joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005452c
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get startup folder

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x50], rdx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov word [rsp + 0x60], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call sub.msvcrt.dll_memset
mov qword [rsi + 0x20], 7
mov qword [rsi + 0x18], r12
lea rbx, [rsi + 8]
mov word [rbx], r12w
xor r8d, r8d
lea rdx, [0x100062c88]
mov rcx, rsi
call fcn.10001b608
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [r12 + 0x1a]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, r12d
je 0x1000546eb
xor eax, eax
or r13, 0xffffffffffffffff
mov rcx, r13
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.10001b608
lea rdx, str.Microsoft_
mov rcx, rsi
call fcn.100048e10
mov r9, r13
xor r8d, r8d
lea rdx, [rbp + 0x28]
mov rcx, rsi
call fcn.10004f198
lea rdx, [0x100065a74]
mov rcx, rsi
call fcn.100048e10
cmp qword [rsi + 0x20], 8
jb 0x100054634
mov rcx, qword [rbx]
jmp 0x100054637
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10005469a
cmp qword [rsi + 0x20], 8
jb 0x10005464e
mov rdx, qword [rbx]
jmp 0x100054651
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp eax, r12d
je 0x10005469a
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r12w
mov r9, r13
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.10001bb30
nop
cmp qword [rsp + 0x48], 8
jb 0x1000546eb
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_free
jmp 0x1000546eb
cmp qword [rbp + 0x48], 8
jb 0x1000546a7
mov rdx, qword [rbp + 0x30]
jmp 0x1000546ab
lea rdx, [rbp + 0x30]
cmp qword [rsi + 0x20], 8
jb 0x1000546b5
mov rbx, qword [rbx]
lea r9, [rsp + 0x270]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
xor r8d, r8d
lea rdx, [0x100062c88]
mov rcx, rsi
call fcn.10001b608
lea rdx, [rsp + 0x270]
mov rcx, rsi
call fcn.100048e10
mov rax, rsi
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.100001c30
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x490
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x100054be0
Capabilities:
Delete file
Delete registry key

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0xb0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1000730b0]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rsi, rcx
lea r8, [rcx + 0x28]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionApplets_
lea rcx, [r11 - 0x80]
call fcn.100053558
nop
lea r8, str.Recovery_
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.100056f90
nop
cmp qword [rsp + 0x68], 8
jb 0x100054c53
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_free
mov r12d, 7
mov qword [rsp + 0x68], r12
xor edi, edi
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
lea rdx, [0x100062c88]
mov rcx, rsi
call fcn.10004f64c
cmp al, dil
je 0x100054c9d
cmp qword [rsp + 0xa0], 8
jb 0x100054c96
mov rcx, qword [rsp + 0x88]
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100054db3
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x80]
call fcn.10004f198
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x28], di
mov r8d, 0x10
lea rdx, str.RecoveryFilePath
lea rcx, [rsp + 0x20]
call fcn.10001b608
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x70]
lea rcx, [rsi + 0x60]
call fcn.100054f6c
mov rbx, qword [rax]
cmp qword [rsp + 0x40], 8
jb 0x100054d03
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
cmp rbx, qword [rsi + 0x68]
je 0x100054d68
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x28], di
mov r8d, 0x10
lea rdx, str.RecoveryFilePath
lea rcx, [rsp + 0x20]
call fcn.10001b608
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x60]
call fcn.100054de4
cmp qword [rax + 0x20], 8
jb 0x100054d4b
mov rcx, qword [rax + 8]
jmp 0x100054d4f
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
nop
cmp qword [rsp + 0x40], 8
jb 0x100054d68
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
lea rdx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 8
cmovae rdx, qword [rsp + 0x88]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, 1
cmp eax, edi
cmove edi, ecx
cmp qword [rsp + 0xa0], 8
jb 0x100054db1
mov rcx, qword [rsp + 0x88]
call sub.msvcrt.dll_free
mov eax, edi
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.100001c30
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x10005c8d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rbx, rcx
movzx ecx, word [rcx + 6]
mov ebp, 0x7ff
shr cx, 4
mov esi, edx
and cx, bp
cmp cx, bp
jne 0x10005c939
test byte [rbx + 6], 0xf
jne 0x10005c92a
xor edi, edi
cmp word [rbx + 4], di
jne 0x10005c92a
cmp word [rbx + 2], di
jne 0x10005c92a
cmp word [rbx], di
jne 0x10005c92a
lea r10d, [rdi + 1]
jmp 0x10005c930
mov r10d, 2
mov ax, r10w
jmp 0x10005cb57
xor edi, edi
cmp cx, di
jne 0x10005c954
mov rcx, rbx
call fcn.10005cf1c
cmp di, ax
mov cx, ax
jl 0x10005cb54
cmp esi, edi
jle 0x10005c98a
movsx eax, cx
sub ebp, eax
cmp ebp, esi
jg 0x10005c98a
movsd xmm0, qword [0x100075a90]
mov ebp, 0x8000
test word [rbx + 6], bp
je 0x10005c97c
xorpd xmm0, xmmword [0x100065ea0]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x10005cb57
movsx edx, cx
mov eax, edx
neg eax
cmp eax, esi
jge 0x10005c9b1
add si, cx
mov eax, 0x800f
and word [rbx + 6], ax
shl si, 4
or word [rbx + 6], si
or eax, 0xffffffff
jmp 0x10005cb57
movzx ecx, word [rbx + 6]
lea r11d, [rsi + rdx - 1]
mov r14d, 0x10
movzx r12d, cx
and cx, 0xf
lea eax, [r11 + 0x35]
or cx, r14w
mov ebp, 0x8000
and r12w, bp
mov word [rbx + 6], cx
cmp eax, 0x34
ja 0x10005cb44
cmp r11w, 0xfff0
movzx esi, di
lea r10d, [r14 - 0xf]
jg 0x10005ca57
movzx edx, word [rbx + 2]
movzx r8d, word [rbx]
mov eax, 0xfff0
sub ax, r11w
mov r13w, cx
movzx ecx, word [rbx + 4]
shr ax, 4
add ax, r10w
movzx r9d, ax
movzx eax, r9w
shl ax, 4
add r11w, ax
cmp si, di
mov eax, edi
setne al
mov si, ax
or si, r8w
sub r9, r10
mov r8w, dx
mov dx, cx
mov cx, r13w
mov r13d, edi
jne 0x10005ca25
mov word [rbx + 6], di
mov word [rbx + 4], cx
mov word [rbx + 2], dx
mov word [rbx], r8w
neg r11w
je 0x10005cae6
movzx r8d, word [rbx]
mov eax, edi
movsx r9d, r11w
sub r14d, r9d
movzx edx, r8w
mov ecx, r14d
shl dx, cl
cmp si, di
movzx ecx, r11w
setne al
shr r8w, cl
mov si, dx
movzx edx, word [rbx + 2]
or si, ax
mov ecx, r14d
movzx eax, dx
shl ax, cl
movzx ecx, r11w
or r8w, ax
shr dx, cl
mov ecx, r14d
mov word [rbx], r8w
movzx r8d, word [rbx + 4]
movzx eax, r8w
shl ax, cl
movzx ecx, r11w
or dx, ax
shr r8w, cl
mov ecx, r14d
mov word [rbx + 2], dx
movzx edx, word [rbx + 6]
movzx eax, dx
shl ax, cl
mov ecx, r9d
or r8w, ax
shr dx, cl
mov word [rbx + 6], dx
mov word [rbx + 4], r8w
or word [rbx + 6], r12w
movzx eax, word [rbx + 6]
cmp bp, si
jb 0x10005cafb
jne 0x10005cb1c
test byte [rbx], r10b
je 0x10005cb1c
add word [rbx], r10w
jne 0x10005cb1c
add word [rbx + 2], r10w
jne 0x10005cb1c
add word [rbx + 4], r10w
jne 0x10005cb1c
add ax, r10w
mov word [rbx + 6], ax
jmp 0x10005c9a9
cmp ax, r12w
jne 0x10005c9a9
cmp word [rbx + 4], di
jne 0x10005c9a9
cmp word [rbx + 2], di
jne 0x10005c9a9
cmp word [rbx], di
je 0x10005cb54
jmp 0x10005c9a9
mov word [rbx + 6], r12w
mov word [rbx + 4], di
mov word [rbx + 2], di
mov word [rbx], di
mov ax, di
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x10005d118
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.DLL_RtlLookupFunctionEntry]
test rax, rax
je 0x10005d183
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_RtlVirtualUnwind]
jmp 0x10005d1a3
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x140006340
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140006373
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400063b9
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400063b4
nop
cmp rbx, rcx
jae 0x1400063b9
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
dec edi
jne 0x1400063a0
cmp rbx, rcx
jb 0x1400063bd
xor eax, eax
jmp 0x1400063c9
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14000eff0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.14000ee60
nop
cmp qword [rax + 0x18], 8
jb 0x14000f026
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp qword [rsp + 0x40], 8
jb 0x14000f044
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rsp + 0x40], 7
xor eax, eax
mov qword [rsp + 0x38], rax
mov word [rsp + 0x28], ax
cmp ebx, 0xffffffff
je 0x14000f065
test bl, 0x10
je 0x14000f065
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140108d90
add rsp, 0x50
pop rbx
ret
Function at 0x14000f400
Capabilities:
Move file

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rdx
mov rsi, rcx
lea rcx, [rsp + 0x28]
call fcn.14000eec0
nop
cmp qword [rsp + 0x38], 0
je 0x14000f45c
lea rcx, [rsp + 0x28]
call fcn.14000f2b0
mov rdi, rax
shr rax, 0x27
not eax
test al, 1
jne 0x14000f4e1
cmp qword [rbx + 0x18], 8
jb 0x14000f466
mov rbx, qword [rbx]
cmp qword [rsi + 0x18], 8
jb 0x14000f470
mov rsi, qword [rsi]
mov r8d, 3
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14000f4d7
lea edx, [rax + 0x5c]
lea rcx, str.D:_agent_work2_sprivate_softgrid_sharedinclude_shared_file_utils.hpp
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x14000f4a0
inc rax
jmp 0x14000f4a7
lea rax, str.D:_agent_work2_sprivate_softgrid_sharedinclude_shared_file_utils.hpp
mov rdx, rax
lea rcx, [0x14020c428]
call fcn.140005ff0
mov rbx, rax
shl rbx, 0x34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
or rdi, rbx
movabs rax, 0x192500000000
or rdi, rax
jmp 0x14000f4e1
movabs rdi, 0x8000000000
cmp qword [rsp + 0x40], 8
jb 0x14000f4f4
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rsp + 0x40], 7
xor eax, eax
mov qword [rsp + 0x38], rax
mov word [rsp + 0x28], ax
mov rax, rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140108d90
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14000f5e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rdx
mov rbx, rcx
mov byte [rdx], 0
xor esi, esi
mov qword [r11 - 0x40], rsi
mov qword [r11 - 0x38], rsi
mov qword [r11 - 0x38], 7
mov qword [r11 - 0x40], rsi
mov word [rsp + 0x28], si
lea r8d, [rsi + 1]
lea rdx, [0x1401627d8]
lea rcx, [r11 - 0x50]
call fcn.140007d00
nop
lea r8, [rsp + 0x28]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.14000e680
nop
cmp qword [rsp + 0x40], 8
jb 0x14000f666
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
lea rcx, [rsp + 0x48]
call fcn.14000e730
cmp qword [rsp + 0x58], 0
je 0x14000f702
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000f6ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea ecx, [rbx - 2]
cmp ecx, 1
jbe 0x14000f702
mov edx, MsiPreviewDialogW
lea rcx, str.D:_agent_work2_sprivate_softgrid_sharedinclude_shared_file_utils.hpp
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x14000f6d3
inc rax
jmp 0x14000f6da
lea rax, str.D:_agent_work2_sprivate_softgrid_sharedinclude_shared_file_utils.hpp
mov rdx, rax
lea rcx, [0x14020c428]
call fcn.140005ff0
shl rax, 0x34
or rbx, rax
movabs rax, 0x1e2500000000
or rbx, rax
jmp 0x14000f70c
mov byte [rdi], 1
movabs rbx, 0x8000000000
cmp qword [rsp + 0x60], 8
jb 0x14000f71f
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140108d90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140015ad0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rbx, rcx
xor ebp, ebp
mov dword [rax - 0x48], ebp
mov word [rax + 0x10], bp
xorps xmm0, xmm0
movdqu xmmword [rax - 0x38], xmm0
mov qword [rax - 0x28], rbp
lea r8, [rax + 0x10]
mov edx, 0x105
lea rcx, [rax - 0x38]
call fcn.140017780
nop
mov rdi, qword [rsp + 0x30]
mov rdx, rdi
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
je 0x140015ba6
cmp esi, 0x104
jbe 0x140015b5c
mov word [rsp + 0x78], bp
mov edx, esi
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.1400174a0
mov rdi, qword [rsp + 0x30]
mov rdx, rdi
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [0x140162794]
test rdi, rdi
cmovne rdx, rdi
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rbp
mov word [rbx], bp
cmp word [rdx], 0
jne 0x140015b84
mov r8, rbp
jmp 0x140015b9b
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140015b90
mov rcx, rbx
call fcn.140007d00
nop
jmp 0x140015bb5
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rbp
mov word [rbx], bp
mov dword [rsp + 0x20], 1
test rdi, rdi
je 0x140015bd9
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbp
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140015bf0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rsi, rdx
mov rbx, rcx
xor r14d, r14d
mov dword [rax - 0x48], r14d
mov word [rax + 0x10], r14w
xorps xmm0, xmm0
movdqu xmmword [rax - 0x38], xmm0
mov qword [rax - 0x28], r14
lea r8, [rax + 0x10]
mov edx, 0x400
lea rcx, [rax - 0x38]
call fcn.140017780
nop
cmp qword [rsi + 0x18], 8
jb 0x140015c4c
mov rcx, qword [rsi]
jmp 0x140015c4f
mov rcx, rsi
mov r8d, 0x400
mov rdi, qword [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
test eax, eax
je 0x140015cf6
cmp ebp, 0x3ff
jbe 0x140015caa
mov word [rsp + 0x78], r14w
mov edx, ebp
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.1400174a0
cmp qword [rsi + 0x18], 8
jb 0x140015c96
mov rsi, qword [rsi]
mov r8d, ebp
mov rdi, qword [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [0x140162794]
test rdi, rdi
cmovne rdx, rdi
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
cmp word [rdx], 0
jne 0x140015cd3
mov r8, r14
jmp 0x140015ceb
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140015ce0
mov rcx, rbx
call fcn.140007d00
nop
jmp 0x140015d06
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
mov dword [rsp + 0x20], 1
test rdi, rdi
je 0x140015d2a
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
mov rax, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140015d50
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rax - 0x48], ebp
cmp qword [rdx + 0x18], 8
jb 0x140015d81
mov rcx, qword [rdx]
jmp 0x140015d84
mov rcx, rdx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea esi, [rax + 1]
mov word [rsp + 0x78], bp
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbp
mov edx, esi
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.140017780
nop
cmp qword [rdi + 0x18], 8
jb 0x140015dc1
mov rdi, qword [rdi]
mov r8d, esi
mov rsi, qword [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rbp
mov word [rbx], bp
test eax, eax
je 0x140015e1b
lea rdx, [0x140162794]
test rsi, rsi
cmovne rdx, rsi
cmp word [rdx], 0
jne 0x140015e01
mov r8, rbp
jmp 0x140015e10
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140015e05
mov rcx, rbx
call fcn.140007d00
nop
jmp 0x140015e1b
mov dword [rsp + 0x20], 1
test rsi, rsi
je 0x140015e3f
mov rcx, rsi
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbp
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140017d70
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x198
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
cmp dword [0x14020b9a4], 0
je 0x140017db0
mov eax, dword [0x14020b9a0]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140108d90
add rsp, 0x198
ret
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x11c
call sub.MSVCR120.dll_memset
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x30]
movzx r9d, byte [rsp + 0x17a]
mov r8d, dword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x64]
mov word [rsp + 0x28], ax
movzx eax, word [rsp + 0x178]
mov word [rsp + 0x20], ax
call fcn.140017e60
mov dword [0x14020b9a4], 1
mov dword [0x14020b9a0], eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140108d90
add rsp, 0x198
ret
Function at 0x140026ec0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
cmp qword [rdx + 0x18], 8
mov rdi, rdx
mov qword [rdx + 0x10], rbx
jb 0x140026ee4
mov rax, qword [rdx]
jmp 0x140026ee7
mov rax, rdx
mov word [rax], bx
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x4000
mov qword [rsp + 0x38], rbx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov esi, eax
test eax, eax
jns 0x140026f5e
lea rcx, str.D:_agent_work2_sprivate_softgrid_sharedinclude_sharedenv_utils.hpp
mov edx, MsiPreviewDialogW
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x140026f24
inc rax
jmp 0x140026f2b
lea rax, str.D:_agent_work2_sprivate_softgrid_sharedinclude_sharedenv_utils.hpp
lea rcx, [0x14020c428]
mov rdx, rax
call fcn.140005ff0
movabs rcx, 0xc2500000000
shl rax, 0x34
or rax, rsi
or rax, rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rdx, qword [rsp + 0x38]
cmp word [rdx], bx
je 0x140026f7a
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140026f70
mov r8, rbx
mov rcx, rdi
call fcn.140007d00
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
movabs rax, 0x8000000000
add rsp, 0x20
pop rdi
ret
Function at 0x1400367d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov r14, r9
mov rdi, r8
mov r15, rdx
xor ecx, ecx
mov dword [rsp + 0x70], ecx
mov rbx, qword [rsp + 0x90]
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
mov qword [r11 - 0x30], rax
mov edx, 0xffffffff
cmp rax, rdx
jbe 0x140036834
mov dword [rsp + 0x30], 1
lea rdx, [0x1401faff0]
lea rcx, [r11 - 0x38]
call sub.MSVCR120.dll__CxxThrowException
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x140036842
mov rcx, qword [rbx]
cmp qword [r8 + 0x18], 8
jb 0x14003684e
mov rdx, qword [r8]
jmp 0x140036851
mov rdx, r8
mov rax, qword [r15]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x140036889
mov rax, qword [rbx + 8]
cmp rax, qword [rbx]
jne 0x1400368d6
mov eax, dword [rsp + 0x70]
test eax, eax
jne 0x140036894
jmp 0x1400368da
cmp eax, 0xea
jne 0x1400368d2
mov eax, dword [rsp + 0x70]
mov edx, eax
mov rcx, rbx
call fcn.140038740
mov rcx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x1400368ab
mov rdi, qword [rdi]
mov rax, qword [r15]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
mov r9, r14
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x140036907
mov eax, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x98]
mov byte [rdx], 1
mov edx, eax
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
cmp rdx, rax
je 0x1400368fb
mov rcx, rbx
call fcn.140038740
movabs rax, 0x8000000000
jmp 0x14003694b
lea eax, [rsi - 2]
cmp eax, 1
jbe 0x140036928
call fcn.140035fa0
mov ecx, esi
or rax, rcx
movabs rcx, 0xf2100000000
or rax, rcx
jmp 0x14003694b
mov rax, qword [rbx]
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x98]
mov byte [rax], 0
movabs rax, 0x8000000000
jmp 0x14003694b
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret