joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400237d0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14009e180]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x1400d1a60], 0
jne 0x1400237fe
cmp qword [0x1400d1a70], 0
je 0x1400237fe
call fcn.140023590
mov rcx, qword [0x1400d1a80]
lea rdx, [rsp + 0x20]
mov rbx, qword [0x14009e200]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x28]
lea rcx, [rsp + 0x30]
sub eax, dword [rsp + 0x20]
movd xmm1, eax
mov eax, dword [rsp + 0x2c]
sub eax, dword [rsp + 0x24]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 8], xmm1
movss dword [rbx + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
xorps xmm1, xmm1
sub rax, qword [0x1400d1a88]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x1400d1a90]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rbx + 0x10], xmm1
mov rax, qword [rsp + 0x30]
mov qword [0x1400d1a88], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rbx + 0x11d], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rbx + 0x11e], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x120], 0
cmp byte [rbx + 0x11c], 0
mov byte [rbx + 0x11f], al
je 0x1400238d9
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
call fcn.140004110
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14007c640
add rsp, 0x40
pop rbx
ret
Function at 0x1400288c0
Capabilities:
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov rax, qword [0x14009e180]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov qword [rsp + 0x28], rdx
xor eax, eax
mov dword [rsp + 0x20], eax
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rax
xor r8d, r8d
lea rdx, [0x140087dde]
mov rcx, rsi
call fcn.140027cd0
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x30], 0x10
mov dword [rsp + 0x34], 0x10
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x1400289fb
lea rax, [rsp + 0x38]
mov rbx, 0xffffffffffffffff
mov rdi, rbx
inc rdi
cmp byte [rax + rdi], 0
jne 0x140028951
mov rax, qword [rsi + 0x18]
cmp rdi, rax
ja 0x14002898a
mov r14, rsi
cmp rax, 0xf
jbe 0x14002896f
mov r14, qword [rsi]
mov qword [rsi + 0x10], rdi
mov r8, rdi
lea rdx, [rsp + 0x38]
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rdi], 0
jmp 0x14002899a
lea r9, [rsp + 0x38]
mov rdx, rdi
mov rcx, rsi
call fcn.1400685a0
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1400289fb
lea rax, [rsp + 0x48]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400289b3
mov rax, qword [rsi + 0x18]
cmp rbx, rax
ja 0x1400289eb
mov rdi, rsi
cmp rax, 0xf
jbe 0x1400289d1
mov rdi, qword [rsi]
mov qword [rsi + 0x10], rbx
mov r8, rbx
lea rdx, [rsp + 0x48]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x1400289fb
lea r9, [rsp + 0x48]
mov rdx, rbx
mov rcx, rsi
call fcn.1400685a0
mov rax, rsi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14007c640
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140031170
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14009e180]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor eax, eax
mov r8, rcx
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x1400d1aa8]
cmp rdx, qword [0x1400d1ab0]
mov qword [rsp + 0x30], rax
je 0x1400311d0
mov qword [rdx], rax
add qword [0x1400d1aa8], 8
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14007c640
add rsp, 0x48
ret
lea r8, [rsp + 0x30]
call fcn.140069120
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14007c640
add rsp, 0x48
ret

Function at 0x1400311f0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1400d1aa0]
mov rsi, qword [0x1400d1aa8]
cmp rbx, rsi
je 0x140031234
mov rdi, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadId]
test eax, eax
je 0x140031246
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
add rbx, 8
cmp rbx, rsi
jne 0x140031212
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140031d70
Capabilities:
Check for debugger via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14009e180]
xor rax, rsp
mov qword [rbp - 0x10], rax
movdqa xmm1, xmmword [0x14008d9e0]
mov dl, 0x6c
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov r8b, 0x56
mov r9b, 0x6a
xor dl, cl
psrldq xmm0, 1
xor byte [rbp - 0x3e], cl
xor r8b, cl
xor byte [rbp - 0x3d], cl
xor r9b, cl
xor byte [rbp - 0x3c], cl
mov r10b, 0x70
xor byte [rbp - 0x3b], cl
xor r10b, cl
xor byte [rbp - 0x3a], cl
mov r11b, 0x67
xor byte [rbp - 0x39], cl
xor r11b, cl
xor byte [rbp - 0x38], cl
mov bl, 0x63
xor byte [rbp - 0x37], cl
xor bl, cl
xor byte [rbp - 0x36], cl
mov dil, 0x66
xor byte [rbp - 0x35], cl
xor dil, cl
xor byte [rbp - 0x34], cl
xor esi, esi
xor byte [rbp - 0x33], cl
xor byte [rbp - 0x32], cl
xor byte [rbp - 0x31], cl
mov byte [rbp - 0x30], dl
mov dl, 0x57
mov byte [rbp - 0x2f], r8b
mov r8b, 0x5f
mov byte [rbp - 0x2e], r9b
movzx r9d, r8b
mov byte [rbp - 0x2d], r10b
xor r9b, 0x33
mov byte [rbp - 0x2c], r11b
mov r10b, 0x1d
mov byte [rbp - 0x2b], bl
movzx r11d, dl
mov byte [rbp - 0x2a], dil
movzx ebx, r8b
movzx edi, r8b
movd eax, xmm0
xor dl, 0x33
mov byte [rbp - 0x29], 0
xor r8b, 0x33
mov byte [rbp - 0x28], 0x33
xor al, cl
mov byte [rbp - 0x25], dl
mov byte [rbp - 0x3f], al
mov cl, 0x47
xor cl, 0x33
mov byte [rbp - 0x24], r8b
mov al, 0x5d
mov byte [rbp - 0x26], cl
xor al, 0x33
mov byte [rbp - 0x23], r9b
xor r10b, 0x33
mov byte [rbp - 0x27], al
xor r11b, 0x33
mov byte [rbp - 0x22], r10b
xor bl, 0x33
mov byte [rbp - 0x21], r11b
xor dil, 0x33
mov byte [rbp - 0x20], bl
lea rcx, [rbp - 0x27]
mov byte [rbp - 0x1f], dil
mov byte [rbp - 0x1e], sil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x3f]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140031ed1
cmp qword [sym.imp.KERNEL32.dll_GetCurrentThread], rsi
jne 0x140031ebe
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
jmp 0x140031ec5
mov rcx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
call rbx
mov dword [rbp - 0x18], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov eax, dword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14007c640
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
Function at 0x1400392f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14009e180]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov dword [rsp + 0x20], 0x130
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14003938a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x14003938a
nop dword [rax]
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140039373
inc rax
test ecx, ecx
jne 0x140039360
test edx, edx
je 0x1400393ad
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x140039350
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14007c640
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
mov eax, dword [rsp + 0x28]
jmp 0x14003938c
Function at 0x140039e40
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov r8d, 0x104
lea rdx, [0x1400cdd70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140039fea
mov r8d, 0x104
lea rdx, [0x1400cdd70]
lea rcx, [0x1400cdd70]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x140039fea
mov dl, 0x6b
mov qword [rsp + 0x50], rbx
movzx r11d, dl
mov byte [rbp - 0x10], 0x4b
xor dl, 0x4b
mov cl, 0x28
xor cl, 0x4b
mov byte [rbp - 0xd], dl
mov al, 0x64
mov byte [rbp - 0xe], cl
mov r8b, 0x2f
lea rdx, [rbp - 0xf]
mov r9b, 0x2e
lea rcx, [0x1400cdf90]
mov r10b, 0x27
xor al, 0x4b
xor r8b, 0x4b
mov byte [rbp - 0xf], al
xor r9b, 0x4b
mov byte [rbp - 0xc], r8b
xor r10b, 0x4b
mov byte [rbp - 0xb], r9b
xor r11b, 0x4b
mov byte [rbp - 0xa], r10b
xor ebx, ebx
mov byte [rbp - 9], r11b
mov byte [rbp - 8], bl
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x1400cdd70]
lea rcx, [0x1400cdf90]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov cl, 0x74
mov byte [rbp - 0x10], 0x4a
movzx edx, cl
mov byte [rbp - 8], bl
mov al, 0x6a
xor dl, 0x4a
movzx r8d, al
mov byte [rbp - 0xd], dl
xor cl, 0x4a
lea rdx, [rbp - 0xf]
mov r9b, 4
mov byte [rbp - 0xe], cl
mov r10b, 0x1f
lea rcx, [0x1400cdf90]
mov r11b, 6
xor al, 0x4a
xor r8b, 0x4a
mov byte [rbp - 0xf], al
xor r9b, 0x4a
mov byte [rbp - 0xc], r8b
xor r10b, 0x4a
mov byte [rbp - 0xb], r9b
xor r11b, 0x4a
mov byte [rbp - 0xa], r10b
mov byte [rbp - 9], r11b
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor r8d, r8d
mov byte [rbp - 0x10], 0x2e
mov al, 0x6d
mov byte [rbp - 8], r8b
xor al, 0x2e
mov cl, 0x41
xor cl, 0x2e
mov byte [rbp - 0xf], al
mov dl, 0x43
mov byte [rbp - 0xe], cl
xor dl, 0x2e
mov r9b, 0x7d
xor r9b, 0x2e
mov byte [rbp - 0xd], dl
mov r10b, 0x5e
mov byte [rbp - 0xc], r9b
xor r10b, 0x2e
mov r11b, 0x4b
xor r11b, 0x2e
mov byte [rbp - 0xb], r10b
mov bl, 0x4d
mov byte [rbp - 0xa], r11b
xor bl, 0x2e
mov byte [rbp - 9], bl
mov r8d, 0x104
lea rdx, [0x1400cdd70]
lea rcx, [rbp - 0xf]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rbx, qword [rsp + 0x50]
test eax, eax
je 0x140039fea
xor eax, eax
lea r9, [0x1400cdf90]
mov dword [rsp + 0x28], eax
lea r8, [0x1400cdd70]
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x40
pop rbp
ret
Function at 0x14003a230
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14009e180]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
mov dword [rsp + 0x40], edi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003a437
mov dword [rsp + 0x58], 0x104
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 2]
lea r8, str.DisplayVersion
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14003a437
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14003a312
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140067c80
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x60]
cmova rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.140067070
nop
lea rax, [rbp - 0x80]
mov rdi, qword [rbp - 0x68]
cmp rbx, rax
je 0x14003a3b6
lea r9, [rbp - 0x80]
cmp rdi, 0xf
cmova r9, qword [rbp - 0x80]
mov rax, qword [rbx + 0x18]
mov rsi, qword [rbp - 0x70]
cmp rsi, rax
ja 0x14003a3a7
mov r14, rbx
cmp rax, 0xf
jbe 0x14003a38e
mov r14, qword [rbx]
mov qword [rbx + 0x10], rsi
mov r8, rsi
mov rdx, r9
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + r14], 0
jmp 0x14003a3b6
mov rdx, rsi
mov rcx, rbx
call fcn.1400685a0
mov rdi, qword [rbp - 0x68]
cmp rdi, 0xf
jbe 0x14003a3f2
lea rdx, [rdi + 1]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a3ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a3ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ca90
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14003a437
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a432
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a432
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ca90
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14007c640
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14003a470
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14009e180]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
mov dword [rsp + 0x40], edi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003a677
mov dword [rsp + 0x58], 0x104
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 2]
lea r8, str.ProductName
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14003a677
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14003a552
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140067c80
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x60]
cmova rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.140067070
nop
lea rax, [rbp - 0x80]
mov rdi, qword [rbp - 0x68]
cmp rbx, rax
je 0x14003a5f6
lea r9, [rbp - 0x80]
cmp rdi, 0xf
cmova r9, qword [rbp - 0x80]
mov rax, qword [rbx + 0x18]
mov rsi, qword [rbp - 0x70]
cmp rsi, rax
ja 0x14003a5e7
mov r14, rbx
cmp rax, 0xf
jbe 0x14003a5ce
mov r14, qword [rbx]
mov qword [rbx + 0x10], rsi
mov r8, rsi
mov rdx, r9
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + r14], 0
jmp 0x14003a5f6
mov rdx, rsi
mov rcx, rbx
call fcn.1400685a0
mov rdi, qword [rbp - 0x68]
cmp rdi, 0xf
jbe 0x14003a632
lea rdx, [rdi + 1]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a62c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a62c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ca90
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14003a677
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a672
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a672
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ca90
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14007c640
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14003a6b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14009e180]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
mov dword [rsp + 0x40], edi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003a8b7
mov dword [rsp + 0x58], 0x104
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 2]
lea r8, str.EditionID
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14003a8b7
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14003a792
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140067c80
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x60]
cmova rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.140067070
nop
lea rax, [rbp - 0x80]
mov rdi, qword [rbp - 0x68]
cmp rbx, rax
je 0x14003a836
lea r9, [rbp - 0x80]
cmp rdi, 0xf
cmova r9, qword [rbp - 0x80]
mov rax, qword [rbx + 0x18]
mov rsi, qword [rbp - 0x70]
cmp rsi, rax
ja 0x14003a827
mov r14, rbx
cmp rax, 0xf
jbe 0x14003a80e
mov r14, qword [rbx]
mov qword [rbx + 0x10], rsi
mov r8, rsi
mov rdx, r9
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + r14], 0
jmp 0x14003a836
mov rdx, rsi
mov rcx, rbx
call fcn.1400685a0
mov rdi, qword [rbp - 0x68]
cmp rdi, 0xf
jbe 0x14003a872
lea rdx, [rdi + 1]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a86c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a86c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ca90
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14003a8b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a8b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a8b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ca90
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14007c640
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14003a8f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14009e180]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
mov dword [rsp + 0x40], edi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003aaf7
mov dword [rsp + 0x58], 0x104
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 2]
lea r8, str.Version
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14003aaf7
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14003a9d2
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140067c80
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x60]
cmova rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.140067070
nop
lea rax, [rbp - 0x80]
mov rdi, qword [rbp - 0x68]
cmp rbx, rax
je 0x14003aa76
lea r9, [rbp - 0x80]
cmp rdi, 0xf
cmova r9, qword [rbp - 0x80]
mov rax, qword [rbx + 0x18]
mov rsi, qword [rbp - 0x70]
cmp rsi, rax
ja 0x14003aa67
mov r14, rbx
cmp rax, 0xf
jbe 0x14003aa4e
mov r14, qword [rbx]
mov qword [rbx + 0x10], rsi
mov r8, rsi
mov rdx, r9
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + r14], 0
jmp 0x14003aa76
mov rdx, rsi
mov rcx, rbx
call fcn.1400685a0
mov rdi, qword [rbp - 0x68]
cmp rdi, 0xf
jbe 0x14003aab2
lea rdx, [rdi + 1]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003aaac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003aaac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ca90
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14003aaf7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003aaf2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003aaf2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007ca90
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14007c640
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret