joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c516
Capabilities:
Query or enumerate registry value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x188
xor eax, eax
lea rbp, [0x1400fa700]
xor r9d, r9d
mov rbx, rcx
lea rdi, [rsp + 0x7c]
mov ecx, 0x41
mov qword [rsp + 0x68], r9
rep stosd dword [rdi], eax
mov ecx, 0x1ff
mov rdi, rbp
mov qword [rsp + 0x70], r9
rep stosb byte [rdi], al
mov rcx, rbx
lea r13, [rsp + 0x7c]
mov dword [rsp + 0x60], 0xffffffff
mov dword [rsp + 0x64], 0x1ff
call sub.msvcrt.dll_strlen
mov rcx, rax
mov r12, rax
test r12, r12
je 0x14000c614
cmp byte [rbx + r12], 0x5c
je 0x14000c58c
dec r12
jmp 0x14000c577
cmp r12, 0x103
ja 0x14000c6d8
mov eax, 0x104
inc rcx
mov rdi, r13
mov rsi, rbx
cmp rcx, rax
cmova rcx, rax
mov ecx, ecx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov r9d, 0x20019
mov rcx, 0xffffffff80000001
lea rdx, [rax + 1]
cmp rdx, 0x104
mov edx, 0x103
cmovae rax, rdx
xor r8d, r8d
mov rdx, r13
mov byte [rsp + rax + 0x7c], 0
lea rax, [rsp + 0x70]
mov byte [rsp + r12 + 0x7c], 0
inc r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c691
xor r8d, r8d
mov qword [rsp + 0x70], r8
jmp 0x14000c6b7
lea rax, [rsp + 0x68]
xor r8d, r8d
mov r9d, 0x2001d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
lea rdx, [0x140082ee7]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000c648
xor ecx, ecx
mov qword [rsp + 0x68], rcx
jmp 0x14000c6b7
lea rax, [rsp + 0x5c]
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
xor eax, eax
mov dword [rsp + 0x20], edx
lea rdx, [0x140082ef0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000c607
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rbp
lea rdx, [rbx + r12]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000c6c7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000c6d8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rsp, 0x188
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14000c95a
Capabilities:
Get disk information

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x180
mov r10d, dword [0x1400fa568]
mov ebp, r8d
mov ebx, r9d
test ecx, ecx
js 0x14000c9d2
lea r9d, [rcx - 0x80]
cmp r9d, 0x40
jbe 0x14000c9a0
mov r8d, 0x188
lea rdx, str.drive.c
lea rcx, str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
call qword [sym.imp.msvcrt.dll__wassert]
test rdx, rdx
je 0x14000c9eb
xor eax, eax
lea r8, [0x1400fa588]
cmp r10d, ecx
jne 0x14000c9d9
cmp qword [r8 + rax*8], rdx
je 0x14000c9ed
inc rax
cmp rax, 0x10
jne 0x14000c9b3
test ebx, ebx
jne 0x14000c9d2
lea rcx, str.Error:_Could_not_find_a_partition_at_offset__lld_on_this_disk
call fcn.140036717
xor eax, eax
jmp 0x14000cae4
test ebx, ebx
jne 0x14000c9d2
lea rcx, str.Error:_Searching_for_a_partition_on_a_non_matching_disk
call fcn.140036717
jmp 0x14000c9d2
xor eax, eax
inc eax
lea r12, [rsp + 0x3c]
mov edx, 0x40
mov rcx, r12
mov dword [rsp + 0x20], eax
lea r8, str.Harddisk_luPartition_lu
call qword [sym.imp.msvcrt.dll__snprintf]
mov byte [rsp + 0x7b], 0
mov ecx, 1
mov r14, qword [str.HG_b_]
test r14, r14
je 0x14000ca3b
mov rcx, r14
call sub.msvcrt.dll_strlen
lea rcx, [rax + 1]
mov eax, 0x104
cmp rcx, rax
cmova rcx, rax
lea r13, [rsp + 0x7c]
mov ecx, ecx
mov rsi, r14
mov rdi, r13
rep movsb byte [rdi], byte [rsi]
mov rcx, r14
mov esi, 0x103
call sub.msvcrt.dll_strlen
mov r8d, 0xf6
mov rcx, r12
lea rdx, [rax + 1]
cmp rdx, 0x104
lea rdx, [rsp + 0x8a]
cmovae rax, rsi
mov byte [rsp + rax + 0x7c], 0
call qword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
test eax, eax
je 0x14000ca94
mov rcx, r13
call sub.msvcrt.dll_strlen
cmp rax, 0x13
ja 0x14000cab8
test ebx, ebx
jne 0x14000c9d2
call fcn.140036bd7
mov rdx, r12
lea rcx, str.Could_not_find_a_DOS_volume_name_for__s:__s
mov r8, rax
call fcn.140036717
jmp 0x14000c9d2
test ebp, ebp
je 0x14000cadb
sub rsi, rax
mov r8d, 2
lea rdx, [0x140082fed]
mov rcx, r13
cmp rsi, r8
cmovbe r8, rsi
call sub.msvcrt.dll_strncat
mov rcx, r13
call qword [sym.imp.msvcrt.dll__strdup]
add rsp, 0x180
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14000dd99
Capabilities:
Get disk information via ioctl

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x120
xor r8d, r8d
xor r9d, r9d
mov rdi, qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
lea rax, [rsp + 0x58]
mov rbx, rdx
xor edx, edx
mov qword [rsp + 0x38], r8
lea rbp, [rsp + 0x48]
mov dword [rsp + 0x48], edx
xor r8d, r8d
mov edx, 0x560000
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0xc8
mov qword [rsp + 0x20], rax
call rdi
mov rcx, qword [rsp + 0x140]
test eax, eax
je 0x14000de07
cmp dword [rsp + 0x48], 0
je 0x14000de07
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x14000de66
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4c]
mov edx, 0x2d1080
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rax
call rdi
test eax, eax
je 0x14000de46
cmp dword [rsp + 0x48], 0
jne 0x14000de5f
lea r8, str._empty_data_
jmp 0x14000de4e
call fcn.140036bd7
mov r8, rax
mov rdx, rbx
lea rcx, str.Could_not_get_device_number_for_device__s__s
call fcn.140036717
jmp 0x14000de7e
mov r8d, dword [rsp + 0x50]
jmp 0x14000de84
dec eax
mov r8d, dword [rsp + 0x60]
je 0x14000de84
mov rdx, rbx
lea rcx, str.Ignoring_drive__s_as_it_spans_multiple_disks__RAID__
call fcn.140036717
or r8d, 0xffffffff
jmp 0x14000dea7
cmp r8d, 0x3f
jle 0x14000dea7
mov rdx, rbx
lea rcx, str.Device_Number_for_device__s_is_too_big___d____ignoring_device
call fcn.140036717
lea rcx, str.NOTE:_This_may_be_due_to_an_excess_of_Virtual_Drives__such_as_hidden_ones_created_by_the_XBox_PC_app
call fcn.140036717
jmp 0x14000de7e
mov eax, r8d
add rsp, 0x120
pop rbx
pop rdi
pop rbp
ret
Function at 0x14000e302
Capabilities:
Get disk information

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov ecx, 0x69
lea rbp, [rsp + 0x27]
mov rdx, rbp
call qword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsA]
mov edx, eax
test eax, eax
jne 0x14000e33c
call fcn.140036bd7
lea rcx, str.GetLogicalDriveStrings_failed:__s
mov rdx, rax
call fcn.140036717
jmp 0x14000e355
mov bl, 0x43
cmp eax, 0x69
jbe 0x14000e38d
mov r8d, 0x69
lea rcx, str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
call fcn.140036717
xor ebx, ebx
jmp 0x14000e392
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rdi, [rdi + rax + 1]
movsx esi, byte [rdi]
test sil, sil
je 0x14000e392
mov ecx, esi
call qword [sym.imp.msvcrt.dll_isalpha]
test eax, eax
je 0x14000e359
mov ecx, esi
call qword [sym.imp.msvcrt.dll_toupper]
cmp bl, al
jne 0x14000e359
inc ebx
cmp bl, 0x5b
je 0x14000e355
mov rdi, rbp
jmp 0x14000e366
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14000e500
Capabilities:
Get disk information

Disassembly:
push rsi
push rbx
sub rsp, 0x98
lea rbx, [rsp + 0x27]
mov esi, ecx
mov ecx, 0x69
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsA]
mov edx, eax
test eax, eax
jne 0x14000e53a
call fcn.140036bd7
lea rcx, str.GetLogicalDriveStrings_failed:__s
mov rdx, rax
call fcn.140036717
jmp 0x14000e551
cmp eax, 0x69
jbe 0x14000e570
mov r8d, 0x69
lea rcx, str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
call fcn.140036717
mov eax, 1
jmp 0x14000e579
call qword [sym.imp.msvcrt.dll_toupper]
cmp sil, al
je 0x14000e551
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rbx, [rbx + rax + 1]
movsx ecx, byte [rbx]
test cl, cl
jne 0x14000e558
xor eax, eax
add rsp, 0x98
pop rbx
pop rsi
ret
Function at 0x14000eba3
Capabilities:
Get disk information via ioctl

Disassembly:
push r12
mov eax, 0x1050
push rbp
push rdi
push rsi
push rbx
call fcn.1400747a0
sub rsp, rax
xor eax, eax
xor edx, edx
mov r9d, 1
mov r8d, 1
xor ebx, ebx
mov ebp, ecx
lea rdi, [rsp + 0x50]
mov ecx, 0x400
rep stosd dword [rdi], eax
mov ecx, ebp
lea rdi, [rsp + 0x50]
call fcn.14000c911
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x14000ecb6
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4c]
mov edx, 0x70050
mov rcx, rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x14000ec33
cmp dword [rsp + 0x4c], 0
lea r12, [0x1400b9af0]
jne 0x14000ec68
call fcn.140036bd7
mov edx, ebp
lea rcx, str.Could_not_get_layout_for_drive_0x_02x:__s
mov r8, rax
call fcn.140036717
jmp 0x14000eca1
mov eax, dword [rsp + 0x50]
test eax, eax
jne 0x14000ec70
mov eax, ebx
imul rax, rax, 0x90
cmp byte [rsp + rax + 0xa0], 0xef
je 0x14000ec8e
inc ebx
cmp ebx, dword [rsp + 0x54]
jb 0x14000ec4b
jmp 0x14000eca1
dec eax
jne 0x14000ec66
mov eax, ebx
mov rdx, r12
imul rax, rax, 0x90
lea rcx, [rdi + rax + 0x50]
call fcn.140035c44
test eax, eax
je 0x14000ec66
mov ebx, ebx
imul rbx, rbx, 0x90
mov rbx, qword [rsp + rbx + 0x88]
jmp 0x14000eca3
xor ebx, ebx
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000ecb6
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rax, rbx
add rsp, 0x1050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14000f0ea
Capabilities:
Get disk information

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov word [rsp + 0x29], 0x3a3f
mov rbx, rcx
mov rsi, rdx
mov byte [rsp + 0x2b], 0
test rcx, rcx
je 0x14000f117
test rdx, rdx
je 0x14000f117
cmp byte [rcx], 0x3f
jne 0x14000f124
mov ecx, 0x57
call qword [sym.imp.KERNEL32.DLL_SetLastError]
jmp 0x14000f17a
mov rdx, qword [str.HG_b_]
mov r8d, 0xe
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__strnicmp]
test eax, eax
jne 0x14000f19f
mov al, byte [rbx]
mov ecx, 9
lea rdx, [rsp + 0x29]
lea r8, [rsi + 0xe]
mov byte [rsp + 0x29], al
call qword [sym.imp.KERNEL32.DLL_DefineDosDeviceA]
movsx ecx, byte [rbx]
test eax, eax
mov rax, qword [sym.imp.msvcrt.dll_toupper]
jne 0x14000f181
call rax
mov rdx, rsi
lea rcx, str.Could_not_mount__s_as__c:
mov r8d, eax
call fcn.140036717
xor eax, eax
jmp 0x14000f2b2
call rax
mov rdx, rsi
lea rcx, str._s_was_successfully_mounted_as__c:
mov r8d, eax
call fcn.140036717
mov eax, 1
jmp 0x14000f2b2
mov r13, qword [sym.imp.KERNEL32.DLL_SetVolumeMountPointA]
mov rdx, rsi
mov rcx, rbx
call r13
test eax, eax
jne 0x14000f195
mov r12, qword [sym.imp.KERNEL32.DLL_GetLastError]
call r12
cmp eax, 0x91
jne 0x14000f17a
lea rdi, [rsp + 0x2c]
mov rbp, qword [sym.imp.KERNEL32.DLL_GetVolumeNameForVolumeMountPointA]
mov r8d, 0x34
mov rcx, rbx
mov rdx, rdi
call rbp
test eax, eax
jne 0x14000f1fb
call fcn.140036bd7
mov rdx, rbx
lea rcx, str._s_is_already_mounted__but_volume_GUID_could_not_be_checked:__s
mov r8, rax
call fcn.140036717
jmp 0x14000f21f
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x14000f195
mov r9, rdi
mov r8, rsi
lea rcx, str._s_is_mounted__but_volume_GUID_doesnt_match:_r_n__expected__s__got__s
mov rdx, rbx
call fcn.140036717
lea rcx, str.Retrying_after_dismount...
call fcn.140036717
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_DeleteVolumeMountPointA]
test eax, eax
jne 0x14000f24f
call fcn.140036bd7
mov rdx, rbx
lea rcx, str.Warning:_Could_not_delete_volume_mountpoint__s:__s
mov r8, rax
call fcn.140036717
mov rdx, rsi
mov rcx, rbx
call r13
test eax, eax
jne 0x14000f195
call r12
cmp eax, 0x91
jne 0x14000f17a
mov r8d, 0x34
mov rdx, rdi
mov rcx, rbx
call rbp
test eax, eax
je 0x14000f17a
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14000f17a
movsx ecx, byte [rbx]
call qword [sym.imp.msvcrt.dll_toupper]
mov rdx, rsi
lea rcx, str._s_was_remounted_as__c:__second_time_lucky__
mov r8d, eax
jmp 0x14000f190
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14000f416
Capabilities:
Get disk information

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x90
xor eax, eax
xor r9d, r9d
mov r8d, 3
mov sil, byte [rcx]
lea rbp, [rsp + 0x5d]
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov r12d, edx
mov dword [rsp + 0x5d], 0x5c2e5c5c
mov edx, 0xc0000000
mov rcx, rbp
mov dword [rsp + 0x60], 0x3a235c
mov dword [rsp + 0x28], pe_nt_image_headers64
mov byte [rsp + 0x61], sil
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000f4a6
call fcn.140036bd7
movsx ecx, sil
mov qword [rsp + 0x48], rax
call qword [sym.imp.msvcrt.dll_toupper]
mov r8, qword [rsp + 0x48]
lea rcx, str.Failed_to_open__c:_for_flushing:__s
mov edx, eax
call fcn.140036717
jmp 0x14000f4ed
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
test eax, eax
jne 0x14000f4da
call fcn.140036bd7
movsx ecx, sil
mov qword [rsp + 0x48], rax
call qword [sym.imp.msvcrt.dll_toupper]
mov r8, qword [rsp + 0x48]
lea rcx, str.Failed_to_flush__c:__s
mov edx, eax
call fcn.140036717
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000f4ed
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov r8d, 0x33
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetVolumeNameForVolumeMountPointA]
test eax, eax
jne 0x14000f50a
mov esi, 1
jmp 0x14000f579
mov rdx, rbp
mov rcx, rbx
call fcn.14000f0ea
mov esi, eax
test eax, eax
je 0x14000f53d
test r12d, r12d
jne 0x14000f503
movsx ecx, byte [rbx]
call qword [sym.imp.msvcrt.dll_toupper]
mov rdx, rbp
lea rcx, str.Successfully_remounted__s_as__c:
mov r8d, eax
call fcn.140036717
jmp 0x14000f503
test r12d, r12d
jne 0x14000f56c
call fcn.140036bd7
movsx ecx, byte [rbx]
mov qword [rsp + 0x48], rax
call qword [sym.imp.msvcrt.dll_toupper]
mov r9, qword [rsp + 0x48]
mov rdx, rbp
lea rcx, str.Could_not_remount__s_as__c:__s
mov r8d, eax
call fcn.140036717
mov rax, qword [0x1400b1100]
mov dword [rax], 0xe0031209
mov eax, esi
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140011ec1
Capabilities:
Query or enumerate registry value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x188
xor r10d, r10d
xor eax, eax
xor r9d, r9d
mov dword [rdx], r10d
mov rbx, rcx
lea rdi, [rsp + 0x7c]
mov ecx, 0x41
rep stosd dword [rdi], eax
mov rcx, rbx
mov qword [rsp + 0x68], r9
mov rbp, rdx
mov qword [rsp + 0x70], r9
lea r13, [rsp + 0x7c]
mov dword [rsp + 0x60], 0xffffffff
mov dword [rsp + 0x64], 4
call sub.msvcrt.dll_strlen
mov rcx, rax
mov r12, rax
test r12, r12
je 0x140011fb7
cmp byte [rbx + r12], 0x5c
je 0x140011f2f
dec r12
jmp 0x140011f1a
cmp r12, 0x103
ja 0x14001207b
mov eax, 0x104
inc rcx
mov rdi, r13
mov rsi, rbx
cmp rcx, rax
cmova rcx, rax
mov ecx, ecx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov r9d, 0x20019
mov rcx, 0xffffffff80000001
lea rdx, [rax + 1]
cmp rdx, 0x104
mov edx, 0x103
cmovae rax, rdx
xor r8d, r8d
mov rdx, r13
mov byte [rsp + rax + 0x7c], 0
lea rax, [rsp + 0x70]
mov byte [rsp + r12 + 0x7c], 0
inc r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140012034
xor r8d, r8d
mov qword [rsp + 0x70], r8
jmp 0x14001205a
lea rax, [rsp + 0x68]
xor r8d, r8d
mov r9d, 0x2001d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
lea rdx, [0x1400859f6]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140011feb
xor ecx, ecx
mov qword [rsp + 0x68], rcx
jmp 0x14001205a
lea rax, [rsp + 0x5c]
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
xor eax, eax
mov dword [rsp + 0x20], edx
lea rdx, [0x1400859ff]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140011faa
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rbp
lea rdx, [rbx + r12]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001206a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14001207b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rsp, 0x188
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x140012121
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
xor r9d, r9d
mov dword [rcx + 0x30], eax
lea rax, [rcx + 0x10]
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov edx, eax
mov eax, 1
test edx, edx
jne 0x140012161
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
sete al
movzx eax, al
neg eax
mov dword [rbx + 8], eax
add rsp, 0x30
pop rbx
ret
Function at 0x140012b85
Capabilities:
Delete file

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140011da3
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
test rbx, rbx
je 0x140012bb1
mov rcx, rbx
call sub.msvcrt.dll_free
mov ecx, esi
add rsp, 0x28
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.DLL_SetLastError]
Function at 0x1400186cb
Capabilities:
Get graphical window text

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a0
lea r8, str._sautorun.inf
mov edx, 0x40
lea rbx, [rsp + 0x60]
mov r9, rcx
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__snprintf]
lea rdx, [0x1400880e6]
mov rcx, rbx
mov byte [rsp + 0x9f], 0
call sub.msvcrt.dll_fopen
mov rsi, rax
test rax, rax
je 0x14001872d
mov rdx, rbx
lea rcx, str._s_already_exists___keeping_it
call fcn.140036717
mov rcx, rsi
call sub.msvcrt.dll_fclose
jmp 0x14001875f
lea rdx, [0x140088107]
mov rcx, rbx
call sub.msvcrt.dll_fopen
mov rsi, rax
test rax, rax
jne 0x140018766
lea rcx, str.Unable_to_create__s
mov rdx, rbx
call fcn.140036717
lea rcx, str.NOTE:_This_may_be_caused_by_a_poorly_designed_security_solution._See_https:__goo.gl_QTobxX.
call fcn.140036717
xor eax, eax
jmp 0x140018825
mov rax, qword [0x1400b1990]
lea rdi, [rsp + 0xa0]
lea rbp, [rsp + 0x20]
mov r12, qword [sym.imp.USER32.dll_GetWindowTextW]
mov r8d, pe_nt_image_headers64
mov rdx, rdi
mov rcx, qword [rax]
call r12
mov rax, qword [0x1400b19c0]
mov r8d, 0x20
mov rdx, rbp
mov rcx, qword [rax]
call r12
mov r8, rbp
lea rdx, str.__Created_by__s_n__https:__rufus.ie_n
mov rcx, rsi
call sub.msvcrt.dll_fwprintf_s
mov r8, rdi
lea rdx, str._autorun__nicon___autorun.ico_nlabel___s_n
mov rcx, rsi
call sub.msvcrt.dll_fwprintf_s
mov rcx, rsi
call sub.msvcrt.dll_fclose
lea rcx, str.Created:__s
mov rdx, rbx
call fcn.140036717
mov rcx, rbx
call sub.msvcrt.dll_strlen
cmp rax, 1
ja 0x140018809
mov r8d, 0xbd
lea rdx, str.icon.c
lea rcx, str.strlen_filename____2
call qword [sym.imp.msvcrt.dll__wassert]
mov rcx, rbx
mov byte [rsp + rax + 0x5f], 0x6f
call sub.msvcrt.dll_strlen
xor edx, edx
mov rcx, rbx
mov byte [rsp + rax + 0x5e], 0x63
call fcn.140018380
add rsp, 0x1a0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400197fa
Capabilities:
Copy file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rdx
call fcn.14001974d
mov rcx, rbx
mov rsi, rax
call fcn.14001974d
xor r8d, r8d
mov rcx, rsi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_CopyFileW]
mov edi, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebp, eax
test rsi, rsi
je 0x14001983e
mov rcx, rsi
call sub.msvcrt.dll_free
test rbx, rbx
je 0x14001984b
mov rcx, rbx
call sub.msvcrt.dll_free
mov ecx, ebp
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140019948
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
call fcn.14001974d
mov rbx, rax
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wmkdir]
test rbx, rbx
je 0x140019970
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sub.msvcrt.dll_free
add rsp, 0x20
pop rbx
ret

Function at 0x14001a7a3
Capabilities:
Delete file

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.14001974d
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14001a7cf
mov rcx, rbx
call sub.msvcrt.dll_free
mov ecx, esi
add rsp, 0x28
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.DLL_SetLastError]
Function at 0x14001d082
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.localization:_invalid_parameter_for_add_message_command_n
test rbx, rbx
je 0x14001d0af
movsxd rax, dword [rbx + 4]
lea edx, [rax - 0xbb9]
cmp edx, 0x15d
jbe 0x14001d0b9
lea rcx, str.localization:_invalid_MSG__index_n
add rsp, 0x20
pop rbx
jmp fcn.140036717
mov rdx, qword [0x1400fb960]
mov rcx, qword [rdx + rax*8 - 0x5dc0]
call sub.msvcrt.dll_free
movsxd rdx, dword [rbx + 4]
mov rax, qword [0x1400fb960]
xor ecx, ecx
lea rax, [rax + rdx*8 - 0x5dc0]
xor edx, edx
mov qword [rax], rdx
mov rdx, qword [rbx + 0x20]
mov qword [rax], rdx
mov qword [rbx + 0x20], rcx
add rsp, 0x20
pop rbx
ret

Function at 0x14001d133
Capabilities:
Print debug messages

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa0
movsxd rbx, ecx
mov rbp, rdx
test rdx, rdx
je 0x14001d159
mov r12, qword [rdx + 0x18]
test r12, r12
je 0x14001d159
cmp ebx, 9
jbe 0x14001d172
lea rcx, str.localization:_invalid_parameter_for_add_dialog_command_n
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.140036717
lea eax, [rbx + 0x30]
mov rcx, r12
mov rsi, r12
mov byte [rsp + 0x20], al
mov al, byte [rdx]
add eax, 0x30
mov byte [rsp + 0x21], al
call sub.msvcrt.dll_strlen
lea rdx, [rsp + 0x22]
lea rcx, [rax + 1]
mov eax, 0x7e
mov rdi, rdx
cmp rcx, rax
cmova rcx, rax
mov ecx, ecx
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
call sub.msvcrt.dll_strlen
lea rcx, [rsp + 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x7e
mov edx, 0x7d
cmovae rax, rdx
lea rdx, [0x14010b9e0]
mov byte [rsp + rax + 0x22], 0
call fcn.140034600
test eax, eax
je 0x14001d21d
mov eax, eax
imul rsi, rax, 0x18
mov rax, qword [0x14010b9e0]
mov rcx, qword [rax + rsi + 0x10]
test rcx, rcx
je 0x14001d211
mov rax, qword [rcx + 0x28]
mov rdx, qword [rcx + 0x30]
mov qword [rdx], rax
mov qword [rax + 8], rdx
xor eax, eax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
call fcn.14001d0f8
mov rax, qword [0x14010b9e0]
mov qword [rax + rsi + 0x10], rbp
shl rbx, 5
lea r8, [0x14007ccc0]
lea rdx, [rbp + 0x28]
lea rax, [r8 + rbx]
lea r8, [r8 + rbx + 0x10]
mov rcx, qword [rax + 0x18]
mov qword [rbp + 0x28], r8
mov qword [rbp + 0x30], rcx
mov qword [rcx], rdx
mov qword [rax + 0x18], rdx
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret