joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bc190
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xa0
mov rbx, rdx
mov rbp, rcx
lea rdx, [0x1400e9510]
mov ecx, 0xb0
mov rdi, r9
mov r14d, r8d
call fcn.1400c2eac
mov rsi, rax
test rax, rax
je 0x1400bc381
lea rcx, [rax + 1]
xor edx, edx
mov r8d, 0xaf
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsi + 8]
mov byte [rsi], 1
mov edx, 2
call sub.MSVCP140.dll__Mtx_init_in_situ
lea rcx, [rsi + 0x58]
call sub.MSVCP140.dll__Cnd_init_in_situ
mov qword [0x140131c48], rsi
xorps xmm0, xmm0
movups xmmword [rsi + 0xa0], xmm0
test r14d, r14d
je 0x1400bc238
test rdi, rdi
je 0x1400bc22e
cmp byte [rdi], 0
je 0x1400bc22e
mov rdx, rdi
mov rcx, rbp
call fcn.1400bc920
jmp 0x1400bc238
xor edx, edx
mov rcx, rbp
call fcn.1400bc880
call sub.KERNEL32.dll_GetCurrentProcessId
lea rcx, [0x14010c6b0]
mov dword [0x14012da38], eax
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x1400bc3b7
test rbx, rbx
je 0x1400bc277
movups xmm0, xmmword [rbx]
movups xmmword [0x14012d7c0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x14012d7d0], xmm1
movups xmm0, xmmword [rbx + 0x20]
jmp 0x1400bc297
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [0x14012d7c0], xmm0
movups xmmword [0x14012d7d0], xmm0
movups xmmword [0x14012d7e0], xmm0
lea rcx, [0x14010c6b0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [0x14012d7f0], xmm0
movups xmmword [0x14012d800], xmm0
movups xmmword [0x14012d810], xmm0
call sub.MSVCP140.dll__Mtx_unlock
cmp qword [0x14010d768], 0
jne 0x1400bc38a
mov rcx, rbp
call fcn.1400c17a0
mov qword [0x14010d768], rax
lea rcx, [0x1400ba960]
mov qword [rax + 0x10], rcx
lea rcx, [0x1400ba970]
mov rax, qword [0x14010d768]
mov qword [rax + 0x18], rcx
mov eax, 1
mov rdi, qword [0x140131c48]
mov ecx, 8
xchg byte [rdi], al
call fcn.1400c225c
xor ebx, ebx
test rax, rax
je 0x1400bc335
mov qword [rax], rdi
jmp 0x1400bc338
mov rax, rbx
lea rcx, [rsp + 0x38]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400ba9c0]
xor ecx, ecx
mov dword [rsp + 0x20], ebx
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400bc3a8
cmp dword [rdi + 0xa8], ebx
jne 0x1400bc37a
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rdi + 0xa0], xmm1
jmp 0x1400bc38a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor ebx, ebx
mov qword [0x140131c48], rbx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov ecx, 6
mov dword [rsp + 0x38], ebx
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3
Function at 0x1400bc920
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xae0
mov rax, qword [0x140105bc0]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rbx, rdx
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0x80]
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x20
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400bc9d3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_opening_Steam_key_n
jmp 0x1400bca9a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.SteamExe
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400bca88
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jb 0x1400bca88
shr ecx, 1
je 0x1400bca46
lea rax, [rsp + 0xc0]
lea edx, [rbx + 0x5c]
cmp word [rax], 0x2f
jne 0x1400bca3c
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x1400bca33
lea rax, [rsp + 0x40]
mov edx, 0x800
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r8, str.__s__steam:__rungameid__s
lea rcx, [rsp + 0x2d0]
call fcn.1400bc7b0
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x80]
call fcn.1400bc450
jmp 0x1400bcaa2
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_reading_SteamExe_key_n
mov rcx, rax
call fcn.1400bcac0
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.1400c23b0
add rsp, 0xae0
pop rbx
ret
Function at 0x1400bcb60
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140105bc0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, dword [0x1400e86a0]
xor edi, edi
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov dword [rsp + 0x68], eax
mov rbx, rcx
movzx eax, word [0x1400e86a4]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [0x1400e8688]
mov word [rsp + 0x6c], ax
mov eax, gethostbyname
movups xmmword [rsp + 0x40], xmm0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
movsd xmm0, qword [0x1400e8698]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
movsd qword [rsp + 0x60], xmm0
mov word [rsp + 0x6a], ax
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x1400bcc64
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400bcc18
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x1400bcc87
inc ax
mov word [rsp + 0x6a], ax
jmp 0x1400bcc33
cmp eax, 0xe7
jne 0x1400bcc87
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x1400bcc87
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1400bcbf8
mov byte [rbx], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400c23b0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
xor al, al
jmp 0x1400bcc69

Function at 0x1400bcc90
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x1400bcd51
test rcx, rcx
je 0x1400bcd51
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1400bcd51
xor ebp, ebp
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x58], ebp
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400bcd3c
mov eax, dword [rsp + 0x58]
cmp rax, rdi
jb 0x1400bcd51
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x68]
mov r8d, edi
mov dword [rsp + 0x68], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x1400bcd25
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
call fcn.1400bcb10
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], bpl
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400bcd60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r8
test r8, r8
jne 0x1400bcd76
mov al, 1
add rsp, 0x30
pop rbx
ret
test rcx, rcx
je 0x1400bcdab
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1400bcdab
test rdx, rdx
je 0x1400bcdab
xor eax, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x1400bcdab
cmp dword [rsp + 0x50], ebx
je 0x1400bcd6e
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x1400c3074
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c30be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c30be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c30be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c30be
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c30be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c30c0
xor al, al
add rsp, 0x28
ret
Function at 0x1000033a8
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov r12, rcx
mov edi, 0x20a
mov ebp, 0x104
mov ecx, edi
call fcn.10000ef18
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x1000033ed
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10000355a
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x100003408
lea rcx, [rsp + 0x48]
call fcn.10000ee3c
jmp 0x1000033e6
cmp eax, ebp
jb 0x10000345b
lea ebp, [rax + 2]
lea rcx, [rsp + 0x48]
lea edx, [rbp + rbp + 2]
call fcn.10000efb8
test eax, eax
jne 0x10000342d
lea rcx, [rsp + 0x48]
call fcn.10000ee3c
jmp 0x1000033db
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1000033db
mov rdx, rbx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1000033fc
cmp eax, ebp
jb 0x10000345b
lea rcx, [rsp + 0x48]
call fcn.10000ee3c
mov ecx, 0x800300fd
jmp 0x1000033e0
mov ecx, edi
call fcn.10000ef18
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x100003421
lea rdx, [0x100001a80]
mov r9, rax
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x10000353c
test r12, r12
je 0x1000034e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 5
cmp eax, ecx
jne 0x1000034e1
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [rax - 1]
movsxd rax, edi
test edi, edi
js 0x100003508
cmp word [r12 + rax*2], 0x5c
je 0x1000034cc
dec edi
sub rax, 1
jns 0x1000034ba
jmp 0x100003508
cmp edi, ebp
jl 0x1000034fa
lea edx, [rdi + 6]
lea rcx, [rsp + 0x48]
call fcn.10000efb8
test eax, eax
jne 0x1000034f5
lea rcx, [rsp + 0x48]
call fcn.10000ee3c
lea rcx, [rsp + 0x50]
jmp 0x100003401
mov rbx, qword [rsp + 0x48]
mov r8d, edi
mov rdx, r12
mov rcx, rbx
call fcn.10000e668
cmp edi, 0xffffffff
jne 0x100003522
lea rdx, [0x100001a88]
mov r8d, 0x104
mov rcx, rbx
call fcn.10000e668
lea rdx, [0x100001a80]
mov r9, rsi
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1000034e1
lea rcx, [rsp + 0x48]
call fcn.10000ee3c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1000033fc
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x100003574
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x30
and qword [rax + 0x20], 0
and dword [rax + 0x10], 0
and dword [rax + 0x18], 0
and dword [rax + 8], 0
lea r8, [rax + 0x20]
lea rdx, [0x100001a90]
mov rcx, 0xffffffff80000001
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10000360d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [0x100001b08]
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000035fd
cmp dword [rsp + 0x48], 4
jne 0x1000035fd
cmp dword [rsp + 0x40], 4
jne 0x1000035fd
cmp dword [rsp + 0x50], ebx
lea eax, [rbx + 1]
cmovne ebx, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x10000360d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x100003ba4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
xor r13d, r13d
mov rsi, r9
mov r14, r8
mov rbp, rdx
mov r12, rcx
mov dword [r11 - 0x38], r13d
mov dword [r11 + 8], r13d
cmp rcx, r13
je 0x100003d90
cmp rdx, r13
je 0x100003d90
cmp r8, r13
je 0x100003d90
cmp r9, r13
je 0x100003d90
mov rdi, qword [rsp + 0x90]
cmp rdi, r13
je 0x100003d90
cmp qword [rsp + 0x98], r13
je 0x100003d90
lea rax, [r11 + 8]
lea r9, [r11 - 0x38]
xor r8d, r8d
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, r13d
je 0x100003c3c
mov ecx, eax
jmp 0x100003d97
mov ecx, dword [rsp + 0x70]
inc ecx
call fcn.10000ef18
mov r13, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x100003c5c
lea ebx, [rax + 0xe]
jmp 0x100003d95
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x100003c94
lea rcx, [rsp + 0x38]
call fcn.10000ee3c
jmp 0x100003d95
xor ebx, ebx
cmp dword [rdi], ebx
jne 0x100003d4b
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x100003d4b
xor r8d, r8d
mov edx, 0xcb
xor ecx, ecx
call fcn.10000d950
lea r8d, [rbx + 1]
mov edx, 0xce
xor ecx, ecx
mov rbp, rax
call fcn.10000d950
mov rcx, rsi
mov r12, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
jne 0x100003d06
lea r8d, [rbx + 2]
mov edx, 0x1f5
xor ecx, ecx
call fcn.10000d950
jmp 0x100003d09
mov rax, rsi
mov r8, qword [rsp + 0x98]
lea rdx, [0x100001ba8]
mov r9, rax
mov ecx, 2
call fcn.10000d518
call fcn.10000d458
mov rbx, rax
mov r9d, dword [rdi]
mov r8, r12
mov rdx, rbx
mov rcx, rbp
call fcn.10000239c
cmp eax, 3
jg 0x100003d2d
jne 0x100003d7a
mov dword [rdi], 1
mov eax, dword [rsp + 0x70]
mov r9d, dword [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rsp + 0x38]
mov ebx, eax
call fcn.10000ee3c
jmp 0x100003d9c
cmp eax, 1
je 0x100003d4b
lea rcx, [rsp + 0x38]
call fcn.10000ee3c
mov ebx, 0x4c7
jmp 0x100003d95
mov ebx, 0x57
mov ecx, ebx
call fcn.100002fe8
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x100009fac
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x40
and dword [rsp + 0x34], 0
and dword [rsp + 0x30], 0
mov rsi, r8
lea rax, [r11 - 0x18]
mov ebp, r9d
mov r12, rdx
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
lea r9, [r11 - 0x14]
xor r8d, r8d
mov rdx, rsi
mov rdi, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10000a077
mov ecx, dword [rsp + 0x30]
inc ecx
and ecx, 0xfffffffe
mov dword [rsp + 0x30], ecx
add ecx, 2
call fcn.10000ef18
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x10000a023
lea eax, [rbx + 8]
jmp 0x10000a077
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x10000a06b
mov ecx, dword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ecx
mov r9, rbx
mov rdx, rsi
mov rcx, r12
call fcn.10000a098
lea rcx, [rsp + 0x38]
call fcn.10000ee3c
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x10000b92c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x100012110]
xor rax, rsp
mov qword [rsp + 0x240], rax
or ecx, 2
lea rax, [rsp + 0x38]
xor r8d, r8d
mov r9d, ecx
mov rcx, 0xffffffff80000000
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r14d, r14d
cmp eax, r14d
je 0x10000b996
mov dword [0x100012a44], 0x2c0
jmp 0x10000bb9b
lea rcx, [rsp + 0x30]
call fcn.10000c548
cmp eax, r14d
je 0x10000bb85
mov edi, 0x5c
lea r15d, [rdi - 0x3c]
dec dword [0x100052a68]
movzx ecx, di
call fcn.10000c684
lea rbx, [0x1000014d0]
lea rcx, [0x100001990]
cmp eax, r14d
cmove rbx, rcx
movzx ecx, word [rbx]
call fcn.10000c684
add rbx, 2
cmp eax, r14d
je 0x10000bb68
cmp word [rbx], r14w
jne 0x10000b9d5
mov ecx, edi
call fcn.10000c684
mov ebx, eax
cmp eax, r14d
je 0x10000bb68
mov esi, r14d
mov rdi, r14
lea rcx, [rsp + 0x30]
call fcn.10000c548
cmp eax, r14d
je 0x10000ba45
movzx ecx, word [rsp + 0x30]
cmp cx, r15w
je 0x10000ba45
cmp cx, 0xa
je 0x10000ba45
cmp cx, 0xd
je 0x10000ba45
cmp esi, 0xff
jae 0x10000ba42
mov word [rsp + rdi*2 + 0x40], cx
inc esi
inc rdi
jmp 0x10000ba08
mov ebx, r14d
cmp ebx, r14d
je 0x10000bb68
mov word [rsp + rdi*2 + 0x40], r14w
call fcn.10000c4c0
mov ecx, 0x3d
call fcn.10000c684
cmp eax, r14d
je 0x10000ba70
mov ecx, r15d
call fcn.10000c684
mov edx, 0x100
mov ecx, 0x40
mov r12d, r14d
mov r13, r14
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea rcx, [rsp + 0x30]
cmp rax, r14
mov ebp, r14d
mov rbx, rax
setne bpl
call fcn.10000c548
cmp eax, r14d
je 0x10000bb0f
mov esi, 0x200
cmp ebp, r14d
je 0x10000bb4b
movzx edi, word [rsp + 0x30]
cmp di, 0xa
je 0x10000bb0f
cmp di, 0xd
je 0x10000bb0f
lea eax, [rsi - 0x101]
cmp r12d, eax
jb 0x10000baf5
mov edx, esi
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov ebp, r14d
cmp rax, r14
setne bpl
cmp ebp, r14d
je 0x10000bb4b
mov rbx, rax
add esi, 0x100
mov word [rbx + r13*2], di
lea rcx, [rsp + 0x30]
inc r12d
inc r13
call fcn.10000c548
cmp eax, r14d
jne 0x10000baa7
cmp ebp, r14d
je 0x10000bb4b
mov word [rbx + r13*2], r14w
mov rcx, qword [rsp + 0x38]
lea eax, [r12 + r12]
lea rdx, [rsp + 0x40]
mov r9, rbx
mov r8d, 1
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
cmp eax, r14d
je 0x10000bb55
mov dword [0x100012a44], 0x2c1
jmp 0x10000bb55
mov dword [0x100012a44], 0x6b
cmp rbx, r14
je 0x10000bb63
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp ebp, r14d
jne 0x10000bb6d
call fcn.10000c4f4
lea rcx, [rsp + 0x30]
call fcn.10000c548
mov edi, 0x5c
cmp eax, r14d
jne 0x10000b9b2
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.100010090
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x10000c548
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rdi
sub rsp, 0x30
mov ebx, dword [0x100052a68]
mov r8d, dword [0x100052a70]
mov rdi, rcx
lea rbp, [0x100012a60]
cmp ebx, r8d
jne 0x10000c64d
mov rcx, qword [0x100052a60]
xor ebx, ebx
cmp dword [0x100012128], 1
mov qword [rax - 0x18], rbx
lea r9, [rax + 0x10]
mov r8d, 0x10000
jne 0x10000c5c7
lea rdx, [0x100032a60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
jne 0x10000c5ba
mov dword [0x100012a44], 0x2bf
xor eax, eax
jmp 0x10000c66c
mov ecx, dword [rsp + 0x48]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
jmp 0x10000c602
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x10000c5a9
mov r9d, dword [rsp + 0x48]
mov edx, 1
lea rax, [0x100032a60]
lea ecx, [rdx + 2]
mov r8, rbp
mov dword [rsp + 0x28], 0x10000
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [rsp + 0x48]
mov dword [0x100052a70], eax
mov r8d, eax
mov eax, dword [0x100052a78]
add eax, ecx
mov ecx, dword [0x100052a74]
mov dword [0x100052a68], ebx
mov dword [0x100052a78], eax
cmp ecx, ebx
je 0x10000c634
xor edx, edx
div ecx
mov ecx, eax
cmp eax, 0x64
jbe 0x10000c639
mov ecx, 0x64
mov eax, dword [0x100052a7c]
cmp eax, ecx
cmovne eax, ecx
cmp ebx, r8d
mov dword [0x100052a7c], eax
jge 0x10000c5b3
movsxd rcx, ebx
mov eax, 1
movzx ecx, word [rbp + rcx*2 + 0x20000]
mov word [rdi], cx
inc dword [0x100052a68]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x10000c6c8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x100012110]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
or qword [rsp + 0x40], 0xffffffffffffffff
xor ebp, ebp
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov dword [0x100012a44], ebp
cmp rdx, rbp
je 0x10000c728
mov r9d, r8d
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.10000b464
cmp eax, ebp
je 0x10000c728
mov dword [0x100012a44], 0x3f2
jmp 0x10000c8ea
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov dword [0x1000126f0], ebp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x100052a60], rax
cmp rax, 0xffffffffffffffff
je 0x10000c8d0
lea r9, [rsp + 0x48]
lea rdx, [0x100001500]
mov r8d, 2
mov rcx, rax
mov dword [0x100052a68], ebp
mov dword [0x100052a6c], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x100001510]
call fcn.10000cdc4
lea rcx, [0x100001a24]
call fcn.10000cdc4
lea rcx, [0x100001550]
call fcn.10000cdc4
lea rcx, [0x100002014]
call fcn.10000cdc4
mov ebx, 0x128
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x50]
cmp rdi, rbp
je 0x10000c816
mov rdx, rdi
sub rdx, rax
lea rax, [rbx + 0x7ffffed6]
cmp rax, rbp
je 0x10000c800
movzx eax, word [rdx + rcx]
cmp ax, bp
je 0x10000c800
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x10000c7de
cmp rbx, rbp
jne 0x10000c809
sub rcx, 2
mov word [rcx], bp
mov rcx, qword [rsp + 0x40]
jmp 0x10000c8af
lea r8, [0x1000019d8]
mov rdx, rbx
sub r8, rax
lea rax, [rdx + 0x7ffffed6]
cmp rax, rbp
je 0x10000c846
movzx eax, word [r8 + rcx]
cmp ax, bp
je 0x10000c846
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10000c823
cmp rdx, rbp
jne 0x10000c84f
sub rcx, 2
mov word [rcx], bp
lea rdx, [rsp + 0x50]
mov r8d, esi
mov rcx, 0xffffffff80000002
call fcn.10000c914
lea rdx, [0x100001a08]
lea rax, [rsp + 0x50]
sub rdx, rax
lea rcx, [rsp + 0x50]
lea rax, [rbx + 0x7ffffed6]
cmp rax, rbp
je 0x10000c89c
movzx eax, word [rdx + rcx]
cmp ax, bp
je 0x10000c89c
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x10000c87a
cmp rbx, rbp
jne 0x10000c8a5
sub rcx, 2
mov word [rcx], bp
mov rcx, 0xffffffff80000003
lea rdx, [rsp + 0x50]
mov r8d, esi
call fcn.10000c914
call fcn.10000cf2c
mov rcx, qword [0x100052a60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10000c8da
mov dword [0x100012a44], 0x6e
cmp rdi, rbp
je 0x10000c8ea
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.100010090
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x2b0
pop rdi
pop rsi
pop rbp
ret