebx, ebx
js 0x1001291d3
cmp qword [rbp + 0x60], 0
je 0x1001291cf
sub edi, dword [0x1004c64a8]
mov eax, 0x1d4c0
cmp edi, eax
jae 0x1001291a0
sub eax, edi
jmp 0x1001291a2
xor eax, eax
mov rdx, qword [rbp + 0x60]
mov rcx, qword [0x1004c4360]
mov r8d, 0x4e20
cmp eax, r8d
mov r9d, 0xfffffffe
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov rcx, qword [0x1004a9500]
xor ebx, ebx
test ebx, ebx
jns 0x1001291f6
cmp rcx, r14
je 0x1001291f6
test byte [rcx + 0x3c], 2
je 0x1001291f6
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a148]
mov edx, 0x29
mov r9d, ebx
call fcn.10005c358
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x10012c480
Capabilities:
Check if file exists
Copy file
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x20], 0
mov rdi, rcx
jne 0x10012c49f
xor ebx, ebx
jmp 0x10012c5c8
lea rdx, [rsp + 0x30]
call fcn.100129214
lea rsi, [0x1004a9500]
mov ebx, eax
test eax, eax
js 0x10012c59e
xor edx, edx
mov rcx, rdi
call fcn.100128318
mov rdx, qword [rdi + 0x18]
mov rcx, rdi
call fcn.100128f18
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10012c4fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10012c5da
mov ebx, 0x80004005
jmp 0x10012c59e
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 0x18]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x10012c4e5
mov rbx, qword [rdi + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10012c533
bts eax, 0xd
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r9, qword [rdi + 0x10]
mov edx, 0xc0000000
mov r8d, 4
mov rcx, rdi
call fcn.10012dbec
mov ebx, eax
test eax, eax
jns 0x10012c57a
mov rcx, qword [0x1004a9500]
cmp rcx, rsi
je 0x10012c581
test byte [rcx + 0x3c], 2
je 0x10012c581
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a148]
mov edx, 0x1c
mov r9d, eax
call fcn.10005c358
mov rcx, qword [0x1004a9500]
test ebx, ebx
js 0x10012c5a5
mov edx, dword [rsp + 0x30]
and dword [rdi + 0x20], 0
xor r8d, r8d
mov rcx, rdi
call fcn.100128d0c
mov ebx, eax
test ebx, ebx
jns 0x10012c5c8
mov rcx, qword [0x1004a9500]
cmp rcx, rsi
je 0x10012c5c8
test byte [rcx + 0x3c], 2
je 0x10012c5c8
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a148]
mov edx, 0x18
mov r9d, ebx
call fcn.10005c358
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10012c59a
Function at 0x10012d254
Capabilities:
Access the windows event log

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x50
movzx ebp, dx
lea rdx, [0x10004a2c0]
xor r12d, r12d
xor ecx, ecx
mov esi, r8d
mov edi, r12d
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
cmp rax, r12
jne 0x10012d295
mov rbx, r12
jmp 0x10012d2c6
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
xor r8d, r8d
mov r9d, esi
movzx edx, bp
mov rcx, rax
mov word [rsp + 0x28], r12w
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp eax, r12d
jne 0x10012d31d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, r12d
jne 0x10012d2d8
mov edi, 0x80004005
jmp 0x10012d2ec
movzx edi, ax
or edi, 0x80070000
cmp eax, r12d
cmovle edi, eax
cmp edi, r12d
jge 0x10012d31d
mov rcx, qword [0x1004a9500]
lea rax, [0x1004a9500]
cmp rcx, rax
je 0x10012d31d
test byte [rcx + 0x3c], 2
je 0x10012d31d
mov rcx, qword [rcx + 0x30]
lea r8, [0x10003a148]
mov edx, 0x19
mov r9d, edi
call fcn.10005c358
cmp rbx, r12
je 0x10012d32b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, edi
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
Function at 0x100133a18
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1004c4740]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp qword [0x1004c4d90], 0
jne 0x100133b85
cmp byte [0x1004c4d6d], 0
jne 0x100133b06
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100133a76
cmp dword [rsp + 0x54], 6
setb al
mov byte [0x1004c4d6e], al
test al, al
jne 0x100133ad9
lea rcx, [0x1000ba1a0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x100133ad1
lea rdx, [0x10042f950]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1004c4d70], rax
test rax, rax
je 0x100133ad1
lea rdx, [0x100015050]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1004a9c10], rax
test rax, rax
jne 0x100133ae2
lea rax, [0x100133868]
mov qword [0x1004a9c10], rax
mov al, 1
mov byte [0x1004c4d6e], al
mov byte [0x1004c4d6d], 1
jmp 0x100133b0c
lea rdx, [0x100038f10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1004c4d88], rax
test rax, rax
je 0x100133ac3
mov al, byte [0x1004c4d6e]
jmp 0x100133ad9
mov al, byte [0x1004c4d6e]
test al, al
jne 0x100133b34
lea r9, [0x1004c4d90]
lea r8, [0x1004c4d98]
lea rdx, [0x100436d24]
lea rcx, [0x10004a648]
call qword [0x1004a9c10]
jmp 0x100133b85
and qword [rsp + 0x48], 0
lea rdx, [0x1004c4d98]
lea rax, [0x10004a648]
mov qword [rsp + 0x38], rdx
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rcx, [rsp + 0x40]
mov r9d, 1
mov r8, rax
mov qword [rsp + 0x20], rcx
lea rcx, [0x1001337dc]
mov qword [0x1004c4d90], rdx
mov qword [rsp + 0x40], rax
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.10027d5f4
add rsp, 0x180
pop rbx
ret

Function at 0x100134040
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rdx
mov qword [rsp + 0x40], rbx
cmp rcx, rbx
jne 0x10013406e
lea ecx, [rbx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1001340ee
cmp rdx, rbx
je 0x10013409c
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x1001340e4
mov rcx, qword [rsp + 0x40]
cmp rcx, rbx
jne 0x1001340a1
jmp 0x1001340e4
mov qword [rsp + 0x40], rcx
lea rdx, [0x10004a658]
cmp rdx, rbx
je 0x1001340d2
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
cmp eax, ebx
mov esi, ebx
sete sil
jmp 0x1001340d7
mov esi, 1
cmp rdi, rbx
je 0x1001340e2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x100134100
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rdi
sub rsp, 0x40
and qword [rax - 0x10], 0
and dword [rax + 8], 0
and dword [rax - 0x18], 0
mov rbx, rdx
mov dword [rax + 0x20], 4
test rcx, rcx
jne 0x10013413a
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1001341c9
test rdx, rdx
je 0x10013416a
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100134166
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x10013416f
mov ecx, eax
jmp 0x10013412d
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
lea rdx, [0x10004a658]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1001341a8
cmp dword [rsp + 0x68], 4
je 0x1001341ad
lea edi, [rax + 0xd]
and dword [rsp + 0x50], 0
test rbx, rbx
je 0x1001341bd
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret