joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f650
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140037040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000f723
cmp byte [rcx + 0x71], 0
je 0x14000f723
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000f71f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000f6e4
sub eax, 1
je 0x14000f6e8
cmp eax, 2
jne 0x14000f71f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140010170
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000f716
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000f71f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000f6cc
xor al, al
jmp 0x14000f6cc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140010170
add rsp, 0x60
pop rbx
ret

Function at 0x140010cb0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140010cfa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140010cfa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140010cfa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140010cfa
cmp dword [rcx + 0x84], 0xe
jbe 0x140010cfa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140010cfc
xor al, al
add rsp, 0x28
ret
Function at 0x180003920
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x6b0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x6e0], rbx
mov rax, qword [0x1800764a0]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rsi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
cmp qword [rdx + 0x18], 0xc8
jbe 0x18000398b
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], rbp
mov word [rcx + 8], bp
xor r8d, r8d
lea rdx, [0x1800602dc]
call fcn.18000a4d0
mov rax, rbx
jmp 0x180003b5f
mov word [rsp + 0x290], bp
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x292]
call fcn.1800432e0
mov r8d, 0x104
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x180003a2f
lea rcx, str.cachekvstore
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add edi, eax
cmp edi, 0x104
jge 0x180003a2f
lea rdx, [0x180061e54]
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.cachekvstore
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov r8d, 0x104
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.180002550
cmp qword [rax + 0x20], 8
jb 0x180003a49
mov rdx, qword [rax + 8]
jmp 0x180003a4d
lea rdx, [rax + 8]
lea rcx, [rsp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp qword [rsp + 0x78], 8
jb 0x180003a6d
mov rcx, qword [rsp + 0x60]
call fcn.180041070
lea rcx, [rsp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180003b24
lea edx, [rax + 3]
lea rcx, [rsp + 0x58]
call fcn.1800038d0
nop
cmp qword [rsp + 0x70], 0
je 0x180003b12
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8d, 0x208
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rdx, str.cachekvstore
lea rcx, [rsp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.180002550
cmp qword [rax + 0x20], 8
jb 0x180003aed
mov rdx, qword [rax + 8]
jmp 0x180003af1
lea rdx, [rax + 8]
lea rcx, [rsp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp qword [rsp + 0x50], 8
jb 0x180003b12
mov rcx, qword [rsp + 0x38]
call fcn.180041070
nop
cmp qword [rsp + 0x78], 8
jb 0x180003b24
mov rcx, qword [rsp + 0x60]
call fcn.180041070
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rbp
mov word [rbx + 8], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x290]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x290]
mov rcx, rbx
call fcn.18000a4d0
mov rax, rbx
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.180040bb0
mov rbx, qword [rsp + 0x6e0]
add rsp, 0x6b0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180003b90
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1800764a0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
cmp qword [rdx + 0x18], 0xc8
jbe 0x180003bee
mov qword [rcx + 0x20], 0xf
mov qword [rcx + 0x18], 0
mov byte [rcx + 8], 0
xor r8d, r8d
lea rdx, [0x1800602d8]
call fcn.180001c90
mov rax, rbx
jmp 0x180003c80
lea rcx, [rsp + 0x30]
call fcn.180003920
nop
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180003c51
mov qword [rbx + 0x20], 0xf
mov qword [rbx + 0x18], 0
mov byte [rbx + 8], al
xor r8d, r8d
lea rdx, [0x1800602d8]
mov rcx, rbx
call fcn.180001c90
nop
cmp qword [rsp + 0x50], 8
jb 0x180003c4c
mov rcx, qword [rsp + 0x38]
call fcn.180041070
mov rax, rbx
jmp 0x180003c80
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.180003900
nop
cmp qword [rsp + 0x50], 8
jb 0x180003c7d
mov rcx, qword [rsp + 0x38]
call fcn.180041070
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180040bb0
add rsp, 0x60
pop rbx
ret
Function at 0x18002d2f4
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0x740
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1800764a0]
xor rax, rsp
mov qword [rsp + 0x730], rax
mov rbp, rdx
mov rbx, rcx
mov qword [r11 - 0x6c0], rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
lea ecx, [r12 + 8]
call fcn.18004116c
cmp rax, r12
je 0x18002d356
lea rcx, [rsp + 0x30]
mov qword [rax], rcx
jmp 0x18002d359
mov rax, r12
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.18000f840
mov qword [rsp + 0x60], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsp + 0x60]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [rax], rax
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x10], rax
mov qword [rsp + 0x68], r12
cmp rbp, r12
jne 0x18002d3bc
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.18000f5e0
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x30]
call fcn.1800076a0
mov rax, rbx
jmp 0x18002d52d
mov rdx, rbp
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..________.dirty
lea rcx, [rsp + 0x520]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18002d50b
lea rdx, [0x180061e50]
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, r12d
je 0x18002d4e8
lea rdx, [0x180061e54]
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, r12d
je 0x18002d4e8
cmp dword [rsp + 0xc0], 0xffffffff
je 0x18002d4e8
mov rdx, rbp
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xec]
lea rcx, [rsp + 0x310]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], r12
mov word [rsp + 0x78], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x310]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x70]
call fcn.18000a4d0
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x30]
call fcn.180010140
nop
cmp qword [rsp + 0x90], 8
jb 0x18002d4e8
mov rcx, qword [rsp + 0x78]
call fcn.180041070
lea rdx, [rsp + 0xc0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r12d
jne 0x18002d405
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.18000f5e0
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x30]
call fcn.1800076a0
mov rax, rbx
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.180040bb0
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x18002dc68
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2070
call fcn.1800554d0
sub rsp, rax
mov rax, qword [0x1800764a0]
xor rax, rsp
mov qword [rsp + 0x2060], rax
xor esi, esi
mov rbx, rdx
mov rdi, rcx
cmp rcx, rsi
je 0x18002de35
cmp rdx, rsi
je 0x18002de35
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
jne 0x18002dcc0
mov esi, 1
jmp 0x18002de35
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov rdi, rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rdi, rsi
je 0x18002de0d
cmp rdi, 0xffffffffffffffff
je 0x18002de0d
cmp rax, rsi
je 0x18002de0d
cmp rax, 0xffffffffffffffff
je 0x18002de21
xor eax, eax
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x4c], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, esi
je 0x18002dd78
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, esi
je 0x18002dd78
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 0x50], rax
je 0x18002dd86
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002de2c
mov dword [rsp + 0x40], esi
jmp 0x18002dddc
mov r8d, dword [rsp + 0x40]
cmp r8d, esi
je 0x18002de03
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x1060]
mov rcx, rbx
mov dword [rsp + 0x44], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
je 0x18002dd78
mov eax, dword [rsp + 0x40]
cmp eax, dword [rsp + 0x44]
jne 0x18002dd78
lea rdx, [rsp + 0x1060]
lea rcx, [rsp + 0x60]
mov r8, rax
call fcn.18004e130
cmp eax, esi
jne 0x18002dd78
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
jne 0x18002dd8c
jmp 0x18002dd78
mov esi, 1
jmp 0x18002dd78
cmp rax, 0xffffffffffffffff
je 0x18002de21
cmp rax, rsi
je 0x18002de21
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 0xffffffffffffffff
je 0x18002de35
cmp rdi, rsi
je 0x18002de35
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.180040bb0
lea r11, [rsp + 0x2070]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18002e114
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1800764a0]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x21]
xor ebx, ebx
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], bl
call fcn.1800432e0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.18002e010
mov r11d, 0x179b06cc
movzx edx, byte [rsp + rbx + 0x20]
movzx eax, r11b
mov ecx, r11d
xor rdx, rax
shr ecx, 8
lea rax, [0x1800788a0]
mov r11d, dword [rax + rdx*4]
inc rbx
xor r11d, ecx
cmp rbx, 0x24
jl 0x18002e15c
not r11d
mov eax, r11d
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180040bb0
add rsp, 0x140
pop rbx
ret

Function at 0x18002e218
Capabilities:
Get disk information

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x1800764a0]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x18002e2ad
test r8d, r8d
je 0x18002e2ad
mov ecx, 0x3a
cmp word [rbx + 2], cx
jne 0x18002e2ad
movzx eax, word [rbx]
mov word [rsp + 0x22], cx
lea rdx, [rsp + 0x30]
mov word [rsp + 0x20], ax
xor eax, eax
lea rcx, [rsp + 0x20]
mov r8d, 0x208
mov dword [rsp + 0x24], eax
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x18002e2ad
lea rdx, [rbx + 4]
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call qword [sym.imp.SHLWAPI.dll_StrNCatW]
lea rdx, [rsp + 0x30]
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, 1
jmp 0x18002e2af
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180040bb0
add rsp, 0x450
pop rdi
pop rsi
pop rbx
ret

Function at 0x18002e2cc
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x260
mov rax, qword [0x1800764a0]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r13d, r13d
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
cmp rdx, r13
je 0x18002e3be
cmp r8d, r13d
je 0x18002e3be
lea rdx, str.deviceMup_
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp rax, rdi
jne 0x18002e345
lea r8, [0x180061f0c]
lea rdx, str.deviceMup_
mov r9, rbp
mov rcx, rdi
mov dword [rsp + 0x20], esi
call fcn.18002ed58
mov eax, 1
jmp 0x18002e3c0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, r13d
mov r12d, eax
bt r12d, ebx
jae 0x18002e3b7
lea ecx, [rbx + 0x61]
mov eax, 0x3a
xor edx, edx
mov word [rsp + 0x30], cx
mov word [rsp + 0x32], ax
xor eax, eax
lea rcx, [rsp + 0x42]
mov r8d, 0x206
mov word [rsp + 0x40], r13w
mov dword [rsp + 0x34], eax
call fcn.1800432e0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp eax, r13d
jbe 0x18002e3b7
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, rdi
call fcn.18002ee8c
cmp eax, r13d
jne 0x18002e3e7
inc ebx
cmp ebx, 0x1a
jl 0x18002e351
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180040bb0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
jmp 0x18002e32f
Function at 0x18002e3f8
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x1800764a0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov ebx, ecx
mov rdi, rdx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x434
call fcn.1800432e0
mov edx, ebx
mov ecx, 8
mov dword [rsp + 0x20], 0x438
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
test rax, rax
je 0x18002e481
cmp rax, 0xffffffffffffffff
je 0x18002e495
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
jmp 0x18002e47d
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.18002e65c
test eax, eax
je 0x18002e481
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x18002e45f
cmp rbx, 0xffffffffffffffff
je 0x18002e495
test rbx, rbx
je 0x18002e495
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180040bb0
mov rbx, qword [rsp + 0x490]
add rsp, 0x470
pop rdi
ret

Function at 0x18002e4b8
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800764a0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x18002e553
cmp rax, 0xffffffffffffffff
je 0x18002e553
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call fcn.1800432e0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18002e553
mov rdx, rsi
lea rcx, [rsp + 0x30]
call rdi
test eax, eax
je 0x18002e553
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x18002e534
cmp rbx, 0xffffffffffffffff
je 0x18002e567
test rbx, rbx
je 0x18002e567
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180040bb0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18002e58c
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1800764a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov esi, r8d
mov rbp, rdx
mov r8d, ecx
mov ecx, 0x410
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edi, edi
mov rbx, rax
cmp rax, rdi
je 0x18002e623
cmp rax, 0xffffffffffffffff
je 0x18002e637
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.1800432e0
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call sub.PSAPI.DLL_GetProcessImageFileNameW
cmp eax, edi
jbe 0x18002e616
lea rcx, [rsp + 0x20]
mov r8d, esi
mov rdx, rbp
call fcn.18002e2cc
mov edi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x18002e639
cmp rax, 0xffffffffffffffff
je 0x18002e637
cmp rax, rdi
je 0x18002e637
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180040bb0
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret

Function at 0x18002e7d8
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
xor ebx, ebx
mov r14d, r8d
mov r12, rdx
mov rsi, rcx
cmp rcx, rbx
je 0x18002e8bb
cmp rdx, rbx
je 0x18002e8bb
lea rdx, [rax + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
cmp eax, ebx
je 0x18002e8bb
lea rcx, [rbp + rbp]
call fcn.180042600
mov rdi, rax
cmp rax, rbx
je 0x18002e8bb
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.1800432e0
mov r9, rdi
mov r8d, ebp
xor edx, edx
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, ebx
je 0x18002e8b3
lea r9, [rsp + 0x98]
lea r8, [rsp + 0x40]
lea rdx, [0x180061e7c]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
cmp eax, ebx
je 0x18002e8b3
mov r8, qword [rsp + 0x40]
movzx ecx, word [r8 + 0xe]
movzx edx, word [r8 + 8]
movzx eax, word [r8 + 0xc]
movzx r9d, word [r8 + 0xa]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea r8, str._d._d._d._d
mov rcx, r12
mov edx, r14d
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov ebx, 1
mov rcx, rdi
call fcn.1800425c0
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x18002f094
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
sub rsp, 0x38
lea rax, [r11 + 0x20]
mov r9d, 4
mov rcx, 0xffffffff80000002
mov dword [r11 - 0x10], r9d
mov qword [r11 - 0x18], rax
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor ecx, ecx
cmp eax, ecx
sete cl
mov eax, ecx
add rsp, 0x38
ret
Function at 0x18002f0cc
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1800764a0]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
mov rdi, r9
mov rbp, r8
mov rsi, rdx
cmp r9, rbx
je 0x18002f102
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x18002f104
mov eax, ebx
lea ecx, [rax + rax + 2]
mov r9d, 1
mov r8, rbp
mov dword [rsp + 0x28], ecx
mov rcx, 0xffffffff80000002
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, ebx
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180040bb0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x18002f14c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x860
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x1800764a0]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbp, r9
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor r12d, r12d
mov dword [rsp + 0x38], r12d
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], r12
mov word [rcx + 8], r12w
mov dword [rsp + 0x38], 1
mov rsi, r12
cmp r8, r12
je 0x18002f2c5
mov word [rsp + 0x50], r12w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x52]
call fcn.1800432e0
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], r12d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x34]
mov r8, rbp
mov rdx, rdi
mov r13, 0xffffffff80000002
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [rsp + 0x34], 1
je 0x18002f215
cmp dword [rsp + 0x34], 2
jne 0x18002f2c5
mov eax, dword [rsp + 0x30]
cmp eax, r12d
je 0x18002f2c5
cmp eax, 0x800
jbe 0x18002f26b
lea rcx, [rax + 2]
call fcn.180042600
mov rsi, rax
mov r8d, dword [rsp + 0x30]
add r8, 2
xor edx, edx
mov rcx, rax
call fcn.1800432e0
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, rbp
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
jmp 0x18002f291
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbp
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea rdx, [rsp + 0x50]
cmp rsi, r12
cmovne rdx, rsi
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.18000a4d0
cmp rsi, r12
je 0x18002f2c5
mov rcx, rsi
call fcn.1800425c0
mov rax, rbx
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.180040bb0
mov rbx, qword [rsp + 0x898]
add rsp, 0x860
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18002f2f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r12
mov eax, 0x20a0
call fcn.1800554d0
sub rsp, rax
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rsp + 0x20c8], rbx
mov qword [rsp + 0x20d0], rbp
mov rax, qword [0x1800764a0]
xor rax, rsp
mov qword [rsp + 0x2090], rax
mov rbx, rcx
mov qword [rsp + 0x80], rcx
xor ebp, ebp
mov dword [rsp + 0x44], ebp
lea ecx, [rbp + 8]
call fcn.18004116c
cmp rax, rbp
je 0x18002f353
mov qword [rax], rbx
jmp 0x18002f356
mov rax, rbp
mov qword [rbx], rax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], rbp
mov qword [rbx + 0x28], rbp
mov dword [rsp + 0x44], 1
lea r12, vtable.RegHandleHolder.0
mov qword [rsp + 0x48], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareWOW6432NodeprojonepodlpdocGuardPass_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
mov rdi, qword [rsp + 0x50]
cmp rdi, rbp
je 0x18002f4b4
mov esi, ebp
mov word [rsp + 0x90], bp
xor edx, edx
mov r8d, 0x1ffe
lea rcx, [rsp + 0x92]
call fcn.1800432e0
mov dword [rsp + 0x40], 0x1000
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x90]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebp
jne 0x18002f4af
inc esi
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rbp
mov word [rsp + 0x60], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x58]
call fcn.18000a4d0
nop
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.18002f89c
nop
cmp qword [rsp + 0x78], 8
jb 0x18002f46a
mov rcx, qword [rsp + 0x60]
call fcn.180041070
mov dword [rsp + 0x40], 0x1000
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x90]
mov edx, esi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebp
je 0x18002f40a
mov rdi, qword [rsp + 0x50]
jmp 0x18002f4b4
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 0x48], r12
cmp rdi, rbp
je 0x18002f4c7
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x2090]
xor rcx, rsp
call fcn.180040bb0
lea r11, [rsp + 0x20a0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret