joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024d0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x40], r12
lea r12, [0x00408110]
mov rax, r12
xor ebx, ebx
nop
nop
cmp ecx, dword [rax]
je 0x4024ff
inc ebx
add rax, 0x10
cmp ebx, 0x13
jb 0x4024f0
cmp ebx, 0x13
je 0x4026e9
mov eax, dword [0x00408990]
mov qword [rsp + 0x68], rdi
cmp eax, 1
je 0x40269e
test eax, eax
jne 0x40252d
cmp dword [0x00408108], 1
je 0x40269e
cmp ecx, 0xfc
je 0x4026e4
mov qword [rsp + 0x58], rbp
lea rbp, [0x00408a10]
mov qword [rsp + 0x60], rsi
lea rsi, [0x00400000]
lea rdx, [0x00408a2a]
mov r8d, 0x104
mov rax, qword [rsi + 0x16a8]
xor ecx, ecx
mov qword [rbp], rax
mov rax, qword [rsi + 0x16b0]
mov qword [rbp + 8], rax
mov rax, qword [rsi + 0x16b8]
mov qword [rbp + 0x10], rax
movzx eax, word [rsi + 0x16c0]
mov word [rbp + 0x18], ax
mov byte [0x00408b2e], 0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4025e0
mov rax, qword [rsi + 0x1690]
mov qword [rsi + 0x8a2a], rax
mov rax, qword [rsi + 0x1698]
mov qword [rsi + 0x8a32], rax
mov eax, dword [rsi + 0x16a0]
mov dword [rsi + 0x8a3a], eax
movzx eax, word [rsi + 0x16a4]
mov word [rsi + 0x8a3e], ax
movzx eax, byte [rsi + 0x16a6]
mov byte [rsi + 0x8a40], al
mov rsi, qword [rsp + 0x60]
xor eax, eax
lea rdi, [0x00408a2a]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x402615
lea rcx, [rcx + rbp - 0x22]
lea r8d, [rax + 3]
lea rdx, [0x0040168c]
call fcn.00403b70
xor eax, eax
mov rdi, rbp
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x00401688]
movsxd rdx, ebx
mov word [rdi - 1], ax
movzx eax, byte [0x0040168a]
add rdx, rdx
mov r8, qword [r12 + rdx*8 + 8]
mov byte [rdi + 1], al
xor eax, eax
mov rdi, rbp
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor edx, edx
nop
nop
nop
nop
movzx eax, byte [r8 + rdx]
inc rdx
test al, al
mov byte [rdi + rdx - 2], al
jne 0x402660
lea rdx, [0x00401660]
mov r8d, 0x12010
mov rcx, rbp
call fcn.004039c0
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x4026e4
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x30]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [r12 + rcx*8 + 8]
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x4039c0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
xor esi, esi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x50], r12
cmp qword [0x00408e68], rsi
mov ebx, r8d
mov rbp, rdx
mov r12, rcx
jne 0x403aa6
lea rcx, [0x00401738]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x403a96
lea rdx, [0x00401728]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x00408e68], rax
je 0x403a96
lea rdx, [0x00401718]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x00401700]
mov rcx, rdi
mov qword [0x00408e70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x004089a4], 2
mov qword [0x00408e78], rax
jne 0x403a9d
lea rdx, [0x004016e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x00408e88], rax
je 0x403a9d
lea rdx, [0x004016c8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x00408e80], rax
jmp 0x403aad
xor eax, eax
jmp 0x403b37
mov rax, qword [0x00408e80]
jmp 0x403aad
mov rax, qword [0x00408e80]
test rax, rax
je 0x403afb
call rax
test rax, rax
je 0x403ae6
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call qword [0x00408e88]
test eax, eax
je 0x403ae6
test byte [rsp + 0x40], 1
jne 0x403afb
cmp dword [case.0x402ab2.24], 4
jb 0x403af5
bts ebx, 0x15
jmp 0x403b25
bts ebx, 0x12
jmp 0x403b25
mov rax, qword [0x00408e70]
test rax, rax
je 0x403b25
call rax
test rax, rax
mov rsi, rax
je 0x403b25
mov rdx, qword [0x00408e78]
test rdx, rdx
je 0x403b25
mov rcx, rax
call rdx
mov rsi, rax
mov r9d, ebx
mov r8, rbp
mov rdx, r12
mov rcx, rsi
call qword [0x00408e68]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x404d90
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x4a8
mov rax, qword [case.0x402ab2.21]
mov qword [rsp + 0x460], rax
cmp ecx, dword [0x0040a6b0]
mov qword [r11 - 8], rbp
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov r12d, r8d
mov rbp, rdx
jae 0x405036
movsxd rax, ecx
lea r11, [0x0040a6c0]
mov r10b, al
mov r9, rax
sar r9, 5
and r10d, 0x1f
mov rax, qword [r11 + r9*8]
shl r10, 4
mov qword [rsp + 0x40], r9
movzx edx, byte [r10 + rax + 8]
mov qword [rsp + 0x38], r10
test dl, 1
je 0x405036
xor r13d, r13d
test r8d, r8d
mov qword [rsp + 0x498], rsi
mov qword [rsp + 0x478], r14
mov r14d, r13d
mov esi, r13d
jne 0x404e25
xor eax, eax
jmp 0x404fac
test dl, 0x20
je 0x404e46
xor edx, edx
lea r8d, [rdx + 2]
call fcn.00405e90
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
lea r11, [0x0040a6c0]
mov rcx, qword [r11 + r9*8]
mov qword [rsp + 0x490], rdi
mov qword [rsp + 0x470], r15
test byte [r10 + rcx + 8], 0x80
je 0x404f5c
test r12d, r12d
mov rdi, rbp
mov r15d, r13d
je 0x404ffa
mov qword [rsp + 0x4c8], rbx
nop
lea rbx, [rsp + 0x50]
mov rcx, r13
nop
nop
mov eax, edi
sub eax, ebp
cmp eax, r12d
jae 0x404ebf
movzx eax, byte [rdi]
inc rdi
cmp al, 0xa
jne 0x404eae
mov byte [rbx], 0xd
inc rbx
inc esi
inc rcx
inc rcx
mov byte [rbx], al
inc rbx
cmp rcx, 0x400
jl 0x404e90
mov rcx, qword [r11 + r9*8]
lea rax, [rsp + 0x50]
mov r8d, ebx
mov rcx, qword [r10 + rcx]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x50]
sub r8d, eax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404f51
movsxd rax, dword [rsp + 0x30]
lea rcx, [rsp + 0x50]
sub rbx, rcx
add r14d, eax
cmp rax, rbx
jl 0x404f1e
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov eax, edi
sub eax, ebp
lea r11, [0x0040a6c0]
cmp eax, r12d
jb 0x404e80
mov rbx, qword [rsp + 0x4c8]
test r14d, r14d
jne 0x40502b
test r15d, r15d
je 0x404fe9
cmp r15d, 5
jne 0x404f8f
mov dword [0x00408998], 9
mov dword [case.0x402ab2.23], r15d
jmp 0x404f97
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
jmp 0x404f1e
mov rcx, qword [r10 + rcx]
lea r9, [rsp + 0x30]
mov r8d, r12d
mov rdx, rbp
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404f84
mov r14d, dword [rsp + 0x30]
mov r15d, r13d
jmp 0x404f26
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
jmp 0x404f2f
mov ecx, r15d
call fcn.00405c90
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x490]
mov r15, qword [rsp + 0x470]
mov rsi, qword [rsp + 0x498]
mov r14, qword [rsp + 0x478]
mov r13, qword [rsp + 0x480]
mov r12, qword [rsp + 0x488]
mov rbp, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x460]
call fcn.00406a50
add rsp, 0x4a8
ret
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
lea r11, [0x0040a6c0]
mov rax, qword [r11 + r9*8]
test byte [r10 + rax + 8], 0x40
je 0x405010
cmp byte [rbp], 0x1a
jne 0x405010
xor eax, eax
jmp 0x404f9c
mov dword [0x00408998], 0x1c
mov dword [case.0x402ab2.23], r13d
mov eax, 0xffffffff
jmp 0x404f9c
sub r14d, esi
mov eax, r14d
jmp 0x404f9c
xor r13d, r13d
mov dword [0x00408998], 9
lea eax, [r13 - 1]
mov dword [case.0x402ab2.23], r13d
jmp 0x404fbc
Function at 0x406020
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [case.0x402ab2.21]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x406063
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
call fcn.00406a50
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.00406690
mov rcx, qword [rsp + 0x28]
call fcn.00406a50
add rsp, 0x38
ret

Function at 0x4063a0
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x20]
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xa8], rsi
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x78], r15
mov rax, qword [case.0x402ab2.21]
mov qword [rbp + 0x68], rax
mov eax, dword [rsp]
sub rsp, 0x10
lea rdx, [rbp + 8]
mov eax, dword [rsp + 0x20]
lea r12, [rsp + 0x20]
mov r8d, 0x30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4064fe
mov r14, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x004089a4]
mov edi, dword [rbp + 0x3c]
xor ebx, ebx
cmp ecx, 2
jne 0x406474
lea rcx, [0x00401760]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x40646e
lea rdx, [0x00401748]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40646e
lea rcx, [rbp]
mov dword [rbp], ebx
call rax
cmp eax, 1
jne 0x40646e
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
mov ecx, dword [0x004089a4]
mov r15d, 1
lea r8d, [rdi - 1]
lea edx, [rbx + rdi - 1]
cmp ecx, r15d
mov eax, r8d
mov esi, 0x104
not eax
cmove esi, r15d
and edx, eax
je 0x406499
add edx, edi
lea eax, [rdi + rdi*2]
mov ebx, r8d
cmp edx, eax
not rbx
cmovb edx, eax
and rbx, r12
mov eax, 0x11
mov r13d, edx
sub rbx, r13
cmp ecx, r15d
cmove edi, eax
mov eax, edi
add rax, r14
cmp rbx, rax
jb 0x4064fe
mov r9d, 4
mov r8d, 0x1000
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x4064fe
lea r9, [rbp + 4]
mov r8d, esi
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4064fe
mov eax, r15d
jmp 0x406500
xor eax, eax
mov rcx, qword [rbp + 0x68]
call fcn.00406a50
mov rbx, qword [rbp + 0xa0]
mov rsi, qword [rbp + 0xa8]
mov rdi, qword [rbp + 0xb0]
mov r12, qword [rbp + 0xb8]
mov r13, qword [rbp + 0x88]
mov r14, qword [rbp + 0x80]
mov r15, qword [rbp + 0x78]
lea rsp, [rbp + 0x90]
pop rbp
ret
Function at 0x4068c0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rsi, [0x00408f70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [0x00409068]
lea rdx, [rsp + 0x70]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x406941
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x00409068]
jmp 0x40695d
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x00409068], r11
mov qword [0x00409008], rax
mov rax, qword [case.0x402ab2.21]
mov qword [0x00408ee0], r11
mov qword [0x00408ff0], rdi
mov dword [0x00408ed0], 0xc0000409
mov dword [0x00408ed4], 1
mov qword [rsp + 0x50], rax
mov rax, qword [0x00408970]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00401c78]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
cmp rcx, qword [case.0x402ab2.21]
jne 0x406a69
rol rcx, 0x10
test cx, 0xffff
jne 0x406a65
ret
ror rcx, 0x10
jmp 0x4068c0
Function at 0x180001ca0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
mov r8, rcx
movabs rax, 0x230be272a0831286
cmp rcx, rdx
je 0x180001cf2
movabs r10, 0x283327ba71823
nop
mov edx, dword [r8]
mov ecx, 0x78dc555d
add edx, eax
add r8, 4
xor edx, eax
ror edx, 0x10
sub ecx, edx
xor rcx, 0x2302374
mov rax, rcx
shl rcx, 8
shr rax, 0x18
or rax, rcx
add rax, r10
cmp r8, r9
jne 0x180001cc0
add eax, 0x6544be
xor eax, 0xdeeeef3a
ret
Function at 0x180011130
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180011160
xor eax, eax
jmp 0x180011223
mov rbp, rbx
cmp word [rax], si
je 0x180011185
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18001116c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180011168
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180011050
movsxd r14, eax
test eax, eax
jne 0x1800111c3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180011159
mov rcx, r14
call fcn.18000c5dc
mov rdi, rax
test rax, rax
jne 0x1800111dc
xor ecx, ecx
call fcn.18000c5a0
jmp 0x1800111b8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180011050
test eax, eax
jne 0x18001120d
mov rcx, rdi
call fcn.18000c5a0
jmp 0x180011217
xor ecx, ecx
call fcn.18000c5a0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180014d98
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x180014dae
mov al, 1
jmp 0x180014e0e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x180014dbf
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180014e0c
mov ecx, dword [rcx + 0x18]
nop
call fcn.180012ef4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180014e0c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180014e0c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180014e0c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x180014e0e
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x180017940
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180017968
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180017968
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400040bc
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x1c0
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x1c0], rbx
mov qword [rbp + 0x1c8], rsi
mov qword [rbp + 0x1d0], rdi
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x190], rax
mov eax, dword [0x140016c80]
mov r15d, 1
test r15b, al
jne 0x140004141
or eax, r15d
lea rcx, [rbp + 0x70]
mov ebx, 0x114
mov dword [0x140016c80], eax
mov r8d, ebx
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [rbp + 0x70]
mov dword [rbp + 0x70], ebx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetVersionExW]
mov eax, dword [rbp + 0x80]
mov dword [0x1400169dc], eax
mov dword [0x140016c84], r15d
mov eax, dword [rsp]
sub rsp, 0x10
lea rsi, [rsp + 0x20]
mov eax, dword [rsi]
mov r8d, 0x30
lea rdx, [rbp + 8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_VirtualQuery]
test rax, rax
jne 0x14000416e
xor eax, eax
jmp 0x140004238
mov rbx, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetSystemInfo]
mov eax, dword [rbp + 0x3c]
mov ecx, 0x11000
mov r14d, eax
lea edi, [rax - 1]
not rdi
and rdi, rsi
mov esi, 0x2000
sub rdi, rax
mov eax, dword [0x1400169dc]
cmp eax, r15d
cmove esi, ecx
add rsi, rbx
cmp rdi, rsi
jb 0x140004167
cmp eax, r15d
je 0x140004218
mov r8d, 0x30
lea rdx, [rbp + 8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_VirtualQuery]
test rax, rax
je 0x140004167
add rbx, qword [rbp + 0x20]
test dword [rbp + 0x28], 0x1000
je 0x1400041b1
test dword [rbp + 0x2c], 0x100
mov rbx, qword [rbp + 8]
je 0x1400041e8
mov eax, r15d
jmp 0x140004238
cmp rdi, rbx
jb 0x140004167
cmp rbx, rsi
mov r9d, 4
mov r8d, 0x1000
mov rdx, r14
cmovb rbx, rsi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_VirtualAlloc]
mov eax, dword [0x1400169dc]
jmp 0x14000421b
mov rbx, rdi
cmp eax, r15d
lea r9, [rbp]
mov r8d, 0x104
mov rdx, r14
cmove r8d, r15d
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_VirtualProtect]
mov rcx, qword [rbp + 0x190]
xor rcx, rbp
call fcn.14000d6c0
mov rbx, qword [rbp + 0x1c0]
mov rsi, qword [rbp + 0x1c8]
mov rdi, qword [rbp + 0x1d0]
lea rsp, [rbp + 0x1a0]
pop r15
pop r14
pop rbp
ret
Function at 0x1400042e8
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rdx
mov rdi, rcx
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400043f3
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000436e
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
test ebx, ebx
jne 0x1400043f3
jmp 0x140004397
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.1400042e8
mov ebx, eax
test eax, eax
jne 0x1400043f3
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0x100
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x80]
xor edx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x14000437e
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400043e6
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
and qword [rsp + 0x48], 0
mov rdx, rsi
mov rcx, rdi
call fcn.140004458
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140004403
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14000d6c0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400058b0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x40], 0
mov rbx, rcx
lea rcx, [0x140016b60]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_EnterCriticalSection]
cmp rbx, qword [0x140016c90]
jne 0x14000591b
cmp byte [0x140016c88], 0
jne 0x14000591b
lea rax, [rsp + 0x40]
mov byte [0x140016c88], 1
mov qword [rsp + 0x28], rax
lea r8, [fcn.1400057a0]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_CreateThread]
mov qword [rbx + 0x88], rax
test rax, rax
jne 0x14000591b
mov rcx, rbx
call fcn.1400057a0
lea rcx, [0x140016b60]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_LeaveCriticalSection]
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x1400081dc
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x188]
sub rsp, 0x280
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rcx
xor ebx, ebx
and qword [rsp + 0x58], rbx
and qword [rsp + 0x60], rbx
and qword [rsp + 0x48], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftALGISV
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400082c8
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x40], 0x100
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov edx, edi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
inc edi
test eax, eax
jne 0x1400082c6
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140008018
test al, al
je 0x1400082bf
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140007c74
mov rbx, qword [rsp + 0x50]
jmp 0x14000825f
xor edi, edi
test rbx, rbx
je 0x1400082d6
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14000d6c0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400088ec
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
mov rax, r8
mov qword [r11 - 0x10], r9
mov rdi, r9
mov qword [r11 - 0x18], rdx
lea r9, [r11 + 8]
mov rbx, rdx
xor esi, esi
mov rdx, rax
mov dword [rsp + 0x40], esi
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x40]
mov edx, eax
test ecx, ecx
je 0x140008961
cmp ecx, 2
jbe 0x140008976
cmp ecx, 7
jne 0x140008961
test byte [rdi], 1
jne 0x140008961
mov eax, dword [rdi]
and eax, 0xfffffffe
cmp eax, 4
jb 0x140008961
test rbx, rbx
je 0x14000898c
mov eax, dword [rdi]
shr rax, 1
cmp word [rbx + rax*2 - 2], si
jne 0x140008961
cmp word [rbx + rax*2 - 4], si
je 0x14000898c
mov eax, 0xd
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test byte [rdi], 1
jne 0x140008961
test rbx, rbx
je 0x14000898c
mov eax, dword [rdi]
shr rax, 1
cmp word [rbx + rax*2 - 2], si
jne 0x140008961
mov eax, edx
jmp 0x140008966