joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002090
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x30
call fcn.140003910
sub rsp, rax
mov rbx, rcx
test rcx, rcx
jne 0x1400020b9
lea eax, [rcx + 1]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx]
mov edi, 1
test rcx, rcx
je 0x140002127
cmp dword [rbx + 0x1c], 0
je 0x1400020ff
mov r8d, dword [rbx + 0x24]
test r8d, r8d
jle 0x1400020ff
mov rdx, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400020ff
lea eax, [rdi - 2]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rbx + 0x18], 0
jne 0x140002127
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
test eax, eax
jne 0x140002127
mov rdx, qword [rbx + 8]
lea rcx, str.ss_fclose
xor r8d, r8d
call fcn.140001d20
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140002135
call fcn.140001530
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140002143
call fcn.140001530
mov rcx, rbx
call fcn.140001530
mov rbx, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x140002360
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x40
call fcn.140003910
sub rsp, rax
mov rdi, rcx
call fcn.140002160
cmp word [rdi], 0x2d
mov rbx, rax
jne 0x1400023ae
cmp word [rdi + 2], 0
jne 0x1400023ae
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx], rax
mov rax, rbx
mov dword [rbx + 0x18], 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov eax, dword [0x14002a004]
xor r9d, r9d
mov qword [rsp + 0x58], rsi
mov edx, 0x80000000
xor esi, esi
mov rcx, rdi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400024fb
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x14002a004]
lea r8d, [rsi + 1]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400024fb
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x14002a004]
lea r8d, [rsi + 3]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400024fb
test rbx, rbx
je 0x1400024e9
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400024c5
cmp dword [rbx + 0x1c], esi
je 0x1400024a0
mov r8d, dword [rbx + 0x24]
test r8d, r8d
jle 0x1400024a0
mov rdx, qword [rbx + 0x10]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400024e9
cmp dword [rbx + 0x18], esi
jne 0x1400024c5
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400024c5
mov rdx, qword [rbx + 8]
lea rcx, str.ss_fclose
xor r8d, r8d
call fcn.140001d20
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400024d3
call fcn.140001530
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400024e1
call fcn.140001530
mov rcx, rbx
call fcn.140001530
mov rsi, qword [rsp + 0x58]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rsi, qword [rsp + 0x58]
mov qword [rbx], rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140002520
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
mov eax, 0x30
call fcn.140003910
sub rsp, rax
mov ebp, r8d
