joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005e5a0
Capabilities:
Get number of processors

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xa8]
mov r14, qword [rsp + 0xa0]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], r13
mov qword [r11 - 0x50], r12
mov qword [r11 - 0x58], r14
call fcn.18005cda0
mov r15, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov r9, r15
mov rdi, qword [rsp + 0xc8]
mov r8, rsi
mov rbx, qword [rsp + 0xc0]
mov rdx, rdi
mov rcx, rbx
call fcn.18005b170
vmovdqu32 zmm3, zmmword [rbx]
mov rax, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
vpmaxsd zmm1, zmm3, zmmword [rax]
mov rcx, qword [rsp + 0x80]
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [rax]
vmovdqu32 zmmword [rax], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r13]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r13]
vmovdqu32 zmmword [r13], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r12]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r12]
vmovdqu32 zmmword [r12], zmm0
vmovdqu32 zmm4, zmmword [r15]
vpmaxsd zmm0, zmm4, zmmword [r14]
vmovdqu32 zmmword [r15], zmm0
vpminsd zmm1, zmm4, zmmword [r14]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
vmovdqu32 zmmword [r14], zmm1
mov qword [rsp + 0x20], r14
vzeroupper
call fcn.18005cfe0
mov r9, r15
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.18005b8a0
Function at 0x1800604a0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xb8]
mov qword [r11 - 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x48], rax
mov rax, qword [rsp + 0xa8]
mov qword [r11 - 0x50], rax
mov rax, qword [rsp + 0xa0]
mov qword [r11 - 0x58], rax
call fcn.18005cda0
mov rax, qword [rsp + 0xf8]
mov r13, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov r9, r14
mov rdi, qword [rsp + 0xc8]
mov r8, rsi
mov rbx, qword [rsp + 0xc0]
mov rdx, rdi
mov r15, qword [rsp + 0xe0]
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
call fcn.18005cec0
vmovdqu32 zmm3, zmmword [rbx]
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xa0]
vpmaxsd zmm1, zmm3, zmmword [r9]
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r9]
vmovdqu32 zmmword [r9], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r8]
mov r10, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r11, qword [rsp + 0x90]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r8]
vmovdqu32 zmmword [r8], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [rdx]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [rdx]
vmovdqu32 zmmword [rdx], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
vmovdqu32 zmm3, zmmword [r15]
vpmaxsd zmm1, zmm3, zmmword [r10]
vmovdqu32 zmmword [r15], zmm1
vpminsd zmm0, zmm3, zmmword [r10]
vmovdqu32 zmmword [r10], zmm0
vmovdqu32 zmm4, zmmword [r12]
vpmaxsd zmm0, zmm4, zmmword [r11]
vmovdqu32 zmmword [r12], zmm0
vpminsd zmm1, zmm4, zmmword [r11]
vmovdqu32 zmmword [r11], zmm1
vmovdqu32 zmm3, zmmword [r13]
vpmaxsd zmm1, zmm3, zmmword [rcx]
vmovdqu32 zmmword [r13], zmm1
vpminsd zmm0, zmm3, zmmword [rcx]
vmovdqu32 zmmword [rcx], zmm0
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x38], r9
mov r9, r10
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rdx
vmovdqu32 zmm4, zmmword [rcx]
vpmaxsd zmm0, zmm4, zmmword [rbx]
vmovdqu32 zmmword [rcx], zmm0
vpminsd zmm1, zmm4, zmmword [rbx]
vmovdqu32 zmmword [rbx], zmm1
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x88]
mov r8, r11
vzeroupper
call fcn.18005cfe0
mov rax, qword [rsp + 0xf8]
mov r9, r14
mov rcx, qword [rsp + 0xc0]
mov r8, rsi
mov qword [rsp + 0xb8], rax
mov rdx, rdi
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r15
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.18005cfe0
Function at 0x18006f320
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18006f348
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18006f348
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x180072780
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x64], r8d
mov rdx, rcx
mov qword [rbp - 0x70], rdx
xor ecx, ecx
mov qword [rbp - 0x78], rcx
mov r9d, 2
mov dword [rbp - 0x68], r9d
lea rcx, [rbp - 0x60]
call fcn.180005cd0
mov r8d, dword [rbp - 0x64]
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
mov r9d, dword [rbp - 0x68]
call sub.bcrypt.dll_BCryptGenRandom
mov ebx, eax
lea rcx, [rbp - 0x60]
call fcn.180005d20
test ebx, ebx
jne 0x1800727f4
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp ebx, 0xc0000017
je 0x18007281c
lea rcx, [0x180113090]
call fcn.180003e80
mov rbx, rax
mov rcx, rbx
call fcn.18007dfa0
mov rcx, rbx
call fcn.1800043f0
int3
lea rcx, [0x1801135a8]
call fcn.180003e80
mov rbx, rax
mov rcx, rbx
call fcn.180081a40
mov rcx, rbx
call fcn.1800043f0
int3

Function at 0x1800752c0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1800752d2
add rsp, 0x28
jmp fcn.1800756c0
lea rcx, [0x18010e838]
call fcn.18007c590
int3
Function at 0x1800829a0
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
mov rsi, rcx
mov rdi, r8
mov r8d, edx
mov ebx, r9d
test ebx, ebx
jne 0x1800829e7
xor eax, eax
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
lea ebp, [rbx - 1]
test ebp, ebp
jne 0x180082a25
movsx rdx, word [rdi]
movzx ecx, dx
dec ecx
cmp ecx, 0xfe
jae 0x180082bcd
mov rcx, rsi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1800fa3c0
xor r14d, r14d
movzx r15d, word [rdi]
sub r8d, ebp
mov r13d, r8d
cmp r13d, 8
jge 0x180082aa8
add rdi, 2
test r13d, r13d
jle 0x180082b2b
lea rcx, [rsi + r14*2]
movsx rdx, r15w
mov r8d, r13d
call fcn.1800f1c40
test eax, eax
jl 0x180082b2b
sub r13d, eax
movsxd rcx, eax
add r14, rcx
test r13d, r13d
jle 0x180082b2b
lea rcx, [rsi + r14*2 + 2]
mov r8d, ebp
add r8, r8
mov rdx, rdi
call fcn.1800824c0
test eax, eax
je 0x180082bb9
mov eax, r14d
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
movsxd rax, ebp
movzx eax, word [rdi + rax*2]
movsxd rbp, ebp
jmp 0x180082abb
dec rbp
movzx eax, word [rdi + rbp*2]
cmp eax, r15d
jne 0x180082ac6
cmp rbp, 1
jg 0x180082ab4
movd xmm0, r15d
movaps xmm6, xmm0
punpcklwd xmm6, xmm0
pshufd xmm6, xmm6, 0
movd xmm0, eax
movaps xmm7, xmm0
punpcklwd xmm7, xmm0
pshufd xmm7, xmm7, 0
movsxd r15, r13d
lea r13, [r15 - 8]
jmp 0x180082af3
mov r14, r13
movups xmm0, xmmword [rsi + r14*2]
pcmpeqw xmm0, xmm6
lea rax, [r14 + rbp]
movups xmm1, xmmword [rsi + rax*2]
pcmpeqw xmm1, xmm7
pand xmm0, xmm1
xorps xmm1, xmm1
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x180082b4b
add r14, 8
cmp r14, r15
jne 0x180082bab
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
pmovmskb r12d, xmm0
test r12d, r12d
jne 0x180082b5c
mov ecx, 0x20
jmp 0x180082b60
bsf ecx, r12d
shr ecx, 1
mov eax, ecx
mov qword [rsp + 0x28], rax
cmp ebx, 2
je 0x180082b8d
lea rcx, [r14 + rax]
lea rcx, [rsi + rcx*2]
mov r8d, ebx
add r8, r8
mov rdx, rdi
call fcn.1800824c0
test eax, eax
mov rax, qword [rsp + 0x28]
je 0x180082b95
add eax, r14d
jmp 0x180082a8d
lea ecx, [r12 - 1]
and ecx, r12d
lea r12d, [rcx - 1]
and r12d, ecx
jne 0x180082b50
jmp 0x180082b1e
cmp r14, r13
jle 0x180082af3
jmp 0x180082af0
dec r13d
inc r14
test r13d, r13d
jg 0x180082a45
jmp 0x180082b2b
mov rcx, rsi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1800f1c40
Function at 0x1800ac220
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x40], rax
test rcx, rcx
je 0x1800ac249
add rcx, 0xc
jmp 0x1800ac24b
xor ecx, ecx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x78], rcx
mov dword [rbp - 0x6c], edx
mov qword [rbp - 0x80], r8
mov dword [rbp - 0x70], r9d
lea rcx, [rbp - 0x68]
call fcn.180005cd0
mov rcx, qword [rbp - 0x78]
mov edx, dword [rbp - 0x6c]
mov r8, qword [rbp - 0x80]
mov r9d, dword [rbp - 0x70]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.180005d20
mov eax, ebx
xor ecx, ecx
mov qword [rbp - 0x40], rcx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1800ac9f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
xor ecx, ecx
mov dword [r9], ecx
mov qword [rbp - 0x40], r9
mov r14, r9
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov qword [rbp - 0x74], rcx
mov rdx, rsi
mov qword [rbp - 0x7c], rdx
mov r8d, edi
mov dword [rbp - 0x6c], r8d
mov r9, r14
mov qword [rbp - 0x84], r9
lea rcx, [rbp - 0x68]
call fcn.180005cd0
mov rcx, qword [rbp - 0x74]
mov rdx, qword [rbp - 0x7c]
mov r8d, dword [rbp - 0x6c]
mov r9, qword [rbp - 0x84]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.180005d20
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1801ad428]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x1800acab9
mov dword [rdi + 0x50], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x1800aa1d0]
call rax
mov rdi, rax
jmp 0x1800acaa3
Function at 0x1800ad4e0
Capabilities:
Access the windows event log

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov rbx, rcx
mov esi, edx
mov edi, r8d
mov r14d, r9d
mov r15, qword [rbp + 0x30]
mov r13, qword [rbp + 0x50]
lea r12, [r13 + 0x10]
xor ecx, ecx
test r13, r13
cmove r12, rcx
mov qword [rbp - 0x40], r12
lea r13, [r15 + 0x10]
test r15, r15
cmove r13, rcx
mov qword [rbp - 0x48], r13
call sub.KERNEL32.dll_SetLastError
mov qword [rsp + 0x20], r13
movsx rdx, word [rbp + 0x38]
mov dword [rsp + 0x28], edx
mov r15d, dword [rbp + 0x40]
mov dword [rsp + 0x30], r15d
mov r15, qword [rbp + 0x48]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r12
movsx rdx, si
mov dword [rbp - 0x74], edx
movzx r8d, di
mov dword [rbp - 0x78], r8d
mov rcx, rbx
mov qword [rbp - 0x84], rcx
mov r9d, r14d
mov dword [rbp - 0x7c], r9d
lea rcx, [rbp - 0x70]
call fcn.180005cd0
mov edx, dword [rbp - 0x74]
mov r8d, dword [rbp - 0x78]
mov rcx, qword [rbp - 0x84]
mov r9d, dword [rbp - 0x7c]
call sub.ADVAPI32.dll_ReportEventW
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.180005d20
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1801ad428]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x1800ad5fd
mov dword [rdi + 0x50], esi
test ebx, ebx
setne al
movzx eax, al
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x1800aa1d0]
call rax
mov rdi, rax
jmp 0x1800ad5de
Function at 0x1800ad610
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x100]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov edi, edx
mov rbx, r8
mov rsi, r9
mov r14, qword [rbp + 0x38]
mov r15, qword [rbp + 0x40]
mov r13, qword [rbp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1800a36a0
nop
lea rcx, [r13 + 0x10]
xor edx, edx
test r13, r13
cmove rcx, rdx
mov qword [rbp - 0x50], rcx
lea rdx, [r15 + 0x10]
xor r8d, r8d
test r15, r15
cmove rdx, r8
mov qword [rbp - 0x58], rdx
lea r8, [r14 + 0x10]
xor r9d, r9d
test r14, r14
cmove r8, r9
mov qword [rbp - 0x60], r8
mov qword [rbp - 0x68], rsi
mov r9, rsi
lea rax, [rbx + 0x10]
xor r10d, r10d
test rbx, rbx
cmove rax, r10
mov qword [rbp - 0x70], rax
mov r10, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [r10 + 8]
mov qword [rbp - 0xa4], rcx
mov edx, edi
mov dword [rbp - 0x9c], edx
mov r8, rax
mov qword [rbp - 0xac], r8
mov qword [rbp - 0xb4], r9
lea rcx, [rbp - 0x98]
call fcn.180005cd0
mov rcx, qword [rbp - 0xa4]
mov edx, dword [rbp - 0x9c]
mov r8, qword [rbp - 0xac]
mov r9, qword [rbp - 0xb4]
call sub.ADVAPI32.dll_RegEnumValueW
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.180005d20
nop
xor ecx, ecx
mov qword [rbp - 0x70], rcx
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1800ad765
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1800a36e0
mov eax, ebx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1800ada70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov rsi, r8
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1800a36a0
nop
test rbx, rbx
je 0x1800adac6
add rbx, 0xc
mov rdx, rbx
jmp 0x1800adac8
xor edx, edx
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rbx
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x88], rdx
mov r8, rsi
mov qword [rbp - 0x90], r8
mov r9, rdi
mov qword [rbp - 0x98], r9
lea rcx, [rbp - 0x78]
call fcn.180005cd0
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x88]
mov r8, qword [rbp - 0x90]
mov r9, qword [rbp - 0x98]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.180005d20
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1800adb51
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1800a36e0
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1800af8a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
mov r8, qword [rcx + 0x18]
mov r10, qword [rcx + 0x20]
mov r9, rdx
shl r9, 0x11
xor r8, rax
xor r10, rdx
lea r11, [rdx + rdx*4]
rol r11, 7
lea r11, [r11 + r11*8]
xor rdx, r8
xor rax, r10
xor r8, r9
rol r10, 0x2d
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], r8
mov qword [rcx + 0x20], r10
mov rax, r11
shr rax, 0x21
cmp rax, 0x7fffffff
je fcn.1800af8a0
ret
Function at 0x1800f1c40
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
cmp r8d, 8
jge 0x1800f1cca
xor r10d, r10d
cmp r8d, 4
jl 0x1800f1c9e
add r8d, 0xfffffffc
movsx rax, word [rcx + r10*2]
movsx r9, dx
cmp eax, r9d
je 0x1800f1ea3
movsx rax, word [rcx + r10*2 + 2]
cmp eax, r9d
je 0x1800f1e91
movsx rax, word [rcx + r10*2 + 4]
cmp eax, r9d
je 0x1800f1e97
movsx rax, word [rcx + r10*2 + 6]
cmp eax, r9d
je 0x1800f1e9d
add r10, 4
test r8d, r8d
jle 0x1800f1cc0
movsx r9, dx
dec r8d
movsx rax, word [rcx + r10*2]
cmp eax, r9d
je 0x1800f1ea3
inc r10
test r8d, r8d
jg 0x1800f1ca7
mov eax, 0xffffffff
add rsp, 0x38
ret
movsx r9, dx
movd xmm0, r9d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov r10, rcx
lea eax, [r8 - 8]
cdqe
add rax, rax
lea rdx, [r10 + rax]
movups xmm1, xmmword [r10]
pcmpeqw xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
xorps xmm2, xmm2
pcmpeqw xmm1, xmm2
pmovmskb r9d, xmm1
cmp r9d, 0xffff
jne 0x1800f1dea
add r10, 0x10
cmp r10, rdx
jbe 0x1800f1cec
mov ecx, r8d
test cl, 7
je 0x1800f1cc0
movups xmm1, xmmword [rdx]
pcmpeqw xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
pcmpeqw xmm0, xmm1
pmovmskb r10d, xmm0
cmp r10d, 0xffff
je 0x1800f1cc0
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 8], rcx
movzx ecx, word [rsp + 8]
shr ecx, 0xf
movzx edx, word [rsp + 0xa]
shr edx, 0xf
add edx, edx
or ecx, edx
movzx edx, word [rsp + 0xc]
shr edx, 0xf
shl edx, 2
or edx, ecx
mov ecx, edx
movzx edx, word [rsp + 0xe]
shr edx, 0xf
shl edx, 3
or edx, ecx
mov ecx, edx
mov rdx, qword [rsp + 0x28]
mov qword [rsp], rdx
movzx edx, word [rsp]
shr edx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
shl edx, 4
or ecx, edx
bsf edx, ecx
mov r8d, 0x20
test ecx, ecx
cmove edx, r8d
shr rax, 1
add eax, edx
jmp 0x1800f1ea6
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x18], rax
movzx eax, word [rsp + 0x18]
shr eax, 0xf
movzx edx, word [rsp + 0x1a]
shr edx, 0xf
add edx, edx
or eax, edx
movzx edx, word [rsp + 0x1c]
shr edx, 0xf
shl edx, 2
or edx, eax
mov eax, edx
movzx edx, word [rsp + 0x1e]
shr edx, 0xf
shl edx, 3
or edx, eax
mov eax, edx
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x10], rdx
movzx edx, word [rsp + 0x10]
shr edx, 0xf
movzx r8d, word [rsp + 0x12]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x14]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x16]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
shl edx, 4
or eax, edx
bsf edx, eax
mov r8d, 0x20
test eax, eax
cmove edx, r8d
mov rax, r10
sub rax, rcx
shr rax, 1
add eax, edx
jmp 0x1800f1ea6
lea eax, [r10 + 1]
jmp 0x1800f1ea6
lea eax, [r10 + 2]
jmp 0x1800f1ea6
lea eax, [r10 + 3]
jmp 0x1800f1ea6
mov eax, r10d
add rsp, 0x38
ret
Function at 0x1400039b0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140003a40
jmp 0x140003a2f
jae 0x140003b00
cmp r8, 0x201
jae 0x140003a40
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140003a98
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x140003a6f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140019590
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140003ac1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140003b68
mov r8d, r14d
cmp r15, r8
jne 0x140003a20
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140003b8b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x140003a2f
jmp 0x140003a40
cmp rsi, r8
jb 0x140003ba5
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.1400059a0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140003b51
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140001220
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140003b39
jmp 0x140003b51
lea rcx, str.internal_error:_entered_unreachable_code_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140019fb0
jmp 0x140003bba
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001a400
ud2