joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140038e60
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x14003cd58]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
test rax, rax
mov rbx, rax
je 0x140038f80
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140038f80
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140038f80
test byte [rbx + 0x44], 4
jne 0x140038fa0
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x14003cd68]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140038fe0
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x140039018
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x140038f07
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140038fc0
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140038f1b
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rdi, rdi
je 0x140038ff8
mov rax, qword [rbx + 8]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14003902a
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x140039008
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x140038f03
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x140038f6e
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x140038ed5
jmp 0x140038edc
call sym.pthread_mutex_destroy
jmp 0x140038f3c
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x140038f64
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x140038f6e
call sym.replace_spin_keys.part.0
nop

Function at 0x140039710
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rdi, [0x14003cd78]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call sym.pthread_spin_lock
mov rax, qword [rbx]
cmp dword [rax], 0xbab1f0ed
jne 0x140039759
mov rax, qword [rbx]
mov eax, dword [rax + 4]
test eax, eax
jle 0x140039759
mov rax, qword [rbx]
mov rcx, rdi
sub dword [rax + 4], 1
call sym.pthread_spin_unlock
mov eax, esi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x20], 0x28
lea r9, str..._.._src_mingw_w64_mingw_w64_libraries_winpthreads_src_rwlock.c
lea r8, str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov rcx, rax
lea rdx, str.Assertion_failed:___s___file__s__line__d_n
call sym.fprintf
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop
Function at 0x140039b80
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x140039ba8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_lock
test eax, eax
jne 0x140039bd1
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x140039be8
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
je 0x140039c10
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, ebp
jmp 0x140039bd3
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rdi
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x140039bd3

Function at 0x140039c40
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x140039c68
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
mov rdx, rdi
lea rbp, [rsi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_timedlock
test eax, eax
jne 0x140039c94
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x140039cb0
mov rcx, rbp
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rdx, rdi
mov rcx, r12
call sym.pthread_mutex_timedlock
test eax, eax
mov edi, eax
je 0x140039ce0
cmp eax, 0x8a
je 0x140039d10
mov rcx, rbp
call sym.pthread_mutex_unlock
mov edx, edi
jmp 0x140039c96
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x140039c96
lock add dword [rsi + 0x10], 1
jmp 0x140039ccc

Function at 0x140039d20
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x140039d48
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_trylock
test eax, eax
jne 0x140039d71
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x140039d88
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
je 0x140039db0
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, ebp
jmp 0x140039d73
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rdi
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x140039d73
Function at 0x140039de0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x140039e08
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rbp, [rsi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_trylock
test eax, eax
mov edx, eax
jne 0x140039e5e
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_trylock
test eax, eax
mov edi, eax
jne 0x140039e98
mov eax, dword [rsi + 8]
mov edx, 0x10
test eax, eax
jne 0x140039e5e
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x140039e51
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x140039e70
mov dword [rsi + 8], 1
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
mov rcx, r12
call sym.pthread_mutex_unlock
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
jne 0x140039e90
test eax, eax
mov esi, 0x10
cmovne esi, eax
mov edx, esi
jmp 0x140039e5e
mov rcx, rbp
call sym.pthread_mutex_unlock
test eax, eax
cmovne edi, eax
mov edx, edi
jmp 0x140039e5e

Function at 0x140039eb0
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
call sym.rwl_ref_unlock
test eax, eax
jne 0x140039f30
mov rdi, qword [rbx]
mov edx, dword [rdi + 8]
lea rbp, [rdi + 0x20]
test edx, edx
je 0x140039f08
lock sub dword [rdi + 8], 1
mov rcx, rbp
call sym.pthread_mutex_unlock
lea rcx, [rdi + 0x18]
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.rwl_unref
mov rcx, rbp
call sym.pthread_mutex_lock
test eax, eax
mov esi, eax
jne 0x140039eef
lock add dword [rdi + 0x10], 1
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x140039f40
mov rcx, rbp
call sym.pthread_mutex_unlock
mov esi, eax
jmp 0x140039eef
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, [rdi + 0x28]
call sym.pthread_cond_signal
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
jmp 0x140039eef
Function at 0x140039f60
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x140039f88
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
jne 0x140039fd9
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
jne 0x14003a070
mov edx, dword [rsi + 8]
test edx, edx
jne 0x140039fd4
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x140039fd0
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x140039ff0
lock add dword [rsi + 8], 1
mov edx, ebp
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.rwl_unref
mov qword [rsp + 0x28], rsi
lea r13, [rsi + 0x28]
neg eax
mov dword [rsi + 0x10], eax
lea rax, [sym.st_cancelwrite]
mov qword [rsp + 0x20], rax
call sym.pthread_getclean
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call sym.pthread_getclean
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x14003a03f
mov eax, dword [rsi + 0x10]
test eax, eax
jns 0x14003a080
mov rdx, r12
mov rcx, r13
call sym.pthread_cond_wait
test eax, eax
mov edi, eax
je 0x14003a038
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov ebp, edi
mov qword [rax], rdx
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x20]
jmp 0x140039fd9
mov rcx, rdi
call sym.pthread_mutex_unlock
jmp 0x140039fd9
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov qword [rax], rdx
mov dword [rsi + 0xc], 0
jmp 0x140039fd4
Function at 0x14003a0a0
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
je 0x14003a150
test rdx, rdx
je 0x14003a150
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14003a0e0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdi, qword [rbx]
mov rdx, rsi
lea rbp, [rdi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_timedlock
test eax, eax
mov edx, eax
jne 0x14003a137
lea r13, [rdi + 0x20]
mov rdx, rsi
mov rcx, r13
call sym.pthread_mutex_timedlock
test eax, eax
mov r12d, eax
jne 0x14003a168
mov edx, dword [rdi + 8]
test edx, edx
jne 0x14003a12f
mov edx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
test edx, edx
jle 0x14003a12b
sub eax, edx
mov dword [rdi + 0x10], 0
mov dword [rdi + 0xc], eax
test eax, eax
jg 0x14003a178
lock add dword [rdi + 8], 1
mov edx, r12d
