joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e9370
Capabilities:
Delete file

Disassembly:
mov qword [str._f_v_], rcx
jmp fcn.1400e9500

Function at 0x1400e9380
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rsi, rdx
mov dword [rsp + 0x28], 0x80
mov rdi, rcx
mov dword [rsp + 0x20], 4
mov rcx, rsi
lea edx, [r9 + 4]
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x90], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rdi + 0x90], 0xffffffffffffffff
mov ebx, eax
jne 0x1400e94e3
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
call fcn.1400eac40
cmp ebx, 0x20
jne 0x1400e94e3
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rdi + 0x28]
mov r8b, 1
lea rcx, [rsp + 0x40]
call fcn.1400e9e30
lea rbx, [rdi + 0x48]
mov rdx, rax
mov rcx, rbx
call fcn.140059ac0
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400e9466
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e9461
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400e9461
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e6a28
lea rcx, str.Trying_again_with_file_name:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x1400e9480
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x1402723e4]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x1400e94a0
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.1400e9380
movzx esi, al
test al, al
jne 0x1400e94cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rbx + 0x18], 8
jb 0x1400e94bf
mov rbx, qword [rbx]
mov r8d, eax
mov rdx, rbx
mov rcx, rdi
call fcn.1400eac40
movzx eax, sil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea r11, [rsp + 0x60]
mov al, 1
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400eac40
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rcx, str.Unable_to_open_log_file:
mov edi, r8d
mov rbx, rdx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str.__error:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea r9, [rsp + 0x72]
test edi, edi
jns 0x1400eace0
neg edi
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub di, cx
add di, 0x30
mov word [r9], di
mov edi, edx
test edx, edx
jne 0x1400eaca0
add r9, 0xfffffffffffffffe
mov eax, 0x2d
mov word [r9], ax
jmp 0x1400ead0c
sub r9, 2
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub di, cx
add di, 0x30
mov word [r9], di
mov edi, edx
test edx, edx
jne 0x1400eace0
lea rcx, [rsp + 0x72]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov eax, 7
mov qword [rsp + 0x38], rax
cmp r9, rcx
je 0x1400ead4c
lea r8, [rsp + 0x72]
mov rdx, r9
sub r8, r9
lea rcx, [rsp + 0x20]
sar r8, 1
call fcn.1400523d0
mov rax, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x20]
cmp rax, 8
lea rcx, [rsp + 0x20]
cmovae rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400eada4
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ead9f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ead9f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e6a28
lea rcx, [0x1402723e4]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400eaf70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rdx
add rcx, 8
call fcn.140057800
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x1400eade0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x48], rax
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400eafec
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
mov qword [rdi + 0x38], 0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400e6b50
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400eb010
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx esi, r8b
mov rdi, rdx
mov rbx, rcx
cmp byte [rcx + 0xe0], 0
jne 0x1400eb10f
mov byte [rcx + 0xe0], 1
cmp qword [rcx + 0x90], 0xffffffffffffffff
jne 0x1400eb10f
lea rdx, [rcx + 0x48]
cmp qword [rdx + 0x18], 8
jb 0x1400eb068
mov rdx, qword [rdx]
call fcn.1400e9380
test al, al
je 0x1400eb10f
xor r8d, r8d
lea rdx, str._t_n_t
mov rcx, rbx
call fcn.1400eb010
lea rdx, [rbx + 0x28]
cmp qword [rdx + 0x18], 8
jb 0x1400eb095
mov rdx, qword [rdx]
lea rcx, [rsp + 0x30]
call fcn.1400f3870
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
xor r8d, r8d
mov rcx, rbx
call fcn.1400eb010
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400eb0fd
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eb0f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eb0f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e6a28
mov r8b, 1
lea rdx, str._begins_n_t_n
mov rcx, rbx
call fcn.1400eb010
mov rcx, qword [rbx + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x1400eb163
mov dword [rsp + 0x50], 0
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x1400eb130
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test sil, sil
je 0x1400eb163
mov rcx, qword [rbx + 0x90]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400eb270
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x440
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rax, qword [rcx + 8]
mov rdi, rcx
mov esi, dword [rax + 0x98]
call fcn.1400ea5e0
mov rbx, rax
mov byte [rsp + 0x20], 0
mov rdx, qword [rax + 0x88]
test rdx, rdx
jne 0x1400eb2c8
mov rdx, qword [0x140376f60]
mov qword [rax + 0x88], rdx
lea rcx, [rsp + 0x20]
call fcn.1400ea160
cmp byte [rsp + 0x20], 0
je 0x1400eb2df
mov dword [rbx + 0x98], eax
mov rax, qword [rdi + 8]
mov ecx, dword [rax + 0x98]
cmp esi, ecx
je 0x1400eb32c
call fcn.1400c1ff0
mov ecx, esi
mov r9, rax
call fcn.1400c1ff0
mov r8, rax
lea rdx, str._Changing_log_level_from__s_to__s_n
lea rcx, [rsp + 0x30]
call fcn.1400bf8b0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x30]
mov r8b, 1
call fcn.1400eb010
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400eb450
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
test rcx, rcx
je 0x1400eb576
mov rdx, qword [0x140376ef0]
call qword [sym.imp.CoreFoundation.dll_CFDictionaryGetValue]
mov rbx, rax
test rax, rax
je 0x1400eb576
mov rcx, rax
call qword [sym.imp.CoreFoundation.dll_CFStringGetLength]
test rax, rax
jle 0x1400eb576
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.CoreFoundation.dll_CFStringCreateCopy]
mov rdi, rax
lea rcx, str._CCC__Using_country_code_from_context:___
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov r8, rax
mov r9, rdi
mov edx, 7
lea rcx, [rsp + 0x40]
call fcn.1400eb780
nop
cmp qword [rsp + 0x50], 0
je 0x1400eb531
call fcn.1400ea5e0
cmp dword [rax + 0x98], 7
jl 0x1400eb531
call fcn.1400ea5e0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [0x140273b24]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], VarDecFix
lea r9, str.D:BWA2C8BCE7B_BF89_0iCloudAuthKitWin_253_srcrootAuthKitWinAKUtils.cpp
lea r8, str.AKCopyCountryCodeFromContext
mov edx, 7
mov rcx, rax
call fcn.1400eaaa0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400eb576
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eb571
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eb571
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e6a28
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400e6b50
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1400eb5a0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ebx, ebx
call qword [sym.imp.CoreFoundation.dll_CFLocaleCopyCurrent]
mov rdi, rax
test rax, rax
je 0x1400eb721
mov rcx, rax
call qword [sym.imp.CoreFoundation.dll_CFLocaleGetIdentifier]
mov rsi, rax
test rax, rax
je 0x1400eb721
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.CoreFoundation.dll_CFLocaleCreateComponentsFromLocaleIdentifier]
mov rbp, rax
test rax, rax
je 0x1400eb721
mov rdx, qword [sym.imp.CoreFoundation.dll_kCFLocaleCountryCode]
mov rdx, qword [rdx]
mov rcx, rax
call qword [sym.imp.CoreFoundation.dll_CFDictionaryGetValue]
mov r14, rax
test rax, rax
je 0x1400eb716
mov rcx, rax
call qword [sym.imp.CoreFoundation.dll_CFStringGetLength]
test rax, rax
jle 0x1400eb716
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.CoreFoundation.dll_CFStringCreateCopy]
mov rbx, rax
lea rcx, str._CCC__Using_country_code_from_system:_____systemLocaleId___
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov r8, rax
mov qword [rsp + 0x20], rsi
mov r9, rbx
mov edx, 7
lea rcx, [rsp + 0x48]
call fcn.1400eb780
nop
cmp qword [rsp + 0x58], 0
je 0x1400eb6d1
call fcn.1400ea5e0
cmp dword [rax + 0x98], 7
jl 0x1400eb6d1
call fcn.1400ea5e0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [0x140273b24]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], CreateErrorInfo
lea r9, str.D:BWA2C8BCE7B_BF89_0iCloudAuthKitWin_253_srcrootAuthKitWinAKUtils.cpp
lea r8, str.AKCopyCountryCodeFromSystem
mov edx, 7
mov rcx, rax
call fcn.1400eaaa0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400eb716
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eb711
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eb711
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e6a28
mov rcx, rbp
call qword [sym.imp.CoreFoundation.dll_CFRelease]
jmp 0x1400eb726
test rdi, rdi
je 0x1400eb72f
mov rcx, rdi
call qword [sym.imp.CoreFoundation.dll_CFRelease]
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400f3720
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x40], 0x124
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
jne 0x1400f375b
lea eax, [rcx + 0xd]
jmp 0x1400f3848
lea rax, [rsp + 0x40]
mov r9d, 2
mov qword [rsp + 0x30], rax
mov r8, rbp
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400f37bf
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400f37a0
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400523d0
xor eax, eax
jmp 0x1400f3848
cmp eax, 2
je 0x1400f37b8
cmp eax, 0xea
jne 0x1400f3848
mov ecx, dword [rsp + 0x40]
mov qword [rsp + 0x1c8], rbx
call fcn.1400e6a30
mov rbx, rax
mov r9d, 2
lea rax, [rsp + 0x40]
mov r8, rbp
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], rbx
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edi, eax
test eax, eax
jne 0x1400f3836
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400f3820
mov rdx, rbx
mov rcx, rsi
call fcn.1400523d0
mov rcx, rbx
call fcn.1400e6a28
mov rbx, qword [rsp + 0x1c8]
mov eax, edi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400e6b50
add rsp, 0x190
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f50d0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, qword [rsp + 0x98]
mov rdi, rdx
mov rsi, rcx
mov rbx, r8
lea r8, [rdx + 2]
movabs rcx, 0xaaaaaaaaaaaaaaab
mov rax, rcx
mul r8
mov eax, dword [rsp + 0x90]
shr rdx, 1
mov r15d, eax
mov dword [r14], 0
lea rbp, [rdx*4]
test eax, eax
je 0x1400f5147
dec eax
xor edx, edx
add rax, rbp
div r15
lea rbp, [rbp + rax*2]
add rbp, 0xfffffffffffffffe
test rbx, rbx
je 0x1400f5299
cmp r9, rbp
jae 0x1400f5163
mov dword [r14], 1
xor eax, eax
jmp 0x1400f529c
xor r10d, r10d
lea r11, [rbx + r9]
cmp rdi, 3
jb 0x1400f5220
mov rax, rcx
mov qword [rsp + 0x70], r13
mul rdi
lea r13, [0x14028e960]
shr rdx, 1
imul rax, rdx, 0xfffffffffffffffd
add rdi, rax
movzx ecx, byte [rsi]
add r10, 4
movzx r8d, byte [rsi + 1]
mov eax, ecx
movzx r9d, byte [rsi + 2]
and cl, 3
shr rax, 2
add rsi, 3
shl cl, 4
movzx eax, byte [rax + r13]
mov byte [rbx], al
movzx eax, r8b
shr al, 4
and r8b, 0xf
add al, cl
shl r8b, 2
movzx eax, al
movzx eax, byte [rax + r13]
mov byte [rbx + 1], al
movzx eax, r9b
shr al, 6
add al, r8b
movzx eax, al
movzx eax, byte [rax + r13]
mov byte [rbx + 2], al
mov eax, r9d
and eax, 0x3f
movzx eax, byte [rax + r13]
mov byte [rbx + 3], al
add rbx, 4
cmp r10, r15
jne 0x1400f5211
cmp rbx, r11
je 0x1400f5211
mov word [rbx], 0xa0d
add rbx, 2
xor r10d, r10d
sub rdx, 1
jne 0x1400f5190
mov r13, qword [rsp + 0x70]
test rdi, rdi
je 0x1400f5299
xor eax, eax
test rdi, rdi
je 0x1400f5245
mov r8, rdi
lea rcx, [rsp + 0x30]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rdi
cmp rdi, 3
jae 0x1400f5259
cmp rax, 3
jae 0x1400f52bd
mov byte [rsp + rax + 0x30], 0
inc rax
cmp rax, 3
jb 0x1400f524b
mov esi, 3
mov qword [rsp + 0x28], r14
mov edx, esi
mov dword [rsp + 0x20], 0
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1400f50d0
lea rcx, [rdi + 1]
add rcx, rbx
cmp rdi, rsi
jae 0x1400f5299
sub rsi, rdi
mov dl, 0x3d
mov r8, rsi
call sub.VCRUNTIME140.dll_memset
mov rax, rbp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400e6b50
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400e6cac
int3
Function at 0x1400f7340
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
cmp byte [0x1403773a0], 0
jne 0x1400f7538
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xor ebx, ebx
mov edi, ebx
mov qword [rbp + 7], rbx
mov dword [rbp + 0xf], ebx
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], rbx
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [str.SoftwareApple_Inc.Preferences.GlobalPreferences]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400f73c3
mov eax, ebx
mov rdi, qword [rbp + 0x1f]
mov qword [rbp + 7], rdi
mov dword [rbp + 0xf], ebx
test eax, eax
jne 0x1400f7419
mov dword [rbp + 0x27], ebx
mov dword [rbp + 0x2b], 4
lea rax, [rbp + 0x2b]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1f]
xor r8d, r8d
lea rdx, [0x14028f460]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400f7419
cmp dword [rbp + 0x1f], 4
jne 0x1400f7419
cmp dword [rbp + 0x27], eax
setne al
mov byte [0x1403773a1], al
mov byte [0x1403773a0], 1
jmp 0x1400f7464
cmp byte [0x1403773a0], 0
jne 0x1400f745d
lea rcx, str..GlobalPreferences
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov rbx, rax
lea rcx, str.AKEnvSwitchingEnabled
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.CoreFoundation.dll_CFPreferencesGetAppBooleanValue]
mov byte [0x1403773a1], al
mov byte [0x1403773a0], 1
jmp 0x1400f7464
movzx eax, byte [0x1403773a1]
movzx ebx, al
lea rcx, str.Env_switching_enabled:__d
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov r9d, ebx
mov r8, rax
mov edx, 7
lea rcx, [rbp + 0x2f]
call fcn.1400eb780
nop
cmp qword [rbp + 0x3f], 0
je 0x1400f74e6
call fcn.1400ea5e0
cmp dword [rax + 0x98], 7
jl 0x1400f74e6
call fcn.1400ea5e0
lea rcx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rcx, qword [rbp + 0x2f]
mov qword [rsp + 0x30], rcx
lea rcx, [0x140273b24]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x13f
lea r9, str.D:BWA2C8BCE7B_BF89_0iCloudAuthKitWin_253_srcrootAuthKitWinConfigInfo.cpp
lea r8, str.IsEnvSwitchingEnabled
mov edx, 7
mov rcx, rax
call fcn.1400eaaa0
nop
mov rdx, qword [rbp + 0x47]
cmp rdx, 8
jb 0x1400f752a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f7524
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f7524
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e6a28
nop
test rdi, rdi
je 0x1400f7538
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [0x1403773a1]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400f7bb0
Capabilities:
Hash data with md5
Initialize hashing via wincrypt
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400f7be6
cmp dword [rcx], 0x48617368
jne 0x1400f7be6
test rdx, rdx
je 0x1400f7be6
call qword [rcx + reloc.OLEAUT32.dll_SafeArrayGetDim]
cmp dword [rbx], 0x48617368
jne 0x1400f7be6
mov edx, dword [rbx + 4]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400f7d60
mov eax, 0xfffffffe
add rsp, 0x20
pop rbx
ret

Function at 0x1400f7d60
Capabilities:
Create new key via cryptacquirecontext
Hash data with md5
Initialize hashing via wincrypt
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x20], rbx
mov qword [rcx + 0x28], rbx
mov qword [rcx + 0x30], rbx
mov dword [rcx], 0x48617368
mov dword [rcx + 4], edx
cmp edx, 1
je 0x1400f7da4
lea rcx, str.InitHashContext__:_Invalid_hash_algorithm
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [rbx - 2]
add rsp, 0x30
pop rbx
ret
lea rax, [0x1400f7eb0]
mov qword [rsp + 0x40], rsi
mov qword [rcx + 8], rax
lea rsi, [rcx + 0x30]
lea rax, [0x1400f7e30]
mov qword [rsp + 0x48], rdi
mov qword [rcx + 0x10], rax
lea rdi, [rcx + 0x28]
lea rax, [0x1400f7f30]
mov dword [rsp + 0x20], 0xf0000020
mov qword [rcx + 0x18], rax
mov r9d, 1
mov rcx, rdi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_security_cryptoapi_l1_1_0.dll_CryptAcquireContextW]
test eax, eax
je 0x1400f7e14
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov edx, 0x8003
call qword [sym.imp.api_ms_win_security_cryptoapi_l1_1_0.dll_CryptCreateHash]
test eax, eax
jne 0x1400f7e1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rsi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
Function at 0x1400f7f50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov rsi, rcx
mov ebx, 0xffffffd5
test rcx, rcx
je 0x1400f8021
test rdx, rdx
je 0x1400f8021
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rbp
xor ebp, ebp
mov qword [rsp + 0x20], rax
mov qword [rcx], rbp
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400f801c
mov rcx, qword [rsp + 0x30]
lea rdx, str.ProductId
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x1400f8011
mov ecx, dword [rdi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [rsp + 0x30]
lea rdx, str.ProductId
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsi], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
cmove ebx, ebp
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400e6b50
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret