joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074130
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x1a8
lea rbp, [rsp + 0x1e0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x140], xmm4
movabs rax, 0xffffffffffffff10
movaps xmmword [rbp + rax - 0x40], xmm4
movaps xmmword [rbp + rax - 0x30], xmm4
movaps xmmword [rbp + rax - 0x20], xmm4
add rax, 0x30
jne 0x14007415f
mov qword [rbp - 0x40], rax
mov rbx, r8
mov r14, r9
mov rax, qword [rbp + 0x48]
mov r15, qword [rbp + 0x50]
mov r13, qword [rbp + 0x58]
test rcx, rcx
jne 0x140074194
xor r12d, r12d
jmp 0x1400741a0
add rcx, 0xc
mov qword [rbp - 0x40], rcx
mov r12, qword [rbp - 0x40]
test rdx, rdx
jne 0x1400741a9
xor esi, esi
jmp 0x1400741b5
add rdx, 0xc
mov qword [rbp - 0x50], rdx
mov rsi, qword [rbp - 0x50]
mov qword [rbp - 0x48], rsi
xor edi, edi
cmp byte [rbp + 0x30], 0
setne dil
mov dword [rbp - 0x54], edi
test rax, rax
jne 0x1400741d6
xor edx, edx
mov qword [rbp - 0x138], rdx
jmp 0x1400741e9
add rax, 0xc
mov qword [rbp - 0x60], rax
mov rdx, qword [rbp - 0x60]
mov qword [rbp - 0x138], rdx
lea rdi, [rbp - 0xc0]
mov qword [rbp + 0x50], r15
mov rsi, r15
mov ecx, 0xc
rep movsq qword [rdi], qword [rsi]
xorps xmm0, xmm0
movups xmmword [rbp - 0x128], xmm0
movups xmmword [rbp - 0x118], xmm0
movups xmmword [rbp - 0x108], xmm0
movups xmmword [rbp - 0xf8], xmm0
movups xmmword [rbp - 0xe8], xmm0
movups xmmword [rbp - 0xd8], xmm0
movups xmmword [rbp - 0xd0], xmm0
lea rcx, [rbp - 0xc0]
lea rdx, [rbp - 0x128]
call fcn.140123db0
mov qword [rbp - 0x130], r13
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15d, dword [rbp - 0x54]
mov dword [rsp + 0x20], r15d
mov r15d, dword [rbp + 0x38]
mov dword [rsp + 0x28], r15d
mov r15, qword [rbp + 0x40]
mov qword [rsp + 0x30], r15
mov r15, qword [rbp - 0x138]
mov qword [rsp + 0x38], r15
lea rcx, [rbp - 0x128]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], r13
mov rcx, r12
mov qword [rbp - 0x148], rcx
mov rdx, qword [rbp - 0x48]
mov qword [rbp - 0x150], rdx
mov r8, rbx
mov qword [rbp - 0x158], r8
mov r9, r14
mov qword [rbp - 0x160], r9
lea rcx, [rbp - 0x188]
call fcn.140002f70
mov rcx, qword [rbp - 0x148]
mov rdx, qword [rbp - 0x150]
mov r8, qword [rbp - 0x158]
mov r9, qword [rbp - 0x160]
call sub.KERNEL32.dll_CreateProcessW
mov esi, eax
lea rcx, [rbp - 0x188]
call fcn.140002fc0
call fcn.14000207f
mov rdi, rax
mov qword [rbp - 0x140], rdi
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rbp - 0x140]
mov dword [rcx + 0x90], eax
xor ebx, ebx
test esi, esi
setne bl
lea rcx, [rbp - 0x128]
lea rdx, [rbp - 0xc0]
call fcn.140123cf0
mov rdi, qword [rbp + 0x50]
lea rsi, [rbp - 0xc0]
call fcn.140002ee0
call fcn.140002ee0
call fcn.140002ee0
mov ecx, 9
rep movsq qword [rdi], qword [rsi]
lea rcx, [rbp - 0x128]
call fcn.140123c30
movzx eax, bl
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400743a0
Capabilities:
Resume thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rcx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rbx
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x70]
call fcn.140002f70
mov rcx, qword [rbp - 0x48]
call sub.KERNEL32.dll_ResumeThread
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.140002fc0
call fcn.14000207f
mov rsi, rax
mov qword [rbp - 0x40], rsi
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rbp - 0x40]
mov dword [rcx + 0x90], eax
mov eax, ebx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140077900
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x70]
call fcn.140002f70
mov rcx, qword [rbp - 0x48]
call sub.KERNEL32.dll_GetSystemInfo
lea rcx, [rbp - 0x70]
call fcn.140002fc0
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140078b20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov rsi, r8
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1400cf540
nop
test rbx, rbx
je 0x140078b76
add rbx, 0xc
mov rdx, rbx
jmp 0x140078b78
xor edx, edx
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rbx
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], rdx
mov r8, rsi
mov qword [rbp - 0x68], r8
mov r9, rdi
mov qword [rbp - 0x70], r9
lea rcx, [rbp - 0x98]
call fcn.140002f70
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.140002fc0
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x140078bf5
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1400cf580
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14007a620
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov qword [rbp - 0x4c], rcx
mov rdx, rsi
mov qword [rbp - 0x54], rdx
mov r8d, edi
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140002f70
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.140002fc0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.14000207f
mov dword [rax + 0x90], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14007c290
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x58], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov edi, r8d
mov rsi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1400cf540
nop
mov qword [rbp - 0x50], rsi
lea r14, [rbx + 0x10]
xor ecx, ecx
test rbx, rbx
cmove r14, rcx
mov qword [rbp - 0x58], r14
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15d, dword [rbp + 0x30]
mov dword [rsp + 0x20], r15d
mov rcx, rbx
mov qword [rbp - 0x64], rcx
mov rdx, r14
mov qword [rbp - 0x6c], rdx
mov r8d, edi
mov dword [rbp - 0x5c], r8d
mov r9, rsi
mov qword [rbp - 0x74], r9
lea rcx, [rbp - 0xa0]
call fcn.140002f70
mov rcx, qword [rbp - 0x64]
mov rdx, qword [rbp - 0x6c]
mov r8d, dword [rbp - 0x5c]
mov r9, qword [rbp - 0x74]
call sub.KERNEL32.dll_K32EnumProcessModulesEx
mov ebx, eax
lea rcx, [rbp - 0xa0]
call fcn.140002fc0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
test ebx, ebx
setne bl
movzx ebx, bl
cmp byte [rbp - 0x40], 0
je 0x14007c382
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1400cf580
call fcn.14000207f
mov dword [rax + 0x90], esi
movzx eax, bl
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14007c8a0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov ebx, edx
mov qword [rbp - 0x40], r8
mov rsi, r8
lea rdi, [rcx + 0x10]
xor eax, eax
test rcx, rcx
cmove rdi, rax
mov qword [rbp - 0x48], rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x54], rcx
mov edx, ebx
mov dword [rbp - 0x4c], edx
mov r8, rsi
mov qword [rbp - 0x5c], r8
lea rcx, [rbp - 0x88]
call fcn.140002f70
mov rcx, qword [rbp - 0x54]
mov edx, dword [rbp - 0x4c]
mov r8, qword [rbp - 0x5c]
call sub.KERNEL32.dll_K32EnumProcesses
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.140002fc0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
test ebx, ebx
setne bl
movzx ebx, bl
call fcn.14000207f
mov dword [rax + 0x90], esi
movzx eax, bl
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140082380
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x3c], r8d
mov rdx, rcx
mov qword [rbp - 0x48], rdx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
mov r9d, 2
mov dword [rbp - 0x40], r9d
lea rcx, [rbp - 0x78]
call fcn.140002f70
mov r8d, dword [rbp - 0x3c]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov r9d, dword [rbp - 0x40]
call sub.bcrypt.dll_BCryptGenRandom
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.140002fc0
test ebx, ebx
jne 0x1400823f4
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp ebx, 0xc0000017
jne 0x14008241b
lea rcx, [0x14015f680]
call fcn.140002ae0
mov rbx, rax
mov rcx, rbx
call fcn.140094930
mov rcx, rbx
call fcn.1400030d0
lea rcx, [0x14015ef48]
call fcn.140002ae0
mov rbx, rax
mov rcx, rbx
call fcn.14008fdd0
mov rcx, rbx
call fcn.1400030d0
int3
Function at 0x140092400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x30
xor eax, eax
mov qword [rsp + 0x28], rax
mov rdi, rcx
mov ebx, edx
mov rsi, r8
mov ecx, 1
test ebx, ebx
cmovle ebx, ecx
mov rcx, rdi
neg rcx
lea rdx, [0x1401e0b68]
mov rax, rcx
or rax, 1
bsr r8, rax
lzcnt rax, rax
xor eax, 0x3f
test dword [0x140262de0], 0x1000
cmovne r8d, eax
movsxd rax, r8d
movzx edx, byte [rdx + rax]
mov eax, edx
shl rax, 3
lea r8, [0x1401e4a88]
add rax, r8
cmp rcx, qword [rax]
setb cl
movzx ecx, cl
sub edx, ecx
cmp ebx, edx
mov ebp, edx
cmovge ebp, ebx
mov r14d, dword [rsi + 8]
add ebp, r14d
lea rcx, [0x14015d2d8]
mov edx, ebp
call fcn.140002ba0
mov r15, rax
test r15, r15
jne 0x14009249f
xor eax, eax
jmp 0x1400924ad
lea rax, [r15 + 0xc]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movsxd rdx, ebp
lea rbp, [rax + rdx*2]
neg rdi
cmp rdi, 0x64
jb 0x140092586
lea rax, [0x140158b08]
cmp qword [rax - 8], 0
jne 0x1400925bb
mov rcx, qword [0x140259740]
add rbp, 0xfffffffffffffffc
add ebx, 0xfffffffe
movabs rdx, 0x28f5c28f5c28f5c3
mov rax, rdi
shr rax, 2
mul rdx
shr rdx, 2
imul rax, rdx, 0x64
sub rdi, rax
mov r13, rdx
mov rax, qword [rcx + 0x38]
cmp byte [rax], al
shl edi, 2
mov edx, edi
mov eax, dword [rax + rdx + 0x10]
mov dword [rbp], eax
cmp r13, 0x64
jae 0x14009257e
test r13, r13
je 0x140092556
dec ebx
movabs rdx, 0xcccccccccccccccd
mov rax, r13
mul rdx
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
mov rcx, r13
sub rcx, rax
mov r13, rdx
add rbp, 0xfffffffffffffffe
add ecx, 0x30
mov word [rbp], cx
test r13, r13
jne 0x140092520
test ebx, ebx
jg 0x140092520
mov rax, rbp
lea ecx, [r14 - 1]
test ecx, ecx
jl 0x1400925a2
cmp r14d, ecx
jle 0x14009258b
add rax, 0xfffffffffffffffe
mov edx, ecx
movzx edx, word [rsi + rdx*2 + 0xc]
mov word [rax], dx
dec ecx
jns 0x14009256a
jmp 0x1400925a2
mov rdi, r13
jmp 0x1400924da
mov r13, rdi
jmp 0x14009251b
add rax, 0xfffffffffffffffe
cmp ecx, r14d
jae 0x1400925c5
mov edx, ecx
movzx edx, word [rsi + rdx*2 + 0xc]
mov word [rax], dx
dec ecx
jns 0x14009258b
xor eax, eax
mov qword [rsp + 0x28], rax
mov rax, r15
add rsp, 0x30
pop rbx
pop rbp
pop rsi
pop rdi
pop r13
pop r14
pop r15
ret
call fcn.140001551
jmp 0x1400924d3
call fcn.140096840
int3
Function at 0x14009f8f0
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, edx
lea rdi, [0x140158e70]
cmp qword [rdi - 8], 0
jne 0x14009f966
cmp byte [rdi], 0
je 0x14009f91b
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
lea rbp, [0x140158b68]
cmp qword [rbp - 8], 0
jne 0x14009f96d
cmp byte [rbp], 0
jne 0x14009f941
mov rcx, rbx
mov edx, esi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp 0x1400a02c0
mov edx, esi
mov ecx, edx
or ecx, 0x80000000
cmp byte [rbx + 0x1b8], 0
cmove edx, ecx
mov rcx, qword [rbx + 8]
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp fcn.1400a09e0
call fcn.1400013a0
jmp 0x14009f90b
call fcn.14000113f
jmp 0x14009f929
sub rsp, 0x28
cmp edx, 0x1009
jne 0x1400a02d3
xor eax, eax
add rsp, 0x28
ret
xor r8d, r8d
mov dword [rsp + 0x20], r8d
mov rcx, qword [rcx + 0x10]
lea r8, [rsp + 0x20]
call fcn.1400db300
mov eax, dword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x14009f980
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, edx
lea rdi, [0x140158e70]
cmp qword [rdi - 8], 0
jne 0x14009fa01
cmp byte [rdi], 0
je 0x14009f9ab
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
lea rbp, [0x140158b68]
cmp qword [rbp - 8], 0
jne 0x14009fa08
cmp byte [rbp], 0
jne 0x14009f9dc
movzx ecx, byte [rbx + 0x1b8]
test ecx, ecx
jne 0x14009f9dc
mov rcx, rbx
mov edx, esi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp 0x1400a02c0
mov edx, esi
mov ecx, edx
or ecx, 0x80000000
cmp byte [rbx + 0x1b8], 0
cmove edx, ecx
mov rcx, qword [rbx + 8]
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp fcn.1400a09e0
call fcn.1400013a0
jmp 0x14009f99b
call fcn.14000113f
jmp 0x14009f9b9

Function at 0x1400a0910
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x50], rax
mov rax, qword [0x14025ae00]
mov qword [rbp + 0x48], rax
test dword [rsp], esp
sub rsp, 0x430
lea rbx, [rsp + 0x20]
test rcx, rcx
je 0x1400a0950
add rcx, 0xc
jmp 0x1400a0952
xor ecx, ecx
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x44], edx
mov r8, rbx
mov qword [rbp + 0x30], r8
mov r9d, 0x212
mov dword [rbp + 0x40], r9d
lea rcx, [rbp + 8]
call fcn.140002f70
mov rcx, qword [rbp + 0x38]
mov edx, dword [rbp + 0x44]
mov r8, qword [rbp + 0x30]
mov r9d, dword [rbp + 0x40]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov esi, eax
lea rcx, [rbp + 8]
call fcn.140002fc0
xor ecx, ecx
mov qword [rbp + 0x50], rcx
test esi, esi
jle 0x1400a09aa
mov rcx, rbx
call fcn.140086c70
jmp 0x1400a09ac
xor eax, eax
lea rcx, [0x14025ae00]
mov rcx, qword [rcx]
cmp qword [rbp + 0x48], rcx
je 0x1400a09c1
call fcn.140003b40
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400a09e0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
or edx, 0x20000000
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x1400a0a16
add rcx, 0xc
jmp 0x1400a0a18
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.140002f70
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.140002fc0
xor eax, eax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400db3a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x100]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov edi, edx
mov rbx, r8
mov rsi, r9
mov r14, qword [rbp + 0x38]
mov r15, qword [rbp + 0x40]
mov r13, qword [rbp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1400cf540
nop
lea rcx, [r13 + 0x10]
xor edx, edx
test r13, r13
cmove rcx, rdx
mov qword [rbp - 0x50], rcx
lea rdx, [r15 + 0x10]
xor r8d, r8d
test r15, r15
cmove rdx, r8
mov qword [rbp - 0x58], rdx
lea r8, [r14 + 0x10]
xor r9d, r9d
test r14, r14
cmove r8, r9
mov qword [rbp - 0x60], r8
mov qword [rbp - 0x68], rsi
mov r9, rsi
lea rax, [rbx + 0x10]
xor r10d, r10d
test rbx, rbx
cmove rax, r10
mov qword [rbp - 0x70], rax
mov r10, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [r10 + 8]
mov qword [rbp - 0x7c], rcx
mov edx, edi
mov dword [rbp - 0x74], edx
mov r8, rax
mov qword [rbp - 0x84], r8
mov qword [rbp - 0x8c], r9
lea rcx, [rbp - 0xb8]
call fcn.140002f70
mov rcx, qword [rbp - 0x7c]
mov edx, dword [rbp - 0x74]
mov r8, qword [rbp - 0x84]
mov r9, qword [rbp - 0x8c]
call sub.ADVAPI32.dll_RegEnumValueW
mov ebx, eax
lea rcx, [rbp - 0xb8]
call fcn.140002fc0
nop
xor ecx, ecx
mov qword [rbp - 0x70], rcx
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1400db4e9
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1400cf580
mov eax, ebx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400db7b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov rsi, r8
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1400cf540
nop
test rbx, rbx
je 0x1400db806
add rbx, 0xc
mov rdx, rbx
jmp 0x1400db808
xor edx, edx
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rbx
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], rdx
mov r8, rsi
mov qword [rbp - 0x68], r8
mov r9, rdi
mov qword [rbp - 0x70], r9
lea rcx, [rbp - 0x98]
call fcn.140002f70
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.140002fc0
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1400db885
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1400cf580
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401304c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
cmp r8d, 8
jge 0x14013055d
xor eax, eax
cmp r8d, 4
jl 0x140130511
add r8d, 0xfffffffc
movsx r10, word [rcx + rax*2]
movsx r9, dx
cmp r10d, r9d
je 0x140130558
nop dword [rax]
movsx r10, word [rcx + rax*2 + 2]
cmp r10d, r9d
je 0x140130551
movsx r10, word [rcx + rax*2 + 4]
cmp r10d, r9d
je 0x140130549
movsx r10, word [rcx + rax*2 + 6]
cmp r10d, r9d
je 0x140130541
add rax, 4
test r8d, r8d
jle 0x14013073a
movsx r9, dx
nop
dec r8d
movsx rdx, word [rcx + rax*2]
cmp edx, r9d
je 0x140130558
inc rax
test r8d, r8d
jg 0x140130520
jmp 0x14013073a
add eax, 3
jmp 0x140130735
add eax, 2
jmp 0x140130735
inc eax
jmp 0x140130735
jmp 0x140130735
movsx r9, dx
movd xmm0, r9d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov rax, rcx
lea edx, [r8 - 8]
movsxd rdx, edx
add rdx, rdx
lea r10, [rax + rdx]
movups xmm1, xmmword [rax]
pcmpeqw xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
xorps xmm2, xmm2
pcmpeqw xmm1, xmm2
pmovmskb r9d, xmm1
cmp r9d, 0xffff
jne 0x140130676
add rax, 0x10
cmp rax, r10
jbe 0x140130580
mov eax, r8d
test al, 7
je 0x14013073a
movups xmm1, xmmword [r10]
pcmpeqw xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x14013073a
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
jne 0x14013072c
mov ecx, 0x20
jmp 0x14013072f
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
jne 0x14013071d
mov r8d, 0x20
jmp 0x140130721
bsf r8d, edx
sub rax, rcx
shr rax, 1
add eax, r8d
jmp 0x140130735
bsf ecx, eax
shr rdx, 1
lea eax, [rdx + rcx]
add rsp, 0x38
ret
mov eax, 0xffffffff
add rsp, 0x38
ret