joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400262d8
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, qword [0x1400c8ab0]
mov rcx, rdi
call fcn.1400263d8
test eax, eax
jne 0x1400263c8
mov rcx, qword [0x1400c8ab0]
lea edx, [rax + 2]
call fcn.140029be4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
call fcn.140026e64
mov ebx, eax
test eax, eax
js 0x140041a3a
call fcn.14002213c
mov ebx, eax
test eax, eax
js 0x140041a61
mov rcx, qword [0x1400c8ab0]
mov rax, qword [rcx]
mov dword [rcx + 0xd0], 1
mov rax, qword [rax + 0x68]
call qword [case.0x14000702c.0]
mov ebx, eax
test eax, eax
js 0x140041a68
mov rcx, qword [0x1400c8ab0]
mov edx, 4
call fcn.140029be4
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x80]
call qword [case.0x14000702c.0]
mov ebx, eax
test eax, eax
js 0x140041a41
mov r8d, SafeArrayGetLBound
lea rdx, [0x140095f50]
lea rcx, [rsp + 0x38]
call fcn.140026dd4
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov edx, 4
mov dword [rsp + 0x30], 1
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
lea rcx, [rsp + 0x38]
call fcn.140026e40
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov edx, 0x218
jmp 0x140041a46
mov edx, 0x222
mov rcx, qword [rsp + 0x28]
lea r8, str.onecoreuap_base_appmodel_search_searchcommondcomsvcdcomsvc.cxx
mov r9d, ebx
call fcn.1400025a0
mov eax, ebx
jmp 0x1400263ca
mov edx, 0x21a
jmp 0x140041a46
mov edx, 0x21e
jmp 0x140041a46

Function at 0x140026d44
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
lea rax, [rbp + 0x38]
xor r8d, r8d
mov qword [rbp + 0x38], rbx
lea rdx, str.SystemSetup
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
lea edi, [rbx + 1]
mov r9d, edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140026dc8
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x28]
mov dword [rbp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Upgrade
mov dword [rbp + 0x30], 4
mov dword [rbp + 0x20], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x140042416
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rdi
pop rbx
pop rbp
ret
cmp dword [rbp + 0x20], 4
jne 0x140026dbe
cmp dword [rbp + 0x28], edi
cmove ebx, edi
jmp 0x140026dbe
Function at 0x140027950
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x48
mov dword [rcx], 3
lea rax, [rbp - 0x10]
mov dword [rdx], 0x65
mov rdi, rdx
mov rsi, rcx
mov byte [rbp + 0x30], 0
lea rdx, str.SOFTWAREMicrosoftWindows_Search
mov qword [rsp + 0x20], rax
mov r9d, 1
mov rcx, 0xffffffff80000002
call fcn.14001e414
mov ebx, eax
test eax, eax
jg 0x1400426a6
test ebx, ebx
js 0x1400426b4
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x18]
and dword [rbp + 0x38], 0
lea r9, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, str.SetupCompletedSuccessfully
lea rax, [rbp + 0x38]
mov dword [rbp - 0x18], 4
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x40], 4
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
test eax, eax
jg 0x1400426d2
js 0x140027a59
cmp dword [rbp + 0x38], 1
jne 0x140027a59
and dword [rsi], 0
lea r8, [rbp + 0x28]
and dword [rdi], 0
lea rdx, [rbp + 0x30]
mov byte [rbp + 0x28], 0
call fcn.140027b4c
test eax, eax
js 0x140027a59
cmp byte [rbp + 0x28], 0
je 0x140042720
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x18]
and dword [rbp + 0x38], 0
lea r9, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, str.RebuildIndex
lea rax, [rbp + 0x38]
mov dword [rbp + 0x40], 4
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x18], 4
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
test eax, eax
je 0x1400426e1
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp byte [rbp + 0x30], 0
jne 0x140027a74
mov eax, ebx
add rsp, 0x48
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14005ae20
jmp 0x140027a69
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14002799e
mov rcx, qword [rbp + 0x20]
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov r9d, ebx
mov edx, 0x117
call fcn.14002cfec
nop
jmp 0x140027a69
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0x1400279e9
cmp dword [rbp + 0x40], 4
jne 0x140042709
mov edx, dword [rbp + 0x38]
test edx, edx
je 0x140042709
lea eax, [rdx - 1]
mov dword [rsi], 1
cmp eax, 8
mov ecx, 0x68
cmovbe ecx, edx
mov dword [rdi], ecx
jmp 0x140027a59
mov rcx, qword [rbp - 0x10]
lea rdx, str.RebuildIndex
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop
jmp 0x140027a59
mov dword [rsi], 1
mov dword [rdi], 0x64
jmp 0x140027a59
Function at 0x140027a7c
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x38
lea rax, [rsp + 0x68]
mov r9d, 0xf003f
lea rdx, str.SOFTWAREMicrosoftWindows_Search
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call fcn.14001e414
xor edi, edi
mov ebx, eax
test eax, eax
jg 0x140042732
test ebx, ebx
js 0x140027b42
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x60]
mov eax, 4
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x60], eax
lea r8, str.SetupCompletedSuccessfully
mov dword [rsp + 0x58], eax
xor edx, edx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
mov ebx, eax
test eax, eax
jg 0x140042740
test ebx, ebx
js 0x140027b37
cmp dword [rsp + 0x50], 1
jne 0x140027b37
mov rcx, qword [rsp + 0x68]
lea rdx, str.PreviousSettings
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteKeyW]
mov ebx, eax
test eax, eax
jle 0x140027b2e
movzx ebx, ax
or ebx, 0x80070000
cmp ebx, 0x80070002
cmove ebx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140027ab2
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140027b02
Function at 0x140027e04
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor r14d, r14d
mov sil, r14b
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x41
mov word [rbp - 0x80], r14w
lea rax, fcn.140008d70
mov qword [rsp + 0x68], rax
lea rax, [0x14008b078]
mov qword [rsp + 0x60], rax
mov dword [rbp + 8], r14d
mov qword [rbp + 0x10], r14
mov qword [rsp + 0x20], r14
mov r9d, 0x2001f
lea r8, str.SOFTWAREMicrosoftWindows_SearchCrawlScopeManagerWindows
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x60]
call fcn.1400177b0
test eax, eax
js 0x140027fba
mov eax, r14d
mov dword [rsp + 0x30], eax
lea edi, [r14 + 6]
lea r15d, [r14 + 4]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x14004284c
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, r15d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetKeySecurity]
mov ecx, eax
mov eax, dword [rsp + 0x30]
cmp ecx, 0x7a
jne 0x140027fba
mov ecx, eax
lea rdx, [0x140096784]
call fcn.14002e1ac
mov rbx, rax
test rax, rax
je 0x140027fb1
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140027f15
lea r9, [rsp + 0x30]
mov r8, rax
mov edx, r15d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetKeySecurity]
mov edi, eax
test edi, edi
jg 0x140042853
js 0x140027fb1
mov qword [rsp + 0x40], r14
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x34]
mov rcx, rbx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x140042863
cmp dword [rsp + 0x34], r14d
je 0x140027fb1
mov dword [rsp + 0x38], 0x44
lea r9, [rsp + 0x38]
lea r8, [rbp + 0x20]
xor edx, edx
lea ecx, [rdx + 0x1a]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
test eax, eax
je 0x140042875
mov edi, r14d
mov r15d, 1
lea r8, [rsp + 0x48]
mov edx, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
test eax, eax
je 0x140027fb1
mov rdx, qword [rsp + 0x48]
add rdx, 8
lea rcx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0x140027ff0
add edi, r15d
test sil, sil
je 0x140027f7c
mov rcx, rbx
call fcn.14000e5b8
nop
lea rcx, [rsp + 0x60]
call fcn.140017740
mov al, sil
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14002dd40
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 4]
and ecx, 0xf003f
movzx esi, sil
cmp ecx, 0xf003f
cmove esi, r15d
jmp 0x140027fa9
mov ecx, edi
jmp 0x140027ed6
movzx edi, di
or edi, 0x80070000
test edi, edi
jmp 0x140027f1d
call fcn.14001e36c
test eax, eax
js 0x140027fb1
jmp 0x140027f48
call fcn.14001e36c
test eax, eax
js 0x140027fb1
jmp 0x140027f73
Function at 0x140028b60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x38
lea rax, [rbp + 0x30]
mov ebx, 1
mov r9d, ebx
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_Search
mov rcx, 0xffffffff80000002
call fcn.14001e414
test eax, eax
jg 0x140043c00
js 0x140028bf1
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x20]
and dword [rbp + 0x28], 0
lea r9, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea r8, str.EnableDefaultScope
lea rax, [rbp + 0x28]
mov dword [rbp + 0x20], 4
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x18], 4
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
test eax, eax
jle 0x140028be1
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x140043c0f
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, bl
add rsp, 0x38
pop rbx
pop rbp
ret
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0x140028b96
cmp dword [rbp + 0x18], 4
je 0x140043c1a
call fcn.140088e60
cmp dword [rbp + 0x20], 4
je 0x140043c25
call fcn.140088e60
mov eax, dword [rbp + 0x28]
neg eax
sbb cl, cl
and bl, cl
jmp 0x140028be7

Function at 0x1400292d8
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
cmp dword [0x1400cb7d8], 0
mov esi, r9d
movzx ebp, r8w
mov edi, edx
mov rbx, rcx
jne 0x140029357
call fcn.1400293d8
test al, al
jne 0x140029357
mov rcx, rbx
call fcn.140029378
test eax, eax
je 0x140029371
call fcn.14002fe90
test al, al
je 0x140029357
and qword [rsp + 0x40], 0
mov r9d, edi
mov rax, qword [rsp + 0x80]
movzx edx, bp
movzx r8d, word [rbx + 0x68]
mov rcx, qword [rbx + 0x60]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov word [rsp + 0x28], si
and qword [rsp + 0x20], 0
call qword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_ReportEventW]
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
xor eax, eax
jmp 0x14002935c

Function at 0x140029634
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r9d, dword [rcx + 0x14]
lea r8, str._08x
mov rdi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x38]
lea edx, [rbx + 0x10]
call fcn.140009728
test eax, eax
js 0x1400296cf
lea rax, [rsp + 0x30]
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 2]
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindows_SearchTracingEventThrottleState
call fcn.14001e414
test eax, eax
jne 0x1400296cf
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 3]
mov dword [rsp + 0x28], SafeArrayPutElement
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov edx, 1
test eax, eax
movzx ebx, bl
cmove ebx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002dd40
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400297c4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, qword [rsp + 0x2b8]
mov rbp, r8
mov rbx, qword [rsp + 0x2c0]
lea r8, [rsp + 0x40]
mov rcx, 0xffffffff80000002
mov r14d, r9d
mov rsi, rdx
call fcn.14000aad0
test al, al
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rdi
cmove rdx, rsi
mov r9d, r14d
and qword [rsp + 0x20], 0
mov r8, rbp
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14002dd40
add rsp, 0x260
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002b8cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x490
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r14, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140041d00
xor r9d, r9d
mov r8, rdi
mov rdx, r14
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FindResourceExW]
mov rdi, rax
test rax, rax
je 0x14002ba53
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14002ba53
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jb 0x140041d0c
mov ecx, eax
lea edx, [rbx + 2]
call fcn.14002be88
cmp rax, 0x400
jbe 0x140041d2c
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14002be64
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x140041d55
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
test eax, eax
je 0x14002ba53
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14002aa5c
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14002ba23
lea rcx, [rsp + 0x70]
call fcn.14002be58
nop
lea rcx, [rsp + 0x48]
call fcn.14002baa0
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14002dd40
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r14
pop rdi
pop rsi
ret
call fcn.140054984
nop
jmp 0x14002ba00
call fcn.140054984
mov ebx, eax
jmp 0x14002ba0c
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x140041d22
lea rcx, [rsp + 0x70]
call fcn.14002be58
mov ebx, 0x8007000e
jmp 0x14002ba23
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14002b9b7
mov ebx, 0x8007000e
jmp 0x14002ba02

Function at 0x14002cc50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x14002cc80
movzx eax, byte [r9 + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc r9
imul r8, r10
cmp r9, rdx
jb 0x14002cc62
mov rax, r8
shr rax, 0x20
xor rax, r8
ret
Function at 0x14002dae4
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.140195000
add rsp, 0x28
jmp 0x14002dae4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x1400c9b58], rbx
je 0x14002db2e
cmp rax, rbx
jne 0x14002db43
mov edi, 1
mov eax, dword [0x1400c9b60]
cmp eax, 1
jne 0x14002db50
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x14002dbbd
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14002db17
mov eax, dword [0x1400c9b60]
test eax, eax
jne 0x14002dbb3
mov dword [0x1400c9b60], 1
lea r14, [0x140093718]
lea rbx, [0x140093700]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x14002dba5
test eax, eax
jne 0x14002dba9
cmp qword [rbx], 0
je 0x14002db9a
mov rax, qword [rbx]
mov rcx, qword [case.0x14000702c.0]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x14002db7b
test eax, eax
je 0x14002dbbd
mov eax, 0xff
jmp 0x14002dd12
mov dword [0x1400c9260], 1
mov eax, dword [0x1400c9b60]
cmp eax, 1
jne 0x14002dbe5
lea rdx, [0x1400936f8]
lea rcx, [0x140093508]
call sub.msvcrt.dll__initterm
mov dword [0x1400c9b60], 2
test edi, edi
jne 0x14002dbf2
xor eax, eax
xchg qword [0x1400c9b58], rax
cmp qword [0x1400c9b78], 0
je 0x14002dc26
lea rcx, [0x1400c9b78]
call fcn.14002e580
test eax, eax
je 0x14002dc26
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400c9b78]
mov r9, qword [case.0x14000702c.0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
mov cl, byte [rbx]
cmp cl, 0x20
ja 0x14002dcb1
test cl, cl
je 0x14002dc48
test edi, edi
jne 0x14002dcb1
dec cl
cmp cl, 0x1f
ja 0x14002dc5b
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x14002dc48
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140024b10
mov dword [0x1400c925c], eax
cmp dword [0x1400c9280], 0
jne 0x14002dc9a
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400c9260], 0
jne 0x14002dcaf
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400c925c]
jmp 0x14002dd12
cmp cl, 0x22
jne 0x14002dcc3
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x14002dcd8
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x14002dc39
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x14002e490
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14002e4dc
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002e4d4
cmp dword [rcx + 0x3c], edx
jl 0x14002e4d4
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14002e4d4
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14002e4dc
mov rax, rdx
add rsp, 0x18
ret

Function at 0x14002e6f4
Capabilities:
Print debug messages

Disassembly:
jmp 0x14002e6fc
push rbx
sub rsp, 0x540
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14002e779
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlVirtualUnwind]
jmp 0x14002e799
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14002dd40
add rsp, 0x540
pop rbx
ret

Function at 0x14002e6fc
Capabilities:
Print debug messages

Disassembly:
jmp 0x14002e6fc
push rbx
sub rsp, 0x540
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14002e779
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlVirtualUnwind]
jmp 0x14002e799
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14002dd40
add rsp, 0x540
pop rbx
ret
Function at 0x140030704
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
or ebx, 0xffffffff
cmp dword [0x1400c9180], ebx
je 0x14003071a
call fcn.140088e60
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
cmp eax, ebx
mov dword [0x1400c9180], eax
sete bl
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x14003073d
movzx eax, ax
or eax, 0x80070000
test bl, bl
je 0x14003075a
mov rcx, qword [rsp + 0x28]
lea r8, str.onecoreuap_base_appmodel_searchcommonincludeperusercatalogresethelper.h
mov r9d, eax
mov edx, 0x22
call fcn.14002cfec
add rsp, 0x20
pop rbx
ret

Function at 0x140044b2c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov rdi, r9
xor ecx, ecx
mov rsi, r8
mov ebp, edx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rcx, qword [rbx + 0xb0]
xor ebx, ebx
test rcx, rcx
jne 0x140044b6e
lea ecx, [rbx + 6]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x140044ba2
lea rax, [rsp + 0x50]
mov r9, rdi
mov qword [rsp + 0x38], rax
mov r8, rsi
mov qword [rsp + 0x30], rbx
mov edx, ebp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x140044b9d
mov ecx, eax
jmp 0x140044b64
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret