joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1600eb8dc
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov ecx, dword [0x160270d84]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x1600eba53
lea rcx, [0x160273d70]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop
cmp qword [0x1602744f8], rdi
jne 0x1600eb954
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
lea r8d, [rsi + 8]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov qword [0x1602744f8], rax
lea ebx, [rsi + 1]
test rax, rax
je 0x1600eba00
xor eax, eax
mov dword [0x160274c28], eax
mov dword [0x160274c30], ebx
jmp 0x1600eb9aa
mov eax, dword [0x160274c28]
mov ecx, dword [0x160274c30]
cmp eax, ecx
jne 0x1600eb9a5
lea ebx, [rcx + 1]
shl rbx, 3
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
mov r9, rbx
mov r8, qword [0x1602744f8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
mov ebx, 1
test rax, rax
je 0x1600eba00
mov qword [0x1602744f8], rax
add dword [0x160274c30], ebx
mov eax, dword [0x160274c28]
jmp 0x1600eb9aa
mov ebx, 1
mov ecx, eax
mov rax, qword [0x1602744f8]
and qword [rax + rcx*8], 0
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x8018
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov rdi, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1600eba00
add rax, 0x18
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], 0x8000
mov rdx, rdi
mov ecx, dword [0x160270d84]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
test eax, eax
cmovne esi, ebx
test esi, esi
je 0x1600eba1f
mov edx, dword [0x160274c28]
mov rax, qword [0x1602744f8]
mov qword [rax + rdx*8], rdi
add edx, ebx
mov dword [0x160274c28], edx
jmp 0x1600eba43
xor edx, edx
mov ecx, dword [0x160270d84]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edi, edi
lea rcx, [0x160273d70]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1600ebde8
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x160270d88]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
test rax, rax
je 0x1600ebe24
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1600ebe24
mov rax, qword [rax]
mov rdx, qword [rax + rcx*8 - 8]
test rdx, rdx
je 0x1600ebe24
cmp qword [rdx], 0
lea rax, [0x1601da1a0]
cmovne rax, qword [rdx]
jmp 0x1600ebe2b
lea rax, [0x1601da1a0]
add rsp, 0x28
ret
Function at 0x1600ebe30
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x160270d88]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
test rax, rax
je 0x1600ebe83
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1600ebe83
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 - 8]
test rax, rax
je 0x1600ebe83
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1600ebe83
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + rcx*8 - 8]
test rdx, rdx
je 0x1600ebe83
cmp qword [rdx], 0
lea rax, [0x1601da1a0]
cmovne rax, qword [rdx]
jmp 0x1600ebe8a
lea rax, [0x1601da1a0]
add rsp, 0x28
ret
Function at 0x1600ee4f8
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x248
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [0x160274cb8], 0
jne 0x1600ee755
cmp dword [0x1602710a8], 0
mov dword [0x160274cb8], 1
mov dword [0x160274c80], ecx
je 0x1600ee556
and dword [0x1602710a8], 0
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersion]
xor ecx, ecx
cmp eax, 0x80000000
setb cl
mov dword [0x160274ca0], ecx
jmp 0x1600ee55c
mov ecx, dword [0x160274ca0]
lea rax, [0x160069ae0]
mov qword [0x160274c78], rax
test ecx, ecx
je 0x1600ee608
lea rax, [0x1600ede00]
mov qword [0x160274c40], rax
lea rcx, str.kernel32
lea rax, [0x1600ee170]
mov qword [0x160274cc8], rax
lea rax, [0x1600edfa0]
mov qword [0x160274c88], rax
lea rax, [0x1600ee300]
mov qword [0x160274c70], rax
lea rax, [0x1600ee3c0]
mov qword [0x160274c50], rax
lea rax, [0x1600edd00]
mov qword [0x160274c48], rax
lea rax, [0x1600ee2b0]
mov qword [0x160274c68], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x1600ee66a
lea rdx, str.AddVectoredExceptionHandler
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test rax, rax
je 0x1600ee66a
mov qword [0x160274c78], rax
jmp 0x1600ee66a
lea rax, [0x1600edd10]
mov qword [0x160274c40], rax
lea rax, [0x1600ee050]
mov qword [0x160274cc8], rax
lea rax, [0x1600ede90]
mov qword [0x160274c88], rax
lea rax, [0x1600ee300]
mov qword [0x160274c70], rax
lea rax, [0x1600ee310]
mov qword [0x160274c50], rax
lea rax, [0x1600edc20]
mov qword [0x160274c48], rax
lea rax, [0x1600ee230]
mov qword [0x160274c68], rax
lea rax, [0x1600ee3f0]
xor edx, edx
mov qword [0x160274c38], rax
lea rcx, [rsp + 0x20]
lea rax, [0x1600ee4d0]
mov r8d, 0x208
mov qword [0x160274cb0], rax
lea rax, [0x1600edc00]
mov qword [0x160274c58], rax
lea rax, [0x1600ee3d0]
mov qword [0x160274ca8], rax
lea rax, [0x1600ee4c0]
mov qword [0x160274cc0], rax
lea rax, [0x1600ee410]
mov qword [0x160274c98], rax
lea rax, [0x1600ee2f0]
mov qword [0x160274cd0], rax
lea rax, [0x1600ee4e0]
mov qword [0x160274c90], rax
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, str._windir__system32dbghelp.dll
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1600ee747
xor r8d, r8d
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
test rax, rax
jne 0x1600ee735
lea rax, [0x160069ae0]
xor ecx, ecx
mov qword [0x160274c60], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
jmp 0x1600ee755
lea rdx, [0x160200198]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
jmp 0x1600ee74e
lea rax, [0x160069ae0]
mov qword [0x160274c60], rax
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x248
ret
Function at 0x1600f0978
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov word [rbp - 0xc], 0x500
lea rax, [rbp - 0x18]
mov dword [rbp - 0x10], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov edi, ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov qword [rbp - 0x18], rbx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1600f0a17
mov rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
xor ecx, ecx
mov dword [rbp - 0x20], ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
test eax, eax
je 0x1600f0a03
mov ebx, dword [rbp - 0x20]
jmp 0x1600f0a0b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_FreeSid]
jmp 0x1600f0a1f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x1600f4970
Capabilities:
Copy file

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r10, r8
test r9d, r9d
mov rcx, rdx
mov rdx, r10
setne al
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_CopyFileExW]
add rsp, 0x38
ret

Function at 0x1600f4b60
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov eax, dword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
add rsp, 0x30
pop rbx
ret

Function at 0x1600f4e00
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov eax, dword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileStringW]
add rsp, 0x30
pop rbx
ret
Function at 0x1600f66cc
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x500
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rsi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0xd0]
mov r8d, 0x208
call sub.msvcrt.dll_memset
test rsi, rsi
je 0x1600f6918
test rbx, rbx
je 0x1600f6918
mov r8, rbx
lea rcx, [rsp + 0xd0]
mov edx, 0x104
call fcn.1600b2fdc
mov ebx, eax
test eax, eax
js 0x1600f691d
lea rcx, [rsp + 0xd0]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindFileNameW]
mov edx, 0x104
lea rcx, [rsp + 0x2e0]
mov r8, rax
call fcn.1600b2fdc
mov ebx, eax
test eax, eax
js 0x1600f691d
or rdi, 0xffffffffffffffff
lea rcx, [rsp + 0x2e0]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x1600f6778
cmp eax, 4
jl 0x1600f684d
cdqe
lea rdx, str..dll
lea rcx, [rsp + rax*2 + 0x2d8]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
jne 0x1600f684d
mov ecx, 0x104
lea rax, [rsp + 0x2e0]
cmp word [rax], 0
je 0x1600f67c7
add rax, 2
sub rcx, 1
jne 0x1600f67b7
xor r10d, r10d
mov ebx, 0x80070057
test rcx, rcx
mov eax, 0x104
mov r8d, r10d
cmovne ebx, r10d
sub rax, rcx
test rcx, rcx
cmovne r8, rax
je 0x1600f684d
mov ecx, 0x104
lea rdx, [rsp + 0x2e0]
lea rdx, [rdx + r8*2]
sub rcx, r8
je 0x1600f6835
lea rax, [r8 + 0x7ffffefa]
add rax, rcx
lea r8, str..mui
sub r8, rdx
test rax, rax
je 0x1600f6835
movzx r9d, word [r8 + rdx]
test r9w, r9w
je 0x1600f6835
mov word [rdx], r9w
dec rax
add rdx, 2
sub rcx, 1
jne 0x1600f6814
test rcx, rcx
lea rax, [rdx - 2]
mov ebx, 0x8007007a
cmovne rax, rdx
cmovne ebx, r10d
mov word [rax], r10w
test ebx, ebx
js 0x1600f691d
lea rcx, [rsp + 0xd0]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x1600f6871
mov ebx, 0x80004005
jmp 0x1600f691d
call qword [sym.imp.api_ms_win_core_localization_obsolete_l1_2_0.dll_GetUserDefaultUILanguage]
mov r9d, 0x55
movzx ecx, ax
lea r8, [rsp + 0x20]
lea edx, [r9 + 7]
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
test eax, eax
jne 0x1600f68a9
lea r8, str.en_us
lea edx, [rax + 0x55]
lea rcx, [rsp + 0x20]
call fcn.1600b2fdc
mov ebx, eax
test ebx, ebx
js 0x1600f691d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathAppendW]
test eax, eax
je 0x1600f6867
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathAppendW]
test eax, eax
je 0x1600f6867
lea rax, [rsp + 0xd0]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1600f68e6
inc edi
cmp edi, 0x104
jle 0x1600f6901
mov ebx, 0x800700ea
jmp 0x1600f691d
lea r8, [rsp + 0xd0]
mov edx, 0x104
mov rcx, rsi
call fcn.1600b2fdc
jmp 0x1600f691d
mov ebx, 0x80004003
mov eax, ebx
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1600f8e80
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x58]
mov ecx, dword [0x160271690]
mov r8d, 8
mov rdx, qword [rax + rcx*8]
mov eax, dword [r8 + rdx]
cmp dword [0x160273e30], eax
jle 0x1600f8ed7
lea rcx, [0x160273e30]
call fcn.16006e658
cmp dword [0x160273e30], 0xffffffff
jne 0x1600f8ed7
lea rcx, [0x160273e00]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemInfo]
lea rcx, [0x160273e30]
call fcn.16006e5ec
lea rax, [0x160273e00]
add rsp, 0x28
ret
Function at 0x160105820
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x58]
mov ecx, dword [0x160271690]
mov r8d, 8
mov rdx, qword [rax + rcx*8]
mov eax, dword [r8 + rdx]
cmp dword [0x160273e78], eax
jle 0x160105881
lea rcx, [0x160273e78]
call fcn.16006e658
cmp dword [0x160273e78], 0xffffffff
jne 0x160105881
lea rcx, [0x160273e40]
mov dword [0x160273e40], 0x38
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_GlobalMemoryStatus]
lea rcx, [0x160273e78]
call fcn.16006e5ec
lea rax, [0x160273e40]
add rsp, 0x28
ret
Function at 0x160108050
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
jne 0x1601080a3
and dword [rcx + 0x28], 0
lea rax, [rcx + 0x30]
mov r9, rcx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x160126310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1601080a3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x1601080a5
movzx eax, ax
or eax, 0x80070000
jmp 0x1601080a5
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x160114f70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
call fcn.1601159f4
mov ebx, eax
test eax, eax
js 0x16011503f
xor edx, edx
xor ecx, ecx
mov r9d, 0x1f0003
lea r8d, [rdx + 1]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventExW]
mov qword [rdi + 0x38], rax
test rax, rax
jne 0x160114fbd
call fcn.160069078
mov ebx, eax
test eax, eax
js 0x16011503f
lock inc dword [0x160274098]
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x16003fc5a.0]
lea rax, [rsp + 0x48]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x160117230]
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov rsi, rax
test rax, rax
je 0x160115003
xor ebx, ebx
jmp 0x16011500e
call fcn.160069078
mov ebx, eax
test eax, eax
js 0x160115019
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x16011503f
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x10]
call qword [case.0x16003fc5a.0]
mov rcx, qword [rdi + 0x48]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
and qword [rdi + 0x48], 0
lock dec dword [0x160274098]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x160117efc
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
jne 0x160117f4f
and dword [rcx + 0x28], 0
lea rax, [rcx + 0x30]
mov r9, rcx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x160117f60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x160117f4f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x160117f51
movzx eax, ax
or eax, 0x80070000
jmp 0x160117f51
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x160118374
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
jne 0x1601183c7
and dword [rcx + 0x28], 0
lea rax, [rcx + 0x30]
mov r9, rcx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x1600aa960]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1601183c7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x1601183c9
movzx eax, ax
or eax, 0x80070000
jmp 0x1601183c9
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x160124b70
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x250
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
mov rbx, rdx
movups xmm0, xmmword [str.file:___]
movaps xmmword [rsp + 0x30], xmm0
movzx eax, word [0x160204978]
mov word [rsp + 0x40], ax
xor edx, edx
mov r8d, 0x1f6
lea rcx, [rsp + 0x42]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x20], 0xfc
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x160124c04
mov rcx, qword [rsp + 0x258]
lea r8, str.onecoreuap_base_appmodel_search_search_searchgathergthrsvcusersettings.cxx
mov edx, 0x21b
call fcn.1600b29e0
jmp 0x160124c50
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAddBackslash]
mov ebx, eax
test eax, eax
jns 0x160124c3a
mov rcx, qword [rsp + 0x258]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_searchgathergthrsvcusersettings.cxx
mov edx, 0x21d
call fcn.1600b29f8
mov eax, ebx
jmp 0x160124c50
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.160026590
nop
xor eax, eax
jmp 0x160124c50
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret

Function at 0x160128fd4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x160270d20]
cmp ecx, 0xffffffff
jne 0x160128fed
xor eax, eax
jmp 0x16012903d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x160129009
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
je 0x160129009
mov bl, 1
jmp 0x16012900b
xor bl, bl
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x16012901d
movzx eax, ax
or eax, 0x80070000
test bl, bl
je 0x16012903a
mov rcx, qword [rsp + 0x28]
lea r8, str.onecoreuap_base_appmodel_searchcommonincludePerUserCatalogResetHelper.h
mov r9d, eax
mov edx, 0x45
call fcn.160071f6c
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x160129048
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x78], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
lea rax, [r11 - 0x50]
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], 0x17
xor edi, edi
mov word [rsp + 0x48], di
lea rax, [0x1601be168]
mov qword [r11 - 0x68], rax
xor edx, edx
lea rcx, [r11 - 0x68]
call fcn.160034ad4
mov r8, rax
mov edx, 0x1004
lea r9d, [rdi + 0x17]
mov ecx, dword [rbx + 0xc]
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.160034aac
cmp dword [rsp + 0x44], edi
je 0x1601290d5
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.msvcrt.dll__wtol]
mov edi, eax
lea rcx, [rsp + 0x30]
call fcn.16006c278
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x160141594
Capabilities:
Get disk size

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
sub rsp, 0x20
mov rcx, qword [rdx + 8]
lea r9, [rax + 0x10]
xor ebx, ebx
lea rdx, [rax + 8]
lea r8, [rax + 0x18]
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x1601415cd
lea eax, [rbx + 1]
jmp 0x1601415e1
mov ecx, dword [0x160272ce0]
shl rcx, 0x14
cmp qword [rsp + 0x30], rcx
setb bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x160156e2c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor ebx, ebx
mov rsi, rdx
and qword [rsp + 0x38], rbx
mov rdi, rcx
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
xor edx, edx
jmp 0x160156e9f
lea r8, [rsp + 0x50]
mov rdx, rdi
mov rcx, rsi
call fcn.160158a14
and qword [rsp + 0x38], 0
inc ebx
and qword [rsp + 0x30], 0
mov edx, ebx
and qword [rsp + 0x28], 0
mov rcx, rdi
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0x80
lea r8, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x160156e70
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x160156fbc
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x460]
sub rsp, 0x560
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0x450], rax
mov rsi, rdx
mov r14, rcx
xor edi, edi
lea rax, [rsp + 0x44]
mov dword [rsp + 0x48], 0x80
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x48]
lea rax, [rbp + 0x50]
mov dword [rsp + 0x44], 0x200
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x40]
mov edx, edi
mov qword [rsp + 0x28], rax
mov rcx, r14
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x160157085
cmp dword [rsp + 0x40], 1
mov bl, 1
jne 0x16015705a
lea r9, [rbp + 0x50]
lea r8, [rsp + 0x50]
mov rcx, rsi
call fcn.160158898
jmp 0x160157087
cmp dword [rsp + 0x40], 2
jne 0x160157087
mov r8d, 0x100
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x160157087
lea r9, [rbp + 0x250]
jmp 0x16015704b
xor bl, bl
inc edi
test bl, bl
jne 0x160156ff2
mov rcx, qword [rbp + 0x450]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret