joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140077f80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xfff0]
mov eax, 0x100f0
call fcn.1401546a0
sub rsp, rax
mov rax, qword [0x1402e7d18]
xor rax, rsp
mov qword [rbp + 0xffe0], rax
mov rdi, rcx
cmp qword [rdx + 0x18], 8
jb 0x140077fbe
mov rdx, qword [rdx]
lea r8, [0x1402a1354]
lea rcx, [rsp + 0x78]
call fcn.14024dd78
mov ebx, eax
test eax, eax
jne 0x1400780e5
mov r9, qword [rsp + 0x78]
test r9, r9
je 0x1400780f4
xor ebx, ebx
mov dword [rbp - 0x27], ebx
mov word [rbp - 0x23], bx
mov byte [rbp - 0x21], bl
mov qword [rbp - 0x60], r9
lea rax, [rbp - 0x20]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], 0x10000
mov qword [rbp - 0x38], rbx
mov byte [rbp - 0x28], bl
mov qword [rbp - 0x30], rbx
lea edx, [rbx + 1]
mov r8d, 0x10000
lea rcx, [rbp - 0x20]
call fcn.140251ba0
mov qword [rbp - 0x38], rax
mov rdx, qword [rbp - 0x58]
lea rcx, [rdx - 1]
add rcx, rax
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rdx
cmp rax, qword [rbp - 0x50]
jae 0x14007804c
mov byte [rax + rdx], bl
inc qword [rbp - 0x48]
mov byte [rbp - 0x28], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
lea rax, [rbp - 0x60]
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], ebx
mov byte [rbp - 0x68], bl
lea rcx, [rbp - 0x80]
call fcn.14005d280
movsxd rax, dword [rbp - 0x78]
lea rcx, [0x140297838]
mov rax, qword [rcx + rax*8]
mov qword [rbp - 0x70], rax
lea rcx, [0x140064e90]
cmp rax, rcx
mov rcx, qword [rbp - 0x80]
jne 0x1400780a2
mov rax, qword [rcx + 0x20]
movsx ebx, byte [rax]
call fcn.14005a0f0
mov dword [rbp - 0x74], ebx
jmp 0x1400780ab
call qword [case.0x140047d56.0]
mov dword [rbp - 0x74], eax
lea rdx, [rbp - 0x80]
mov rcx, rdi
call fcn.140064a60
mov rcx, qword [rsp + 0x78]
call fcn.14010b9e0
mov rcx, qword [rbp + 0xffe0]
xor rcx, rsp
call fcn.140154650
lea r11, [rsp + 0x100f0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400780f4
call fcn.14010b9e0
mov edx, ebx
lea rcx, [rsp + 0x38]
call fcn.14003d7f0
nop
mov r8, rax
lea rdx, str.Could_not_open_json_file._Status:
lea rcx, [rsp + 0x58]
call fcn.140041d60
nop
mov rcx, rax
call fcn.1400062f0
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140002480
lea rdx, [0x1402e36b8]
lea rcx, [rsp + 0x20]
call fcn.140145d8c
int3
Function at 0x14007a220
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x30], 0
jne 0x14007a2c5
lea rsi, [0x1402f10b8]
mov qword [rsp + 0x20], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x28], 1
cmp qword [0x1402f10b0], 0
jne 0x14007a278
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [0x1402f1100]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
call qword [case.0x140047d56.0]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rcx, qword [0x1402f10b0]
mov rbx, qword [rcx + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rbx, rdi
je 0x14007a2c5
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14007d4c0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1402e7d18]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
mov rcx, qword [0x1402f1100]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x140047d56.0]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x58], rcx
lea r14, vtable.SqliteStatement.0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x30], ecx
add rax, 0x10
mov qword [rsp + 0x38], rax
lea rdx, str.SELECT_PIN_ACTION_FROM_PINNED_APPLICATIONS_WHERE_FILE_ID___file_id
mov qword [rsp + 0x40], rdx
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x58], cl
lea r8d, [rcx + 6]
lea rcx, [0x14029b200]
call fcn.1400e3d50
movzx ecx, byte [rsp + 0x58]
mov edx, 1
test eax, eax
cmove ecx, edx
mov byte [rsp + 0x58], cl
lea rax, vtable.TransactionSafeStatement.0
mov qword [rsp + 0x28], rax
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14002ab40
mov ebx, eax
test eax, eax
jne 0x14007d594
lea rcx, [rsp + 0x28]
call fcn.14002afd0
mov ebx, eax
lea rsi, [0x1402eb3e0]
cmp ebx, 0x64
jne 0x14007d5e2
lea r8, [rsp + 0x20]
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.14002ae60
mov edi, eax
test eax, eax
je 0x14007d5de
mov ebx, eax
mov rcx, qword [0x1402eb3e0]
cmp rcx, rsi
je 0x14007d61c
test dword [rcx + 0x44], 0x20000
je 0x14007d61c
cmp byte [rcx + 0x41], 2
jb 0x14007d61c
mov edx, 0x12
mov r9d, eax
jmp 0x14007d605
xor ebx, ebx
jmp 0x14007d615
mov rcx, qword [0x1402eb3e0]
cmp rcx, rsi
je 0x14007d61c
test dword [rcx + 0x44], 0x20000
je 0x14007d61c
cmp byte [rcx + 0x41], 2
jb 0x14007d61c
mov edx, 0x13
mov r9d, ebx
lea r8, [0x14026db38]
mov rcx, qword [rcx + 0x38]
call fcn.140038540
mov rcx, qword [0x1402eb3e0]
mov edi, dword [rsp + 0x20]
cmp edi, 3
jbe 0x14007d657
cmp rcx, rsi
je 0x14007d651
test dword [rcx + 0x44], 0x20000
je 0x14007d651
cmp byte [rcx + 0x41], 2
jb 0x14007d651
mov edx, 0x14
mov r9d, ebx
lea r8, [0x14026db38]
mov rcx, qword [rcx + 0x38]
call fcn.140038540
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x28]
call fcn.14002b150
nop
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140154650
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14007fe60
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rax, qword [rcx + 0x410]
xorps xmm0, xmm0
mov qword [rsp + 0x38], rbp
mov rsi, rcx
mov qword [rsp + 0x40], rdi
mov rbp, rdx
mov qword [rsp + 0x48], r14
xor r14d, r14d
mov rdi, qword [rcx + rax*8 + 0x418]
mov qword [rdi], r14
mov dword [rdi + 8], r14d
mov qword [rdi + 0x28], r14
movups xmmword [rdi + 0x18], xmm0
mov rcx, qword [rdi + 0x2c0]
mov dword [rdi + 0x248], 4
mov word [rdi + 0x48], r14w
mov qword [rdi + 0x2c0], r14
test rcx, rcx
je 0x14007fedc
mov qword [rsp + 0x30], rbx
mov rbx, qword [rcx + 0x40]
call fcn.1400e4e08
mov rcx, rbx
test rbx, rbx
jne 0x14007fec6
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + 0x280]
mov qword [rdi + 0x268], r14
mov qword [rdi + 0x2e0], rax
mov rdx, rbp
mov qword [rax + 0x40], r14
mov dword [rax + 0x48], r14d
mov dword [rax + 0x4c], 1
mov dword [rdi + 0x270], r14d
mov qword [rax], 0xffffffffffffffff
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rax + 0x10], 0xffffffffffffffff
mov qword [rax + 0x18], 0xffffffffffffffff
mov qword [rax + 0x20], 0xffffffffffffffff
mov qword [rax + 0x28], 0xffffffffffffffff
mov qword [rax + 0x30], 0xffffffffffffffff
mov qword [rax + 0x38], 0xffffffffffffffff
mov r8, qword [rsi + 0x410]
mov rcx, qword [rsi + 8]
mov r8, qword [rsi + r8*8 + 0x418]
call fcn.1400c1b90
mov r14, qword [rsp + 0x48]
test eax, eax
mov rax, qword [rsi + 0x410]
mov rdi, qword [rsp + 0x40]
sete cl
mov byte [rsi + rax + 0x818], cl
mov rax, qword [rsi + 0x410]
mov qword [rsi + rax*8 + 0x10], rbp
inc qword [rsi + 0x410]
mov rcx, qword [rsi + 0x410]
mov rax, qword [section..data]
mov rbp, qword [rsp + 0x38]
cmp rcx, rax
jb 0x14007ffb6
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14007f450
add rsp, 0x20
pop rsi
ret

Function at 0x140082070
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + 8]
mov rdi, rdx
test rsi, rsi
je 0x1400820db
lea rbx, [rdx + 8]
test rbx, rbx
je 0x1400820db
cmp byte [rcx + 0x4c], 0
je 0x1400820db
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1400820db
cmp byte [rdi + 0x4c], 0
je 0x1400820db
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1400820db
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140085860
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov esi, r9d
mov rbp, r8
mov rbx, rcx
mov qword [rcx], rdx
mov byte [rcx + 8], 0
movzx eax, byte [rsp + 0x60]
mov byte [rcx + 9], al
mov qword [rcx + 0x10], 0
movzx eax, byte [rsp + 0x68]
mov byte [rcx + 0x20], al
mov qword [rcx + 0x28], r8
mov dword [rcx + 0x30], r9d
lea r9, [0x14026dc30]
mov r8d, esi
mov rdx, rbp
call fcn.1400bfee0
mov rcx, qword [0x1402f1100]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
call qword [case.0x140047d56.0]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x1400858fb
xor r8d, r8d
lea rdx, str.Retrieving_thread_context_failed._Queuing
mov rcx, rbx
call fcn.1400bfe70
jmp 0x1400859ff
mov edi, 0x65
lea r14, [0x1402f10b8]
mov qword [rsp + 0x20], r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x28], 1
cmp byte [rbx + 9], 0
je 0x140085949
mov rax, qword [0x1402f10a8]
test rax, rax
jne 0x14008593c
mov qword [0x1402f10a0], rbx
mov qword [0x1402f10a8], rbx
jmp 0x140085969
mov qword [rax + 0x10], rbx
mov qword [0x1402f10a8], rbx
jmp 0x140085969
mov rax, qword [0x1402f1098]
test rax, rax
jne 0x14008595e
mov qword [0x1402f1090], rbx
jmp 0x140085962
mov qword [rax + 0x10], rbx
mov qword [0x1402f1098], rbx
mov rax, qword [0x1402f1070]
inc rax
mov qword [0x1402f1070], rax
cmp byte [0x1402f1088], 0
jne 0x14008598d
mov rcx, rbx
call fcn.14007fd90
mov edi, eax
mov byte [rsp + 0x28], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, 0x65
je 0x1400859b2
mov r8d, edi
lea rdx, str.Begin
mov rcx, rbx
call fcn.1400bfe70
lea r9, str.WAITTING
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.1400bfee0
mov rcx, qword [rbx + 0x18]
mov edx, 0xffffffff
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r9, str.ENTERED
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.1400bfee0
mov rax, qword [0x1402f1080]
inc rax
mov qword [0x1402f1080], rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140089780
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rsp + 0x28], rcx
lea rax, vtable.Component.0
mov qword [rcx], rax
mov dword [rcx + 8], 0xffffffff
xor esi, esi
mov dword [rcx + 0xc], esi
mov qword [rcx + 0x18], rdx
lea rax, [r8 + 0x98]
test r8, r8
cmove rax, rsi
mov qword [rcx + 0x20], rax
lea rax, vtable.PinningController.0
mov qword [rcx], rax
lea rax, vtable.PinningController.1.0
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x28], r8
mov qword [rcx + 0x30], rsi
mov qword [rcx + 0x38], rdx
lea rbx, [rcx + 0x40]
mov qword [rsp + 0x20], rbx
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
lfence
lea ecx, [rsi + 0x50]
call fcn.1401544fc
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rcx, [rbx + 0x10]
mov edx, 0x80000400
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
lea rax, str.pinning_sequence_number
mov qword [rdi + 0x78], rax
mov qword [rdi + 0x80], rsi
mov rax, qword [rdi + 0x38]
add rax, 0x10
lea rcx, vtable.SqliteStatement.0
mov qword [rdi + 0x88], rcx
mov dword [rdi + 0x90], esi
mov qword [rdi + 0x98], rax
lea rdx, str._SELECT_SUM_VALUE_________SELECT_VALUE_FROM_STATISTICS_WHERE_ID__1_________SELECT_SUM_CLUSTERS__FROM_SEGMENTS_WHERE______________FILE_ID__0xFFFFFF___32__OR_______________FILE_ID_IN__SELECT_FILE_ID_FROM_SYSTEM_FILES____AND___________SEGMENT_ID__0_____FROM_STATISTICS__WHERE_ID__6_OR_ID__7
mov qword [rdi + 0xa0], rdx
mov qword [rdi + 0xa8], rsi
mov qword [rdi + 0xb0], rsi
mov byte [rdi + 0xb8], sil
lea r8d, [rsi + 6]
lea rcx, [0x14029b200]
call fcn.1400e3d50
test eax, eax
jne 0x140089895
mov byte [rdi + 0xb8], 1
lea rax, vtable.TransactionSafeStatement.0
mov qword [rdi + 0x88], rax
mov edx, 0x80000400
lea rcx, [rdi + 0xc0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov qword [rdi + 0xe8], rsi
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400925a0
Capabilities:
Listen for remote procedure calls

Disassembly:
sub rsp, 0x28
mov r8d, 1
mov edx, 0x4d2
mov ecx, r8d
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
test eax, eax
jne 0x1400925c1
add rsp, 0x28
ret
mov rcx, qword [0x1402eb3e0]
lea rdx, [0x1402eb3e0]
cmp rcx, rdx
je 0x1400925fb
test dword [rcx + 0x44], 0x400000
je 0x1400925fb
cmp byte [rcx + 0x41], 2
jb 0x1400925fb
mov rcx, qword [rcx + 0x38]
lea r8, [0x14026fbc0]
mov edx, 0x1a
mov r9d, eax
call fcn.140026620
mov eax, 0x1f
add rsp, 0x28
ret
Function at 0x1400a1c50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1402e7d18]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov qword [rsp + 0x30], 0
mov rdx, qword [rcx]
lea rax, [rsp + 0x30]
mov rsi, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400a1ce5
mov rdx, qword [rsi + 8]
xor r9d, r9d
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3c], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a1ce5
mov eax, dword [rsp + 0x38]
mov dword [rdi], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140154650
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400a1fd0
Capabilities:
Set registry value

Disassembly:
jmp 0x1400a1fe0
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1402e7d18]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
lea rax, [rsp + 0x30]
mov rdx, qword [rcx]
mov rdi, rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], 0
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400a205c
mov rdx, qword [rdi + 8]
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 4]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140154650
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400a1fe0
Capabilities:
Set registry value

Disassembly:
jmp 0x1400a1fe0
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1402e7d18]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
lea rax, [rsp + 0x30]
mov rdx, qword [rcx]
mov rdi, rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], 0
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400a205c
mov rdx, qword [rdi + 8]
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 4]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140154650
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400a3c30
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov rsi, rdx
mov rbp, rcx
xor edi, edi
mov dword [rsp + 0x78], edi
cmp qword [rdx + 8], rdi
jne 0x1400a3db8
lea r15, [0x1402eb3e0]
mov rcx, qword [0x1402eb3e0]
cmp rcx, r15
je 0x1400a3c8b
test byte [rcx + 0x44], 8
je 0x1400a3c8b
cmp byte [rcx + 0x41], 4
jb 0x1400a3c8b
lea edx, [rdi + 0x2e]
lea r8, [0x140270b98]
mov rcx, qword [rcx + 0x38]
call fcn.140024250
rdtsc
shl rdx, 0x20
or rax, rdx
mov rbx, rax
lea rcx, [rbp + 0x6f0]
mov r8, r14
lea rdx, [rsp + 0x30]
call fcn.1400a0440
nop
mov rdx, rax
mov rcx, rsi
call fcn.1400341c0
nop
lea rcx, [rsp + 0x30]
call fcn.140034640
rdtsc
shl rdx, 0x20
or rax, rdx
lea rcx, [rbp + 0x568]
mov rdx, qword [rcx]
mov r9, qword [rdx + 0x38]
mov r8, rax
mov rdx, rbx
mov rax, r9
call qword [case.0x140047d56.0]
mov rcx, qword [0x1402eb3e0]
cmp rcx, r15
je 0x1400a3d3d
test byte [rcx + 0x44], 8
je 0x1400a3d3d
cmp byte [rcx + 0x41], 3
jb 0x1400a3d3d
mov rax, qword [rsi + 8]
mov qword [rsp + 0x88], rax
mov r9, qword [rsi]
mov qword [rsp + 0x78], r9
mov edi, 3
lea edx, [rdi + 0x2c]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea r8, [0x140270b98]
mov rcx, qword [rcx + 0x38]
call fcn.140025d90
mov rcx, qword [0x1402eb3e0]
test dil, 2
je 0x1400a3d57
and edi, 0xfffffffd
lea rcx, [rsp + 0x78]
call fcn.140034180
mov rcx, qword [0x1402eb3e0]
test dil, 1
je 0x1400a3d71
lea rcx, [rsp + 0x88]
call fcn.140034180
mov rcx, qword [0x1402eb3e0]
cmp qword [rsi + 8], 0
jne 0x1400a3db8
cmp rcx, r15
je 0x1400a3da2
test byte [rcx + 0x44], 8
je 0x1400a3da2
cmp byte [rcx + 0x41], 3
jb 0x1400a3da2
lea r9, [rbp + 0x10]
mov edx, 0x30
lea r8, [0x140270b98]
mov rcx, qword [rcx + 0x38]
call fcn.14002a6f0
mov eax, 0x70
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a6410
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x60
mov rax, qword [0x1402e7d18]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx]
mov rsi, r8
mov rbp, rdx
mov r14, rcx
mov rax, qword [rax + 0x28]
call qword [case.0x140047d56.0]
test eax, eax
jne 0x1400a6546
mov ecx, dword [rsi]
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r15
test ecx, ecx
je 0x1400a6524
xor r15d, r15d
cmp ecx, 6
jb 0x1400a657e
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], r15d
mov r8d, 6
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400a64a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jne 0x1400a6583
jmp 0x1400a64ad
mov eax, dword [rsp + 0x38]
sub dword [rsi], eax
mov edx, dword [rsi]
mov r8d, dword [rsp + 0x32]
lea rcx, [rdx + 6]
cmp r8, rcx
ja 0x1400a6575
movzx ecx, word [rsp + 0x30]
lea eax, [r8 - 6]
sub edx, eax
mov dword [rsp + 0x3c], eax
mov dword [rsi], edx
call fcn.1400a88f0
mov rbx, rax
test rax, rax
je 0x1400a6575
mov rax, qword [rax]
lea r8, [rsp + 0x3c]
mov rdx, rbp
mov rcx, rbx
mov rax, qword [rax + 0x30]
call qword [case.0x140047d56.0]
mov edi, eax
test eax, eax
jne 0x1400a655c
mov rax, qword [r14 + 0x28]
test rax, rax
je 0x1400a6510
mov qword [rax + 0x18], rbx
jmp 0x1400a6514
mov qword [r14 + 0x20], rbx
mov qword [r14 + 0x28], rbx
mov eax, dword [rsi]
mov ecx, eax
test eax, eax
jne 0x1400a6465
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 8]
call qword [case.0x140047d56.0]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x98]
mov r15, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140154650
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x140047d56.0]
mov eax, edi
jmp 0x1400a6534
mov edi, 0xd
mov eax, edi
jmp 0x1400a6534
mov edi, 0x452
mov eax, edi
jmp 0x1400a6534

Function at 0x1400a6bb0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1402e7d18]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rcx + 0x30], 0
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
je 0x1400a6bde
mov eax, 0x4df
jmp 0x1400a6c47
mov ecx, dword [r8]
mov eax, 2
shr ecx, 1
inc ecx
mul rcx
mov qword [rdi + 0x38], rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400e59b0
mov qword [rdi + 0x30], rax
test rax, rax
jne 0x1400a6c14
mov eax, 0xe
jmp 0x1400a6c47
mov r8d, dword [rbx]
lea r9, [rsp + 0x30]
xor ecx, ecx
mov rdx, rax
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400a6c3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400a6c47
mov eax, dword [rsp + 0x30]
sub dword [rbx], eax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140154650
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400a6c60
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov r9, r8
mov qword [rsp + 0x20], 0
mov r8d, dword [rcx + 0x38]
mov rax, rdx
mov rdx, qword [rcx + 0x30]
mov rcx, rax
lea r8d, [r8*2 + 2]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400a6c9b
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add rsp, 0x38
ret

Function at 0x1400a7370
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1402e7d18]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rax, rdx
mov dword [rsp + 0x30], r8d
lea rdx, [rcx + 0x30]
mov qword [rsp + 0x20], r8
mov rcx, rax
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400a73cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140154650
add rsp, 0x40
pop rbx
ret
mov eax, dword [rsp + 0x30]
sub dword [rbx], eax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140154650
add rsp, 0x40
pop rbx
ret

Function at 0x1400a73f0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rax, rdx
mov qword [rsp + 0x20], 0
lea rdx, [rcx + 0x30]
mov r9, r8
mov rcx, rax
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400a7425
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add rsp, 0x38
ret