joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6dad4920
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6dad4930
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6dad4940
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6dad4981
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6dad4978
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6dad4983
add rax, 0x28
cmp rax, r9
jne 0x6dad4964
xor eax, eax
ret

Function at 0x6dad4a20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6daf21f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6dad4a8d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6dad4a8d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6dad4a8d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6dad4a84
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6dad4a8f
add rax, 0x28
cmp rax, r9
jne 0x6dad4a70
xor eax, eax
add rsp, 0x28
ret

Function at 0x6dad4b90
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6daf21f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6dad4bb0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6dad4ba8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6dad4c0d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6dad4c04
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6dad4c14
add rax, 0x28
cmp rax, r9
jne 0x6dad4bf0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6dad4c30
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6daf21f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6dad4c9e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6dad4c9e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6dad4c9e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6dad4c9e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6dad4c95
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6dad4ca5
add rcx, 0x28
cmp rcx, rax
jne 0x6dad4c80
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6dad4cb8
jmp 0x6dad4c9e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6dad4cc6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6dad4c9e
test r9d, r9d
jg 0x6dad4cb0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6dad5000
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x14000b9fc
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b77c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba52
mov ecx, 1
call fcn.14000b77c
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
adc dword [rbx], 0x21ab4890
push 0xffffffffffffff9f
sbb bh, byte [rdi + 0x5bdcd1e9]
invalid
Function at 0x14003be10
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x280
mov ebx, r9d
mov rsi, r8
mov edi, edx
mov r14, rcx
mov rax, qword [0x140216028]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1401ed060]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003bebf
mov r15, rax
lea r9, [rsp + 0x68]
mov qword [r9], 0
mov rcx, r14
xor edx, edx
xor r8d, r8d
call qword [case.0x140173770.0]
test eax, eax
jns 0x14003be9b
test bl, bl
je 0x14003be9b
lea r9, [rsp + 0x68]
mov rcx, r14
mov edx, 0x8800
xor r8d, r8d
mov rax, r15
call qword [case.0x140173770.0]
test eax, eax
setns bl
jns 0x14003bf78
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14003bf57
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x14003bf57
lea r14, [rsp + 0x70]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.140112970
mov word [r14], 0
mov qword [rsp + 0x20], r14
xor ecx, ecx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x14003bf19
cmp eax, 0x80070057
je 0x14003bf19
test bl, bl
je 0x14003bf19
or edi, 0xa000
mov qword [rsp + 0x20], r14
xor ecx, ecx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
setns bl
js 0x14003bf57
lea rdi, [rsp + 0x30]
mov qword [rdi], r14
mov rcx, r14
call fcn.140133dc4
mov qword [rdi + 8], rax
lea r14, [rsp + 0x40]
mov rcx, r14
mov rdx, rdi
call fcn.1400ed090
mov rcx, rsi
mov rdx, r14
call fcn.1400ed2c0
mov rcx, r14
call fcn.1400ed250
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140110830
mov eax, ebx
add rsp, 0x280
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdx, qword [rsp + 0x68]
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.14014b030
movzx eax, byte [rdi + 0x17]
test al, al
mov rcx, qword [rdi]
cmovns rcx, rdi
lea rdx, [rsp + 0x58]
mov qword [rdx], rcx
cmovs rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea r14, [rsp + 0x70]
mov rcx, r14
call fcn.1400ed090
mov rcx, rsi
mov rdx, r14
call fcn.1400ed2c0
mov rcx, r14
call fcn.1400ed250
cmp byte [rdi + 0x17], 0
jns 0x14003bea6
mov rcx, qword [rsp + 0x40]
call fcn.14010f324
jmp 0x14003bea6

Function at 0x14003bff0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rcx, section..rdata
mov edx, 0xd
mov r8, rsi
xor r9d, r9d
call fcn.14003be10
test al, al
je 0x14003c01b
mov al, 1
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1401be010]
mov edx, 5
mov r8, rsi
mov r9b, 1
add rsp, 0x20
pop rsi
jmp fcn.14003be10

Function at 0x14003c040
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x1401be020]
mov edx, 0x27
mov r8, rsi
xor r9d, r9d
call fcn.14003be10
test al, al
je 0x14003c06b
mov al, 1
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1401be010]
mov edx, 5
mov r8, rsi
mov r9b, 1
add rsp, 0x20
pop rsi
jmp fcn.14003be10
Function at 0x14003c090
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rcx, [0x1401be040]
mov edx, 0xe
mov r8, rsi
xor r9d, r9d
call fcn.14003be10
test al, al
je 0x14003c0bb
mov al, 1
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1401be010]
mov edx, 5
mov r8, rsi
mov r9b, 1
add rsp, 0x20
pop rsi
jmp fcn.14003be10

Function at 0x140040310
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r9
mov r15, r8
mov r14, rcx
mov rax, qword [0x140216028]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rdi, [rcx + 0x10]
mov rcx, rdi
call fcn.1400dfcb0
mov ebx, eax
test al, al
je 0x140040417
mov rax, qword [r15 + 8]
mov dword [rax], 0x20
mov ecx, dword [r14 + 0x20]
mov dword [rax + 4], ecx
mov dword [rax + 0xc], 0
mov ecx, dword [r14 + 0x18]
cmp ecx, 2
ja 0x14004036d
mov dword [rax + 8], ecx
mov rcx, qword [r14 + 0x28]
mov rdx, qword [r14 + 0x30]
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rcx
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14], rax
mov rcx, rdi
mov rdx, r14
call fcn.140071110
xor eax, eax
mov qword [rsp + 0x28], rax
mov r15, qword [r14]
mov qword [r14], rax
cmp r15, 0xffffffffffffffff
je 0x1400403b7
test r15, r15
je 0x1400403db
call fcn.1400ec7c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [r15 + 1]
cmp rax, 2
jb 0x1400403d3
mov qword [rsp + 0x28], r15
call fcn.1400ec7c0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
call fcn.1400f5700
cmp qword [rsi], 0
je 0x140040432
mov rcx, qword [rsi + 8]
lea rsi, [rsp + 0x30]
mov rdx, rsi
call fcn.1400f5670
mov rcx, rsi
call fcn.1400f57b0
mov rax, qword [rsp + 0x40]
inc rax
cmp rax, 2
jae 0x140040435
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140110830
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
int3
call fcn.1400ec7c0
mov rcx, qword [rsp + 0x40]
call fcn.1400df420
jmp 0x140040417

Function at 0x140054db0
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rsi, rcx
mov rax, qword [0x140216028]
xor rax, rsp
mov qword [rsp + 0x238], rax
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0x101
lea rbx, [rsp + 0x30]
mov r8d, 0x202
mov rcx, rbx
mov dl, 0xaa
call fcn.140112970
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test eax, eax
jne 0x140054e23
test edi, edi
setne bl
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.140110830
mov eax, ebx
add rsp, 0x240
pop rbx
pop rdi
pop rsi
ret
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.140133dc4
mov rcx, rsi
mov rdx, rbx
mov r8, rax
call fcn.140061bf0
jmp 0x140054e01
Function at 0x140062920
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, [0x1401ea040]
mov qword [rcx], rax
add rcx, 8
call fcn.1400d9840
lea rcx, [rsi + 0x10]
call fcn.1400d9840
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.1400d9840
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
mov ebp, 0x3f800000
mov dword [rsi + 0xd0], ebp
mov dword [rsi + 0xd8], ebx
movups xmmword [rsi + 0xe0], xmm6
movups xmmword [rsi + 0xf0], xmm6
mov dword [rsi + 0x100], ebp
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
mov dword [rsi + 0x128], ebp
movups xmmword [rsi + 0x140], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x150], ebp
movups xmmword [rsi + 0x158], xmm6
movups xmmword [rsi + 0x168], xmm6
mov dword [rsi + 0x178], ebp
mov qword [rsi + 0x198], rbx
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebx
mov eax, dword [0x1401fa988]
mov dword [rsi + 0x1a0], eax
lea rcx, [rsi + 0x1a8]
call fcn.14007e8f0
movups xmmword [rsi + 0x2e0], xmm6
movups xmmword [rsi + 0x2f0], xmm6
mov dword [rsi + 0x300], ebp
movups xmmword [rsi + 0x308], xmm6
movups xmmword [rsi + 0x318], xmm6
movups xmmword [rsi + 0x328], xmm6
mov byte [rsi + 0x338], bl
mov dword [rsi + 0x33c], edi
mov byte [rsi + 0x340], bl
movups xmmword [rsi + 0x348], xmm6
mov qword [rsi + 0x358], rbx
call fcn.140038260
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x190], eax
mov eax, eax
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x188], rax
mov edx, dword [rsi + 0x1a0]
mov rax, qword [rsi + 0x1b0]
mov rcx, rax
shr rcx, 6
test dword [0x1401fa98c], edx
je 0x140062b1b
cmp rax, 0x40
mov eax, 0x3e8
cmovb rcx, rax
call fcn.1400f5a80
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x140062b3f
call fcn.1400653f0
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.1400654a0
mov qword [0x14022e7d0], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
test dword [0x1401fa990], edx
jne 0x140062b52
test dword [0x1401fa994], edx
jne 0x140062b60
cmp rax, 0x40
mov eax, 0xfa0
cmovb rcx, rax
call fcn.14007e6e0
jmp 0x140062adc
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x140173770.0]
jmp 0x140062ae9
cmp rax, 0x40
mov eax, 0x100
jmp 0x140062ad3
cmp rax, 0x40
mov eax, 0x7a1200
jmp 0x140062b34
Function at 0x140064440
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov edi, 2
cmp rdx, 1
jne 0x140064470
mov rbx, qword [rsi + 8]
cmp rdi, rbx
jbe 0x14006447e
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400dee80
lea rax, [rdx - 1]
test rdx, rax
jne 0x140064494
mov rdi, rdx
jmp 0x140064455
jae 0x140064581
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x1400644a1
cvtsi2ss xmm0, rax
jmp 0x1400644b6
mov rcx, rdx
call fcn.1400da400
mov rdi, rax
jmp 0x140064455
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.14012ae0c
cvttss2si rax, xmm0
mov rcx, rax
subss xmm0, dword [0x1401db0a8]
cvttss2si rdx, xmm0
sar rcx, 0x3f
and rdx, rcx
or rdx, rax
cmp rbx, 3
jb 0x140064569
mov rax, rbx
shr rax, 1
movabs rcx, 0x5555555555555555
and rcx, rax
mov rax, rbx
sub rax, rcx
movabs rcx, 0x3333333333333333
mov r8, rax
shr r8, 2
and rax, rcx
and r8, rcx
add r8, rax
mov rax, r8
shr rax, 4
add rax, r8
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rax
movabs rax, 0x101010101010101
imul rax, rcx
shr rax, 0x38
cmp eax, 1
ja 0x140064569
lea rax, [rdx - 1]
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
cmp rdx, 2
cmovb rax, rdx
jmp 0x140064571
mov rcx, rdx
call fcn.1400da400
cmp rdi, rax
cmovbe rdi, rax
cmp rdi, rbx
jb 0x14006445e
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140065cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x140216028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea r8, [rsp + 0x38]
mov dword [r8], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140065d59
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x140065d43
cmp dword [rsp + 0x38], 4
jne 0x140065d43
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140110830
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x140065d43
Function at 0x140065d60
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.1401107d0
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140216028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.140112970
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140065e24
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x140065e28
lea rcx, [rsp + 0x840]
call fcn.140133dc4
lea rdx, [rsp + 0x840]
mov rcx, rsi
mov r8, rax
call fcn.140061bf0
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140110830
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x140065e05
cmp eax, 2
jne 0x140065e7d
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.140112970
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x140065e84
lea rcx, [rsp + 0x40]
call fcn.140133dc4
lea rdx, [rsp + 0x40]
jmp 0x140065df8
mov edi, 0x3f4
jmp 0x140065e05
mov edi, 0xea
jmp 0x140065e05
Function at 0x1400664d0
Capabilities:
Create thread

Disassembly:
jmp 0x1400664d0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r13d, dword [rsp + 0xd0]
mov rax, qword [0x140216028]
xor rax, rsp
mov qword [rsp + 0x60], rax
shl ebp, 0x10
mov ecx, 0x18
call fcn.14010f2e8
mov rsi, rax
movabs r12, 0xfffffffc00000000
mov rax, r15
and rax, r12
cmp rax, qword [0x140225fc8]
je 0x14006659e
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r13d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x140066980]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x1400665a8
test r14, r14
je 0x1400665ec
mov qword [r14], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140110830
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
call fcn.1400c2bb0
jmp 0x140066535
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x1400665c1
mov ebp, eax
cmp eax, 0x5af
je 0x1400665c1
cmp ebp, 0xe
jne 0x1400665f7
mov rcx, rbx
call fcn.14017f330
test rsi, rsi
je 0x140066578
mov rcx, qword [rsi]
and r12, rcx
cmp r12, qword [0x140225fc8]
jne 0x1400665e2
call fcn.1400c2d00
mov rcx, rsi
call fcn.14010f324
jmp 0x140066578
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140066578
mov eax, dword [0x14022e860]
mov ecx, dword [0x140226bdc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14006666a
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov edx, ebp
call fcn.14006dc40
movzx eax, byte [rbx + 0x17]
test al, al
mov rcx, qword [rbx]
cmovns rcx, rbx
cmovs rax, qword [rbx + 8]
lea rdx, [rsp + 0x50]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, qword [0x14022e858]
call fcn.1400f6bb0
cmp byte [rbx + 0x17], 0
jns 0x1400665c9
mov rcx, qword [rsp + 0x38]
call fcn.14010f324
jmp 0x1400665c9
lea rcx, [0x14022e860]
call fcn.14010f440
cmp dword [0x14022e860], 0xffffffff
jne 0x140066618
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.140080c70
mov qword [0x14022e858], rax
lea rcx, [0x14022e860]
call fcn.14010f4d8
jmp 0x140066618

Function at 0x140066e20
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140066e67
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140066e81
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140066e5f
mov qword [rsi], rdi
call fcn.1400ec7c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140066e97
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400ec7c0
mov rcx, qword [rsi]
call fcn.1400df420
mov qword [rsi], 0
jmp 0x140066e4d
int3
Function at 0x140066ed0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r14, qword [rdx]
mov qword [rdx], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x140066efa
call fcn.1400ec7c0
cmp qword [rsi], r14
je 0x140066f29
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140066f64
cmp r15, 2
jb 0x140066f21
mov qword [rsi], r14
call fcn.1400ec7c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140066f4e
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400ec7c0
mov rcx, qword [rdi]
call fcn.1400df420
mov qword [rdi], 0
jmp 0x140066f3f
call fcn.1400ec7c0
mov rcx, qword [rsi]
call fcn.1400df420
mov qword [rsi], 0
jmp 0x140066f13

Function at 0x140067340
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140216028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x50]
mov qword [r14 + 0x40], r12
movaps xmm0, xmmword [0x1401ec750]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x97
call fcn.1400ec7a0
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400e2f30
test esi, esi
js 0x14006744a
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], 0
call fcn.1400f7cf0
test al, al
jne 0x140067451
lea r14, [rsp + 0x2c]
mov dword [r14], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [r14]
lea rcx, [rsp + 0x30]
call fcn.1400f7d80
lea rcx, [rsp + 0x50]
call fcn.1400e3170
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140110830
mov eax, esi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14006741d
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.140180bc0
jmp 0x1400673e2