joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cbbe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push r12
push r13
sub rsp, 0x28
mov qword [rsp + 0x58], rdi
mov r12, rdx
mov qword [rsp + 0x60], r14
mov rsi, rcx
mov qword [rsp + 0x20], r15
call fcn.14002cd50
mov r14, rax
call fcn.1400d39f0
mov r8, qword [rsi]
xor r13d, r13d
mov rdi, 0xffffffffffffffff
mov r15, rax
mov rdx, rdi
mov r9, qword [r8]
mov word [r9], r13w
mov r8, qword [rsi]
mov rcx, qword [r8]
nop dword [rax]
inc rdx
cmp word [rcx + rdx*2], r13w
jne 0x1400cbc30
mov r8d, dword [rsi + 8]
movsxd rax, edx
mov qword [rsp + 0x50], rbx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400cbc76
movsxd rbx, eax
mov rdx, r14
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
mov r14, qword [rsp + 0x60]
mov rdx, rdi
nop
inc rdx
cmp word [rcx + rdx*2], r13w
jne 0x1400cbc80
movsxd rax, edx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400cbcc1
movsxd rbx, eax
lea rdx, str.Binaries_
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
mov rdx, rdi
inc rdx
cmp word [rcx + rdx*2], r13w
jne 0x1400cbcc4
movsxd rax, edx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400cbd01
movsxd rbx, eax
mov rdx, r15
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
mov r15, qword [rsp + 0x20]
mov rdx, rdi
nop dword [rax]
inc rdx
cmp word [rcx + rdx*2], r13w
jne 0x1400cbd10
movsxd rax, edx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400cbd51
movsxd rbx, eax
lea rdx, [0x140270c00]
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
inc rdi
cmp word [rcx + rdi*2], r13w
jne 0x1400cbd51
movsxd rax, edi
sub r8d, edi
mov rdi, qword [rsp + 0x58]
lea rbp, [rcx + rax*2]
test r8d, r8d
jle 0x1400cbd8e
movsxd rbx, r8d
mov rdx, r12
mov rcx, rbp
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + rbx*2 - 2], r13w
mov rax, qword [rsi]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rbx, qword [rsp + 0x50]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x1400d1a50
Capabilities:
Create process memory minidump

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rbx, r9
mov rdi, r8
mov ebp, edx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
mov qword [rsp + 0x30], 0
cmp r14, rax
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
setne sil
mov rcx, rbx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1400d1abf
xor al, al
jmp 0x1400d1b6a
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x64], rax
mov eax, dword [rdi + 0x54]
add eax, eax
mov dword [rsp + 0x60], ebp
cmp dword [rdi + 0x50], 0
mov dword [rsp + 0x6c], esi
mov dword [rsp + 0x50], 0x10000
mov dword [rsp + 0x54], eax
je 0x1400d1af1
mov rax, qword [rdi + 0x48]
jmp 0x1400d1af8
lea rax, [0x1402655d8]
mov qword [rsp + 0x58], rax
mov rcx, rdi
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x44], rax
call fcn.140033730
xor ebx, ebx
mov ecx, 0x1826
test al, al
cmovne ebx, ecx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov qword [rsp + 0x30], 0
mov r9d, ebx
mov edx, eax
mov r8, r15
lea rax, [rsp + 0x40]
mov rcx, r14
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call sub.dbghelp.dll_MiniDumpWriteDump
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
sete al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x1400d1b90
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
lea rax, [0x140280708]
mov qword [rcx + 8], rdx
mov qword [rcx], rax
mov r10, rdx
xor eax, eax
mov dword [rcx + 0x40], r8d
mov qword [rcx + 0x30], rax
mov rbx, rcx
mov qword [rcx + 0x38], rax
mov eax, dword [rsp + 0x50]
mov dword [rcx + 0x48], eax
lea rax, [rdx - 1]
mov dword [rcx + 0x44], r9d
cmp rax, 0xfffffffffffffffd
ja 0x1400d1be4
lea rdx, [rsp + 0x30]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rax, qword [rsp + 0x30]
mov qword [rbx + 0x38], rax
xorps xmm0, xmm0
mov rax, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
add rsp, 0x20
pop rbx
ret
Function at 0x1400d21a0
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword gs:[0x58]
mov ecx, dword [0x140442618]
mov edx, 0x1c
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140419a48], eax
jg 0x1400d238b
mov ecx, dword [0x140419a40]
test ecx, ecx
je 0x1400d21e5
lea eax, [rcx - 1]
test eax, eax
jne 0x1400d2374
lea r9, [rbp + 0x10]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1402ff120]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400d236e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x68], rdi
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x60], r14
xor r14d, r14d
mov qword [rbp - 0x30], r14
mov edx, r14d
mov dword [rbp - 0x28], edx
mov ecx, r14d
mov dword [rbp - 0x24], ecx
test rdi, rdi
je 0x1400d2289
cmp word [rdi], cx
je 0x1400d2289
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], cx
jne 0x1400d2244
inc ebx
test ebx, ebx
jle 0x1400d2264
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.14001ca50
mov ecx, dword [rbp - 0x24]
mov edx, dword [rbp - 0x28]
lea eax, [rbx + rdx]
mov dword [rbp - 0x28], eax
cmp eax, ecx
jle 0x1400d2277
lea rcx, [rbp - 0x30]
call fcn.14001c660
mov rcx, qword [rbp - 0x30]
mov rdx, rdi
movsxd r8, ebx
add r8, r8
call fcn.140034be0
lea r9, [0x140270c00]
mov dword [rsp + 0x20], 1
lea r8, [0x1402667e0]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call fcn.1400218d0
mov rcx, qword [rax]
mov r8d, dword [rax + 8]
mov qword [rax], r14
mov qword [rbp - 0x40], rcx
mov ecx, dword [rax + 0xc]
mov qword [rax + 8], r14
mov eax, r8d
neg eax
mov dword [rbp - 0x38], r8d
mov dword [rbp - 0x34], ecx
sbb edx, edx
add edx, 7
add edx, r8d
cmp edx, ecx
jle 0x1400d22e2
lea rcx, [rbp - 0x40]
call fcn.14001ca50
mov r8d, 6
lea rdx, str._Epic_
lea rcx, [rbp - 0x40]
call fcn.14001ee30
mov rcx, qword [0x140419a38]
mov rsi, qword [rbp - 0x40]
mov ebx, dword [rbp - 0x38]
mov edi, dword [rbp - 0x34]
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
mov r14, qword [rsp + 0x60]
test rcx, rcx
je 0x1400d2320
call fcn.14004dcf0
mov rcx, qword [rbp - 0x20]
mov qword [0x140419a38], rsi
mov rsi, qword [rsp + 0x90]
mov dword [0x140419a40], ebx
mov rbx, qword [rsp + 0x88]
mov dword [0x140419a44], edi
mov rdi, qword [rsp + 0x68]
test rcx, rcx
je 0x1400d2356
call fcn.14004dcf0
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400d2364
call fcn.14004dcf0
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [0x140419a40]
test ecx, ecx
lea rax, [0x1402655d8]
cmovne rax, qword [0x140419a38]
add rsp, 0x70
pop rbp
ret
lea rcx, [0x140419a48]
call fcn.14024fed0
cmp dword [0x140419a48], 0xffffffff
jne 0x1400d21d0
lea rcx, [0x140260ca0]
call fcn.14024fd30
lea rcx, [0x140419a48]
call fcn.14024fe70
jmp 0x1400d21d0
Function at 0x1400d2a70
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x538
mov rax, qword [0x14035e6e8]
xor rax, rsp
mov qword [rsp + 0x520], rax
call fcn.1400d7fe0
cmp qword [rsp + 0x548], 0
je 0x1400d2ab2
cmp dword [rsp + 0x550], 0
jne 0x1400d2ab9
xor eax, eax
jmp 0x1400d2b5d
mov r8d, dword [rsp + 0x540]
xor edx, edx
mov ecx, 0x1b
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400d2adf
xor eax, eax
jmp 0x1400d2b5d
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rcx, [rsp + 0x30]
call fcn.1400d1c00
mov dword [rsp + 0x70], 0x100001
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x510], rax
mov dword [rsp + 0x28], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400d2b43
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x550]
mov rcx, qword [rsp + 0x548]
call fcn.1400d2860
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.140250070
add rsp, 0x538
ret
Function at 0x1400d3b90
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0xa8
mov rax, qword [0x14035e6e8]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp qword [0x14035a020], 0
jne 0x1400d3cdc
xorps xmm0, xmm0
mov qword [r11 + 8], rbx
movups xmmword [rsp + 0x50], xmm0
mov qword [r11 + 0x10], rsi
lea rcx, [r11 - 0x58]
mov qword [r11 - 8], rdi
mov edi, 0x40
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x28], xmm0
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rbx, qword [rsp + 0x58]
mov r9d, 0x3f
mov ecx, dword [rsp + 0x48]
mov rax, qword [rsp + 0x78]
mov qword [0x14035a028], rax
mov eax, dword [rsp + 0x24]
mov qword [0x14035a048], rax
mov qword [0x14035a030], rax
lea rax, [rbx - 1]
mov qword [0x14035a040], rcx
mov qword [0x14035a038], rcx
bsr r10, rbx
mov qword [0x14035a020], rbx
setne r11b
bsr rcx, rax
mov eax, r9d
setne r8b
sub eax, ecx
mov ecx, eax
xor esi, esi
test r8b, r8b
mov eax, edi
mov edx, esi
cmovne eax, esi
cmovne edx, ecx
or dl, al
sub r9d, r10d
sub dil, dl
mov eax, r9d
test r11b, r11b
mov ecx, esi
mov edx, 1
cmovne ecx, eax
mov eax, 0xffffffff
cmovne eax, esi
mov rsi, qword [rsp + 0xb8]
or rcx, rax
lea rax, [rbx + 0x3fffffff]
mov rbx, qword [rsp + 0xb0]
shl rcx, 0x39
sar rcx, 0x3f
not cl
and cl, dil
mov rdi, qword [rsp + 0xa0]
shl rdx, cl
shr rax, 0x1e
mov dword [0x14035a058], eax
mov qword [0x14035a050], rdx
lea rax, [0x14035a020]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140250070
add rsp, 0xa8
ret
Function at 0x1400d3d10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov eax, 0x80
mov qword [rcx], rsi
mov edi, esi
mov qword [rcx + 8], rsi
cmp eax, esi
mov rbx, rcx
jle 0x1400d3d4a
mov dword [rbx + 8], eax
cmp eax, dword [rbx + 0xc]
jle 0x1400d3d59
mov edx, edi
mov rcx, rbx
call fcn.14001c660
jmp 0x1400d3d59
jge 0x1400d3d59
je 0x1400d3d59
mov rcx, rbx
mov dword [rbx + 8], eax
call fcn.14001c770
mov rdx, qword [rbx]
mov ecx, dword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1400d3ddc
movsxd rdi, dword [rbx + 8]
cmp eax, edi
jae 0x1400d3d34
inc eax
cmp eax, edi
jle 0x1400d3db4
mov esi, eax
mov dword [rbx + 8], eax
sub esi, edi
cmp eax, dword [rbx + 0xc]
jle 0x1400d3d8d
mov edx, edi
mov rcx, rbx
call fcn.14001c660
mov rax, qword [rbx]
xor edx, edx
movsxd r8, esi
add r8, r8
lea rcx, [rax + rdi*2]
call sub.VCRUNTIME140.dll_memset
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
jge 0x1400d3dfb
mov ecx, edi
sub ecx, eax
je 0x1400d3dfb
sub edi, ecx
mov rcx, rbx
mov dword [rbx + 8], edi
call fcn.14001c770
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], esi
test eax, eax
jns 0x1400d3df0
xor edx, edx
mov rcx, rbx
call fcn.14001ca50
mov rax, qword [rbx]
test rax, rax
je 0x1400d3dfb
mov word [rax], si
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d77f0
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0xc0
mov rax, qword [0x14035e6e8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
call fcn.140025400
xorps xmm0, xmm0
mov qword [rbx + 0x70], 0
movups xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0xa0], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x50], rdx
mov qword [rbx + 0x50], rcx
mov rcx, qword [rsp + 0x68]
cmovbe rdx, qword [rsp + 0x50]
mov qword [rbx + 0x58], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rbx], rax
mov rax, qword [rsp + 0x30]
mov qword [rbx + 0x60], rcx
mov rcx, qword [rsp + 0xa0]
mov qword [rbx + 0x40], rax
mov rax, rbx
mov qword [rbx + 0x68], rcx
mov qword [rbx + 0x48], rdx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140250070
add rsp, 0xc0
pop rbx
ret
Function at 0x1400d8570
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x14035e6e8]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor r12d, r12d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x20], r12
mov r14, r8
mov qword [rsp + 0x28], r12
mov r15, rdx
mov dil, 1
mov esi, r12d
mov r13d, r12d
test rdx, rdx
je 0x1400d863c
cmp word [rdx], r12w
je 0x1400d863c
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdx + rbx*2], r12w
jne 0x1400d85d3
inc ebx
test ebx, ebx
jle 0x1400d85fd
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.14001ca50
mov r13d, dword [rsp + 0x2c]
mov esi, dword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
mov edx, esi
add esi, ebx
mov dword [rsp + 0x28], esi
cmp esi, r13d
jle 0x1400d8622
lea rcx, [rsp + 0x20]
call fcn.14001c660
mov r13d, dword [rsp + 0x2c]
mov esi, dword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
movsxd r8, ebx
mov rdx, r15
add r8, r8
mov rcx, r12
call fcn.140034be0
mov eax, 4
test esi, esi
jne 0x1400d8641
mov eax, 5
lea edx, [rsi + rax]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x3c], r13d
cmp edx, r13d
jle 0x1400d8661
lea rcx, [rsp + 0x30]
call fcn.14001ca50
mov r8d, 3
lea rdx, [0x140274470]
lea rcx, [rsp + 0x30]
call fcn.140020780
cmp dword [rsp + 0x38], 0
lea rbx, [0x1402655d8]
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x20]
mov r8, rbx
movzx r9d, dil
cmovne r8, qword [rsp + 0x30]
call fcn.1400dca30
cmp dword [rsp + 0x28], 0
lea rdx, [rsp + 0x50]
cmovne rbx, qword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, qword [rsp + 0x20]
mov rbx, rax
test rcx, rcx
je 0x1400d86cb
call fcn.14004dcf0
cmp rbx, 0xffffffffffffffff
je 0x1400d8735
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rsp + 0x7c]
movzx eax, word [rsp + 0x7e]
cmp cx, 0x2e
jne 0x1400d8706
test ax, ax
je 0x1400d8715
cmp cx, cx
jne 0x1400d8706
cmp ax, cx
jne 0x1400d8706
cmp word [rbp - 0x80], 0
je 0x1400d8715
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x50]
call qword [r14]
movzx edi, al
test dil, dil
je 0x1400d872c
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400d86e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400d8744
call fcn.14004dcf0
movzx eax, dil
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140250070
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400da980
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rbx
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
xor bl, bl
mov qword [r11 + 0x20], rsi
xor r14d, r14d
mov qword [r11 - 0x38], r12
mov rax, rdx
mov r13d, r14d
mov r15, r9
mov rdi, r8
mov edx, 0x200
nop dword [rax]
test bl, bl
jne 0x1400dab5b
mov r9d, 0x100
mov qword [rbp - 0x20], r14
test r13d, r13d
cmove r9d, edx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], rdx
or r9d, 0x20019
mov rdx, rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400dab41
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, rdi
mov dword [rbp - 0x28], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400dab37
mov eax, dword [rbp - 0x28]
test eax, eax
je 0x1400dab37
mov ecx, eax
call fcn.140012750
mov rcx, qword [rbp - 0x20]
mov r12, rax
lea rax, [rbp - 0x28]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400dab2f
mov esi, dword [rbp - 0x28]
mov rbx, r14
shr esi, 1
mov edi, r14d
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], 0
test r12, r12
je 0x1400daae9
cmp esi, 1
jbe 0x1400daae9
cmp word [r12], ax
je 0x1400daae9
test esi, esi
je 0x1400daaaa
mov edx, esi
lea rcx, [rbp - 0x18]
call fcn.14001ca50
mov r14d, dword [rbp - 0xc]
mov edi, dword [rbp - 0x10]
mov rbx, qword [rbp - 0x18]
mov edx, edi
add edi, esi
mov dword [rbp - 0x10], edi
cmp edi, r14d
jle 0x1400daaca
lea rcx, [rbp - 0x18]
call fcn.14001c660
mov r14d, dword [rbp - 0xc]
mov edi, dword [rbp - 0x10]
mov rbx, qword [rbp - 0x18]
lea r8, [rsi*2 - 2]
mov rdx, r12
mov rcx, rbx
call fcn.140034be0
movsxd rax, edi
xor esi, esi
mov word [rbx + rax*2 - 2], si
jmp 0x1400daaeb
xor esi, esi
lea rax, [rbp - 0x18]
cmp r15, rax
je 0x1400dab19
mov rcx, qword [r15]
test rcx, rcx
je 0x1400dab01
call fcn.14004dcf0
mov qword [r15], rbx
mov dword [r15 + 0xc], r14d
xor r14d, r14d
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rsi
mov dword [r15 + 8], edi
jmp 0x1400dab29
test rbx, rbx
je 0x1400dab26
mov rcx, rbx
call fcn.14004dcf0
xor r14d, r14d
mov rdi, qword [rbp + 0x48]
mov bl, 1
mov rcx, r12
call fcn.1400127e0
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbp + 0x40]
inc r13d
mov rcx, qword [rbp + 0x38]
mov edx, 0x200
cmp r13d, 2
jl 0x1400da9c0
mov r12, qword [rsp + 0x50]
movzx eax, bl
mov rsi, qword [rsp + 0xa8]
add rsp, 0x58
pop r15
pop r14
pop r13
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400dad40
Capabilities:
Parse pe header

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push r15
sub rsp, 0x68
mov eax, 0x5a4d
mov r15, rdx
mov rbx, rcx
cmp word [rcx], ax
jne 0x1400daf37
mov qword [r11 - 0x28], r12
movsxd r12, dword [rcx + 0x3c]
add r12, rcx
cmp dword [r12], 0x4550
jne 0x1400daf28
mov r8d, dword [r12 + 0x90]
mov rdx, r12
mov qword [r11 + 0x10], rbp
mov qword [r11 - 0x30], r13
call fcn.1400d8ee0
xor ebp, ebp
mov qword [rsp + 0x90], rax
mov r13d, ebp
cmp dword [r12 + 0x94], ebp
jbe 0x1400daf0c
mov qword [rsp + 0x58], rdi
mov ecx, ebp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x40], r14
nop
cmp dword [rcx + rax], 0
jne 0x1400dade6
cmp dword [rcx + rax + 4], 0
jne 0x1400dade6
cmp dword [rcx + rax + 8], 0
jne 0x1400dade6
cmp dword [rcx + rax + 0xc], 0
jne 0x1400dade6
cmp dword [rcx + rax + 0x10], 0
je 0x1400daefd
mov eax, dword [rcx + rax + 0xc]
test eax, eax
je 0x1400daed2
mov r8d, eax
mov rdx, r12
mov rcx, rbx
call fcn.1400d8ee0
mov qword [rsp + 0x30], rbp
mov rdi, rax
mov qword [rsp + 0x38], 0
mov r14, rbp
mov esi, ebp
test rax, rax
je 0x1400dae8c
cmp byte [rax], 0
je 0x1400dae8c
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400dae27
inc ebx
test ebx, ebx
jle 0x1400dae4f
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.14001ca50
mov ebp, dword [rsp + 0x3c]
mov esi, dword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
mov edx, esi
add esi, ebx
mov dword [rsp + 0x38], esi
cmp esi, ebp
jle 0x1400dae72
lea rcx, [rsp + 0x30]
call fcn.14001c660
mov ebp, dword [rsp + 0x3c]
mov esi, dword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
mov eax, 0x3f
mov r9d, ebx
mov r8, rdi
mov word [rsp + 0x20], ax
mov edx, ebx
mov rcx, r14
call fcn.14001da70
movsxd rbx, dword [r15 + 8]
lea eax, [rbx + 1]
mov dword [r15 + 8], eax
cmp eax, dword [r15 + 0xc]
jle 0x1400daea7
mov edx, ebx
mov rcx, r15
call fcn.14001c290
mov rax, rbx
mov qword [rsp + 0x30], 0
mov rbx, qword [rsp + 0x80]
shl rax, 4
add rax, qword [r15]
mov qword [rax], r14
mov dword [rax + 0xc], ebp
xor ebp, ebp
mov qword [rsp + 0x38], rbp
mov dword [rax + 8], esi
mov eax, dword [r12 + 0x94]
inc r13
lea rcx, [r13*4]
add rcx, r13
shl rcx, 2
cmp rcx, rax
mov rax, qword [rsp + 0x90]
jb 0x1400dadc0
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
mov r13, qword [rsp + 0x48]
mov al, 1
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x50]
add rsp, 0x68
pop r15
pop rbx
ret
mov r12, qword [rsp + 0x50]
xor al, al
add rsp, 0x68
pop r15
pop rbx
ret
xor al, al
add rsp, 0x68
pop r15
pop rbx
ret