joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001569
Capabilities:
Compute adler32 checksum

Disassembly:
jmp 0x1400088cc
jmp 0x1400087a8
mov r8d, r8d
jmp 0x1400010a5
mov r10d, ecx
movzx r9d, cx
shr r10d, 0x10
mov r11, rdx
cmp r8, 1
jne 0x140008910
movzx ecx, byte [rdx]
mov r8d, 0xfff1
add ecx, r9d
cmp ecx, r8d
lea edx, [rcx - 0xfff1]
cmovb edx, ecx
lea eax, [rdx + r10]
cmp eax, r8d
lea ecx, [rax - 0xfff1]
cmovb ecx, eax
shl ecx, 0x10
or ecx, edx
mov eax, ecx
ret
test rdx, rdx
jne 0x140008919
lea eax, [rdx + 1]
ret
cmp r8, 0x10
jae 0x140008962
test r8, r8
je 0x140008937
movzx eax, byte [r11]
inc r11
add r9d, eax
add r10d, r9d
sub r8, 1
jne 0x140008924
mov r8d, 0xfff1
lea ecx, [r9 - 0xfff1]
cmp r9d, r8d
mov eax, 0x80078071
cmovb ecx, r9d
mul r10d
shr edx, 0xf
imul eax, edx, 0xf
add eax, r10d
shl eax, 0x10
or eax, ecx
ret
cmp r8, 0x15b0
jb 0x140008a89
mov rcx, r8
movabs rax, 0x79baa6bb6398b6f7
mul r8
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xc
imul rax, rcx, 0xffffffffffffea50
add r8, rax
mov edx, 0x15b
movzx eax, byte [r11]
add r9d, eax
movzx eax, byte [r11 + 1]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 2]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 3]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 4]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 5]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 6]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 7]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 8]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 9]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 0xa]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 0xb]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 0xc]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 0xd]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 0xe]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 0xf]
add r10d, r9d
add r11, 0x10
add r9d, eax
add r10d, r9d
add edx, 0xffffffff
jne 0x14000899b
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul r10d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r10d, eax
sub rcx, 1
jne 0x140008996
test r8, r8
je 0x140008ba7
cmp r8, 0x10
jb 0x140008b67
mov rcx, r8
shr rcx, 4
imul rax, rcx, 0xfffffffffffffff0
add r8, rax
Function at 0x1400019d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
call fcn.14000196c
xor ecx, ecx
mov rdx, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_LoadResource]

Function at 0x140001af0
Capabilities:
Check mutex on windows

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
cmp qword [rcx + 8], 0
jne 0x140001be8
lea r8, [rcx + 0x10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
lea rcx, [rsp + 0x28]
cmp eax, 0xb7
jne 0x140001ba2
lea rdx, str.cant_create_mutex
call fcn.14000264c
nop
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x28]
call fcn.140002680
lea rcx, [rsp + 0x28]
call fcn.1400018c0
mov r8, rax
lea rdx, str.ERROR
mov rcx, qword [rbx + 0x210]
call fcn.140018920
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 8], 0
lea rcx, [rsp + 0x28]
call fcn.140001624
mov eax, 1
jmp 0x140001bea
lea rdx, str.Mutex_is_created
call fcn.14000264c
nop
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x28]
call fcn.140002680
lea rcx, [rsp + 0x28]
call fcn.1400018c0
mov r8, rax
lea rdx, str.INFO
mov rcx, qword [rbx + 0x210]
call fcn.140018920
nop
lea rcx, [rsp + 0x28]
call fcn.140001624
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005ba60
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400047a0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1450
call fcn.140068770
sub rsp, rax
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rsp + 0x1440], rax
mov rsi, qword [r9]
lea rax, [rsp + 0x34]
mov rbx, rdx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
movsxd rdi, r8d
mov rdx, rcx
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0x400
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004850
mov eax, dword [rsp + 0x30]
cmp eax, 1
je 0x140004818
cmp eax, 2
je 0x14000481d
cmp eax, 7
je 0x140004818
cmp eax, 3
jne 0x140004850
cmp eax, 2
jne 0x140004840
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea r8, [rsp + 0x440]
jmp 0x140004845
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call fcn.14005c0fc
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.14005ba60
add rsp, 0x1450
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004880
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, qword [rdx]
lea rax, [rsp + 0x34]
mov rdx, rcx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0x400
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400048f8
cmp dword [rsp + 0x38], 4
jne 0x1400048f8
mov edx, dword [rsp + 0x34]
lea r9d, [rax + 4]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14005cc5c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14005ba60
add rsp, 0x450
pop rbx
ret

Function at 0x140004920
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
or edi, 0xffffffff
xor ebx, ebx
mov rsi, r9
mov rbp, r8
test r9, r9
je 0x1400049ad
mov qword [r11 - 0x18], rbx
lea rax, [r11 + 0x20]
xor r9d, r9d
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400049ad
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
lea r9d, [rbx + 1]
xor r8d, r8d
not rcx
mov rdx, rbp
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
test edi, edi
sete al
add rsp, 0x50
pop rdi
ret
Function at 0x1400049d0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x50
mov rbx, rdx
xor edx, edx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edx
mov rdx, rcx
mov rcx, 0xffffffff80000002
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140004a4d
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov r9d, 4
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x50
pop rbx
ret

Function at 0x140004a60
Capabilities:
Get disk information
Get disk size

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
sub rsp, 0x860
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov r12, rdx
mov rbp, rcx
xor r13d, r13d
mov word [rcx], r13w
lea rdx, [rsp + 0x40]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, r13d
lea rbx, [rsp + 0x40]
cmp word [rsp + 0x42], si
je 0x140004b68
mov qword [rsp + 0x858], r14
mov qword [rsp + 0x850], r15
mov qword [rsp + 0x8a0], rdi
nop dword [rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x140004b35
movzx eax, word [rbx]
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x3a], 0x5c003a
mov word [rsp + 0x38], ax
mov word [rsp + 0x3e], r13w
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x140004b35
mov rdi, qword [rsp + 0x20]
shr rdi, 0x14
cmp edi, esi
jbe 0x140004b35
mov r8, rbx
mov edx, 8
mov rcx, rbp
mov esi, edi
call fcn.14005c0fc
mov dword [r12], edi
add rbx, 2
cmp word [rbx], r13w
jne 0x140004b35
add rbx, 2
cmp word [rbx], r13w
je 0x140004b50
cmp word [rbx + 2], r13w
jne 0x140004ad0
mov rdi, qword [rsp + 0x8a0]
mov r14, qword [rsp + 0x858]
mov r15, qword [rsp + 0x850]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14005ba60
add rsp, 0x860
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret

Function at 0x140004b90
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
test r8, r8
je 0x140004c05
mov ecx, 0x800
call fcn.14005ba80
lea rdx, str.xecute_process_NO_WAIT__cmd:___s___param:___s_
lea rcx, [0x140088420]
mov rbx, rax
call fcn.140007130
mov r9, rbp
mov edx, 0x400
mov rcx, rbx
mov r8, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea rdx, str.INFO
mov r8, rbx
mov rcx, rdi
call fcn.140018920
mov rcx, rbx
call fcn.14005ba88
lea rdx, [0x140088428]
lea rcx, [0x140088430]
call fcn.140007130
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r9, rsi
mov r8, rbp
mov rdx, rbx
mov rcx, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140004c60
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x280
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r12, qword [rsp + 0x2d0]
mov ebx, edx
mov edx, 0x68
mov r13, rcx
lea ecx, [rdx - 0x28]
mov rdi, r9
mov rsi, r8
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [rsp + 0x50], 0xfffffffb
xor r14d, r14d
mov ecx, 0xa
test ebx, ebx
cmovne cx, r14w
lea rdx, str.xecute_process__WAIT_cmd:
mov rbp, rax
mov word [rax + 0x40], cx
lea rcx, [0x140088420]
mov dword [rax], 0x68
mov dword [rax + 0x3c], 0x101
mov qword [rax + 0x58], rdi
mov qword [rax + 0x60], rdi
mov qword [rax + 0x50], rsi
call fcn.140007130
lea rdx, str.INFO
mov r8, rax
mov rcx, r12
call fcn.140018920
lea rdx, str.INFO
mov r8, r13
mov rcx, r12
call fcn.140018920
lea r11, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov rdx, r13
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140004df2
mov ecx, reloc.OLEAUT32.dll_SetErrorInfo
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, str.nd_waiting_process_:
lea rcx, [0x140088420]
call fcn.140007130
lea rdx, str.INFO
mov rcx, r12
mov r8, rax
call fcn.140018920
lea rdx, str.INFO
mov r8, r13
mov rcx, r12
call fcn.140018920
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140004ddf
cmp dword [rsp + 0x50], 0x103
jne 0x140004de7
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x50], 0xfffffffc
jmp 0x140004de7
mov dword [rsp + 0x50], 0xfffffffe
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x140004e3d
lea rdx, str.xit_code_is__d
lea rcx, [0x140088420]
call fcn.140007130
mov r9d, dword [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov r8, rax
mov edx, 0x100
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea r8, [rsp + 0x70]
lea rdx, str.INFO
mov rcx, r12
call fcn.140018920
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14005ba60
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140004e70
Capabilities:
Create pipe
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x60
xor eax, eax
mov rbx, r8
mov rsi, rdx
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov rdi, rcx
lea r8, [r11 - 0x28]
lea rdx, [r11 - 0x30]
lea rcx, [r11 - 0x38]
xor r9d, r9d
mov dword [rsp + 0x40], 0x18
mov dword [rsp + 0x50], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov edx, 1
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call fcn.140004c60
xor edx, edx
mov r8d, 0x100
mov rcx, rsi
mov ebx, eax
call fcn.140062200
test ebx, ebx
jne 0x140004f13
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x88]
mov r8d, 0x100
mov rdx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x140005090
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x1050
call fcn.140068770
sub rsp, rax
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
mov rbx, rcx
lea edx, [r9 + 0x1a]
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000264c
mov rax, rbx
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14005ba60
add rsp, 0x1050
pop rbx
ret

Function at 0x140005110
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x1050
call fcn.140068770
sub rsp, rax
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea rax, [rsp + 0x40]
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000264c
mov rax, rbx
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14005ba60
add rsp, 0x1050
pop rbx
ret

Function at 0x140005180
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x1050
call fcn.140068770
sub rsp, rax
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
mov rbx, rcx
lea edx, [r9 + 0xb]
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000264c
mov rax, rbx
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14005ba60
add rsp, 0x1050
pop rbx
ret
Function at 0x140005200
Capabilities:
Get common file path
Get program files directory

Disassembly:
push rbx
mov eax, 0x1050
call fcn.140068770
sub rsp, rax
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
mov rbx, rcx
lea edx, [r9 + 0x26]
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000264c
mov rax, rbx
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14005ba60
add rsp, 0x1050
pop rbx
ret

Function at 0x140005280
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2450
call fcn.140068770
sub rsp, rax
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rsp + 0x2440], rax
mov rbx, rcx
lea rdx, str.ersonal
lea rcx, [0x1400884f8]
xor esi, esi
mov dword [rsp + 0x30], esi
call fcn.140007130
lea rdx, str.OFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea rcx, [0x140088580]
mov rdi, rax
call fcn.140007130
lea rcx, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov rdx, rax
mov word [rsp + 0x440], si
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400053a7
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x34], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000539c
mov eax, dword [rsp + 0x30]
cmp eax, 1
je 0x14000535d
cmp eax, 2
je 0x140005362
cmp eax, 7
je 0x14000535d
cmp eax, 3
jne 0x14000539c
cmp eax, 2
jne 0x140005385
lea rdx, [rsp + 0x1440]
lea rcx, [rsp + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea r8, [rsp + 0x1440]
jmp 0x14000538a
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x440]
mov edx, 0x800
call fcn.14005c0fc
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x440]
mov rcx, rbx
call fcn.14000264c
mov rax, rbx
mov rcx, qword [rsp + 0x2440]
xor rcx, rsp
call fcn.14005ba60
lea r11, [rsp + 0x2450]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400053e0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor esi, esi
mov rdi, rdx
xor r9d, r9d
mov qword [rdx], rsi
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005482
lea rdx, [rsp + 0x60]
mov rcx, rax
mov qword [rsp + 0x60], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140005479
mov rcx, qword [rsp + 0x60]
inc rcx
call fcn.14005ba80
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov rdx, rax
mov rcx, rbx
mov qword [rdi], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11, qword [rdi]
mov rax, qword [rsp + 0x60]
mov byte [rax + r11], sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140005550
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x180
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x110
xor dil, dil
mov dword [rsp + 0x40], 0x114
call fcn.140062200
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebp, ebp
cmp dword [rsp + 0x50], 2
mov qword [rsp + 0x38], rbp
je 0x1400055b5
mov dil, 1
jmp 0x1400056e6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400056e6
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
lea rax, [rsp + 0x30]
lea edx, [r9 + 2]
xor r8d, r8d
mov dword [rsp + 0x160], 0x201
mov dword [rsp + 0x164], 0x5000000
mov dword [rsp + 0x168], 0x20
mov dword [rsp + 0x16c], 0x220
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400056e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400056e6
mov edx, dword [rsp + 0x30]
lea ecx, [rax - 0x3a]
mov qword [rsp + 0x190], rbx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1400056de
mov r9d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov r8, rbx
mov edx, 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400056d5
cmp dword [rbx], ebp
jbe 0x1400056d5
mov qword [rsp + 0x198], rsi
mov qword [rsp + 0x1a0], r12
mov r12d, 1
lea rsi, [rbx + 8]
nop dword [rax]
mov rcx, qword [rsi]
lea rdx, [rsp + 0x160]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
movzx edi, dil
test eax, eax
cmovne edi, r12d
inc ebp
add rsi, 0x10
cmp ebp, dword [rbx]
jb 0x1400056a0
mov r12, qword [rsp + 0x1a0]
mov rsi, qword [rsp + 0x198]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14005ba60
mov rbp, qword [rsp + 0x1a8]
add rsp, 0x180
pop rdi
ret
Function at 0x140005720
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1030
call fcn.140068770
sub rsp, rax
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rdi, rdx
lea rdx, [0x1400885bc]
call fcn.14005c7a8
mov rbx, rax
test rax, rax
je 0x14000577b
lea rdx, [0x1400885c4]
mov rcx, rdi
call fcn.14005c7a8
mov rdi, rax
test rax, rax
jne 0x14000577f
mov rcx, rbx
call fcn.14005d16c
xor al, al
jmp 0x1400057e4
lea rcx, [rsp + 0x20]
mov r9, rbx
mov edx, 1
mov r8d, 0x1000
call fcn.14005cc3c
test rax, rax
je 0x1400057d2
nop dword [rax]
lea rcx, [rsp + 0x20]
mov r9, rdi
mov r8, rax
mov edx, 1
call fcn.14005ce70
lea rcx, [rsp + 0x20]
mov r9, rbx
mov edx, 1
mov r8d, 0x1000
call fcn.14005cc3c
test rax, rax
jne 0x1400057a0
mov rcx, rbx
call fcn.14005d16c
mov rcx, rdi
call fcn.14005d16c
mov al, 1
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14005ba60
mov rbx, qword [rsp + 0x1050]
add rsp, 0x1030
pop rdi
ret