joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e2690
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, rcx
mov edx, 9
call fcn.1400d7ee0
movzx esi, al
test al, al
jne 0x1400e26dc
mov edx, 0xc
mov rcx, rbx
call fcn.1400d8590
test al, al
je 0x1400e28ca
mov rdi, qword [0x140428b78]
test rdi, rdi
je 0x1400e28ca
mov qword [rbp + 0x17], 0
mov edx, 0x1c
lea rcx, [rbp + 0xf]
call fcn.1401fcb40
mov eax, dword [rbp + 0x17]
inc eax
movsxd rdx, eax
mov r9d, 0x1c
lea r8, str.Captions_SearchingRepairFile
mov rcx, qword [rbp + 0xf]
call fcn.1402ba94c
mov edx, 0x1c
lea rcx, [rbp + 0xf]
call fcn.1401fde50
nop
lea rdx, [rbp + 0xf]
lea rcx, [rbp + 0x2f]
call fcn.1400f4800
nop
cmp dword [rbp + 0x17], 0
jle 0x1400e274c
mov rcx, qword [rbp + 0xf]
call fcn.1402b7350
mov r8, qword [rbx + 8]
mov rdx, qword [rbp + 0x2f]
lea rcx, [rbp + 0x3f]
call fcn.1401fcfe0
nop
xor r9d, r9d
xorps xmm2, xmm2
mov rdx, rax
mov rcx, rdi
call fcn.1400f4200
nop
cmp dword [rbp + 0x47], 0
jle 0x1400e277f
mov rcx, qword [rbp + 0x3f]
call fcn.1402b7350
movzx r9d, sil
mov r8, rbx
lea rdx, [rbp + 0x1f]
mov rcx, rdi
call fcn.140102630
nop
mov rdx, qword [rbx + 8]
cmp dword [rbp + 0x2b], 0
jne 0x1400e280f
lea rcx, str.WARNING:_Did_not_find_a_white_listed_repair_file_for:__s_r_n
call fcn.1402b9694
xor edx, edx
mov rcx, rbx
call fcn.1400d7a00
movzx eax, byte [rbx + 0x40]
shr al, 4
test al, 1
je 0x1400e28ab
mov rcx, rbx
call fcn.1400d8a80
cmp dword [rax + 0x28], 8
je 0x1400e28ab
mov dword [rax + 0x28], 8
cmp byte [rax + 8], 0
je 0x1400e28ab
mov rax, qword [rax]
mov rdx, qword [0x140428b78]
mov qword [rbp + 0x3f], rax
mov dword [rbp + 0x47], 7
lea rcx, [rdx + 0x388]
lea r8, [rbp + 0x3f]
call fcn.1401188e0
jmp 0x1400e28ab
mov r8, qword [rbp + 0x1f]
lea rcx, str._tRepair_file_found__r_nBad:_t_ws_r_nReplace_t_s_r_n
call fcn.1402b9694
mov rax, qword [rbx + 0x40]
shr rax, 0x23
test al, 1
je 0x1400e2832
mov edx, 0xb
jmp 0x1400e289e
xor sil, sil
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400e2899
lea rdx, [rbp + 0x6f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400e2886
mov ecx, dword [rbx + 0x38]
cmp rcx, qword [rbp + 0x6f]
setge sil
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
mov edx, 0xb
jne 0x1400e289e
mov edx, 0xa
lea r8, [rbp + 0x1f]
mov rcx, rbx
call fcn.14000b8f0
nop
cmp dword [rbp + 0x27], 0
jle 0x1400e28bb
mov rcx, qword [rbp + 0x1f]
call fcn.1402b7350
nop
cmp dword [rbp + 0x37], 0
jle 0x1400e28ca
mov rcx, qword [rbp + 0x2f]
call fcn.1402b7350
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400ea910
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push r12
push r14
push r15
sub rsp, 0x88
xor r12d, r12d
lea rax, [r11 + 0x18]
mov r15, rcx
mov rcx, qword [rcx + 8]
mov qword [r11 - 0x50], r12
mov qword [r11 - 0x58], r12
mov qword [r11 - 0x60], r12
mov qword [r11 - 0x68], r12
mov qword [r11 - 0x70], r12
mov qword [r11 - 0x78], r12
mov qword [r11 - 0x80], rax
lea rax, [r11 + 8]
mov r14, rdx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x1400ea984
xor al, al
add rsp, 0x88
pop r15
pop r14
pop r12
pop rbx
ret
mov ecx, dword [rsp + 0xc0]
mov qword [rsp + 0x80], rbp
mov eax, 2
inc ecx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1402b2274
mov edx, dword [rsp + 0xb0]
mov rcx, r14
mov rbp, rax
call fcn.1400c7e30
mov ecx, dword [rsp + 0xb0]
mov esi, r12d
mov edi, r12d
test ecx, ecx
je 0x1400eaa52
nop dword [rax]
mov ecx, dword [rsp + 0xc0]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
inc ecx
lea r9, [rsp + 0xc8]
mov r8, rbp
mov dword [rsp + 0xc8], ecx
mov rcx, qword [r15 + 8]
mov edx, edi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400eaa45
lea rcx, [rsp + 0x60]
mov rdx, rbp
call fcn.1401faae0
mov edx, esi
mov rcx, r14
mov r8, rax
call fcn.1400e28f0
inc esi
mov ecx, dword [rsp + 0xb0]
inc edi
cmp edi, ecx
jb 0x1400ea9e0
mov rdi, qword [rsp + 0x70]
cmp esi, ecx
je 0x1400eaa65
mov edx, esi
mov rcx, r14
call fcn.1400c7e30
mov rcx, rbp
call fcn.1402b712c
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
mov al, 1
add rsp, 0x88
pop r15
pop r14
pop r12
pop rbx
ret

Function at 0x1400eaa90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rbp, rcx
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x50]
mov rdi, r8
xor ebx, ebx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400eab21
cmp dword [rsp + 0x68], 3
jne 0x1400eab21
mov edx, dword [rsp + 0x50]
mov rcx, rdi
call fcn.1400d2aa0
test al, al
je 0x1400eab21
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 8]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400eab30
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 8]
xor eax, eax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1400eab72.5
mov eax, dword [rsp + 0x40]
dec eax
cmp eax, 0xa
ja case.0x1400eab72.5
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0xeabb8]
add rcx, rdx
jmp rcx
mov eax, 3
add rsp, 0x38
ret
mov eax, 4
add rsp, 0x38
ret
mov eax, 2
add rsp, 0x38
ret
mov eax, 7
add rsp, 0x38
ret
mov eax, 0xb
add rsp, 0x38
ret
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x1400eabf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push r14
push r15
sub rsp, 0x80
xor r15d, r15d
lea rax, [r11 + 0x18]
mov r14, rcx
mov rcx, qword [rcx + 8]
mov qword [r11 - 0x40], r15
mov qword [r11 - 0x48], r15
mov qword [r11 - 0x50], r15
mov qword [r11 - 0x58], rax
lea rax, [r11 + 8]
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x68], r15
mov rbp, rdx
mov qword [r11 - 0x70], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [r11 - 0x78], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1400eac55
xor al, al
add rsp, 0x80
pop r15
pop r14
pop rbp
ret
mov ecx, dword [rsp + 0xb0]
mov qword [rsp + 0xa8], rbx
mov eax, 2
inc ecx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1402b2274
mov edx, dword [rsp + 0xa0]
mov rcx, rbp
mov rsi, rax
call fcn.1400c7e30
mov ecx, dword [rsp + 0xa0]
mov edi, r15d
mov ebx, r15d
test ecx, ecx
je 0x1400ead18
nop
mov ecx, dword [rsp + 0xb0]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
inc ecx
lea r9, [rsp + 0xb8]
mov r8, rsi
mov dword [rsp + 0xb8], ecx
mov rcx, qword [r14 + 8]
mov edx, ebx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1400ead0b
lea rcx, [rsp + 0x60]
mov rdx, rsi
call fcn.1401faae0
mov edx, edi
mov rcx, rbp
mov r8, rax
call fcn.1400e28f0
inc edi
mov ecx, dword [rsp + 0xa0]
inc ebx
cmp ebx, ecx
jb 0x1400eacb0
mov rbx, qword [rsp + 0xa8]
cmp edi, ecx
je 0x1400ead2e
mov edx, edi
mov rcx, rbp
call fcn.1400c7e30
mov rcx, rsi
call fcn.1402b712c
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov al, 1
add rsp, 0x80
pop r15
pop r14
pop rbp
ret
Function at 0x1400eadd0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov byte [r11 + 0x18], r8b
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
movzx ebx, r8b
mov r12, rdx
mov r15, rcx
xor r14b, r14b
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [r11 - 0x58], rax
xor eax, eax
mov dword [rsp + 0x48], eax
mov qword [r11 - 0x48], rax
lea rdx, [r11 - 0x58]
call fcn.1400eabf0
mov r13, qword [rsp + 0x50]
test al, al
je 0x1400eaf47
mov eax, dword [rsp + 0x48]
test eax, eax
jle 0x1400eaf47
mov rsi, r13
mov ebp, eax
mov r13d, 1
nop dword [rax]
nop word [rax + rax]
xor eax, eax
mov dword [rsp + 0xb8], eax
mov rdi, qword [rsi]
test bl, bl
jne 0x1400eae8b
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
test al, al
jne 0x1400eaf35
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400eaf35
mov ecx, dword [rsp + 0xb8]
call fcn.1402b7390
mov rbx, rax
test rax, rax
je 0x1400eaf2d
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400eaf25
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, dword [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx r14d, r14b
test eax, eax
cmove r14d, r13d
mov rcx, rbx
call fcn.1402b7350
movzx ebx, byte [rsp + 0xb0]
add rsi, 0x10
dec rbp
jne 0x1400eae50
mov r13, qword [rsp + 0x50]
test r13, r13
je 0x1400eaf6d
lea r9, [fcn.140005eb0]
mov r8d, dword [r13 - 8]
mov edx, 0x10
mov rcx, r13
call fcn.1402b7cf4
lea rcx, [r13 - 8]
call fcn.1402b712c
movzx eax, r14b
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400eb3b0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rbp, [0x140346ce0]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
test eax, eax
jle 0x1400eb45f
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.1401fcb40
mov rdx, qword [rsp + 0x30]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.1401fde50
mov qword [rbx + 8], rsi
mov edx, dword [rsp + 0x3c]
test edx, edx
jne 0x1400eb42f
mov qword [rbx], rbp
jmp 0x1400eb455
mov rcx, rbx
call fcn.1401fcb40
movsxd r9, dword [rsp + 0x3c]
mov eax, dword [rbx + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x30]
mov rcx, qword [rbx]
call fcn.1402ba94c
mov edx, dword [rsp + 0x3c]
mov rcx, rbx
call fcn.1401fde50
jmp 0x1400eb46f
mov rdx, qword [0x140416ee8]
mov rcx, rbx
call fcn.1401faae0
nop
cmp dword [rsp + 0x38], 0
jle 0x1400eb480
mov rcx, qword [rsp + 0x30]
call fcn.1402b7350
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400ebad0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x328], rbx
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov qword [rsp + 0x60], r8
xor dil, dil
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.1400d2ba0
nop
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400ebce2
lea rax, vtable.Core::Collection_class_Core::String_.0
mov qword [rsp + 0x30], rax
xor edi, edi
mov r15d, edi
mov dword [rsp + 0x38], edi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
lea r13, [0x140346ce0]
mov r14, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
test byte [rsp + 0x70], 0x10
jne 0x1400ebc6e
lea rax, [rbp - 0x64]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400ebb85
mov qword [rsp + 0x28], 0
test ebx, ebx
jne 0x1400ebba3
mov qword [rsp + 0x20], r13
jmp 0x1400ebbc9
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rsp + 0x28]
inc eax
movsxd rdx, eax
lea r8, [rbp - 0x64]
mov rcx, qword [rsp + 0x20]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.1401fde50
nop
mov ecx, 0x20
call fcn.1402b6dbc
mov rbx, rax
test rax, rax
je 0x1400ebbf6
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0
jmp 0x1400ebbf9
mov rbx, rdi
mov edx, dword [rsp + 0x2c]
lea rcx, [rbx + 0x10]
call fcn.1401fcb40
movsxd r9, dword [rsp + 0x2c]
mov eax, dword [rbx + 0x18]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call fcn.1402ba94c
mov edx, dword [rsp + 0x2c]
lea rcx, [rbx + 0x10]
call fcn.1401fde50
xor edi, edi
mov qword [rsp + 0x48], rbx
test r15d, r15d
jne 0x1400ebc48
mov qword [rbx + 8], rdi
mov rsi, rbx
mov qword [rsp + 0x40], rbx
jmp 0x1400ebc4f
mov qword [r14], rbx
mov qword [rbx + 8], r14
mov r14, rbx
mov qword [rbx], rdi
inc r15d
mov dword [rsp + 0x38], r15d
cmp dword [rsp + 0x28], 0
jle 0x1400ebc6e
mov rcx, qword [rsp + 0x20]
call fcn.1402b7350
lea rdx, [rsp + 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400ebb72
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
sete dil
mov edx, r15d
mov rcx, qword [rsp + 0x60]
call fcn.140117c40
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140117b00
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
test rsi, rsi
je 0x1400ebce2
nop
mov rbx, qword [rsi]
cmp dword [rsi + 0x18], 0
jle 0x1400ebcd2
mov rcx, qword [rsi + 0x10]
call fcn.1402b7350
mov rcx, rsi
call fcn.1402150f0
mov rsi, rbx
test rbx, rbx
jne 0x1400ebcc0
cmp dword [rsp + 0x58], 0
jle 0x1400ebcf3
mov rcx, qword [rsp + 0x50]
call fcn.1402b7350
movzx eax, dil
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1402b6d40
mov rbx, qword [rsp + 0x328]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ecb00
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x80
mov eax, dword [rcx + 0xc]
mov ebp, r9d
movsxd rsi, r8d
mov r14, rdx
mov rdi, rcx
test eax, eax
jne 0x1400ecc23
add rcx, 0x30
mov qword [r11 + 8], rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lock inc dword [rdi + 0x10]
lea rcx, [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 0x58
mov byte [rdi + 0xa9], 0
call fcn.1402b6dbc
test rax, rax
je 0x1400ecba4
mov rcx, qword [rsp + 0xc0]
lea r9, [r14 + rsi]
lea r8, [rdi + 0xb0]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0xb8]
mov rdx, rdi
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov dword [rsp + 0x20], ebp
call fcn.1400ec620
mov rsi, rax
jmp 0x1400ecba6
xor esi, esi
mov rdx, qword [rsi + 8]
mov rcx, qword [rdi + 0xa0]
lea rax, [rdi + 0xb0]
lea r9, [rsi + 0x20]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400ecbfe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xea
je 0x1400ecbfe
cmp eax, 0x3e5
je 0x1400ecbfe
mov rdx, rsi
mov rcx, rdi
call fcn.1400ed320
cmp ebx, 0x6d
je 0x1400ecc3f
cmp ebx, 0xe9
jne 0x1400ecc46
jmp 0x1400ecc3f
mov rbx, qword [rsp + 0x90]
lea r11, [rsp + 0x80]
mov rax, rsi
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
lea rcx, [rsp + 0x40]
call fcn.1400ec420
lea rdx, [0x14040d638]
lea rcx, [rsp + 0x40]
call fcn.1402bece8
int3
mov byte [rdi + 0xa8], 0
lea rax, [0x140346ce0]
lea rdx, [0x14040d6c8]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, vtable.Core::NamedPipeException.0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], ebx
call fcn.1402bece8
int3
Function at 0x1400ecf50
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
mov dword [r11 + 0x18], r8d
push rdi
sub rsp, 0x70
mov eax, dword [rcx + 0xc]
mov ebx, r9d
mov rsi, rdx
mov rdi, rcx
mov dword [r11 + 0x18], 0
test eax, eax
jne 0x1400ed041
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [r11 + 8], rbp
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rdi + 0xa0]
lea rbp, [rdi + 0xd0]
lea r9, [rsp + 0x90]
mov r8d, ebx
mov rdx, rsi
mov qword [rdi + 0xe8], rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400ed013
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x3e5
jne 0x1400ed000
mov rcx, qword [rdi + 0xa0]
lea r8, [rsp + 0x90]
mov r9d, 1
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1400ed013
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x1400ed013
cmp ebx, 0x6d
je 0x1400ed05d
cmp ebx, 0xe9
jne 0x1400ed064
jmp 0x1400ed05d
mov rcx, qword [rdi + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x90]
mov rbp, qword [rsp + 0x80]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, [rsp + 0x30]
call fcn.1400ec420
lea rdx, [0x14040d638]
lea rcx, [rsp + 0x30]
call fcn.1402bece8
int3
mov byte [rdi + 0xa8], 0
mov rcx, qword [rdi + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [0x140346ce0]
lea rdx, [0x14040d6c8]
mov qword [rsp + 0x50], rax
lea rax, vtable.Core::NamedPipeException.0
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x48], rax
call fcn.1402bece8
int3
Function at 0x1400ed0b0
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
mov dword [r11 + 0x18], r8d
push rbx
push rbp
push rdi
sub rsp, 0x70
mov eax, dword [rcx + 0xc]
xor ebp, ebp
mov rdi, rdx
mov rbx, rcx
mov byte [rcx + 0xa9], 0
mov dword [r11 + 0x20], ebp
test eax, eax
jne 0x1400ed224
lea edx, [rbp + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [r11 + 8], rsi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rbx + 0xa0]
lea rsi, [rbx + 0xb0]
lea r9, [rsp + 0xa8]
mov r8d, 0x1000
mov rdx, rdi
mov qword [rbx + 0xc8], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400ed1bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x3e5
jne 0x1400ed165
mov rcx, qword [rbx + 0xa0]
lea r9d, [rbp + 1]
lea r8, [rsp + 0xa8]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1400ed1bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xea
jne 0x1400ed19e
mov rcx, qword [rbx + 0xa0]
lea r8, [rsp + 0xa8]
mov r9d, 1
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1400ed1bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0xea
je 0x1400ed1bc
test edi, edi
je 0x1400ed1bc
cmp edi, 0x6d
je 0x1400ed240
cmp edi, 0xe9
jne 0x1400ed247
jmp 0x1400ed240
mov rcx, qword [rbx + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0xa0]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x1400ed1fd
mov byte [rbx + 0xa9], 1
jmp 0x1400ed20d
cmp dword [rsp + 0xa0], ebp
sete al
mov byte [rbx + 0xa9], al
mov eax, dword [rsp + 0xa8]
mov rsi, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x30]
call fcn.1400ec420
lea rdx, [0x14040d638]
lea rcx, [rsp + 0x30]
call fcn.1402bece8
int3
mov byte [rbx + 0xa8], bpl
mov rcx, qword [rbx + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [0x140346ce0]
lea rdx, [0x14040d6c8]
mov qword [rsp + 0x50], rax
lea rax, vtable.Core::NamedPipeException.0
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x48], rax
call fcn.1402bece8
int3
Function at 0x1400ef960
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x40
lea r8, [rcx + 0xe8]
lea rdx, str.PrivateCloud
mov rsi, rcx
mov byte [rcx + 0xe0], 0
call fcn.1400f03c0
test al, al
je 0x1400efa14
xor ecx, ecx
mov qword [rsp + 0x30], rdi
call fcn.1400f1cf0
mov rdi, rax
test rax, rax
je 0x1400efa0f
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.UsePrivateCloud
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
mov rbx, qword [rsp + 0x38]
jne 0x1400efa02
cmp dword [rsp + 0x50], 0
setne al
mov byte [rsi + 0xe0], al
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rdi, qword [rsp + 0x30]
add rsp, 0x40
pop rsi
ret

Function at 0x1400efb40
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [0x140429a18]
movzx edi, dl
mov rsi, rcx
test al, 1
jne 0x1400efb8d
or eax, 1
lea rcx, [0x1402fedc0]
mov qword [0x1404299f8], 0xffffffff80000002
mov dword [0x140429a18], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x1404299f0], rax
call fcn.1402b8a74
lea rdx, [0x14034ce18]
lea rcx, [0x1404299f0]
call fcn.1400ea630
mov rbx, rax
test rax, rax
je 0x1400efc02
lea rdx, str.UsePrivateCloud
test dil, dil
je 0x1400efbe3
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x48]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400efbf5
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x40]
mov byte [rsi + 0xe0], dil
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret