joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b9a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400101c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xe001a
mov dword [rbp - 0x1c], 0x210022
mov dword [rbp - 0x18], 0x420015
mov dword [rbp - 0x14], 0x7d0065
mov dword [rbp - 0x10], 0x30027
mov dword [rbp - 0xc], 0x63000b
call fcn.140002a50
mov rcx, rax
call rbx
mov rbx, qword [0x1400101c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400101a0], rax
mov dword [rbp - 0x20], 0xf001e
mov dword [rbp - 0x1c], 0x240029
mov dword [rbp - 0x18], 0x140017
mov dword [rbp - 0x14], 0x7d0023
mov dword [rbp - 0x10], 0x30027
mov dword [rbp - 0xc], 0x63000b
call fcn.140002a50
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x14000ebf0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400101b0], rax
mov word [rbp - 0x10], 0x500
mov byte [rbp - 0xe], 0x4e
call fcn.1400043c0
mov rcx, qword [0x1400101a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140010130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x21220e1a
mov dword [rbp - 0x1c], 0x362f3415
mov dword [rbp - 0x18], 0x6131a20
mov word [rbp - 0x14], 0x451d
call fcn.140001180
mov rcx, qword [0x1400101a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140010130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x28330800
mov dword [rbp - 0x1c], 0x27321f0b
mov dword [rbp - 0x18], 0xd021f0c
mov word [rbp - 0x14], 0x450b
call fcn.140001180
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000eab0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100e8], rax
mov byte [rbp - 0x10], 0x76
call fcn.1400014c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000eb60]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100f0], rax
mov dword [rbp - 0x10], 0x412b3e12
call fcn.1400026f0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000ebd0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100e0], rax
mov byte [rbp - 0x10], 0x76
call fcn.1400014c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000eaf0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100d8], rax
mov dword [rbp - 0x10], 0x203d1f
mov byte [rbp - 0xc], 0x4e
call fcn.1400031c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000eb80]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x1318
mov byte [rbp - 0xe], 0x4e
call fcn.1400043c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp rax
Function at 0x140013430
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140013469
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140013557
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x1400134ff
cmp qword [rsp + 0x20], 0
jle 0x1400134ff
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x1400134a9
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140018ff0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x140013547
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140013547
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x140013560
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14021e080]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x140013594
xor eax, eax
jmp 0x140013790
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x1400135c6
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140013790
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x140013677
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.1400137b0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140018ff0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x140013780
mov rcx, qword [rsp + 0x80]
call fcn.140016050
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x14001372d
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x140013728
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x140013790
jmp 0x1400136a3
cmp qword [rsp + 0x50], 0
jbe 0x140013780
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140173480
add rsp, 0x78
ret
Function at 0x140016110
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x14021e080]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14001614d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140016154
mov al, 1
jmp 0x1400162ae
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140018f10
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140018f10
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.140018f70
movzx eax, al
test eax, eax
je 0x1400161ab
xor al, al
jmp 0x1400162ae
mov qword [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14001621b
cmp dword [rsp + 0x30], 1
je 0x140016227
cmp dword [rsp + 0x30], 3
je 0x14001629c
jmp 0x1400162ac
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x140016273
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x140016273
xor al, al
jmp 0x1400162ae
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001628d
mov dword [rsp + 0x34], 1
jmp 0x140016295
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x1400162ae
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400162ae
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140173480
add rsp, 0xa8
ret
Function at 0x1400295a0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [0x14021e080]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x58]
lea rcx, [0x1401928b8]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WLDAP32.dll_Ordinal_46
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x50], reloc.WS2_32.dll_setsockopt
mov eax, 2
imul rax, rax, 0x15
mov ecx, Ordinal_50
mov word [rsp + rax + 0x58], cx
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x48]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x48]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x140029652
mov rax, qword [rsp + 0x48]
mov byte [rax], 1
mov al, 1
jmp 0x1400296cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 2
jne 0x14002969c
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rsp + rax + 0x58]
cmp eax, 0x39
jge 0x14002969a
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rsp + rax + 0x58]
inc ax
mov ecx, 2
imul rcx, rcx, 0x15
mov word [rsp + rcx + 0x58], ax
jmp 0x140029602
jmp 0x1400296c3
cmp dword [rsp + 0x40], 0xe7
jne 0x1400296c3
mov edx, 0x2710
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x1400296be
xor al, al
jmp 0x1400296cc
jmp 0x140029602
xor al, al
jmp 0x1400296cc
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140173480
add rsp, 0x98
pop rdi
pop rsi
ret

Function at 0x140029730
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14021e080]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x70], 0
jne 0x140029761
mov al, 1
jmp 0x14002983e
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14002978f
mov r8d, reloc.WLDAP32.dll_Ordinal_79
lea rdx, [0x140192920]
lea rcx, [0x1401929b8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
cmp qword [rsp + 0x38], 0
jne 0x14002979e
xor al, al
jmp 0x14002983e
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0xffffffffffffffff
jne 0x1400297b1
xor al, al
jmp 0x14002983e
cmp qword [rsp + 0x68], 0
jne 0x1400297d5
mov r8d, 0x56
lea rdx, [0x1401929e0]
lea rcx, [0x140192a78]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
cmp qword [rsp + 0x68], 0
jne 0x1400297e1
xor al, al
jmp 0x14002983e
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x140029831
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x40], eax
jne 0x140029831
mov dword [rsp + 0x34], 1
jmp 0x140029839
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140173480
add rsp, 0x58
ret
Function at 0x140029850
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14021e080]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x68], 0
jne 0x140029896
mov r8d, 0x62
lea rdx, [0x140192ac0]
lea rcx, [0x140192b58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
cmp qword [rsp + 0x68], 0
jne 0x1400298a5
xor al, al
jmp 0x1400299b6
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1400298d3
mov r8d, 0x67
lea rdx, [0x140192b90]
lea rcx, str.self
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
cmp qword [rsp + 0x38], 0
jne 0x1400298e2
xor al, al
jmp 0x1400299b6
mov rax, qword [rsp + 0x38]
cmp qword [rax + 8], 0xffffffffffffffff
jne 0x1400298f5
xor al, al
jmp 0x1400299b6
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400299aa
mov eax, dword [rsp + 0x40]
cmp rax, qword [rsp + 0x70]
jb 0x1400299a8
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x14002999e
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x30], eax
je 0x140029998
mov r8d, reloc.WS2_32.dll_WSACleanup
lea rdx, str.C:UsersCASAVideosBPBLAZE_PRO_SORUCEDiscordSDK_srcconnection_win.cpp
lea rcx, str.bytesToRead__bytesRead
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov al, 1
jmp 0x1400299b6
mov rcx, qword [rsp + 0x60]
call fcn.1400296f0
jmp 0x1400299b4
mov rcx, qword [rsp + 0x60]
call fcn.1400296f0
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140173480
add rsp, 0x58
ret
Function at 0x140029d60
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14021e080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0
cmp qword [rsp + 0x88], 0
je 0x140029e24
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x88]
movzx eax, word [rcx + rax]
test eax, eax
je 0x140029e24
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140029e1a
mov eax, dword [rsp + 0x50]
jmp 0x140029e84
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x98]
xor r8d, r8d
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x50], eax
cmp qword [rsp + 0x60], 0
je 0x140029e80
mov rax, qword [rsp + 0x80]
cmp qword [rsp + 0x60], rax
je 0x140029e80
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140173480
add rsp, 0x78
ret
Function at 0x14002a2c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xaf8
mov rax, qword [0x14021e080]
xor rax, rsp
mov qword [rsp + 0xae0], rax
mov dword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0xb00]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0xb08]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x14002a391
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_opening_Steam_key_n
mov rcx, rax
call fcn.140029af0
jmp 0x14002a498
mov dword [rsp + 0x48], 0x208
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140192e18]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x34], 0
jne 0x14002a3e5
cmp dword [rsp + 0x48], 1
jae 0x14002a404
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_reading_SteamExe_key_n
mov rcx, rax
call fcn.140029af0
jmp 0x14002a498
mov eax, dword [rsp + 0x48]
xor edx, edx
mov ecx, 2
div rcx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0
jmp 0x14002a42a
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x30], eax
jae 0x14002a458
mov eax, dword [rsp + 0x30]
movzx eax, word [rsp + rax*2 + 0xd0]
cmp eax, 0x2f
jne 0x14002a456
mov eax, dword [rsp + 0x30]
mov ecx, 0x5c
mov word [rsp + rax*2 + 0xd0], cx
jmp 0x14002a420
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd0]
lea r8, [0x140192e50]
mov edx, 0x800
lea rcx, [rsp + 0x2e0]
call fcn.140029b60
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x90]
call fcn.140029ea0
mov rcx, qword [rsp + 0xae0]
xor rcx, rsp
call fcn.140173480
add rsp, 0xaf8
ret
Function at 0x14002dd30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14021e080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.14000a440
mov rcx, qword [rsp + 0x68]
call fcn.14000a560
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14002e2b0
nop
lea rax, [0x14002e330]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.140005c60
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14002dddb
lea rcx, [rsp + 0x40]
call fcn.14001ec20
jmp 0x14002ddf3
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x40]
call fcn.14002df80
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140173480
add rsp, 0x58
ret

Function at 0x14002e400
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x138
jne 0x14002e422
mov rcx, qword [rsp + 0x40]
call fcn.14002e500
jmp 0x14002e439
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jb 0x14002e439
mov rcx, qword [rsp + 0x40]
call fcn.14002e5d0
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax*8 + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
shr rax, 0x1d
mov rcx, qword [rsp + 0x40]
and rax, qword [rcx + 0x1388]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rax, rcx
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
shl rax, 0x25
movabs rcx, 0xfff7eee000000000
and rax, rcx
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
shr rax, 0x2b
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x14002e500
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov qword [rsp], 0x138
jmp 0x14002e51e
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x270
jae 0x14002e5bc
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp]
mov rax, qword [rax + rcx*8 - 0x9b8]
and rax, 0xffffffff80000000
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp]
mov rcx, qword [rcx + rdx*8 - 0x9b0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
and rax, 1
test rax, rax
je 0x14002e582
movabs rax, 0xb5026f5aa96619e9
mov qword [rsp + 0x10], rax
jmp 0x14002e58b
mov qword [rsp + 0x10], 0
mov rax, qword [rsp + 8]
shr rax, 1
xor rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp]
xor rax, qword [rcx + rdx*8 - 0x4d8]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14002e513
add rsp, 0x28
ret