joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d7080
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x690
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov rdi, qword [rsp + 0x6f0]
mov r12, qword [rsp + 0x6f8]
mov rbx, rcx
lea rcx, [rsp + 0x40]
mov rbp, r9
mov rsi, r8
mov r13, rdx
call fcn.1400012c0
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.14017e4d0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, r12
lea r10, [rsp + 0x260]
neg rcx
mov r14d, eax
mov rcx, r13
sbb r11d, r11d
xor eax, eax
lea rdx, [rsp + 0x470]
and r11d, 0x104
test r12, r12
mov r9, rsi
cmove r10, rax
neg rcx
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x38], r11d
sbb r8d, r8d
mov qword [rsp + 0x30], r10
and r8d, 0x104
test r13, r13
mov qword [rsp + 0x28], rdi
cmove rdx, rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
mov ebx, eax
jne 0x1400d715d
mov word [rsp + 0x470], ax
mov word [rsp + 0x260], ax
lea rcx, [rsp + 0x40]
call fcn.140177510
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
test r13, r13
je 0x1400d7185
lea rdx, [rsp + 0x470]
mov rcx, r13
call fcn.1401782f0
test r12, r12
je 0x1400d719a
lea rdx, [rsp + 0x260]
mov rcx, r12
call fcn.1401782f0
mov eax, ebx
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x690
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400d7960
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
add rdx, 4
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [rbx], eax
jne 0x1400d798c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400d798c
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1400d7b50
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017e300
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov ebx, eax
je 0x1400d7bad
mov r8, qword [rsp + 0x28]
xor r9d, r9d
mov edx, 0x1005
lea ecx, [r9 + 4]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rcx, [rsp + 0x20]
call fcn.140177510
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x250
pop rbx
ret

Function at 0x1400d7be0
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017e300
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
mov ebx, eax
je 0x1400d7c3d
mov r8, qword [rsp + 0x28]
xor r9d, r9d
mov edx, 0x1005
lea ecx, [r9 + 4]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rcx, [rsp + 0x20]
call fcn.140177510
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x250
pop rbx
ret
Function at 0x1400d8200
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017e4d0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140177510
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x250
pop rbx
ret

Function at 0x1400d8450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017e300
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140177510
cmp ebx, 0xffffffff
je 0x1400d84ad
test bl, 0x10
jne 0x1400d84ad
mov eax, 1
jmp 0x1400d84af
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x250
pop rbx
ret

Function at 0x1400d84d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017e300
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140177510
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x250
pop rbx
ret

Function at 0x1400d8540
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp byte [rcx], 0
mov rbx, rcx
je 0x1400d85a2
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017e5f0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140177510
cmp ebx, 0xffffffff
je 0x1400d85a2
test bl, 0x10
je 0x1400d85a2
mov eax, 1
jmp 0x1400d85a4
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x250
pop rbx
ret

Function at 0x1400d88d0
Capabilities:
Delete file

Disassembly:
mov r11, rsp
sub rsp, 0x68
xor eax, eax
neg r8d
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x48], rcx
mov dword [rsp + 0x28], 3
mov qword [r11 - 0x30], rax
sbb ax, ax
mov qword [r11 - 0x38], rdx
and ax, 0x40
lea rcx, str.Enter_SHFileOperation_n
or ax, 0x4000
mov word [rsp + 0x40], ax
call fcn.1400b3e90
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
lea rcx, str.Leave_SHFileOperation_n
call fcn.1400b3e90
add rsp, 0x68
ret
Function at 0x1400d8b30
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rdi
sub rsp, 0x250
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rdx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400d8c41
mov qword [rsp + 0x270], rbx
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea rcx, [rsp + 0x20]
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.14017d970
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.140001000
mov ecx, 2
add eax, 1
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x1400d8bda
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call fcn.140001150
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rcx, [rsp + 0x20]
call fcn.140177510
mov rcx, rdi
call fcn.14017d180
mov ecx, 2
add eax, 1
movsxd rdx, eax
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x1400d8c33
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rdi
mov rcx, rax
call fcn.14017cdb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x250
pop rdi
ret
Function at 0x1400d9220
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x690
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
mov rbp, rdx
call fcn.1400012c0
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.14017e4d0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, rbx
lea rdx, [rsp + 0x260]
neg rcx
mov rcx, qword [rsp + 0x48]
mov esi, eax
sbb r8d, r8d
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
and r8d, 0x104
mov qword [rsp + 0x28], rax
test rbx, rbx
mov qword [rsp + 0x20], rax
cmove rdx, rax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
mov edi, eax
jne 0x1400d92c3
mov word [rsp + 0x260], ax
mov word [rsp + 0x470], ax
lea rcx, [rsp + 0x40]
call fcn.140177510
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
test rbx, rbx
je 0x1400d92ea
lea rdx, [rsp + 0x260]
mov rcx, rbx
call fcn.1401782f0
test edi, edi
je 0x1400d92f7
mov rax, qword [rbx + 8]
cmp byte [rax], 0
jne 0x1400d9362
lea rcx, [rsp + 0x40]
call fcn.1400012c0
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.14017e4d0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea rcx, [rsp + 0x40]
mov edi, eax
call fcn.140177510
cmp edi, 3
je 0x1400d934c
cmp edi, 6
je 0x1400d934c
test edi, edi
mov rax, qword [0x1402006b8]
jne 0x1400d9343
mov rdx, qword [rax + 0x32e0]
jmp 0x1400d935a
mov rdx, qword [rax + 0x378]
jmp 0x1400d935a
mov rax, qword [0x1402006b8]
mov rdx, qword [rax + 0x370]
mov rcx, rbx
call fcn.140178250
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1401a8fd0
mov rbx, qword [rsp + 0x6c0]
add rsp, 0x690
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400d9730
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov rbx, rdx
call fcn.1400012c0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r8d, dword [rsp + 0x24]
add eax, 1
cmp eax, r8d
jle 0x1400d9786
lea rcx, [rsp + 0x20]
mov edx, eax
call fcn.14017d6c0
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbx
test eax, eax
je 0x1400d97a7
mov rdx, qword [rsp + 0x28]
call fcn.1401782f0
jmp 0x1400d97ac
call fcn.1401784f0
lea rcx, [rsp + 0x20]
call fcn.140177510
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8fd0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x1400d97e0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, r8
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rcx, [rsp + 0x20]
mov rdi, rax
call fcn.1400012c0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r8d, dword [rsp + 0x24]
add eax, 1
cmp eax, r8d
jle 0x1400d983c
lea rcx, [rsp + 0x20]
mov edx, eax
call fcn.14017d6c0
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbx
test eax, eax
je 0x1400d985d
mov rdx, qword [rsp + 0x28]
call fcn.1401782f0
jmp 0x1400d9862
call fcn.1401784f0
lea rcx, [rsp + 0x20]
call fcn.140177510
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8fd0
mov rbx, qword [rsp + 0x278]
add rsp, 0x250
pop rdi
ret

Function at 0x1400d9a00
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
lea r8, [rsp + 0x20]
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x1400d9a66
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1400d9a5b
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1401782f0
mov ebx, 1
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8fd0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret

Function at 0x1400da600
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
sets cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1400da760
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, r8
mov rbp, rcx
mov r9d, edx
lea rcx, [rsp + 0x30]
mov edi, edx
xor esi, esi
mov qword [rsp + 0x20], rcx
or r9d, 8
xor r8d, r8d
mov rdx, rax
mov rcx, rbp
mov qword [rsp + 0x38], rax
mov ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400da866
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x100
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [rsi + 1]
test eax, eax
jne 0x1400da816
nop
nop
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov edx, edi
call fcn.1400da760
test eax, eax
je 0x1400da818
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x100
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1400da7e0
mov ecx, 1
mov ebx, ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1400da866
mov r10, qword [0x14020e2e0]
mov rdx, qword [rsp + 0x38]
mov rcx, rbp
test r10, r10
je 0x1400da852
or edi, 2
xor r9d, r9d
mov r8d, edi
call r10
test eax, eax
jne 0x1400da862
mov eax, 1
jmp 0x1400da868
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
mov eax, 1
cmove esi, eax
mov eax, esi
jmp 0x1400da868
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8fd0
mov rbx, qword [rsp + 0x288]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400da890
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
mov ebp, r9d
mov r12d, r8d
mov rbx, rdx
call fcn.1400012c0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14017d970
xor edi, edi
lea rbx, [0x1401d0118]
test ebp, ebp
mov rcx, rsi
je 0x1400da8f8
mov r8, qword [rsp + 0x28]
mov edx, dword [rbx]
call fcn.1400da760
jmp 0x1400da91d
mov rax, qword [0x14020e2e0]
mov rdx, qword [rsp + 0x28]
test rax, rax
je 0x1400da917
mov r8d, dword [rbx]
xor r9d, r9d
or r8d, 2
call rax
jmp 0x1400da91d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test r12d, r12d
je 0x1400da92e
add edi, 1
add rbx, 4
cmp edi, 3
jb 0x1400da8e3
lea rcx, [rsp + 0x20]
call fcn.140177510
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a8fd0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400daa10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x490
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rdi, rcx
lea rcx, [rsp + 0x260]
mov r12, r9
mov rbp, r8
mov rbx, rdx
xor esi, esi
call fcn.1400012c0
lea rcx, [rsp + 0x260]
mov rdx, rbx
call fcn.14017d970
mov rdx, qword [rsp + 0x268]
lea r11, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rcx, [rsp + 0x260]
test eax, eax
mov ebx, esi
mov edi, 1
cmove ebx, edi
call fcn.140177510
test ebx, ebx
je 0x1400dab88
lea rcx, [rsp + 0x40]
call fcn.1400012c0
lea rcx, [rsp + 0x260]
call fcn.1400012c0
test rbp, rbp
lea rcx, [rsp + 0x260]
je 0x1400daace
mov rdx, rbp
call fcn.14017d970
jmp 0x1400daad3
call fcn.140177d30
mov r8d, dword [rsp + 0x44]
nop
nop
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x38]
lea eax, [r8 + r8]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd r8, dword [rsp + 0x44]
cmp eax, 0xea
mov edx, dword [rsp + 0x30]
je 0x1400dab34
test eax, eax
jne 0x1400dab66
mov rcx, r8
add rcx, rcx
cmp rdx, rcx
jb 0x1400dab4b
add edx, edi
shr edx, 1
add edx, edi
cmp edx, r8d
jle 0x1400daae0
lea rcx, [rsp + 0x40]
call fcn.14017d6c0
jmp 0x1400daad3
mov rax, qword [rsp + 0x48]
shr rdx, 1
mov rcx, r12
mov word [rax + rdx*2], si
mov rdx, qword [rsp + 0x48]
call fcn.1401782f0
mov esi, edi
lea rcx, [rsp + 0x40]
call fcn.140177510
lea rcx, [rsp + 0x260]
call fcn.140177510
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x490
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400dabb0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x6b0
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rbx, rcx
lea rcx, [rsp + 0x270]
mov r12d, r9d
mov rsi, r8
mov rdi, rdx
xor ebp, ebp
call fcn.1400012c0
lea rcx, [rsp + 0x50]
call fcn.1400012c0
lea rcx, [rsp + 0x270]
mov rdx, rbx
call fcn.14017d970
test rdi, rdi
lea rcx, [rsp + 0x50]
je 0x1400dac19
mov rdx, rdi
call fcn.14017d970
jmp 0x1400dac1e
call fcn.140177d30
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x278]
mov dword [rsp + 0x38], ebp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x490]
lea r8, [rsp + 0x44]
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
lea rcx, [rsp + 0x50]
test eax, eax
mov ebx, 1
cmove ebp, ebx
call fcn.140177510
lea rcx, [rsp + 0x270]
call fcn.140177510
test ebp, ebp
je 0x1400daca1
lea rdx, [rsp + 0x490]
mov rcx, rsi
mov word [rsp + 0x696], 0
call fcn.1401782f0
mov eax, ebx
jmp 0x1400daca3
xor eax, eax
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x6b0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400dacd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x4a0
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rbx, rcx
lea rcx, [rsp + 0x270]
mov r12d, r9d
mov rbp, r8
mov rsi, rdx
xor edi, edi
call fcn.1400012c0
lea rcx, [rsp + 0x50]
call fcn.1400012c0
lea rcx, [rsp + 0x270]
mov rdx, rbx
call fcn.14017d970
test rsi, rsi
lea rcx, [rsp + 0x50]
je 0x1400dad39
mov rdx, rsi
call fcn.14017d970
jmp 0x1400dad3e
call fcn.140177d30
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x278]
mov dword [rsp + 0x38], edi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x44]
mov r9, rbp
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
mov ecx, 1
test eax, eax
cmove edi, ecx
lea rcx, [rsp + 0x50]
call fcn.140177510
lea rcx, [rsp + 0x270]
call fcn.140177510
mov eax, edi
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x4a0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400db1c0
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
sub rsp, 0x40
mov esi, r9d
mov r12, r8
mov r13d, edx
mov rdi, rcx
xor ebx, ebx
cmp byte [0x14020dd1b], bl
je 0x1400db1fc
call fcn.14017cf30
cmp eax, 0x104
jge 0x1400db21e
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9d, esi
mov r8, r12
mov edx, r13d
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rbx, rax
mov qword [rsp + 0x30], rax
jmp 0x1400db235
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
add rsp, 0x40
pop r13
ret
Function at 0x1400dbc60
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbp, rcx
mov eax, 7
xor edi, edi
cmp byte [0x14020e1c8], dil
lea rcx, [rsp + 0x60]
mov ebx, 3
cmovne ebx, eax
call fcn.1400012c0
lea rcx, [rsp + 0x60]
mov rdx, rbp
call fcn.14017e300
mov rcx, qword [rsp + 0x68]
mov r8d, ebx
mov qword [rsp + 0x30], rdi
mov ebx, 0x80000000
xor r9d, r9d
mov edx, ebx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rsp + 0x60]
mov rsi, rax
call fcn.140177510
cmp rsi, 0xffffffffffffffff
jne 0x1400dbd24
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400dbe14
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateFileW__:__d:_Failed_to_open_file__s_n
mov r8, rbp
mov edx, eax
call fcn.1400b3e90
jmp 0x1400dbe14
lea rdx, [rsp + 0x44]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov r11d, eax
mov dword [rsp + 0x40], eax
jne 0x1400dbd51
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400dbe0b
mov r11d, dword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x1400dbd7d
lea r8, [rsp + 0x48]
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x1400dbe0b
mov rdi, qword [rsp + 0x48]
jmp 0x1400dbe0b
cmp rax, rbx
jge 0x1400dbe0b
mov edx, r11d
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x1400dbe0b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400dbe02
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x48]
mov rdx, rax
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
test eax, eax
je 0x1400dbdfc
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov r11d, dword [rsp + 0x48]
cmp r11, qword [rsp + 0x40]
jne 0x1400dbe02
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x1400dbe02
mov rdi, qword [rsp + 0x50]
jmp 0x1400dbe0b
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1401a8fd0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret