joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a100
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
mov eax, 0x2050
call fcn.140018420
sub rsp, rax
mov rax, qword [0x14004d028]
xor rax, rsp
mov qword [rsp + 0x2040], rax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rax, [rsp + 0x2068]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x2060]
call fcn.140008b70
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov edx, 0x5000
mov rcx, qword [rsp + 0x2060]
call fcn.140009cb0
shl rax, 1
mov ecx, 0x800
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
cmp rcx, rax
jb 0x14000a1bd
mov qword [rsp + 0x30], 0
jmp 0x14000a248
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x2060]
lea rcx, [rsp + 0x40]
call fcn.140008ba0
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
call fcn.140008c30
lea rax, [rsp + 0x1040]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rax, [rsp + 0x1040]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea r9, [rsp + 0x40]
lea r8, [0x1400440b8]
mov edx, 0x800
lea rcx, [rsp + 0x1040]
call fcn.140009c30
lea rcx, [rsp + 0x1040]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x1040]
call fcn.140009cf0
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140017a80
add rsp, 0x2050
pop rdi
ret

Function at 0x14000a270
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x260
mov rax, qword [0x14004d028]
xor rax, rsp
mov qword [rsp + 0x250], rax
cmp dword [0x14004da84], 0xffffffff
jne 0x14000a33b
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x38], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140044698]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000a2ea
mov dword [0x14004da84], 0
xor eax, eax
jmp 0x14000a341
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140044bd8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000a326
mov dword [0x14004da84], 0
jmp 0x14000a330
mov dword [0x14004da84], 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x14004da84]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140017a80
add rsp, 0x260
pop rdi
ret
Function at 0x14000f1b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x260
mov rax, qword [0x14004d028]
xor rax, rsp
mov qword [rsp + 0x250], rax
cmp dword [0x14004da88], 0xffffffff
jne 0x14000f27b
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x38], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140045450]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000f22a
mov dword [0x14004da88], 0
xor eax, eax
jmp 0x14000f281
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140045488]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000f266
mov dword [0x14004da88], 0
jmp 0x14000f270
mov dword [0x14004da88], 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x14004da88]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140017a80
add rsp, 0x260
pop rdi
ret
Function at 0x14000f6b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
mov eax, 0x2050
call fcn.140018420
sub rsp, rax
mov rax, qword [0x14004d028]
xor rax, rsp
mov qword [rsp + 0x2040], rax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rax, [rsp + 0x2068]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x2060]
call fcn.140008b70
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov edx, 0x5000
mov rcx, qword [rsp + 0x2060]
call fcn.140009cb0
shl rax, 1
mov ecx, 0x800
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
cmp rcx, rax
jb 0x14000f76d
mov qword [rsp + 0x30], 0
jmp 0x14000f7f8
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x2060]
lea rcx, [rsp + 0x40]
call fcn.140008ba0
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
call fcn.140008c30
lea rax, [rsp + 0x1040]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rax, [rsp + 0x1040]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea r9, [rsp + 0x40]
lea r8, [0x1400454a8]
mov edx, 0x800
lea rcx, [rsp + 0x1040]
call fcn.140009c30
lea rcx, [rsp + 0x1040]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x1040]
call fcn.14000f2a0
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140017a80
add rsp, 0x2050
pop rdi
ret
Function at 0x14000fa30
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2a0
mov rax, qword [0x14004d028]
xor rax, rsp
mov qword [rsp + 0x298], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x38], eax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x14000faa3
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x2c0]
call fcn.140007d80
mov eax, dword [rsp + 0x30]
jmp 0x14000fbcd
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x14000faf9
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x2c0]
call fcn.140007d80
mov eax, dword [rsp + 0x34]
jmp 0x14000fbcd
mov dword [rsp + 0x290], 0
mov rcx, qword [rsp + 0x2c0]
call fcn.140007460
mov rdx, rax
lea rcx, [rsp + 0x7c]
call fcn.140024a74
test eax, eax
jne 0x14000fb91
lea rdx, [rsp + 0x290]
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x14000fb3a
jmp 0x14000fba9
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x290], eax
je 0x14000fb49
jmp 0x14000fb91
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x14000fb8f
mov r8, qword [rsp + 0x2b8]
mov edx, 0xf01ff
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000fba9
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000faf9
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x3c], eax
mov rcx, qword [rsp + 0x2c0]
call fcn.140007d80
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x298]
xor rcx, rsp
call fcn.140017a80
add rsp, 0x2a0
pop rdi
ret
Function at 0x140010160
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x4e0
mov rax, qword [0x14004d028]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x50], 0
mov rax, qword [rsp + 0x4f0]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov qword [rsp + 0x68], 0
lea rcx, [rsp + 0x80]
call fcn.14000f020
nop
cmp qword [rsp + 0x4f0], 0xffffffff80000001
jne 0x140010298
lea rcx, [rsp + 0x80]
call fcn.14000f820
test eax, eax
je 0x140010275
lea rcx, [rsp + 0x80]
call fcn.14000ff20
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x140010252
mov qword [rsp + 0x70], 0xffffffff80000003
mov rax, qword [rsp + 0x4f8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
lea r8, str._s_s
mov edx, 0x200
lea rcx, [rsp + 0xd0]
call fcn.140009c30
jmp 0x140010273
mov r9, qword [rsp + 0x4f8]
lea r8, [0x140046fac]
mov edx, 0x200
lea rcx, [rsp + 0xd0]
call fcn.140009c30
jmp 0x140010296
mov r9, qword [rsp + 0x4f8]
lea r8, [0x140046fac]
mov edx, 0x200
lea rcx, [rsp + 0xd0]
call fcn.140009c30
jmp 0x1400102b9
mov r9, qword [rsp + 0x4f8]
lea r8, [0x140046fac]
mov edx, 0x200
lea rcx, [rsp + 0xd0]
call fcn.140009c30
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140010375
cmp dword [rsp + 0x520], 0
jne 0x140010311
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x80]
call fcn.14000f0a0
mov eax, dword [rsp + 0x54]
jmp 0x1400103ef
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140010375
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x80]
call fcn.14000f0a0
mov eax, dword [rsp + 0x58]
jmp 0x1400103ef
mov eax, dword [rsp + 0x510]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x508]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x518]
xor r8d, r8d
mov rdx, qword [rsp + 0x500]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400103bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x5c], eax
jmp 0x1400103c3
mov dword [rsp + 0x50], 1
cmp qword [rsp + 0x78], 0
je 0x1400103d6
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0x80]
call fcn.14000f0a0
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.140017a80
add rsp, 0x4e0
pop rdi
ret

Function at 0x140010e60
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
call fcn.140010db0
cmp eax, 1
jne 0x140010e7e
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400111b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x280
mov rax, qword [0x14004d028]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor r9d, r9d
mov r8d, 0x25
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x140011206
xor al, al
jmp 0x14001133f
mov edx, 8
lea rcx, [rsp + 0x48]
call fcn.1400013a0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.14000be30
nop
lea rdx, str.drivers
lea rcx, [rsp + 0x48]
call fcn.140015d10
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.1400013a0
lea rcx, [rsp + 0x40]
call fcn.140008f60
nop
lea r8, [0x1400443bc]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.140012a40
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140009170
nop
lea rcx, [rsp + 0x38]
call fcn.14000a3d0
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x40]
call fcn.140015d10
mov dword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.1400099d0
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x298]
mov rcx, rax
call fcn.140011070
movzx eax, al
test eax, eax
je 0x140011309
cmp dword [rsp + 0x50], 1
jne 0x1400112dd
mov byte [rsp + 0x20], 1
jmp 0x1400112e2
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0x40]
call fcn.14000a3d0
nop
lea rcx, [rsp + 0x48]
call fcn.14000a3d0
movzx eax, byte [rsp + 0x21]
jmp 0x14001133f
mov byte [rsp + 0x22], 1
lea rcx, [rsp + 0x40]
call fcn.14000a3d0
nop
lea rcx, [rsp + 0x48]
call fcn.14000a3d0
movzx eax, byte [rsp + 0x22]
jmp 0x14001133f
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140017a80
add rsp, 0x280
pop rdi
ret

Function at 0x140011b40
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x260
mov rax, qword [0x14004d028]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x38], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SOFTWAREWOW6432NodeLenovoImControllerApplicabilityTags
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140011bb2
lea rcx, str.InstallSetting_RegOpenKeyEx_tag_faile
call fcn.140010e60
mov eax, 0xffffffff
jmp 0x140011c0d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.System.Profile.Gaming
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140011c00
lea rcx, str.InstallSetting_RegQueryValueEx_tag_faile
call fcn.140010e60
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x140011c0d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140017a80
add rsp, 0x260
pop rdi
ret
Function at 0x1400143e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x24c0
call fcn.140018420
sub rsp, rax
mov rax, qword [0x14004d028]
xor rax, rsp
mov qword [rsp + 0x24b0], rax
mov dword [rsp + 0x50], 0
lea rax, [rsp + 0x4b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x2000
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x24d0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x60]
call fcn.14000f020
nop
cmp qword [rsp + 0x24e0], 0
jne 0x140014489
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x60]
call fcn.14000f0a0
movzx eax, byte [rsp + 0x30]
jmp 0x140014648
cmp qword [rsp + 0x24d0], 0xffffffff80000001
jne 0x14001453c
lea rcx, [rsp + 0x60]
call fcn.14000f820
test eax, eax
je 0x140014519
lea rcx, [rsp + 0x60]
call fcn.14000ff20
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400144f6
mov qword [rsp + 0x40], 0xffffffff80000003
mov rax, qword [rsp + 0x24d8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x38]
lea r8, str._s_s
mov edx, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140009c30
jmp 0x140014517
mov r9, qword [rsp + 0x24d8]
lea r8, [0x140046fac]
mov edx, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140009c30
jmp 0x14001453a
mov r9, qword [rsp + 0x24d8]
lea r8, [0x140046fac]
mov edx, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140009c30
jmp 0x14001455d
mov r9, qword [rsp + 0x24d8]
lea r8, [0x140046fac]
mov edx, 0x200
lea rcx, [rsp + 0xb0]
call fcn.140009c30
cmp dword [rsp + 0x24f0], 0
je 0x140014571
mov dword [rsp + 0x34], 0x101
jmp 0x140014579
mov dword [rsp + 0x34], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x34]
xor r8d, r8d
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400145bb
mov byte [rsp + 0x31], 0
lea rcx, [rsp + 0x60]
call fcn.14000f0a0
movzx eax, byte [rsp + 0x31]
jmp 0x140014648
mov dword [rsp + 0x50], 0x2000
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x24e0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140014618
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x32], 0
lea rcx, [rsp + 0x60]
call fcn.14000f0a0
movzx eax, byte [rsp + 0x32]
jmp 0x140014648
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x24e8]
mov ecx, dword [rsp + 0x4b0]
mov dword [rax], ecx
mov byte [rsp + 0x33], 1
lea rcx, [rsp + 0x60]
call fcn.14000f0a0
movzx eax, byte [rsp + 0x33]
mov rcx, qword [rsp + 0x24b0]
xor rcx, rsp
call fcn.140017a80
add rsp, 0x24c0
pop rdi
ret
Function at 0x140016940
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x260
mov rax, qword [0x14004d028]
xor rax, rsp
mov qword [rsp + 0x250], rax
cmp dword [0x14004da90], 0xffffffff
jne 0x140016a0b
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x38], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140046418]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400169ba
mov dword [0x14004da90], 0
xor eax, eax
jmp 0x140016a11
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400464b8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400169f6
mov dword [0x14004da90], 0
jmp 0x140016a00
mov dword [0x14004da90], 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x14004da90]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140017a80
add rsp, 0x260
pop rdi
ret
Function at 0x140016e40
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
mov eax, 0x2050
call fcn.140018420
sub rsp, rax
mov rax, qword [0x14004d028]
xor rax, rsp
mov qword [rsp + 0x2040], rax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rax, [rsp + 0x2068]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x2060]
call fcn.140008b70
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov edx, 0x5000
mov rcx, qword [rsp + 0x2060]
call fcn.140009cb0
shl rax, 1
mov ecx, 0x800
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
cmp rcx, rax
jb 0x140016efd
mov qword [rsp + 0x30], 0
jmp 0x140016f88
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x2060]
lea rcx, [rsp + 0x40]
call fcn.140008ba0
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
call fcn.140008c30
lea rax, [rsp + 0x1040]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rax, [rsp + 0x1040]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea r9, [rsp + 0x40]
lea r8, [0x1400464d8]
mov edx, 0x800
lea rcx, [rsp + 0x1040]
call fcn.140009c30
lea rcx, [rsp + 0x1040]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x1040]
call fcn.140016a30
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140017a80
add rsp, 0x2050
pop rdi
ret

Function at 0x140018788
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400187d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400187d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400187d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400187d2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400187d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400187d4
xor al, al
add rsp, 0x28
ret
Function at 0x1400318c4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003194b
mov rsi, rbx
cmp word [rax], bp
je 0x14003190a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400318f4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400318f0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14002dfe0
mov rdi, rax
test rax, rax
je 0x140031938
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140019db0
mov rbp, rdi
xor ecx, ecx
call fcn.14002dfa4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14003422c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140034242
mov al, 1
jmp 0x1400342a2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140034253
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400342a0
mov ecx, dword [rcx + 0x18]
nop
call fcn.140032024
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400342a0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400342a0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400342a0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400342a2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140037ba0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140037bc8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140037bc8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret