joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004d030
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140105c88]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x90], rax
movaps xmm6, xmmword [section..rdata]
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
lea rdx, str.WriteAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x97
call fcn.1400322c0
lea rcx, [rsp + 0x50]
mov rdx, r14
xor r8d, r8d
call fcn.1400429f0
test esi, esi
js 0x14004d12e
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x30], 0
call fcn.1400753e0
test al, al
je 0x14004d0f2
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1400754a0
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
call fcn.140075470
jmp 0x14004d133
mov esi, 0xffffffff
lea rcx, [rsp + 0x50]
call fcn.140042a50
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400a5060
mov eax, esi
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14004ef20
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.14004cee0
mov qword [rsi], 0
test rax, rax
je 0x14004ef87
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x14004ef6d
call fcn.1400322e0
mov rcx, qword [rsi]
call fcn.140041f60
mov qword [rsi], 0
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14004ef7f
mov qword [rsi], rbx
call fcn.1400322e0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.140032310
lea rcx, [rsi + 0x20]
call fcn.140075400
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
movzx eax, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
movzx eax, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140058be0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
jne 0x140058cef
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x140058c4e
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.1400a7bd0
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x140058cef
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x140058d39
lea rcx, [r12*8]
call fcn.1400a4cb4
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x140058cc8
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
nop word [rax + rax]
mov r10, rcx
add r10, r9
je 0x140058d0d
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x140058cb0
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x140058cef
mov rcx, r14
call fcn.1400a4d04
mov r15, qword [rsi + 0x10]
test r15, r15
je 0x140058d0d
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str.E:_nw77_win64_node_webkit_srcoutst_nw...._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.140005584
call fcn.140001a95
int3
Function at 0x140063728
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rax, qword [0x140105c88]
xor rax, rsp
mov qword [rsp + 0x240], rax
movaps xmm0, xmmword [section..rdata]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
mov esi, eax
test eax, eax
js 0x1400638a4
lea rdi, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rbx, [0x14010aeb0]
mov r14d, 0xff
mov r8d, 0xff
mov rcx, rbx
call fcn.1400c4c14
mov rcx, rbx
call fcn.1400c47c0
sub r14, rax
lea rdx, [0x1400df27c]
mov rcx, rbx
mov r8, r14
call fcn.1400c4c14
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
lea rbx, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.1400a8280
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
lea rcx, str.PROGRAMFILES
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140063800
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400c4c5c
test eax, eax
je 0x14006383b
lea rcx, str.PROGRAMFILES_X86_
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140063837
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400c4c5c
test eax, eax
je 0x14006383b
xor eax, eax
jmp 0x14006383d
mov al, 1
mov byte [0x14010aaad], al
mov dword [rsp + 0x30], 0
lea rcx, [0x1400da780]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400e2e83]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140063895
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rax, rdi
call qword [0x140117008]
test eax, eax
je 0x140063895
cmp dword [rsp + 0x30], 0
setne al
jmp 0x140063897
xor eax, eax
mov byte [0x14010b0b0], al
mov byte [0x14010aaac], 1
test esi, esi
setns bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400a5060
mov eax, ebx
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140063a9b
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x140105c88]
xor rax, rsp
mov qword [rsp + 0x70], rax
test byte [r8], 1
jne 0x140063ad1
mov rcx, rsi
call fcn.140001c9e
jmp 0x140063ad5
mov rax, qword [rsi + 8]
test rax, rax
je 0x140063b04
bt ebx, 8
jae 0x140063ae9
mov eax, ebx
and eax, 0x200
jne 0x140063b04
cmp edi, 2
lea rax, [0x14010aab0]
lea rcx, [0x14010acb0]
cmove rcx, rax
cmp word [rcx], 0
je 0x140063b23
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400a5060
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [r14], 0
je 0x140063b04
cmp byte [0x14010b0b0], 0
setne al
bt ebx, 8
jb 0x140063b04
shr ebx, 9
and ebx, 1
or bl, al
je 0x140063b04
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea r13, str.SOFTWARE
cmove r13, rax
test byte [rsi], 1
jne 0x140063b8e
lea rdi, [rsi + 2]
mov rcx, rsi
call fcn.140001c9e
mov rbp, rax
jmp 0x140063b96
mov rbp, qword [rsi + 8]
mov rdi, qword [rsi + 0x10]
mov ebx, 1
xor r14d, r14d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov r12, qword [r13 + 8]
mov r15, rbp
sub r15, r12
jb 0x140063bd3
mov rdx, qword [r13]
mov rcx, rdi
mov r8, r12
call fcn.1400bfcd0
test eax, eax
je 0x140063be4
add r13, 0x28
inc r14
cmp r14, rbx
jb 0x140063bb4
jmp 0x140063c64
movzx edx, word [rdi + r12*2]
cmp edx, 0x5c
je 0x140063bf2
test edx, edx
jne 0x140063bd3
lea rcx, [rdi + r12*2]
mov r8d, dword [r13 + 0x10]
lea rax, str.WOW6432Node_
cmp r8d, 1
je 0x140063c23
cmp r8d, 2
jne 0x140063c19
mov rdi, rcx
lea rax, str.WOW6432Node
jmp 0x140063c23
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
cmp dx, 0x5c
mov dword [rsp + 0x2c], r8d
jne 0x140063c41
lea rdx, [rcx + 2]
dec r15
cmp word [rcx + 2], 0x5c
mov rcx, rdx
je 0x140063c2e
jmp 0x140063c44
mov rdx, rcx
mov rbx, qword [r13 + 0x20]
mov r13, qword [r13 + 0x18]
mov rbp, r15
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rax
xor r14d, r14d
mov rdi, rdx
jmp 0x140063bda
cmp dword [rsp + 0x2c], 0
je 0x140063b04
test byte [rsi], 1
jne 0x140063c7a
lea rax, [rsi + 2]
jmp 0x140063c7e
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, rsi
mov r8, qword [rsp + 0x38]
call fcn.1400285f8
jmp 0x140063b04
Function at 0x140063f59
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x140105c88]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp byte [0x14010aaac], 0
jne 0x140063f9a
call fcn.140063728
test al, al
je 0x14006405f
xorps xmm0, xmm0
lea r15, [rsp + 0x50]
movaps xmmword [r15], xmm0
mov rcx, r15
mov rdx, rdi
call sub.ntdll.dll_RtlInitUnicodeString
lea r13, [rsp + 0x4c]
mov dword [r13], 0x18
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rdi], xmm0
mov edx, 0x18
mov rcx, rdi
call fcn.14006409c
mov ebp, 5
mov edx, dword [rsp + 0x4c]
mov rcx, rdi
call fcn.140005844
mov r12, qword [rsp + 0x30]
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], eax
mov rcx, r14
mov rdx, r15
mov r8d, 1
mov r9, r12
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0xc0000023
je 0x14006402d
cmp eax, 0x80000005
jne 0x140064035
dec ebp
jne 0x140063fed
xor esi, esi
jmp 0x14006406e
test eax, eax
js 0x140064031
mov eax, dword [r12 + 4]
mov dword [rbx], eax
mov r8d, dword [r12 + 0xc]
test r8, r8
je 0x140064063
mov edx, dword [r12 + 8]
add rdx, r12
add r8, rdx
mov rcx, rsi
call fcn.140008e30
jmp 0x14006406b
xor esi, esi
jmp 0x14006407b
mov rcx, rsi
call fcn.140006078
mov sil, 1
lea rcx, [rsp + 0x68]
mov qword [rcx], rdi
call fcn.14000604a
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400a5060
mov eax, esi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400656b0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x140105c88]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
call fcn.14002f560
test byte [rsp + 0x58], 1
je 0x1400656f3
mov rcx, qword [rsp + 0x68]
jmp 0x1400656f8
lea rcx, [rsp + 0x5a]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test byte [rsp + 0x58], 1
je 0x140065716
mov rcx, qword [rsp + 0x68]
call fcn.1400a4d04
test rsi, rsi
je 0x140065802
test edi, edi
je 0x140065802
mov ecx, edi
add rcx, rcx
call fcn.1400a4d3c
mov rbx, rax
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x30]
call fcn.14002f560
test byte [rsp + 0x58], 1
je 0x14006575a
mov rcx, qword [rsp + 0x68]
jmp 0x14006575f
lea rcx, [rsp + 0x5a]
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test byte [rsp + 0x58], 1
je 0x14006577c
mov rcx, qword [rsp + 0x68]
call fcn.1400a4d04
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x140065795
mov rcx, rbx
call fcn.1400c47c0
mov qword [rsp + 0x28], rax
jmp 0x1400657c7
mov qword [rsp + 0x28], 0
lea rdx, str....._base_strings_string_piece.h
lea r9, [0x1400d96fe]
lea r14, [rsp + 0x58]
mov rcx, r14
mov r8d, 0x86
call fcn.140038500
mov rcx, r14
call fcn.140038640
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x20]
call fcn.14002f590
test byte [rsi], 1
je 0x1400657e4
mov rcx, qword [rsi + 0x10]
call fcn.1400a4d04
mov rax, qword [rsp + 0x68]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x140065802
mov rcx, rbx
call fcn.1400a4d44
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400a5060
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140065a63
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x140105c88]
xor rax, rsp
mov qword [rsp + 0x198], rax
lea rbx, [rcx + 2]
test byte [rcx], 1
mov rcx, rbx
je 0x140065a92
mov rcx, qword [rsi + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x140065b80
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140065ad4
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400a5060
mov rcx, rsi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
jmp fcn.140065b9d
mov ecx, 2
call fcn.140050500
test al, al
je 0x140065b7e
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x266
mov r9d, 2
call fcn.1400517c0
lea rcx, [rsp + 0x68]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400031c8
mov rdi, rax
test byte [rsi], 1
je 0x140065b2f
mov rbx, qword [rsi + 0x10]
mov qword [rsp + 0x30], rbx
jne 0x140065b40
mov rcx, rsi
call fcn.140001c9e
jmp 0x140065b44
mov rax, qword [rsi + 8]
lea rdx, [rsp + 0x30]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.14002f590
mov rcx, rdi
mov rdx, rsi
call fcn.140003d2c
test byte [rsi], 1
je 0x140065b74
mov rcx, qword [rsp + 0x50]
call fcn.1400a4d04
lea rcx, [rsp + 0x58]
call fcn.1400518b0
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400a5060
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140065b9d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rsi, rcx
mov rax, qword [0x140105c88]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
lea rbx, [rcx + 2]
test byte [rcx], 1
mov rcx, rbx
je 0x140065bcc
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140065c4c
mov dil, 1
test al, 0x10
jne 0x140065d4d
mov ecx, 2
call fcn.140050500
test al, al
je 0x140065d4b
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x68]
mov r8d, 0x255
mov r9d, 2
call fcn.1400505d0
lea rcx, [rsp + 0x78]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400031c8
mov rdi, rax
test byte [rsi], 1
je 0x140065c34
mov rbx, qword [rsi + 0x10]
mov qword [rsp + 0x30], rbx
jne 0x140065cf8
mov rcx, rsi
call fcn.140001c9e
jmp 0x140065cfc
mov ecx, 2
call fcn.140050500
test al, al
je 0x140065d4b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x68]
mov r8d, 0x251
mov r9d, 2
call fcn.1400517c0
lea rcx, [rsp + 0x78]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400031c8
mov rdi, rax
test byte [rsi], 1
je 0x140065ca7
mov rbx, qword [rsi + 0x10]
mov qword [rsp + 0x40], rbx
jne 0x140065cb8
mov rcx, rsi
call fcn.140001c9e
jmp 0x140065cbc
mov rax, qword [rsi + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.14002f590
mov rcx, rdi
mov rdx, rsi
call fcn.140003d2c
test byte [rsi], 1
je 0x140065cec
mov rcx, qword [rsp + 0x60]
call fcn.1400a4d04
lea rcx, [rsp + 0x68]
call fcn.1400518b0
jmp 0x140065d4b
mov rax, qword [rsi + 8]
lea rdx, [rsp + 0x30]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.14002f590
mov rcx, rdi
mov rdx, rsi
call fcn.140003d2c
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1400031c8
test byte [rsi], 1
je 0x140065d41
mov rcx, qword [rsp + 0x60]
call fcn.1400a4d04
lea rcx, [rsp + 0x68]
call fcn.140050b40
xor edi, edi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400a5060
mov eax, edi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
ret
Function at 0x14006754e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x140105c88]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov ebx, 1
cmp rdi, r12
je 0x1400675e2
mov rsi, r8
mov r14, rcx
lea r15, [rsp + 0x20]
mov rcx, rdi
mov rdx, r15
call fcn.140069878
test al, al
jne 0x1400675aa
add rdi, 0x70
cmp rdi, r12
jne 0x14006758f
mov rdi, r12
cmp rdi, qword [r14 + 0x58]
je 0x1400675e2
test byte [rdi + 0x10], 1
je 0x1400675bc
mov rcx, qword [rdi + 0x20]
jmp 0x1400675c0
lea rcx, [rdi + 0x12]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov ebx, 1
cmovne ebx, ecx
test ebx, ebx
jne 0x1400675e2
mov qword [rsi], rdi
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a5060
mov eax, ebx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140068b02
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x68]
cmp eax, edx
jne 0x140068b19
test byte [rcx + 0x10], 1
je 0x140068b28
mov rcx, qword [rcx + 0x20]
jmp 0x140068b2c
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
inc eax
jmp 0x140068b45
add rcx, 0x12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret
Function at 0x14006b4ee
Capabilities:
Create pipe

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x140105c88]
xor rax, rsp
mov qword [rsp + 0x180], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x14006b5da
lea rdi, [rsp + 0x70]
xor ebx, ebx
mov r8d, 0x110
mov rcx, rdi
xor edx, edx
call fcn.1400a8280
mov dword [rdi - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
mov qword [rdi - 8], 6
mov word [rdi + 0x108], 0
lea rcx, [rsp + 0x64]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov edi, 0x80003
test eax, eax
je 0x14006b5e1
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov dword [rbx], 0x18
xor ecx, ecx
call fcn.14006b644
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x14006b5e1
mov edi, 3
xor ebx, ebx
test byte [rsi], 1
je 0x14006b5ec
mov rsi, qword [rsi + 0x10]
jmp 0x14006b5f0
add rsi, 2
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400a5060
mov rax, rsi
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140074030
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x140105c88]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], 0
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400740ac
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x1400740ac
cmp dword [rsp + 0x38], 4
jne 0x1400740ac
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a5060
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x1400740d0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.1400a5000
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140105c88]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1400a8280
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x38], 0x800
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x3c]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400741bc
mov eax, dword [rsp + 0x3c]
cmp eax, 2
je 0x14007416c
mov edi, 0x3f4
cmp eax, 1
jne 0x1400741bc
lea rdx, [rsp + 0x840]
jmp 0x1400741b2
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1400a8280
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x1400741bc
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140051a90
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400a5060
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400749c0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140105c88]
xor rax, rsp
mov qword [rsp + 0x28], rax
movzx eax, byte [0x14010b728]
test al, 1
jne 0x140074a64
test rsi, rsi
je 0x140074a90
mov r13d, 0xffffffff
lea rbx, str....._base_rand_util_win.cc
lea r14, str.success
lea r15, [rsp + 0x20]
nop word cs:[rax + rax]
cmp rsi, r13
mov r12d, 0xffffffff
cmovb r12, rsi
mov rcx, rdi
mov edx, r12d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140074a46
add rdi, r12
sub rsi, r12
jne 0x140074a20
jmp 0x140074a90
mov rcx, r15
mov rdx, rbx
mov r8d, 0x48
mov r9, r14
call fcn.140038500
mov rcx, r15
call fcn.140038640
jmp 0x140074a3c
call fcn.1400767e0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a5060
mov rcx, rdi
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x140078400
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a5060
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
sub rsp, 0x28
lea r8, [0x1400e6320]
call fcn.140078420
mov eax, 1
add rsp, 0x28
ret