joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002770
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140002798
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400027be
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400027c0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002819
test ecx, ecx
jle 0x1400027f9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002819
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002819
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140002840
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002862
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140002878
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002894
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002896
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400028d2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000296e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000290d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000294e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000296e
cmp rbx, rax
ja 0x140002920
test rbx, rbx
je 0x14000296e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140002dd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002dfd
xor eax, eax
jmp 0x140002f69
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002e37
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002e37
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002f69
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002f5c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002e7a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002ea5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002f61
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002f14
sub eax, 1
je 0x140002f14
cmp eax, 2
jne 0x140002f5c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002f61
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002f42
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002f5c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002f61
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003f00
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003530
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003603
cmp byte [rcx + 0x71], 0
je 0x140003603
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400035ff
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400035c4
sub eax, 1
je 0x1400035c8
cmp eax, 2
jne 0x1400035ff
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003f00
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400035f6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400035ff
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400035ac
xor al, al
jmp 0x1400035ac
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003f00
add rsp, 0x60
pop rbx
ret

Function at 0x14000494c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004996
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004996
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004996
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004996
cmp dword [rcx + 0x84], 0xe
jbe 0x140004996
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004998
xor al, al
add rsp, 0x28
ret
Function at 0x1400010be
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
cpuid
mov eax, 1
cpuid
movabs r9, 0xb2d05e00
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
fldpi
frndint
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, r9
jb 0x1400010e1
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0xffffffff9f345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x14000110c
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x140001105
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret
Function at 0x140005b10
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x90
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, rcx
mov ecx, 0x5000
call fcn.140015468
mov rdi, rax
mov ecx, 0x5000
call fcn.140015468
mov rbp, rax
xor edx, edx
mov r8d, 0x5000
mov rcx, rdi
call fcn.1400166f0
xor edx, edx
mov r8d, 0x5000
mov rcx, rbp
call fcn.1400166f0
mov esi, 1
lea rax, [0x140042700]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2800
mov r9, rdi
lea r8, [0x14002ce18]
lea rdx, str.Filter
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or r14, 0xffffffffffffffff
mov rax, r14
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140005bb0
test rax, rax
je 0x140005caa
mov rdx, rbx
lea rcx, str._nChecking_Filter__s
call fcn.14000adf0
mov r8, rdi
lea rdx, str.function_filter__WShell__new_ActiveXObject__WScript.Shell____nEnv__WShell.Environment__PROCESS____n_s_nfilter___
mov rcx, rbp
call fcn.140018028
lea rdx, str.JScript
lea rcx, [rsp + 0x70]
call fcn.1400048f0
nop
cmp dword [rsp + 0x88], 0
jne 0x140005c65
lea rcx, [rsp + 0x58]
call qword [0x14002c428]
lea rcx, [rsp + 0x58]
call qword [0x14002c420]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
xor ebx, ebx
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], 0x20
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
call qword [rax + 0x28]
mov dword [rsp + 0x88], eax
cmp r14w, word [rsp + 0x60]
je 0x140005c69
jmp 0x140005c67
xor ebx, ebx
mov esi, ebx
lea rax, [0x14002ce28]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140005c97
mov rax, qword [rcx]
call qword [rax + 0x38]
mov dword [rsp + 0x88], eax
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140005caa
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, rdi
call fcn.1400159b8
mov rcx, rbp
call fcn.1400159b8
mov eax, esi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140007380
Capabilities:
Query environment variable
Set registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2470]
mov eax, 0x2570
call fcn.140018cb0
sub rsp, rax
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x25a8], rbx

Function at 0x1400089a0
Capabilities:
Check if file exists
Create directory
Get file attributes
Write file on windows

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x23e0]
mov eax, 0x24e0
call fcn.140018cb0
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x2508], rbx
mov qword [rsp + 0x2510], rsi
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rbp + 0x23d0], rax
mov rbx, rcx
xor r14d, r14d
mov dword [rbp + 0x17d0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x17d4]
call fcn.1400166f0
mov dword [rbp + 0x19d0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x19d4]
call fcn.1400166f0
mov dword [rbp + 0x11d0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x11d4]
call fcn.1400166f0
mov dword [rbp + 0xdd0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0xdd4]
call fcn.1400166f0
mov dword [rbp + 0x1bd0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x1bd4]
call fcn.1400166f0
mov dword [rbp + 0xfd0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0xfd4]
call fcn.1400166f0
mov dword [rbp + 0x13d0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0x13d4]
call fcn.1400166f0
mov dword [rbp + 0xbd0], r14d
xor edx, edx
mov r8d, 0x1fc
lea rcx, [rbp + 0xbd4]
call fcn.1400166f0
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x68], r14
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x7d0]
call fcn.1400166f0
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x30]
call fcn.1400166f0
mov rcx, rbx
call fcn.140005b10
test eax, eax
je 0x1400097b5
mov dword [rsp + 0x30], 1
lea rdi, [0x140042700]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r9, [rbp - 0x30]
lea r8, [0x14002ce18]
lea rdx, str.RegFile
mov rcx, rbx
call fcn.14000db60
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r9, [rbp + 0x17d0]
lea r8, [0x14002ce18]
lea rdx, str.DisplayName
mov rcx, rbx
call fcn.14000db60
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r9, [rbp + 0x7d0]
lea r8, [0x14002ce18]
lea rdx, [0x140030880]
mov rcx, rbx
call fcn.14000db60
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r9, [rbp + 0x15d0]
lea r8, [0x14002ce18]
lea rdx, str.Default
mov rcx, rbx
call fcn.14000db60
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r9, [rbp + 0xbd0]
lea r8, [0x14002ce18]
lea rdx, str.SortIndex
Function at 0x140009d90
Capabilities:
Check if file exists
Get file attributes
Set registry value

Disassembly:
push rdi
sub rsp, 0x470
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x488], rbx
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rdi, rcx
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x50], rbx
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x60]
call fcn.1400166f0
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x260]
call fcn.1400166f0
mov rcx, rdi
call fcn.140005b10
test eax, eax
je 0x140009f8d
mov dword [rsp + 0x30], ebx
lea rbx, [0x140042700]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r9, [rsp + 0x60]
lea r8, [0x14002ce18]
lea rdx, str.OEMKey
mov rcx, rdi
call fcn.14000db60
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r9, [rsp + 0x260]
lea r8, [0x14002ce18]
lea rdx, str.TargetLink
mov rcx, rdi
call fcn.14000db60
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0x60]
lea rcx, str._nCreating_MFU__s_pointing_to__s
call fcn.14000adf0
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140009ea1
lea rcx, str._nError_:Creating_MFU__Target_Link_does_not_exists
jmp 0x140009f09
test al, 0x10
je 0x140009eae
lea rcx, str._nError_:Creating_MFU__Directory_cannot_be_set_as_MFU
jmp 0x140009f09
lea rdx, str.OEM0
lea rcx, [rsp + 0x60]
call fcn.140017124
test eax, eax
je 0x140009f18
lea rdx, str.OEM1
lea rcx, [rsp + 0x60]
call fcn.140017124
test eax, eax
je 0x140009f18
lea rdx, str.OEM2
lea rcx, [rsp + 0x60]
call fcn.140017124
test eax, eax
je 0x140009f18
lea rdx, str.OEM3
lea rcx, [rsp + 0x60]
call fcn.140017124
test eax, eax
je 0x140009f18
lea rcx, str._nError_:Creating_MFU__Invalid_OEM_Key
call fcn.14000adf0
mov dword [0x1400434f8], 1
mov r9d, 0x2001f
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionSMDEn
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.140010850
lea rcx, [rsp + 0x260]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009f42
inc eax
add eax, eax
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x140009f8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
test rbx, rbx
je 0x140009f9b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400161c0
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret
Function at 0x14000a3b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x470
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rcx
xor esi, esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x50], rsi
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x60]
call fcn.1400166f0
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x260]
call fcn.1400166f0
mov rcx, rbx
call fcn.140005b10
test eax, eax
je 0x14000a585
mov dword [rsp + 0x30], esi
lea rdi, [0x140042700]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r9, [rsp + 0x60]
lea r8, [0x14002ce18]
lea rdx, str.OEMKey
mov rcx, rbx
call fcn.14000db60
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r9, [rsp + 0x260]
lea r8, [0x14002ce18]
lea rdx, str.TargetLink
mov rcx, rbx
call fcn.14000db60
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0x60]
lea rcx, str._nCreating_MFU__s_pointing_to__s_in_C:HPHPQWareBTBHostMFU.ini
call fcn.14000adf0
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000a4c3
lea rcx, str._nError_:Creating_MFU__Target_Link_does_not_exists
jmp 0x14000a52b
test al, 0x10
je 0x14000a4d0
lea rcx, str._nError_:Creating_MFU__Directory_cannot_be_set_as_MFU
jmp 0x14000a52b
lea rdx, str.OEM0
lea rcx, [rsp + 0x60]
call fcn.140017124
test eax, eax
je 0x14000a53a
lea rdx, str.OEM1
lea rcx, [rsp + 0x60]
call fcn.140017124
test eax, eax
je 0x14000a53a
lea rdx, str.OEM2
lea rcx, [rsp + 0x60]
call fcn.140017124
test eax, eax
je 0x14000a53a
lea rdx, str.OEM3
lea rcx, [rsp + 0x60]
call fcn.140017124
test eax, eax
je 0x14000a53a
lea rcx, str._nError_:Creating_MFU__Invalid_OEM_Key
call fcn.14000adf0
mov dword [0x1400434f8], 1
mov dword [rsp + 0x20], esi
lea r9, str.C:HPHPQWareBTBHostMFU.ini
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0x60]
lea rcx, [0x1400304b0]
call fcn.1400135d0
test eax, eax
jne 0x14000a585
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0x60]
lea rcx, str._nError_Creating_MFU_Entry_key__s__link___s
call fcn.14000adf0
mov dword [0x1400434f8], 1
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400161c0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000ab50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x750]
sub rsp, 0x850
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rbp + 0x740], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x200
call fcn.1400166f0
lea rcx, [rbp + 0x540]
xor edx, edx
mov r8d, 0x200
call fcn.1400166f0
lea rcx, [rbp + 0x140]
xor edx, edx
mov r8d, 0x200
call fcn.1400166f0
lea rcx, [rbp + 0x340]
xor edx, edx
mov r8d, 0x200
call fcn.1400166f0
mov rcx, rbx
call fcn.140005b10
test eax, eax
je 0x14000adcf
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x868], rdi
lea rdi, [0x140042700]
lea r9, [rsp + 0x40]
lea r8, [0x14002ce18]
lea rdx, str.SBOEMKey
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], pe_nt_image_headers64
call fcn.14000db60
mov dword [rsp + 0x30], 0
lea r9, [rbp + 0x540]
lea r8, [0x14002ce18]
lea rdx, str.AppID
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], pe_nt_image_headers64
call fcn.14000db60
mov dword [rsp + 0x30], 1
lea r9, [rbp + 0x140]
lea r8, [0x14002ce18]
lea rdx, str.ShortCutPath
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], pe_nt_image_headers64
call fcn.14000db60
lea r8, [rbp + 0x140]
lea rdx, [rsp + 0x40]
lea rcx, str._nCreating_MFU__s_pointing_to__s_in_C:HPHPQWareBTBHostTaskbar.ini
call fcn.14000adf0
lea rdx, str.SBOEM0
lea rcx, [rsp + 0x40]
call fcn.140017124
mov rdi, qword [rsp + 0x868]
test eax, eax
je 0x14000ad09
lea rdx, str.SBOEM1
lea rcx, [rsp + 0x40]
call fcn.140017124
test eax, eax
je 0x14000ad09
lea rdx, str.SBOEM2
lea rcx, [rsp + 0x40]
call fcn.140017124
test eax, eax
je 0x14000ad09
lea rdx, str.SBOEM3
lea rcx, [rsp + 0x40]
call fcn.140017124
test eax, eax
je 0x14000ad09
lea rdx, [rsp + 0x40]
lea rcx, str._nError_:Creating_Taskbar__Invalid_SBOEM_Key___s
call fcn.14000adf0
mov dword [0x1400434f8], 1
lea rcx, [rbp + 0x540]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000ad14
test rax, rax
je 0x14000ad33
lea r8, [rbp + 0x540]
lea rdx, str.UWA___s
jmp 0x14000ad76
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000ad4e
lea rcx, str._nError_:Creating_Taskbar__Target_Link_does_not_exists
jmp 0x14000ad59
test al, 0x10
je 0x14000ad68
lea rcx, str._nError_:Creating_Taskbar__Directory_cannot_be_set_as_MFU
call fcn.14000adf0
mov dword [0x1400434f8], 1
lea r8, [rbp + 0x140]
lea rdx, str.LNK___s
lea rcx, [rbp + 0x340]
call fcn.1400048b0
lea r9, str.C:HPHPQWareBTBHostTaskbar.ini
lea r8, [rbp + 0x340]
lea rdx, [rsp + 0x40]
lea rcx, str.Taskbar
mov dword [rsp + 0x20], 0
call fcn.1400135d0
test eax, eax
jne 0x14000adcf
lea r8, [rbp + 0x340]
lea rdx, [rsp + 0x40]
lea rcx, str._nError_Creating_UWA_Taskbar_Entry_key__s__value___s
call fcn.14000adf0
mov dword [0x1400434f8], 1
mov rcx, qword [rbp + 0x740]
xor rcx, rsp
call fcn.1400161c0
mov rbx, qword [rsp + 0x870]
add rsp, 0x850
pop rbp
ret
Function at 0x14000d380
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
sub rsp, 0x4a0
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov r9, rdx
mov r8, rcx
lea rdx, [0x14002d6c8]
lea rcx, [rsp + 0x280]
call fcn.140018028
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000d4e3
mov qword [rsp + 0x4c0], rsi
mov qword [rsp + 0x4c8], rdi
lea rdi, [0x140040c10]
xor esi, esi
nop
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x270]
mov r8d, 3
mov qword [rsp + 0x270], rsi
call qword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea rcx, [rsp + 0x270]
call fcn.14000e220
test rax, rax
je 0x14000d4b4
or rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rdi + rcx*2], si
jne 0x14000d430
test rcx, rcx
jne 0x14000d463
mov rdx, rdi
mov dword [0x140041adc], 1
sub rdx, rax
nop
movzx ecx, word [rax]
lea rax, [rax + 2]
mov word [rdx + rax - 2], cx
test cx, cx
jne 0x14000d450
jmp 0x14000d4b4
inc dword [0x140041adc]
lea rdx, [rdi - 2]
nop dword [rax]
cmp word [rdx + 2], si
lea rdx, [rdx + 2]
jne 0x14000d470
mov ecx, dword [0x14002d35c]
mov dword [rdx], ecx
lea rdx, [rdi - 2]
cmp word [rdx + 2], si
lea rdx, [rdx + 2]
jne 0x14000d486
xor r8d, r8d
nop word [rax + rax]
movzx ecx, word [rax + r8*2]
lea r8, [r8 + 1]
mov word [rdx + r8*2 - 2], cx
test cx, cx
jne 0x14000d4a0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000d3f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0x4c8]
mov rsi, qword [rsp + 0x4c0]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1400161c0
add rsp, 0x4a0
pop rbx
ret

Function at 0x14000d680
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x14003f2f0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x200
call fcn.1400166f0
mov rcx, rbx
call fcn.140005b10
test eax, eax
je 0x14000d75d
lea rax, [0x140042700]
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, [0x14002ce18]
lea rdx, str.Source
mov rcx, rbx
mov dword [rsp + 0x20], pe_nt_image_headers64
call fcn.14000db60
lea rdx, [rsp + 0x40]
lea rcx, str._nExpanding_file_in_from__s
call fcn.14000adf0
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000d711
test rax, rax
jne 0x14000d72e
lea rcx, str._nSource_not_specified
call fcn.140017d0c
jmp 0x14000d75d
cmp word [rsp + rax*2 + 0x3e], 0x5c
jne 0x14000d73d
xor ecx, ecx
mov word [rsp + rax*2 + 0x3e], cx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x40]
test al, 0x10
je 0x14000d758
call fcn.14000d7f0
jmp 0x14000d75d
call fcn.14000d780
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400161c0
add rsp, 0x250
pop rbx
ret