joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d5970
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov r15, r8
mov rbx, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [r11 + 8], r12d
lea rax, [r11 + 8]
mov qword [r11 - 0x70], rax
mov qword [r11 - 0x78], r12
lea r9, [r11 + 0x20]
xor r8d, r8d
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400d5b62
cmp dword [rsp + 0xb8], 7
jne 0x1400d5b62
lea rax, [0x140323de0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r12
mov edx, dword [rsp + 0xa0]
shr edx, 1
lea rcx, [rsp + 0x38]
call fcn.1401e9030
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb8]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400d5b4d
mov edx, dword [rsp + 0xa0]
cmp edx, 2
ja 0x1400d5a70
mov rcx, qword [r15 + 0x10]
test rcx, rcx
je 0x1400d5b4d
lea rbx, [rcx - 8]
lea r9, [fcn.140005d80]
mov r8d, dword [rbx]
lea edx, [rax + 0x10]
call fcn.140298fa4
mov rcx, rbx
call fcn.1402983dc
mov qword [r15 + 0x10], r12
mov dword [r15 + 8], r12d
jmp 0x1400d5b4d
shr edx, 1
lea rcx, [rsp + 0x38]
call fcn.1401ea290
mov ebp, r12d
or r13d, 0xffffffff
nop dword [rax]
nop word [rax + rax]
mov esi, r12d
mov ebx, r12d
movsxd r14, ebp
nop dword [rax]
xor edx, edx
mov r8d, ebx
lea rcx, [rsp + 0x38]
call fcn.1401e9590
movsxd rdi, eax
test eax, eax
jle 0x1400d5b2c
cmp r14, 1
jne 0x1400d5ae1
mov r9d, edi
sub r9d, ebx
mov r8d, ebx
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.1401eb1b0
mov r8, rax
mov edx, esi
mov rcx, r15
call fcn.1400df510
inc esi
mov r8d, 2
lea rdx, [0x140323e64]
mov rax, qword [rsp + 0x38]
lea rax, [rax + rdi*2]
nop dword [rax]
movzx ecx, word [rdx]
cmp word [rax], cx
jne 0x1400d5b17
add rax, 2
add rdx, 2
dec r8
je 0x1400d5b34
jmp 0x1400d5b00
mov r8d, 1
cmp word [rax], cx
cmovb r8d, r13d
test r8d, r8d
je 0x1400d5b34
lea ebx, [rdi + 1]
test ebx, ebx
jns 0x1400d5aa0
test ebp, ebp
jne 0x1400d5b42
mov edx, esi
mov rcx, r15
call fcn.1400c7710
inc ebp
cmp ebp, 2
jl 0x1400d5a90
cmp dword [rsp + 0x40], 0
jle 0x1400d5b5e
mov rcx, qword [rsp + 0x38]
call fcn.140298600
mov al, 1
jmp 0x1400d5b64
xor al, al
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400dd4c0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1a8]
sub rsp, 0x2a0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rbp + 0x190], rax
lea rdi, [rcx + 8]
mov r8d, 1
lea rdx, [0x14032309c]
mov rcx, rdi
call fcn.1401eb700
test al, al
je 0x1400dd51c
xor al, al
jmp 0x1400dd65e
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor esi, esi
mov qword [rsp + 0x48], rsi
lea edx, [rsi + 0xc]
lea rcx, [rsp + 0x40]
call fcn.1401e9030
mov eax, dword [rsp + 0x48]
inc eax
movsxd rdx, eax
lea r9d, [rsi + 0xc]
lea r8, [0x1403286e0]
mov rcx, qword [rsp + 0x40]
call fcn.14029b4d8
lea edx, [rsi + 0xc]
lea rcx, [rsp + 0x40]
call fcn.1401ea290
nop
lea rax, [rbp - 0x80]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400dd573
mov qword [rsp + 0x38], rsi
test ebx, ebx
jne 0x1400dd594
lea rax, [0x140323de0]
mov qword [rsp + 0x30], rax
jmp 0x1400dd5ba
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
lea r8, [rbp - 0x80]
mov rcx, qword [rsp + 0x30]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1401ea290
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.1400d1690
nop
cmp dword [rsp + 0x38], 0
jle 0x1400dd5ee
mov rcx, qword [rsp + 0x30]
call fcn.140298600
nop
cmp dword [rsp + 0x48], 0
jle 0x1400dd5ff
mov rcx, qword [rsp + 0x40]
call fcn.140298600
mov r8, qword [rdi]
lea rdx, str._select___s_
lea rcx, [rsp + 0x50]
call fcn.1401e94c0
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rsi
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
lea rdx, str.OPEN
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [rsp + 0x58], 0
jle 0x1400dd64b
mov rcx, qword [rsp + 0x50]
call fcn.140298600
nop
cmp dword [rsp + 0x68], 0
jle 0x1400dd65c
mov rcx, qword [rsp + 0x60]
call fcn.140298600
mov al, 1
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140297ff0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400df2b0
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, rcx
mov edx, 9
call fcn.1400d4b20
movzx esi, al
test al, al
jne 0x1400df2fc
mov edx, 0xc
mov rcx, rbx
call fcn.1400d51d0
test al, al
je 0x1400df4ea
mov rdi, qword [0x1403fd7a8]
test rdi, rdi
je 0x1400df4ea
mov qword [rbp + 0x17], 0
mov edx, 0x1c
lea rcx, [rbp + 0xf]
call fcn.1401e9030
mov eax, dword [rbp + 0x17]
inc eax
movsxd rdx, eax
mov r9d, 0x1c
lea r8, str.Captions_SearchingRepairFile
mov rcx, qword [rbp + 0xf]
call fcn.14029b4d8
mov edx, 0x1c
lea rcx, [rbp + 0xf]
call fcn.1401ea290
nop
lea rdx, [rbp + 0xf]
lea rcx, [rbp + 0x2f]
call fcn.1400f6370
nop
cmp dword [rbp + 0x17], 0
jle 0x1400df36c
mov rcx, qword [rbp + 0xf]
call fcn.140298600
mov r8, qword [rbx + 8]
mov rdx, qword [rbp + 0x2f]
lea rcx, [rbp + 0x3f]
call fcn.1401e94c0
nop
xor r9d, r9d
xorps xmm2, xmm2
mov rdx, rax
mov rcx, rdi
call fcn.1400f5d70
nop
cmp dword [rbp + 0x47], 0
jle 0x1400df39f
mov rcx, qword [rbp + 0x3f]
call fcn.140298600
movzx r9d, sil
mov r8, rbx
lea rdx, [rbp + 0x1f]
mov rcx, rdi
call fcn.140103e90
nop
mov rdx, qword [rbx + 8]
cmp dword [rbp + 0x2b], 0
jne 0x1400df42f
lea rcx, str.WARNING:_Did_not_find_a_white_listed_repair_file_for:__s_r_n
call fcn.14029a88c
xor edx, edx
mov rcx, rbx
call fcn.1400d4640
movzx eax, byte [rbx + 0x40]
shr al, 4
test al, 1
je 0x1400df4cb
mov rcx, rbx
call fcn.1400d56c0
cmp dword [rax + 0x28], 8
je 0x1400df4cb
mov dword [rax + 0x28], 8
cmp byte [rax + 8], 0
je 0x1400df4cb
mov rax, qword [rax]
mov rdx, qword [0x1403fd7a8]
mov qword [rbp + 0x3f], rax
mov dword [rbp + 0x47], 7
lea rcx, [rdx + 0x388]
lea r8, [rbp + 0x3f]
call fcn.140119670
jmp 0x1400df4cb
mov r8, qword [rbp + 0x1f]
lea rcx, str._tRepair_file_found__r_nBad:_t_ws_r_nReplace_t_s_r_n
call fcn.14029a88c
mov rax, qword [rbx + 0x40]
shr rax, 0x23
test al, 1
je 0x1400df452
mov edx, 0xb
jmp 0x1400df4be
xor sil, sil
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400df4b9
lea rdx, [rbp + 0x6f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400df4a6
mov ecx, dword [rbx + 0x38]
cmp rcx, qword [rbp + 0x6f]
setge sil
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
mov edx, 0xb
jne 0x1400df4be
mov edx, 0xa
lea r8, [rbp + 0x1f]
mov rcx, rbx
call fcn.14000b7c0
nop
cmp dword [rbp + 0x27], 0
jle 0x1400df4db
mov rcx, qword [rbp + 0x1f]
call fcn.140298600
nop
cmp dword [rbp + 0x37], 0
jle 0x1400df4ea
mov rcx, qword [rbp + 0x2f]
call fcn.140298600
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400ec710
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push r12
push r14
push r15
sub rsp, 0x88
xor r12d, r12d
lea rax, [r11 + 0x18]
mov r15, rcx
mov rcx, qword [rcx + 8]
mov qword [r11 - 0x50], r12
mov qword [r11 - 0x58], r12
mov qword [r11 - 0x60], r12
mov qword [r11 - 0x68], r12
mov qword [r11 - 0x70], r12
mov qword [r11 - 0x78], r12
mov qword [r11 - 0x80], rax
lea rax, [r11 + 8]
mov r14, rdx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x1400ec784
xor al, al
add rsp, 0x88
pop r15
pop r14
pop r12
pop rbx
ret
mov ecx, dword [rsp + 0xc0]
mov qword [rsp + 0x80], rbp
mov eax, 2
inc ecx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140296f58
mov edx, dword [rsp + 0xb0]
mov rcx, r14
mov rbp, rax
call fcn.1400c7710
mov ecx, dword [rsp + 0xb0]
mov esi, r12d
mov edi, r12d
test ecx, ecx
je 0x1400ec852
nop dword [rax]
mov ecx, dword [rsp + 0xc0]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
inc ecx
lea r9, [rsp + 0xc8]
mov r8, rbp
mov dword [rsp + 0xc8], ecx
mov rcx, qword [r15 + 8]
mov edx, edi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400ec845
lea rcx, [rsp + 0x60]
mov rdx, rbp
call fcn.1401e6fd0
mov edx, esi
mov rcx, r14
mov r8, rax
call fcn.1400df510
inc esi
mov ecx, dword [rsp + 0xb0]
inc edi
cmp edi, ecx
jb 0x1400ec7e0
mov rdi, qword [rsp + 0x70]
cmp esi, ecx
je 0x1400ec865
mov edx, esi
mov rcx, r14
call fcn.1400c7710
mov rcx, rbp
call fcn.1402983dc
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
mov al, 1
add rsp, 0x88
pop r15
pop r14
pop r12
pop rbx
ret

Function at 0x1400ec890
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x68]
mov rdi, r8
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x1400ec8ee
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov dword [rdi], eax
mov al, 1
add rsp, 0x40
pop rdi
ret
Function at 0x1400ec910
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rbp, rcx
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x50]
mov rdi, r8
xor ebx, ebx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ec9a1
cmp dword [rsp + 0x68], 3
jne 0x1400ec9a1
mov edx, dword [rsp + 0x50]
mov rcx, rdi
call fcn.1400d14a0
test al, al
je 0x1400ec9a1
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 8]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400ec9b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 8]
xor eax, eax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1400ec9f2.5
mov eax, dword [rsp + 0x40]
dec eax
cmp eax, 0xa
ja case.0x1400ec9f2.5
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0xeca38]
add rcx, rdx
jmp rcx
mov eax, 3
add rsp, 0x38
ret
mov eax, 4
add rsp, 0x38
ret
mov eax, 2
add rsp, 0x38
ret
mov eax, 7
add rsp, 0x38
ret
mov eax, 0xb
add rsp, 0x38
ret
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x1400eca70
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push r14
push r15
sub rsp, 0x80
xor r15d, r15d
lea rax, [r11 + 0x18]
mov r14, rcx
mov rcx, qword [rcx + 8]
mov qword [r11 - 0x40], r15
mov qword [r11 - 0x48], r15
mov qword [r11 - 0x50], r15
mov qword [r11 - 0x58], rax
lea rax, [r11 + 8]
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x68], r15
mov rbp, rdx
mov qword [r11 - 0x70], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [r11 - 0x78], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1400ecad5
xor al, al
add rsp, 0x80
pop r15
pop r14
pop rbp
ret
mov ecx, dword [rsp + 0xb0]
mov qword [rsp + 0xa8], rbx
mov eax, 2
inc ecx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140296f58
mov edx, dword [rsp + 0xa0]
mov rcx, rbp
mov rsi, rax
call fcn.1400c7710
mov ecx, dword [rsp + 0xa0]
mov edi, r15d
mov ebx, r15d
test ecx, ecx
je 0x1400ecb98
nop
mov ecx, dword [rsp + 0xb0]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
inc ecx
lea r9, [rsp + 0xb8]
mov r8, rsi
mov dword [rsp + 0xb8], ecx
mov rcx, qword [r14 + 8]
mov edx, ebx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1400ecb8b
lea rcx, [rsp + 0x60]
mov rdx, rsi
call fcn.1401e6fd0
mov edx, edi
mov rcx, rbp
mov r8, rax
call fcn.1400df510
inc edi
mov ecx, dword [rsp + 0xa0]
inc ebx
cmp ebx, ecx
jb 0x1400ecb30
mov rbx, qword [rsp + 0xa8]
cmp edi, ecx
je 0x1400ecbae
mov edx, edi
mov rcx, rbp
call fcn.1400c7710
mov rcx, rsi
call fcn.1402983dc
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov al, 1
add rsp, 0x80
pop r15
pop r14
pop rbp
ret
Function at 0x1400ecc50
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov byte [r11 + 0x18], r8b
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
movzx ebx, r8b
mov r12, rdx
mov r15, rcx
xor r14b, r14b
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [r11 - 0x58], rax
xor eax, eax
mov dword [rsp + 0x48], eax
mov qword [r11 - 0x48], rax
lea rdx, [r11 - 0x58]
call fcn.1400eca70
mov r13, qword [rsp + 0x50]
test al, al
je 0x1400ecdc7
mov eax, dword [rsp + 0x48]
test eax, eax
jle 0x1400ecdc7
mov rsi, r13
mov ebp, eax
mov r13d, 1
nop dword [rax]
nop word [rax + rax]
xor eax, eax
mov dword [rsp + 0xb8], eax
mov rdi, qword [rsi]
test bl, bl
jne 0x1400ecd0b
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
test al, al
jne 0x1400ecdb5
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ecdb5
mov ecx, dword [rsp + 0xb8]
call fcn.140298640
mov rbx, rax
test rax, rax
je 0x1400ecdad
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ecda5
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, dword [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx r14d, r14b
test eax, eax
cmove r14d, r13d
mov rcx, rbx
call fcn.140298600
movzx ebx, byte [rsp + 0xb0]
add rsi, 0x10
dec rbp
jne 0x1400eccd0
mov r13, qword [rsp + 0x50]
test r13, r13
je 0x1400ecded
lea r9, [fcn.140005d80]
mov r8d, dword [r13 - 8]
mov edx, 0x10
mov rcx, r13
call fcn.140298fa4
lea rcx, [r13 - 8]
call fcn.1402983dc
movzx eax, r14b
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ed230
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rbp, [0x140323de0]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
test eax, eax
jle 0x1400ed2df
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.1401e9030
mov rdx, qword [rsp + 0x30]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.1401ea290
mov qword [rbx + 8], rsi
mov edx, dword [rsp + 0x3c]
test edx, edx
jne 0x1400ed2af
mov qword [rbx], rbp
jmp 0x1400ed2d5
mov rcx, rbx
call fcn.1401e9030
movsxd r9, dword [rsp + 0x3c]
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x30]
mov rcx, qword [rbx]
call fcn.14029b4d8
mov edx, dword [rsp + 0x3c]
mov rcx, rbx
call fcn.1401ea290
jmp 0x1400ed2ef
mov rdx, qword [0x1403ec168]
mov rcx, rbx
call fcn.1401e6fd0
nop
cmp dword [rsp + 0x38], 0
jle 0x1400ed300
mov rcx, qword [rsp + 0x30]
call fcn.140298600
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400ed950
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x328], rbx
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov qword [rsp + 0x60], r8
xor dil, dil
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.1400d1690
nop
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400edb62
lea rax, vtable.Core::Collection_class_Core::String_.0
mov qword [rsp + 0x30], rax
xor edi, edi
mov r15d, edi
mov dword [rsp + 0x38], edi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
lea r13, [0x140323de0]
mov r14, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
test byte [rsp + 0x70], 0x10
jne 0x1400edaee
lea rax, [rbp - 0x64]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400eda05
mov qword [rsp + 0x28], 0
test ebx, ebx
jne 0x1400eda23
mov qword [rsp + 0x20], r13
jmp 0x1400eda49
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rsp + 0x28]
inc eax
movsxd rdx, eax
lea r8, [rbp - 0x64]
mov rcx, qword [rsp + 0x20]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.1401ea290
nop
mov ecx, 0x20
call fcn.14029806c
mov rbx, rax
test rax, rax
je 0x1400eda76
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0
jmp 0x1400eda79
mov rbx, rdi
mov edx, dword [rsp + 0x2c]
lea rcx, [rbx + 0x10]
call fcn.1401e9030
movsxd r9, dword [rsp + 0x2c]
mov eax, dword [rbx + 0x18]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call fcn.14029b4d8
mov edx, dword [rsp + 0x2c]
lea rcx, [rbx + 0x10]
call fcn.1401ea290
xor edi, edi
mov qword [rsp + 0x48], rbx
test r15d, r15d
jne 0x1400edac8
mov qword [rbx + 8], rdi
mov rsi, rbx
mov qword [rsp + 0x40], rbx
jmp 0x1400edacf
mov qword [r14], rbx
mov qword [rbx + 8], r14
mov r14, rbx
mov qword [rbx], rdi
inc r15d
mov dword [rsp + 0x38], r15d
cmp dword [rsp + 0x28], 0
jle 0x1400edaee
mov rcx, qword [rsp + 0x20]
call fcn.140298600
lea rdx, [rsp + 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400ed9f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
sete dil
mov edx, r15d
mov rcx, qword [rsp + 0x60]
call fcn.1401189d0
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140118890
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
test rsi, rsi
je 0x1400edb62
nop
mov rbx, qword [rsi]
cmp dword [rsi + 0x18], 0
jle 0x1400edb52
mov rcx, qword [rsi + 0x10]
call fcn.140298600
mov rcx, rsi
call fcn.1402012c0
mov rsi, rbx
test rbx, rbx
jne 0x1400edb40
cmp dword [rsp + 0x58], 0
jle 0x1400edb73
mov rcx, qword [rsp + 0x50]
call fcn.140298600
movzx eax, dil
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140297ff0
mov rbx, qword [rsp + 0x328]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ee980
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x80
mov eax, dword [rcx + 0xc]
mov ebp, r9d
movsxd rsi, r8d
mov r14, rdx
mov rdi, rcx
test eax, eax
jne 0x1400eeaa3
add rcx, 0x30
mov qword [r11 + 8], rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lock inc dword [rdi + 0x10]
lea rcx, [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 0x58
mov byte [rdi + 0xa9], 0
call fcn.14029806c
test rax, rax
je 0x1400eea24
mov rcx, qword [rsp + 0xc0]
lea r9, [r14 + rsi]
lea r8, [rdi + 0xb0]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0xb8]
mov rdx, rdi
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov dword [rsp + 0x20], ebp
call fcn.1400ee4a0
mov rsi, rax
jmp 0x1400eea26
xor esi, esi
mov rdx, qword [rsi + 8]
mov rcx, qword [rdi + 0xa0]
lea rax, [rdi + 0xb0]
lea r9, [rsi + 0x20]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400eea7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xea
je 0x1400eea7e
cmp eax, 0x3e5
je 0x1400eea7e
mov rdx, rsi
mov rcx, rdi
call fcn.1400ef1a0
cmp ebx, 0x6d
je 0x1400eeabf
cmp ebx, 0xe9
jne 0x1400eeac6
jmp 0x1400eeabf
mov rbx, qword [rsp + 0x90]
lea r11, [rsp + 0x80]
mov rax, rsi
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
lea rcx, [rsp + 0x40]
call fcn.1400ee2a0
lea rdx, [0x1403e29c0]
lea rcx, [rsp + 0x40]
call fcn.14029f768
int3
mov byte [rdi + 0xa8], 0
lea rax, [0x140323de0]
lea rdx, [0x1403e2a50]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, vtable.Core::NamedPipeException.0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], ebx
call fcn.14029f768
int3
Function at 0x1400eedd0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
mov dword [r11 + 0x18], r8d
push rdi
sub rsp, 0x70
mov eax, dword [rcx + 0xc]
mov ebx, r9d
mov rsi, rdx
mov rdi, rcx
mov dword [r11 + 0x18], 0
test eax, eax
jne 0x1400eeec1
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [r11 + 8], rbp
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rdi + 0xa0]
lea rbp, [rdi + 0xd0]
lea r9, [rsp + 0x90]
mov r8d, ebx
mov rdx, rsi
mov qword [rdi + 0xe8], rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400eee93
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x3e5
jne 0x1400eee80
mov rcx, qword [rdi + 0xa0]
lea r8, [rsp + 0x90]
mov r9d, 1
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1400eee93
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x1400eee93
cmp ebx, 0x6d
je 0x1400eeedd
cmp ebx, 0xe9
jne 0x1400eeee4
jmp 0x1400eeedd
mov rcx, qword [rdi + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x90]
mov rbp, qword [rsp + 0x80]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, [rsp + 0x30]
call fcn.1400ee2a0
lea rdx, [0x1403e29c0]
lea rcx, [rsp + 0x30]
call fcn.14029f768
int3
mov byte [rdi + 0xa8], 0
mov rcx, qword [rdi + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [0x140323de0]
lea rdx, [0x1403e2a50]
mov qword [rsp + 0x50], rax
lea rax, vtable.Core::NamedPipeException.0
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x48], rax
call fcn.14029f768
int3