joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800b43a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1800f9b98]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1800b4435
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1800b4496
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.1800933d0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800c73c0
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1800b4551
sub ecx, 1
je 0x1800b45c4
sub ecx, 1
je 0x1800b4500
cmp ecx, 1
je 0x1800b44e3
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1800ced0c]
call fcn.1800933d0
jmp 0x1800b45c4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.1800b40d0
test eax, eax
je 0x1800b45c4
jmp 0x1800b446a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1800b45c4
sub rax, rsi
cmp rax, rbp
jae 0x1800b45c4
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.180093550
jmp 0x1800b45c4
cmp r8d, 4
jle 0x1800b45c4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x1800b45c4
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.1800932f0
mov esi, eax
test eax, eax
je 0x1800b45a3
mov edx, 5
mov rcx, rbx
call fcn.1800b5090
mov eax, esi
jmp 0x1800b446a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.18009d970
mov rcx, r14
call fcn.18009dc50
test eax, eax
je 0x1800b4468
mov edx, 5
mov rcx, rbx
call fcn.1800b5090
mov eax, Ordinal_45
jmp 0x1800b446a
Function at 0x1800c6d20
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1800c6d62
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1800c6da9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1800c6e02
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1800c6dc0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1800c6e43
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1800e390b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1800e390c]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1800c6e10
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1800c70f4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800c7178
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1800c7178
dec r8
sub rdx, 1
jne 0x1800c715e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140026780
Capabilities:
Check mutex on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], 0
mov qword [rcx + 8], 0
lea r8, str.A946A6A9_917E_4949_B9BC_6BADA8C7FD63
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400267c0
mov rcx, rax
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete byte [rsi]
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x140027b70
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
cmp rdx, 1
je 0x140027bb2
mov rdi, rdx
lea rax, [rdx - 1]
test rdx, rax
je 0x140027b97
mov rcx, rdi
int3
mov rbx, qword [rsi + 8]
cmp rdi, rbx
jbe 0x140027bb9
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140143fd0
mov edi, 2
jmp 0x140027b97
jb 0x140027bc3
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x140027bd3
cvtsi2ss xmm0, rax
jmp 0x140027be8
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.14013fae0
cvttss2si rcx, xmm0
movss xmm1, dword [0x1401eaa64]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
btc rax, 0x3f
ucomiss xmm0, xmm1
cmovb rax, rcx
cmp rbx, 3
jb 0x140027c9a
mov rcx, rbx
shr rcx, 1
movabs r8, 0x5555555555555555
and r8, rcx
mov rdx, rbx
sub rdx, r8
movabs r8, 0x3333333333333333
mov rcx, rdx
shr rcx, 2
and rdx, r8
and rcx, r8
add rcx, rdx
mov rdx, rcx
shr rdx, 4
add rdx, rcx
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rdx
movabs rdx, 0x101010101010101
imul rdx, rcx
shr rdx, 0x38
cmp edx, 1
ja 0x140027c9a
cmp rax, 2
jb 0x140027ca2
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x140027ca2
mov rcx, rax
int3
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rbx
jae 0x140027bbb
jmp 0x140027ba0
Function at 0x140041890
Capabilities:
Get session information

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x140041955
lea r9, [rsp + 0x48]
mov qword [r9], 0
lea rcx, [rsp + 0x44]
mov dword [rcx], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov edx, eax
mov r8d, 0x18
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x140041955
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x38]
mov qword [r14], rax
mov rdi, qword [rsp + 0x48]
mov ecx, 0x30
int3
mov qword [rsi], 0
jmp 0x14004197c
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140111870
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140047cf0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov rbx, qword [rdx]
mov qword [rdx], rax
lea rbp, [rbx + 1]
cmp rbp, 2
jb 0x140047d1f
call fcn.1400e8390
cmp qword [rsi], rbx
je 0x140047d50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140047d8d
cmp rbp, 2
jb 0x140047d47
mov qword [rsi], rbx
call fcn.1400e8390
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
call fcn.1400e6740
lea rcx, [rsi + 0x20]
int3
call fcn.1400e8390
mov rcx, qword [rsi]
int3
Function at 0x1400500a0
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x270], rax
movzx eax, word [rcx + 0x28]
mov word [rsp + 0x260], ax
movzx eax, word [rcx + 0x2a]
mov word [rsp + 0x262], ax
mov rsi, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call rsi
mov word [rsp + 0x264], ax
movzx eax, word [rbx + 0x2a]
mov word [rsp + 0x266], ax
movzx eax, word [rbx + 0x28]
mov word [rsp + 0x268], ax
mov bp, 0x4e4
mov word [rsp + 0x26a], bp
call rsi
mov word [rsp + 0x26c], ax
mov word [rsp + 0x26e], bp
xor ebp, ebp
lea rsi, [rsp + 0x50]
lea r15, str.StringFileInfo_04x_04x_ls
lea r12, [rsp + 0x48]
lea r13, [rsp + 0x44]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140114200
movzx eax, word [rsp + rbp + 0x262]
movzx ecx, word [rsp + rbp + 0x260]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
mov r9, r15
int3

Function at 0x140050750
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov r14, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.140114200
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x1400507ef
lea rsi, [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.14012c3a4
mov qword [rsi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
int3
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140111870
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140050820
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140114200
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400508b5
cmp word [rsp + 0x70], 0
je 0x1400508b5
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.14012c3a4
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
int3
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140111870
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1401e90c0]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.1400e6740
mov rcx, rdi
call fcn.140050750
test al, al
je 0x1400508f5
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400e67a0
jmp 0x140050914
lea rax, [0x1401f099c]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
int3
lea rcx, [rsp + 0x40]
call fcn.1400e68a0
jmp 0x140050897
Function at 0x140054ad0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
add rsp, 0x38
ret

Function at 0x140054b80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x98], rax
xor ebp, ebp
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
jne 0x140054bf3
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140111870
mov eax, ebp
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x90]
mov qword [rax], 0
mov r9d, esi
or r9d, 8
mov qword [rsp + 0x20], rax
xor ebp, ebp
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140054c2c
cmp eax, 2
je 0x140054bc5
mov ebp, eax
jmp 0x140054bc5
movabs r15, 0x7fffffffffffffef
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x1401e90c0]
movaps xmmword [rsp + 0x70], xmm0
mov rcx, rdi
call fcn.14012c3a4
cmp rax, r15
ja 0x140054e27
mov rbp, rax
cmp rax, 0xb
jae 0x140054c7e
lea r14, [rsp + 0x70]
mov byte [r14 + 0x17], bpl
test rbp, rbp
jne 0x140054cab
jmp 0x140054cbc
lea r12, [rbp + 8]
and r12, 0xfffffffffffffff8
lea rcx, [r12 + r12]
int3
mov r8, rbp
add r8, rbp
mov rcx, r14
mov rdx, rdi
call fcn.140113df0
mov word [r14 + rbp*2], 0
mov al, byte [rsp + 0x87]
test al, al
mov rcx, qword [rsp + 0x78]
movzx r14d, al
mov rdx, r14
cmovs rdx, rcx
test rdx, rdx
je 0x140054d15
test al, al
jns 0x140054cec
mov rbp, qword [rsp + 0x70]
jmp 0x140054cf1
lea rbp, [rsp + 0x70]
cmp word [rbp + rdx*2 - 2], 0x5c
je 0x140054d15
lea rbp, [rsp + 0x70]
mov rcx, rbp
mov dx, 0x5c
int3
xorps xmm6, xmm6
lea r15, [rsp + 0x50]
movaps xmmword [r15], xmm6
test al, al
cmovs r14, rcx
mov qword [r15 + 0x10], 0
lea r12, [rsp + 0x4c]
mov rbp, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea r13, [rsp + 0x70]
mov dword [rsp + 0x4c], 0x104
mov edx, 0x104
mov rcx, r15
call fcn.140053eb0
mov rcx, qword [rsp + 0x90]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
xor edx, edx
mov r8, rax
mov r9, r12
call rbp
test eax, eax
jne 0x140054dd7
mov edx, dword [rsp + 0x4c]
mov rcx, r15
xor r8d, r8d
call fcn.1400e5310
mov rcx, r13
mov rdx, r14
xor r8d, r8d
call fcn.1400e5310
movzx r8d, byte [rsp + 0x67]
mov rdx, r15
test r8b, r8b
jns 0x140054daa
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, r13
int3
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ebp, eax
cmp byte [rsp + 0x67], 0
jns 0x140054e0a
mov rcx, qword [rsp + 0x50]
call fcn.1401109f8
cmp byte [rsp + 0x87], 0
jns 0x140054bc5
mov rcx, qword [rsp + 0x70]
call fcn.1401109f8
jmp 0x140054bc5
lea rcx, [rsp + 0x70]
int3
Function at 0x140054e50
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea rdi, [rsp + 0x38]
mov dword [rdi], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140054ec3
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x140054ec3
cmp dword [rsp + 0x38], 4
jne 0x140054ec3
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140111870
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140054ee0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rax, qword [rsp + 0x60]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop
add rsp, 0x38
ret

Function at 0x140055020
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140111870
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x140055080
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.14012c3a4
add eax, eax
add eax, 2
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140055220
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rcx], 0
je 0x140055304
cmp dword [rsi + 8], 0
js 0x140055304
lea r15, [rsi + 0x10]
cmp byte [rsi + 0x27], 0
jns 0x140055326
mov ebp, dword [rsi + 0x20]
dec ebp
lea rdi, [rsp + 0x4c]
mov dword [rdi], ebp
lea r14, [rsi + 0x28]
mov eax, dword [rsi + 0x30]
mov rbx, qword [rsi + 0x28]
sub eax, ebx
add eax, 0xfffffffe
and eax, 0xfffffffe
lea r13, [rsi + 0x40]
mov dword [rsi + 0x40], eax
lea r12, [rsi + 0x44]
mov edx, ebp
mov rcx, r15
call fcn.140053eb0
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
mov r8, rax
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x140055330
test eax, eax
jne 0x140055304
mov eax, dword [r13]
inc rax
and rax, 0xfffffffffffffffe
mov rcx, qword [r14]
mov word [rcx + rax], 0
mov dil, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140111870
mov eax, edi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsi + 0x10]
cmp byte [rsi + 0x27], 0
jns 0x140055311
mov rax, qword [rax]
xor edi, edi
mov word [rax], di
mov rax, qword [rsi + 0x28]
mov word [rax], di
mov dword [rsi + 0x40], 0
jmp 0x1400552e4
mov ebp, 0xa
jmp 0x140055269
mov edx, dword [rsi + 0x40]
inc rdx
shr rdx, 1
mov rdi, qword [rsi + 0x28]
mov rax, qword [rsi + 0x30]
sub rax, rdi
mov rcx, rax
sar rcx, 1
sub rdx, rcx
jb 0x140055370
lea r8, [rsp + 0x4a]
mov word [r8], 0
inc rdx
mov rcx, r14
int3
add eax, 0xfffffffe
and eax, 0xfffffffe
mov dword [rsi + 0x40], eax
lea rbx, [rsp + 0x4c]
cmp dword [rbx], ebp
mov edx, 0x4000
cmovne edx, ebp
mov dword [rbx], edx
mov rcx, r15
call fcn.140053eb0
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
mov r8, rax
mov r9, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x1400552c9
dec dword [rcx + 8]
jmp 0x140055220
Function at 0x140074530
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140074557
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140074591
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400745b0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140111870
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140074670
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140111870
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400e83a0
test al, al
je 0x140074667
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x25d
mov r9d, 2
int3
xor esi, esi
jmp 0x140074594

Function at 0x140074670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x140074697
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400746c9
mov dil, 1
test al, 0x10
je 0x140074785
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140111870
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400e83a0
test al, al
je 0x140074848
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x248
mov r9d, 2
int3
mov ecx, 2
call fcn.1400e83a0
test al, al
je 0x140074848
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x24c
mov r9d, 2
call fcn.14004a130
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
int3
xor edi, edi
jmp 0x1400746ad
Function at 0x140075db0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r12, rdx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x20]
mov qword [rsi], rax
mov rdx, rsi
call fcn.1400749a0
mov rax, qword [rsi]
test rax, rax
je 0x140075e2b
mov rbx, qword [rax + 0x38]
mov rdi, qword [rax + 0x40]
xor esi, esi
cmp rbx, rdi
jne 0x140075e32
lea rcx, [rsp + 0x20]
call fcn.1400754c0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140111870
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 3
jmp 0x140075e02
lea r14, [r12 + 0x18]
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
je 0x140075e4f
add rbx, 0x70
cmp rdi, rbx
je 0x140075e02
jmp 0x140075e3e
cmp byte [rbx + 0x27], 0
jns 0x140075e5b
mov rcx, qword [rbx + 0x10]
jmp 0x140075e5f
lea rcx, [rbx + 0x10]
call r13
test al, 0x10
jne 0x140075e44
mov r15, qword [r12 + 8]
cmp r15, qword [r12 + 0x10]
je 0x140075e8b
mov rcx, r14
mov rdx, r15
mov r8, rbx
int3
mov rcx, r12
mov rdx, rbx
int3