joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c047
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 0x10], 0
mov rax, qword [rbp + 0x10]
mov dword [rbp - 4], eax
call fcn.14001bd97
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call fcn.14001bbe8
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 0x40]
and eax, 0x30
test al, al
jne 0x14001c0b4
mov rax, qword [rbp - 0x18]
add rax, 0xd0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
call rax
mov eax, dword [0x1400c01e0]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14001c1f8
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14001c151
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14001c10c
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14001a7ee
mov qword [rbp - 0x10], 0
mov eax, dword [0x1400c01e0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x14001c1f8
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 1
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14001c18b
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x44]
and eax, 4
test eax, eax
je 0x14001c1f8
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14001a7ee
mov qword [rbp - 0x10], 0
mov eax, dword [0x1400c01e0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call rax
nop
Function at 0x14001e100
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
lea rax, [0x1400c0200]
mov rcx, rax
call fcn.14001a06c
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov eax, dword [rax]
cmp eax, 0xbab1f0ed
jne 0x14001e13c
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov eax, dword [rax + 4]
test eax, eax
jg 0x14001e17c
mov ecx, 2
mov rax, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call rax
mov rcx, rax
mov dword [rsp + 0x20], 0x28
lea r9, str..._.._.._mingw_w64_libraries_winpthreads_src_rwlock.c
lea r8, str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
lea rax, str.Assertion_failed:___s___file__s__line__d_n
mov rdx, rax
call fcn.1400175d0
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov edx, dword [rax + 4]
sub edx, 1
mov dword [rax + 4], edx
lea rax, [0x1400c0200]
mov rcx, rax
call fcn.14001a0eb
mov eax, dword [rbp + 0x18]
add rsp, 0x30
pop rbp
ret

Function at 0x140023870
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call rcx
nop
jmp 0x1400bd6f0
Function at 0x1400847f0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x140084838
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14008480a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400a9ef0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
movabs rcx, 0x3fffffffffffffff
mov rax, qword [rdx]
cmp rcx, rax
jb 0x1400a9f4b
lea r9, [rax + 1]
cmp r8, rax
jae 0x1400a9f29
add r8, r8
cmp rax, r8
jae 0x1400a9f29
cmp rcx, r8
jae 0x1400a9f38
movabs r9, 0x4000000000000000
mov qword [rdx], rcx
mov rcx, r9
add rsp, 0x28
jmp fcn.1400bccf0
lea r9, [r8 + 1]
mov qword [rdx], r8
mov rcx, r9
add rsp, 0x28
jmp fcn.1400bccf0
lea rcx, [0x1400c5570]
call fcn.1400be9a0
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov qword [rcx + 8], rdx
ret

Function at 0x1400adc30
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
movabs rax, 0x1fffffffffffffff
mov rcx, qword [rdx]
cmp rax, rcx
jb 0x1400adc91
cmp r8, rcx
jb 0x1400adc60
add rcx, 1
add rcx, rcx
add rsp, 0x28
jmp fcn.1400bccf0
add r8, r8
cmp rcx, r8
jae 0x1400adc4b
cmp rax, r8
jae 0x1400adc88
movabs rcx, 0x4000000000000000
mov qword [rdx], rax
add rsp, 0x28
jmp fcn.1400bccf0
mov qword [rdx], r8
lea rcx, [r8 + 1]
jmp 0x1400adc4f
lea rcx, str.basic_string::_M_create
call fcn.1400be9a0
nop
nop
nop
mov qword [rcx + 8], rdx
ret

Function at 0x1400bccf0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, 1
test rcx, rcx
cmovne rax, rcx
mov rbx, rax
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x1400bcd17
add rsp, 0x20
pop rbx
ret
call fcn.1400b7a20
test rax, rax
je 0x1400bd710
call rax
jmp 0x1400bcd04
Function at 0x1400bd6f0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.1400bce10
mov rax, qword [rbx - 0x10]
mov rcx, qword [rbx - 0x40]
mov rbp, qword [rbx - 0x18]
movsxd rsi, dword [rbx - 0x24]
mov qword [rsp + 0x30], rax
mov rdi, qword [rbx - 0x38]
call fcn.140023890
mov rcx, rax
jmp 0x1400bd630
call fcn.1400bce10
call fcn.1400bd060
mov rbx, qword [rax]
test byte [rbx + 0x50], 1
je 0x1400bd6b7
mov rbx, qword [rbx]
lea r12, [rsp + 0x20]
mov rdx, rbp
xor ecx, ecx
mov r8, r12
call fcn.140023460
mov rdx, qword [rbx - 0x90]
mov r9, rsi
mov r8, rbx
mov rcx, r12
call fcn.140023550
test al, al
jne 0x1400bd6d5
lea rbx, [0x1400cc520]
mov r9, rsi
xor r8d, r8d
mov rcx, r12
mov rdx, rbx
call fcn.140023550
test al, al
je 0x1400bd6da
mov ecx, 8
call fcn.1400bcda0
lea r8, [0x14008aa10]
mov rdx, rbx
mov rcx, rax
mov rax, qword [0x1400ca000]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bd320
add rbx, 0x90
jmp 0x1400bd646
call fcn.1400bd2d0
mov rcx, rdi
call fcn.140023870
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rax
call fcn.1400bce10
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, 8
call fcn.1400bcda0
lea r8, [fcn.1400b5310]
lea rdx, [0x1400cd190]
mov rcx, rax
mov rax, qword [str.P4_r_]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bd320
nop
nop
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400bd7bc
call fcn.1400bce10
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call fcn.1400bcf40
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rdi
call fcn.140017b10
call fcn.1400bd2d0
call fcn.1400bce10
call fcn.1400bcf40
jmp 0x1400bd7aa
Function at 0x1400bd710
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.1400bce10
mov rax, qword [rbx - 0x10]
mov rcx, qword [rbx - 0x40]
mov rbp, qword [rbx - 0x18]
movsxd rsi, dword [rbx - 0x24]
mov qword [rsp + 0x30], rax
mov rdi, qword [rbx - 0x38]
call fcn.140023890
mov rcx, rax
jmp 0x1400bd630
call fcn.1400bce10
call fcn.1400bd060
mov rbx, qword [rax]
test byte [rbx + 0x50], 1
je 0x1400bd6b7
mov rbx, qword [rbx]
lea r12, [rsp + 0x20]
mov rdx, rbp
xor ecx, ecx
mov r8, r12
call fcn.140023460
mov rdx, qword [rbx - 0x90]
mov r9, rsi
mov r8, rbx
mov rcx, r12
call fcn.140023550
test al, al
jne 0x1400bd6d5
lea rbx, [0x1400cc520]
mov r9, rsi
xor r8d, r8d
mov rcx, r12
mov rdx, rbx
call fcn.140023550
test al, al
je 0x1400bd6da
mov ecx, 8
call fcn.1400bcda0
lea r8, [0x14008aa10]
mov rdx, rbx
mov rcx, rax
mov rax, qword [0x1400ca000]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bd320
add rbx, 0x90
jmp 0x1400bd646
call fcn.1400bd2d0
mov rcx, rdi
call fcn.140023870
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rax
call fcn.1400bce10
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, 8
call fcn.1400bcda0
lea r8, [fcn.1400b5310]
lea rdx, [0x1400cd190]
mov rcx, rax
mov rax, qword [str.P4_r_]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bd320
nop
nop
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400bd7bc
call fcn.1400bce10
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call fcn.1400bcf40
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rdi
call fcn.140017b10
call fcn.1400bd2d0
call fcn.1400bce10
call fcn.1400bcf40
jmp 0x1400bd7aa
Function at 0x1400bd740
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.1400bce10
mov rax, qword [rbx - 0x10]
mov rcx, qword [rbx - 0x40]
mov rbp, qword [rbx - 0x18]
movsxd rsi, dword [rbx - 0x24]
mov qword [rsp + 0x30], rax
mov rdi, qword [rbx - 0x38]
call fcn.140023890
mov rcx, rax
jmp 0x1400bd630
call fcn.1400bce10
call fcn.1400bd060
mov rbx, qword [rax]
test byte [rbx + 0x50], 1
je 0x1400bd6b7
mov rbx, qword [rbx]
lea r12, [rsp + 0x20]
mov rdx, rbp
xor ecx, ecx
mov r8, r12
call fcn.140023460
mov rdx, qword [rbx - 0x90]
mov r9, rsi
mov r8, rbx
mov rcx, r12
call fcn.140023550
test al, al
jne 0x1400bd6d5
lea rbx, [0x1400cc520]
mov r9, rsi
xor r8d, r8d
mov rcx, r12
mov rdx, rbx
call fcn.140023550
test al, al
je 0x1400bd6da
mov ecx, 8
call fcn.1400bcda0
lea r8, [0x14008aa10]
mov rdx, rbx
mov rcx, rax
mov rax, qword [0x1400ca000]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bd320
add rbx, 0x90
jmp 0x1400bd646
call fcn.1400bd2d0
mov rcx, rdi
call fcn.140023870
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rax
call fcn.1400bce10
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, 8
call fcn.1400bcda0
lea r8, [fcn.1400b5310]
lea rdx, [0x1400cd190]
mov rcx, rax
mov rax, qword [str.P4_r_]
add rax, 0x10
mov qword [rcx], rax
call fcn.1400bd320
nop
nop
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400bd7bc
call fcn.1400bce10
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call fcn.1400bcf40
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov rcx, rdi
call fcn.140017b10
call fcn.1400bd2d0
call fcn.1400bce10
call fcn.1400bcf40
jmp 0x1400bd7aa
Function at 0x14001dd20
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140076100]
xor rax, rsp
mov qword [rbp + 0x20], rax
movabs rax, 0x331b949731ab8710
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movabs rcx, 0xc28cce219d023056
mov qword [rbp - 0x68], rcx
movabs rax, 0xe5fcf87192b29bc1
mov qword [rsp + 0x48], rax
movabs rdi, 0x7047d9d265f8de43
movdqa xmm0, xmmword [rsp + 0x40]
movabs rax, 0x66ab0d60e191e59b
mov qword [rsp + 0x50], rax
movabs rbx, 0x8abf8c1ff7c0e9b4
movabs rax, 0xae14c5de5407272
mov qword [rbp + 0x18], rcx
mov qword [rsp + 0x58], rax
mov r9d, 2
movdqa xmm1, xmmword [rsp + 0x50]
movabs rax, 0xab8768e7b5f735ab
mov qword [rsp + 0x60], rax
xor r8d, r8d
movabs rax, 0xc9da219706ea500d
mov qword [rbp - 0x40], rdi
mov qword [rsp + 0x68], rax
mov rcx, 0xffffffff80000002
movabs rax, 0x3ca671177eac4257
mov qword [rbp - 0x38], rbx
xorps xmm0, xmmword [rbp - 0x40]
mov qword [rsp + 0x70], rax
movabs rax, 0xcf897c43697a3c5b
mov qword [rsp + 0x78], rax
movabs rax, 0x119e960586fa12d9
mov qword [rbp - 0x80], rax
movabs rax, 0xb2b50dd2a5391538
mov qword [rbp - 0x78], rax
movabs rax, 0xd19bbb0f7352618
mov qword [rbp - 0x70], rax
movabs rax, 0x12ce5e0c8ee391f5
mov qword [rbp - 0x30], rax
movabs rax, 0x668e3e298b2f312e
mov qword [rbp - 0x28], rax
movabs rax, 0xece20b8ec39271f7
xorps xmm1, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movabs rax, 0xacb972cb62983178
mov qword [rbp - 0x18], rax
movabs rax, 0x74fa027817de2339
mov qword [rbp - 0x10], rax
movabs rax, 0xa0fa15351b1f4c22
mov qword [rbp - 8], rax
movabs rax, 0x74fde46ae09457ab
mov qword [rbp], rax
movabs rax, 0xc6db44b7c156565c
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x10]
mov qword [rbp + 8], rax
movabs rax, 0xd19c2c49e47417d
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [rbp - 0x70]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x60]
xorps xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001df79
mov rcx, qword [rbp - 0x60]
lea rdx, [rsp + 0x30]
mov dword [rbp - 0x58], eax
mov r9d, 4
mov qword [rsp + 0x38], rbx
movabs rax, 0x7023bcbe0799b006
mov qword [rsp + 0x30], rax
xor r8d, r8d
movdqa xmm0, xmmword [rsp + 0x30]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rbx
xorps xmm0, xmmword [rbp - 0x50]
mov dword [rsp + 0x28], 4
movdqa xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400384a0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14001e2a0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140076100]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, rcx
lea r9, [rsp + 0x20]
xor r14d, r14d
mov ecx, 0xb
xor r8d, r8d
mov dword [rsp + 0x20], r14d
xor edx, edx
mov edi, r14d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14001e32d
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14001e2e2
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rsi
test eax, eax
js 0x14001e3fc
mov ebx, r14d
cmp dword [rdi], ebx
jbe 0x14001e3fc
nop dword [rax]
mov eax, ebx
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rdi + 0x2e]
lea rsi, [rcx + rdi]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rdi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x14001e385
lea rcx, [rsp + 0x28]
call fcn.14001b2a0
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
mov rdx, rbp
cmova rcx, qword [rsp + 0x28]
call fcn.140042be0
test eax, eax
je 0x14001e432
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14001e3f2
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e3ed
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e485
call fcn.1400384fc
inc ebx
cmp ebx, dword [rdi]
jb 0x14001e350
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400384a0
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
mov rbx, qword [rsi + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14001e480
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e47b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e485
call fcn.1400384fc
mov rax, rbx
jmp 0x14001e40f
call fcn.14003e404
int3
Function at 0x140025840
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x140076100]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor eax, eax
mov dword [rbp - 0x49], 4
mov dword [rbp - 0x51], eax
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x4d], eax
movabs rcx, 0xa0fa15351b1f4c22
mov qword [rbp - 1], rcx
movabs rax, 0x331b949731ab8710
mov qword [rbp - 0x39], rax
movabs r14, 0x7047d9d265f8de43
mov qword [rbp + 0x3f], rcx
movabs rax, 0xe5fcf87192b29bc1
mov qword [rbp - 0x31], rax
movabs rsi, 0x8abf8c1ff7c0e9b4
movdqa xmm0, xmmword [rbp - 0x39]
movabs rax, 0x66ab0d60e191e59b
mov qword [rbp - 0x29], rax
movabs rdi, 0x12ce5e0c8ee391f5
movabs rax, 0xae14c5de5407272
mov qword [rbp + 7], r14
mov qword [rbp - 0x21], rax
movabs rbx, 0x668e3e298b2f312e
movdqa xmm1, xmmword [rbp - 0x29]
movabs rax, 0xae8779fba0f722ab
mov qword [rbp - 0x19], rax
mov r9d, 0x20019
movabs rax, 0xd8d806983eec5e17
mov qword [rbp + 0xf], rsi
xorps xmm0, xmmword [rbp + 7]
xor r8d, r8d
mov qword [rbp - 0x11], rax
mov rcx, 0xffffffff80000002
movdqa xmmword [rbp - 0x39], xmm0
movabs rax, 0x74fa027817de235c
movdqa xmm0, xmmword [rbp - 0x19]
mov qword [rbp - 9], rax
movabs rax, 0xece20b8ec39271f7
mov qword [rbp + 0x27], rax
movabs rax, 0xacb972cb62983178
mov qword [rbp + 0x2f], rax
movabs rax, 0x74fa027817de2339
xorps xmm0, xmmword [rbp + 0x27]
mov qword [rbp + 0x37], rax
lea rax, [rbp - 0x59]
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], rbx
xorps xmm1, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm1, xmmword [rbp - 9]
xorps xmm1, xmmword [rbp + 0x37]
movdqa xmmword [rbp - 9], xmm1
mov qword [rsp + 0x20], rax
movdqa xmmword [rbp - 0x19], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp - 0x59]
lea r9, [rbp - 0x49]
mov qword [rbp + 0x1f], rbx
lea rdx, [rbp + 7]
movabs rax, 0x524bc812cbe9b16
mov qword [rbp - 0x39], r14
mov qword [rbp + 7], rax
xor r8d, r8d
movabs rax, 0xe4faf87098828cc6
mov qword [rbp - 0x31], rsi
mov qword [rbp + 0xf], rax
movabs rax, 0x12ce5e68eb8ff394
movdqa xmm0, xmmword [rbp + 7]
xorps xmm0, xmmword [rbp - 0x39]
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x4d]
movdqa xmm1, xmmword [rbp + 0x17]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x51]
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rbx
xorps xmm1, xmmword [rbp - 0x29]
mov qword [rsp + 0x20], rax
movdqa xmmword [rbp + 7], xmm0
movdqa xmmword [rbp + 0x17], xmm1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp - 0x51], 0
setne al
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400384a0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140026e70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140076100]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x40]
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x1c
xor edi, edi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x140026eef
lea rdx, str.Error_getting_AppData_Local_folder_path.
lea rcx, [0x140077b10]
call fcn.14001aec0
mov rcx, rax
call fcn.140031670
xorps xmm0, xmm0
lea rdx, [0x14006a82d]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
xor r8d, r8d
mov qword [rbx + 0x18], rdi
jmp 0x140026f1e
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x140026f10
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14001b2a0
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400384a0
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret