joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003440
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400b8010]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rdx, qword [rdx]
lea rcx, [rsp + 0x88]
call fcn.14001b980
test al, al
je 0x1400034f2
xor ecx, ecx
mov qword [rsp + 0x88], rcx
mov dword [rsp + 0x80], 8
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x14000349c
mov r8, qword [rdi]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor edx, edx
lea r9d, [rdx + 0x40]
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x140003514
mov rcx, qword [rsp + 0x88]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
cmova rcx, rax
mov qword [rbx], rcx
mov byte [rbx + 8], 1
jmp 0x1400034f6
mov byte [rbx + 8], 0
mov rax, rbx
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14005a730
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.RegGetValueW_failed
lea rcx, [rsp + 0x40]
call fcn.140002f20
nop
mov r9d, esi
mov r8, rdi
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rsp + 0x60]
call fcn.14005f880
int3
Function at 0x14001b980
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rbx, r8
mov rax, rdx
cmp qword [r8 + 0x10], 0
je 0x14001ba27
mov rdx, rbx
cmp qword [r8 + 0x18], 8
jb 0x14001b9a8
mov rdx, qword [r8]
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x14001b9de
cmp eax, 2
jne 0x14001b9ee
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
lea rdx, str.RegQueryValueExW_failed
lea rcx, [rsp + 0x50]
call fcn.140002f20
nop
mov r9d, edi
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rsp + 0x30]
call fcn.14005f880
nop
lea rdx, str.Invalid_registry_value_name
lea rcx, [rsp + 0x30]
call fcn.140002f20
nop
xor r9d, r9d
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rsp + 0x50]
call fcn.14005f880
int3

Function at 0x14001bbe0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x60
mov rbx, r8
mov rax, rdx
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x14001bbfd
mov rdx, qword [r8]
xor r9d, r9d
mov r8d, dword [rcx + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov edi, eax
test eax, eax
jne 0x14001bc21
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
lea rdx, str.RemoveKeyFunction_failed
lea rcx, [rsp + 0x20]
call fcn.140002f20
nop
mov r9d, edi
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rsp + 0x40]
call fcn.14005f880
int3

Function at 0x14001bc80
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400b8010]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, r8
mov r9, r8
mov r8, rdx
lea rdx, [rsp + 0x60]
call fcn.14001b540
nop
lea rdx, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov edi, eax
test eax, eax
jne 0x14001bd6c
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x14001bd1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bd18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bd66
call fcn.14005a750
movdqa xmm0, xmmword [0x1400a5200]
movdqu xmmword [rsp + 0x80], xmm0
xor eax, eax
mov word [rsp + 0x70], ax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001bd45
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14005a730
mov rbx, qword [rsp + 0xc8]
add rsp, 0xa0
pop rdi
ret
call fcn.14006538c
nop
lea rdx, str.RegDeleteTreeW_failed
lea rcx, [rsp + 0x20]
call fcn.140002f20
nop
mov r9d, edi
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rsp + 0x40]
call fcn.14005f880
int3
Function at 0x14001bdb0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, r8
mov rax, rdx
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x14001bdcd
mov rdx, qword [r8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test eax, eax
jne 0x14001bde7
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
lea rdx, str.RegDeleteValue_failed
lea rcx, [rsp + 0x20]
call fcn.140002f20
nop
mov r9d, edi
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rsp + 0x40]
call fcn.14005f880
int3

Function at 0x14001be20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400b8010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, r8
mov rax, rdx
xor ecx, ecx
mov dword [rsp + 0x70], ecx
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x14001be55
mov rdx, qword [r8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14001be98
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14005a730
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
lea rdx, str.RegQueryValueEx_failed
lea rcx, [rsp + 0x30]
call fcn.140002f20
nop
mov r9d, edi
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rsp + 0x50]
call fcn.14005f880
int3

