joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a1410
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x14016b010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edi, r9d
mov r12, r8
mov r13, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rax, [0x14016bcb0]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r8], xmm0
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
cmp qword [rdx + 0x18], 8
jb 0x1400a1478
mov rdx, qword [rdx]
xor r9d, r9d
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
lea rdx, [0x14016c220]
test eax, eax
je 0x1400a14af
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x1400a14ab
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rdx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
xor al, al
jmp 0x1400a14b1
mov al, 1
cmp dword [rsp + 0x30], ebx
je 0x1400a15eb
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
mov r9d, 0x3001f
mov r8, r13
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1400a12d0
nop
mov rbx, qword [rsp + 0x30]
cmp dword [r12], 0
je 0x1400a14f4
xor sil, sil
jmp 0x1400a15d9
test rbx, rbx
jne 0x1400a1501
mov sil, 1
jmp 0x1400a15d9
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov r8, r12
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400a0fb0
mov rbp, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
cmp dword [r12], 0
jne 0x1400a1582
mov r14, r15
cmp r15, rbp
je 0x1400a1610
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x1400a154a
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
je 0x1400a155f
lea ecx, [rax - 2]
cmp ecx, 1
ja 0x1400a1568
add r14, 0x20
cmp r14, rbp
jmp 0x1400a1537
mov dword [rsp + 0x30], eax
lea rax, [0x14016c220]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r12], xmm0
xor sil, sil
test r15, r15
je 0x1400a15d9
mov rdi, r15
cmp r15, rbp
je 0x1400a15a3
mov rcx, rdi
call fcn.14000df70
add rdi, 0x20
cmp rdi, rbp
jne 0x1400a1592
mov rdx, qword [rsp + 0x50]
sub rdx, r15
and rdx, 0xffffffffffffffe0
mov rax, r15
cmp rdx, 0x1000
jb 0x1400a15d0
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a1629
mov rcx, r15
call fcn.1400d45f0
nop
test rbx, rbx
je 0x1400a15e7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d45d0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rsi
call fcn.1400a1390
mov sil, 1
jmp 0x1400a1585
call fcn.1400e6180
int3
Function at 0x1400a1940
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14016b010]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x38], rcx
xor r12d, r12d
mov dword [rbp - 0x38], r12d
lea rax, [0x14016bcb0]
mov qword [rbp - 0x30], rax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [r8], xmm0
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r12w
movzx ebx, byte [rbp - 0x40]
mov rcx, qword [rbp - 0x18]
inc rcx
call fcn.14001bdb0
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8d, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, eax
test eax, eax
je 0x1400a1a8a
lea edi, [rdx - 1]
mov r8, qword [rbp - 0x18]
lea rcx, [r8 + 1]
cmp rdx, rcx
jbe 0x1400a1a67
cmp rdi, r8
ja 0x1400a1a02
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rax, qword [rbp - 0x28]
mov qword [rbp - 0x18], rdi
mov word [rax + rdi*2], r12w
jmp 0x1400a19a0
mov rdx, rdi
sub rdx, r8
mov rcx, qword [rbp - 0x10]
mov rax, rcx
sub rax, r8
cmp rdx, rax
ja 0x1400a1a49
mov qword [rbp - 0x18], rdi
lea r9, [rbp - 0x28]
cmp rcx, 8
cmovae r9, qword [rbp - 0x28]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x1400a1a3b
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r12w
jmp 0x1400a19a0
lfence
mov word [rsp + 0x20], r12w
mov r9, rdx
movzx r8d, bl
lea rcx, [rbp - 0x28]
call fcn.14000fea0
jmp 0x1400a19a0
lfence
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.14000d0d0
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rsi + 0x10], xmm1
jmp 0x1400a1af5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x38], eax
lea rax, [0x14016c220]
mov qword [rbp - 0x30], rax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [r15], xmm0
mov qword [rsi], r12
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 7
mov word [rsi], r12w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x1400a1af5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a1af0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a1b13
call fcn.1400d45f0
mov rax, rsi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d45d0
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400e6180
int3
Function at 0x1400a1b20
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, qword [rsp + 0x80]
lea rax, [0x14016bcb0]
mov qword [rsp + 0x38], rax
mov r11d, r8d
mov dword [rsp + 0x30], 0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
mov r10, qword [r9]
mov r8, qword [r9 + 8]
sub r8, r10
mov eax, r8d
cmp rax, r8
jne 0x1400a1ba1
cmp qword [rdx + 0x18], 8
jb 0x1400a1b69
mov rdx, qword [rdx]
mov dword [rsp + 0x28], r8d
mov r9d, r11d
xor r8d, r8d
mov qword [rsp + 0x20], r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400a1b9b
mov dword [rsp + 0x30], eax
lea rax, [0x14016c220]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
call fcn.1400102c0
lea rdx, [0x140167a60]
lea rcx, [rsp + 0x30]
call fcn.1400d9ba0
int3

Function at 0x1400a1df0
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14016b010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r9
mov rdi, rdx
mov rbx, rcx
movzx eax, byte [r8 + 0x20]
cmp al, 1
jne 0x1400a1e26
mov r8d, dword [r8]
call fcn.1400a2410
jmp 0x1400a1f5a
cmp al, 2
jne 0x1400a1e34
call fcn.1400a2510
jmp 0x1400a1f5a
cmp al, 3
jne 0x1400a1eb6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov rdx, r8
lea rcx, [rsp + 0x30]
call fcn.1400a1cd0
nop
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
mov r8d, 7
mov rdx, rdi
mov rcx, rbx
call fcn.1400a1b20
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400a1f5a
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a1eac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a1f6f
call fcn.1400d45f0
jmp 0x1400a1f5a
cmp al, 4
jne 0x1400a1ed2
mov qword [rsp + 0x20], rsi
mov r9, r8
mov r8d, 3
call fcn.1400a1b20
jmp 0x1400a1f5a
cmp al, 5
jne 0x1400a1ee0
mov r8, qword [r8]
call fcn.1400a2490
jmp 0x1400a1f5a
cmp al, 6
jne 0x1400a1eeb
call fcn.1400a25f0
jmp 0x1400a1f5a
test al, al
jne 0x1400a1f4d
xor ecx, ecx
mov dword [rsp + 0x30], ecx
lea rax, [0x14016bcb0]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r9], xmm0
cmp qword [rdx + 0x18], 8
jb 0x1400a1f14
mov rdi, qword [rdx]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400a1f5a
mov dword [rsp + 0x30], eax
lea rax, [0x14016c220]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
jmp 0x1400a1f5a
mov edx, 2
mov rcx, rsi
call fcn.1400a3120
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d45d0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
call fcn.1400e6180
int3
Function at 0x1400a2410
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [0x14016bcb0]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov rbx, r9
movups xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x40], r8d
movups xmmword [r9], xmm0
cmp qword [rdx + 0x18], 8
jb 0x1400a2445
mov rdx, qword [rdx]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400a2482
mov dword [rsp + 0x30], eax
lea rax, [0x14016c220]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret

Function at 0x1400a2490
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [0x14016bcb0]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov rbx, r9
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], r8
movups xmmword [r9], xmm0
cmp qword [rdx + 0x18], 8
jb 0x1400a24c5
mov rdx, qword [rdx]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400a2502
mov dword [rsp + 0x30], eax
lea rax, [0x14016c220]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret

Function at 0x1400a2510
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [0x14016bcb0]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov rbx, r9
movups xmm0, xmmword [rsp + 0x30]
mov r10, rdx
mov rdx, r8
movups xmmword [r9], xmm0
mov r9, qword [r8 + 0x18]
cmp r9, 8
jb 0x1400a2549
mov rdx, qword [r8]
mov rax, 0xffffffffffffffff
cmp word [rdx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400a2550
lea rdx, [rax*2 + 2]
mov eax, edx
cmp rax, rdx
jne 0x1400a25bb
cmp r9, 8
jb 0x1400a2574
mov r8, qword [r8]
cmp qword [r10 + 0x18], 8
jb 0x1400a257e
mov r10, qword [r10]
mov dword [rsp + 0x28], edx
mov r9d, 1
mov qword [rsp + 0x20], r8
mov rdx, r10
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400a25b5
mov dword [rsp + 0x30], eax
lea rax, [0x14016c220]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
call fcn.1400102c0
lea rdx, [0x140167a60]
lea rcx, [rsp + 0x30]
call fcn.1400d9ba0
int3
Function at 0x1400a25f0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [0x14016bcb0]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov rbx, r9
movups xmm0, xmmword [rsp + 0x30]
mov r10, rdx
mov rdx, r8
movups xmmword [r9], xmm0
mov r9, qword [r8 + 0x18]
cmp r9, 8
jb 0x1400a2629
mov rdx, qword [r8]
mov rax, 0xffffffffffffffff
cmp word [rdx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400a2630
lea rdx, [rax*2 + 2]
mov eax, edx
cmp rax, rdx
jne 0x1400a269b
cmp r9, 8
jb 0x1400a2654
mov r8, qword [r8]
cmp qword [r10 + 0x18], 8
jb 0x1400a265e
mov r10, qword [r10]
mov dword [rsp + 0x28], edx
mov r9d, 2
mov qword [rsp + 0x20], r8
mov rdx, r10
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400a2695
mov dword [rsp + 0x30], eax
lea rax, [0x14016c220]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
add rsp, 0x50
pop rbx
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
call fcn.1400102c0
lea rdx, [0x140167a60]
lea rcx, [rsp + 0x30]
call fcn.1400d9ba0
int3
Function at 0x1400a2990
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14016b010]
xor rax, rsp
mov qword [rbp - 8], rax
mov r13, r9
mov r12, rdx
mov rbx, rcx
xor r14d, r14d
mov dword [rbp - 0x3c], r14d
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov qword [rbp - 0x10], r14
mov dword [rbp - 0x3c], 1
mov r15, qword [r8 + 8]
mov rsi, qword [r8]
mov rax, qword [rbp - 0x18]
cmp rsi, r15
je 0x1400a2a67
nop dword [rax + rax]
mov rdi, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400a29fd
mov rdi, qword [rsi]
mov rdx, rsi
jb 0x1400a2a05
mov rdx, qword [rsi]
mov rcx, 0xffffffffffffffff
nop dword [rax]
lea rcx, [rcx + 1]
cmp word [rdx + rcx*2], 0
jne 0x1400a2a10
lea r14, [rcx + 1]
lea r14, [rdi + r14*2]
cmp rdi, r14
je 0x1400a2a5b
cmp rax, qword [rbp - 0x10]
je 0x1400a2a40
movzx ecx, byte [rdi]
mov byte [rax], cl
mov rax, qword [rbp - 0x18]
inc rax
mov qword [rbp - 0x18], rax
jmp 0x1400a2a53
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400a34a0
mov rax, qword [rbp - 0x18]
inc rdi
cmp rdi, r14
jne 0x1400a2a28
add rsi, 0x20
cmp rsi, r15
jne 0x1400a29f0
xor r14d, r14d
mov edi, 2
nop dword [rax]
mov byte [rbp - 0x40], 0
cmp rax, qword [rbp - 0x10]
je 0x1400a2a8a
mov byte [rax], 0
mov rax, qword [rbp - 0x18]
inc rax
mov qword [rbp - 0x18], rax
jmp 0x1400a2a9e
lea r8, [rbp - 0x40]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400a34a0
mov rax, qword [rbp - 0x18]
sub rdi, 1
jne 0x1400a2a70
mov dword [rbp - 0x38], r14d
lea rcx, [0x14016bcb0]
mov qword [rbp - 0x30], rcx
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [r13], xmm0
mov r8, qword [rbp - 0x20]
sub rax, r8
mov ecx, eax
cmp rcx, rax
jne 0x1400a2b73
cmp qword [r12 + 0x18], 8
jb 0x1400a2ada
mov r12, qword [r12]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
mov r9d, 7
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400a2b13
mov dword [rbp - 0x38], eax
lea rax, [0x14016c220]
mov qword [rbp - 0x30], rax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [r13], xmm0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400a2b49
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a2b44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a2b6d
call fcn.1400d45f0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d45d0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400e6180
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x38]
call fcn.1400102c0
lea rdx, [0x140167a60]
lea rcx, [rbp - 0x38]
call fcn.1400d9ba0
int3

Function at 0x1400a74a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add rsp, 0x30
pop rbx
ret
Function at 0x1400a7690
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14016b010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rcx
mov qword [rsp + 0x20], rcx
lea rax, vtable.Base::Exclusions.0
mov qword [rcx], rax
lea rax, vtable.WindowsEnvironment.0
mov qword [rcx + 8], rax
lea rax, [0x1400a7630]
mov qword [rcx + 0x10], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a7701
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400a7701
mov qword [rdi + 0x10], rax
lea rcx, [rdi + 0x18]
lea rdx, [rdi + 8]
call fcn.1400a99b0
nop
lea rbx, [rdi + 0x58]
mov qword [rsp + 0x28], rbx
mov ecx, 0x38
call fcn.1400d4898
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rax], edx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rdx
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 0x28], rcx
mov word [rax + 0x30], cx
mov byte [rax + 0x32], cl
mov qword [rbx], rax
mov qword [rdi + 0x60], rdx
mov qword [rdi + 0x68], rdx
mov qword [rdi + 0x70], rdx
lea rcx, [rdi + 0x78]
mov edx, 2
call fcn.1400d6d0c
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov ecx, 0x18
mov eax, dword [rcx + rsi]
test al, 1
jne 0x1400a77a1
or eax, 1
mov dword [rcx + rsi], eax
mov ebx, 0x10
xor eax, eax
mov qword [rbx + rsi], rax
call fcn.1400ad5c0
mov qword [rbx + rsi], rax
jmp 0x1400a77a6
mov ebx, 0x10
lea r9, [0x14012d73b]
lea r8, str.Base::Exclusions::Exclusions
mov rdx, qword [rsi + rbx]
lea rcx, [rsp + 0x28]
call fcn.140057520
lea rcx, [rsp + 0x28]
call fcn.140016f70
nop
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d45d0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400afbb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14016b010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x1400afd12
cmp byte [rdx + 4], 0
je 0x1400afbee
mov eax, dword [rcx]
cmp dword [rdx], eax
jl 0x1400afd12
mov r9, r8
mov r8, rdx
lea rdx, str._H:_M:_S
lea rcx, [rbp + 0xf]
call fcn.1400aebb0
nop
mov dword [rbp + 7], 0
cmp byte [rbx + 0x10], 0
je 0x1400afcb1
lea rax, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rax, qword [rbp + 0xf]
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x1f]
mov qword [rbp - 1], rax
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x2f]
call fcn.1400b1900
lea rdx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rdx, qword [rbp + 0x2f]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, dword [rbp + 0x3f]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rdx, qword [rbp + 0x47]
cmp rdx, 8
jb 0x1400afcdb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400afcaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400afd35
call fcn.1400d45f0
jmp 0x1400afcdb
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rdx, qword [rbp + 0xf]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, dword [rbp + 0x1f]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x1400afd12
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400afd0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400afd2f
call fcn.1400d45f0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400d45d0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rbp
ret
call fcn.1400e6180
nop
call fcn.1400e6180
nop
int3
Function at 0x1400b0b40
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14016b010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, qword [r8]
mov r14, r9
mov rbp, qword [rsp + 0xe0]
mov rsi, rdx
mov r15, qword [rsp + 0xe8]
mov rbx, rcx
mov r12, qword [rsp + 0xf0]
test rdi, rdi
je 0x1400b0c46
cmp qword [rdi + 8], 0xffffffffffffffff
je 0x1400b0c46
cmp byte [rcx + 4], 0
je 0x1400b0ba9
mov eax, dword [rdi]
cmp dword [rcx], eax
jl 0x1400b0c46
mov r9, rsi
lea rdx, str._FT_T
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.1400aebb0
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
xor eax, eax
mov qword [rsp + 0x68], 0xffffffffffffffff
cmp qword [rsp + 0x50], 0x10
mov dword [rsp + 0x30], eax
cmovae rdx, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x1400b0c46
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b0c41
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b0c8e
call fcn.1400d45f0
mov rcx, qword [r14]
test rcx, rcx
je 0x1400b0c59
mov r8, rsi
mov rdx, rbx
call fcn.1400aee70
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.1400b1430
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400d45d0
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400e6180
int3

Function at 0x1400e5c18
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1400e5c4f
call fcn.1400f1154
mov dword [rax], 0x16
call fcn.1400e6160
xor eax, eax
jmp 0x1400e5cdd
mov rdx, r9
mov rcx, r8
call fcn.1400e5bb4
mov rbx, rax
test rax, rax
je 0x1400e5cda
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1400e5ae0]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400e5cc7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400f10c8
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400e5cae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400e5cbd
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1400fc1dc
jmp 0x1400e5cda
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400e5cd7
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140102f58
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400fc590
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140102ff9
cmp ebx, dword [rsp + 0x30]
je 0x140102ff2
test esi, esi
je 0x140102ff2
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140102fcd
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140102fda
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140102fb7
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x140102fde
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140102ffb
mov eax, 1
jmp 0x140102ffb
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140103404
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14010341a
mov al, 1
jmp 0x14010347a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14010342b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140103478
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400f3764
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140103478
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140103478
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140103478
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14010347a
xor al, al
add rsp, 0x20
pop rbx
ret