joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b5c80
Capabilities:
Hash data using sha256

Disassembly:
push rbx
push rbp
push rdi
push r14
sub rsp, 0xe8
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rcx, qword [rcx + 8]
lea rbx, [rdx + 8]
mov r14, r9
mov rdx, rbx
mov rbp, r8
xor dil, dil
call fcn.1400fa9f0
test rax, rax
je 0x1401b5e20
mov qword [rsp + 0xe0], r15
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor r15d, r15d
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], r15d
call fcn.1402b6e68
mov rcx, rax
test rax, rax
je 0x1401b5e1a
mov rax, qword [rax]
mov r8d, 0x10000
mov rdx, rbx
call qword [rax + 0x30]
mov rbx, rax
test rax, rax
je 0x1401b5e1a
mov ecx, 0x10000
mov qword [rsp + 0x120], rsi
call fcn.140298640
mov rsi, rax
test rax, rax
je 0x1401b5ddb
movups xmm0, xmmword [0x1403072e8]
movups xmm1, xmmword [0x1403072f8]
mov rax, qword [rbx]
lea r9, [rsp + 0x30]
mov r8d, 0x10000
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x30], r15d
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm1
call qword [rax + 8]
test al, al
je 0x1401b5da0
nop dword [rax + rax]
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x1401b5da0
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.14017c780
mov rax, qword [rbx]
lea r9, [rsp + 0x30]
mov r8d, 0x10000
mov rdx, rsi
mov rcx, rbx
call qword [rax + 8]
test al, al
jne 0x1401b5d70
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xb0]
call fcn.14017c870
lea rcx, [rsp + 0xb0]
mov r8d, 0x20
mov rdx, rbp
call fcn.1402a2dc0
mov rcx, rsi
mov dil, 1
test eax, eax
setne al
mov byte [r14], al
call fcn.140298600
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8]
mov rsi, qword [rsp + 0x120]
movzx eax, dil
mov r15, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140297ff0
add rsp, 0xe8
pop r14
pop rdi
pop rbp
pop rbx
ret
movzx eax, dil
jmp 0x1401b5df5
movzx eax, dil
jmp 0x1401b5dfd
Function at 0x1401b71f0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx + 0x20]
mov rbx, rcx
test rdx, rdx
je 0x1401b723b
mov rcx, qword [rcx + 0x18]
xor r9d, r9d
mov r8d, 0x2710
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x1401b7229
mov rcx, qword [rbx + 0x20]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x20], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1401bddb0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rdi, rdx
mov rbx, rcx
mov qword [rcx + 8], rdx
xor r14d, r14d
mov qword [rcx + 0x18], r14
lea rbp, vtable.Core::EventWaitHandle.0
mov qword [rcx + 0x10], rbp
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x18], rax
lea rsi, vtable.Core::ManualResetEvent.0
mov qword [rbx + 0x10], rsi
lea rax, vtable.HitmanPro35::HashClassifier.0
mov qword [rbx], rax
mov qword [rbx + 0x20], r14
mov qword [rbx + 0x30], r14
mov qword [rbx + 0x28], rbp
xor r9d, r9d
mov edx, 1
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x40], r14
mov qword [rbx + 0x38], rbp
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x38], rsi
lea rax, vtable.Core::Mutex.0
mov qword [rbx + 0x48], rax
lea rcx, [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rax, vtable.Core::Queue_class_HitmanPro35::File____ptr64_.0
mov qword [rbx + 0x78], rax
mov dword [rbx + 0x80], r14d
mov qword [rbx + 0x88], r14
mov qword [rbx + 0x90], r14
mov ecx, dword [rdi + 0x10]
mov edx, 0xfa
dec ecx
je 0x1401bdeba
dec ecx
je 0x1401bdeb2
mov dword [rbx + 0x98], 0x1388
jmp 0x1401bdec4
mov dword [rbx + 0x98], edx
jmp 0x1401bdec4
mov dword [rbx + 0x98], 0x9c4
mov byte [rbx + 0xa0], 0
mov eax, 0x32
cmp byte [rdi + 0xe0], 0
cmovne eax, edx
mov dword [rbx + 0x9c], eax
mov rdx, rdi
call fcn.1401be0b0
mov qword [rbx + 0xa8], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rbx
lea r8, [0x1401be330]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x20], rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1401bdf60
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rbx, rcx
lea rax, vtable.HitmanPro35::HashClassifier.0
mov qword [rcx], rax
mov rdx, qword [rcx + 0x20]
xor edi, edi
test rdx, rdx
je 0x1401bdfca
xor r9d, r9d
mov r8d, 0x3a98
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x1401bdfbc
or edx, 0xffffffff
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x20], rdi
mov rcx, qword [rbx + 0xa8]
test rcx, rcx
je 0x1401bdfe1
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
lea rax, vtable.Core::Queue_class_HitmanPro35::File____ptr64_.0
mov qword [rbx + 0x78], rax
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x1401be02d
nop dword [rax + rax]
mov rcx, qword [rax]
mov qword [rbx + 0x88], rcx
test rcx, rcx
je 0x1401be013
mov qword [rcx + 8], rdi
mov rcx, rax
call fcn.1402012c0
dec dword [rbx + 0x80]
mov rax, qword [rbx + 0x88]
test rax, rax
jne 0x1401be000
mov qword [rbx + 0x88], rdi
mov qword [rbx + 0x90], rdi
lea rax, vtable.Core::Mutex.0
mov qword [rbx + 0x48], rax
lea rcx, [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
lea rsi, vtable.Core::EventWaitHandle.0
mov qword [rbx + 0x38], rsi
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, vtable.Core::WaitHandle.0
mov qword [rbx + 0x38], rdi
mov qword [rbx + 0x28], rsi
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1401be200
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx + 0x20]
mov rbx, rcx
test rdx, rdx
je 0x1401be24b
mov rcx, qword [rcx + 0x18]
xor r9d, r9d
mov r8d, 0x3a98
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x1401be239
mov rcx, qword [rbx + 0x20]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x20], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1401c04d0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401c0588
lea rcx, [rsp + 0x250]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
je 0x1401c0588
lea r8, [0x1403232c8]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.14029a500
lea r8, [0x1403232c8]
lea rcx, [rsp + 0x250]
mov edx, 0x104
call fcn.14029a500
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x250]
lea rcx, [rbx + 0x28]
mov qword [rsp + 0x38], rax
call fcn.1401ce950
lea rdx, [rsp + 0x30]
lea r9, [rax + 0x20]
lea rcx, [rbx + 0x28]
mov qword [rsp + 0x20], rax
call fcn.1401bdaa0
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140297ff0
add rsp, 0x470
pop rbx
ret
Function at 0x1401c0680
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
cmp dword [0x1403ffe88], 0
mov rbx, rcx
lea rsi, [0x1403fff70]
jne 0x1401c073b
lea rax, [rsp + 0x68]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c073b
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.ProgramFilesDir
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401c0730
mov eax, dword [rsp + 0x58]
shr eax, 1
dec eax
mov dword [0x1403ffe88], eax
cdqe
cmp word [rsi + rax*2], 0x5c
je 0x1401c0730
lea r8, [0x1403232c8]
mov edx, 0x104
mov rcx, rsi
call fcn.14029a500
inc dword [0x1403ffe88]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1403ffe8c], 0
lea rdi, [0x140400180]
jne 0x1401c07eb
lea rax, [rsp + 0x68]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c07eb
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.ProgramFilesDir
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x58], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401c07e0
mov eax, dword [rsp + 0x58]
shr eax, 1
dec eax
mov dword [0x1403ffe8c], eax
cdqe
cmp word [rdi + rax*2], 0x5c
je 0x1401c07e0
lea r8, [0x1403232c8]
mov edx, 0x104
mov rcx, rdi
call fcn.14029a500
inc dword [0x1403ffe8c]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsxd rax, dword [0x1403ffe88]
test eax, eax
jle 0x1401c0812
mov rdx, qword [rbx]
mov r8, rax
mov rcx, rsi
call fcn.14029a350
test eax, eax
jne 0x1401c0812
mov al, 1
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
movsxd rax, dword [0x1403ffe8c]
test eax, eax
jle 0x1401c082f
mov rdx, qword [rbx]
mov r8, rax
mov rcx, rdi
call fcn.14029a350
test eax, eax
je 0x1401c0808
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401cea20
Capabilities:
Get common file path
Query environment variable

Disassembly:
push rdi
sub rsp, 0xa60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xa78], rbx
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0xa50], rax
mov rbx, rcx
mov r8d, 1
lea rdx, [0x14032c0d4]
call fcn.1401eb700
movzx eax, al
mov r8d, 1
mov rcx, rbx
test eax, eax
jle 0x1401cea9a
lea rdx, [0x14032c0d4]
call fcn.1401e9840
test eax, eax
jle 0x1401ceaba
mov r8d, dword [rbx + 0xc]
sub r8d, eax
mov edx, eax
mov rcx, rbx
call fcn.1401ea390
mov r8d, 1
jmp 0x1401ceab0
lea rdx, [0x1403300d8]
call fcn.1401eb700
test al, al
je 0x1401ceaba
mov r8d, 4
xor edx, edx
mov rcx, rbx
call fcn.1401ea390
cmp dword [rbx + 0xc], 0
je 0x1401ceb8d
xor r8d, r8d
lea rdx, str.system32_
mov rcx, rbx
call fcn.1401eb700
test al, al
je 0x1401ceb0f
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401ceb8d
xor edx, edx
lea r8d, [rdx + 8]
mov rcx, rbx
call fcn.1401ea390
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.1401e9e50
jmp 0x1401ceb8d
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rbx
call fcn.1401eb700
test al, al
je 0x1401ceb56
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401ceb8d
xor edx, edx
lea r8d, [rdx + 0xb]
mov rcx, rbx
call fcn.1401ea390
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.1401e9e50
jmp 0x1401ceb8d
xor edx, edx
mov rcx, rbx
call fcn.1401e7500
cmp ax, 0x25
jne 0x1401ceb8d
mov r8d, 0x400
lea rdx, [rsp + 0x250]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x250]
mov rcx, rbx
call fcn.1401e7490
mov rcx, rbx
cmp dword [rbx + 0xc], 3
jge 0x1401ceba2
mov rdx, qword [0x1403ec168]
jmp 0x1401cec27
mov r9d, 2
lea r8d, [r9 - 1]
lea rdx, [rsp + 0x20]
call fcn.1401eb1b0
nop
mov r8d, 1
lea rdx, [0x14033c4b4]
mov rcx, rax
call fcn.1401e9310
test al, al
sete dil
cmp dword [rsp + 0x28], 0
jle 0x1401cebe3
mov rcx, qword [rsp + 0x20]
call fcn.140298600
mov rcx, rbx
test dil, dil
jne 0x1401ceb96
mov r8d, 1
lea rdx, [0x14033a5a8]
call fcn.1401e8da0
test al, al
je 0x1401cec2c
mov r8d, 0x400
lea rdx, [rsp + 0x250]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401cec2c
lea rdx, [rsp + 0x250]
mov rcx, rbx
call fcn.1401e7490
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.140297ff0
mov rbx, qword [rsp + 0xa78]
add rsp, 0xa60
pop rdi
ret
Function at 0x1401da1e0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0xa60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xa70], rbx
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0xa50], rax
mov rdi, rdx
mov r8d, 1
lea rdx, [0x1403300d8]
mov rcx, rdi
call fcn.1401eb700
test al, al
je 0x1401da27d
mov r8d, 4
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1401eaef0
mov rbx, rax
mov edx, dword [rax + 0xc]
mov rcx, rdi
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rdi + 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rdi]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
mov rcx, rdi
call fcn.1401ea290
nop
cmp dword [rsp + 0x28], 0
jle 0x1401da27d
mov rcx, qword [rsp + 0x20]
call fcn.140298600
mov r8d, 1
lea rdx, [0x14033a5a8]
mov rcx, rdi
call fcn.1401e8da0
test al, al
je 0x1401da305
mov r8d, 0x400
lea rdx, [rsp + 0x250]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x1401da305
lea rax, [rsp + 0x250]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401da2c0
test ebx, ebx
jle 0x1401da2f5
mov edx, ebx
mov rcx, rdi
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
lea r8, [rsp + 0x250]
mov rcx, qword [rdi]
call fcn.14029b4d8
jmp 0x1401da2fb
cmp dword [rdi + 0xc], 0
jle 0x1401da305
mov edx, ebx
mov rcx, rdi
call fcn.1401ea290
mov eax, dword [rdi + 0xc]
cmp eax, 2
jge 0x1401da321
mov rdx, qword [0x1403ec168]
mov rcx, rdi
call fcn.1401e7490
jmp 0x1401da3dd
cmp eax, 1
jg 0x1401da38e
lea rcx, [rsp + 0x20]
call fcn.1401e6d00
nop
lea rax, vtable.Core::IndexOutOfRangeException.0
mov qword [rsp + 0x20], rax
mov edx, 0x2a
lea rcx, [rsp + 0x28]
call fcn.1401e9030
mov eax, dword [rsp + 0x30]
inc eax
movsxd rdx, eax
mov r9d, 0x2a
lea r8, str.Index_was_outside_the_bounds_of_the_array.
mov rcx, qword [rsp + 0x28]
call fcn.14029b4d8
mov edx, 0x2a
lea rcx, [rsp + 0x28]
call fcn.1401ea290
nop
lea rdx, [0x1403e2d68]
lea rcx, [rsp + 0x20]
call fcn.14029f768
int3
mov rax, qword [rdi]
cmp word [rax + 2], 0x3a
je 0x1401da3dd
xor r8d, r8d
lea rdx, str.SystemRoot_
mov rcx, rdi
call fcn.1401eb700
test al, al
je 0x1401da3dd
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1401da3dd
xor edx, edx
lea r8d, [rdx + 0xb]
mov rcx, rdi
call fcn.1401ea390
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.1401e9e50
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.140297ff0
mov rbx, qword [rsp + 0xa70]
add rsp, 0xa60
pop rdi
ret
Function at 0x1401da400
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov rbx, rcx
lea rcx, str.SeDebugPrivilege
call fcn.1400ffc40
call fcn.1400fffc0
cmp qword [rbx + 0x18], 0
mov qword [rbx + 0x10], rax
jne 0x1401da469
mov qword [rsp + 0x40], rdi
xor edi, edi
lea rcx, str..hmpkick
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
cmove rax, rdi
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 0x18], rax
mov rcx, rbx
call fcn.1401da700
mov rcx, rbx
call fcn.1401db1d0
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401da48d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x48
ret
Function at 0x1401db2a0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x490
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rbx, rdx
mov rdi, rcx
call fcn.1401acf80
lea r9, [rsp + 0x30]
mov r8d, 8
lea rdx, [rsp + 0x38]
mov rcx, rbx
test al, al
je 0x1401db2f1
mov dword [rsp + 0x20], 3
call qword [sym.imp.PSAPI.DLL_EnumProcessModulesEx]
jmp 0x1401db2f7
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x1401db314
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.EnumProcessModules_error__d_r_n
mov edx, eax
call fcn.140298d38
jmp 0x1401db3d2
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov r9d, 0x18
mov rcx, rbx
call qword [sym.imp.PSAPI.DLL_GetModuleInformation]
test eax, eax
jne 0x1401db34a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetModuleInformation_error__d_r_n
mov edx, eax
call fcn.140298d38
jmp 0x1401db3d2
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x270]
mov r9d, 0x104
mov rcx, rbx
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x1401db380
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetModuleFileNameEx_error__d_r_n
mov edx, eax
call fcn.140298d38
jmp 0x1401db3d2
xor eax, eax
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x60], ax
call fcn.1402a04b0
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x60]
mov r9d, 0x104
mov rcx, rbx
call qword [sym.imp.PSAPI.DLL_GetMappedFileNameW]
test eax, eax
jne 0x1401db3d2
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x270]
lea rcx, str.Hollow_Process____p_:__ls_r_n
call fcn.140298d38
mov byte [rdi], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140297ff0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop rdi
ret
Function at 0x1401dbbd0
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
mov esi, r8d
mov rdi, rcx
lea r8, [0x1403232c8]
mov edx, 0x104
mov rcx, rbx
call fcn.14029a500
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.1401eb700
test al, al
je 0x1401dbc4a
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jle 0x1401dbc4a
mov r8d, esi
xor edx, edx
mov rcx, rdi
call fcn.1401ea390
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.1401e9e50
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140297ff0
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401dd7d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0xfa0]
mov eax, 0x10a0
call fcn.1402a90d0
sub rsp, rax
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x10c8], rbx
mov qword [rsp + 0x10d0], rsi
mov qword [rsp + 0x10d8], rdi
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rbp + 0xf90], rax
mov rsi, rcx
lea r8, [rsp + 0x68]
lea rdx, str.SOFTWAREClassesInstallerProducts
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1401dda05
xor r14d, r14d
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, r14d
cmp dword [rsp + 0x60], r14d
jbe 0x1401dd9fa
lea r15, [0x140323de0]
nop dword [rax]
mov r9d, 0x800
lea r8, [rbp + 0x790]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc edi
test eax, eax
jne 0x1401dd9e9
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x790]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1401dd9f0
mov dword [rsp + 0x64], 0x800
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14032af80]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x64], 0x800
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProductIcon
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401dd9dd
lea edx, [rax + 0x5c]
lea rcx, [rbp - 0x70]
call fcn.14029aea8
test rax, rax
je 0x1401dd9dd
mov word [rax + 2], r14w
lea rax, [rbp - 0x70]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dd970
mov qword [rsp + 0x78], r14
test ebx, ebx
jne 0x1401dd98a
mov qword [rsp + 0x70], r15
jmp 0x1401dd9b0
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rsp + 0x78]
inc eax
movsxd rdx, eax
lea r8, [rbp - 0x70]
mov rcx, qword [rsp + 0x70]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.1401ea290
nop
lea rdx, [rsp + 0x70]
mov rcx, qword [rsi + 8]
call fcn.1400f69f0
nop
cmp dword [rsp + 0x78], 0
jle 0x1401dd9dd
mov rcx, qword [rsp + 0x70]
call fcn.140298600
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401dd9f0
cmp eax, 0x103
je 0x1401dd9fa
cmp edi, dword [rsp + 0x60]
jb 0x1401dd8a0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0xf90]
xor rcx, rsp
call fcn.140297ff0
lea r11, [rsp + 0x10a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret