joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002890
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140046100]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400460e0]
test rbx, rbx
je 0x1400028e4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x1400028db
test r12, r12
je 0x1400028db
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400028c0
lea rcx, [0x140046100]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002b10
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x140002b20
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x140002b30
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140002b75
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x140002b6c
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x140002b77
add rax, 0x28
cmp rax, r9
jne 0x140002b58
xor eax, eax
ret

Function at 0x140002c20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x140042fe0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x140002c99
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x140002c99
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x140002c96
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x140002c8d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x140002c99
add r8, 0x28
cmp r8, r9
jne 0x140002c78
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x140002d80
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140042fe0]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x140002def
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x140002def
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x140002ded
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002de4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002df8
add rax, 0x28
cmp rax, r9
jne 0x140002dd0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x140002e10
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x140042fe0]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x140002e88
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x140002e88
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x140002e88
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140002e88
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x140002e7c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x140002e90
add rdx, 0x28
cmp rdx, r10
jne 0x140002e68
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x140002ea0
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x140002eae
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002e85
test r8d, r8d
jg 0x140002e98
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x1800029d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1804a3780]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180002aa3
cmp byte [rcx + 0x71], 0
je 0x180002aa3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180002a9f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180002a64
sub eax, 1
je 0x180002a68
cmp eax, 2
jne 0x180002a9f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000e740
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180002a96
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180002a9f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180002a4c
xor al, al
jmp 0x180002a4c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000e740
add rsp, 0x60
pop rbx
ret

Function at 0x180003560
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xe0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x74], xmm0
mov dword [r11 - 0x14], eax
mov ebx, r8d
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [r11 - 0x78]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov rdx, rcx
movups xmmword [r11 - 0x64], xmm0
xor ecx, ecx
mov dword [rsp + 0x20], eax
movups xmmword [r11 - 0x54], xmm0
movups xmmword [r11 - 0x44], xmm0
movups xmmword [r11 - 0x34], xmm0
movups xmmword [r11 - 0x24], xmm0
mov dword [rsp + 0x70], 0x68
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180003620
test ebx, ebx
je 0x1800035f7
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x108]
add rsp, 0xe0
pop rbx
ret
Function at 0x180003b90
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x40
mov r15d, r8d
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x180003bbb
cmp r8d, 1
jne 0x180003bbb
mov eax, 0x32
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
mov qword [rsp + 0x60], rbx
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], r14
inc rcx
cmp byte [rdx + rcx], 0
jne 0x180003bd1
inc rcx
call fcn.18000e5c0
mov r8, rax
mov rbp, rax
sub r8, rdi
mov rdx, rdi
nop
movzx ecx, byte [rdx]
mov byte [r8 + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x180003bf0
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
lea rdx, str..tmp
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathAddExtensionA]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x180003dee
mov edx, ebx
lea rax, str.pl_aux
nop dword [rax]
movzx ecx, byte [rsi + rdx]
inc rdx
cmp cl, byte [rax + rdx - 1]
jne 0x180003ca9
cmp rdx, 7
jne 0x180003c60
mov r8d, dword [0x180184780]
lea rax, [0x180011a50]
mov qword [rsp + 0x30], rbp
lea rdx, section..data
mov qword [rsp + 0x28], rdi
mov r9d, r15d
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.180003e20
mov ebx, eax
jmp 0x180003df2
mov rcx, rbx
lea rdx, str.tl_aux
movzx eax, byte [rsi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x180003cfc
cmp rcx, 7
jne 0x180003cb3
mov r8d, dword [0x180184784]
lea rax, [0x180011a60]
mov qword [rsp + 0x30], rbp
lea rdx, [0x180184790]
mov qword [rsp + 0x28], rdi
mov r9d, r15d
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.180003e20
mov ebx, eax
jmp 0x180003df2
lea rcx, str.dl_aux
movzx eax, byte [rsi + rbx]
inc rbx
cmp al, byte [rcx + rbx - 1]
jne 0x180003d4c
cmp rbx, 7
jne 0x180003d03
mov r8d, dword [0x180184788]
lea rax, [0x180011a70]
mov qword [rsp + 0x30], rbp
lea rdx, [0x180352d10]
mov qword [rsp + 0x28], rdi
mov r9d, r15d
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.180003e20
mov ebx, eax
jmp 0x180003df2
lea rdx, str.dummy_bin
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x180003d92
mov r8d, dword [0x18018478c]
lea rax, [0x180011a88]
mov qword [rsp + 0x30], rbp
lea rdx, [0x180485be0]
mov qword [rsp + 0x28], rdi
mov r9d, r15d
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.180003e20
mov ebx, eax
jmp 0x180003df2
lea rdx, str.blscr_bin
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov rcx, r14
test eax, eax
jne 0x180003dd8
mov r8d, dword [0x1804a3760]
lea rax, [0x180011aa8]
mov qword [rsp + 0x30], rbp
lea rdx, str.MSCF
mov qword [rsp + 0x28], rdi
mov r9d, r15d
mov qword [rsp + 0x20], rax
call fcn.180003e20
mov ebx, eax
jmp 0x180003df2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, 0x57
jmp 0x180003df2
mov ebx, dword [rsp + 0x68]
mov rcx, rbp
call fcn.18000e5b8
mov r14, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
Function at 0x180003e20
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x80
mov ebx, r9d
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
xor r15d, r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x180003f1e
mov rbx, qword [rsp + 0xd0]
mov rdx, rbx
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rax, [rsp + 0x38]
mov qword [rsp + 0xa8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rbx + r8], r15b
jne 0x180003ea5
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.180001460
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
nop
inc rdi
cmp byte [rbx + rdi], 0
jne case.default.0x180003f3f
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.180001460
nop
mov r8d, 0x8000000
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.180006500
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rsi
mov rdi, rbp
xor eax, eax
rep stosb byte [rdi], al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
in al, 0x4b
outsd dx, dword [rsi]
pushfq
push rbx
mov r12b, 0xb8
loop 0x180026cd2
out dx, eax
pop rsp
loope 0x180026ce3
jno 0x180026c8c
mov edx, 0x7a376144
invalid
invalid
invalid
jp 0x180026c5f
out 0x13, eax
idiv r12b
idiv ah
lea r12, [r9]
push rbp
retf
mov dh, 0x10
ret
xchg ebp, eax
xor r13b, byte [rsi + 0x18]
invalid
Function at 0x1800043f0
Capabilities:
Download url
Receive data

Disassembly:
sub rsp, 0x38
mov r8, rdx
mov qword [rsp + 0x20], 0
mov rdx, rcx
xor r9d, r9d
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
add rsp, 0x38
ret

Function at 0x180004420
Capabilities:
Open clipboard

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x18000443c
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x180004b90
Capabilities:
Lock the desktop
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
mov dword [rsp + 0x58], 0
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x60], 4
lea r8, [rsp + 0x68]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x180004bf0
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180004c27
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r8, str.DisableLockWorkstation
lea rax, [rsp + 0x58]
mov r9d, 0x10
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x58], 0
jne case.default.0x180004c4c
call qword [sym.imp.USER32.dll_LockWorkStation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x180004c7a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.LWS_FAIL
call fcn.1800011d0
mov rcx, rax
lea rdx, [0x180001930]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3f0
call qword [sym.imp.KERNEL32.dll_SetLastError]
add rsp, 0x40
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x1800054b0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x180005593
lea rax, [rsp + 0x60]
xor edx, edx
lea r9, [0x180012710]
mov qword [rsp + 0x20], rax
mov r8d, 1
lea rcx, [0x180012720]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x180005593
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [0x1800126f0]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x180005593
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x30]
lea rdx, [0x180012700]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x180005593
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov rdx, qword [rbx + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x68]
test eax, eax
js 0x180005593
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
js 0x180005593
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x50]
mov edx, 0xffffffff
mov rax, qword [rcx]
call qword [rax + 0x48]
jmp 0x180005597
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [rsp + 0x50]
add rsp, 0x40
pop rbx
ret

Function at 0x1800055d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, rdx
mov rdi, rcx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r14b
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1800056c6
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
je 0x1800056bd
lea ecx, [rsi + 1]
call fcn.18000e5c0
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x80]
mov r8d, esi
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800056b5
cmp dword [rsp + 0x80], esi
jne 0x1800056b5
mov byte [rsi + rbx], r14b
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1800056a0
mov rdx, rbx
mov rcx, rdi
call fcn.180002ba0
mov rcx, rbx
call fcn.18000e5b8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1800056e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rbp, r9
mov rdi, r8
mov rsi, rdx
cmp ecx, 1
jne 0x180005791
lea r8, [rsp + 0x50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x180005758
xor ebx, ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rbx
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov rdx, rsi
mov dword [rsp + 0x28], 0x20006
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x18000577b
mov rcx, qword [rsp + 0x50]
mov r9d, 1
mov dword [rsp + 0x28], 0x14
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180005822
test ecx, ecx
jne 0x18000581e
xor ebx, ebx
mov dword [rsp + 0x50], 4
lea r8, [rsp + 0x58]
mov dword [rsp + 0x70], ebx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1800057e4
lea rax, [rsp + 0x58]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180005813
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov r9d, 0x10
lea rax, [rsp + 0x70]
mov r8, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x70]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180006940
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1804a3780]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x18000696d
xor eax, eax
jmp 0x180006ad6
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x1800069ad
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x1800069ad
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x180006ace
cmp qword [rdi + 0x80], 0
je 0x180006ac9
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x1800069e7
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x180006a12
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x180006ace
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180006a81
sub eax, 1
je 0x180006a81
cmp eax, 2
jne 0x180006ac9
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x180006ace
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x180006aaf
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x180006ac9
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x180006ace
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18000e740
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180007bc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x180007bf1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x180007c08
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x180007c59
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x180007cd1
mov rcx, rbp
call fcn.180002ae0
cmp rbx, 0xfff
jbe 0x180007cb1
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x180007cf2
cmp rbx, rax
ja 0x180007c80
test rdi, rdi
je 0x180007cd1
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x180007cd4
sahf
and byte [rsi - 0x7d7156d0], al
sbb dword [rbp + 0x58], ecx
and al, 0x11
push rbp
push rdx
mov esp, 0x80656fbb