joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400012f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0xb0
xor r15d, r15d
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov r14d, r15d
xor eax, eax
lock cmpxchg qword [0x1400035e0], rbx
je 0x140001359
cmp rax, rbx
jne 0x14000134c
mov edi, 1
mov r14d, edi
jmp 0x14000135e
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001330
mov edi, 1
mov eax, dword [0x1400035e8]
cmp eax, edi
jne 0x140001376
mov esi, 0x1f
mov ecx, esi
call fcn.140171000
jmp 0x1400013e7
mov eax, dword [0x1400035e8]
test eax, eax
jne 0x1400013dc
mov dword [0x1400035e8], edi
lea r12, [0x1400021b0]
lea rbx, [0x140002198]
mov qword [rsp + 0x30], rbx
mov eax, r15d
mov dword [rsp + 0x24], eax
cmp rbx, r12
jae 0x1400013ce
test eax, eax
jne 0x1400013d2
mov rsi, qword [rbx]
test rsi, rsi
je 0x1400013c3
mov rcx, rsi
mov rax, qword [0x140002170]
call rax
call rsi
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x1400013a0
test eax, eax
je 0x1400013e2
mov eax, 0xff
jmp 0x140001543
mov dword [0x140003024], edi
mov esi, 0x1f
mov eax, dword [0x1400035e8]
cmp eax, edi
jne 0x14000140e
lea rdx, [0x140002190]
lea rcx, [0x140002180]
call sub.msvcrt.dll__initterm
mov dword [0x1400035e8], 2
test r14d, r14d
jne 0x14000141d
mov rax, r15
xchg qword [0x1400035e0], rax
cmp qword [0x1400035f0], r15
je 0x140001454
lea rcx, [0x1400035f0]
call fcn.140001750
test eax, eax
je 0x140001454
mov rbx, qword [0x1400035f0]
mov rcx, rbx
mov rax, qword [0x140002170]
call rax
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call rbx
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rdx, qword [rax]
test rdx, rdx
jne 0x14000146d
mov eax, 0xff
jmp 0x140001543
mov qword [rsp + 0x28], rdx
mov ecx, dword [rsp + 0x20]
cmp word [rdx], 0x20
ja 0x1400014f4
cmp word [rdx], r15w
je 0x140001486
test ecx, ecx
jne 0x1400014f4
movzx eax, word [rdx]
sub ax, di
cmp ax, si
ja 0x14000149c
add rdx, 2
mov qword [rsp + 0x28], rdx
jmp 0x140001486
mov ecx, dword [rsp + 0x7c]
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
and cl, dil
cmovne r9d, eax
mov r8, rdx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001010
mov dword [0x140003020], eax
cmp dword [0x140003040], r15d
jne 0x1400014dd
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140003024], r15d
jne 0x1400014f2
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140003020]
jmp 0x140001543
cmp word [rdx], 0x22
jne 0x140001508
mov eax, r15d
test ecx, ecx
sete al
mov ecx, eax
mov dword [rsp + 0x20], eax
add rdx, 2
mov qword [rsp + 0x28], rdx
jmp 0x140001476
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
sub rsp, 0x28
call fcn.1400017e4
add rsp, 0x28
jmp 0x1400012f0
Function at 0x140034660
Capabilities:
Check mutex on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], 0
mov qword [rcx + 8], 0
lea r8, str.A946A6A9_917E_4949_B9BC_6BADA8C7FD63
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400346a0
mov rcx, rax
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete byte [rsi]
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x140034840
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14003489c
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jb 0x14003487a
call fcn.140162c00
mov rcx, qword [rdi]
call fcn.140151f40
mov qword [rdi], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14003488c
mov qword [rdi], rsi
call fcn.140162c00
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140036460
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x1400364a6
mov r14, r12
test r14, r14
je 0x1400365a8
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r15
jbe 0x140036508
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x1400364f4
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1401b1b20
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
jmp 0x140036482
mov rax, r12
sub rax, r15
sar rax, 2
cmp r12, r15
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x1400365ce
lea rcx, [r13*8]
call fcn.1401ae97c
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, r12
mov r14, rcx
sub rdx, rbx
je 0x14003656e
lea r14, [rdx + rcx]
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x1400365a8
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x140036556
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], rdx
cmp r12, rbx
je 0x14003658e
add r12, 0xfffffffffffffff8
jne 0x140036581
jmp 0x1400365bb
test r15, r15
je 0x140036482
mov rcx, r15
call fcn.1401ae9b8
mov r14, qword [rsi + 0x10]
jmp 0x140036482
lea rcx, [0x1402f4f7c]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.1401ec0b0
lea rcx, [0x1402f4f7c]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.1401ec0b0
call fcn.1401e8c80
int3
Function at 0x1400443f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14004444d
mov dl, byte [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x14035cc68]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rbx, [rbp - 0x20]
mov rcx, r9
mov rdx, rbx
call fcn.14014e4e0
lea rdx, [0x1403814e0]
mov rcx, rbx
call fcn.14014f100
mov r14, rax
mov rcx, qword [rbp - 0x20]
lea rax, [0x140381308]
cmp rcx, rax
je 0x140044499
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140044499
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x14035cc68]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1402eb060]
movaps xmmword [rbx], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [0x14035cc68]
movzx eax, byte [rbx + 0x17]
mov rdx, rax
test al, al
jns 0x1400444dc
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
test rdx, rdx
je 0x14004454c
test al, al
cmovns rcx, rbx
mov r14, rcx
jmp 0x14004452e
movzx edx, al
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [0x14035cc68]
cmp eax, 0xffffffff
jne 0x14004450a
xor edi, edi
movzx eax, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rdx, rbx
mov r8, rax
test al, al
jns 0x140044523
mov r8, qword [rbp - 0x18]
mov rdx, rcx
add rdx, r8
inc r14
cmp r14, rdx
je 0x14004454c
test rdi, rdi
je 0x140044508
mov al, byte [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x1400444f0
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
jmp 0x14004450a
mov qword [rsi], rdi
test al, al
jns 0x14004443d
call fcn.1401ae9b8
jmp 0x14004443d
Function at 0x140050390
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rcx], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400503ce
call fcn.140162c00
mov rcx, rsi
mov rdx, r14
call fcn.140034840
mov qword [rsi + 8], 0xffffffffffffffff
lea r14, [rsi + 0x10]
xor eax, eax
mov qword [rsp + 0x28], rax
mov r15, qword [rdi]
mov qword [rdi], rax
cmp r15, 0xffffffffffffffff
je 0x140050402
test r15, r15
je 0x140050426
call fcn.140162c00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
lea rax, [r15 + 1]
cmp rax, 2
jb 0x14005041e
mov qword [rsp + 0x28], r15
call fcn.140162c00
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.1400b7300
mov rax, qword [rbx]
inc rax
cmp rax, 2
jb 0x140050453
call fcn.140162c00
mov rcx, qword [rbx]
call fcn.140151f40
mov qword [rbx], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jb 0x140050473
call fcn.140162c00
mov rcx, qword [rdi]
call fcn.140151f40
mov qword [rdi], 0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401b0080
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14005f8e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
add rsp, 0x38
ret

Function at 0x14005f910
Capabilities:
Delete registry key

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [rcx]
test rcx, rcx
je 0x14005f9de
mov ebp, r8d
mov rbx, rdx
movabs r15, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], r15
xor eax, eax
mov qword [rsp + 0x38], rax
mov r12d, dword [rsi + 8]
mov r9d, r12d
or r9d, 0x10001
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rsp + 0x20], rdx
mov rdx, rbx
mov r8d, 8
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005f9be
mov r14, qword [rsp + 0x40]
mov qword [rsp + 0x28], r14
and r12d, 0x300
mov dword [rsp + 0x30], r12d
test bpl, bpl
je 0x14005f9e5
test r14, r14
je 0x14005f9af
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [rsi + 8]
mov rcx, qword [rsi]
mov rdx, rbx
call fcn.14005fa50
mov edi, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401b0080
mov eax, edi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edi, 6
jmp 0x14005f9c0
lea rdi, [rsp + 0x40]
mov qword [rdi], r15
lea rcx, [rsp + 0x28]
mov rdx, rdi
call fcn.14005fc20
cmp byte [rdi + 4], 0
je 0x14005fa0b
mov edi, dword [rsp + 0x40]
test r14, r14
je 0x14005f9c0
jmp 0x14005fa26
mov r8d, dword [rsi + 8]
lea rdx, [0x1402f73ca]
mov rcx, r14
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov edi, eax
jmp 0x14005fa04
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14005f9c0
mov edx, 1
call fcn.140060640
jmp 0x14005f9c0
Function at 0x14005fa50
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov esi, r8d
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [0x1402eb060]
movaps xmmword [rsp + 0x40], xmm0
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov r9d, r8d
or r9d, 0x10009
lea rax, [rsp + 0x60]
mov qword [rax], rbx
mov qword [rsp + 0x20], rax
mov r8d, 8
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005fb47
lea rbx, [rsp + 0x60]
mov rdi, qword [rbx]
lea rcx, [rsp + 0x40]
mov qword [rcx], rdi
mov eax, esi
and eax, 0x300
mov dword [rcx + 8], eax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbx], rax
mov rdx, rbx
call fcn.14005fc20
cmp byte [rbx + 4], 0
jne 0x14005fbff
lea rdx, [0x1402f73ca]
xor ebx, ebx
mov rcx, rdi
mov r8d, esi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
jne 0x14005fb4f
test rdi, rdi
je 0x14005fb16
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x14005fc08
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401b0080
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
cmp eax, 2
cmovne ebx, eax
jmp 0x14005fb16
mov ecx, 0x200
call fcn.1401ae9ec
mov r14, rax
mov r8d, 0x200
mov rcx, rax
xor edx, edx
call fcn.1401b21d0
xorps xmm6, xmm6
lea rbx, [rsp + 0x60]
mov r15, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x60], 0x100
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, rdi
xor edx, edx
mov r8, r14
mov r9, rbx
call r15
test eax, eax
jne 0x14005fbcc
mov eax, dword [rsp + 0x60]
cmp rax, 0x100
jae 0x14005fc17
cmp word [r14 + rax*2], 0
jne 0x14005fc1a
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, r14
mov r8d, esi
call fcn.14005fa50
test eax, eax
je 0x14005fb7b
jmp 0x14005fbd1
mov rdi, qword [rsp + 0x40]
lea rdx, [0x1402f73ca]
mov rcx, rdi
mov r8d, esi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ebx, eax
test r14, r14
je 0x14005fb08
mov rcx, r14
call fcn.1401ae9f4
jmp 0x14005fb08
mov ebx, dword [rsp + 0x60]
jmp 0x14005fb08
mov edx, 1
call fcn.140060640
jmp 0x14005fb24
int3
int3
Function at 0x14005fc20
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea r9, [rsp + 0x3c]
mov dword [r9], 0
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rdx, str.SymbolicLinkValue
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x14005fc86
mov byte [rsi], 0
xor eax, eax
mov byte [rsi + 4], al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401b0080
mov rax, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
test eax, eax
jne 0x14005fcd4
cmp dword [rsp + 0x3c], 6
jne 0x14005fc67
mov rcx, qword [rdi]
call sub.ntdll.dll_NtDeleteKey
test eax, eax
je 0x14005fcda
mov edi, eax
mov eax, dword [0x1403821e0]
mov ecx, dword [0x14037f078]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005fce9
mov rax, qword [0x1403821d8]
test rax, rax
je 0x14005fce2
mov ecx, edi
call qword [0x14035cc68]
mov dword [rsi], eax
mov al, 1
jmp 0x14005fc6c
mov dword [rsi], 0
jmp 0x14005fcd6
mov eax, 5
jmp 0x14005fcd4
lea rcx, [0x1403821e0]
call fcn.1401aead0
cmp dword [0x1403821e0], 0xffffffff
jne 0x14005fcc0
lea rcx, [0x140307d04]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlNtStatusToDosError
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403821d8], rax
lea rcx, [0x1403821e0]
call fcn.1401aeb68
jmp 0x14005fcc0

Function at 0x14005fd40
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea r8, [rsp + 0x38]
mov dword [r8], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005fdc8
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x14005fdb2
cmp dword [rsp + 0x38], 4
jne 0x14005fdb2
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401b0080
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x14005fdb2
Function at 0x14005fdd0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.1401b0020
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1401b21d0
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005fe83
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x14005fe87
lea rdx, [rsp + 0x840]
mov rcx, rsi
call fcn.14004a8c0
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1401b0080
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x14005fe64
cmp eax, 2
jne 0x14005fecf
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1401b21d0
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x14005fed6
lea rdx, [rsp + 0x40]
jmp 0x14005fe5a
mov edi, 0x3f4
jmp 0x14005fe64
mov edi, 0xea
jmp 0x14005fe64

Function at 0x14005fee0
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401b0080
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x14005ff40
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.1401d1e74
lea eax, [rax*2 + 2]
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140060040
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rcx], 0
je 0x14006012f
cmp dword [rsi + 8], 0xffffffff
je 0x14006012f
lea rdi, [rsi + 0x10]
cmp byte [rsi + 0x27], 0
jns 0x14006015b
mov ebp, dword [rsi + 0x20]
dec ebp
lea rbx, [rsp + 0x44]
mov dword [rbx], ebp
mov eax, dword [rsi + 0x30]
mov r12, qword [rsi + 0x28]
sub eax, r12d
and eax, 0xfffffffe
add eax, 0xfffffffe
lea r14, [rsi + 0x40]
mov dword [rsi + 0x40], eax
lea r15, [rsi + 0x44]
mov edx, ebp
mov rcx, rdi
call fcn.140061590
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
mov r8, rax
mov r9, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x140060178
test eax, eax
jne 0x14006012f
mov eax, dword [rsi + 0x40]
inc rax
shr rax, 1
mov rcx, qword [rsi + 0x28]
mov rdx, qword [rsi + 0x30]
sub rdx, rcx
sar rdx, 1
cmp rdx, rax
jbe 0x140060165
mov word [rcx + rax*2], 0
mov sil, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401b0080
mov eax, esi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [rsi + 0x10]
cmp byte [rsi + 0x27], 0
jns 0x14006013c
mov rax, qword [rax]
mov word [rax], 0
mov rax, qword [rsi + 0x28]
cmp qword [rsi + 0x30], rax
je 0x140060165
mov word [rax], 0
mov dword [rsi + 0x40], 0
xor esi, esi
jmp 0x140060111
mov ebp, 0xa
jmp 0x140060087
lea rcx, [0x1402f4f7c]
lea rdx, str....._third_partylibc_srcinclude_vector:1411:_assertion___n___size___failed:_vector___index_out_of_bounds_n
call fcn.1401ec0b0
mov edx, dword [rsi + 0x40]
inc rdx
shr rdx, 1
mov r12, qword [rsi + 0x28]
mov rax, qword [rsi + 0x30]
sub rax, r12
mov rcx, rax
sar rcx, 1
cmp rcx, rdx
ja 0x1400601b9
lea rcx, [rsi + 0x28]
inc rdx
lea r8, [rsp + 0x42]
mov word [r8], 0
call fcn.140060250
mov r12, qword [rsi + 0x28]
mov rax, qword [rsi + 0x30]
sub rax, r12
and eax, 0xfffffffe
add eax, 0xfffffffe
mov dword [rsi + 0x40], eax
lea rbx, [rsp + 0x44]
cmp dword [rbx], ebp
mov edx, 0x4000
cmovne edx, ebp
mov dword [rbx], edx
mov rcx, rdi
call fcn.140061590
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
mov r8, rax
mov r9, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x1400600e8

Function at 0x140060230
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [rcx + 8]
cmp eax, 0xffffffff
je fcn.140060040
dec eax
mov dword [rcx + 8], eax
jmp fcn.140060040
Function at 0x1400602d0
Capabilities:
Query or enumerate registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x70], rax
or r9d, 0x20019
mov qword [rsp + 0x20], rcx
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400603a5
lea rdi, [rsp + 0x64]
mov dword [rdi], 0
mov rcx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x58], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1400603c7
mov edx, dword [rsp + 0x64]
sub edx, 1
setb al
mov dword [rsi + 8], edx
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400603ac
test al, al
jne 0x1400603ac
lea r8, [rsi + 0xc]
lea r9, [rsp + 0x6c]
mov dword [r9], 0x104
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400603b2
jmp 0x1400603ac
mov qword [rsi], 0
mov word [rsi + 0xc], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401b0080
nop
add rsp, 0x78
pop rdi
pop rsi
ret
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400603a5

Function at 0x140060460
Capabilities:
Query or enumerate registry key

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x14036e038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, dword [rcx + 8]
cmp edx, 0xffffffff
je 0x1400604ea
sub edx, 1
setb al
mov dword [rsi + 8], edx
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400604ea
test al, al
jne 0x1400604ea
lea r8, [rsi + 0xc]
lea r9, [rsp + 0x54]
mov dword [r9], 0x104
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r10, [rsp + 0x4c]
mov qword [r10], rax
mov qword [rsp + 0x38], r10
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400604ea
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401b0080
nop
add rsp, 0x60
pop rsi
ret
mov word [rsi + 0xc], 0
jmp 0x1400604d6