mov rcx, rbx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.rwl_unref
mov eax, 0x16
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
jmp 0x14003a134
mov qword [rsp + 0x28], rdi
lea r14, [rdi + 0x28]
neg eax
mov dword [rdi + 0x10], eax
lea rax, [sym.st_cancelwrite]
mov qword [rsp + 0x20], rax
call sym.pthread_getclean
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call sym.pthread_getclean
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x14003a1c4
test ebp, ebp
jne 0x14003a1db
mov r8, rsi
mov rdx, r13
mov rcx, r14
call sym.pthread_cond_timedwait
mov ebp, eax
mov eax, dword [rdi + 0x10]
test eax, eax
js 0x14003a1c0
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
test ebp, ebp
mov qword [rax], rdx
jne 0x14003a200
mov dword [rdi + 0xc], 0
jmp 0x14003a12f
mov rcx, qword [rsp + 0x28]
mov r12d, ebp
call qword [rsp + 0x20]
jmp 0x14003a134
Function at 0x1400128c0
Capabilities:
Set current directory

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x150
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc8], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
lea rcx, [rbp - 0x48]
mov rdx, rdi
mov r8, rsi
call fcn.140011650
mov rcx, qword [rbp - 0x48]
cmp rcx, 0xffffffffffffffff
lea rbx, [rbp - 0x38]
cmove rcx, rbx
call sub.KERNEL32.dll_SetCurrentDirectoryW
mov r14, qword [rbp - 0x48]
cmp r14, 0xffffffffffffffff
cmovne rbx, r14
test eax, eax
je 0x140012944
cmp r14, 0xffffffffffffffff
je 0x140012936
call fcn.14009218c
mov esi, dword [rax]
mov rcx, r14
call fcn.140097584
call fcn.14009218c
mov dword [rax], esi
add rsp, 0x150
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
test rsi, rsi
jne 0x14001296b
test rbx, rbx
jne 0x140012952
xor ecx, ecx
jmp 0x14001295d
mov rcx, rbx
call fcn.140099574
mov rcx, rax
mov rdx, rbx
call fcn.140014010
mov rdi, rax
mov rsi, rdx
lea rcx, [0x1400f17b0]
call fcn.140067130
mov rbx, rax
lea rax, [0x1400c5100]
mov qword [rbx], rax
mov qword [rbx + 8], 0
movups xmm0, xmmword [0x1400c50b8]
movups xmmword [rbx + 0x10], xmm0
movups xmm0, xmmword [0x1400c50c8]
movups xmmword [rbx + 0x20], xmm0
movups xmm0, xmmword [0x1400c50d8]
movups xmmword [rbx + 0x30], xmm0
movups xmm0, xmmword [0x1400c50e8]
movups xmmword [rbx + 0x40], xmm0
mov rax, qword [0x1400c50f8]
mov qword [rbx + 0x50], rax
call sub.KERNEL32.dll_GetLastError
lea rcx, str.D:_aldcldc_runtimephobos_std_file.d
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0xb5e
mov qword [rsp + 0x20], 0x26
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
mov r9d, eax
call fcn.14002ab30
mov rcx, rbx
call fcn.140046240
int3
Function at 0x14002b630
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, r9
mov r14, rdx
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
mov rcx, rbx
mov rdx, rsi
mov r8d, 1
call sub.KERNEL32.dll_MoveFileExW
test eax, eax
je 0x14002b682
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
test r14, r14
jne 0x14002b6a4
mov rcx, rbx
call fcn.140099574
mov rcx, rax
mov rdx, rbx
call fcn.1400297f0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rdx
test rdi, rdi
jne 0x14002b6c6
mov rcx, rsi
call fcn.140099574
mov rcx, rax
mov rdx, rsi
call fcn.1400297f0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x28]
call fcn.14002b6e0
mov rcx, rax
call fcn.140046240
int3

Function at 0x14002b850
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, r8
call sub.KERNEL32.dll_DeleteFileW
test eax, eax
je 0x14002b874
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
test rsi, rsi
jne 0x14002b89b
test rbx, rbx
jne 0x14002b882
xor ecx, ecx
jmp 0x14002b88d
mov rcx, rbx
call fcn.140099574
mov rcx, rax
mov rdx, rbx
call fcn.140029490
mov rdi, rax
mov rsi, rdx
lea rcx, [0x1400f17b0]
call fcn.140067130
mov rbx, rax
lea rax, [0x1400c5100]
mov qword [rbx], rax
mov qword [rbx + 8], 0
movups xmm0, xmmword [0x1400c50b8]
movups xmmword [rbx + 0x10], xmm0
movups xmm0, xmmword [0x1400c50c8]
movups xmmword [rbx + 0x20], xmm0
movups xmm0, xmmword [0x1400c50d8]
movups xmmword [rbx + 0x30], xmm0
movups xmm0, xmmword [0x1400c50e8]
movups xmmword [rbx + 0x40], xmm0
mov rax, qword [0x1400c50f8]
mov qword [rbx + 0x50], rax
call sub.KERNEL32.dll_GetLastError
lea rcx, str.std_file.d
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0x429
mov qword [rsp + 0x20], 0xa
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
mov r9d, eax
call fcn.14002ab30
mov rcx, rbx
call fcn.140046240
int3

Function at 0x14002b930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret
Function at 0x14002c410
Capabilities:
Copy file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov r15, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
mov rcx, r12
mov rdx, r15
xor r8d, r8d
call sub.KERNEL32.dll_CopyFileW
test eax, eax
je 0x14002c459
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
test rbx, rbx
jne 0x14002c477
mov rcx, r12
call fcn.140099574
mov rcx, rax
mov rdx, r12
call fcn.1400297f0
mov r14, rax
mov rbx, rdx
test rsi, rsi
jne 0x14002c495
mov rcx, r15
call fcn.140099574
mov rcx, rax
mov rdx, r15
call fcn.1400297f0
mov rdi, rax
mov rsi, rdx
lea rcx, [0x1400f17b0]
call fcn.140067130
mov r15, rax
lea rax, [0x1400c5100]
mov qword [r15], rax
mov qword [r15 + 8], 0
movups xmm0, xmmword [0x1400c50b8]
movups xmmword [r15 + 0x10], xmm0
movups xmm0, xmmword [0x1400c50c8]
movups xmmword [r15 + 0x20], xmm0
movups xmm0, xmmword [0x1400c50d8]
movups xmmword [r15 + 0x30], xmm0
movups xmm0, xmmword [0x1400c50e8]
movups xmmword [r15 + 0x40], xmm0
mov rax, qword [0x1400c50f8]
mov qword [r15 + 0x50], rax
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call fcn.14002f630
mov rsi, rax
mov rdi, rdx
call sub.KERNEL32.dll_GetLastError
lea rcx, str.std_file.d
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0x10de
mov qword [rsp + 0x20], 0xa
mov rcx, r15
mov rdx, rsi
mov r8, rdi
mov r9d, eax
call fcn.14002ab30
mov rcx, r15
call fcn.140046240
int3
Function at 0x14002c9e0
Capabilities:
Delete directory

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x150
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc8], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
lea rcx, [rbp - 0x48]
mov rdx, rdi
mov r8, rsi
call fcn.140011650
mov rcx, qword [rbp - 0x48]
cmp rcx, 0xffffffffffffffff
lea rbx, [rbp - 0x38]
cmove rcx, rbx
call sub.KERNEL32.dll_RemoveDirectoryW
mov r14, qword [rbp - 0x48]
cmp r14, 0xffffffffffffffff
cmovne rbx, r14
test eax, eax
je 0x14002ca64
cmp r14, 0xffffffffffffffff
je 0x14002ca56
call fcn.14009218c
mov esi, dword [rax]
mov rcx, r14
call fcn.140097584
call fcn.14009218c
mov dword [rax], esi
add rsp, 0x150
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
test rsi, rsi
jne 0x14002ca8b
test rbx, rbx
jne 0x14002ca72
xor ecx, ecx
jmp 0x14002ca7d
mov rcx, rbx
call fcn.140099574
mov rcx, rax
mov rdx, rbx
call fcn.140029490
mov rdi, rax
mov rsi, rdx
lea rcx, [0x1400f17b0]
call fcn.140067130
mov rbx, rax
lea rax, [0x1400c5100]
mov qword [rbx], rax
mov qword [rbx + 8], 0
movups xmm0, xmmword [0x1400c50b8]
movups xmmword [rbx + 0x10], xmm0
movups xmm0, xmmword [0x1400c50c8]
movups xmmword [rbx + 0x20], xmm0
movups xmm0, xmmword [0x1400c50d8]
movups xmmword [rbx + 0x30], xmm0
movups xmm0, xmmword [0x1400c50e8]
movups xmmword [rbx + 0x40], xmm0
mov rax, qword [0x1400c50f8]
mov qword [rbx + 0x50], rax
call sub.KERNEL32.dll_GetLastError
lea rcx, str.std_file.d
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0xc6f
mov qword [rsp + 0x20], 0xa
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
mov r9d, eax
call fcn.14002ab30
mov rcx, rbx
call fcn.140046240
int3
Function at 0x14005bb40
Capabilities:
Set registry value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd8], 0xfffffffffffffffe
mov esi, r9d
mov rdi, rcx
mov rbx, qword [rbp + 0x130]
mov r14d, dword [rbp + 0x138]
mov qword [rbp + 0xc8], rdx
mov qword [rbp + 0xd0], r8
lea rcx, [rbp - 0x48]
call fcn.14004ef70
mov rax, qword [rbp - 0x48]
cmp rax, 0xffffffffffffffff
lea rdx, [rbp - 0x38]
cmovne rdx, rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
mov rcx, rdi
xor r8d, r8d
mov r9d, esi
call sub.ADVAPI32.dll_RegSetValueExW
test eax, eax
jne 0x14005bbe5
mov rsi, qword [rbp - 0x48]
cmp rsi, 0xffffffffffffffff
je 0x14005bbd7
call fcn.14009218c
mov edi, dword [rax]
mov rcx, rsi
call fcn.140097584
call fcn.14009218c
mov dword [rax], edi
add rsp, 0x160
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov esi, eax
lea rcx, [0x1400fb6f0]
call fcn.140067130
mov rdi, rax
lea rax, [0x1400daae0]
mov qword [rdi], rax
mov qword [rdi + 8], 0
movups xmm0, xmmword [0x1400dab48]
movups xmmword [rdi + 0x10], xmm0
movups xmm0, xmmword [0x1400dab58]
movups xmmword [rdi + 0x20], xmm0
movups xmm0, xmmword [0x1400dab68]
movups xmmword [rdi + 0x30], xmm0
movups xmm0, xmmword [0x1400dab78]
movups xmmword [rdi + 0x40], xmm0
mov rax, qword [0x1400dab88]
mov qword [rdi + 0x50], rax
lea rax, [0x1400dac52]
mov qword [rsp + 0x20], rax
lea rdx, str.Value_cannot_be_set:__
lea r8, [rbp + 0xc8]
mov ecx, reloc.WS2_32.dll_shutdown
mov r9d, 1
call fcn.14004ea40
mov r9, rdx
lea rcx, str.stdwindows_registry.d
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0x2de
mov qword [rsp + 0x20], reloc.WS2_32.dll_shutdown
mov rcx, rdi
mov edx, esi
mov r8, rax
call fcn.140059320
mov rcx, rdi
call fcn.140046240
int3
Function at 0x14005bcd0
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rbx, rcx
xorps xmm6, xmm6
movups xmmword [r8], xmm6
mov rax, qword [rcx]
mov r14, qword [rax + 0x10]
mov dword [rsp + 0x44], 0
mov rax, qword [rcx + 8]
mov rcx, rax
shr rcx, 0x20
jne 0x14005bd77
mov rsi, r8
mov edi, edx
lea r15, [rbx + 8]
lea r12, [rsp + 0x44]
lea r13, [0x1400f6ab8]
nop word cs:[rax + rax]
mov dword [rsp + 0x44], eax
mov r8, qword [rbx + 0x10]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, r14
mov edx, edi
mov r9, r12
call sub.ADVAPI32.dll_RegEnumKeyExW
cmp eax, 0xea
jne 0x14005be08
mov rdx, qword [r15]
add rdx, rdx
mov rcx, r13
mov r8, r15
call fcn.140069560
mov rax, qword [r15]
mov rcx, rax
shr rcx, 0x20
je 0x14005bd30
lea rcx, [0x1400f16d0]
call fcn.140067130
lea rcx, [0x1400c4bb0]
mov qword [rax], rcx
mov qword [rax + 8], 0
movups xmm0, xmmword [0x1400c4b68]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x1400c4b98]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [0x1400c4b78]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x1400c4b88]
movups xmmword [rax + 0x30], xmm0
mov ecx, dword [0x1400c4ba8]
mov dword [rax + 0x50], ecx
mov qword [rax + 0x10], 0x1c
lea rcx, str.Conversion_positive_overflow
mov qword [rax + 0x18], rcx
mov qword [rax + 0x48], 0
mov qword [rax + 0x20], 0xa
lea rcx, str.stdconv.d
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], 0x625
mov rcx, rax
call fcn.140046240
test eax, eax
jne 0x14005bed7
mov edi, dword [rsp + 0x44]
mov rbx, qword [rbx + 0x10]
mov rdx, qword [0x1400f88c8]
mov rax, qword [rdx]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x58]
mov r8d, 0x20
xor r9d, r9d
call qword [rax + 0x50]
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
mov qword [rsp + 0x48], rax
test rdi, rdi
je 0x14005bec0
lea r14, [rsp + 0x48]
lea r15, [rsp + 0x50]
jmp 0x14005be99
mov rcx, rdi
mov rdx, rbx
mov r8, r15
call fcn.140026ad0
mov edx, eax
mov rax, qword [rsp + 0x50]
lea rbx, [rbx + rax*2]
sub rdi, rax
mov rcx, r14
call fcn.1400141b0
test rdi, rdi
je 0x14005beb6
mov qword [rsp + 0x50], 0
movzx edx, word [rbx]
cmp edx, 0xd7ff
ja 0x14005be70
add rbx, 2
dec rdi
jmp 0x14005be8c
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14005beca
mov rcx, qword [rax + 8]
mov rax, qword [rax + 0x10]
jmp 0x14005bece
xor ecx, ecx
xor eax, eax
mov qword [rsi], rcx
mov qword [rsi + 8], rax
xor eax, eax
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret