joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020f4c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov r8d, 4
lea rdx, str.Path
mov rsi, rcx
call fcn.140014c40
xor r14d, r14d
mov rdi, rax
test rax, rax
jne 0x140020f99
mov eax, 0x80004005
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov r8d, 5
lea rdx, str.Csidl
mov rcx, rsi
call fcn.140014c40
test rax, rax
jne 0x140021011
mov rax, qword [rdi + 8]
test rax, rax
je 0x140020fc2
mov rcx, qword [rdi + 0x18]
jmp 0x140020fc5
mov rcx, r14
test rax, rax
lea rdx, [0x140063614]
mov r8d, ecx
lea rcx, [rsp + 0x50]
cmovne rdx, rax
call fcn.14001d36c
mov rdx, rax
mov rcx, rbx
call fcn.14001a3e0
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002100a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
jmp 0x140020f86
cmp qword [rax + 8], r14
lea rsi, [0x140063614]
mov rcx, rsi
cmovne rcx, qword [rax + 8]
xor edx, edx
lea r8d, [rdx + 0xa]
call qword [sym.imp.msvcrt.dll_strtol]
mov rdx, qword [rbx]
mov r8d, 1
mov ebp, eax
mov eax, 0x104
mov ecx, dword [rdx - 0xc]
sub r8d, dword [rdx - 8]
sub ecx, eax
or r8d, ecx
jge 0x14002105b
mov edx, eax
mov rcx, rbx
call fcn.1400020a8
mov rdx, qword [rbx]
xor r9d, r9d
mov r8d, ebp
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x140021078
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140020f86
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140021085
mov eax, r14d
jmp 0x140021092
movsxd rdx, dword [rcx - 0xc]
call fcn.1400462c0
test eax, eax
js 0x1400210e6
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1400210e6
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], r14w
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400210b7
mov rax, qword [rdi + 0x18]
jmp 0x1400210ba
mov rax, r14
test rcx, rcx
mov r8d, eax
cmovne rsi, rcx
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.14001d36c
mov rcx, rbx
mov rdx, qword [rax]
call fcn.14001b0b0
mov rdx, qword [rsp + 0x58]
jmp 0x140020ff0
mov ecx, 0x80070057
call fcn.140002198
int3
Function at 0x1400211ec
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov r8d, 0xc
lea rdx, str.Architecture
mov rbx, rcx
call fcn.140014c40
mov rsi, rax
test rax, rax
jne 0x140021220
or eax, 0xffffffff
jmp 0x1400212d5
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp qword [rsi + 8], 0
lea rdi, [0x140063614]
mov rcx, rdi
cmovne rcx, qword [rsi + 8]
mov esi, 0xa
mov r8d, esi
xor edx, edx
call qword [sym.imp.msvcrt.dll_strtol]
movzx ecx, word [rsp + 0x20]
cmp eax, ecx
jne 0x1400212d3
lea r8d, [rsi - 2]
mov rcx, rbx
lea rdx, str.Revision
call fcn.140014c40
test rax, rax
je 0x140021291
cmp qword [rax + 8], 0
mov rcx, rdi
mov r8d, esi
cmovne rcx, qword [rax + 8]
xor edx, edx
call qword [sym.imp.msvcrt.dll_strtol]
movzx ecx, word [rsp + 0x4e]
cmp eax, ecx
jne 0x1400212d3
mov r8d, 5
lea rdx, str.Level
mov rcx, rbx
call fcn.140014c40
test rax, rax
je 0x1400212cc
cmp qword [rax + 8], 0
mov r8d, esi
cmovne rdi, qword [rax + 8]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_strtol]
movzx ecx, word [rsp + 0x4c]
cmp eax, ecx
jne 0x1400212d3
mov eax, 1
jmp 0x1400212d5
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14002327c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
and qword [rax - 0x28], 0
lea r8, [rax - 0x28]
mov rbp, rdx
call fcn.140022e54
mov esi, 1
cmp eax, esi
jne 0x140023405
and dword [rsp + 0x70], 0
lea r8d, [rsi + 4]
lea rdx, str.Value
mov rcx, rbp
call fcn.140014c40
test rax, rax
je 0x140023403
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400232dd
mov rdx, qword [rax + 0x18]
jmp 0x1400232df
xor edx, edx
test rdx, rdx
je 0x140023403
test rcx, rcx
je 0x1400232f3
mov r8, qword [rax + 0x18]
jmp 0x1400232f6
xor r8d, r8d
test rcx, rcx
lea rdi, [0x140063614]
mov rdx, rdi
cmovne rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.14001d36c
lea rcx, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rax]
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, qword [rsp + 0x38]
mov r14d, eax
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x14002335d
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test r14d, r14d
je 0x140023369
xor eax, eax
jmp 0x140023405
mov r8d, 4
lea rdx, str.Type
mov rcx, rbp
call fcn.140014c40
test rax, rax
je 0x140023407
cmp qword [rax + 8], 0
cmovne rdi, qword [rax + 8]
mov eax, dword [rsp + 0x78]
sub eax, esi
je 0x1400233fa
sub eax, esi
je 0x1400233f1
sub eax, esi
je 0x1400233e8
sub eax, esi
je 0x1400233df
sub eax, 3
je 0x1400233d6
sub eax, 2
je 0x1400233bd
cmp eax, 2
jne 0x140023409
lea rdx, str.REG_QWORD
jmp 0x1400233c4
lea rdx, str.REG_FULL_RESOURCE_DESCRIPTOR
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
xor ebx, ebx
test eax, eax
sete bl
jmp 0x140023409
lea rdx, str.REG_MULTI_SZ
jmp 0x1400233c4
lea rdx, str.REG_DWORD
jmp 0x1400233c4
lea rdx, str.REG_BINARY
jmp 0x1400233c4
lea rdx, str.REG_EXPAND_SZ
jmp 0x1400233c4
lea rdx, str.REG_SZ
jmp 0x1400233c4
mov eax, esi
mov esi, eax
mov ebx, esi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140023419
call qword [0x140057c38]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140023430
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
and qword [rbp - 0x18], 0
lea r8, [rbp - 0x18]
mov rdi, rdx
call fcn.140022e54
mov ebx, eax
cmp eax, 1
jne 0x14002357e
lea r8d, [rax + 4]
mov rcx, rdi
lea rdx, str.Value
call fcn.140014c40
test rax, rax
jne 0x140023481
or ebx, 0xffffffff
jmp 0x14002357e
and dword [rbp + 0x30], 0
mov dword [rbp + 0x38], 4
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14002349b
mov r8, qword [rax + 0x18]
jmp 0x14002349e
xor r8d, r8d
test rcx, rcx
lea r14, [0x140063614]
mov rdx, r14
cmovne rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.14001d36c
lea rcx, [rbp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rbp - 0x20]
lea rcx, [rbp + 0x30]
mov rdx, qword [rax]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, qword [rbp - 0x10]
test eax, eax
sete sil
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140023505
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test sil, sil
je 0x140023514
cmp dword [rbp - 0x20], 4
je 0x140023514
xor ebx, ebx
jmp 0x14002357e
mov r8d, 0xa
lea rdx, str.Comparison
mov rcx, rdi
call fcn.140014c40
mov rsi, rax
test rax, rax
je 0x14002357e
mov r8d, 4
lea rdx, str.Data
mov rcx, rdi
call fcn.140014c40
test rax, rax
je 0x14002357e
cmp qword [rax + 8], 0
mov rcx, r14
cmovne rcx, qword [rax + 8]
cmp qword [rsi + 8], 0
cmovne r14, qword [rsi + 8]
xor edx, edx
lea r8d, [rdx + 0xa]
call qword [sym.imp.msvcrt.dll_strtoul]
mov edx, dword [rbp + 0x30]
mov rcx, r14
mov r8d, eax
call fcn.1400231b8
mov ebx, eax
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14002358d
call qword [0x140057c38]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
Function at 0x140023c24
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rdx
call fcn.1400241a0
mov edi, 1
cmp eax, edi
jne 0x140023c53
xor eax, eax
jmp 0x140023de2
xor ebp, ebp
test eax, eax
jne 0x140023ddf
lea r8d, [rbp + 8]
mov rcx, rbx
lea rdx, str.Language
call fcn.140014c40
test rax, rax
je 0x140023ddf
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140023c88
mov r8, qword [rax + 0x18]
jmp 0x140023c8b
mov r8, rbp
test rcx, rcx
lea rdx, [0x140063614]
cmovne rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.14001d36c
call fcn.140001b5c
mov rcx, rax
test rax, rax
je 0x140023e00
mov rax, qword [rax]
call qword [rax + 0x18]
mov ecx, edi
mov esi, 0x55
lea rbx, [rax + 0x18]
mov eax, dword [rbx - 0xc]
sub ecx, dword [rbx - 8]
sub eax, esi
or ecx, eax
mov qword [rsp + 0x40], rbx
jge 0x140023ce7
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.1400020a8
mov rbx, qword [rsp + 0x40]
mov r9d, esi
mov r8, rbx
mov edx, 0x59
mov ecx, 0x800
mov r14, rbx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400462c0
test eax, eax
js 0x140023df5
cmp eax, dword [rbx - 0xc]
jg 0x140023df5
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], bp
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x140023d9e
mov edx, 0x2d
lea rcx, [rsp + 0x40]
call fcn.14001a668
mov rbx, qword [rsp + 0x40]
mov edx, 0x5a
mov ecx, 0x800
movsxd rax, dword [rbx - 0x10]
sub esi, dword [rbx - 0x10]
mov r9d, esi
lea r8, [r14 + rax*2]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400462c0
test eax, eax
js 0x140023df5
cmp eax, dword [rbx - 0xc]
jg 0x140023df5
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], bp
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
mov edi, ebp
sete dil
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140023dbb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x50]
mov ecx, ebx
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x140023ddb
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, edi
jmp 0x140023de2
or eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80070057
call fcn.140002198
int3
mov ecx, 0x80004005
call fcn.140002198
int3
Function at 0x140029a00
Capabilities:
Create new key via cryptacquirecontext
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xf8
mov rax, qword [0x14006f5c0]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor r15d, r15d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rdi, rdx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], r15
mov qword [rbp - 0x79], rax
lea rdx, [rbp - 0x29]
movups xmm0, xmmword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], r15
mov qword [rbp - 0x71], rax
mov rbx, rcx
movsd xmm1, qword [rbp - 0x71]
lea rax, fcn.140031bf0
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x69]
lea rax, [rbp - 0x69]
movsd qword [rbp - 0x51], xmm1
mov qword [rbp - 0x31], rax
mov r14d, r9d
mov rsi, r8
mov qword [rbp + 0xf], r15
movups xmmword [rbp - 0x61], xmm0
call fcn.140031bf0
mov rcx, qword [rbp - 0x31]
mov qword [rbp + 0xf], rax
test rcx, rcx
je 0x140029aac
mov rax, qword [rcx]
lea rdx, [rbp - 0x69]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140029b3b
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [0x1400637e0]
xor r9d, r9d
mov dword [rsp + 0x20], 0x41
mov r8d, DllRegisterServer
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x140029b3b
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8004
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140029b3b
mov r8d, dword [rdi]
xor r9d, r9d
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x140029b5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
je 0x140029b56
test eax, 0xffff0000
jne 0x140029b88
or ebx, 0x80070000
jmp 0x140029b88
mov ebx, 0x80004005
jmp 0x140029b88
mov r9, qword [rsp + 0x38]
mov r8d, r14d
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
test eax, eax
mov ebx, 0x80070241
cmovne ebx, r15d
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x140029bcf
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x140029bb1
mov r8, qword [rcx]
lea rax, [rbp - 0x29]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
mov eax, ebx
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400408d0
add rsp, 0xf8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400398f8
int3
Function at 0x14002cdf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x14006f5c0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov ebx, 1
xor eax, eax
lock cmpxchg qword [0x140071cb0], rbx
lea rdi, [0x140071cc0]
cmp rax, 2
je 0x14002cf5a
cmp rax, rbx
jne 0x14002ce58
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lock cmpxchg qword [0x140071cb0], rbx
cmp rax, 2
jne 0x14002ce35
jmp 0x14002cf5a
test rax, rax
jne 0x14002cf5a
lea rax, [rsp + 0x38]
xor esi, esi
mov r9d, ebx
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360Safe.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002cf4e
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x14005ce40]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0x204
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002cf43
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
test eax, eax
je 0x14002cf3c
mov edx, 0x200
mov rcx, rdi
call fcn.1400462c0
test rax, rax
je 0x14002cf43
lea rcx, [rax + rax]
nop word [rax + rax]
movzx edx, word [rcx + rdi - 2]
sub rcx, 2
dec rax
cmp dx, 0x5c
je 0x14002cf28
cmp dx, 0x2f
jne 0x14002cf43
cmp rcx, 0x400
jae 0x14002cf82
mov word [rcx + rdi], si
test rax, rax
jne 0x14002cf10
jmp 0x14002cf43
mov word [0x140071cc0], si
mov rcx, qword [rsp + 0x38]
call qword [0x140057c38]
mov ecx, 2
xchg qword [0x140071cb0], rcx
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400408d0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.140040d58
int3
Function at 0x140038314
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
cmp dword [rcx + 0x118], 6
jae 0x140038456
xor edi, edi
cmp qword [0x14006fed0], rdi
jne 0x14003844d
bt qword [0x140057b80], 0
lea rdx, str.NtOpenKeyedEvent
lea rcx, [0x14006f078]
call fcn.1400389c8
mov rbx, rax
test rax, rax
jne 0x14003837f
xor r9d, r9d
lea edx, [rdi + 1]
xor r8d, r8d
mov ecx, 0xc0000264
call qword [sym.imp.KERNEL32.dll_RaiseException]
or rcx, 0xffffffffffffffff
lea r9, str.KernelObjectsCritSecOutOfMemoryEvent
mov rax, r9
mov rdx, rdi
lea r8d, [rcx + 3]
cmp word [rax], di
je 0x1400383a5
inc rdx
add rax, r8
sub rcx, 1
jne 0x140038394
lea rcx, [rdx + rdx]
mov qword [rsp + 0x28], r9
mov edx, 0xffff
mov dword [rsp + 0x30], 0x30
cmp rcx, rdx
mov qword [rsp + 0x38], rdi
movzx eax, cx
cmova ax, dx
mov word [rsp + 0x20], ax
lea rax, [rcx + 2]
add cx, r8w
lea r8, [rsp + 0x30]
cmp rax, rdx
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
cmova cx, dx
xor eax, eax
mov word [rsp + 0x22], cx
mov edx, 0x2000000
movaps xmm0, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x70]
movdqa xmmword [rsp + 0x20], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
call rbx
test eax, eax
jns 0x140038431
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xc0000264
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov rcx, qword [rsp + 0x70]
xor eax, eax
lock cmpxchg qword [0x14006fed0], rcx
je 0x14003844d
mov rcx, qword [rsp + 0x70]
call fcn.140037368
mov rax, qword [0x14006fed0]
jmp 0x140038458
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140038a94
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x240
xor r12d, r12d
mov r15d, r8d
xor eax, eax
mov rbx, rdx
mov rsi, rcx
lock cmpxchg qword [rcx], r12
je 0x140038afb
or rdi, 0xffffffffffffffff
cmp rax, rdi
jne 0x140038ada
xor eax, eax
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
or rdi, 0xffffffffffffffff
mov qword [rbp + 0x188], r12
test r15b, 1
je 0x140038b1a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jmp 0x140038c5f
bt qword [0x140057bc8], 0
lea rdx, str.LoadLibraryExW
lea rcx, [0x14006f0c0]
call fcn.1400389c8
mov r14, rax
test rax, rax
je 0x140038ad8
mov r13d, 2
test r13b, r15b
je 0x140038b51
mov r8d, r13d
jmp 0x140038c57
test r15b, 4
je 0x140038b5f
xor r8d, r8d
jmp 0x140038c57
bt qword [0x140057ba0], 0
lea rdx, str.AddDllDirectory
lea rcx, [0x14006f098]
call fcn.1400389c8
test rax, rax
jne 0x140038c51
bt qword [0x140057b98], 0
lea rdx, str.LdrLoadDll
lea rcx, [0x14006f090]
call fcn.1400389c8
mov r15, rax
test rax, rax
je 0x140038ad8
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x140038b57
mov rdx, rdi
mov rax, rbx
mov rcx, r12
test rbx, rbx
je 0x140038bf7
cmp word [rax], r12w
je 0x140038bf7
inc rcx
add rax, r13
sub rdx, 1
jne 0x140038be5
add rcx, rcx
mov qword [rsp + 0x28], rbx
movzx eax, cx
lea r9, [rbp + 0x188]
mov edx, 0xffff
lea r8, [rsp + 0x20]
cmp rcx, rdx
cmova ax, dx
mov word [rsp + 0x20], ax
lea rax, [rcx + 2]
add cx, r13w
cmp rax, rdx
cmova cx, dx
xor edx, edx
mov word [rsp + 0x22], cx
lea rcx, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call r15
mov rax, qword [rbp + 0x188]
jmp 0x140038c66
mov r8d, 0x800
xor edx, edx
mov rcx, rbx
call r14
mov qword [rbp + 0x188], rax
test rax, rax
jne 0x140038c73
xchg qword [rsi], rdi
jmp 0x140038ad8
xchg qword [rsi], rax
test rax, rax
je 0x140038c88
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rbp + 0x188]
jmp 0x140038ada

Function at 0x14003b4d4
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x40
xor ebx, ebx
mov qword [rax - 0x10], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x28], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x14003b540
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov r9, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x38
ret
Function at 0x14003b570
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov r9, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x38
ret

Function at 0x14003b9e4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rsi, r8
xor r9d, r9d
xor r8d, r8d
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003ba4d
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003ba4d
cmp ebx, dword [rsp + 0x48]
je 0x14003ba46
xor edx, edx
lea r9, [0x140063614]
xor ecx, ecx
lea r8d, [rdx + 1]
call fcn.14003af84
jmp 0x14003ba64
mov eax, 1
jmp 0x14003ba66
lea r9, [0x140063614]
xor edx, edx
lea r8, [0x140063614]
xor ecx, ecx
call fcn.14003b02c
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14003c518
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rcx + 8]
lea rbx, [rcx + 0xcd4]
mov r12d, dword [rcx + 0xcc]
lea rdx, [rcx + 0xd4]
mov ebp, dword [rsp + 0xa0]
xor r10d, r10d
mov qword [rbx], rax
mov r13, r9
mov dword [rbx + 8], 4
mov rdi, rcx
mov dword [rbx + 0xc], ebp
mov dword [rbx + 0x10], 1
lea r14d, [r10 + 2]
mov eax, dword [rcx + 0xc]
mov qword [rbx + 0x18], rax
mov dword [rbx + 0x20], 8
mov dword [rbx + 0x24], ebp
mov dword [rbx + 0x28], r10d
test ebp, ebp
je 0x14003c5a2
mov eax, dword [rcx + 0x20]
lea r14d, [r10 + 3]
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x38], r10d
mov dword [rbx + 0x3c], ebp
mov dword [rbx + 0x40], r10d
jmp 0x14003c5e8
mov r9d, dword [rcx + 0x14]
test r12d, r12d
je 0x14003c5e8
mov r8, r12
mov eax, 0xf000
cmp word [rdx + 8], ax
jne 0x14003c5de
mov eax, r14d
lea rcx, [rax + rax*2]
mov eax, dword [rdx]
add rax, r9
mov qword [rbx + rcx*8], rax
mov eax, dword [rdx + 4]
add eax, 7
mov qword [rbx + rcx*8 + 0xc], r10
and eax, 0xfffffff8
mov dword [rbx + rcx*8 + 8], eax
inc r14d
add rdx, 0xc
sub r8, 1
jne 0x14003c5ae
lea r15d, [r14 + r14*2]
shl r15d, 3
mov ecx, r15d
call fcn.14003b398
mov rsi, rax
test rax, rax
jne 0x14003c61c
lea r9, [0x140063614]
xor edx, edx
lea r8, [0x140063614]
xor ecx, ecx
call fcn.14003b02c
jmp 0x14003c6c3
mov r8d, r15d
mov rdx, rbx
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov r15, qword [rsp + 0x90]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov r9, r15
and qword [rsp + 0x30], 0
mov r8d, r14d
and qword [rsp + 0x28], 0
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r13
call fcn.14003bfa4
test eax, eax
je 0x14003c6bb
test ebp, ebp
jne 0x14003c6dd
test r12d, r12d
jne 0x14003c6dd
mov rcx, qword [rsp + 0x80]
lea rax, [rcx + 7]
cqo
and edx, 7
lea rdi, [rdx + rax]
and edi, 0xfffffff8
sub edi, ecx
je 0x14003c6dd
mov r8d, edi
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
mov r8d, edi
mov rdx, rbx
mov rcx, r13
call r15
test eax, eax
jne 0x14003c6dd
lea r9, [0x140063614]
xor edx, edx
xor ecx, ecx
lea r8d, [rbp + 0x11]
call fcn.14003af84
mov rcx, rsi
call fcn.14003b3dc
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call fcn.14003b3dc
mov eax, 1
jmp 0x14003c6c5

Function at 0x14003ce40
Capabilities:
Get file size

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14003ce65
lea r8, [0x140063614]
xor edx, edx
mov r9, r8
xor ecx, ecx
call fcn.14003b02c
xor eax, eax
jmp 0x14003ce6a
mov eax, 1
add rsp, 0x28
ret