joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401629e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r14
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov r14, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140162a25
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x50], rdi
cmp r15d, dword [rbp + 0x1c]
jbe 0x140162a70
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, r14
call qword [rbp + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbp + 0x18]
add r14, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, r14
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor esi, esi
test r15, r15
je 0x140162ad2
mov rsi, r15
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rbp + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rbp + reloc.WS2_32.dll_htonl]
sub r15, 1
jne 0x140162a90
mov eax, dword [rbp + 0x1c]
cmp rsi, rax
jae 0x140162b13
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1401a2b00]
mov r8d, 1
call qword [rbp + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1401a2b01]
mov r8d, 1
call qword [rbp + reloc.WS2_32.dll_htonl]
mov eax, dword [rbp + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140162ae0
mov rdi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
Function at 0x140162b30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push r12
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
mov r12, r9
mov rcx, r8
mov r14, rdx
call fcn.1400e52d0
mov r8d, dword [rbp + 0x18]
mov ecx, dword [rbp + 0x20]
add rcx, 0x18
mov r15d, eax
lea r9d, [r8 + r8]
add rcx, r9
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140162cd6
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x58], rsi
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x60], rdi
cmp r15d, dword [rbp + 0x1c]
jbe 0x140162bc0
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, r14
call qword [rbp + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbp + 0x18]
add r14, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, r14
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor esi, esi
test r15, r15
je 0x140162c22
mov rsi, r15
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x50]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x50], al
mov rcx, qword [rbx + 8]
call qword [rbp + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x50]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x50], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rbp + reloc.WS2_32.dll_htonl]
sub r15, 1
jne 0x140162be0
mov eax, dword [rbp + 0x1c]
cmp rsi, rax
jae 0x140162c63
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1401a2b00]
mov r8d, 1
call qword [rbp + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1401a2b01]
mov r8d, 1
call qword [rbp + reloc.WS2_32.dll_htonl]
mov eax, dword [rbp + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140162c30
mov rcx, qword [rsp + 0x70]
call fcn.1400e52d0
mov r9, qword [rbx]
mov r8d, eax
mov rcx, qword [rbx + 8]
mov rdx, r12
call qword [r9 + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rbx]
test rdi, rdi
jne 0x140162c92
mov edi, dword [rsi + 0x18]
add rdi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rdi
call qword [rsi + reloc.WS2_32.dll_recv]
mov r8d, dword [rsi + 0x20]
mov rdx, rdi
mov rcx, qword [rbx + 0x10]
call qword [rsi + reloc.WS2_32.dll_htonl]
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
call qword [rsi + reloc.WS2_32.dll_recv]
mov rcx, rbx
call qword [fcn.140165b32]
mov rdi, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
mov eax, 0x1b
add rsp, 0x20
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
Function at 0x140162e00
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401c7f00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140162e4c
mov eax, 0x1b
jmp 0x140162f1e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140162e90
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x140162f1e
mov rcx, rbp
call fcn.1400e52d0
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
lea edx, [r8 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x140162efa
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140162f0a
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140162f1c
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140164680
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140163cd0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x140163d35
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x140163ce0
ret

Function at 0x140163f1c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140163f56
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140163f5b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140163fa4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140163fa4
dec r8
sub rdx, 1
jne 0x140163f8a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140165754
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14016579e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14016579e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14016579e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14016579e
cmp dword [rcx + 0x84], 0xe
jbe 0x14016579e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401657a0
xor al, al
add rsp, 0x28
ret
Function at 0x14001943c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x1400306f8], rbx
je 0x1400194a3
cmp rax, rbx
jne 0x140019496
mov ebx, 1
mov esi, ebx
jmp 0x1400194a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14001947b
mov ebx, 1
mov eax, dword [0x140030700]
cmp eax, ebx
jne 0x1400194c0
mov edi, 0x1f
mov ecx, edi
call fcn.1401a2000
jmp 0x14001952c
mov eax, dword [0x140030700]
test eax, eax
jne 0x140019521
mov dword [0x140030700], ebx
lea r15, [0x14001dcb8]
lea rdi, [0x14001dca0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x140019513
test eax, eax
jne 0x140019517
cmp qword [rdi], r14
je 0x140019508
mov rax, qword [rdi]
mov rcx, qword [0x14001dc18]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400194ea
test eax, eax
je 0x140019527
mov eax, 0xff
jmp 0x140019682
mov dword [0x14002ffb4], ebx
mov edi, 0x1f
mov eax, dword [0x140030700]
cmp eax, ebx
jne 0x140019553
lea rdx, [0x14001dc98]
lea rcx, [0x14001dc20]
call sub.msvcrt.dll__initterm
mov dword [0x140030700], 2
test esi, esi
jne 0x140019561
mov rax, r14
xchg qword [0x1400306f8], rax
cmp qword [0x140030718], r14
je 0x140019594
lea rcx, [0x140030718]
call fcn.140019a50
test eax, eax
je 0x140019594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140030718]
mov r9, qword [0x14001dc18]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x1400195ad
mov eax, 0xff
jmp 0x140019682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140019633
test ax, ax
je 0x1400195c8
test edx, edx
jne 0x140019633
sub ax, bx
cmp ax, di
ja 0x1400195de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400195c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003e4c
mov dword [0x14002ffb0], eax
cmp dword [0x14002ffd0], r14d
jne 0x14001961c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14002ffb4], r14d
jne 0x140019631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14002ffb0]
jmp 0x140019682
cmp ax, 0x22
jne 0x140019647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400195b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140019ad0
add rsp, 0x28
jmp 0x14001943c
Function at 0x1400050ac
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x80
cmp qword [rdx + 8], 0xffffffffffffffff
mov r14, r8
mov rbx, rdx
mov esi, ecx
je 0x1400051fc
cmp qword [rdx], 0xffffffffffffffff
je 0x1400051fc
mov rdx, qword [rdx + 0x10]
xor r8d, r8d
call fcn.140016154
test rax, rax
js 0x1400051fc
mov rcx, qword [rbx + 8]
inc rcx
call fcn.14000f284
mov rdi, rax
test rax, rax
je 0x1400051fc
mov r8d, dword [rbx + 8]
mov rdx, rax
mov ecx, esi
call fcn.140019db0
movsxd rcx, eax
mov rax, qword [rbx + 8]
cmp rcx, rax
jne 0x1400051f4
cmp dword [rbx + 0x18], 0
jne 0x140005149
mov byte [rax + rdi], 0
test r14, r14
je 0x140005141
mov eax, dword [rbx + 8]
mov dword [r14], eax
mov rax, rdi
jmp 0x1400051fe
cmp dword [rbx + 0x18], 8
jne 0x1400051f4
and qword [rsp + 0x50], 0
lea r8, [0x14002a578]
and qword [rsp + 0x58], 0
lea rcx, [rsp + 0x20]
and qword [rsp + 0x60], 0
mov r9d, 0x58
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], eax
lea edx, [r9 - 0x67]
call fcn.14000945c
test eax, eax
js 0x1400051f4
mov rcx, qword [rbx]
inc rcx
call fcn.14000f284
mov rsi, rax
test rax, rax
je 0x1400051f4
mov ecx, dword [rbx]
mov edx, 1
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
call fcn.140007df0
mov rcx, rdi
test eax, eax
jns 0x1400051cb
call fcn.14000f270
mov rcx, rsi
jmp 0x1400051f7
mov rax, qword [rbx]
mov byte [rsi + rax], 0
call fcn.14000f270
lea rcx, [rsp + 0x20]
call fcn.140009404
test eax, eax
js 0x1400051c6
test r14, r14
je 0x1400051ef
mov eax, dword [rbx]
mov dword [r14], eax
mov rax, rsi
jmp 0x1400051fe
mov rcx, rdi
call fcn.14000f270
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x1400054a4
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax + 0x20], 0
lea rax, [rax - 0x18]
mov rsi, r8
mov qword [rsp + 0x28], rax
mov r9, r8
mov dword [rsp + 0x20], 0x10000
mov rbp, rcx
mov r8, rcx
xor ecx, ecx
mov rdi, rdx
call fcn.1400166bc
mov rbx, rax
test rax, rax
jne 0x14000550b
lea rax, [rsp + 0x30]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8, rbp
and dword [rsp + 0x20], ebx
mov edx, edi
xor ecx, ecx
call fcn.1400166bc
mov rbx, rax
cmp dword [0x14003a040], 0
je 0x1400055c2
lea rcx, [0x14002ad10]
call fcn.14000f008
test rax, rax
je 0x140005542
lea rdx, [0x140029b0c]
mov rcx, rax
call fcn.140018970
neg eax
sbb ecx, ecx
and dword [0x14003a040], ecx
lea rcx, [0x14002ad18]
call fcn.14000f008
mov rdi, rax
test rax, rax
je 0x140005577
lea rdx, [0x140029b0c]
mov rcx, rax
call fcn.140018970
neg eax
sbb ecx, ecx
and ecx, dword [0x14003a040]
mov dword [0x14003a040], ecx
jmp 0x14000557d
mov ecx, dword [0x14003a040]
test ecx, ecx
jns 0x1400055b4
and dword [0x14003a040], 0
test rdi, rdi
je 0x1400055c2
lea rdx, [0x140029b04]
mov rcx, rdi
call fcn.140018970
mov ecx, dword [0x14003a040]
test eax, eax
mov edx, 1
cmove ecx, edx
mov dword [0x14003a040], ecx
test ecx, ecx
je 0x1400055c2
lea rcx, [0x14002ad28]
call fcn.14000532c
test rbx, rbx
je 0x1400055ec
or edx, 0xffffffff
mov rcx, rbx
call qword [0x140029078]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [0x140029088]
mov rcx, rbx
call qword [0x140029058]
jmp 0x1400055f5
mov rcx, rsi
call rbp
mov dword [rsp + 0x68], eax
cmp dword [0x14003ad48], 0
je 0x14000560c
mov rax, qword [0x14003ad70]
test rax, rax
je 0x14000560c
call rax
mov eax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000b128
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140029158]
test rax, rax
je 0x14000b172
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000b172
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000b172
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000b172
cmp dword [rcx + 0x84], 0xe
jbe 0x14000b172
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000b174
xor al, al
add rsp, 0x28
ret

Function at 0x14000f570
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000f403
xor ecx, ecx
call qword [0x140029158]
test rax, rax
je 0x14000f403
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f403
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f403
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f403
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f403
cmp dword [rcx + 0xf8], 0
je 0x14000f403
mov ecx, ebx
call fcn.14000f4a4
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000f294
cmp dword [rbp + 0x20], 0
je 0x14000f450
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000f458
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000f39c
Function at 0x140003bac
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x140019188]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
lea rax, [rsp + 0x30]
mov qword [r8], r15
lea rdx, [rsp + 0x30]
sub rcx, rax
mov r14, r8
mov r9d, 0x104
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x140003c1d
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140003c1d
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x140003bfb
test r9, r9
lea rax, [rdx - 2]
lea r8, [0x1400138f0]
cmovne rax, rdx
lea rcx, [rsp + 0x30]
mov word [rax], r15w
call fcn.140001c5c
mov ebx, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, ebx
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140003c93
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x140003d5c
mov edx, reloc.OLEAUT32.dll_CreateErrorInfo
mov rcx, qword [rbp + 0x168]
lea r8, [0x140013834]
call fcn.1400035c8
mov esi, eax
jmp 0x140003d5f
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r15d
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call fcn.140003a24
mov esi, eax
test eax, eax
jns 0x140003cd0
mov rcx, qword [rbp + 0x168]
lea r8, [0x140013834]
mov r9d, eax
mov edx, 0xcf
call fcn.140003590
jmp 0x140003d5f
lea r8, [0x1400138f8]
lea rcx, [rsp + 0x30]
call fcn.140001c5c
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140003d08
mov edx, 0xd5
jmp 0x140003c79
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140003a24
mov esi, eax
test eax, eax
jns 0x140003d40
mov rcx, qword [rbp + 0x168]
lea r8, [0x140013834]
mov r9d, eax
mov edx, 0xd7
call fcn.140003590
mov rcx, rbx
call fcn.140003664
jmp 0x140003d5f
mov rcx, rbx
call fcn.140003664
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
mov esi, r15d
test rdi, rdi
je 0x140003d6c
mov rcx, rdi
call fcn.140003664
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140010160
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140005dd0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
or rax, 0xffffffffffffffff
xor ebx, ebx
inc rax
cmp word [r8 + rax*2], bx
jne 0x140005ddc
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140005e31
mov rcx, qword [rsp + 0x38]
lea r8, str.onecoreuap_analog_sdk_simulation_servicesperceptionsimulationexemain.cpp
mov ebx, 0x80004005
mov edx, 0xd8
mov r9d, ebx
call fcn.140003590
mov eax, ebx
jmp 0x140005e33
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140005e40
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
lea rax, [0x140014280]
mov dword [rsp + 0x28], 0xb4
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140005e94
mov rcx, qword [rsp + 0x38]
lea r8, str.onecoreuap_analog_sdk_simulation_servicesperceptionsimulationexemain.cpp
mov r9d, 0x80004005
mov edx, 0xf6
call fcn.140003590
mov eax, 0x80004005
jmp 0x140005e96
xor eax, eax
add rsp, 0x38
ret
Function at 0x140010130
Capabilities:
Access peb ldr_data

Disassembly:
push rcx
push r11
push r13
sub rcx, rcx
add rcx, 0x60
mov r11, qword gs:[rcx]
push r10
mov rcx, r11
add rcx, 0x10
mov r10, qword [rcx]
add r11, 0x18
mov r13, qword [r11]
mov rcx, r13
add rcx, 0x10
mov r11, qword [rcx]
push r12
mov r13, r11
add r13, 0x30
mov rcx, qword [r13]
cmp rcx, 0
je 0x1400101a3
mov r13, qword [r11 + 0x60]
mov r12, qword [r13]
and r12d, 0xdf00df
mov r13, qword [r13 + 0xc]
shl r13d, 8
add r13d, r12d
shl r13d, 2
sub r13d, 0xc914cd2c
cmp r13, 0
je 0x1400101ab
mov r13, qword [r11]
mov r11, r13
jmp 0x14001015f
mov r11d, dword [rcx + 0x3c]
add r11, rcx
add r11, 0x10
mov r13d, dword [r11 + 0x78]
add r13, rcx
push rbx
mov r12d, dword [r13 + 0x20]
add r12, rcx
mov ebx, dword [r12]
add rbx, rcx
mov r11d, dword [rbx + 0xb]
sub r11d, 0x746365
test r11d, r11d
jne 0x1400101e1
jmp 0x1400101ef
inc r12
inc r12
inc r12
inc r12
jmp 0x1400101c5
mov r11d, dword [r13 + 0x20]
sub r12, r11
sub r12, rcx
shr r12d, 1
mov r11d, dword [r13 + 0x24]
add r11, r12
add r11, rcx
mov r12d, dword [r11]
mov r11d, dword [r13 + 0x1c]
and r12d, 0xffff
shl r12d, 2
add r11, rcx
add r11, r12
mov r12d, dword [r11]
mov r11d, 0x7f000
add r12, rcx
push rcx
add r11, r10
push r10
push r11
push rbx
push rbx
push r12
mov rcx, r11
mov r9, rsp
sub r8, r8
add r8, 0x40
mov edx, 0x55000
call r12
pop r13
pop rbx
pop rbx
pop r11
pop r10
mov ecx, 0x6ab5
movabs r13, 0x3a4c0
push r12
mov r12d, 4
imul ecx, r12d
movabs r12, 0x1f75
add rcx, r12
add rcx, r10
call 0x1400102ac
mov r11d, 0xbf000
movabs rcx, 0x58049
add rcx, r10
add r11, r10
mov r13d, 0x3aa0
call 0x1400102ac
pop r12
cmp rcx, r11
jne 0x1400102e4
mov r12d, dword [rcx]
xor r12d, 0x619baae3
dec r12
mov dword [r11], r12d
dec r13
dec r13
dec r13
inc rcx
inc rcx
inc rcx
inc rcx
add r11, 4
dec r13
test r13d, r13d
je 0x1400102e2
jmp 0x1400102ac
nop
ret
mov ecx, 0x8000000
movabs r11, 0x7f000
mov r13d, 0x22c
mov r12d, 7
imul r13d, r12d
add r11, r10
add r13d, 0xcc
sub r11, r13
mov r13, r11
sub r13, rcx
movabs rcx, 0x5cc49
add rcx, r10
mov r12d, dword [rcx]
xor r12d, 0x619baae3
dec r12
test r12d, r12d
je 0x140010349
add r12, r11
mov rbx, qword [r12]
add rbx, r13
mov qword [r12], rbx
mov dword [rsp], ebx
add rcx, 4
jmp 0x140010323
mov r11d, 0x67ae
movabs rcx, 0x63d0
sub rsp, 0x28
add rcx, 0x8294c
add rcx, r10
add rcx, r11
push rcx
mov rcx, r11
dec r11
jmp 0x1400102e2