Function at 0x14001bee0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400b8010]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, r8
mov rax, rdx
xor edx, edx
mov dword [r11 - 0x18], edx
mov dword [r11 - 0x14], 4
cmp qword [r8 + 0x18], 8
jb 0x14001bf1f
mov r8, qword [r8]
lea rcx, [rsp + 0x84]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov r9d, 0x10
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edi, eax
test eax, eax
jne 0x14001bf7b
mov eax, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14005a730
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
lea rdx, str.RegGetValueW_failed
lea rcx, [rsp + 0x40]
call fcn.140002f20
nop
mov r9d, edi
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rsp + 0x60]
call fcn.14005f880
int3
Function at 0x14001c000
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rbx, r8
mov rax, rdx
mov dword [rsp + 0x70], r9d
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x14001c025
mov rdx, qword [r8]
mov dword [rsp + 0x28], 4
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov r9d, 4
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
jne 0x14001c060
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
lea rdx, str.RegSetValueExW_failed
lea rcx, [rsp + 0x30]
call fcn.140002f20
nop
mov r9d, edi
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rsp + 0x50]
call fcn.14005f880
int3

Function at 0x14001c0a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400b8010]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, r8
mov rax, rdx
xor edx, edx
mov qword [r11 - 0x20], rdx
mov dword [r11 - 0x28], 8
cmp qword [r8 + 0x18], 8
jb 0x14001c0df
mov r8, qword [r8]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov r9d, 0x40
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edi, eax
test eax, eax
jne 0x14001c13c
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14005a730
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
lea rdx, str.RegGetValueW_failed
lea rcx, [rsp + 0x40]
call fcn.140002f20
nop
mov r9d, edi
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rsp + 0x60]
call fcn.14005f880
int3

Function at 0x14001c180
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rbx, r8
mov rax, rdx
mov qword [rsp + 0x70], r9
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x14001c1a5
mov rdx, qword [r8]
mov dword [rsp + 0x28], 8
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov r9d, 0xb
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
jne 0x14001c1e0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
lea rdx, str.RegSetValueExW_failed
lea rcx, [rsp + 0x30]
call fcn.140002f20
nop
mov r9d, edi
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rsp + 0x50]
call fcn.14005f880
int3
Function at 0x14001c570
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rbx, r8
mov r10, rdx
mov rax, qword [r9 + 0x10]
cmp rax, 0x7ffffffe
ja 0x14001c617
lea rax, [rax*2 + 2]
cmp qword [r9 + 0x18], 8
jb 0x14001c5a2
mov r9, qword [r9]
mov rdx, rbx
cmp qword [r8 + 0x18], 8
jb 0x14001c5af
mov rdx, qword [r8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov r9d, 1
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
jne 0x14001c5de
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
lea rdx, str.RegSetValueExW_failed
lea rcx, [rsp + 0x50]
call fcn.140002f20
nop
mov r9d, edi
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rsp + 0x30]
call fcn.14005f880
nop
lea rdx, str.Value_too_big_for_registry
lea rcx, [rsp + 0x30]
call fcn.140002f20
nop
xor r9d, r9d
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rsp + 0x50]
call fcn.14005f880
int3
Function at 0x14001cff0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rbx, r8
mov r10, rdx
mov rcx, qword [r9]
mov rax, qword [r9 + 8]
sub rax, rcx
mov edx, 0xffffffff
cmp rax, rdx
ja 0x14001d089
mov rdx, rbx
cmp qword [r8 + 0x18], 8
jb 0x14001d021
mov rdx, qword [r8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 3
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
jne 0x14001d050
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
lea rdx, str.RegSetValueExW_failed
lea rcx, [rsp + 0x30]
call fcn.140002f20
nop
mov r9d, edi
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rsp + 0x50]
call fcn.14005f880
nop
lea rdx, str.Buffer_too_large_for_RegSetValueExW
lea rcx, [rsp + 0x30]
call fcn.140001d40
lea rdx, [0x1400b5fc8]
lea rcx, [rsp + 0x30]
call fcn.14005f880
int3
Function at 0x140021510
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov rax, qword [0x1400b8010]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15d, r9d
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0xf], rcx
mov ecx, 2
mov dword [rbp + 0xf], ecx
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
xor r12d, r12d
mov r8d, r12d
mov qword [rbp + 7], r12
nop
mov eax, ecx
and eax, 1
shr rcx, 1
add rax, rcx
mov r9, qword [rbp - 1]
mov rcx, r9
mov rdx, qword [rbp - 9]
sub rcx, rdx
sar rcx, 1
cmp rax, rcx
jae 0x14002158b
lea rcx, [rdx + rax*2]
mov qword [rbp - 1], rcx
jmp 0x1400215c6
jbe 0x1400215c6
sub r8, rdx
sar r8, 1
cmp rax, r8
jbe 0x1400215a9
lfence
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.140012720
jmp 0x1400215c2
sub rax, rcx
lea r8, [rax + rax]
lea rbx, [r8 + r9]
xor edx, edx
mov rcx, r9
call fcn.14005f950
mov qword [rbp - 1], rbx
mov rdx, qword [rbp - 9]
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400215d3
mov r8, qword [rdi]
lea rax, [rbp + 0xf]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9d, r15d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
cmp eax, 0xea
jne 0x140021609
mov ecx, dword [rbp + 0xf]
mov r8, qword [rbp + 7]
jmp 0x140021560
cmp ebx, 2
jne 0x140021654
mov byte [rsi + 0x18], 0
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140021695
mov rdx, qword [rbp + 7]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002164d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400216eb
call fcn.14005a750
jmp 0x140021695
test ebx, ebx
jne 0x1400216f1
mov ecx, dword [rbp + 0xf]
test cl, 1
jne 0x1400216b6
mov edx, ecx
and edx, 1
mov eax, ecx
shr rax, 1
add rdx, rax
lea rcx, [rbp - 9]
call fcn.14000eff0
mov rax, qword [rbp - 9]
mov qword [rsi], rax
mov rax, qword [rbp - 1]
mov qword [rsi + 8], rax
mov rax, qword [rbp + 7]
mov qword [rsi + 0x10], rax
mov byte [rsi + 0x18], 1
mov rax, rsi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14005a730
add rsp, 0xf0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rdx, str.Invalid_registry_value_data_length
lea rcx, [rbp - 0x49]
call fcn.140002f20
nop
xor r9d, r9d
mov r8, rdi
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x29]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rbp - 0x29]
call fcn.14005f880
nop
call fcn.14006538c
nop
lea rdx, str.RegGetValueW_failed
lea rcx, [rsp + 0x40]
call fcn.140002f20
nop
mov r9d, ebx
mov r8, rdi
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x69]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rbp - 0x69]
call fcn.14005f880
int3
Function at 0x140021730
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1400b8010]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x1f], rcx
mov eax, 1
mov dword [rbp + 0x1f], eax
xorps xmm1, xmm1
movdqu xmmword [rbp + 7], xmm1
xor r15d, r15d
mov edx, r15d
mov qword [rbp + 0x17], rdx
nop dword [rax]
mov r8d, eax
mov r9, qword [rbp + 0xf]
mov rax, r9
mov rcx, qword [rbp + 7]
sub rax, rcx
cmp r8, rax
jae 0x1400217a0
lea rax, [r8 + rcx]
mov qword [rbp + 0xf], rax
jmp 0x1400217d4
jbe 0x1400217d4
sub rdx, rcx
cmp r8, rdx
jbe 0x1400217bb
lfence
mov rdx, r8
lea rcx, [rbp + 7]
call fcn.1400236e0
jmp 0x1400217d0
sub r8, rax
lea rbx, [r9 + r8]
xor edx, edx
mov rcx, r9
call fcn.14005f950
mov qword [rbp + 0xf], rbx
mov rcx, qword [rbp + 7]
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400217e1
mov r8, qword [rdi]
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
xor edx, edx
lea r9d, [rdx + 8]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
cmp eax, 0xea
jne 0x140021818
mov eax, dword [rbp + 0x1f]
mov rdx, qword [rbp + 0x17]
jmp 0x140021780
cmp ebx, 2
jne 0x140021861
mov byte [rsi + 0x18], 0
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x1400218d1
mov rdx, qword [rbp + 0x17]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002185a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002192c
call fcn.14005a750
jmp 0x1400218d1
test ebx, ebx
jne 0x1400218f7
mov r8d, dword [rbp + 0x1f]
mov rcx, qword [rbp + 0xf]
mov r9, rcx
mov rdx, qword [rbp + 7]
sub r9, rdx
cmp r8, r9
jae 0x140021886
lea rcx, [r8 + rdx]
jmp 0x1400218be
jbe 0x1400218be
mov rax, qword [rbp + 0x17]
sub rax, rdx
cmp r8, rax
jbe 0x1400218a9
lfence
mov rdx, r8
lea rcx, [rbp + 7]
call fcn.1400236e0
mov rcx, qword [rbp + 0xf]
jmp 0x1400218ba
sub r8, r9
lea rbx, [rcx + r8]
xor edx, edx
call fcn.14005f950
mov rcx, rbx
mov rdx, qword [rbp + 7]
mov qword [rsi], rdx
mov qword [rsi + 8], rcx
mov rax, qword [rbp + 0x17]
mov qword [rsi + 0x10], rax
mov byte [rsi + 0x18], 1
mov rax, rsi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14005a730
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.RegGetValueW_failed
lea rcx, [rbp - 0x39]
call fcn.140002f20
nop
mov r9d, ebx
mov r8, rdi
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x19]
call fcn.14001b460
lea rdx, [0x1400b6340]
lea rcx, [rbp - 0x19]
call fcn.14005f880
nop
call fcn.14006538c
int3
Function at 0x140029ec0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400b8010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov qword [rsp + 0x60], rcx
movups xmm0, xmmword [0x1400910e0]
movaps xmmword [rsp + 0x50], xmm0
xor esi, esi
mov qword [rsp + 0x60], rsi
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov edi, eax
test eax, eax
jne 0x140029fd7
mov rdx, qword [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140029f24
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], si
lea rcx, [rsp + 0x20]
call fcn.14000f8e0
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140029f63
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000f500
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140029faf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029faa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029fd1
call fcn.14005a750
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14005a730
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14006538c
nop
lea rdx, str.SHGetKnownFolderPath_failed
lea rcx, [rsp + 0x20]
call fcn.140002f20
nop
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.14002f570
int3
Function at 0x1400324b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x1400324d2
xor eax, eax
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x14003255e
lfence
mov rdi, rbp
nop dword [rax]
mov rcx, rbx
call fcn.14001fe30
test rax, rax
jle 0x14003252e
cmp rdi, rax
mov rsi, rdi
mov rcx, r14
cmovge rsi, rax
mov rax, qword [rbx + 0x38]
mov r8, rsi
mov rdx, qword [rax]
call fcn.14005fb20
mov rax, qword [rbx + 0x50]
sub rdi, rsi
sub dword [rax], esi
mov rcx, qword [rbx + 0x38]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14003254e
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [0x140090530]
cmp eax, 0xffffffff
je 0x140032556
mov byte [r14], al
dec rdi
mov esi, 1
add r14, rsi
test rdi, rdi
jg 0x1400324f0
sub rbp, rdi
jmp 0x140032648
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140032575
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140032577
xor ecx, ecx
movsxd rax, ecx
mov rdi, rbp
test ecx, ecx
je 0x1400325ac
cmp rax, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.14005fb20
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
mov rdi, rsi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140032642
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400325e7
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x140032620
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.14006cf30
sub rsi, rax
add r14, rax
mov rdi, rsi
cmp rax, 0xfff
jne 0x140032642
cmp rsi, rax
ja 0x1400325f0
test rdi, rdi
je 0x140032642
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14006cf30
mov rsi, rdi
sub rsi, rax
sub rbp, rsi
lfence
mov rsi, qword [rsp + 0x28]
mov rax, rbp
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
Function at 0x14003f180
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x100
movaps xmmword [rsp + 0xf0], xmm6
mov rbx, rdx
xor esi, esi
mov dword [rsp + 0x30], esi
lea rax, [0x1400b8cb0]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
cmp qword [rdx + 0x18], 8
jb 0x14003f1be
mov rdx, qword [rdx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14003f1fa
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x14003f1f5
mov dword [rsp + 0x30], eax
lea rax, [0x1400b8f00]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
xor dil, dil
jmp 0x14003f1fd
mov dil, 1
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r8d, 0xb
lea rdx, str.ValueExists
lea rcx, [rsp + 0x40]
call fcn.140002f80
nop
movd eax, xmm6
test eax, eax
jne 0x14003f292
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14003f26e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f269
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f28c
call fcn.14005a750
movzx eax, dil
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rdi
ret
call fcn.14006538c
nop
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14000f450
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.140059280
mov rbx, rax
lea r8, [0x1400a40a8]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.140014570
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1400461a0
nop
lea r8, str.__failed
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.14000fc20
nop
movdqa xmmword [rsp + 0x30], xmm6
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14003e510
int3
mov rcx, rdx
mov rdx, r8
jmp 0x14003f180