joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180023ebc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1800228b8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1800228b8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x18002400c
cmp rax, 0xffffffffffffffff
je 0x18002400c
xor edi, edi
test rbp, rbp
jle 0x180023fb7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.180018808
mov rbx, rax
test rax, rax
jne 0x180023f44
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180023fad
mov edx, 0x8000
mov ecx, r14d
call fcn.180023d40
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.18001e6b8
cmp eax, 0xffffffff
je 0x180023f8d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x180023f54
mov edx, r15d
mov ecx, r14d
call fcn.180023d40
jmp 0x180023fad
cmp byte [rsi + 0x38], dil
je 0x180023fa4
cmp dword [rsi + 0x34], 5
jne 0x180023fa4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x180023fad
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.180018880
jmp 0x180024020
jns 0x180024020
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1800228b8
cmp rax, 0xffffffffffffffff
jne 0x180023fd8
cmp byte [rsi + 0x30], dil
je 0x180024020
mov edi, dword [rsi + 0x2c]
jmp 0x180024020
mov ecx, r14d
call fcn.18001ee6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180024020
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x180024020
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180024019
mov eax, dword [rsi + 0x2c]
jmp 0x18002401e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1800228b8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x180024f90
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180024fb8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180024fb8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll___p__environ]
mov rsi, qword [0x140004050]
xor edx, edx
mov rcx, qword [rax]
mov qword [0x1400040c8], rcx
xor ecx, ecx
call sub.jli.dll_JLI_InitArgProcessing
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001086
lea rcx, str.Windows_original_main_args:_n
call fcn.140001164
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [rax], ebx
jle 0x140001086
xor edi, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov edx, ebx
lea rcx, str.wwwd_args__d____s_n
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call fcn.140001164
inc ebx
lea rdi, [rdi + 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp ebx, dword [rax]
jl 0x14000105b
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
test edi, edi
jle 0x1400010d2
xor edx, edx
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010bf
mov rcx, qword [str.openjdk]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010e9
mov rcx, qword [rbx]
mov rax, qword [section..data]
test rax, rax
jne 0x1400010f8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov r9, rsi
mov byte [rsp + 0x60], 1
xor r8d, r8d
mov byte [rsp + 0x58], 1
mov rdx, rbx
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x48], rcx
mov ecx, edi
mov qword [rsp + 0x40], rax
lea rax, [0x1400022e4]
mov qword [rsp + 0x38], rax
lea rax, [0x1400022e8]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call sub.jli.dll_JLI_Launch
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140001948
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001992
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001992
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001992
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001992
cmp dword [rcx + 0x84], 0xe
jbe 0x140001992
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001994
xor al, al
add rsp, 0x28
ret
Function at 0x1408f90b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408f9237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1408f90e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408f90c7
add dl, dl
jne 0x1408f90ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408f914e
xor eax, eax
add dl, dl
jne 0x1408f90fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408f9205
add dl, dl
jne 0x1408f910e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408f911b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408f9128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408f9135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408f9142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1408f90d6
mov eax, 1
add dl, dl
jne 0x1408f915e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408f916b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408f9153
sub eax, ebx
mov ebx, 1
jne 0x1408f91a4
mov ecx, 1
add dl, dl
jne 0x1408f9186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408f9193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408f917b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408f90d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1408f91c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408f91cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408f91b5
cmp eax, 0x7d00
jae 0x1408f91f3
cmp eax, 0x500
jb 0x1408f91ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408f90d6
cmp eax, 0x7f
ja 0x1408f91f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408f90d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408f922a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1408f90d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140005c00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
add rax, 8
mov rcx, rax
call fcn.14005d780
movzx eax, al
test eax, eax
jne 0x140005c32
mov rax, qword [rsp + 0x70]
add rax, 8
mov rcx, rax
call fcn.140006cb0
mov rax, qword [rsp + 0x70]
add rax, 0x20
mov rcx, rax
call fcn.140007220
lea rdx, [0x140120388]
mov rcx, rax
call qword [sym.imp.MSVCR120.dll_fopen]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140005d12
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll_fseek]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll_ftell]
cdqe
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll_rewind]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140006bd0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140005cf3
mov r9, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov edx, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCR120.dll_fread]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x48], rax
jne 0x140005cf3
mov rax, qword [rsp + 0x70]
mov byte [rax + 0x40], 1
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll_fclose]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.140006bf0
mov rax, qword [rsp + 0x70]
add rax, 8
mov rcx, rax
call fcn.1400074e0
movzx eax, al
test eax, eax
jne 0x140005d3b
mov rax, qword [rsp + 0x70]
add rax, 8
mov rcx, rax
call fcn.140006ce0
xor al, al
add rsp, 0x68
ret
Function at 0x140008690
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
mov qword [rax], 0
mov rax, qword [rsp + 0x70]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x70]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x70]
mov qword [rax + 0x18], 0
mov rax, qword [rsp + 0x70]
add rax, 0x20
mov rcx, rax
call fcn.140006a50
mov rax, qword [rsp + 0x70]
add rax, 0x20
mov rcx, rax
call fcn.140006cb0
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.140008830
lea rcx, [rsp + 0x48]
call fcn.140008ac0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x14000875e
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0xffffffffffffffff
jne 0x14000876d
lea rcx, [rsp + 0x48]
call fcn.140008960
jmp 0x14000881a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x1000002
xor edx, edx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, qword [rsp + 0x70]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax + 8], 0
jne 0x1400087b8
lea rcx, [rsp + 0x48]
call fcn.140008960
jmp 0x14000881a
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, qword [rsp + 0x70]
mov qword [rcx + 0x10], rax
xor edx, edx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov eax, eax
mov rcx, qword [rsp + 0x70]
mov qword [rcx + 0x18], rax
mov rax, qword [rsp + 0x70]
add rax, 0x20
mov rcx, rax
call fcn.140006ce0
lea rcx, [rsp + 0x48]
call fcn.140008960
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x140009710
Capabilities:
Get common file path

Disassembly:
mov byte [rsp + 0x20], r9b
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1d0
mov rax, qword [0x14014d470]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rax + 0x30], 0
mov rax, qword [rsp + 0x1e0]
movzx ecx, byte [rsp + 0x1f8]
mov byte [rax + 0x28], cl
mov byte [rsp + 0xb0], 0
lea rax, [rsp + 0xb1]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
lea rdx, [rsp + 0xb0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jbe 0x140009888
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.140002e30
lea r8, [0x1401211a8]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400064f0
mov r8, qword [rsp + 0x1e8]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000be60
mov rcx, qword [rsp + 0x1e0]
add rcx, 8
mov rdx, rax
call fcn.14000c950
lea rcx, [rsp + 0x50]
call fcn.140005b40
lea rcx, [rsp + 0x90]
call fcn.140005b40
lea rcx, [rsp + 0x70]
call fcn.140005b40
movzx eax, byte [rsp + 0x1f0]
test eax, eax
je 0x140009828
mov dword [rsp + 0x40], 4
jmp 0x140009830
mov dword [rsp + 0x40], 3
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x1e0]
add rax, 8
mov rcx, rax
call fcn.140007220
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov ecx, dword [rsp + 0x48]
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, qword [rsp + 0x1e0]
mov qword [rcx + 0x30], rax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140101630
add rsp, 0x1d0
pop rdi
ret

Function at 0x14000a0b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov edx, 0x20019
mov rcx, qword [rsp + 0x50]
call fcn.14000a670
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000a0e8
mov eax, dword [rsp + 0x30]
jmp 0x14000a135
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000a133
mov eax, 0xc0000001
jmp 0x14000a135
xor eax, eax
add rsp, 0x48
ret
Function at 0x14000a140
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [rsp + 0x50]
call fcn.14000a780
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000a16e
mov eax, dword [rsp + 0x30]
jmp 0x14000a1b9
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCR120.dll_wcslen]
inc rax
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000a1b7
mov eax, 0xc0000001
jmp 0x14000a1b9
xor eax, eax
add rsp, 0x48
ret

Function at 0x14000a1d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov edx, 0x20019
mov rcx, qword [rsp + 0x50]
call fcn.14000a670
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x14000a208
mov eax, dword [rsp + 0x34]
jmp 0x14000a270
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x38], 7
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000a262
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov eax, 0xc0000001
jmp 0x14000a270
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
xor eax, eax
add rsp, 0x48
ret

Function at 0x14000a300
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov edx, 0x20019
mov rcx, qword [rsp + 0x50]
call fcn.14000a670
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000a333
mov eax, dword [rsp + 0x30]
jmp 0x14000a380
mov dword [rsp + 0x34], 4
mov dword [rsp + 0x38], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000a37e
mov eax, 0xc0000001
jmp 0x14000a380
xor eax, eax
add rsp, 0x48
ret
Function at 0x14000a390
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [rsp + 0x50]
call fcn.14000a780
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000a3be
mov eax, dword [rsp + 0x30]
jmp 0x14000a3fa
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000a3f8
mov eax, 0xc0000001
jmp 0x14000a3fa
xor eax, eax
add rsp, 0x48
ret

Function at 0x14000a410
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov edx, 0x20019
mov rcx, qword [rsp + 0x50]
call fcn.14000a670
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x14000a448
mov eax, dword [rsp + 0x34]
jmp 0x14000a4b0
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x38], 3
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000a4a2
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov eax, 0xc0000001
jmp 0x14000a4b0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
xor eax, eax
add rsp, 0x48
ret

Function at 0x14000a540
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov edx, 0x20006
mov rcx, qword [rsp + 0x40]
call fcn.14000a670
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14000a56e
mov eax, dword [rsp + 0x20]
jmp 0x14000a58f
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14000a58d
mov eax, 0xc0000001
jmp 0x14000a58f
xor eax, eax
add rsp, 0x38
ret

Function at 0x14000b2f0
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x28
ret

Function at 0x14000b340
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x28
ret

Function at 0x14000b370
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x28
ret
Function at 0x140022fa0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x78
cmp qword [0x140150918], 0
jne 0x140023096
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x44]
mov qword [rsp + 0x38], rax
xor eax, eax
test eax, eax
je 0x140022fd6
mov dword [rsp + 0x20], 0
jmp 0x140022fde
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x30], rax
xor eax, eax
test eax, eax
jne 0x14002301d
mov rax, qword [rsp + 0x30]
dec rax
mov rcx, qword [rsp + 0x30]
and rcx, rax
mov rax, rcx
test rax, rax
jne 0x14002301d
mov rax, qword [rsp + 0x38]
dec rax
mov rcx, qword [rsp + 0x38]
and rcx, rax
mov rax, rcx
test rax, rax
je 0x140023023
call qword [sym.imp.MSVCR120.dll_abort]
mov rax, qword [rsp + 0x30]
mov qword [0x140150928], rax
mov rax, qword [rsp + 0x38]
mov qword [0x140150920], rax
mov qword [0x140150930], 0x40000
mov qword [0x140150938], 0x200000
mov dword [0x140150940], 5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
xor rax, 0x55555555
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
or rax, 8
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
and rax, 0xfffffffffffffff8
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [0x140150918], rax
mov eax, 1
add rsp, 0x78
ret
Function at 0x1400b6870
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x14014d470]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x48], 0x80000000
mov eax, dword [rsp + 0x98]
and eax, 1
test eax, eax
je 0x1400b68b4
mov dword [rsp + 0x48], 0x40000000
jmp 0x1400b68ca
mov eax, dword [rsp + 0x98]
and eax, 2
test eax, eax
je 0x1400b68ca
mov dword [rsp + 0x48], 0xc0000000
mov dword [rsp + 0x44], 3
mov eax, dword [rsp + 0x98]
and eax, 0x500
cmp eax, 0x500
jne 0x1400b68ef
mov dword [rsp + 0x44], 1
jmp 0x1400b693e
mov eax, dword [rsp + 0x98]
and eax, 0x300
cmp eax, 0x300
jne 0x1400b690c
mov dword [rsp + 0x44], 2
jmp 0x1400b693e
mov eax, dword [rsp + 0x98]
and eax, 0x100
test eax, eax
je 0x1400b6926
mov dword [rsp + 0x44], 4
jmp 0x1400b693e
mov eax, dword [rsp + 0x98]
and eax, 0x200
test eax, eax
je 0x1400b693e
mov dword [rsp + 0x44], 5
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x98]
and eax, 0x40
test eax, eax
je 0x1400b6960
mov eax, dword [rsp + 0x40]
bts eax, 0x1a
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x98]
and eax, 0x80000000
test eax, eax
je 0x1400b697c
mov eax, dword [rsp + 0x40]
bts eax, 0x1f
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x98]
and eax, 0x40000000
test eax, eax
je 0x1400b6998
mov eax, dword [rsp + 0x40]
bts eax, 0x1e
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x98]
and eax, 0x20000000
test eax, eax
je 0x1400b69b4
mov eax, dword [rsp + 0x40]
bts eax, 0x1d
mov dword [rsp + 0x40], eax
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x58]
call fcn.140011600
mov rcx, rax
call fcn.14005b9c0
mov qword [rsp + 0x30], 0
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov r8d, 1
mov edx, dword [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x58]
call fcn.14004f260
mov eax, dword [rsp + 0x98]
and eax, 8
test eax, eax
je 0x1400b6a38
cmp qword [rsp + 0x50], 0xffffffffffffffff
je 0x1400b6a38
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140101630
add rsp, 0x88
ret

Function at 0x1400b6aa0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x1400b6b05
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
add rsp, 0x68
ret