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x14000255b
lea r8d, [rax - 0x2f]
lea rdx, str.Called_with_NULL_pointer_for_SS_FileIO
lea rcx, str.ss_fread
call fcn.140001d20
xor r14d, r14d
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], r14d
cmp qword [rbx + 0x10], r14
jne 0x140002598
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
mov r8d, ebp
mov qword [rsp + 0x20], r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000261f
mov eax, dword [rsp + 0x50]
jmp 0x140002631
mov esi, r14d
cmp ebp, 1
jle 0x14000262c
mov edx, dword [rbx + 0x24]
cmp edx, dword [rbx + 0x28]
jl 0x1400025dd
mov r8d, dword [rbx + 0x20]
lea r9, [rsp + 0x50]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000261f
mov eax, dword [rsp + 0x50]
mov edx, r14d
mov dword [rbx + 0x28], eax
mov dword [rbx + 0x24], r14d
test eax, eax
jle 0x140002611
mov rax, qword [rbx + 0x10]
movsxd rcx, edx
movzx r8d, byte [rcx + rax]
cmp r8b, 0xd
jne 0x1400025f7
lea eax, [rdx + 1]
mov dword [rbx + 0x24], eax
jmp 0x14000260a
cmp r8b, 0xa
je 0x140002626
mov byte [rdi], r8b
inc esi
inc dword [rbx + 0x24]
inc rdi
dec ebp
cmp ebp, 1
jg 0x1400025a4
jmp 0x14000262c
test esi, esi
mov byte [rdi], dl
mov eax, 0xffffffff
cmove esi, eax
jmp 0x14000262f
mov eax, 0xffffffff
jmp 0x140002631
lea eax, [rdx + 1]
mov dword [rbx + 0x24], eax
mov byte [rdi], r14b
mov eax, esi
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
Function at 0x140002650
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push r14
mov eax, 0x30
call fcn.140003910
sub rsp, rax
mov esi, r8d
mov r14, rdx
mov rbx, rcx
test rcx, rcx
jne 0x140002687
lea r8d, [rax - 0x2f]
lea rdx, str.Called_with_NULL_pointer_for_SS_FileIO
lea rcx, str.ss_fwrite
call fcn.140001d20
cmp dword [rbx + 0x1c], 0
mov qword [rsp + 0x58], rdi
jne 0x1400026c7
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
xor edi, edi
mov r8d, esi
mov rdx, r14
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002750
mov eax, dword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
mov r8d, dword [rbx + 0x24]
test r8d, r8d
jne 0x1400026e6
mov eax, esi
and eax, 0x80000fff
jge 0x1400026e2
dec eax
or eax, 0xfffff000
inc eax
test eax, eax
je 0x140002692
xor edi, edi
mov dword [rsp + 0x50], edi
test esi, esi
je 0x1400026b5
movzx eax, byte [r14]
lea r14, [r14 + 1]
mov rcx, qword [rbx + 0x10]
dec esi
movsxd rdx, r8d
mov byte [rdx + rcx], al
mov r8d, dword [rbx + 0x24]
inc dword [rsp + 0x50]
inc r8d
mov dword [rbx + 0x24], r8d
cmp r8d, dword [rbx + 0x20]
jne 0x14000273a
mov rdx, qword [rbx + 0x10]
lea r9, [rsp + 0x68]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002750
mov dword [rbx + 0x24], edi
mov r8d, edi
test esi, esi
jne 0x1400026f0
mov eax, dword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rsp + 0x58]
mov eax, 0xffffffff
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret

Function at 0x140002770
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.140003910
sub rsp, rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x1400027a5
lea r8d, [rax - 0x1f]
lea rdx, str.Called_with_NULL_pointer_for_SS_FileIO
lea rcx, str.ss_fwrite_b
call fcn.140001d20
mov rcx, rdi
call fcn.140003170
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140002650
Function at 0x1400027d0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push r14
mov eax, 0x30
call fcn.140003910
sub rsp, rax
mov rbx, rcx
test rcx, rcx
jne 0x140002824
lea r8d, [rax - 0x2f]
lea rdx, str.Called_with_NULL_pointer_for_SS_FileIO
lea rcx, str.ss_fnl
call fcn.140001d20
lea r8d, [rbx + 1]
lea rdx, str.Called_with_NULL_pointer_for_SS_FileIO
lea rcx, str.ss_fwrite
lea esi, [rbx + 2]
lea r14, [0x14001e8f0]
call fcn.140001d20
jmp 0x140002830
mov esi, 2
lea r14, [0x14001e8f0]
mov qword [rsp + 0x60], rdi
xor edi, edi
cmp dword [rbx + 0x1c], edi
jne 0x140002878
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
lea r8d, [rdi + 2]
mov qword [rsp + 0x20], rdi
lea rdx, [0x14001e8f0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x50]
mov edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov eax, ecx
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
mov r8d, dword [rbx + 0x24]
mov dword [rsp + 0x50], edi
movzx eax, byte [r14]
lea r14, [r14 + 1]
mov rcx, qword [rbx + 0x10]
dec esi
movsxd rdx, r8d
mov byte [rdx + rcx], al
mov r8d, dword [rbx + 0x24]
inc dword [rsp + 0x50]
inc r8d
mov dword [rbx + 0x24], r8d
cmp r8d, dword [rbx + 0x20]
jne 0x1400028ca
mov rdx, qword [rbx + 0x10]
lea r9, [rsp + 0x58]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400028e0
mov dword [rbx + 0x24], edi
mov r8d, edi
test esi, esi
jne 0x140002880
mov eax, dword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rsp + 0x60]
mov eax, 0xffffffff
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140002940
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x480
call fcn.140003910
sub rsp, rax
mov rax, qword [0x14002a768]
xor rax, rsp
mov qword [rsp + 0x470], rax
lea rax, [0x14001e924]
xor r15d, r15d
mov qword [rsp + 0x50], rax
mov rbp, r9
mov qword [rsp + 0x68], r15
mov r14d, r8d
mov rbx, rdx
movzx edi, cl
call fcn.140002fa0
mov r8, rax
lea rdx, str._________Han._s_event_message_at__s__________n
mov r9, rbx
lea rcx, [rsp + 0x270]
call fcn.140001070
lea eax, [rdi - 0x57]
lea esi, [r15 + 4]
test al, 0xdf
jne 0x1400029b9
lea esi, [r15 + 2]
sub dil, 0x45
test dil, 0xdf
jne 0x1400029c8
mov esi, 1
movups xmm0, xmmword [str.SYSTEMCurrentControlSetServicesEventlogApplication]
lea rax, [rsp + 0x270]
mov qword [rsp + 0x60], rbp
movups xmm1, xmmword [0x14001e968]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x70]
mov eax, dword [0x14001e988]
dec rcx
mov dword [rsp + 0xa0], eax
movzx eax, word [0x14001e98c]
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [0x14001e978]
mov word [rsp + 0xa4], ax
movzx eax, byte [0x14001e98e]
mov byte [rsp + 0xa6], al
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x90], xmm0
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x140002a36
mov eax, dword [str.HAN.]
mov dword [rcx], eax
movzx eax, word [0x14001e994]
mov word [rcx + 4], ax
lea rcx, [rsp + 0x70]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x140002a60
xor edx, edx
nop dword [rax]
movzx eax, byte [rbx + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140002a70
lea r9, str._Systemdrive_MgrHanEvents.dll
lea r8, str.EventMessageFile
lea rdx, [rsp + 0x70]
lea rcx, str.HKLM
call fcn.140003580
test eax, eax
je 0x140002ab8
xor r8d, r8d
lea rdx, [0x14001e9d4]
lea rcx, [0x14001e9d8]
call fcn.140001d20
mov r9d, 7
lea r8, str.TypesSupportet
lea rdx, [rsp + 0x70]
lea rcx, str.HKLM
call fcn.1400034b0
test eax, eax
je 0x140002af0
xor r8d, r8d
lea rdx, [0x14001e9d4]
lea rcx, [0x14001e9d8]
call fcn.140001d20
mov eax, dword [str.Han.]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], eax
dec rcx
movzx eax, byte [0x14001e9f4]
mov byte [rsp + 0x74], al
nop dword [rax]
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x140002b10
xor edx, edx
nop dword [rax]
movzx eax, byte [rbx + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140002b20
lea rdx, [rsp + 0x70]
lea rcx, [0x14001e9f5]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov qword [rsp + 0x40], r15
xor r8d, r8d
mov rbx, rax
mov r9d, r14d
lea rax, [rsp + 0x50]
movzx edx, si
mov qword [rsp + 0x38], rax
mov rcx, rbx
mov dword [rsp + 0x30], r15d
mov word [rsp + 0x28], 3
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140003970
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002bb0
Capabilities:
Get hostname

Disassembly:
push rbx
mov eax, 0x20
call fcn.140003910
sub rsp, rax
cmp byte [0x14002b248], 0
mov dword [rsp + 0x30], 0x10
jne 0x140002c09
lea rbx, [0x14002b248]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x140002c00
lea r8d, [rax + 1]
lea rdx, str.GetComputerName
lea rcx, str.ss_host
call fcn.140001d20
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x14002b248]
add rsp, 0x20
pop rbx
ret

Function at 0x140002c20
Capabilities:
Get hostname

Disassembly:
push rbx
mov eax, 0x20
call fcn.140003910
sub rsp, rax
cmp word [0x14002b258], 0
mov dword [rsp + 0x30], 0x10
jne 0x140002c7a
lea rbx, [0x14002b258]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x140002c71
lea r8d, [rax + 1]
lea rdx, [0x14001e9f8]
lea rcx, str.ss_host
call fcn.140001d20
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x14002b258]
add rsp, 0x20
pop rbx
ret

Function at 0x140002e30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
mov eax, 0x20
call fcn.140003910
sub rsp, rax
lea rdx, [0x14001ea50]
mov rbx, rcx
call fcn.1400019c0
test eax, eax
je 0x140002e6b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140002f10
Capabilities:
Get session user name

Disassembly:
mov eax, 0x28
call fcn.140003910
sub rsp, rax
mov rax, qword [0x14002b288]
test rax, rax
jne 0x140002f5d
mov ecx, 0x104
call fcn.1400015d0
mov qword [0x14002b288], rax
test rax, rax
jne 0x140002f5d
lea r8d, [rax + 1]
lea rdx, str.ss_malloc_failed
lea rcx, str.ss_user
call fcn.140001d20
mov rax, qword [0x14002b288]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x104
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x140002f8e
lea r8d, [rax + 1]
lea rdx, str.GetUserName
lea rcx, str.ss_user
call fcn.140001d20
mov rax, qword [0x14002b288]
add rsp, 0x28
ret

Function at 0x140003310
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x78
call fcn.140003910
sub rsp, rax
mov rax, qword [0x14002a768]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [0x14002b2a0]
test rax, rax
jne 0x14000338f
call fcn.140003860
mov r9d, eax
lea r8, str._8.8x_ss_lock_pr
mov edx, 0x40
lea rcx, [rsp + 0x20]
call fcn.140001fd0
lea r8, [rsp + 0x20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x14002b2a0], rax
test rax, rax
jne 0x14000338f
lea r8d, [rax + 1]
lea rdx, str.CreateMutex
lea rcx, str.ss_lock_pr
call fcn.140001d20
mov rax, qword [0x14002b2a0]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x1400033bb
mov r8d, 1
lea rdx, [0x14001e598]
lea rcx, str.ss_lock_pr
call fcn.140001d20
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140003970
add rsp, 0x78
ret
Function at 0x1400034b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x20], r9d
push rdi
mov eax, 0x60
call fcn.140003910
sub rsp, rax
mov rsi, r8
mov rbx, rdx
call fcn.140003410
lea rcx, [rsp + 0x50]
xor edi, edi
mov qword [rsp + 0x40], rcx
lea r9, str.REG_DWORD
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rcx
mov rdx, rbx
mov qword [rsp + 0x30], rdi
mov rcx, rax
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140003568
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x88]
mov dword [rsp + 0x28], 4
lea r9d, [rdi + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
setne dil
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x70]
mov eax, 1
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x140003580
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x60
call fcn.140003910
sub rsp, rax
mov rsi, r9
mov rbp, r8
mov rbx, rdx
call fcn.140003410
lea rcx, [rsp + 0x50]
xor edi, edi
mov qword [rsp + 0x40], rcx
lea r9, str.REG_SZ
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rcx
mov rdx, rbx
mov qword [rsp + 0x30], rdi
mov rcx, rax
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140003629
mov rcx, rsi
call fcn.140003170
mov rcx, qword [rsp + 0x58]
lea r9d, [rdi + 1]
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
setne dil
mov eax, edi
jmp 0x14000362e
mov eax, 1
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140004244
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000428e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000428e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000428e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000428e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000428e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004290
xor al, al
add rsp, 0x28
ret
Function at 0x14000da14
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000d87f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d87f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d87f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d87f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d87f
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d87f
cmp dword [rcx + 0xf8], 0
je 0x14000d87f
mov ecx, ebx
call fcn.14000d930
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000d70c
nop
cmp dword [rbp + 0x20], 0
je 0x14000d8cd
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000d8d8
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000d810
Function at 0x140014e94
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140014ec4
xor eax, eax
jmp 0x140014f87
mov rbp, rbx
cmp word [rax], si
je 0x140014ee9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140014ed0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140014ecc
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140013a34
movsxd r14, eax
test eax, eax
jne 0x140014f27
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140014ebd
mov rcx, r14
call fcn.14001070c
mov rdi, rax
test rax, rax
jne 0x140014f40
xor ecx, ecx
call fcn.14000fa94
jmp 0x140014f1c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140013a34
test eax, eax
jne 0x140014f71
mov rcx, rdi
call fcn.14000fa94
jmp 0x140014f7b
xor ecx, ecx
call fcn.14000fa94
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140014fa4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001502b
mov rsi, rbx
cmp word [rax], bp
je 0x140014fea
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140014fd4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140014fd0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001070c
mov rdi, rax
test rax, rax
je 0x140015018
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140005800
mov rbp, rdi
xor ecx, ecx
call fcn.14000fa94
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400195d0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400195e6
mov al, 1
jmp 0x140019646
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400195f7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140019644
mov ecx, dword [rcx + 0x18]
nop
call fcn.140015b90
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140019644
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140019644
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140019644
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140019646
xor al, al
add rsp, 0x20
pop rbx
ret