joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400143e8
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
xor r14d, r14d
mov qword [rbp + 0x17], rdx
mov dword [rsp + 0x50], r14d
lea r9, [rbp - 9]
mov qword [rsp + 0x48], r14
lea r8, [rbp + 7]
mov dword [rsp + 0x40], 0x60
xorps xmm0, xmm0
lea ebx, [r14 + 1]
mov qword [rbp + 0x77], r14
mov dword [rsp + 0x38], ebx
mov rsi, rcx
mov dword [rsp + 0x30], ebx
lea rcx, [rbp + 0x77]
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov qword [rsp + 0x20], r14
mov edi, r14d
mov qword [rbp + 0x7f], r14
mov qword [rbp + 0x6f], r14
movups xmmword [rbp - 9], xmm0
mov dword [rbp + 7], 0x30
mov qword [rbp + 0xf], r14
mov dword [rbp + 0x1f], 0x240
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
js 0x140014578
mov dword [rsp + 0x50], r14d
lea r9, [rbp - 9]
mov qword [rsp + 0x48], r14
lea r8, [rbp + 7]
mov dword [rsp + 0x40], 0x60
lea rcx, [rbp + 0x7f]
mov dword [rsp + 0x38], 3
xorps xmm0, xmm0
mov dword [rsp + 0x30], ebx
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r14
mov dword [rbp + 7], 0x30
mov qword [rbp + 0xf], r14
mov dword [rbp + 0x1f], 0x240
mov qword [rbp + 0x17], rsi
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
js 0x140014578
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
je 0x140014578
mov rcx, qword [rbp + 0x77]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x1000
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, 0xc0000011
je 0x14001457b
mov rsi, qword [rbp - 1]
lea rax, [rbp + 0x6f]
mov rcx, qword [rbp + 0x7f]
xor r9d, r9d
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov dword [rsp + 0x30], esi
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
test eax, eax
js 0x140014578
mov eax, esi
add qword [rbp + 0x6f], rax
jmp 0x1400144f9
mov bl, r14b
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14001458a
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140014599
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test rdi, rdi
je 0x1400145a9
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, bl
add rsp, 0xa0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400147cc
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14001491c
and qword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
lea esi, [rdx + 0xb]
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140014921
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
je 0x14001491c
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rax
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
xor edx, edx
mov esi, eax
test eax, eax
jns 0x140014863
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
jmp 0x140014921
mov r9d, dword [rdi]
mov esi, 0xc0000001
test r9d, r9d
je 0x140014915
lea rcx, [rdi + 0x20]
mov r8, qword [rcx - 8]
cmp rbp, r8
jbe 0x14001488b
mov eax, dword [rcx]
add rax, r8
cmp rbp, rax
jb 0x14001489b
inc edx
add rcx, 0x128
cmp edx, r9d
jae 0x140014915
jmp 0x140014878
mov eax, edx
imul rcx, rax, 0x128
lea rax, [rdi + 8]
add rax, rcx
mov ecx, 2
lea edx, [rcx + 0x7e]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rbx + 0x60], xmm0
add rbx, rdx
movups xmm1, xmmword [rax + 0x70]
add rax, rdx
movups xmmword [rbx - 0x10], xmm1
sub rcx, 1
jne 0x1400148b3
movups xmm0, xmmword [rax]
xor esi, esi
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov rax, qword [rax + 0x20]
mov qword [rbx + 0x20], rax
xor edx, edx
jmp 0x140014853
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x403db0
Capabilities:
Delete registry value

Disassembly:
push r12
push rbx
sub rsp, 0x28
movzx eax, word [rdx + 2]
mov rbx, rcx
lea r12, [rdx + 2]
cmp ax, 9
je 0x403dd0
cmp ax, 0x20
jne 0x403de6
nop
movzx eax, word [r12 + 2]
add r12, 2
cmp ax, 0x20
je 0x403dd0
cmp ax, 9
je 0x403dd0
test ax, ax
je 0x403e08
cmp ax, 0x3b
je 0x403e08
mov rax, r12
mov dword [rbx + 0x48], 2
add rsp, 0x28
pop rbx
pop r12
ret
mov rdx, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.advapi32.dll_RegDeleteValueW]
jmp 0x403df1

Function at 0x404000
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
je 0x4041b8
cmp qword [0x0040d070], 0
je 0x404170
mov r13, qword [0x0040d060]
test r13, r13
je 0x4041b8
mov rdi, qword [sym.imp.ucrtbase.dll_wcspbrk]
mov r12, qword [sym.imp.ucrtbase.dll_memmove]
mov rbp, qword [sym.imp.ucrtbase.dll_fread]
lea rdx, [0x004092b2]
mov rcx, r13
call rdi
test rax, rax
jne 0x4041c4
mov rdx, qword [0x0040d060]
cmp word [rdx], 0
je 0x4041a8
mov rax, rdx
nop word cs:[rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x404080
sub rax, rdx
sar rax, 1
movsxd rbx, eax
lea r8, [rbx + rbx + 2]
lea r13, [rbx + rbx]
mov rcx, qword [0x0040d068]
call r12
mov rdx, qword [0x0040d070]
mov rcx, rax
mov rax, rdx
sub rax, rbx
cmp rax, 2
jbe 0x404148
mov rax, rbx
add rcx, r13
mov r9, rsi
not rax
lea r8, [rax + rdx]
mov edx, 2
call rbp
test rax, rax
jne 0x404100
mov qword [0x0040d060], 0
mov r13, qword [0x0040d068]
mov rax, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r13, qword [0x0040d068]
add rax, rbx
xor ecx, ecx
mov word [r13 + rax*2], cx
mov qword [0x0040d060], r13
test r13, r13
jne 0x40404d
nop word [rax + rax]
mov rcx, r13
xor r13d, r13d
call qword [sym.imp.ucrtbase.dll_free]
mov qword [0x0040d070], 0
jmp 0x4040ee
lea r14, [rdx + rdx]
shl rdx, 2
mov qword [0x0040d070], r14
call qword [sym.imp.ucrtbase.dll_realloc]
mov rdx, r14
mov qword [0x0040d068], rax
mov rcx, rax
jmp 0x4040c0
mov qword [0x0040d070], 0x1000
mov ecx, 0x2000
call qword [sym.imp.ucrtbase.dll_malloc]
xor r8d, r8d
mov qword [0x0040d068], rax
mov r13, rax
mov word [rax], r8w
mov qword [0x0040d060], rax
jmp 0x404038
xor ebx, ebx
xor r13d, r13d
mov r8d, 2
jmp 0x40409c
mov r13, qword [0x0040d068]
jmp 0x404128
lea rdx, [rax + 2]
cmp word [rax], 0xd
mov qword [0x0040d060], rdx
je 0x4041df
xor edx, edx
mov word [rax], dx
jmp 0x4040ee
cmp word [rax + 2], 0xa
jne 0x4041d5
lea rdx, [rax + 4]
mov qword [0x0040d060], rdx
jmp 0x4041d5
Function at 0x404440
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r14, qword [sym.imp.ucrtbase.dll_free]
mov rsi, rcx
mov rcx, qword [0x0040d090]
call r14
test rsi, rsi
je 0x4045f0
cmp qword [0x0040d088], 0
je 0x4045b8
mov r12, qword [0x0040d078]
test r12, r12
je 0x4045f0
mov rdi, qword [sym.imp.ucrtbase.dll_strpbrk]
mov r13, qword [sym.imp.ucrtbase.dll_strlen]
mov rbp, qword [sym.imp.ucrtbase.dll_memmove]
lea rdx, [0x004092b8]
mov rcx, r12
call rdi
test rax, rax
jne 0x404600
mov rcx, r12
call r13
mov rcx, qword [0x0040d080]
mov rdx, r12
mov rbx, rax
lea r8, [rax + 1]
call rbp
mov r12, qword [0x0040d088]
mov rcx, rax
mov rax, r12
sub rax, rbx
cmp rax, 2
jbe 0x404590
mov rax, rbx
add rcx, rbx
mov r9, rsi
mov edx, 1
not rax
lea r8, [rax + r12]
call qword [sym.imp.ucrtbase.dll_fread]
test rax, rax
jne 0x404540
mov rax, qword [0x0040d080]
mov qword [0x0040d078], 0
test rax, rax
je 0x404525
mov rcx, rax
call sym.GetWideString.part.0
mov qword [0x0040d090], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r12, qword [0x0040d080]
add rbx, r12
mov qword [0x0040d078], r12
mov byte [rbx + rax], 0
test r12, r12
jne 0x40449e
mov qword [0x0040d090], 0
mov rcx, r12
call r14
xor eax, eax
mov qword [0x0040d088], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
add r12, r12
mov qword [0x0040d088], r12
mov rdx, r12
call qword [sym.imp.ucrtbase.dll_realloc]
mov qword [0x0040d080], rax
mov rcx, rax
jmp 0x4044e6
mov qword [0x0040d088], 0x1000
mov ecx, 0x1000
call qword [sym.imp.ucrtbase.dll_malloc]
mov qword [0x0040d080], rax
mov r12, rax
mov byte [rax], 0
mov qword [0x0040d078], rax
jmp 0x404489
mov r12, qword [0x0040d080]
jmp 0x40455e
lea rdx, [rax + 1]
cmp byte [rax], 0xd
mov qword [0x0040d078], rdx
je 0x404630
mov byte [rax], 0
mov rcx, r12
call sym.GetWideString.part.0
mov qword [0x0040d090], rax
jmp 0x40452c
cmp byte [rax + 1], 0xa
jne 0x404610
lea rdx, [rax + 2]
mov qword [0x0040d078], rdx
jmp 0x404610

Function at 0x404750
Capabilities:
Delete registry key

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
mov r12, rdx
je 0x404789
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ucrtbase.dll_free]
mov qword [rbx + 0x20], 0
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov qword [rbx + 0x18], 0
movzx eax, word [r12]
and eax, 0xffffffdf
cmp ax, 0x48
je 0x4047b0
mov rax, r12
mov dword [rbx + 0x48], 2
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
mov rcx, r12
mov edx, 0x5c
call qword [sym.imp.ucrtbase.dll_wcschr]
mov rcx, r12
mov rsi, rax
test rax, rax
je 0x4047f0
call sym.path_get_rootkey
test rax, rax
je 0x404797
cmp word [rsi + 2], 0
je 0x404797
lea rdx, [rsi + 2]
mov rcx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
jmp 0x404797
call sym.path_get_rootkey
jmp 0x404797
Function at 0x404b40
Capabilities:
Set registry value

Disassembly:
push r12
push rbx
sub rsp, 0x38
xor r8d, r8d
mov rbx, rcx
mov r12, rdx
mov rdx, qword [rcx + 0x28]
mov rcx, qword [rcx + 0x18]
mov eax, dword [rbx + 0x40]
mov r9d, dword [rbx + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [rbx + 0x30]
sub eax, 3
cmp eax, 1
jbe 0x404bb0
cmp word [rbx + 0x10], 1
mov eax, 1
mov qword [rbx + 0x38], 0
sbb eax, 0xffffffff
mov dword [rbx + 0x40], 0
mov dword [rbx + 0x48], eax
mov rax, r12
add rsp, 0x38
pop rbx
pop r12
ret
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.ucrtbase.dll_free]
jmp 0x404b7d

Function at 0x405090
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x88
mov rbx, rdx
cmp ecx, 4
jg 0x4050bf
mov dword [rsp + 0x44], 0
jne 0x40511f
mov rcx, qword [rdx + 0x18]
movzx eax, word [rcx]
and eax, 0xfffffffd
cmp ax, 0x2d
je 0x4050f8
mov ecx, 0x69
call sym.output_message
mov rcx, qword [rbx + 8]
call qword [sym.imp.ucrtbase.dll__wcsupr]
mov ecx, 0x6a
mov rdx, rax
call sym.output_message
mov eax, 1
add rsp, 0x88
pop rbx
pop rsi
pop r12
pop r13
ret
lea r12, [rcx + 2]
mov rsi, qword [sym.imp.kernel32.dll_lstrcmpiW]
lea rdx, str.reg:32
mov rcx, r12
call rsi
test eax, eax
jne 0x4052c0
mov dword [rsp + 0x44], 0x200
mov r13, qword [rbx + 0x10]
lea rdx, [0x00409328]
mov rcx, r13
call qword [sym.imp.ucrtbase.dll__wfopen]
mov r12, rax
test rax, rax
je 0x4052a0
lea rcx, [rsp + 0x2e]
mov r9, rax
mov r8d, 1
mov edx, 2
call qword [sym.imp.ucrtbase.dll_fread]
cmp rax, 1
jne 0x405280
movzx eax, byte [rsp + 0x2e]
movzx edx, byte [rsp + 0x2f]
xor r8d, r8d
lea rcx, [sym.get_lineA]
cmp al, 0xff
jne 0x40518f
xor r8d, r8d
lea r9, [sym.get_lineW]
cmp dl, 0xfe
cmove rcx, r9
sete r8b
shl edx, 0x10
pxor xmm0, xmm0
mov dword [rsp + 0x3c], r8d
lea rbx, [rsp + 0x30]
or eax, edx
mov qword [0x0040d098], rcx
lea rdx, [rsp + 0x38]
lea rsi, sym.header_state
mov dword [rsp + 0x38], eax
mov eax, 0xffffffff
mov word [rsp + 0x40], ax
lea rax, [sym.header_state]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x78], 0
movups xmmword [rsp + 0x48], xmm0
jmp 0x405210
mov eax, dword [rsp + 0x78]
mov rax, qword [rsi + rax*8]
mov rcx, rbx
call rax
mov rdx, rax
test rax, rax
jne 0x405208
cmp word [rsp + 0x40], 4
je 0x405280
mov rcx, qword [rsp + 0x58]
mov rbx, qword [sym.imp.ucrtbase.dll_free]
call rbx
cmp qword [rsp + 0x48], 0
je 0x40525f
mov rcx, qword [rsp + 0x50]
call rbx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], 0
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov qword [rsp + 0x48], 0
mov rcx, r12
call qword [sym.imp.ucrtbase.dll_fclose]
xor eax, eax
add rsp, 0x88
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, r12
call qword [sym.imp.ucrtbase.dll_fclose]
mov eax, 1
add rsp, 0x88
pop rbx
pop rsi
pop r12
pop r13
ret
mov rdx, r13
mov ecx, 0x192
call sym.output_message
mov eax, 1
jmp 0x4050e5
lea rdx, [0x0040931a]
mov rcx, r12
call rsi
test eax, eax
jne 0x4050bf
mov dword [rsp + 0x44], 0x100
jmp 0x40511f
Function at 0x4055e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rax, qword [sym.imp.ucrtbase.dll_malloc]
mov r15d, 0x800
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rsi, rdx
mov ecx, 0x800
mov qword [rsp + 0xd0], r8
lea r12, [rsp + 0x64]
lea rbp, [rsp + 0x5c]
mov dword [rsp + 0xd8], r9d
call rax
mov rdi, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov r13, qword [sym.imp.ucrtbase.dll_realloc]
mov r14, rax
jmp 0x405650
mov edx, dword [rsp + 0x5c]
mov rcx, r14
mov r15, rdx
call r13
mov r14, rax
xor r8d, r8d
mov dword [rsp + 0x5c], r15d
mov r9, r12
mov rdx, rsi
mov qword [rsp + 0x28], rbp
mov rcx, rbx
mov qword [rsp + 0x20], r14
call rdi
cmp eax, 0xea
je 0x405640
test eax, eax
je 0x4056f0
mov dword [rsp + 0x4c], eax
mov rbp, qword [sym.imp.ucrtbase.dll_free]
mov rcx, r14
call rbp
mov eax, dword [rsp + 0xd8]
test eax, eax
jne 0x405746
mov eax, dword [rsp + 0x4c]
cmp eax, 2
jne 0x405845
test rsi, rsi
je 0x4056b3
cmp word [rsi], 0
jne 0x405880
mov rdx, qword [rsp + 0xd0]
lea rcx, [0x004094e8]
call sym.output_string
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call sym.output_value
xor eax, eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsp + 0xd0]
lea rcx, [0x004094e8]
call sym.output_string
mov edx, dword [rsp + 0x64]
mov r8, r14
mov rcx, rsi
mov r9d, dword [rsp + 0x5c]
call sym.output_value
lea rcx, [0x004094c2]
call sym.output_string
add dword [0x0040d0a4], 1
mov rbp, qword [sym.imp.ucrtbase.dll_free]
mov rcx, r14
call rbp
mov edx, dword [rsp + 0xd8]
test edx, edx
je 0x405845
mov rax, qword [rsp + 0x40]
mov ecx, 0x202
call rax
mov r12, rax
mov rax, qword [rsp + 0xd0]
cmp word [rax], 0
je 0x405894
mov rdi, rax
nop word [rax + rax]
add rdi, 2
cmp word [rdi], 0
jne 0x405770
sub rdi, qword [rsp + 0xd0]
sar rdi, 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0xc8], rsi
xor r13d, r13d
lea r14, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov r15, qword [rsp + 0xd0]
mov dword [rsp + 0x60], 0x101
mov r9, r14
mov r8, r12
mov edx, r13d
mov qword [rsp + 0x38], 0
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
jne 0x405840
mov r9d, dword [rsp + 0x60]
mov r8, r12
mov edx, edi
mov rcx, r15
call sym.build_subkey_path
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
mov r9d, dword [0x0040d0a0]
mov rsi, rax
mov rax, qword [rsp + 0x40]
or r9d, 0x20019
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x405850
mov rcx, rsi
add r13d, 1
call rbp
jmp 0x4057a7
mov rcx, r12
call rbp
xor eax, eax
jmp 0x4056db
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xc8]
mov r9d, 1
mov r8, rsi
call sym.query_value
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x405829
mov ecx, 0x6f
call sym.output_message
mov eax, 1
jmp 0x4056db
xor edi, edi
jmp 0x405785
Function at 0x406310
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbp, qword [sym.imp.kernel32.dll_GetStdHandle]
mov esi, edx
mov rbx, rcx
lea rdi, [rsp + 0x4c]
mov ecx, 0xfffffff5
call rbp
mov r9, rdi
mov r8d, esi
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov rcx, rax
call qword [sym.imp.kernel32.dll_WriteConsoleW]
test eax, eax
je 0x406370
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [sym.imp.kernel32.dll_GetOEMCP]
call r15
mov r9d, esi
mov r8, rbx
xor edx, edx
mov r14, qword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [rsp + 0x28], 0
mov ecx, eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call r14
mov ecx, eax
mov r13, rcx
call qword [sym.imp.ucrtbase.dll_malloc]
mov r12, rax
call r15
mov r9d, esi
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x38], 0
mov ecx, eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r12
call r14
mov ecx, 0xfffffff5
call rbp
mov r9, rdi
mov r8d, r13d
mov rdx, r12
mov qword [rsp + 0x20], 0
mov rcx, rax
call qword [sym.imp.kernel32.dll_WriteFile]
mov rcx, r12
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.ucrtbase.dll_free]

Function at 0x406f40
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
call qword [sym.imp.ucrtbase.dll_strlen]
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x406f93
cmp byte [r12 + rbx - 1], 0xa
je 0x406f6e
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
xchg dword [0x0040d1e4], eax
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov edx, 1
mov r9, rax
mov r8, rbx
mov rcx, r12
call qword [sym.imp.ucrtbase.dll_fwrite]
add rsp, 0x28
pop rbx
pop r12
ret
Function at 0x4074a0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x110
cmp qword [0x0040d200], 0
mov ebx, ecx
mov rsi, rdx
mov rdi, r8
je 0x407710
mov rcx, rsi
call qword [0x0040d200]
movzx eax, al
bt eax, ebx
jae 0x4077a8
mov ecx, dword [0x0040d1e4]
xor eax, eax
mov rdx, qword gs:[0x30]
cmp dword [rdx + 0x48], ecx
je 0x407572
test byte [0x00408070], 8
jne 0x407678
test byte [0x00408080], 8
jne 0x4075c0
lea r12, [rsp + 0x40]
mov rbp, r12
test byte [0x00408090], 8
jne 0x407628
mov rax, qword gs:[0x30]
mov r8d, dword [rax + 0x48]
lea rdx, str._04x:
mov rcx, rbp
call sym.sprintf
test rdi, rdi
je 0x407547
cmp ebx, 3
jbe 0x407580
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov rcx, r12
mov rbx, rax
call qword [sym.imp.ucrtbase.dll_strlen]
mov r9, rbx
mov edx, 1
mov rcx, r12
mov r8, rax
call qword [sym.imp.ucrtbase.dll_fwrite]
add rsp, 0x110
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cdqe
add rsi, 1
mov qword [rsp + 0x28], rdi
lea r8, str._s:_s:_s
lea rcx, [rbp + rax]
mov rax, r12
mov qword [rsp + 0x20], rsi
sub rax, rcx
lea rdx, [rax + 0xc8]
lea rax, str.fixme
mov r9, qword [rax + rbx*8]
call sym.snprintf.constprop.0
jmp 0x407547
cmp qword [0x0040d200], 0
je 0x407730
lea rcx, [0x00408080]
call qword [0x0040d200]
test al, 8
je 0x40750c
call qword [sym.imp.kernel32.dll_GetTickCount]
lea r12, [rsp + 0x40]
lea rdx, str._3u._03u:
mov r8d, eax
mov rcx, r12
mov r9, r8
imul r8, r8, 0x10624dd3
shr r8, 0x26
imul eax, r8d, 0x3e8
sub r9d, eax
call sym.sprintf
movsxd rbp, eax
add rbp, r12
jmp 0x407514
cmp qword [0x0040d200], 0
je 0x407750
lea rcx, [0x00408090]
call qword [0x0040d200]
test al, 8
je 0x407521
mov rax, qword gs:[0x30]
mov r8d, dword [rax + 0x40]
mov rcx, rbp
lea rdx, str._04x:
call sym.sprintf
cdqe
add rbp, rax
jmp 0x407521
cmp qword [0x0040d200], 0
je 0x407770
lea rcx, [0x00408070]
call qword [0x0040d200]
test al, 8
je 0x4074ff
cmp qword [0x0040d0c0], 0
je 0x407790
lea rcx, [rsp + 0x38]
lea r12, [rsp + 0x40]
call qword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov rcx, r12
imul rax, qword [rsp + 0x38], 0xf4240
cqo
idiv qword [0x0040d0c0]
movabs rdx, 0x431bde82d7b634db
mov r9, rax
imul rdx
mov rax, r9
sar rax, 0x3f
sar rdx, 0x12
mov r8, rdx
lea rdx, str._3u._06u:
sub r8, rax
imul rax, r8, 0xf4240
sub r9d, eax
call sym.sprintf
movsxd rbp, eax
add rbp, r12
jmp 0x407514
lea r8, [sym.fallback__wine_dbg_get_channel_flags]
lea rdx, str.__wine_dbg_get_channel_flags
lea rcx, [0x0040d200]
call sym.load_func.part.0
jmp 0x4074c3
lea r8, [sym.fallback__wine_dbg_get_channel_flags]
lea rdx, str.__wine_dbg_get_channel_flags
lea rcx, [0x0040d200]
call sym.load_func.part.0
jmp 0x4075ce
lea r8, [sym.fallback__wine_dbg_get_channel_flags]
lea rdx, str.__wine_dbg_get_channel_flags
lea rcx, [0x0040d200]
call sym.load_func.part.0
jmp 0x407636
lea r8, [sym.fallback__wine_dbg_get_channel_flags]
lea rdx, str.__wine_dbg_get_channel_flags
lea rcx, [0x0040d200]
call sym.load_func.part.0
jmp 0x407686
lea rcx, [0x0040d0c0]
call qword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
jmp 0x4076a9
mov eax, 0xffffffff
jmp 0x407572
Function at 0x407ba0
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov ecx, 1
call sym._configure_wide_argv
call sym._initialize_wide_environment
call sym.__p___argc
mov r12d, dword [rax]
call sym.__p___wargv
mov r13, qword [rax]
call sym._get_initial_wide_environment
xor ecx, ecx
mov rbx, rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x10]
mov edx, dword [rax + 0x3c]
cmp word [rax + rdx + 0x5c], 2
sete cl
add ecx, 1
call sym._set_app_type
mov ecx, r12d
mov r8, rbx
mov rdx, r13
call sym.wmain
mov ecx, eax
call sym.exit
nop
nop
nop
nop