joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rbx, [rsp - 0x48]
cmp rbx, qword [r15 + 8]
jbe fcn.140095ad0
mov rsp, rbx
mov eax, dword [r14 + 0x2e7a20]
lea rcx, [r14 + rax*8]
mov qword [rsp + 0x30], rcx
lea rbx, [r14 + 0x2e7a18]
mov qword [rsp + 0x28], rbx
cmp dword [r14 + 0x2e7a28], 1
jge 0x14001289b
mov dword [rsp + 0x24], eax
lea rdx, [r14 + 0x2a2f60]
mov eax, dword [rdx]
shr rax, 5
shl rax, 3
add rax, r14
mov rcx, rax
test rax, rax
cmove rcx, r14
nop
cmp rcx, r14
je 0x1400128c5
mov ebx, dword [rcx]
shr ebx, 5
cmp ebx, 0x471a7
jne 0x14001291b
test rax, rax
cmove rax, r14
mov ecx, dword [rcx + 0x68]
sar ecx, 8
and ecx, 0xfff
mov ecx, ecx
add rcx, rdx
mov qword [rsp + 0x40], rcx
cmp rax, r14
je 0x140012909
mov edx, dword [rax]
shr edx, 5
cmp edx, 0x471a7
jne 0x140012921
nop word [rax + rax]
nop
cmp dword [r14 + 0x2e7a28], 0x15
jge 0x1400128cb
mov eax, dword [r14 + 0x2e7a28]
cmp eax, 0x15
jae 0x140012915
mov edx, eax
mov esi, dword [r14 + rdx*4 + 0x2b9068]
mov dword [rsp + 0x20], esi
cmp dword [r14 + 0x2e7a2c], 0
je 0x140012855
lea rdi, [r14 + rsi*8]
mov qword [rsp + 0x18], rdi
jmp 0x140012802
mov dword [rsp + 0x3c], edx
mov eax, dword [r14 + rsi*8]
shr eax, 5
mov dword [rsp + 0x14], eax
mov r8, qword [r14 + rax*8 + 0xa8]
mov rdx, rdi
mov rax, r8
call rax
nop
mov edx, dword [rsp + 0x3c]
cmp edx, eax
jg 0x140012873
mov eax, dword [rsp + 0x14]
mov esi, dword [r14 + 0x2e7a2c]
mov rcx, qword [r14 + rax*8 + 0xb0]
mov rdx, qword [rsp + 0x18]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x40]
mov edi, 3
mov rax, rcx
call rax
nop
jmp 0x14001282d
mov edx, 1
add edx, dword [r14 + 0x2e7a2c]
mov dword [r14 + 0x2e7a2c], edx
lock add dword [rsp], 0
nop word [rax + rax]
test esi, esi
jne 0x140012780
jmp 0x14001290f
mov edx, 1
add edx, dword [r14 + 0x2e7a28]
mov dword [r14 + 0x2e7a28], edx
mov dword [r14 + 0x2e7a2c], 0
lock add dword [rsp], 0
jmp 0x140012720
mov eax, 0xffffffff
add eax, dword [r14 + rdx*4 + 0x29f480]
mov dword [r14 + 0x2e7a2c], eax
lock add dword [rsp], 0
jmp 0x14001275a
mov edx, 1
add edx, dword [r14 + 0x2e7a28]
mov dword [r14 + 0x2e7a28], edx
mov dword [r14 + 0x2e7a2c], 0
lock add dword [rsp], 0
jmp 0x140012720
nop dword [rax + rax]
test eax, eax
je 0x140012927
mov dword [r14 + rax*8 + 4], 0
mov rdx, rcx
mov dword [rsp + 0x24], eax
call fcn.1400e8590
nop
nop
jmp 0x1400126a0
call fcn.1401079b0
nop
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x14001292d
mov edx, dword [r14 + rax*8]
shr edx, 5
mov rax, qword [r14 + rdx*8 + 0xb8]
mov rdx, qword [rsp + 0x30]
call rax
nop
mov rdx, qword [rsp + 0x28]
call fcn.140010f00
nop
add rsp, 0x48
sub dword [r15 + 0x10], 1
jle fcn.140116590
ret
call fcn.1401079b0
nop
call fcn.1401079b0
nop
call fcn.140107b20
nop
call fcn.1401073f0
nop
call fcn.1401073f0
nop
call fcn.1401079b0
nop
call fcn.1401079b0
nop
int3
Function at 0x140121940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rbx, [rsp - 0x48]
cmp rbx, qword [r15 + 8]
jbe fcn.140095bf0
mov rsp, rbx
lea rdx, [r14 + 0x2c8de8]
lea r8, [r14 + 0x1dadd0]
call fcn.1400ad660
nop
call fcn.140147b50
nop
call fcn.140148020
nop
call fcn.140148e90
nop
call fcn.1400ac8f0
nop
nop
call fcn.14014eb20
nop
lea r13, [rsp + 0x20]
mov qword [r13], 0
mov qword [r13 + 8], 0
mov rcx, qword [r15 + 0x38]
mov qword [r13 + 0x10], rcx
mov qword [r15 + 0x38], r13
mov rdx, qword [0x1402d8658]
mov ecx, 0xfffffff6
mov eax, 0
mov r10, rdx
mov qword [rsp + 0x40], rdx
lea r12, [0x1401219c7]
mov qword [r13], r12
mov qword [r13 + 8], rsp
mov dword [r15 + 0x14], 3
call r10
nop
nop dword [rax + rax]
cmp dword [r15 + 0xcc], 0
jne 0x140121b3c
mov ecx, eax
mov eax, 3
mov r10d, 1
lock cmpxchg dword [r15 + 0x14], r10d
jne 0x140121b9f
mov rax, qword [r15 + 0x38]
mov rax, qword [rax + 0x10]
mov qword [r15 + 0x38], rax
movsxd rcx, ecx
mov qword [r14 + 0x2c9050], rcx
lea r13, [rsp + 0x20]
mov qword [r13], 0
mov qword [r13 + 8], 0
mov rcx, qword [r15 + 0x38]
mov qword [r13 + 0x10], rcx
mov qword [r15 + 0x38], r13
mov ecx, 0xfffffff5
mov eax, 0
mov r10, qword [rsp + 0x40]
lea r12, [0x140121a54]
mov qword [r13], r12
mov qword [r13 + 8], rsp
mov dword [r15 + 0x14], 3
call r10
nop
cmp dword [r15 + 0xcc], 0
jne 0x140121b5a
mov ecx, eax
mov eax, 3
mov r10d, 1
lock cmpxchg dword [r15 + 0x14], r10d
jne 0x140121b99
mov rax, qword [r15 + 0x38]
mov rax, qword [rax + 0x10]
mov qword [r15 + 0x38], rax
movsxd rcx, ecx
mov qword [r14 + 0x2c9078], rcx
lea r13, [rsp + 0x20]
mov qword [r13], 0
mov qword [r13 + 8], 0
mov rcx, qword [r15 + 0x38]
mov qword [r13 + 0x10], rcx
mov qword [r15 + 0x38], r13
mov ecx, 0xfffffff4
mov eax, 0
mov r10, qword [rsp + 0x40]
lea r12, [0x140121adc]
mov qword [r13], r12
mov qword [r13 + 8], rsp
mov dword [r15 + 0x14], 3
call r10
nop
cmp dword [r15 + 0xcc], 0
jne 0x140121b78
mov ecx, eax
mov eax, 3
mov edx, 1
lock cmpxchg dword [r15 + 0x14], edx
jne 0x140121b93
mov rdx, qword [r15 + 0x38]
mov rdx, qword [rdx + 0x10]
mov qword [r15 + 0x38], rdx
movsxd rdx, ecx
mov qword [r14 + 0x2c90a0], rdx
add rsp, 0x48
sub dword [r15 + 0x10], 1
jle fcn.140116590
ret
mov dword [rsp + 0x3c], eax
mov edx, 1
mov r8d, 1
call fcn.140116b40
nop
mov ecx, dword [rsp + 0x3c]
jmp 0x140121a13
mov dword [rsp + 0x3c], eax
mov edx, 1
mov r8d, 1
call fcn.140116b40
nop
mov ecx, dword [rsp + 0x3c]
jmp 0x140121a9b
mov dword [rsp + 0x3c], eax
mov edx, 1
mov r8d, 1
call fcn.140116b40
nop
mov ecx, dword [rsp + 0x3c]
jmp 0x140121b22
mov dword [rsp + 0x3c], ecx
jmp 0x140121b7c
mov dword [rsp + 0x3c], ecx
jmp 0x140121b5e
mov dword [rsp + 0x3c], ecx
jmp 0x140121b40
Function at 0x14017ea20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rbx, [rsp - 0x48]
cmp rbx, qword [r15 + 8]
jbe fcn.140095bf0
mov rsp, rbx
mov dword [rsp + 0x44], r8d
nop word [rax + rax]
cmp r8d, 2
jl 0x14017ec1f
cmp r8d, 0x25
jge 0x14017ec3c
mov qword [rsp + 8], rdx
mov ecx, dword [rdx + 4]
nop dword [rax]
test ecx, ecx
je 0x14017ec59
mov eax, dword [r14 + rcx*8 + 4]
movsx ecx, byte [rdx + 0xc]
shr eax, cl
mov dword [rsp + 0x40], eax
test eax, eax
je 0x14017ec5f
mov rcx, rdx
mov r8d, 0
call fcn.14018f590
nop
cmp eax, 0x30
jb 0x14017eb80
movabs rax, 0x8000000000000001
mov rcx, rax
mov r8d, 0
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x30], rcx
mov ebx, dword [rsp + 0x44]
mov qword [rsp + 0x28], rbx
mov rax, rcx
cqo
idiv rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x18], 0
jmp 0x14017eb47
mov r11d, r8d
inc r11d
mov r12, rdx
mov dword [rsp + 0x14], r11d
call fcn.14018f590
nop
mov edx, eax
mov r8d, dword [rsp + 0x44]
call fcn.140156650
nop
test eax, eax
jl 0x14017ebef
mov rdx, qword [rsp + 0x20]
cmp rdx, qword [rsp + 0x18]
jg 0x14017ebef
mov r8, qword [rsp + 0x18]
imul r8, qword [rsp + 0x28]
mov eax, eax
mov rcx, rax
add rcx, qword [rsp + 0x30]
cmp rcx, r8
jg 0x14017ec0d
mov r11d, dword [rsp + 0x14]
sub r8, rax
mov qword [rsp + 0x18], r8
mov r8d, r11d
mov eax, dword [rsp + 0x40]
mov rdx, qword [rsp + 8]
cmp eax, r8d
ja 0x14017eae0
mov eax, dword [rsp + 0x3c]
nop dword [rax]
test eax, eax
jne 0x14017ebbd
mov rax, qword [rsp + 0x18]
neg rax
add rsp, 0x48
sub dword [r15 + 0x10], 1
jle fcn.140116590
ret
cmp eax, 0x2b
jne 0x14017ebd2
movabs rax, 0x8000000000000001
mov rdx, rax
mov eax, 0
nop dword [rax + rax]
cmp dword [rsp + 0x40], 1
je 0x14017ec68
mov rcx, rdx
mov r8d, 1
mov dword [rsp + 0x3c], eax
jmp 0x14017eab2
mov rax, qword [rsp + 0x18]
add rsp, 0x48
sub dword [r15 + 0x10], 1
jle fcn.140116590
ret
cmp eax, 0x2d
jne 0x14017ec7a
movabs rax, 0x8000000000000000
mov rdx, rax
mov eax, 1
jmp 0x14017eb9b
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x44]
call fcn.140183c60
nop
lea r8, [rsp + 0x50]
mov rdx, rax
call fcn.1401007f0
nop
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x44]
call fcn.140183c60
nop
jmp 0x14017ebff
lea rdx, [r14 + 0x1db760]
lea r9, [r14 + 0x1db778]
call fcn.1401308c0
nop
mov rdx, rax
call fcn.14003c350
nop
lea rdx, [r14 + 0x1db760]
lea r9, [r14 + 0x1db790]
call fcn.1401308c0
nop
mov rdx, rax
call fcn.14003c350
nop
call fcn.14010b4b0
nop
nop
call fcn.140183c60
nop
jmp 0x14017ebff
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x44]
call fcn.140183c60
nop
jmp 0x14017ebff
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rsp + 8]
call fcn.140183c60
nop
jmp 0x14017ebff
Function at 0x1401a1030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rbx, [rsp - 0x58]
cmp rbx, qword [r15 + 8]
jbe fcn.140095bf0
mov rsp, rbx
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x4c], r8d
mov dword [rsp + 0x48], r9d
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x40], ecx
mov eax, esi
add eax, ecx
mov dword [rsp + 0x3c], eax
mov ebx, r8d
add ebx, r9d
mov dword [rsp + 0x38], ebx
mov ecx, r8d
nop word [rax + rax]
nop
cmp ebx, ecx
jle 0x1401a1255
cmp eax, esi
jle 0x1401a1255
mov r12d, ecx
shl r12d, 1
movsxd r12, r12d
movzx r12d, word [rdx + r12 + 8]
mov r13d, esi
shl r13d, 1
movsxd r13, r13d
movzx r13d, word [rdi + r13 + 8]
nop
cmp r13d, r12d
je 0x1401a1181
mov dword [rsp + 0x34], esi
mov dword [rsp + 0x30], ecx
mov edx, r12d
mov r8d, r13d
mov dword [rsp + 0x2c], r13d
mov dword [rsp + 0x28], r12d
call fcn.1401a0e60
nop
mov ecx, dword [rsp + 0x30]
inc ecx
test eax, eax
je 0x1401a11b5
mov dword [rsp + 0x24], ecx
mov r12d, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x18]
mov r8d, r12d
mov r9d, dword [rsp + 0x30]
mov edi, dword [rsp + 0x4c]
mov esi, dword [rsp + 0x38]
call fcn.1401a0cf0
nop
nop dword [rax]
test eax, eax
jge 0x1401a11f4
neg eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov r13d, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x10]
mov r8d, r13d
mov r9d, dword [rsp + 0x34]
mov edi, dword [rsp + 0x44]
mov esi, dword [rsp + 0x3c]
call fcn.1401a0cf0
nop
test eax, eax
jge 0x1401a11d5
neg eax
mov esi, dword [rsp + 0x34]
inc esi
mov edx, dword [rsp + 0x28]
mov r8d, eax
mov dword [rsp + 0x2c], esi
call fcn.1401a0e60
nop
test eax, eax
jne 0x1401a1235
mov esi, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x20]
mov eax, esi
inc eax
mov edx, ecx
inc edx
sub dword [r15 + 0x10], 1
nop
jle 0x1401a120f
mov esi, eax
mov ecx, edx
mov ebx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
nop dword [rax]
jmp 0x1401a1080
mov esi, dword [rsp + 0x34]
inc esi
mov ebx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
nop
jmp 0x1401a1080
mov edx, dword [rsp + 0x28]
mov r8d, eax
call fcn.1401a0e60
nop
test eax, eax
jne 0x1401a1245
mov esi, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x20]
jmp 0x1401a1181
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
jmp 0x1401a1130
nop
call fcn.140116590
nop
mov esi, eax
mov ecx, edx
mov ebx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
nop dword [rax]
jmp 0x1401a1080
add rsp, 0x58
sub dword [r15 + 0x10], 1
jle fcn.140116590
ret
add rsp, 0x58
sub dword [r15 + 0x10], 1
jle fcn.140116590
ret
mov r9d, dword [rsp + 0x48]
sub r9d, dword [rsp + 0x40]
mov eax, r9d
add rsp, 0x58
sub dword [r15 + 0x10], 1
jle fcn.140116590
ret
Function at 0x1402d1ab8
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1402d8f40]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea eax, [rcx + 0x40]
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], ax
mov ebx, ecx
xor eax, eax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jb 0x1402d1b08
xor edx, edx
mov r8d, 0x104
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetdcwd]
jmp 0x1402d1b0a
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1402d2750
add rsp, 0x30
pop rbx
ret
Function at 0x140003798
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400037e2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400037e2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400037e2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400037e2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400037e2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400037e4
xor al, al
add rsp, 0x28
ret
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call sub.MSVCR80.dll__amsg_exit
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.1016b000
add rsp, 0x28
jmp 0x10007510
Function at 0x1000d580
Capabilities:
Delete registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xc8
mov rax, qword [0x10014030]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movdqu xmm0, xmmword [rcx]
mov rbp, rdx
mov rsi, r8
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
movdqu xmmword [rsp + 0x20], xmm0
mov rbx, r9
call fcn.1000abf0
xor eax, eax
lea rcx, [rax - 1]
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
add rcx, 6
cmp rcx, 0x40
jbe 0x1000d5eb
mov eax, 0x80070057
jmp 0x1000d69a
lea r8, [0x10003ed8]
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.MSVCR80.dll_wcscpy_s]
lea r8, [rsp + 0x30]
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.MSVCR80.dll_wcscat_s]
lea rdx, [0x10003ef8]
mov rcx, rsi
call fcn.1000cef0
lea rdx, [0x10003ee8]
mov rcx, rsi
call fcn.1000cef0
mov rdi, 0xffffffff80000000
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [0x10003ee8]
mov rcx, rbp
call fcn.1000cef0
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [0x10003f08]
mov rcx, rbx
call fcn.1000cef0
lea rdx, [0x10003f18]
mov rcx, rbx
call fcn.1000cef0
lea rdx, [0x10003f50]
mov rcx, rbx
call fcn.1000cef0
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.10007870
add rsp, 0xc8
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1016b000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
push rbp
mov rbp, rsp
sub rsp, 0x20
and rsp, 0xfffffffffffffff0
lea rbx, [0x100de000]
movabs rdi, 0
push rbx
Function at 0x14000633c
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
je 0x1400065b7
mov rsi, rdx
nop
test eax, eax
nop
mov edx, dword [section..data]
mov eax, dword [0x140039008]
imul eax, edx
imul eax, dword [0x140039004]
cmp eax, 0x80000000
jne 0x1400063a0
lea rcx, str.futanari__d
call fcn.1400013d7
mov edx, dword [0x140039004]
lea rcx, str.keko__d
call fcn.1400013d7
mov edx, dword [0x140039008]
lea rcx, str.futanari2__d
call fcn.1400013d7
nop
test eax, eax
nop
mov edx, dword [section..data]
mov eax, dword [0x140039008]
imul eax, edx
imul eax, dword [0x140039004]
cmp eax, 0x80000000
jne 0x1400063f2
lea rcx, str.futanari__d
call fcn.1400013d7
mov edx, dword [0x140039004]
lea rcx, str.keko__d
call fcn.1400013d7
mov edx, dword [0x140039008]
lea rcx, str.futanari2__d
call fcn.1400013d7
movzx eax, word [rsi]
cmp eax, 0x5a4d
jne 0x1400065b7
nop
test eax, eax
nop
mov edx, dword [section..data]
mov eax, dword [0x140039008]
imul eax, edx
imul eax, dword [0x140039004]
cmp eax, 0x80000000
jne 0x140006452
lea rcx, str.futanari__d
call fcn.1400013d7
mov edx, dword [0x140039004]
lea rcx, str.keko__d
call fcn.1400013d7
mov edx, dword [0x140039008]
lea rcx, str.futanari2__d
call fcn.1400013d7
movsxd rdi, dword [rsi + 0x3c]
nop
test eax, eax
nop
mov edx, dword [section..data]
mov eax, dword [0x140039008]
imul eax, edx
imul eax, dword [0x140039004]
cmp eax, 0x80000000
jne 0x1400064a8
lea rcx, str.futanari__d
call fcn.1400013d7
mov edx, dword [0x140039004]
lea rcx, str.keko__d
call fcn.1400013d7
mov edx, dword [0x140039008]
lea rcx, str.futanari2__d
call fcn.1400013d7
cmp edi, 0x400
jg 0x1400065b7
nop
test eax, eax
nop
mov edx, dword [section..data]
mov eax, dword [0x140039008]
imul eax, edx
imul eax, dword [0x140039004]
cmp eax, 0x80000000
jne 0x140006506
lea rcx, str.futanari__d
call fcn.1400013d7
mov edx, dword [0x140039004]
lea rcx, str.keko__d
call fcn.1400013d7
mov edx, dword [0x140039008]
lea rcx, str.futanari2__d
call fcn.1400013d7
add rsi, rdi
nop
test eax, eax
nop
mov edx, dword [section..data]
mov eax, dword [0x140039008]
imul eax, edx
imul eax, dword [0x140039004]
cmp eax, 0x80000000
jne 0x14000655b
lea rcx, str.futanari__d
call fcn.1400013d7
mov edx, dword [0x140039004]
lea rcx, str.keko__d
call fcn.1400013d7
mov edx, dword [0x140039008]
lea rcx, str.futanari2__d
call fcn.1400013d7
cmp dword [rsi], 0x4550
jne 0x1400065b7
nop
test eax, eax
nop
mov edx, dword [section..data]
mov eax, dword [0x140039008]
imul eax, edx
imul eax, dword [0x140039004]
cmp eax, 0x80000000
jne 0x1400065b9
lea rcx, str.futanari__d
call fcn.1400013d7
mov edx, dword [0x140039004]
lea rcx, str.keko__d
call fcn.1400013d7
mov edx, dword [0x140039008]
lea rcx, str.futanari2__d
call fcn.1400013d7
jmp 0x1400065b9
xor esi, esi
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14000a2c0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.14000b750
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.14000b750
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x14000be00
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.14000d1a0
test al, al
je 0x14000be3d
mov ecx, 2
call qword [fcn.14000b750]
mov qword [rsp + 0x20], rsi
lea rdx, str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0llx__n
mov rcx, rax
mov r8, rbx
mov r9d, edi
call fcn.14000bdd0
mov rcx, rbx
mov edx, edi
mov r8, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.14000d2a0

Function at 0x14000beb0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.14000d1a0
test al, al
je 0x14000bee5
mov ecx, 2
call qword [fcn.14000b750]
lea rdx, str.libunwind:__Unwind_SetIP_context_p__value0x_0llx__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call fcn.14000bdd0
mov rcx, rdi
mov edx, 0xffffffff
mov r8, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14000d2a0

Function at 0x14000cd30
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140030008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000cd9c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000cd9c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000cd9c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000cd9c
sub rcx, qword [0x140030008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x14000cd88
add rax, 0x28
dec edx
je 0x14000cd9c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x14000cd80
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x14000cd80
jmp 0x14000cd9e
xor eax, eax
ret

Function at 0x14000cda0
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140030008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x14000cdd5
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x14000cdd5
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x14000cdd5
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x14000ce50
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140030008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14000ce7c
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14000ce7c
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x14000ce7e
xor eax, eax
ret