joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a8490
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and qword [rax + 8], 0
lea r9, [rax + 8]
lea rdx, [0x140169c10]
mov r8d, 0x60019
xor ecx, ecx
xor esi, esi
call fcn.1400a73ac
mov edi, eax
test eax, eax
jns 0x1400a8510
cmp eax, 0xc0000034
jne 0x1400a84ce
xor edi, edi
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400a84e1
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
test rsi, rsi
je 0x1400a84fe
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x20
pop rdi
ret
mov ecx, 0xf003f
call fcn.1400a6dc4
mov rbx, qword [rsp + 0x30]
mov rsi, rax
test rax, rax
jne 0x1400a852e
mov edi, 0xc0000001
jmp 0x1400a84d3
mov r8, rax
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtSetSecurityObject]
mov edi, eax
test eax, eax
js 0x1400a84d3
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
lea rdx, [0x140169c10]
mov r8d, 0xf003f
xor ecx, ecx
call fcn.1400a73ac
mov edi, eax
test eax, eax
js 0x1400a84ce
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov edi, eax
jmp 0x1400a84d3
Function at 0x1400a8df4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
test rcx, rcx
jne 0x1400a8e21
lea edx, [rcx + 0x3b]
lea r8, [0x140009540]
lea rcx, [0x140009550]
call fcn.1400a8be8
and qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
xor edi, edi
mov rcx, rbx
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x58], rdi
call fcn.1400a97c0
mov ebx, eax
test eax, eax
js 0x1400a8eff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, reloc.ADVAPI32.dll_TraceEvent
jne 0x1400a8e80
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x80070005
jne 0x1400a8eff
mov ebx, 0x80780047
jmp 0x1400a8eff
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x58]
lea rdx, [0x140009578]
call fcn.1400a9ab8
mov ebx, eax
test eax, eax
js 0x1400a8efa
and qword [rsp + 0x30], rdi
mov rdi, qword [rsp + 0x58]
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], reloc.ADVAPI32.dll_TraceEvent
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400a8eff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x80780047
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x80070005
cmove ecx, ebx
mov ebx, ecx
jmp 0x1400a8eff
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rsi, 0xffffffffffffffff
je 0x1400a8f22
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400ac130
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor r12d, r12d
mov r15, rdx
lea r9, [rax + 0x10]
mov qword [rdx], r12
xor r8d, r8d
xor edx, edx
mov r14, rcx
mov ebx, r12d
mov dword [rax + 0x18], r12d
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x1400ac18d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x1400ac18d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400ac246
mov ecx, dword [rsp + 0x68]
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rbp, rax
test rax, rax
jne 0x1400ac1ac
mov ebx, 0x8007000e
jmp 0x1400ac24a
mov r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x70]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x1400ac1dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400ac23d
or rsi, 0xffffffffffffffff
inc rsi
cmp word [rbp + rsi*2], r12w
jne 0x1400ac1e0
test esi, esi
je 0x1400ac23d
lea eax, [rsi + 1]
mov ebx, eax
lea rcx, [rax + rax]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
jne 0x1400ac20d
mov ebx, 0x8007000e
jmp 0x1400ac23d
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call fcn.140052508
mov ebx, eax
test eax, eax
js 0x1400ac22f
lea ecx, [rsi - 1]
mov word [rdi + rcx*2], r12w
mov qword [r15], rdi
mov rdi, r12
test rdi, rdi
je 0x1400ac23d
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test ebx, ebx
jns 0x1400ac285
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1400ac285
test byte [rcx + 0x1c], 1
je 0x1400ac285
cmp byte [rcx + 0x19], 3
jb 0x1400ac285
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009d20]
mov edx, 0xa
mov r9, r14
mov dword [rsp + 0x20], ebx
call fcn.14001ecbc
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400ac2a4
Capabilities:
Get disk size

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push r13
push r14
sub rsp, 0x40
and qword [rdx], 0
and qword [rax + 0x18], 0
mov rsi, rdx
lea rdx, [rax + 0x18]
mov r14, rcx
call fcn.1400a987c
lea r13, [0x14017d3a8]
mov ebx, eax
test eax, eax
js 0x1400ac414
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x80]
and dword [rsp + 0x28], 0
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400ac369
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x1400ac356
test byte [rcx + 0x1c], 1
je 0x1400ac356
cmp byte [rcx + 0x19], 2
jb 0x1400ac356
mov r9, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0xc]
lea r8, [0x140009d20]
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
jmp 0x1400ac41b
xor eax, eax
xor r9d, r9d
xor r8d, r8d
and qword [rsp + 0x38], rax
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
mov edx, 0x7405c
mov rcx, rbp
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400ac400
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x1400ac3f0
test byte [rcx + 0x1c], 1
je 0x1400ac3f0
cmp byte [rcx + 0x19], 2
jb 0x1400ac3f0
mov r9, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009d20]
mov edx, reloc.ADVAPI32.dll_GetTraceLoggerHandle
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
jmp 0x1400ac40b
mov rax, qword [rsp + 0x88]
mov qword [rsi], rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14017d3a8]
cmp qword [rsp + 0x80], 0
je 0x1400ac43b
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
test ebx, ebx
jns 0x1400ac46f
cmp rcx, r13
je 0x1400ac46f
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x1400ac46f
cmp byte [rcx + 0x19], 2
jb 0x1400ac46f
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009d20]
mov edx, reloc.ADVAPI32.dll_GetTraceEnableLevel
mov r9, r14
mov dword [rsp + 0x20], ebx
call fcn.14001ecbc
mov eax, ebx
add rsp, 0x40
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400ad320
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x50
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
lea r12, [0x140009d20]
mov ebp, 1
cmp rcx, r14
je 0x1400ad384
test byte [rcx + 0x1c], bpl
je 0x1400ad384
cmp byte [rcx + 0x19], 4
jb 0x1400ad384
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x17]
mov r8, r12
call fcn.14001dd24
xor ebx, ebx
lea rcx, [rsp + 0x20]
xor edx, edx
lea edi, [rbx + 0x20]
mov r8d, edi
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
lea ecx, [rbx + 0x5a]
xor r9d, r9d
mov r8d, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x1400ad3f1
mov ecx, eax
call fcn.14005246c
mov ebx, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, r14
je 0x1400ad494
test byte [rcx + 0x1c], 8
je 0x1400ad472
cmp byte [rcx + 0x19], 2
jb 0x1400ad472
mov rcx, qword [rcx + 0x10]
lea edx, [rdi - 7]
mov r9d, eax
mov r8, r12
call fcn.14001de24
jmp 0x1400ad46b
mov rcx, qword [0x14017d3a8]
cmp rcx, r14
je 0x1400ad426
test byte [rcx + 0x1c], bpl
je 0x1400ad426
cmp byte [rcx + 0x19], 4
jb 0x1400ad426
mov r9d, dword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
mov edx, 0x1a
mov r8, r12
call fcn.14001de24
mov rcx, qword [0x14017d3a8]
cmp dword [rsp + 0x30], 2
movzx edi, bl
cmove edi, ebp
cmp rcx, r14
je 0x1400ad468
test byte [rcx + 0x1c], bpl
je 0x1400ad468
cmp byte [rcx + 0x19], 4
jb 0x1400ad468
mov rcx, qword [rcx + 0x10]
lea rax, [0x140003f90]
test dil, dil
lea r9, [0x140003f98]
mov edx, 0x1b
mov r8, r12
cmovne r9, rax
call fcn.14001ec40
mov byte [rsi], dil
mov rcx, qword [0x14017d3a8]
cmp rcx, r14
je 0x1400ad494
test byte [rcx + 0x1c], bpl
je 0x1400ad494
cmp byte [rcx + 0x19], 4
jb 0x1400ad494
mov rcx, qword [rcx + 0x10]
mov edx, 0x1c
mov r8, r12
call fcn.14001dd24
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140168920
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x1400ad628
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
test rcx, rcx
jne 0x1400ad65e
lea r8, [0x140005858]
lea rcx, [0x140009ba0]
mov edx, 0x6a8
call fcn.1400a8be8
test r14, r14
jne 0x1400ad67b
lea r8, [0x140009d00]
lea rcx, [0x140009ba0]
mov edx, 0x6a9
call fcn.1400a8be8
and qword [rsp + 0x60], 0
lea rdx, [rsp + 0x60]
xor ebx, ebx
mov rcx, rdi
xor r15b, r15b
mov qword [rsp + 0x68], rbx
call fcn.1400a97c0
mov edi, eax
test eax, eax
js 0x1400ad761
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [0x140004ed0]
call fcn.1400a9ab8
mov edi, eax
test eax, eax
js 0x1400ad75c
and qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], reloc.ADVAPI32.dll_TraceEvent
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400ad745
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400ad748
cmp eax, 3
je 0x1400ad748
mov rcx, qword [0x14017d3a8]
lea rdx, [0x14017d3a8]
cmp rcx, rdx
je 0x1400ad761
test byte [rcx + 0x1c], 1
je 0x1400ad761
cmp byte [rcx + 0x19], 2
jb 0x1400ad761
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x23]
lea r8, [0x140009d20]
mov r9, rbx
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
jmp 0x1400ad761
mov r15b, 1
mov byte [r14], r15b
cmp rbp, 0xffffffffffffffff
je 0x1400ad761
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400ad761
mov rbx, qword [rsp + 0x68]
cmp qword [rsp + 0x60], 0
je 0x1400ad774
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rbx, rbx
je 0x1400ad782
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400b001c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x1400b0063
lea r8, [0x140009e90]
lea rcx, [0x140009d40]
mov edx, 0x7a0
call fcn.1400a8be8
test rsi, rsi
jne 0x1400b0080
lea r8, [0x140009ea8]
lea rcx, [0x140009d40]
mov edx, 0x7a1
call fcn.1400a8be8
and qword [rsi], 0
lea rcx, [rsp + 0x30]
xor edi, edi
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x20], rdi
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x240]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x1400b00e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400b0174
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x1400b0151
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x1400b0176
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1400b014a
test byte [rcx + 0x1c], 1
je 0x1400b014a
cmp byte [rcx + 0x19], 2
jb 0x1400b014a
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x3e]
lea r8, [0x140009f38]
call fcn.14001dd24
mov ebx, 0x8000ffff
jmp 0x1400b0174
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x240]
xor r8d, r8d
call fcn.1400a99e4
mov rdi, qword [rsp + 0x20]
mov ebx, eax
test eax, eax
js 0x1400b0178
mov qword [rsi], rdi
test ebx, ebx
jns 0x1400b0181
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140168920
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400b0234
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x1400b0260
lea r8, [0x140009ec0]
lea rcx, [0x140009d40]
mov edx, 0x817
call fcn.1400a8be8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, reloc.ADVAPI32.dll_TraceEvent
jne 0x1400b02e3
xor r9d, r9d
xor r8d, r8d
mov dl, dil
mov rcx, rbx
call fcn.1400ad9cc
test eax, eax
js 0x1400b02e5
mov edx, 0x2000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1400b02e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1400b02d4
test byte [rcx + 0x1c], 2
je 0x1400b02d4
cmp byte [rcx + 0x19], 2
jb 0x1400b02d4
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009f38]
mov edx, 0x40
mov r9d, ebx
call fcn.14001de24
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1400b02e5
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b08b8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r14, rdx
mov rsi, rcx
mov rcx, qword [0x14017d3a8]
lea r13, [0x14017d3a8]
lea r12, [0x14000a328]
cmp rcx, r13
je 0x1400b0912
test byte [rcx + 0x1c], 1
je 0x1400b0912
cmp byte [rcx + 0x19], 4
jb 0x1400b0912
mov rcx, qword [rcx + 0x10]
mov edx, 0xa
mov r8, r12
call fcn.14001dd24
xor ebx, ebx
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov edi, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
test eax, eax
jne 0x1400b096d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
mov ebx, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x1400b0a21
test byte [rcx + 0x1c], 1
je 0x1400b0a21
cmp byte [rcx + 0x19], 2
jb 0x1400b0a21
lea edx, [rdi + 0xb]
jmp 0x1400b09d5
mov rcx, rbp
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
jne 0x1400b098b
mov ebx, 0x8007000e
jmp 0x1400b0a21
mov r8d, ebp
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1400b09ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
mov ebx, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x1400b0a21
test byte [rcx + 0x1c], 1
je 0x1400b0a21
cmp byte [rcx + 0x19], 2
jb 0x1400b0a21
mov edx, reloc.ADVAPI32.dll_GetTraceLoggerHandle
mov rcx, qword [rcx + 0x10]
mov r9, rsi
mov r8, r12
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
jmp 0x1400b0a21
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x1400b0a1b
test byte [rcx + 0x1c], 1
je 0x1400b0a1b
cmp byte [rcx + 0x19], 4
jb 0x1400b0a1b
mov rcx, qword [rcx + 0x10]
mov edx, reloc.ADVAPI32.dll_GetTraceEnableLevel
mov r9, rsi
mov r8, r12
mov qword [rsp + 0x20], rdi
call fcn.14001ed50
mov qword [r14], rdi
mov rdi, rbx
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x1400b0a53
test byte [rcx + 0x1c], 1
je 0x1400b0a53
cmp byte [rcx + 0x19], 4
jb 0x1400b0a53
mov rcx, qword [rcx + 0x10]
mov edx, reloc.ADVAPI32.dll_GetTraceEnableFlags
mov r8, r12
call fcn.14001dd24
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x1400b0a7c
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and dword [rax + 0x10], 0
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 5]
lea r8, [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x1400b0abe
lea r8, [0x140009f78]
lea rcx, [0x140009f80]
mov edx, InitializeCriticalSection
call fcn.1400a8be8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x800700ea
jne 0x1400b0b4f
mov ecx, dword [rsp + 0x38]
xor ebx, ebx
inc ecx
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
jne 0x1400b0afa
mov ebx, 0x8007000e
jmp 0x1400b0b4f
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov rcx, rax
inc r8d
add r8, r8
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x38]
mov rdx, rdi
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x1400b0b3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400b0b41
mov qword [rsi], rdi
xor edi, edi
test rdi, rdi
je 0x1400b0b4f
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b1184
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, r9
mov r14, r8
mov rsi, rdx
mov r12, rcx
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1400b11da
test byte [rcx + 0x1c], 1
je 0x1400b11da
cmp byte [rcx + 0x19], 4
jb 0x1400b11da
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x18
call fcn.14001dd24
mov r15, qword [rsp + 0x90]
xor ebx, ebx
and dword [rsp + 0x30], ebx
and dword [rsp + 0x80], ebx
test r14, r14
je 0x1400b1203
test rsi, rsi
je 0x1400b1203
test rbp, rbp
je 0x1400b1203
test r15, r15
jne 0x1400b121b
lea r8, [0x14000a030]
lea rcx, [0x140009f80]
mov edx, 0x1c0
call fcn.1400a8be8
and qword [r14], rbx
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbx
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400b12a0
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017d3a8]
lea rbp, [0x14017d3a8]
cmp rcx, rbp
je 0x1400b13d1
test byte [rcx + 0x1c], 1
je 0x1400b13ab
cmp byte [rcx + 0x19], 3
jb 0x1400b13ab
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x19
mov r9, rsi
mov dword [rsp + 0x20], ebx
call fcn.14001ecbc
jmp 0x1400b13a4
mov eax, dword [rsp + 0x80]
test eax, eax
jne 0x1400b12ca
lea r8, [0x14000a080]
lea rcx, [0x140009f80]
mov edx, 0x1ce
call fcn.1400a8be8
mov eax, dword [rsp + 0x80]
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
jne 0x1400b12eb
mov ebx, 0x8007000e
lea rbp, [0x14017d3a8]
jmp 0x1400b13a4
mov r8d, dword [rsp + 0x80]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x80]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400b1372
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017d3a8]
lea rbp, [0x14017d3a8]
cmp rcx, rbp
je 0x1400b1396
test byte [rcx + 0x1c], 1
je 0x1400b1396
cmp byte [rcx + 0x19], 2
jb 0x1400b1396
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x1a
mov r9, rsi
mov dword [rsp + 0x20], ebx
call fcn.14001ecbc
jmp 0x1400b138f
mov eax, dword [rsp + 0x30]
mov qword [r14], rdi
xor edi, edi
mov dword [rbp], eax
mov eax, dword [rsp + 0x80]
lea rbp, [0x14017d3a8]
mov dword [r15], eax
mov rcx, qword [0x14017d3a8]
test rdi, rdi
je 0x1400b13ab
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
cmp rcx, rbp
je 0x1400b13d1
test byte [rcx + 0x1c], 1
je 0x1400b13d1
cmp byte [rcx + 0x19], 4
jb 0x1400b13d1
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x1b
call fcn.14001dd24
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400b15a0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x50
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov rcx, qword [0x14017d3a8]
lea rbp, [0x14017d3a8]
cmp rcx, rbp
je 0x1400b15f5
test byte [rcx + 0x1c], 1
je 0x1400b15f5
cmp byte [rcx + 0x19], 4
jb 0x1400b15f5
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x1f
call fcn.14001dd24
xor ebx, ebx
xor eax, eax
lea r8, [rsp + 0x38]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x34]
lea r9d, [rbx + 0xc]
lea edx, [rbx + 5]
mov rcx, rdi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
call qword [sym.imp.ntdll.dll_NtQueryKey]
test eax, eax
jns 0x1400b1659
mov ecx, eax
call fcn.14005246c
mov ebx, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, rbp
je 0x1400b16e6
test byte [rcx + 0x1c], 1
je 0x1400b16c0
cmp byte [rcx + 0x19], 2
jb 0x1400b16c0
mov edx, 0x20
jmp 0x1400b16a6
mov eax, dword [rsp + 0x40]
mov r9d, 4
lea r8, [rsp + 0x30]
or eax, 0xe
lea edx, [r9 - 2]
mov rcx, rdi
mov dword [rsp + 0x30], eax
call qword [sym.imp.ntdll.dll_NtSetInformationKey]
test eax, eax
jns 0x1400b16b9
mov ecx, eax
call fcn.14005246c
mov ebx, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, rbp
je 0x1400b16e6
test byte [rcx + 0x1c], 1
je 0x1400b16c0
cmp byte [rcx + 0x19], 2
jb 0x1400b16c0
mov edx, 0x21
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov r9d, eax
call fcn.14001de24
mov rcx, qword [0x14017d3a8]
cmp rcx, rbp
je 0x1400b16e6
test byte [rcx + 0x1c], 1
je 0x1400b16e6
cmp byte [rcx + 0x19], 4
jb 0x1400b16e6
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x22
call fcn.14001dd24
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140168920
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret