joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1600cdc68
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r9d, dword [rcx + 0x14]
lea r8, str._08x
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x38]
lea edx, [rbx + 0x10]
call fcn.160059e34
test eax, eax
js 0x1600cdd07
lea rax, [rsp + 0x30]
mov rdx, rdi
lea r9d, [rbx + 2]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call fcn.16005ab8c
test eax, eax
jne 0x1600cdd07
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 3]
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_SafeArrayLock
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov edx, 1
test eax, eax
movzx ebx, bl
cmove ebx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1600ce83c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, r8
mov esi, edx
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r14d, eax
test sil, 2
je 0x1600ce874
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
test sil, 1
je 0x1600ce919
mov rcx, qword [rbx + 0xc0]
test rcx, rcx
je 0x1600ce919
or rbp, 0xffffffffffffffff
inc rbp
cmp byte [rdi + rbp], 0
jne 0x1600ce892
mov eax, dword [rbx + 0xc8]
mov r9d, ebp
and dword [rsp + 0x28], 0
add rax, rcx
mov ecx, 0x4e4
mov qword [rsp + 0x20], rax
mov r8, rdi
mov edx, 9
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
mov r8d, dword [rbx + 0xc8]
movsxd r15, eax
lea rcx, [r8 + r15*2]
cmp rcx, 0x7ffe2
jbe 0x1600ce8ea
mov rcx, rbx
call fcn.1600ce984
mov r8d, dword [rbx + 0xc8]
add r8, qword [rbx + 0xc0]
mov r9d, ebp
mov dword [rsp + 0x28], r15d
mov edx, 9
mov qword [rsp + 0x20], r8
mov ecx, 0x4e4
mov r8, rdi
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
add eax, eax
add dword [rbx + 0xc8], eax
test sil, 8
je 0x1600ce93c
mov ecx, 2
call fcn.160070d10
mov rcx, rax
lea rdx, [0x1601fbd14]
mov r8, rdi
call qword [sym.imp.msvcrt.dll_fprintf]
test sil, 4
je 0x1600ce95f
mov ecx, 1
call fcn.160070d10
mov rcx, rax
lea rdx, [0x1601fbd14]
mov r8, rdi
call qword [sym.imp.msvcrt.dll_fprintf]
mov ecx, r14d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
jmp qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
Function at 0x1600cf8a0
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rbx, str.SOFTWAREMicrosoftWindows_SearchEFS
mov rcx, 0xffffffff80000002
mov rdx, rbx
lea r8, [rsp + 0x20]
call fcn.16005acac
test al, al
lea rdx, [rsp + 0x20]
mov rcx, 0xffffffff80000002
cmove rdx, rbx
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x240
pop rbx
ret

Function at 0x1600cf9b8
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
sub rsp, 0x38
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov r10, rdx
mov r9d, 1
mov r11d, 0x4c11db7
test r8d, r8d
je 0x1600cf9fb
mov edx, r8d
mov eax, r9d
lea ecx, [r9 + r9]
mov r9d, ecx
xor r9d, r11d
test eax, eax
cmovns r9d, ecx
sub rdx, 1
jne 0x1600cf9e2
lea rdx, [rsp]
mov r8d, 8
mov dword [rdx], r9d
lea ecx, [r9 + r9]
mov eax, r9d
lea rdx, [rdx + 4]
mov r9d, ecx
xor r9d, r11d
test eax, eax
cmovns r9d, ecx
sub r8, 1
jne 0x1600cfa05
xor edx, edx
xor r8d, r8d
lea r9, [rsp]
xor ecx, ecx
mov eax, edx
shr eax, cl
test al, 1
je 0x1600cfa3b
xor r8d, dword [r9]
inc ecx
add r9, 4
cmp ecx, 8
jb 0x1600cfa30
mov dword [r10], r8d
inc edx
add r10, 4
cmp edx, 0x100
jb 0x1600cfa27
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x38
ret

Function at 0x1600d3344
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, rdx
mov rsi, rcx
call fcn.1600d33c0
xor ebx, ebx
mov edi, eax
test eax, eax
je 0x1600d33a0
mov rcx, qword [rsi]
lea r8, [rsp + 0x40]
mov edx, ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
test eax, eax
je 0x1600d33a0
mov rcx, qword [rsp + 0x40]
cmp byte [rcx], 0
jne 0x1600d339a
add rcx, 8
mov rdx, rbp
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0x1600d33b7
inc ebx
cmp ebx, edi
jb 0x1600d336b
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rsp + 0x40]
jmp 0x1600d33a2
Function at 0x1600d3578
Capabilities:
Get user security identifier

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov r14, rdx
mov rsi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1600d35a1
call fcn.160031c48
and qword [rsi], 0
and dword [rbp + 0x30], 0
and dword [rbp + 0x40], 0
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x40]
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountNameW]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0x1600d35fb
mov rcx, qword [rbp + 0x28]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_searchcommon_secutil_secutil.cxx
mov edx, 0x1cd
call fcn.160108adc
int3
and qword [rbp - 0x20], 0
mov ecx, dword [rbp + 0x30]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
mov rax, qword [0x1601c0fd8]
call qword [case.0x16003fc5a.0]
mov rbx, rax
mov qword [rbp - 0x20], rax
and qword [rbp - 0x18], 0
mov ecx, dword [rbp + 0x40]
mov rax, qword [0x1601c0fd8]
call qword [case.0x16003fc5a.0]
mov rdi, rax
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x40]
mov r8, rdi
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountNameW]
test eax, eax
jne 0x1600d3695
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [rbp + 0x28]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_searchcommon_secutil_secutil.cxx
mov edx, 0x1df
call fcn.160108adc
int3
mov qword [rsi], rdi
test rbx, rbx
je 0x1600d36a5
mov rcx, rbx
call fcn.160031c48
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1600d3ecc
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, rdx
mov rdi, rcx
call fcn.1600d33c0
xor ebx, ebx
mov esi, eax
test eax, eax
je 0x1600d3f23
mov rcx, qword [rdi]
lea r8, [rsp + 0x40]
mov edx, ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
test eax, eax
je 0x1600d3f60
mov rcx, qword [rsp + 0x40]
mov rdx, rbp
add rcx, 8
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0x1600d3f40
inc ebx
cmp ebx, esi
jb 0x1600d3ef3
mov rcx, qword [rsp + 0x28]
lea r8, str.onecoreuap_base_appmodel_search_searchcommon_secutil_secutil.cxx
mov r9d, 0x490
mov edx, 0x5c7
call fcn.160108adc
int3
mov rcx, qword [rdi]
mov edx, ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DeleteAce]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rsp + 0x28]
lea r8, str.onecoreuap_base_appmodel_search_searchcommon_secutil_secutil.cxx
mov edx, 0x5bd
call fcn.1600be3d0
int3
Function at 0x1600df044
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edx, dword [rcx + 0x7c]
xor al, al
mov rbx, rcx
cmp edx, 0xffffffff
je 0x1600df1f6
mov ecx, edx
cmp ecx, 0x7c
je 0x1600df1f6
cmp ecx, 0x29
jne 0x1600df08d
cmp dword [rbx + 0x1c], 0
jne 0x1600df1f6
cmp ecx, ecx
jne 0x1600df08d
test dword [rbx + 0x80], 0x10000000
je 0x1600df201
cmp ecx, 0x2e
jne 0x1600df0ad
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.1600e216c
mov rcx, rbx
call fcn.1600e21cc
jmp 0x1600df1de
cmp ecx, 0x5c
jne 0x1600df114
mov rcx, rbx
call fcn.1600e21cc
test byte [rbx + 0x80], 0x80
je 0x1600df107
cmp word [rbx + 0x78], 0x62
jne 0x1600df0e5
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.1600e216c
mov rcx, rbx
call fcn.1600e21cc
jmp 0x1600df1e6
cmp word [rbx + 0x78], 0x42
jne 0x1600df107
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.1600e216c
mov rax, qword [rbx + 0x48]
add rax, 0xc
xor dword [rax], 1
jmp 0x1600df0d8
mov rcx, rbx
call fcn.1600df290
jmp 0x1600df1de
cmp ecx, 0x5b
jne 0x1600df13e
mov rcx, rbx
call fcn.1600e21cc
mov rcx, rbx
call fcn.1600dfbfc
cmp dword [rbx + 0x7c], 0x5d
je 0x1600df0a0
mov ecx, 4
call fcn.16006dfe8
int3
cmp ecx, 0x28
jne 0x1600df167
mov rcx, rbx
call fcn.1600e21cc
mov rcx, rbx
call fcn.1600e4ec0
cmp dword [rbx + 0x7c], 0x29
mov dil, al
je 0x1600df1d1
mov ecx, 5
call fcn.16006dfe8
int3
cmp ecx, 0x5e
jne 0x1600df174
lea edx, [rcx - 0x5c]
jmp 0x1600df0cf
cmp ecx, 0x24
jne 0x1600df181
lea edx, [rcx - 0x21]
jmp 0x1600df0cf
cmp ecx, 0x3f
je 0x1600df222
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x1600df222
cmp ecx, 0x7b
je 0x1600df222
cmp edx, 0x7d
jne 0x1600df1b0
test dword [rbx + 0x80], 0x10000000
je 0x1600df20c
cmp edx, 0x5d
jne 0x1600df1c1
test dword [rbx + 0x80], 0x10000000
je 0x1600df217
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.1600de994
mov dil, 1
mov rcx, rbx
call fcn.1600e21cc
test dil, dil
je 0x1600df1e6
mov rcx, rbx
call fcn.1600e3f8c
mov edx, dword [rbx + 0x7c]
mov al, 1
mov ecx, edx
cmp edx, 0xffffffff
jne 0x1600df061
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 5
call fcn.16006dfe8
int3
mov ecx, 6
call fcn.16006dfe8
int3
mov ecx, 4
call fcn.16006dfe8
int3
mov ecx, 0xa
call fcn.16006dfe8
int3
Function at 0x1600e9028
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x48
cmp byte [0x160273e88], 0
jne 0x1600e915a
cmp byte [0x160273e89], 0
jne 0x1600e915a
and qword [rbp - 0x18], 0
lea rax, [rbp - 0x18]
mov bl, 1
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov byte [0x160273e88], bl
lea rdx, str.SOFTWAREMicrosoftWindows_Search
mov rcx, 0xffffffff80000002
call fcn.16005ab8c
test eax, eax
jne 0x1600e915a
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x28]
mov dword [rbp + 0x18], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ETWLogging
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1600e90c3
cmp dword [rbp + 0x20], 4
jne 0x1600e90c3
cmp dword [rbp + 0x28], eax
ja 0x1600e90c5
xor bl, bl
cmp dword [0x160273da8], 0
mov byte [0x160273e89], bl
mov dword [rbp + 0x18], 4
ja 0x1600e9150
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x30]
xor r8d, r8d
lea rdx, str.ETWBufferSize
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1600e9150
cmp dword [rbp + 0x20], 4
jne 0x1600e9150
mov ebx, dword [rbp + 0x30]
test ebx, ebx
je 0x1600e9150
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
and dword [0x160273dac], 0
mov edx, 8
shr ebx, 0xb
mov rcx, rax
mov r8d, ebx
mov dword [0x160273da8], r8d
shl r8, 0xb
mov qword [0x160273da0], rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov qword [0x160273db0], rax
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
add rsp, 0x48
pop rbx
pop rbp
ret
Function at 0x1600e9908
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x30
and qword [rbp + 0x38], 0
lea rax, [0x1601c4548]
mov qword [rcx], rax
lea rdx, str.SOFTWAREMicrosoftWindows_Search
lea rax, [rbp + 0x38]
mov dword [rcx + 8], 0x10000
mov rbx, rcx
mov dword [rcx + 0xc], 3
mov word [rcx + 0x10], 1
mov r9d, 0x20019
mov dword [rcx + 0x14], 0x3e8
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.16005ab8c
test eax, eax
jne 0x1600e9aaa
mov rcx, qword [rbp + 0x38]
lea edi, [rax + 4]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], edi
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x28]
lea rax, [rbp + 0x30]
xor r8d, r8d
lea rdx, str.HashSingleCutoff
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1600e99a9
cmp dword [rbp + 0x28], edi
jne 0x1600e99a9
mov eax, dword [rbp + 0x30]
mov dword [rbx + 8], eax
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x28]
lea rax, [rbp + 0x30]
mov dword [rbp + 0x20], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HashRetriesAllowed
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1600e99e6
cmp dword [rbp + 0x28], edi
jne 0x1600e99e6
movzx eax, byte [rbp + 0x30]
mov dword [rbx + 0xc], eax
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x28]
lea rax, [rbp + 0x30]
mov dword [rbp + 0x20], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ExtentLogging
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1600e9a25
cmp dword [rbp + 0x28], edi
jne 0x1600e9a25
cmp dword [rbp + 0x30], eax
setne al
mov byte [rbx + 0x10], al
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x28]
lea rax, [rbp + 0x30]
mov dword [rbp + 0x20], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.JetLogging
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1600e9a64
cmp dword [rbp + 0x28], edi
jne 0x1600e9a64
cmp dword [rbp + 0x30], eax
setne al
mov byte [rbx + 0x11], al
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x28]
lea rax, [rbp + 0x30]
mov dword [rbp + 0x20], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.StoreAppThreshold
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1600e9aa0
cmp dword [rbp + 0x28], edi
jne 0x1600e9aa0
mov eax, dword [rbp + 0x30]
mov dword [rbx + 0x14], eax
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rax, rbx
add rsp, 0x30
pop rdi
pop rbx
pop rbp
ret
Function at 0x1600eb094
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rdi, r9
mov r12, r8
mov r13, rdx
mov rbx, rcx
xor r15d, r15d
mov qword [r11 - 0x50], r15
or rax, 0xffffffffffffffff
mov qword [r11 - 0x40], rax
mov r14, rax
mov qword [r11 - 0x48], rax
xor eax, eax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
and qword [r11 - 0x68], rax
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, r13
mov rax, qword [0x160274c48]
call qword [case.0x16003fc5a.0]
mov rsi, rax
mov qword [rsp + 0x58], rax
cmp rax, r14
je 0x1600eb1f1
test rbx, rbx
je 0x1600eb13d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x64], rbx
and dword [rsp + 0x6c], r15d
neg rbx
sbb rdi, rdi
lea rax, [rsp + 0x60]
and rdi, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rsi
mov edx, ebx
mov rax, qword [0x160274c60]
call qword [case.0x16003fc5a.0]
test eax, eax
je 0x1600eb1e9
lea rdx, [rsp + 0x44]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp eax, 0xffffffff
je 0x1600eb1e9
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x44]
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_CreateFileMappingW]
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1600eb1e9
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov r15, rax
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xb8]
test r15, r15
jne 0x1600eb23d
cmp r14, 0xffffffffffffffff
je 0x1600eb20c
mov rcx, r14
mov rax, qword [0x160274c58]
call qword [case.0x16003fc5a.0]
cmp rsi, 0xffffffffffffffff
je 0x1600eb238
mov rcx, rsi
mov rax, qword [0x160274c58]
call qword [case.0x16003fc5a.0]
cmp rsi, 0xffffffffffffffff
je 0x1600eb238
mov rcx, r13
mov rax, qword [0x160274c68]
call qword [case.0x16003fc5a.0]
test r15, r15
je 0x1600eb263
test rdi, rdi
je 0x1600eb24a
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x1600eb25a
mov qword [rax], r14
test r12, r12
je 0x1600eb263
mov qword [r12], rsi
mov rax, r15
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1600eb2e8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rdx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
xor esi, esi
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, [0x1601fd9d0]
lea rcx, [0x160274510]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetTempFileNameW]
test eax, eax
je 0x1600eb417
mov ebx, 0x104
lea r8, [rsp + 0x20]
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.16000a664
test eax, eax
js 0x1600eb417
mov r9, qword [rsp + 0x20]
lea r8, [rsp + 0x30]
add r9, 0xfffffffffffffffd
mov edx, ebx
mov rcx, rdi
call fcn.16006722c
test eax, eax
js 0x1600eb417
mov ecx, ebx
mov rax, rdi
cmp word [rax], si
je 0x1600eb39e
add rax, 2
sub rcx, 1
jne 0x1600eb38f
mov rax, rbx
mov rdx, rsi
sub rax, rcx
test rcx, rcx
cmovne rdx, rax
je 0x1600eb417
lea rcx, [rdi + rdx*2]
sub rbx, rdx
je 0x1600eb3ee
lea rax, [rdx + 0x7ffffefa]
add rax, rbx
lea rdx, str.diagerr.mdmp
sub rdx, rcx
test rax, rax
je 0x1600eb3ee
movzx r8d, word [rdx + rcx]
test r8w, r8w
je 0x1600eb3ee
mov word [rcx], r8w
dec rax
add rcx, 2
sub rbx, 1
jne 0x1600eb3cd
test rbx, rbx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], si
je 0x1600eb417
mov rax, qword [0x160274c68]
lea rcx, [rsp + 0x30]
call qword [case.0x16003fc5a.0]
mov eax, 1
jmp 0x1600eb419
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1600eb440
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [0x160274500]
test eax, eax
je 0x1600eb5cb
add eax, 0xffffffff
mov dword [0x160274500], eax
jne 0x1600eb5cb
mov rsi, qword [0x160274c20]
lea rbx, [0x1600eb880]
and qword [0x160274c20], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
cmp rbx, rax
cmove rax, qword [0x160274508]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov ecx, dword [0x160270d84]
and qword [0x160274508], 0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
mov ecx, dword [0x160270d88]
or dword [0x160270d84], 0xffffffff
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1600eb509
jmp 0x1600eb4d8
mov rcx, rax
call fcn.1600eb018
mov rcx, rbx
call fcn.1600eb7bc
test rax, rax
jne 0x1600eb4d0
mov rdi, qword [rbx]
test rdi, rdi
je 0x1600eb501
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov rcx, rbx
call fcn.160031c48
mov ecx, dword [0x160270d88]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
or dword [0x160270d88], 0xffffffff
lea rcx, [0x160273d70]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov rdx, qword [0x1602744f8]
test rdx, rdx
je 0x1600eb59f
mov ecx, dword [0x160274c30]
xor ebx, ebx
test ecx, ecx
je 0x1600eb571
mov rdi, qword [rdx + rbx*8]
test rdi, rdi
je 0x1600eb56b
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov rdx, qword [0x1602744f8]
mov ecx, dword [0x160274c30]
inc ebx
cmp ebx, ecx
jb 0x1600eb541
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, qword [0x1602744f8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and qword [0x1602744f8], 0
and dword [0x160274c30], 0
and dword [0x160274c28], 0
lea rcx, [0x160273d70]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
test rsi, rsi
je 0x1600eb5b9
mov rcx, rsi
call fcn.1600ee950
and dword [0x160274c18], 0
call fcn.1600ed624
mov eax, dword [0x160274500]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1600eb6a0
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
or edi, 0xffffffff
cmp dword [0x160270d84], edi
jne 0x1600eb6c7
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
mov dword [0x160270d84], eax
cmp eax, edi
je 0x1600eb6e4
cmp dword [0x160270d88], edi
jne 0x1600eb6df
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
mov dword [0x160270d88], eax
cmp eax, edi
je 0x1600eb6e4
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1600eb704
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov word [rbp - 0xc], 0x500
mov dword [rbp - 0x10], ebx
mov qword [rbp - 0x18], rbx
call fcn.1600f0978
test eax, eax
je 0x1600eb73f
lea eax, [rbx + 1]
jmp 0x1600eb79c
lea rax, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x48], ebx
mov dl, 1
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
lea r8d, [r9 + 0x13]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1600eb79a
mov rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
xor ecx, ecx
mov dword [rbp - 0x20], ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
mov rcx, qword [rbp - 0x18]
test eax, eax
cmovne ebx, dword [rbp - 0x20]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_FreeSid]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret