joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003370
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140041060]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000339d
xor eax, eax
jmp 0x1400034e3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400033d7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400033d7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400034e3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400034d6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000341a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003429
movsx ecx, dil
jmp 0x14000347d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x140003497
sub eax, 1
je 0x140003497
cmp eax, 2
jne 0x1400034d6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.14000f018
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400034db
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400034c4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.140011524
cmp rsi, rax
jne 0x1400034d6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1400034db
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140008ea0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x140016f1c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140016d48
Function at 0x140002860
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rdx]
lea rdx, [0x1400083f8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400023a0
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_EnumWindows]

Function at 0x140002fc0
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rdx]
lea rdx, [0x140008240]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400023a0
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]

Function at 0x140003010
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rdx]
lea rdx, [0x140008228]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400023a0
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
Function at 0x1400246b4
Capabilities:
Get token membership

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x1400bc178]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
call fcn.1400244cc
lea rdx, [rax + 8]
lea r8, [rsp + 0x24]
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x14002470f
cmp dword [rsp + 0x24], 0
setne dil
mov al, 1
jmp 0x140024716
xor al, al
mov dil, byte [rsp + 0x20]
test al, al
sete bl
lea rcx, [rsp + 0x30]
call fcn.14000475c
test bl, bl
je 0x14002472d
xor al, al
jmp 0x140024734
mov al, dil
jmp 0x140024734
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140061880
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rdi
ret
Function at 0x140025f74
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x1400bc178]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
lea rax, [rsp + 0x30]
mov qword [r8], r15
lea rdx, [rsp + 0x30]
sub rcx, rax
mov r14, r8
mov r9d, 0x104
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x140025fe5
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140025fe5
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x140025fc3
test r9, r9
jne 0x140025fee
sub rdx, 2
lea r8, [0x1400882c0]
mov word [rdx], r15w
lea rcx, [rsp + 0x30]
call fcn.14002494c
mov ebx, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov rdi, rax
test rax, rax
jne 0x14002604d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140026109
mov edx, 0xc9
mov rcx, qword [rbp + 0x168]
lea r8, [0x140088270]
call fcn.140025d60
mov esi, eax
jmp 0x14002610c
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r15d
mov rcx, rax
mov dword [rsp + 0x20], r15d
call fcn.140025e28
mov esi, eax
test eax, eax
jns 0x140026083
mov rcx, qword [rbp + 0x168]
mov r9d, eax
mov edx, 0xcf
call fcn.140025d24
jmp 0x14002610c
lea r8, [0x1400882c8]
lea rcx, [rsp + 0x30]
call fcn.14002494c
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov rbx, rax
test rax, rax
jne 0x1400260b2
mov edx, 0xd5
jmp 0x140026033
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140025e28
mov esi, eax
test eax, eax
jns 0x1400260e8
mov rcx, qword [rbp + 0x168]
mov r9d, eax
mov edx, 0xd7
call fcn.140025d24
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14002610c
jmp 0x14002614c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14002615e
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
mov esi, r15d
test rdi, rdi
je 0x14002611e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140026170
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140061880
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [rbp + 0x168]
mov edx, 0x623
call fcn.140025d80
int3
mov rcx, qword [rbp + 0x168]
mov edx, 0x623
call fcn.140025d80
int3
mov rcx, qword [rbp + 0x168]
mov edx, 0x623
call fcn.140025d80
int3
Function at 0x140026830
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov rdi, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
xor ebx, ebx
mov qword [rbp - 8], rbx
mov edx, 0x104
lea rcx, [rbp - 0x18]
call fcn.140032320
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rdx, rcx
sar rdx, 1
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test eax, eax
jne 0x14002688d
mov rcx, qword [rbp - 0x18]
jmp 0x140026921
mov r8, qword [rbp - 0x10]
mov rax, r8
mov rcx, qword [rbp - 0x18]
sub rax, rcx
sar rax, 1
cmp rdx, rax
jbe 0x1400268ca
lea rcx, [rbp - 0x18]
call fcn.140032320
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rdx, rcx
sar rdx, 1
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
test edx, edx
je 0x140026921
sub r8, rcx
sar r8, 1
mov eax, edx
cmp rax, r8
ja 0x140026921
cmp word [rcx], bx
jne 0x1400268e5
mov r8, rbx
jmp 0x1400268f3
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], bx
jne 0x1400268e9
mov rdx, rcx
mov rcx, rdi
call fcn.140003394
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14002691d
mov rdx, qword [rbp - 8]
sub rdx, rcx
sar rdx, 1
mov r8d, 2
call fcn.1400029dc
mov bl, 1
jmp 0x14002693b
test rcx, rcx
je 0x14002693b
mov rdx, qword [rbp - 8]
sub rdx, rcx
mov r8d, 2
sar rdx, 1
call fcn.1400029dc
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x14003add4
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x198
mov rax, qword [0x1400bc178]
xor rax, rsp
mov qword [rsp + 0x180], rax
cmp dword [0x1400bd0e8], 0
je 0x14003ae01
mov eax, dword [0x1400bd0e4]
jmp 0x14003ae82
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x11c
call sub.api_ms_win_crt_private_l1_1_0.dll__o_memset
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x30]
call sub.api_ms_win_crt_private_l1_1_0.dll__o_memset
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x30]
mov r9b, byte [rsp + 0x17a]
mov edx, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x70]
mov word [rsp + 0x28], ax
movzx eax, word [rsp + 0x178]
mov word [rsp + 0x20], ax
call fcn.14003aea0
mov dword [0x1400bd0e4], eax
mov dword [0x1400bd0e8], 1
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140061880
add rsp, 0x198
ret

Function at 0x14003c03c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r14, r8
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rbp - 0x30], r15d
mov dword [rbp + 0x48], r15d
cmp qword [rdx + 0x18], 8
jb 0x14003c077
mov rdx, qword [rdx]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x30]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003c152
mov ecx, dword [rbp + 0x48]
test ecx, ecx
je 0x14003c14d
mov eax, dword [rbp - 0x30]
dec eax
cmp eax, 1
ja 0x14003c14d
mov byte [rbp + 0x38], r15b
lea rdx, [rcx + 2]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r15
lea r8, [rbp + 0x38]
lea rcx, [rbp - 0x20]
call fcn.14003c424
nop
cmp qword [rdi + 0x18], 8
jb 0x14003c0df
mov rdi, qword [rdi]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov rbx, qword [rbp - 0x20]
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14003c12f
cmp word [rbx], r15w
jne 0x14003c115
mov r8, r15
jmp 0x14003c123
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], r15w
jne 0x14003c119
mov rdx, rbx
mov rcx, r14
call fcn.140003394
nop
test rbx, rbx
je 0x14003c149
mov rdx, qword [rbp - 0x10]
sub rdx, rbx
mov r8d, 1
mov rcx, rbx
call fcn.1400029dc
mov eax, edi
jmp 0x14003c152
mov eax, 0x65e
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003c850
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400bc178]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rcx
xor ebx, ebx
mov r14d, ebx
mov dword [rsp + 0x20], ebx
call fcn.14003add4
and eax, 0xffff0000
cmp eax, 0x800000
jl 0x14003c902
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
lea r8d, [rbx + 0xa]
lea rdx, str.API_MS_WIN
lea rcx, [rsp + 0x30]
call fcn.140003394
lea r14d, [rbx + 1]
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
cmp qword [rsi + 0x18], 8
jb 0x14003c8ed
mov rcx, qword [rsi]
jmp 0x14003c8f0
mov rcx, rsi
mov r8, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsnicmp]
test eax, eax
mov dil, r14b
je 0x14003c905
mov dil, bl
test r14b, 1
je 0x14003c91a
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.14000328c
test dil, dil
je 0x14003c9c7
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
cmp qword [rsi + 0x18], 8
jb 0x14003c93d
mov rcx, qword [rsi]
jmp 0x14003c940
mov rcx, rsi
lea rdx, [rsp + 0x30]
call fcn.14003c708
mov r14, rax
mov rdi, rbx
test rax, rax
je 0x14003c9a2
lea rdx, str.API_MS_WIN_CORE_PROCESSTHREADS_L1_1_0.DLL
mov rdx, qword [rdi + rdx]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__stricmp]
test eax, eax
je 0x14003c996
add rdi, 8
cmp rdi, 0x30
jb 0x14003c955
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14003c9c7
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov r8d, 1
call fcn.1400029dc
jmp 0x14003c9c7
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14003c9bf
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov r8d, 1
call fcn.1400029dc
mov rax, rdi
jmp 0x14003ca74
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x103
ja 0x14003ca72
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
cmp word [rsp + 0x70], bx
je 0x14003ca13
lea rcx, [rsp + 0x70]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x14003ca07
mov rbx, rax
mov r8, rbx
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140003394
nop
mov r8, rsi
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14003cdac
cmp qword [rax + 0x18], 8
jb 0x14003ca42
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x50]
call fcn.14000328c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.14000328c
mov rax, rbx
jmp 0x14003ca74
xor eax, eax
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140061880
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14003d4cc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x50
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rsi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
cmp qword [rdx + 0x18], 8
jb 0x14003d500
mov rcx, qword [rdx]
jmp 0x14003d503
mov rcx, rdx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edi, [rax + 1]
mov word [rsp + 0x68], bp
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbp
mov edx, edi
lea r8, [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.14003c4c4
nop
cmp qword [rsi + 0x18], 8
jb 0x14003d540
mov rsi, qword [rsi]
mov r8d, edi
mov rdi, qword [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rbp
test eax, eax
je 0x14003d5a6
lea rdx, [0x140087f0c]
test rdi, rdi
cmovne rdx, rdi
cmp qword [rbx + 0x18], 8
jb 0x14003d57e
mov rax, qword [rbx]
jmp 0x14003d581
mov rax, rbx
mov word [rax], bp
cmp word [rdx], bp
jne 0x14003d58e
mov r8, rbp
jmp 0x14003d59c
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], bp
jne 0x14003d592
mov rcx, rbx
call fcn.140003394
jmp 0x14003d5b8
cmp qword [rbx + 0x18], 8
jb 0x14003d5b2
mov rax, qword [rbx]
jmp 0x14003d5b5
mov rax, rbx
mov word [rax], bp
test rdi, rdi
je 0x14003d5d6
mov rdx, qword [rsp + 0x40]
sub rdx, rdi
mov r8d, 2
sar rdx, 1
mov rcx, rdi
call fcn.1400029dc
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x140040400
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
and dword [rsp + 0x58], 0
mov ebx, edx
lea rdx, [rcx + 0x40]
mov dword [rsp + 0x40], r9d
cmp qword [rdx + 0x18], 8
jb 0x140040424
mov rdx, qword [rdx]
mov rcx, qword [rcx + 0x60]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x140040493
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x140040467
inc rax
jmp 0x14004046e
lea rax, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
mov rdx, rax
lea rcx, [0x1400bd408]
call fcn.14000fa54
shl rax, 0x34
movabs rcx, 0x342500000000
or rax, rdi
or rax, rcx
jmp 0x1400404e5
cmp ebx, dword [rsp + 0x58]
je 0x1400404db
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x1400404b5
inc rax
jmp 0x1400404bc
lea rax, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
mov rdx, rax
lea rcx, [0x1400bd408]
call fcn.14000fa54
shl rax, 0x34
movabs rcx, 0x350500040002
jmp 0x14004048e
movabs rax, 0x8000000000
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140040774
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
and dword [rax + 0x20], 0
mov esi, edx
and dword [rax + 8], 0
lea rdx, [rcx + 0x40]
cmp qword [rdx + 0x18], 8
mov rdi, r8
jb 0x14004079f
mov rdx, qword [rdx]
mov rcx, qword [rcx + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 0xea
je 0x140040819
test eax, eax
je 0x140040819
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x1400407ea
inc rax
jmp 0x1400407f1
lea rax, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
mov rdx, rax
lea rcx, [0x1400bd408]
call fcn.14000fa54
shl rax, 0x34
movabs rcx, 0x312500000000
or rax, rbx
or rax, rcx
jmp 0x1400408bd
cmp esi, dword [rsp + 0x40]
je 0x140040861
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x14004083b
inc rax
jmp 0x140040842
lea rax, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
mov rdx, rax
lea rcx, [0x1400bd408]
call fcn.14000fa54
shl rax, 0x34
movabs rcx, 0x320500040002
jmp 0x140040811
mov eax, dword [rsp + 0x58]
cmp eax, 0x4000
jb 0x1400408b1
mov edx, 0x5c
lea rcx, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
test rax, rax
je 0x140040888
inc rax
jmp 0x14004088f
lea rax, str.admin_appman_appv_sharedclientconfiguration_registryvalue.h
mov rdx, rax
lea rcx, [0x1400bd408]
call fcn.14000fa54
shl rax, 0x34
movabs rcx, 0x330500040003
jmp 0x140040811
mov dword [rdi], eax
movabs rax, 0x8000000000
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14005f698
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbp, rdx
mov rbx, rcx
or rsi, 0xffffffffffffffff
cmp rdx, rcx
je 0x14005f6d8
mov r9, rsi
xor r8d, r8d
mov rdx, rcx
mov rcx, rbp
call fcn.1400034b4
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14008a2bc]
mov rcx, rbx
call fcn.14003b8dc
cmp rax, rsi
jne 0x14005f6fd
mov al, r9b
jmp 0x14005f79b
cmp qword [rbx + 0x18], 8
jb 0x14005f709
mov rcx, qword [rbx]
jmp 0x14005f70c
mov rcx, rbx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r14d, eax
xor r15d, r15d
test eax, eax
je 0x14005f79b
mov rdx, r14
lea rcx, [rsp + 0x28]
call fcn.140019044
nop
cmp qword [rbx + 0x18], 8
jb 0x14005f739
mov rbx, qword [rbx]
mov r8d, r14d
mov rdi, qword [rsp + 0x28]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp r14d, eax
sete bl
test bl, bl
je 0x14005f77b
cmp word [rdi], r15w
jne 0x14005f762
mov rsi, r15
jmp 0x14005f76c
inc rsi
cmp word [rdi + rsi*2], r15w
jne 0x14005f762
mov r8, rsi
mov rdx, rdi
mov rcx, rbp
call fcn.140003394
nop
test rdi, rdi
je 0x14005f799
mov rdx, qword [rsp + 0x38]
sub rdx, rdi
sar rdx, 1
mov r8d, 2
mov rcx, rdi
call fcn.1400029dc
mov al, bl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140061400
Capabilities:
Get hostname

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rdi, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
xor esi, esi
mov qword [rbp - 8], rsi
mov dword [rbp + 0x30], esi
lea r8, [rbp + 0x30]
xor edx, edx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x140061447
lea ebx, [rsi + 0xd]
jmp 0x1400614b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xea
jne 0x1400614b1
mov word [rbp + 0x20], si
mov edx, dword [rbp + 0x30]
lea r8, [rbp + 0x20]
lea rcx, [rbp - 0x18]
call fcn.14003c274
lea r8, [rbp + 0x30]
mov rdx, qword [rbp - 0x18]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x14006148b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1400614b1
mov rdx, qword [rbp - 0x18]
cmp word [rdx], si
jne 0x140061499
mov r8, rsi
jmp 0x1400614a7
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], si
jne 0x14006149d
mov rcx, rdi
call fcn.140003394
mov ebx, esi
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400614cf
mov rdx, qword [rbp - 8]
sub rdx, rcx
sar rdx, 1
mov r8d, 2
call fcn.1400029dc
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140061a4c
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140061add
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x140061add
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140061add
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140061ac1
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140061abb
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140061ac3
add rdx, 0x28
jmp 0x140061aa0
xor edx, edx
test rdx, rdx
jne 0x140061acc
xor al, al
jmp 0x140061ae3
test dword [rdx + 0x24], 0x80000000
je 0x140061ad9
xor al, al
jmp 0x140061ae3
mov al, 1
jmp 0x140061ae3
xor al, al
jmp 0x140061ae3
add rsp, 0x18
ret

Function at 0x140061d78
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400bcec0], eax
call fcn.140062054
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400bcec0], 0
jne case.default.0x140061dce
mov ecx, 1
call fcn.140062054
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
invalid
js 0x140126ff9
adc esi, dword [rax]
invalid