joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006140
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1403aeb60]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x1400061af
mov rcx, r9
call fcn.140006010
test eax, eax
je 0x1400061af
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x1400061ad
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x1400061a4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400061af
add rdx, 0x28
cmp rdx, r9
jne 0x140006190
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x140006530
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [0x1403b11e0], 0xffffffff
mov r8d, 0xffff
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [0x1403b11e8], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140006580
lea rdx, [0x140006440]
mov ecx, eax
mov dword [0x1403b11d8], eax
call fcn.14000b8e0
test eax, eax
jne 0x140006588
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140006577
call sub.msvcrt.dll_abort
nop
nop
Function at 0x140006590
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x1403aeb00]
mov r11d, dword [rsi]
mov rbx, rcx
test r11d, r11d
jne 0x1400065c8
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140006630
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rcx + 0x10]
test r12, r12
je 0x140006640
mov esi, dword [0x1403b11d8]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
call r13
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x1400066b0
mov rbp, qword [rsi]
cmp rbp, r12
jb 0x1400066f8
sub r12, 1
mov rax, qword [rsi + r12*8 + 8]
test rax, rax
jne 0x1400065b7
mov rcx, rbx
call fcn.140006490
mov qword [rsi + r12*8 + 8], rax
jmp 0x1400065b7
call fcn.140006490
mov qword [rbx + 0x10], rax
jmp 0x1400065b7
mov r10d, dword [rsi]
test r10d, r10d
je 0x14000675a
mov r9d, dword [0x1403addb0]
test r9d, r9d
je 0x140006788
lock add dword [0x1403b11e0], 1
jne 0x1400067bc
mov r12, qword [rbx + 0x10]
test r12, r12
je 0x140006767
mov eax, dword [rsi]
test eax, eax
je 0x1400065d1
lock sub dword [0x1403b11e0], 1
js 0x1400065d1
mov rcx, qword [0x1403b11e8]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x1400065d1
lea rcx, [r12 + 0x21]
mov edx, 8
call sub.msvcrt.dll_calloc
lea rdi, [r12 + 0x20]
test rax, rax
mov rsi, rax
je 0x1400067e3
mov qword [rax], rdi
mov ecx, dword [0x1403b11d8]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14000660b
call r13
jmp 0x14000660b
lea rdi, [rbp + rbp]
mov rcx, rsi
lea rax, [r12 + 0x20]
cmp rdi, r12
cmovb rdi, rax
lea rdx, [rdi*8 + 8]
call sub.msvcrt.dll_realloc
test rax, rax
mov rsi, rax
je 0x1400067e3
mov qword [rax], rdi
lea rcx, [rax + rbp*8 + 8]
sub rdi, rbp
xor edx, edx
lea r8, [rdi*8]
call sub.msvcrt.dll_memset
jmp 0x1400066d3
call fcn.140006530
mov dword [0x1403addb0], 1
mov edx, dword [rsi]
test edx, edx
jne 0x14000665c
mov r12, qword [rbx + 0x10]
test r12, r12
jne 0x1400065d1
mov rax, qword [0x1403b11d0]
lea r12, [rax + 1]
mov qword [0x1403b11d0], r12
mov qword [rbx + 0x10], r12
jmp 0x140006677
lock add dword [0x1403addb4], 1
je 0x140006741
mov r8d, dword [0x1403addb0]
lea rdi, [0x1403addb0]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
test r8d, r8d
jne 0x140006750
nop dword [rax]
xor ecx, ecx
call rbp
mov ecx, dword [rdi]
test ecx, ecx
je 0x1400067b0
jmp 0x140006750
mov rcx, qword [0x1403b11e8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000666a
lock sub dword [0x1403b11e0], 1
jmp 0x14000666a
call sub.msvcrt.dll_abort
nop
nop dword [rax]
cmp qword [rcx], rdx
jae 0x140006800
mov qword [rcx], rdx
mov qword [rcx + 0x18], 0
cmp qword [rcx + 8], r8
jae 0x14000680a
mov qword [rcx + 8], r8
test r9, r9
je 0x140006814
cmp qword [rcx], rdx
je 0x140006818
ret
mov qword [rcx + 0x18], r9
ret
Function at 0x140001530
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140013d28], rbx
je 0x14000157c
cmp rax, rbx
jne 0x14000156f
mov ebx, 1
mov esi, ebx
jmp 0x140001581
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001554
mov ebx, 1
mov eax, dword [0x140013d30]
cmp eax, ebx
jne 0x140001597
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x140001606
mov eax, dword [0x140013d30]
test eax, eax
jne 0x140001600
mov dword [0x140013d30], ebx
lea r15, [0x14000f680]
lea rdi, [0x14000f668]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400015f2
test eax, eax
jne 0x1400015f6
cmp qword [rdi], 0
je 0x1400015e7
movabs r10, 0xd30527475e523070
mov rax, qword [rdi]
mov rcx, qword [0x14000f608]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400015be
test eax, eax
je 0x140001606
mov eax, 0xff
jmp 0x1400016ec
mov dword [0x1400132c4], ebx
mov eax, dword [0x140013d30]
cmp eax, ebx
jne 0x14000162d
lea rdx, [0x14000f660]
lea rcx, [0x14000f620]
call sub.msvcrt.dll__initterm
mov dword [0x140013d30], 2
test esi, esi
jne 0x14000163a
xor eax, eax
xchg qword [0x140013d28], rax
cmp qword [0x140013d38], 0
je 0x140001678
lea rcx, [0x140013d38]
call fcn.140001900
test eax, eax
je 0x140001678
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140013d38]
mov r9, qword [0x14000f608]
call r9
mov r8, qword [0x1400132d8]
mov rdx, qword [0x1400132d0]
mov ecx, dword [0x1400132c8]
call fcn.140003938
mov dword [0x1400132c0], eax
cmp dword [0x1400132e0], 0
jne 0x1400016a8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400132c4], 0
jne 0x1400016bd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400132c0]
jmp 0x1400016ec
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140001994
add rsp, 0x28
jmp 0x140001530

Function at 0x1400017ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001838
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001830
cmp dword [rcx + 0x3c], edx
jl 0x140001830
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001830
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140001838
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140001960
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001988
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140001988
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400025cc
Capabilities:
Block operations on executable memory pages using arbitrary code guard

Disassembly:
push rsi
sub rsp, 0x30
mov esi, 4
mov dword [rsp + 0x40], 1
mov r8d, esi
lea rdx, [rsp + 0x40]
lea ecx, [rsi + 4]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov r8d, esi
mov dword [rsp + 0x48], 1
lea rdx, [rsp + 0x48]
lea ecx, [rsi - 2]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov r8d, esi
mov dword [rsp + 0x50], 1
lea rdx, [rsp + 0x50]
lea ecx, [rsi + 5]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov r8d, esi
mov dword [rsp + 0x58], 3
lea rdx, [rsp + 0x58]
lea ecx, [rsi + 6]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov r8d, esi
mov dword [rsp + 0x20], 2
lea rdx, [rsp + 0x20]
lea ecx, [rsi + 9]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
add rsp, 0x30
pop rsi
ret

Function at 0x140002680
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
cmp dword [0x140013048], 5
lea rsi, str.SM_WORKER::Initialize
mov rdi, rcx
jbe 0x1400026cb
lea rax, [rbp + 0x28]
mov dword [rbp + 0x28], 0xa2
mov qword [rsp + 0x28], rax
lea rdx, [0x140010542]
lea rax, [rbp + 0x30]
mov qword [rbp + 0x30], rsi
mov qword [rsp + 0x20], rax
call fcn.140001008
call fcn.1400099fc
mov ebx, eax
test eax, eax
je 0x1400026fa
xor r8d, r8d
lea rcx, [0x1400022d0]
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpoolWork]
nop dword [rax + rax]
mov qword [rdi + 0x38], rax
test rax, rax
jne 0x140002754
xor ebx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [0x140013048], 2
jbe 0x140002744
mov dword [rbp + 0x28], eax
lea rdx, [0x14001050e]
lea rax, [rbp + 0x28]
mov dword [rbp + 0x30], 0xb7
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x38], rsi
call fcn.1400010b0
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp dword [0x140013048], 5
jbe 0x140002744
lea rax, [rbp + 0x28]
mov dword [rbp + 0x28], 0xb7
mov qword [rsp + 0x28], rax
lea rdx, [0x1400104e1]
lea rax, [rbp + 0x30]
mov qword [rbp + 0x30], rsi
mov qword [rsp + 0x20], rax
call fcn.140001008
jmp 0x140002744
Function at 0x1400030a4
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
cmp dword [0x140013048], 5
lea r13, str.SmDetachSpace
mov r15, rcx
jbe 0x1400030fa
lea rax, [rbp + 0x40]
mov dword [rbp + 0x40], 0x28f
mov qword [rsp + 0x28], rax
lea rdx, [0x140010542]
lea rax, [rbp + 0x48]
mov qword [rbp + 0x48], r13
mov qword [rsp + 0x20], rax
call fcn.140001008
lea rcx, [rbp - 0x40]
call fcn.1400039d4
mov eax, dword [r15 + 0x88]
lea rsi, [r15 + 0x34]
xor r12d, r12d
mov qword [rbp - 0x28], 0x28
add rsi, rax
mov qword [rbp - 0x20], r12
mov rcx, rsi
mov qword [rbp - 0x18], r12
lea r8, [rbp + 0x40]
mov qword [rbp - 0x10], r12
xor edx, edx
mov dword [rbp - 8], r12d
mov word [rbp - 4], r12w
mov ebx, r12d
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
call fcn.14000b010
mov r14, qword [rbp + 0x40]
test eax, eax
je 0x1400031ee
movups xmm0, xmmword [rsi]
lea rdx, [rbp + 0x48]
movups xmm1, xmmword [rsi + 0x10]
lea rcx, [rbp - 0x28]
movups xmmword [rbp - 0x24], xmm0
movups xmmword [rbp - 0x14], xmm1
call fcn.14000bff8
mov rdi, qword [rbp + 0x48]
mov ebx, eax
test eax, eax
je 0x1400031da
test byte [rdi + 0xaa0], 2
jne 0x14000318f
test byte [r14 + 0xa60], 2
je 0x1400031bc
lea rcx, [rbp - 0x40]
call fcn.140003c78
mov ebx, eax
test eax, eax
je 0x1400031da
mov rdx, rsi
lea rcx, [rbp - 0x40]
call fcn.1400041b8
mov ebx, eax
test eax, eax
je 0x1400031da
movups xmm0, xmmword [0x14000fb28]
movdqu xmmword [rsi + 0x20], xmm0
cmp dword [rdi + 0xa80], 1
je 0x1400031d3
mov rcx, rsi
call fcn.14000be28
mov ebx, eax
test eax, eax
je 0x1400031da
mov dword [r15 + 0x90], r12d
test rdi, rdi
je 0x1400031ee
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test r14, r14
je 0x140003202
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test ebx, ebx
jne 0x140003252
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [0x140013048], 2
jbe 0x140003284
mov dword [rbp + 0x40], eax
lea rdx, [0x14001050e]
lea rax, [rbp + 0x40]
mov dword [rbp + 0x48], 0x2e0
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x50], r13
call fcn.1400010b0
jmp 0x140003284
cmp dword [0x140013048], 5
jbe 0x140003284
lea rax, [rbp + 0x40]
mov dword [rbp + 0x40], 0x2e0
mov qword [rsp + 0x28], rax
lea rdx, [0x1400104e1]
lea rax, [rbp + 0x48]
mov qword [rbp + 0x48], r13
mov qword [rsp + 0x20], rax
call fcn.140001008
lea rcx, [rbp - 0x40]
call fcn.140003a74
mov eax, ebx
mov rbx, qword [rsp + 0xd8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400032b4
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
cmp dword [0x140013048], 5
lea rsi, str.SmExecuteRepair
mov rdi, rcx
jbe 0x1400032ff
lea rax, [rbp + 0x28]
mov dword [rbp + 0x28], 0x1aa
mov qword [rsp + 0x28], rax
lea rdx, [0x140010542]
lea rax, [rbp + 0x30]
mov qword [rbp + 0x30], rsi
mov qword [rsp + 0x20], rax
call fcn.140001008
lea rcx, [rbp - 0x20]
call fcn.1400039d4
mov rcx, rdi
call fcn.1400097c4
mov ebx, eax
test eax, eax
je 0x140003368
cmp dword [rdi + 0x8c], 0xe70003
jne 0x140003334
lea rdx, [rdi + 0x44]
mov rcx, rdi
call fcn.1400035c8
mov ebx, eax
test eax, eax
je 0x140003368
cmp dword [0x140013048], 5
jbe 0x1400033b2
lea rax, [rbp + 0x28]
mov dword [rbp + 0x28], 0x1c4
mov qword [rsp + 0x28], rax
lea rdx, [0x1400104e1]
lea rax, [rbp + 0x30]
mov qword [rbp + 0x30], rsi
mov qword [rsp + 0x20], rax
call fcn.140001008
jmp 0x1400033b2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [0x140013048], 2
jbe 0x1400033b2
mov dword [rbp + 0x28], eax
lea rdx, [0x14001050e]
lea rax, [rbp + 0x28]
mov dword [rbp + 0x30], 0x1c4
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x38], rsi
call fcn.1400010b0
lea rcx, [rbp - 0x20]
call fcn.140003a74
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400033d4
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
cmp dword [0x140013048], 5
lea r14, str.SmExecuteWitness
mov rbx, rcx
jbe 0x140003420
lea rax, [rbp + 0x30]
mov dword [rbp + 0x30], 0x1cf
mov qword [rsp + 0x28], rax
lea rdx, [0x140010542]
lea rax, [rbp + 0x38]
mov qword [rbp + 0x38], r14
mov qword [rsp + 0x20], rax
call fcn.140001008
lea rcx, [rbp - 0x20]
call fcn.1400039d4
and dword [rbp + 0x28], 0
lea rcx, [rbp - 0x20]
and qword [rbp - 0x30], 0
call fcn.140003c78
mov edi, eax
test eax, eax
je 0x140003505
lea rcx, [rbx + 0x74]
lea rdx, [rbp - 0x30]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
nop dword [rax + rax]
test eax, eax
je 0x140003472
xor edi, edi
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
jmp 0x140003505
mov ecx, dword [rbx + 0x40]
mov r9d, dword [rbx + 0x84]
mov dword [rbp + 0x28], r9d
sub ecx, 1
je 0x1400034b3
cmp ecx, 1
jne 0x140003505
mov eax, dword [rbx + 0x88]
lea r8, [rbx + 0x34]
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x20]
add r8, rax
call fcn.140004084
mov edi, eax
test eax, eax
je 0x140003505
and dword [rbx + 0x90], 0
jmp 0x140003505
mov eax, dword [rbx + 0x88]
lea r8, [rbx + 0x34]
mov rdx, qword [rbp - 0x30]
lea r9, [rbp + 0x28]
add r8, rax
lea rcx, [rbp - 0x20]
call fcn.140003b44
mov edi, eax
test eax, eax
jne 0x1400034fc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
jne 0x140003505
and dword [rbp + 0x28], edi
xor ecx, ecx
lea edi, [rax - 1]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov eax, dword [rbp + 0x28]
mov dword [rbx + 0x90], eax
cmp qword [rbp - 0x30], 0
je 0x140003521
lea rcx, [rbp - 0x30]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
nop dword [rax + rax]
and qword [rbp - 0x30], 0
test edi, edi
jne 0x140003571
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [0x140013048], 2
jbe 0x1400035a3
mov dword [rbp + 0x30], eax
lea rdx, [0x14001050e]
lea rax, [rbp + 0x30]
mov dword [rbp + 0x38], 0x214
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x28], r14
call fcn.1400010b0
jmp 0x1400035a3
cmp dword [0x140013048], 5
jbe 0x1400035a3
lea rax, [rbp + 0x30]
mov dword [rbp + 0x30], 0x214
mov qword [rsp + 0x28], rax
lea rdx, [0x1400104e1]
lea rax, [rbp + 0x38]
mov qword [rbp + 0x38], r14
mov qword [rsp + 0x20], rax
call fcn.140001008
lea rcx, [rbp - 0x20]
call fcn.140003a74
mov rbx, qword [rsp + 0x90]
mov eax, edi
add rsp, 0x70
pop r14
pop rdi
pop rbp
ret
Function at 0x1400035c8
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
cmp dword [0x140013048], 5
lea r15, str.SmExecuteWorkRemote
mov rsi, rdx
mov rdi, rcx
jbe 0x14000361a
lea rax, [rbp + 0x40]
mov dword [rbp + 0x40], 0x166
mov qword [rsp + 0x28], rax
lea rdx, [0x140010542]
lea rax, [rbp + 0x48]
mov qword [rbp + 0x48], r15
mov qword [rsp + 0x20], rax
call fcn.140001008
lea rcx, [rbp - 0x18]
call fcn.1400039d4
mov rcx, rdi
call fcn.1400097c4
xor r14d, r14d
mov ebx, eax
test eax, eax
je 0x140003671
cmp dword [rdi + 0x8c], 0xe70003
jne 0x140003719
lea rcx, [rbp - 0x18]
mov dword [rdi + 0x90], r14d
call fcn.140003c78
mov ebx, eax
test eax, eax
je 0x140003671
mov rdx, rsi
lea rcx, [rbp - 0x18]
call fcn.140003dc4
mov rsi, rax
test rax, rax
jne 0x1400036db
mov ebx, r14d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [0x140013048], 2
jbe 0x1400036bb
mov dword [rbp + 0x40], eax
lea rdx, [0x14001050e]
lea rax, [rbp + 0x40]
mov dword [rbp + 0x48], 0x19f
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x20], r15
call fcn.1400010b0
lea rcx, [rbp - 0x18]
call fcn.140003a74
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov r9d, dword [rdi + 0x38]
mov r8, rdi
add r9d, 0x34
mov rdx, rsi
call fcn.140003f3c
mov ebx, eax
test eax, eax
je 0x140003702
cmp dword [rdi + 0x8c], 0xe70003
cmove ebx, r14d
mov rcx, rsi
call qword [sym.imp.ext_ms_win_cluster_clusapi_l1_1_0.dll_CloseClusterResource]
nop dword [rax + rax]
test ebx, ebx
je 0x140003671
cmp dword [0x140013048], 5
jbe 0x1400036bb
lea rax, [rbp + 0x40]
mov dword [rbp + 0x40], 0x19f
mov qword [rsp + 0x28], rax
lea rdx, [0x1400104e1]
lea rax, [rbp + 0x48]
mov qword [rbp + 0x48], r15
mov qword [rsp + 0x20], rax
call fcn.140001008
jmp 0x1400036bb
Function at 0x140003b44
Capabilities:
Check if file exists

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
cmp dword [0x140013048], 5
lea r12, str.SM_CLUSTER::GetRegistryValue
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
jbe 0x140003ba1
lea rax, [rbp + 0x30]
mov dword [rbp + 0x30], 0xa8
mov qword [r11 - 0x50], rax
lea rdx, [0x140010542]
lea rax, [rbp - 0x10]
mov qword [rbp - 0x10], r12
mov qword [r11 - 0x58], rax
call fcn.140001008
mov rcx, qword [r15 + 0x10]
mov r9, rsi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, r14
xor ebx, ebx
call qword [sym.imp.ext_ms_win_cluster_clusapi_l1_1_1.dll_ClusterRegQueryValue]
nop dword [rax + rax]
test eax, eax
je 0x140003c1f
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [0x140013048], 2
jbe 0x140003c56
mov dword [rbp + 0x30], eax
lea rdx, [0x14001050e]
lea rax, [rbp + 0x30]
mov dword [rbp - 0x10], 0xbf
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov qword [rbp - 8], r12
call fcn.1400010b0
jmp 0x140003c56
cmp dword [0x140013048], 5
mov ebx, 1
jbe 0x140003c56
lea rax, [rbp + 0x30]
mov dword [rbp + 0x30], 0xbf
mov qword [rsp + 0x28], rax
lea rdx, [0x1400104e1]
lea rax, [rbp - 8]
mov qword [rbp - 8], r12
mov qword [rsp + 0x20], rax
call fcn.140001008
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140003c78
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
cmp dword [0x140013048], 5
lea rsi, str.SM_CLUSTER::Initialize
mov rdi, rcx
jbe 0x140003cc3
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], 0x47
mov qword [rsp + 0x28], rax
lea rdx, [0x140010542]
lea rax, [rbp + 0x28]
mov qword [rbp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.140001008
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.ext_ms_win_cluster_clusapi_l1_1_0.dll_OpenCluster]
nop dword [rax + rax]
mov qword [rdi], rax
test rax, rax
je 0x140003d28
lea edx, [rbx + 2]
mov rcx, rax
call qword [sym.imp.ext_ms_win_cluster_clusapi_l1_1_1.dll_GetClusterKey]
nop dword [rax + rax]
mov qword [rdi + 8], rax
test rax, rax
je 0x140003d28
lea r9, [rdi + 0x10]
mov r8d, 0x2001f
lea rdx, str.SpaceportWitness
mov rcx, rax
call qword [sym.imp.ext_ms_win_cluster_clusapi_l1_1_1.dll_ClusterRegOpenKey]
nop dword [rax + rax]
test eax, eax
je 0x140003d82
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [0x140013048], 2
jbe 0x140003d72
mov dword [rbp + 0x20], eax
lea rdx, [0x14001050e]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x28], 0x68
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x30], rsi
call fcn.1400010b0
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp dword [0x140013048], 5
jbe 0x140003db4
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], 0x68
mov qword [rsp + 0x28], rax
lea rdx, [0x1400104e1]
lea rax, [rbp + 0x28]
mov qword [rbp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.140001008
mov ebx, 1
jmp 0x140003d72