joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f0a0
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x30
lea rcx, [0x140085d18]
call fcn.14000c1c0
mov rdi, rax
test rax, rax
jne 0x14002f0c0
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x48], rbx
xor r8d, r8d
mov qword [rsp + 0x50], rbp
xor edx, edx
mov qword [rsp + 0x20], r14
mov rcx, rdi
xor r14b, r14b
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
mov rbx, 0xffffffffffffffff
test eax, eax
je 0x14002f165
mov ecx, ebp
mov qword [rsp + 0x28], rsi
lea edx, [rbx + 3]
call fcn.1400462ec
mov rsi, rax
test rax, rax
je 0x14002f160
mov r8d, ebp
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14002f13d
lea r8, [0x140085560]
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14004ccec
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14002f13d
mov r14b, 1
call fcn.14004c82c
mov r8, rbx
inc r8
cmp word [rsi + r8*2], 0
jne 0x14002f140
add r8, r8
xor edx, edx
mov rcx, rsi
call fcn.1400452a0
mov rcx, rsi
call fcn.1400462d0
mov rsi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
nop word [rax + rax]
cmp word [rdi + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x14002f170
lea r8, [rbx + rbx]
xor edx, edx
mov rcx, rdi
call fcn.1400452a0
mov rcx, rdi
call fcn.1400462d0
mov rbx, qword [rsp + 0x48]
movzx eax, r14b
mov r14, qword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x140033460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14003347a
test al, 0x10
je 0x14003347a
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x1400345f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push r12
push r15
sub rsp, 0x40
mov rsi, rcx
mov r15d, edx
mov ecx, edx
mov r12, r9
mov ebp, r8d
call fcn.1400462e4
mov rbx, rax
test rax, rax
je 0x140034802
mov ecx, 0x20
mov qword [rsp + 0x80], rdi
call fcn.1400462e4
mov rdi, rax
test rax, rax
je 0x1400347fa
mov rcx, rax
call fcn.140005f10
test al, al
je 0x1400347fa
lea edx, [rbp - 1]
mov qword [rsp + 0x38], r13
imul edx, r15d
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], 0
mov r8d, r15d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r13d, dword [rsp + 0x98]
test eax, eax
je 0x14003477a
movzx eax, byte [rbx]
cmp al, 5
jne 0x14003480e
movzx r14d, byte [rbx + 3]
mov esi, 0
movzx eax, byte [rbx + 4]
shl r14d, 8
add r14d, eax
je 0x140034735
nop dword [rax]
lea eax, [rsi*2 + 0xc]
mov edx, 0x10
movzx ebp, byte [rax + rbx]
lea eax, [rsi*2 + 0xd]
movzx eax, byte [rax + rbx]
shl ebp, 8
lea ecx, [rdx - 0xf]
add ebp, eax
call fcn.1400462ec
mov r9, rax
test rax, rax
je 0x14003472e
movzx r8d, byte [rbp + rbx]
lea ecx, [rbp + 1]
movzx ecx, byte [rcx + rbx]
lea eax, [rbp + 3]
movzx eax, byte [rax + rbx]
mov rdx, r9
shl r8d, 8
add r8d, ecx
lea ecx, [rbp + 2]
movzx ecx, byte [rcx + rbx]
shl r8d, 8
add r8d, ecx
mov rcx, rdi
shl r8d, 8
add r8d, eax
mov dword [r9], r8d
call fcn.1400057c0
inc esi
cmp esi, r14d
jb 0x1400346c0
movzx eax, byte [rbx + 9]
movzx esi, byte [rbx + 8]
shl esi, 8
add esi, eax
movzx eax, byte [rbx + 0xa]
shl esi, 8
add esi, eax
movzx eax, byte [rbx + 0xb]
shl esi, 8
add esi, eax
je 0x140034775
mov edx, 0x10
lea ecx, [rdx - 0xf]
call fcn.1400462ec
test rax, rax
je 0x140034775
mov rdx, rax
mov dword [rax], esi
mov rcx, rdi
call fcn.1400057c0
mov rsi, qword [rsp + 0x70]
mov r14d, dword [rsp + 0x90]
mov rcx, rbx
call fcn.1400462d0
xor ebp, ebp
mov ebx, ebp
cmp qword [rdi + 8], rbx
jbe 0x1400347de
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rdi]
mov r9, r12
mov dword [rsp + 0x28], r13d
mov edx, r15d
mov dword [rsp + 0x20], r14d
mov rcx, qword [rax + rbx*8]
mov r8d, dword [rcx]
mov rcx, rsi
call fcn.1400345f0
mov rcx, qword [rdi]
mov rcx, qword [rcx + rbx*8]
call fcn.1400462d0
mov rax, qword [rdi]
mov qword [rax + rbx*8], rbp
inc rbx
cmp rbx, qword [rdi + 8]
jb 0x1400347a0
xor edx, edx
mov rcx, rdi
call fcn.140005c80
mov rcx, rdi
call fcn.1400462d0
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r12
pop rsi
pop rbp
pop rbx
ret
cmp al, 0xd
jne 0x14003477a
movzx ebp, byte [rbx + 3]
mov esi, 0
movzx eax, byte [rbx + 4]
mov r14d, dword [rsp + 0x90]
shl ebp, 8
add ebp, eax
je 0x14003487f
nop dword [rax]
nop word [rax + rax]
lea eax, [rsi*2 + 8]
mov dword [rsp + 0x28], r13d
movzx edx, byte [rax + rbx]
mov r9, r12
shl rdx, 8
lea eax, [rsi*2 + 9]
movzx ecx, byte [rax + rbx]
mov r8d, r15d
mov dword [rsp + 0x20], r14d
lea rax, [rbx + rdx]
movzx edx, byte [rbx]
add rcx, rax
call fcn.140033cd0
inc esi
cmp esi, ebp
jb 0x140034840
mov rsi, qword [rsp + 0x70]
jmp 0x140034782
Function at 0x140036bf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x140073010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rsi, rdx
mov qword [rsp + 0x30], rdx
mov rbx, rcx
call fcn.140036b70
mov qword [rsp + 0x28], rax
mov rdi, rax
test rsi, rsi
je 0x140036ddc
mov qword [rsp + 0x168], r12
mov qword [rsp + 0x160], r13
mov qword [rsp + 0x158], r14
mov qword [rsp + 0x150], r15
test rbx, rbx
je 0x140036db2
test rax, rax
je 0x140036db2
xor esi, esi
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call fcn.1400366c0
mov r14, qword [rsp + 0x20]
mov r13, rax
cmp r14, 0x10
jae 0x140036c8f
mov rcx, rax
call fcn.1400462d0
jmp 0x140036db4
test r14b, 0xf
jne 0x140036db4
cmp r14, 0x20
jb 0x140036db4
lea r12, [r14 - 0x10]
mov edx, 1
mov rcx, r12
call fcn.1400462ec
mov r15, rax
test rax, rax
je 0x140036da3
lea rdx, [r13 + 0x10]
mov qword [rsp + 0x1a0], rbp
mov r8, r12
mov rcx, rax
call fcn.140044e90
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140041bb0
movups xmm0, xmmword [r13]
lea eax, [r14 - 0x10]
mov rbx, r15
mov ebp, eax
movaps xmmword [rsp + 0x130], xmm0
test eax, eax
je 0x140036d66
lea rdi, [rsp + 0x130]
sub rdi, r15
dec rbp
shr rbp, 4
inc rbp
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140042610
mov ecx, 0x10
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140036d40
sub rdi, 0x10
movaps xmmword [rsp + 0x130], xmm0
sub rbp, 1
jne 0x140036d20
mov rdi, qword [rsp + 0x28]
mov rcx, r13
call fcn.1400462d0
movsx rcx, byte [r14 + r15 - 0x11]
mov rbp, qword [rsp + 0x1a0]
lea rax, [rcx - 1]
cmp rax, 0xf
ja 0x140036da8
sub r14, rcx
sub r14, 0x10
cmp r14, r12
jae 0x140036da3
sub r12, r14
lea rcx, [r14 + r15]
mov r8, r12
xor edx, edx
call fcn.1400452a0
mov rsi, r15
jmp 0x140036db4
mov rcx, r15
call fcn.1400462d0
jmp 0x140036db4
xor esi, esi
mov rax, qword [rsp + 0x30]
mov r15, qword [rsp + 0x150]
mov r14, qword [rsp + 0x158]
mov r13, qword [rsp + 0x160]
mov r12, qword [rsp + 0x168]
mov qword [rax], rsi
mov rcx, rdi
call fcn.1400462d0
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140043fc0
add rsp, 0x170
pop rdi
pop rsi
pop rbx
ret
Function at 0x140036e00
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x140073010]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x20], rcx
mov r14, r9
mov r12, rdx
test rcx, rcx
je 0x140037050
test rdx, rdx
je 0x140037050
mov edx, 1
mov dword [rbp + 0x30], 0x6cb10a8
mov dword [rbp + 0x34], 0xd88e0683
mov dword [rbp + 0x38], 0xfb8aca17
mov dword [rbp + 0x3c], 0x80fcdece
lea ecx, [rdx + 0x1f]
mov dword [rbp + 0x40], 0x4057a424
mov dword [rbp + 0x44], 0x43d53696
mov dword [rbp + 0x48], 0x1d66eb90
mov dword [rbp + 0x4c], 0xbb6a62a3
call fcn.1400462ec
mov r13, rax
test rax, rax
je 0x140036ecb
xor r8d, r8d
lea r10, [rbp + 0x30]
sub r10, rax
mov r9, rax
nop dword [rax]
movzx ecx, byte [r10 + r9]
lea r9, [r9 + 1]
mov edx, r8d
lea eax, [rcx - 0x35]
xor cl, 0x1d
and dl, 1
movzx ecx, cl
movzx eax, al
cmovne ecx, eax
inc r8d
mov byte [r9 - 1], cl
cmp r8d, 0x20
jl 0x140036ea0
mov rax, r12
lea rsi, [r12 + 0x10]
and eax, 0xf
mov edi, 0x10
sub rdi, rax
mov edx, 1
add rsi, rdi
mov rcx, rsi
call fcn.1400462ec
mov qword [r14], rax
mov rbx, rax
test rax, rax
je 0x140037050
xor ecx, ecx
mov qword [rsp + 0x1b0], r15
call fcn.1400467d4
mov rcx, rax
call fcn.140046c94
mov r15d, 0x10
nop word [rax + rax]
call fcn.140046c68
and eax, 0x800000ff
jge 0x140036f35
dec eax
or eax, 0xffffff00
inc eax
mov byte [rbx], al
inc rbx
sub r15, 1
jne 0x140036f20
mov rcx, qword [r14]
mov r8, r12
mov rdx, qword [rsp + 0x20]
add rcx, 0x10
call fcn.140044e90
mov r15, qword [rsp + 0x1b0]
mov rdx, rsi
sub rdx, rdi
mov rbx, rdx
cmp rdx, rsi
jae 0x140036fb4
cmp rdi, 0x10
jb 0x140036fc0
mov rax, qword [r14]
lea rcx, [rax - 1]
add rcx, rsi
lea r9, [rax + rdx]
cmp r9, r14
ja 0x140036f88
cmp rcx, r14
jae 0x140036fc0
mov rax, rdi
mov r8, rsi
and eax, 0xf
sub r8, rax
add rbx, 0x10
cmp rbx, r8
jb 0x140036f94
sub r8, rdx
mov rcx, r9
add r8, 0xf
movzx edx, dil
and r8, 0xfffffffffffffff0
call fcn.1400452a0
cmp rbx, rsi
jae 0x140036fcf
nop dword [rax]
mov rax, qword [r14]
mov byte [rbx + rax], dil
inc rbx
cmp rbx, rsi
jb 0x140036fc0
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.140041bb0
mov rcx, qword [r14]
lea eax, [rsi - 0x10]
mov edi, eax
lea r8, [rbp + 0x20]
lea rbx, [rcx + 0x10]
movups xmm0, xmmword [rcx]
movaps xmmword [rbp + 0x20], xmm0
test eax, eax
je 0x14003704b
dec rdi
shr rdi, 4
inc rdi
nop dword [rax]
nop word [rax + rax]
mov rcx, rbx
sub r8, rbx
mov edx, 0x10
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140037020
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140042310
mov r8, rbx
add rbx, 0x10
sub rdi, 1
jne 0x140037010
mov rax, rsi
jmp 0x140037052
xor eax, eax
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140043fc0
add rsp, 0x160
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140037070
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140073010]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov r12, r9
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400372a8
test rdx, rdx
je 0x1400372a8
cmp qword [r9], 0
jne 0x1400372a8
test r14b, 0xf
jne 0x1400372a8
cmp rdx, 0x20
jb 0x1400372a8
mov dword [rbp + 0x20], 0x6cb10a8
mov dword [rbp + 0x24], 0xd88e0683
mov dword [rbp + 0x28], 0xfb8aca17
mov dword [rbp + 0x2c], 0x80fcdece
mov dword [rbp + 0x30], 0x4057a424
mov dword [rbp + 0x34], 0x43d53696
mov dword [rbp + 0x38], 0x1d66eb90
mov dword [rbp + 0x3c], 0xbb6a62a3
test r8, r8
jne 0x14003715d
lea edx, [r8 + 1]
lea ecx, [rdx + 0x1f]
call fcn.1400462ec
mov rbx, rax
test rax, rax
je 0x140037160
xor r8d, r8d
lea r10, [rbp + 0x20]
sub r10, rax
mov r9, rax
nop dword [rax]
movzx ecx, byte [r10 + r9]
lea r9, [r9 + 1]
mov edx, r8d
lea eax, [rcx - 0x35]
xor cl, 0x1d
and dl, 1
movzx ecx, cl
movzx eax, al
cmovne ecx, eax
inc r8d
mov byte [r9 - 1], cl
cmp r8d, 0x20
jl 0x140037130
jmp 0x140037160
mov rbx, r8
lea rsi, [r14 - 0x10]
mov edx, 1
mov rcx, rsi
call fcn.1400462ec
mov qword [r12], rax
test rax, rax
je 0x1400372a8
lea rdx, [rdi + 0x10]
mov r8, rsi
mov rcx, rax
call fcn.140044e90
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140041bb0
movups xmm0, xmmword [rdi]
mov rbx, qword [r12]
lea eax, [r14 - 0x10]
mov r15d, eax
movaps xmmword [rbp + 0x10], xmm0
test eax, eax
je 0x140037211
lea rdi, [rbp + 0x10]
sub rdi, rbx
dec r15
shr r15, 4
inc r15
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140042610
mov ecx, 0x10
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400371f0
sub rdi, 0x10
movaps xmmword [rbp + 0x10], xmm0
sub r15, 1
jne 0x1400371d0
mov rbx, qword [r12]
movsx r15, byte [rbx + r14 - 0x11]
lea rax, [r15 - 1]
cmp rax, 0xf
ja 0x1400372a8
sub r14, r15
mov rax, rsi
sub r14, 0x10
sub rax, r14
mov rdi, r14
cmp r14, rsi
jae 0x14003727e
cmp rax, 0x10
jb 0x140037290
lea rcx, [rsi - 1]
add rcx, rbx
lea r9, [r14 + rbx]
cmp r9, r12
ja 0x140037255
cmp rcx, r12
jae 0x140037290
and eax, 0xf
mov r8, rsi
sub r8, rax
nop
add rdi, 0x10
cmp rdi, r8
jb 0x140037260
sub r8, r14
xor edx, edx
add r8, 0xf
mov rcx, r9
and r8, 0xfffffffffffffff0
call fcn.1400452a0
cmp rdi, rsi
jae 0x1400372a0
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r12]
mov byte [rdi + rcx], 0
inc rdi
cmp rdi, rsi
jb 0x140037290
sub rsi, r15
mov rax, rsi
jmp 0x1400372aa
xor eax, eax
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.140043fc0
add rsp, 0x150
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400376b0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x140073010]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
test rcx, rcx
jne 0x1400376fb
mov r8d, 0x10e
lea rdx, str.D:WorkProjectsPRS_SVNsTFS_PHDL_INCREMENT_VERSION_SIEMENSClientSideRangerRangerServicesPrsCoreSourceFilesHelpersEncryptionHelper.c
lea rcx, str.message___NULL
call fcn.1400473ec
test rdi, rdi
jne 0x140037719
mov r8d, 0x10f
lea rdx, str.D:WorkProjectsPRS_SVNsTFS_PHDL_INCREMENT_VERSION_SIEMENSClientSideRangerRangerServicesPrsCoreSourceFilesHelpersEncryptionHelper.c
lea rcx, str.messageLength___0
call fcn.1400473ec
cmp qword [rsi], 0
je 0x140037738
mov r8d, 0x110
lea rdx, str.D:WorkProjectsPRS_SVNsTFS_PHDL_INCREMENT_VERSION_SIEMENSClientSideRangerRangerServicesPrsCoreSourceFilesHelpersEncryptionHelper.c
lea rcx, str.hash__NULL
call fcn.1400473ec
test rbp, rbp
je 0x14003783c
test rdi, rdi
je 0x14003783c
cmp qword [rsi], 0
jne 0x14003783c
mov edx, 1
lea ecx, [rdx + 0x1f]
call fcn.1400462ec
mov qword [rsi], rax
mov rdx, rax
test rax, rax
je 0x14003783c
xor eax, eax
mov qword [rsp + 0xb0], rbx
xor ebx, ebx
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x6a09e667
mov dword [rsp + 0x74], 0xbb67ae85
mov dword [rsp + 0x78], 0x3c6ef372
mov dword [rsp + 0x7c], 0xa54ff53a
mov dword [rsp + 0x80], 0x510e527f
mov dword [rsp + 0x84], 0x9b05688c
mov dword [rsp + 0x88], 0x1f83d9ab
mov dword [rsp + 0x8c], 0x5be0cd19
test rdi, rdi
je 0x140037823
xor edx, edx
nop dword [rax + rax]
mov ecx, eax
movzx eax, byte [rdx + rbp]
mov byte [rsp + rcx + 0x20], al
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
cmp eax, 0x40
jne 0x140037817
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.140041480
add qword [rsp + 0x68], 0x200
xor eax, eax
mov dword [rsp + 0x60], eax
inc ebx
mov edx, ebx
cmp rdx, rdi
jb 0x1400377e0
mov rdx, qword [rsi]
lea rcx, [rsp + 0x20]
call fcn.1400419d0
mov rbx, qword [rsp + 0xb0]
mov eax, 0x20
jmp 0x14003783e
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140043fc0
lea r11, [rsp + 0xa0]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140038860
Capabilities:
Get common file path

Disassembly:
test rcx, rcx
je 0x140038a00
mov r11, rsp
push rdi
sub rsp, 0x160
mov rax, qword [0x140073010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword [rcx]
mov rdi, rcx
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
xor esi, esi
test rax, rax
je 0x1400388a0
cmp dword [rax + 0x18], esi
jne 0x1400388e2
mov ecx, 0x20
call fcn.1400462e4
mov qword [rdi], rax
mov rbx, rax
test rax, rax
je 0x1400389d8
mov ecx, 0x40
mov qword [rax + 8], rsi
call fcn.1400462e4
mov qword [rbx], rax
test rax, rax
je 0x1400389d8
mov qword [rbx + 0x10], 8
mov dword [rbx + 0x18], 0x100
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x17]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x140038917
lea rcx, [rsp + 0x40]
call fcn.1400463c8
mov rcx, qword [rdi]
mov rdx, rax
call section..text
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rsi
call fcn.1400034f0
cmp qword [rsp + 0x38], rsi
je 0x1400389d8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x180], rbp
lea rcx, str.ZNmYdEp3Dl7g9w0qaOELQBYlJG0dKGpjnEUYt9bcr7M
mov qword [rsp + 0x30], rsi
call fcn.140036bf0
mov rbx, qword [rsp + 0x30]
mov rax, 0xffffffffffffffff
mov rcx, rax
nop
inc rcx
cmp byte [rbx + rcx], sil
jne 0x140038960
mov r8, qword [rsp + 0x38]
nop
cmp byte [r8 + rax + 1], sil
lea rax, [rax + 1]
jne 0x140038970
lea rbp, [rax + 1]
mov edx, 8
add rbp, rcx
mov rcx, rbp
call fcn.1400462ec
mov rsi, rax
test rax, rax
je 0x1400389d0
mov r8, qword [rsp + 0x38]
mov rdx, rbp
mov rcx, rax
call fcn.140046b08
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.140046b08
mov rcx, rsi
call fcn.1400463c8
mov rcx, qword [rdi]
mov rdx, rax
call section..text
mov rcx, rsi
call fcn.1400462d0
mov rbp, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x178]
mov rsi, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140043fc0
add rsp, 0x160
pop rdi
ret
Function at 0x140038869
Capabilities:
Get common file path

Disassembly:
test rcx, rcx
je 0x140038a00
mov r11, rsp
push rdi
sub rsp, 0x160
mov rax, qword [0x140073010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword [rcx]
mov rdi, rcx
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
xor esi, esi
test rax, rax
je 0x1400388a0
cmp dword [rax + 0x18], esi
jne 0x1400388e2
mov ecx, 0x20
call fcn.1400462e4
mov qword [rdi], rax
mov rbx, rax
test rax, rax
je 0x1400389d8
mov ecx, 0x40
mov qword [rax + 8], rsi
call fcn.1400462e4
mov qword [rbx], rax
test rax, rax
je 0x1400389d8
mov qword [rbx + 0x10], 8
mov dword [rbx + 0x18], 0x100
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x17]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x140038917
lea rcx, [rsp + 0x40]
call fcn.1400463c8
mov rcx, qword [rdi]
mov rdx, rax
call section..text
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rsi
call fcn.1400034f0
cmp qword [rsp + 0x38], rsi
je 0x1400389d8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x180], rbp
lea rcx, str.ZNmYdEp3Dl7g9w0qaOELQBYlJG0dKGpjnEUYt9bcr7M
mov qword [rsp + 0x30], rsi
call fcn.140036bf0
mov rbx, qword [rsp + 0x30]
mov rax, 0xffffffffffffffff
mov rcx, rax
nop
inc rcx
cmp byte [rbx + rcx], sil
jne 0x140038960
mov r8, qword [rsp + 0x38]
nop
cmp byte [r8 + rax + 1], sil
lea rax, [rax + 1]
jne 0x140038970
lea rbp, [rax + 1]
mov edx, 8
add rbp, rcx
mov rcx, rbp
call fcn.1400462ec
mov rsi, rax
test rax, rax
je 0x1400389d0
mov r8, qword [rsp + 0x38]
mov rdx, rbp
mov rcx, rax
call fcn.140046b08
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.140046b08
mov rcx, rsi
call fcn.1400463c8
mov rcx, qword [rdi]
mov rdx, rax
call section..text
mov rcx, rsi
call fcn.1400462d0
mov rbp, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x178]
mov rsi, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140043fc0
add rsp, 0x160
pop rdi
ret
Function at 0x14003af20
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140073010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov r15, rdx
mov r14, rcx
test rcx, rcx
je 0x14003b0dd
test rdx, rdx
je 0x14003b0dd
test rbx, rbx
je 0x14003b0dd
xor ebp, ebp
mov rdi, 0xffffffffffffffff
mov esi, ebp
mov rcx, rdi
inc rcx
cmp byte [r8 + rcx], sil
jne 0x14003af71
add rcx, 1
mov edx, 2
cmovb rcx, rdi
call fcn.1400462ec
mov rdx, rax
mov rcx, rax
movsx eax, byte [rbx]
test al, al
je 0x14003afac
test rdx, rdx
je 0x14003af92
inc esi
mov word [rcx], ax
inc rbx
add rcx, 2
jmp 0x14003af92
test rdx, rdx
je 0x14003afb8
movsxd rax, esi
mov word [rdx + rax*2], bp
mov rcx, rdx
call fcn.1400372d0
mov rsi, rax
test rax, rax
je 0x14003b0b2
mov rcx, rdi
nop
inc rcx
cmp word [rax + rcx*2], bp
jne 0x14003afd0
add rcx, 1
mov edx, 1
cmovb rcx, rdi
call fcn.1400462ec
mov rbx, rax
mov rdx, rax
mov rax, rsi
movzx ecx, word [rax]
test cx, cx
je 0x14003b00e
test rbx, rbx
je 0x14003aff4
inc ebp
mov byte [rdx], cl
add rax, 2
inc rdx
jmp 0x14003aff4
test rbx, rbx
je 0x14003b0b2
movsxd rax, ebp
mov rcx, rsi
mov byte [rax + rbx], 0
call fcn.1400462d0
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14003b0dd
mov rax, rdi
inc rax
cmp byte [rbx + rax], 0
jne 0x14003b054
mov rcx, qword [rsp + 0x30]
inc eax
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
inc rdi
cmp byte [rbx + rdi], 0
jne 0x14003b081
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.1400452a0
mov rcx, rbx
call fcn.1400462d0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x14003b0dd
xor eax, eax
jmp 0x14003b0e2
mov rcx, rsi
call fcn.1400462d0
lea rcx, [rsp + 0x30]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140043fc0
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003b110
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140073010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, dword [0x140074e20]
xor r14d, r14d
mov dword [rsp + 0x40], eax
mov r15, rdx
mov qword [rsp + 0x38], r14
test rcx, rcx
jne 0x14003b238
lea rdx, [rsp + 0x30]
mov esi, r14d
lea rcx, str.6VVYqCAosWjD4erSfQbAxxIXcxyHU1Xlr9LBeTz09TNPJ8UHuJZMnf946smXMDRuyFCrMXlN9wHXbMdkGsUHCQ
call fcn.140036bf0
mov rbp, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov rdx, rbp
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rbx, [r14 - 1]
test eax, eax
jne 0x14003b229
mov rdi, rbx
nop dword [rax + rax]
cmp byte [rdi + rbp + 1], sil
lea rdi, [rdi + 1]
jne 0x14003b1a0
mov edx, 1
lea rcx, [rdi + 1]
call fcn.1400462ec
mov rsi, rax
test rax, rax
je 0x14003b229
mov r8, rbp
lea rdx, [rdi + 1]
mov rcx, rax
call fcn.1400466e0
cmp qword [rsp + 0x38], r14
je 0x14003b229
mov rcx, rbx
nop word [rax + rax]
inc rcx
cmp byte [rsi + rcx], r14b
jne 0x14003b1e0
add rcx, 1
mov edx, 1
cmovb rcx, rbx
call fcn.1400462ec
test rax, rax
je 0x14003b21a
cmp byte [rsi + rbx + 1], r14b
lea rbx, [rbx + 1]
jne 0x14003b200
lea rdx, [rbx + 1]
mov r8, rsi
mov rcx, rax
call fcn.1400466e0
mov rcx, rsi
call fcn.1400462d0
mov rcx, qword [rsp + 0x38]
jmp 0x14003b269
mov rcx, rsi
call fcn.1400462d0
mov eax, ebx
jmp 0x14003b2ba
lea rax, [rsp + 0x38]
mov rdx, rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14003b2b3
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14003b2b3
cmp dword [rsp + 0x40], 0xffffffff
je 0x14003b2ac
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
setne r14b
mov eax, r14d
jmp 0x14003b2ba
mov eax, 1
jmp 0x14003b2ba
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140043fc0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret