joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ff60
Capabilities:
Shutdown system

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, dword [0x140149370]
lea rdx, str.Reboot:_Restarting_windows...
movsd xmm0, qword [str.sfxsh]
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x21], eax
mov dword [rbp + 0x27], 0x31373531
mov dword [rbp + 0x2b], 0x38303934
mov rax, qword [rbp + 0x27]
mov qword [rbp - 0x1d], rax
movsd qword [rbp - 0x29], xmm0
mov dword [rbp - 0x15], 0xeb
call fcn.140031960
mov qword [rbp + 0x17], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea r9, [rbp + 0x17]
mov rcx, rax
lea edx, [r8 + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x140030005
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x17]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140030115
lea r8, [rbp + 0x27]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14003010b
mov rax, qword [rbp + 0x27]
lea r8, [rbp + 0x37]
mov rcx, qword [rbp + 0x17]
mov r9d, 0x10
mov qword [rsp + 0x28], 0
xor edx, edx
mov qword [rbp + 0x3b], rax
mov dword [rbp + 0x37], 1
mov dword [rbp + 0x43], 2
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14003010b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
je 0x14003010b
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov dword [rsp + 0x28], 0x80040002
xor r8d, r8d
mov dword [rsp + 0x20], 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
test eax, eax
jne 0x140030151
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsd xmm0, qword [str.sfxsh]
lea r9, [rbp - 9]
mov dword [rbp - 9], eax
lea r8, [rbp - 0x29]
mov eax, dword [0x140149370]
lea rdx, [rbp - 1]
mov dword [rbp + 7], eax
mov dword [rbp - 0x29], 0x31373531
mov dword [rbp - 0x25], 0x38303934
mov rax, qword [rbp - 0x29]
mov qword [rbp + 0xb], rax
lea rax, str.Reboot:_InitiateSystemShutdownEx_returned_0x:08X
mov qword [rbp - 0x29], rax
movsd qword [rbp - 1], xmm0
mov dword [rbp + 0x13], 0x10c
mov qword [rbp - 0x21], 0x32
call fcn.140031e30
jmp 0x140030151
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x140149370]
lea rdx, [rbp - 1]
movsd xmm0, qword [str.sfxsh]
mov dword [rbp + 7], eax
mov dword [rbp - 0x29], 0x31373531
mov dword [rbp - 0x25], 0x38303934
mov rax, qword [rbp - 0x29]
mov qword [rbp + 0xb], rax
movsd qword [rbp - 1], xmm0
mov dword [rbp + 0x13], 0x111
call fcn.140031f80
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0xb0
pop rbp
ret
Function at 0x140030170
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, qword [rsp + 0x60]
mov ebp, 1
mov r8d, ebp
xor edx, edx
xor ecx, ecx
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140030200
lea r8d, [rbp + 3]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1400301f7
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400301ee
cmp dword [rsp + 0x24], 4
movzx ebx, bl
cmove ebx, ebp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b89f0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400334d0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rbx, qword [rsp + 0x30]
lea rax, vtable.ProgressAnimator.0
xor edi, edi
mov qword [rbx], rax
cmp qword [rbx + 0x60], rdi
je 0x140033545
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x140033512
xor r9d, r9d
lea edx, [rdi + 0x10]
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostMessageW]
mov qword [rbx + 0x70], rdi
mov rcx, qword [rbx + 0x60]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140033537
mov rcx, qword [rbx + 0x60]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x60], rdi
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x140033563
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x1400a96cf.0]
mov qword [rbx + 0x78], rdi
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140033580
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rdi
lea rcx, [rbx + 0x38]
call fcn.14000c080
lea rcx, [rbx + 0x18]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14000c080

Function at 0x140033c20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x50]
xor ecx, ecx
mov dword [rsp + 0x30], ecx
cmp qword [rbx + 0x60], rcx
jne 0x140033c9c
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x1400339b0]
xor edx, edx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x60], rax
test rax, rax
je 0x140033c9c
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140033c87
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x40
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x40
pop rbx
ret
Function at 0x140035850
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov r14d, ebx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov r15d, 0x3ff
movzx ebp, ax
and ax, r15w
cmp ax, 0x1a
jne 0x14003589d
movzx eax, bp
shr ax, 0xa
cmp ax, 0xc
ja 0x14003589d
mov ecx, 0x1ecc
bt ecx, eax
jae 0x14003589d
mov ebp, 0x81a
mov qword [rsp + 0x40], rsi
mov edi, ebx
call fcn.14004cb70
test eax, eax
je 0x1400358e7
nop dword [rax]
call fcn.14004caf0
mov rcx, qword [rax]
mov eax, edi
lea rsi, [rax + rax*4]
shl rsi, 4
cmp bp, word [rsi + rcx + 0x44]
je 0x1400358d6
inc edi
call fcn.14004cb70
cmp edi, eax
jb 0x1400358b0
jmp 0x1400358e7
call fcn.14004caf0
mov r14, qword [rax]
add r14, rsi
jne 0x140035964
and bp, r15w
mov edi, ebx
call fcn.14004cb70
test eax, eax
je 0x140035930
call fcn.14004caf0
mov rcx, qword [rax]
mov eax, edi
lea rsi, [rax + rax*4]
shl rsi, 4
movzx eax, word [rsi + rcx + 0x44]
and ax, r15w
cmp bp, ax
je 0x140035923
inc edi
call fcn.14004cb70
cmp edi, eax
jb 0x1400358f6
jmp 0x140035930
call fcn.14004caf0
mov r14, qword [rax]
add r14, rsi
jne 0x140035964
call fcn.14004cb70
test eax, eax
je 0x140035964
mov esi, 0x409
nop
call fcn.14004caf0
mov rcx, qword [rax]
mov eax, ebx
lea rdi, [rax + rax*4]
shl rdi, 4
cmp word [rdi + rcx + 0x44], si
je 0x140035980
inc ebx
call fcn.14004cb70
cmp ebx, eax
jb 0x140035940
mov rax, r14
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
call fcn.14004caf0
mov rax, qword [rax]
add rax, rdi
jmp 0x140035967
Function at 0x14003f310
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, qword [rbp + 0x67]
mov qword [rbp + 7], rbx
mov rdi, qword [rbp + 0x6f]
xor esi, esi
mov dword [rbp - 0x29], esi
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov dword [rbp - 0x29], 1
mov qword [rbp + 0x17], rsi
lea rdx, [rbp + 0x17]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003f43d
cmp dword [rbp + 0x1b], esi
jne 0x14003f417
mov edx, dword [rbp + 0x17]
mov rcx, rbx
call fcn.1400271e0
mov dword [rbp + 0xf], esi
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
movups xmmword [rbp + 0x2f], xmm0
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xf]
mov r8d, dword [rbp + 0x17]
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003f3ee
mov edx, dword [rbp + 0xf]
mov rcx, rbx
call fcn.1400271e0
mov rax, rbx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400b89f0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, str.get_file_content:_ReadFile
lea rcx, [rbp - 0x21]
call fcn.1400aa6a0
lea rdx, [0x140172368]
lea rcx, [rbp - 0x21]
call fcn.1400bb9a0
int3
lea r8, str.get_file_content
mov edx, 0xdf
lea rcx, [rbp - 0x21]
call fcn.1400aa6a0
lea rdx, [0x140172368]
lea rcx, [rbp - 0x21]
call fcn.1400bb9a0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, str.get_file_content:_GetFileSizeEx
lea rcx, [rbp - 0x21]
call fcn.1400aa6a0
lea rdx, [0x140172368]
lea rcx, [rbp - 0x21]
call fcn.1400bb9a0
int3
Function at 0x140042a80
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov dword [rax - 0x28], ebx
mov rsi, r8
mov rdi, rdx
sub rsi, rdx
xorps xmm0, xmm0
mov r14, rcx
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], 0xf
mov byte [rcx], bl
mov dword [rax - 0x28], 1
lea rcx, [rsi + 2]
movabs rax, 0x5555555555555556
imul rcx
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, 4
mul rdx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
xor r8d, r8d
mov rdx, rax
mov rcx, r14
call fcn.140026140
mov r9, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x140042b10
mov r9, qword [r14]
lea r10, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp rsi, 3
jl 0x140042bae
movabs rax, 0xaaaaaaaaaaaaaaab
mul rsi
shr rdx, 1
imul rax, rdx, 0xfffffffffffffffd
add rsi, rax
nop dword [rax + rax]
movzx r8d, byte [rdi]
movzx eax, byte [rdi + 1]
movzx ecx, byte [rdi + 2]
add rdi, 3
shl r8, 8
or r8, rax
shl r8, 8
or r8, rcx
mov rax, r8
shr rax, 0x12
movzx eax, byte [rax + r10]
mov byte [r9 + rbx], al
mov rax, r8
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [r9 + rbx + 1], al
mov rax, r8
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [r9 + rbx + 2], al
and r8d, 0x3f
movzx eax, byte [r8 + r10]
mov byte [r9 + rbx + 3], al
add rbx, 4
sub rdx, 1
jne 0x140042b40
cmp rsi, 2
jne 0x140042c12
movzx edx, byte [rdi]
shl rdx, 8
movzx eax, byte [rdi + 1]
or rdx, rax
shl rdx, 8
mov rax, rdx
shr rax, 0x12
movzx eax, byte [rax + r10]
mov byte [r9 + rbx], al
mov rcx, rdx
shr rcx, 0xc
and ecx, 0x3f
movzx ecx, byte [rcx + r10]
mov byte [r9 + rbx + 1], cl
shr rdx, 6
and edx, 0x3f
movzx ecx, byte [rdx + r10]
mov byte [r9 + rbx + 2], cl
mov byte [r9 + rbx + 3], 0x3d
mov rax, r14
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
cmp rsi, 1
jne 0x140042c48
movzx ecx, byte [rdi]
shl rcx, 0x10
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + r10]
mov byte [r9 + rbx], al
shr rcx, 0xc
and ecx, 0x3f
movzx eax, byte [rcx + r10]
mov byte [r9 + rbx + 1], al
mov word [r9 + rbx + 2], 0x3d3d
mov rax, r14
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140046560
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
mov r14, r8
mov r15, r9
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdi, [rcx + 0x68]
mov qword [r11 - 0x50], rdi
mov byte [r11 - 0x48], r12b
mov rcx, rdi
call fcn.1400b7f4c
test eax, eax
jne 0x1400466e4
cmp dword [rdi + 0x4c], 0x7fffffff
je 0x1400466ef
mov byte [rsp + 0x50], 1
lea ecx, [rax + 0x60]
call fcn.1400b8a40
mov rbx, rax
mov rdx, r15
mov rcx, rax
call fcn.1400ac220
xorps xmm0, xmm0
movups xmmword [rbx + 0x28], xmm0
mov qword [rbx + 0x38], r12
mov qword [rbx + 0x40], r12
movups xmm0, xmmword [r14]
movups xmmword [rbx + 0x28], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbx + 0x38], xmm1
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], 0xf
mov byte [r14], r12b
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rax]
mov qword [rbx + 0x48], rcx
mov qword [rbx + 0x50], rsi
lea rax, [0x140046890]
mov qword [rbx + 0x58], rax
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rbx
lea r8, [0x140047b30]
xor edx, edx
xor ecx, ecx
call fcn.1400ca7a8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400466d4
mov rdx, qword [rsi + 0xc0]
cmp rdx, qword [rsi + 0xc8]
je 0x140046691
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rdx], xmm1
add qword [rsi + 0xc0], 0x10
jmp 0x1400466a3
lea r8, [rsp + 0x30]
lea rcx, [rsi + 0xb8]
call fcn.140026d40
nop
cmp dword [rsp + 0x38], 0
jne 0x1400466ce
mov rcx, rdi
call fcn.1400b7f70
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400c8abc
nop
mov dword [rsp + 0x38], r12d
mov ecx, 6
call fcn.1400b78c0
nop
mov ecx, 5
call fcn.1400b78c0
int3
dec dword [rdi + 0x4c]
mov ecx, 6
call fcn.1400b78c0
int3
Function at 0x140046700
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
mov r14, r8
mov r15, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdi, [rcx + 0x68]
mov qword [r11 - 0x50], rdi
mov byte [rsp + 0x50], 0
mov rcx, rdi
call fcn.1400b7f4c
test eax, eax
jne 0x140046868
cmp dword [rdi + 0x4c], 0x7fffffff
je 0x140046873
mov byte [rsp + 0x50], 1
lea ecx, [rax + 0x60]
call fcn.1400b8a40
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rdx, r15
mov rcx, rax
call fcn.1400ac260
nop
lea rcx, [rbx + 0x28]
mov rdx, r14
call fcn.140027c60
nop
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rax]
mov qword [rbx + 0x48], rcx
mov qword [rbx + 0x50], rsi
lea rax, [0x140046890]
mov qword [rbx + 0x58], rax
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x140047b30]
xor edx, edx
xor ecx, ecx
call fcn.1400ca7a8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140046855
mov rdx, qword [rsi + 0xc0]
cmp rdx, qword [rsi + 0xc8]
je 0x140046814
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rdx], xmm1
add qword [rsi + 0xc0], 0x10
jmp 0x140046826
lea r8, [rsp + 0x30]
lea rcx, [rsi + 0xb8]
call fcn.140026d40
nop
cmp dword [rsp + 0x38], 0
jne 0x14004684f
mov rcx, rdi
call fcn.1400b7f70
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400c8abc
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.1400b78c0
nop
mov ecx, 5
call fcn.1400b78c0
int3
dec dword [rdi + 0x4c]
mov ecx, 6
call fcn.1400b78c0
int3
Function at 0x140059dd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r14, rdx
mov rsi, r8
mov r8d, 1
lea rdx, [rsp + 0x30]
call fcn.1400a52d0
mov rcx, rax
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0xc0], xmm0
mov dword [rsp + 0xb0], 0
mov dword [rsp + 0xb4], 8
lea rax, str.Cannot_query_registry_value
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
movq rdx, xmm0
mov qword [rsp + 0x50], rdx
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm1
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.1400a3280
mov rdi, qword [rsp + 0xc0]
mov ebx, dword [rsp + 0xb0]
cmp byte [rsp + 0x38], 0
jne 0x140059ed4
xor ecx, ecx
mov qword [rsp + 0x30], rcx
jmp 0x140059ed9
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140059ef0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140059ef0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x30], 0
cmp ebx, 0xb
jne 0x140059f2b
mov qword [rsi], rdi
mov al, 1
jmp 0x140059f07
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400b89f0
mov rbx, qword [rsp + 0x118]
add rsp, 0xe0
pop r14
pop rdi
pop rsi
ret
mov ecx, ebx
call fcn.1400a4dd0
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x40], xmm0
lea r9, [rsp + 0x40]
mov r8d, eax
mov edx, 0xb
lea rcx, [rsp + 0x80]
call fcn.1400a4e70
lea rdx, [0x1401727b8]
lea rcx, [rsp + 0x80]
call fcn.1400bb9a0
int3
Function at 0x140063e10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
test r14, r14
jg 0x140063e46
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rbx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140063ecd
mov rdi, r14
nop word [rax + rax]
mov rcx, rbx
call fcn.140051f80
test rax, rax
jle 0x140063e9e
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400fe670
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140063ebd
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1400a96cf.0]
cmp eax, 0xffffffff
je 0x140063ec5
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140063e60
sub r14, rdi
jmp 0x140063faf
mov rax, qword [rbx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140063ee4
mov rax, qword [rbx + 0x50]
mov ecx, dword [rax]
jmp 0x140063ee6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140063f18
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400fe670
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140063fac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140063f53
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140063f8d
nop dword [rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400d7318
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140063fac
cmp rbp, rax
ja 0x140063f60
test rbp, rbp
je 0x140063fac
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400d7318
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x1400668b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
sub rsp, 8
mov rsi, qword [rsp + 0x30]
xor ecx, ecx
mov ebx, ecx
mov r11d, ecx
mov r10, qword [rsi]
mov rdx, r10
cmp r10, 0x40
jb 0x140066a15
mov r9, qword [rsp + 0x28]
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140066a15
mov qword [rsp], rdi
movsxd rdi, dword [r9 + 0x3c]
test edi, edi
js 0x140066a11
mov eax, edi
cmp rdx, rax
jb 0x140066a11
sub rdx, rdi
lea r8, [rdi + r9]
cmp rdx, 4
jb 0x140066a11
cmp dword [r8], 0x4550
jne 0x140066a11
sub rdx, 4
cmp rdx, 0x14
jb 0x140066a11
movzx eax, word [r8 + 4]
sub rdx, 0x14
mov qword [rsp + 0x38], rbp
mov ebp, 0x14c
cmp ax, bp
jne 0x140066984
cmp rdx, 0xe0
jb 0x140066a0c
mov eax, 0x10b
cmp word [r8 + 0x18], ax
jne 0x140066a0c
mov r11d, dword [r8 + 0x9c]
lea edx, [rax - 0x73]
mov eax, dword [r8 + 0x98]
jmp 0x1400669c0
mov ebp, 0x8664
cmp ax, bp
je 0x140066998
mov ebp, 0xaa64
cmp ax, bp
jne 0x140066a0c
cmp rdx, 0xf0
jb 0x140066a0c
mov eax, 0x20b
cmp word [r8 + 0x18], ax
jne 0x140066a0c
mov eax, dword [r8 + 0xa8]
mov edx, 0xa8
mov r11d, dword [r8 + 0xac]
mov r8d, r11d
lea r11d, [rdi + rdx]
add edi, 0x58
mov ebx, edi
lea rdx, [rax + r8]
cmp rdx, r10
ja 0x140066a0c
cmp rdx, rax
jb 0x140066a0c
test rax, rax
jne 0x1400669e6
test r8, r8
cmove rax, r10
dec rax
nop dword [rax]
cmp rax, r10
jae 0x140066a06
cmp byte [rax + r9], 0
jne 0x140066a06
inc ecx
dec rax
cmp ecx, 8
jl 0x1400669f0
inc rax
mov qword [rsi], rax
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp]
mov rax, qword [rsp + 0x20]
mov dword [rax], ebx
mov dword [rax + 4], r11d
add rsp, 8
pop rsi
pop rbx
ret
Function at 0x140068270
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, qword [rbp + 0x67]
lea rdx, [rbp - 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400683b3
mov rbx, qword [rbp - 1]
test rbx, rbx
jne 0x1400682e3
xor al, al
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400b89f0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
mov rdx, rdi
lea rcx, [rbp + 7]
call fcn.140068b50
nop
test rbx, rbx
js 0x14006838c
cmp byte [rbp + 0x2f], 0
je 0x14006836b
mov rdx, rbx
mov rcx, qword [rbp + 0x37]
call fcn.140068180
movzx ebx, al
mov rcx, qword [rbp + 0x37]
test rcx, rcx
je 0x140068330
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x37], xmm0
mov byte [rbp + 0x2f], 0
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x14006834b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x17], 0
mov rcx, qword [rbp + 7]
cmp rcx, 0xffffffffffffffff
je 0x140068363
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
jmp 0x1400682c2
lea rdx, str.Unable_to_retrieve_pointer_of_the_unmapped_view_
lea rcx, [rbp - 0x29]
call fcn.1400aa660
lea rdx, [0x140172368]
lea rcx, [rbp - 0x29]
call fcn.1400bb9a0
int3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 0x29]
call fcn.14000e690
lea rdx, [0x140172048]
lea rcx, [rbp - 0x29]
call fcn.1400bb9a0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, str.Unable_to_get_file_size_
lea rcx, [rbp - 0x29]
call fcn.1400aa6a0
lea rdx, [0x140172368]
lea rcx, [rbp - 0x29]
call fcn.1400bb9a0
int3