joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff34467a18
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push r12
push r13
push r14
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov r12, rdx
mov r14, rcx
xor edi, edi
mov ebx, edi
mov rax, qword [str.lCH4]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rdi
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rdi
mov rax, qword [rdx]
mov r13d, dword [rax - 8]
mov esi, edi
cmp esi, r13d
jge 0x7ff34467ade
movsxd rcx, esi
mov rax, qword [r12]
cmp word [rax + rcx*2], 0x5c
je 0x7ff34467a7e
cmp word [rax + rcx*2], 0x2f
jne 0x7ff34467ada
lea r8, [rsp + 0x28]
mov edx, esi
mov rcx, r12
call fcn.7ff3444dacc
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.7ff34467758
mov ebx, eax
cmp eax, edi
jl 0x7ff34467ade
mov rbx, rdi
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x7ff34467ac0
test al, 0x10
cmovne rbx, qword [rsp + 0x28]
mov rdx, rbx
mov rcx, qword [rsp + 0x38]
call fcn.7ff34467804
mov ebx, eax
cmp eax, edi
jge 0x7ff34467ada
cmp eax, 0xc0000035
jne 0x7ff34467ade
inc esi
jmp 0x7ff34467a64
lea rcx, [rsp + 0x38]
call fcn.7ff3444cfe4
nop
lea rcx, [rsp + 0x28]
call fcn.7ff3444cfe4
nop
jmp 0x7ff34467afc
cmp ebx, 0xc0000035
cmove ebx, edi
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret

Function at 0x7ff34467b28
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rdx, [rcx + 8]
mov rdi, rcx
call fcn.7ff34467a18
xor esi, esi
cmp eax, esi
mov ebx, eax
jl 0x7ff34467b75
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 8]
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, 0xc0000034
cmp eax, esi
cmove ebx, ecx
cmp ebx, esi
setge sil
mov dword [rdi + 0x30], esi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff34468eec
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, r8
mov rbp, rdx
mov dword [r8], ebx
mov rdi, rcx
mov qword [rax + 8], rbx
cmp qword [rcx + 0x90], rbx
jne 0x7ff34468f54
lea r9, [rax + 8]
add rcx, 0x98
xor edx, edx
mov r8d, 0xf003f
call fcn.7ff34471538
cmp eax, ebx
je 0x7ff34468f3e
mov eax, 0xc8008000
jmp 0x7ff34468f93
mov rax, qword [rsp + 0x40]
mov dword [rdi + 0x88], 1
mov qword [rdi + 0x90], rax
mov rcx, qword [rdi + 0x90]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x7ff34468f86
mov dword [rsi], 1
inc dword [0x7ff34485200]
jmp 0x7ff34468f91
mov ecx, 0xc0000001
cmp eax, 2
cmovne ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff34468fb0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [rcx + 0x58]
mov dword [rax + 0x18], ebx
mov dword [rax + 8], ebx
mov rdi, rbx
cmp rcx, rbx
jne 0x7ff34468fde
xor eax, eax
jmp 0x7ff34469084
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x7ff34468fd7
cmp eax, ebx
jne 0x7ff3446906d
mov ecx, dword [rsp + 0x40]
call fcn.7ff3444f574
mov rdi, rax
cmp rax, rbx
jne 0x7ff3446901e
mov ebx, 0xc0000017
jmp 0x7ff3446907a
mov rcx, qword [rsi + 0x58]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x7ff3446906d
mov eax, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x50]
mov rcx, qword [rsi + 0x90]
mov dword [rsp + 0x28], eax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x7ff34469074
mov ebx, 0xc0000001
jmp 0x7ff3446907a
inc dword [0x7ff34485204]
mov rcx, rdi
call fcn.7ff3444f5a0
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff3446fe70
Capabilities:
Set environment variable

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
test ecx, ecx
je 0x7ff3446ffe9
sub ecx, 1
je 0x7ff3446fef3
sub ecx, 1
je 0x7ff3446feaa
cmp ecx, 1
jne 0x7ff3446ffe9
mov ecx, dword [0x7ff344841c4]
call fcn.7ff344740d4
jmp 0x7ff3446ffe9
lea rdx, [0x7ff34441678]
lea rcx, [rsp + 0x28]
call fcn.7ff3444d158
nop
lea rax, [0x7ff34446320]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x68]
mov ecx, dword [0x7ff344841c4]
call fcn.7ff34474060
nop
lea rcx, [rsp + 0x28]
call fcn.7ff3444cfe4
nop
jmp 0x7ff3446ffe9
lea rdx, [0x7ff34446720]
lea rcx, [0x7ff34446758]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x7ff34446768]
lea rcx, [0x7ff344467a0]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call fcn.7ff34469908
test eax, eax
jne 0x7ff3446ff3a
lea rdx, [0x7ff34444f68]
lea ecx, [rax + 1]
call fcn.7ff3446a4dc
xor eax, eax
jmp 0x7ff3446ffee
call fcn.7ff34470f30
nop
mov rdx, qword [0x7ff34484328]
lea rcx, [rsp + 0x38]
call fcn.7ff3444d158
nop
lea rax, [0x7ff34446320]
mov qword [rsp + 0x68], rax
mov ecx, 0x38
call fcn.7ff3444f574
test rax, rax
je 0x7ff3446ffa0
mov ecx, 0x5c
mov word [rax], cx
and dword [rax + 4], 0
and dword [rax + 8], 0
mov rcx, qword [str.lCH4]
mov qword [rax + 0x10], rcx
and qword [rax + 0x18], 0
and qword [rax + 0x20], 0
and dword [rax + 0x28], 0
and dword [rax + 0x2c], 0
and dword [rax + 0x30], 0
jmp 0x7ff3446ffa2
xor eax, eax
mov qword [0x7ff344854d8], rax
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x68]
mov ecx, dword [0x7ff344841c4]
call fcn.7ff34474060
mov ebx, eax
lea rcx, [rsp + 0x38]
call fcn.7ff3444cfe4
test ebx, ebx
jns 0x7ff3446ffe3
lea rdx, [0x7ff34444fd0]
mov ecx, 1
call fcn.7ff3446a4dc
xor eax, eax
jmp 0x7ff3446ffee
jmp 0x7ff3446ffe9
mov eax, 1
add rsp, 0x50
pop rbx
ret
Function at 0x7ff34471e0c
Capabilities:
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov esi, 1
mov r14, r9
mov r12d, r8d
mov r13, rdx
mov rbx, rcx
cmp r8d, esi
jne 0x7ff34471eba
cmp byte [rcx + 0x60], 0
je 0x7ff34471eba
cmp byte [rcx + 0x61], 0
je 0x7ff34471e54
call fcn.7ff34472294
mov byte [rbx + 0x61], 0
xor ebp, ebp
cmp dword [rbx + 0x108], ebp
jle 0x7ff34471eb6
lea rdi, [rbx + 0x128]
cmp byte [rdi + 4], 0
jne 0x7ff34471ea8
cmp dword [rdi], 0
je 0x7ff34471ea4
movsxd rax, ebp
mov rcx, rbx
shl rax, 5
lea rdx, [rax + rbx + 0x110]
call fcn.7ff34472690
mov r11d, dword [rbx + 8]
test dword [rdi], r11d
je 0x7ff34471ea4
mov rdx, qword [rdi - 0x18]
lea r8, [rsp + 0x20]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov byte [rdi + 4], sil
add ebp, esi
add rdi, 0x20
cmp ebp, dword [rbx + 0x108]
jl 0x7ff34471e65
mov byte [rbx + 0x60], 0
mov ecx, dword [0x7ff34484224]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor r11d, r11d
xor ecx, ecx
lea rdx, [rbx + 0x110]
cmp ecx, dword [rbx + 0x108]
jge 0x7ff34471efc
cmp r13, qword [rdx]
jne 0x7ff34471ef1
movsxd rax, ecx
shl rax, 5
lea r11, [rax + rbx + 0x110]
add ecx, esi
add rdx, 0x20
test r11, r11
je 0x7ff34471ed5
test r11, r11
je 0x7ff34471f3a
test r12d, r12d
jne 0x7ff34471f0f
mov eax, dword [r11 + 0x18]
test dword [rbx + 4], eax
jne 0x7ff34471f2a
mov rax, qword [r11 + 0x10]
test rax, rax
je 0x7ff34471f25
mov r8, r14
mov edx, r12d
mov rcx, r13
call rax
mov esi, eax
test r12d, r12d
jne 0x7ff34471f3a
test r14, r14
je 0x7ff34471f3a
mov rdx, r13
mov rcx, rbx
call fcn.7ff34472158
mov ecx, dword [0x7ff34484224]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop r13
pop r12
ret

Function at 0x7ff34472060
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rdi, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
jmp 0x7ff3447209a
cmp rax, r9
je 0x7ff3447209f
lea rbx, [rax - 0x10]
cmp qword [rbx + 0x30], rdx
je 0x7ff344720a1
mov rax, qword [rbx + 0x10]
test rax, rax
jne 0x7ff34472087
xor ebx, ebx
test rbx, rbx
je 0x7ff34472146
movsxd rax, dword [rcx + 0x108]
cmp eax, 0x200
jae 0x7ff34472146
shl rax, 5
mov qword [rax + rcx + 0x110], rdx
movsxd rax, dword [rdi + 0x108]
mov ecx, dword [rbx + 0x40]
add rcx, rdx
shl rax, 5
mov qword [rax + rdi + 0x118], rcx
movsxd rcx, dword [rdi + 0x108]
mov rax, qword [rbx + 0x38]
add rcx, 9
shl rcx, 5
mov qword [rcx + rdi], rax
mov rdx, qword [rbx + 0x60]
mov rcx, rdi
call fcn.7ff3447255c
movsxd rcx, dword [rdi + 0x108]
shl rcx, 5
mov dword [rcx + rdi + 0x128], eax
movsxd rax, dword [rdi + 0x108]
shl rax, 5
mov byte [rax + rdi + 0x12c], 0
inc dword [rdi + 0x108]
lock add dword [0x7ff344854a4], 1
lea rax, [0x7ff34471f70]
mov qword [rbx + 0x38], rax
mov byte [rdi + 0x60], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff34472294
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rsi, dword [rcx + 0x108]
mov rbx, rcx
xor edi, edi
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
add rax, 0x20
test rdi, rdi
jne 0x7ff344722cc
mov rdi, qword [rax]
cmp rdi, rax
je 0x7ff3447238a
movsxd r9, dword [rbx + 0x108]
lea rdx, [rdi - 0x10]
mov r8, qword [rdx + 0x30]
mov r10d, dword [rdx + 0x40]
mov rdi, qword [rdx + 0x10]
cmp r9d, 0x200
jae 0x7ff344722af
xor ecx, ecx
test rsi, rsi
jle 0x7ff34472314
lea rax, [rbx + 0x110]
cmp qword [rax], r8
je 0x7ff344722af
inc rcx
add rax, 0x20
cmp rcx, rsi
jl 0x7ff34472303
lea rcx, [r8 + r10]
mov rax, r9
shl rax, 5
mov qword [rax + rbx + 0x110], r8
movsxd rax, dword [rbx + 0x108]
shl rax, 5
mov qword [rax + rbx + 0x118], rcx
movsxd rax, dword [rbx + 0x108]
mov rcx, rbx
add rax, 9
shl rax, 5
and qword [rax + rbx], 0
mov rdx, qword [rdx + 0x60]
call fcn.7ff3447255c
movsxd rcx, dword [rbx + 0x108]
shl rcx, 5
mov dword [rcx + rbx + 0x128], eax
movsxd rax, dword [rbx + 0x108]
shl rax, 5
mov byte [rax + rbx + 0x12c], 0
inc dword [rbx + 0x108]
jmp 0x7ff344722af
mov rsi, qword [rsp + 0x38]
mov byte [rbx + 0x60], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff34472848
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rbp, rcx
lea rcx, [0x7ff344852a0]
mov r13, r9
mov r12d, r8d
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x7ff344852c8]
xor edi, edi
lea r8, [0x7ff34446aa0]
lea rcx, [0x7ff34441840]
lea edx, [rdi + 9]
mov r9, rbp
mov qword [rsp + 0x20], rsi
call fcn.7ff3444bb30
test rbx, rbx
je 0x7ff344728ba
cmp qword [rbx], rbp
jne 0x7ff344728b0
cmp qword [rbx + 8], rsi
je 0x7ff344728b6
mov rbx, qword [rbx + 0x18]
jmp 0x7ff344728a0
mov rdi, qword [rbx + 0x10]
lea r8, [0x7ff34446ad8]
lea rcx, [0x7ff34441840]
mov r9, rdi
mov edx, 9
call fcn.7ff3444bb30
test rdi, rdi
jne 0x7ff344728ff
test r12d, r12d
je 0x7ff344728ff
lea r8, [0x7ff34446af0]
lea edx, [rdi + 1]
lea rcx, [0x7ff34441840]
call fcn.7ff3444bb30
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
int3
lea rcx, [0x7ff344852a0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rax, rdi
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x7ff344732a4
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rdx
mov rax, qword [str.lCH4]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x40], 0
inc dword [0x7ff34485328]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov qword [rsp + 0x20], rbx
mov r8d, dword [0x7ff34485328]
lea rdx, [0x7ff34446f08]
lea rcx, [rsp + 0x38]
call fcn.7ff3444db38
mov rdx, qword [0x7ff34485330]
test rdx, rdx
je 0x7ff34473310
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fputws]
jmp 0x7ff34473315
mov rbx, qword [rsp + 0x38]
cmp dword [0x7ff3448532c], 0
je 0x7ff34473328
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
lea rcx, [rsp + 0x38]
call fcn.7ff3444cfe4
nop
add rsp, 0x50
pop rbx
ret
Function at 0x7ff34474060
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov ebx, ecx
call fcn.7ff344740d4
cmp ebx, 0xffffffff
je 0x7ff344740b8
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov rdi, rax
test rax, rax
jne 0x7ff34474099
mov eax, 0xc0000017
jmp 0x7ff344740bd
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rdx, rsi
mov rcx, rdi
mov dword [rdi + 0x20], 1
call fcn.7ff34473ee4
jmp 0x7ff344740bd
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff344740d4
Capabilities:
Set thread local storage value

Disassembly:
cmp ecx, 0xffffffff
je 0x7ff34474107
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.7ff34474110
test rax, rax
je 0x7ff344740f8
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x20
pop rbx
ret

Function at 0x7ff34474110
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
cmp ecx, 0xffffffff
je 0x7ff3447414d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x7ff3447414d
cmp dword [rax + 0x24], 0
mov rdi, rax
je 0x7ff3447414d
mov rax, qword [rax]
mov rcx, rbx
call qword [rax + 0x30]
test eax, eax
jns 0x7ff34474149
xor eax, eax
jmp 0x7ff34474150
and dword [rbx + 0x24], 0
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff34474690
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
xor ebx, ebx
lea r8, [0x7ff34441788]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdx
mov rdx, rcx
xor ecx, ecx
mov r9d, 0x104
call qword [sym.imp.KERNEL32.dll_SearchPathW]
cmp eax, ebx
jne 0x7ff344746e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov ebx, eax
jmp 0x7ff3447470e
cmp eax, 0x104
jb 0x7ff344746ef
mov ebx, 0x8007006f
jmp 0x7ff3447470e
cmp rdi, rbx
je 0x7ff34474709
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x7ff34474709
and eax, 0x10
cmp al, bl
je 0x7ff3447470e
mov ebx, 0x80070002
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff34474d28
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
and qword [rcx], 0
and dword [rcx + 8], 0
mov rbx, rcx
lea rcx, [0x7ff34442e20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
and dword [rbx + 0x48], 0
and qword [rbx + 0x10], 0
and qword [rbx + 0x28], 0
and qword [rbx + 0x30], 0
and qword [rbx + 0x18], 0
and qword [rbx + 0x20], 0
mov qword [rbx + 0x38], rax
test rax, rax
je 0x7ff34474dea
lea rdx, [0x7ff34447950]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, [0x7ff34447968]
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, [0x7ff34447980]
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, [0x7ff34447998]
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x38]
lea rdx, [0x7ff344479b0]
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x20], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x7ff34474dea
lea rcx, [rbx + 0x40]
call rax
mov dword [rbx + 0x48], 1
and dword [rbx + 0x50], 0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x7ff34474f20
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp qword [0x7ff34484b78], rbx
jne 0x7ff3447503a
lea r8, [0x7ff34447a18]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x7ff34484b78], rax
test rax, rax
je 0x7ff34475026
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x7ff34474f79
mov rcx, qword [0x7ff34484b78]
call sub.iertutil.dll_Ordinal_50
mov ebx, eax
test eax, eax
js 0x7ff3447500f
mov r8d, 4
lea rax, [0x7ff34447a58]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], r8d
mov dword [0x7ff34484b90], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [0x7ff34484b80], rax
test rax, rax
je 0x7ff34474fe7
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x7ff34484b88], rax
test rax, rax
je 0x7ff34474fe7
mov rcx, qword [0x7ff34484b80]
call sub.iertutil.dll_Ordinal_50
mov ebx, eax
jmp 0x7ff34474ffb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x7ff3447503a
lea rcx, [0x7ff34484b80]
call fcn.7ff34477028
test ebx, ebx
jns 0x7ff3447503a
mov rcx, qword [0x7ff34484b78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x7ff34484b78], 0
jmp 0x7ff3447503a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff344750e4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rax, [r11 + 0x18]
mov rbx, rdx
mov rsi, r9
mov qword [r11 - 0x30], rax
lea rax, [r11 - 0x20]
mov rbp, r8
lea r9, [r11 + 0x20]
lea rdx, [0x7ff344478d0]
xor r8d, r8d
mov rcx, rbx
mov qword [r11 - 0x38], rax
mov dword [rsp + 0x70], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r9, [rsp + 0x30]
lea rdx, [0x7ff344478a8]
mov edi, eax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 1
test eax, eax
jne 0x7ff34475181
cmp dword [rsp + 0x30], 4
jne 0x7ff34475181
mov r8d, dword [rsp + 0x34]
mov r9d, r8d
shr r9d, 0x13
and r9d, ebx
jmp 0x7ff34475187
xor r8d, r8d
xor r9d, r9d
and r8d, 0x81f3f
mov r11d, 0xf
mov eax, r8d
and eax, r11d
jl 0x7ff344751a1
cmp eax, 4
jle 0x7ff344751a5
and r8d, 0xfffffff0
mov r10, qword [rsp + 0x80]
test edi, edi
jne 0x7ff344751ff
cmp dword [rsp + 0x78], 4
mov edx, dword [rsp + 0x38]
jne 0x7ff344751f6
mov eax, edx
and eax, r11d
jl 0x7ff344751c8
cmp eax, 4
jle 0x7ff344751cd
mov edi, 0x80004005
test edi, edi
js 0x7ff344751e0
test r10, r10
je 0x7ff344751e0
mov eax, edx
shr eax, 0x13
and eax, ebx
mov dword [r10], eax
mov ecx, edi
movzx eax, di
and ecx, 0x1fff0000
cmp ecx, 0x70000
cmove edi, eax
jmp 0x7ff344751fb
mov edi, 0x8000ffff
test edi, edi
je 0x7ff3447520b
mov edx, r8d
mov dword [r10], r9d
and edx, 0x8003f
mov ecx, edx
and ecx, r11d
sub ecx, ebx
je 0x7ff34475235
sub ecx, ebx
je 0x7ff3447522e
sub ecx, ebx
je 0x7ff34475227
cmp ecx, ebx
jne 0x7ff34475246
bt r8d, 0xb
jmp 0x7ff3447523a
bt r8d, 0xa
jmp 0x7ff3447523a
bt r8d, 9
jmp 0x7ff3447523a
bt r8d, 8
jae 0x7ff34475246
mov eax, r8d
xor eax, edx
and eax, r11d
xor edx, eax
test r10, r10
je 0x7ff34475256
bt r8d, 0xc
jae 0x7ff34475256
and dword [r10], 0
test dl, 0x10
je 0x7ff3447525f
or r8d, 0x10
test dl, 0x20
je 0x7ff34475268
or r8d, 0x20
test r8b, 0x10
je 0x7ff34475271
or edx, 0x10
test r8b, 0x20
je 0x7ff3447527a
or edx, 0x20
mov rbx, qword [rsp + 0x60]
and edx, r11d
mov eax, edi
mov dword [rbp], edx
mov dword [rsi], r8d
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff34475298
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x7ff34484108]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r10, r8
mov rax, rdx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x40]
mov rsi, r9
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, rax
mov rdx, r10
xor edi, edi
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x7ff3447536d
cmp dword [rsp + 0x34], 1
je 0x7ff34475309
cmp dword [rsp + 0x34], 2
je 0x7ff34475309
lea ebx, [rdi + 5]
jmp 0x7ff3447536d
mov ebx, dword [rsp + 0x30]
mov rcx, 0xffffffffffffffff
mov eax, 2
shr ebx, 1
inc ebx
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.7ff3444f574
mov rdi, rax
test rax, rax
jne 0x7ff34475339
lea ebx, [rax + 8]
jmp 0x7ff3447536d
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rax
call fcn.7ff3444bb58
mov ecx, eax
mov ebx, eax
movzx eax, ax
and ecx, 0x1fff0000
cmp ecx, 0x70000
cmove ebx, eax
test ebx, ebx
je 0x7ff3447536d
mov rcx, rdi
call fcn.7ff3444f5a0
xor edi, edi
mov qword [rsi], rdi
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.7ff344779c0
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff34475a4c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
and qword [rsp + 0x68], 0
cmp dword [rcx + 0x180], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x50], 4
jne 0x7ff34475b64
cmp dword [rcx + 0x148], 0
je 0x7ff34475b64
add rcx, 0x150
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rbx + 0x180], 0
jne 0x7ff34475b4e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
lea rdx, [0x7ff344478f0]
mov r9d, 0x20019
mov dword [rbx + 0x178], eax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7ff34475b4e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x58]
mov rdx, rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x7ff34475b43
cmp dword [rsp + 0x58], 4
jne 0x7ff34475b43
mov eax, dword [rsp + 0x60]
mov ecx, eax
and ecx, 0xf
jl 0x7ff34475b43
cmp ecx, 4
jg 0x7ff34475b43
shr eax, 0x13
mov dword [rbx + 0x178], ecx
mov dword [rbx + 0x180], 1
and eax, 1
mov dword [rbx + 0x17c], eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx + 0x148], 0
je 0x7ff34475b64
lea rcx, [rbx + 0x150]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rbx + 0x178]
mov dword [rsi], eax
test rdi, rdi
je 0x7ff34475b79
mov eax, dword [rbx + 0x17c]
mov dword [rdi], eax
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret