joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140040950
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x60
xor ebx, ebx
lea rax, [r11 + 8]
mov qword [r11 - 0x20], rbx
mov rbp, rdx
mov qword [r11 - 0x28], rbx
xor r9d, r9d
mov qword [r11 - 0x30], rbx
xor r8d, r8d
mov qword [r11 - 0x38], rbx
xor edx, edx
mov qword [r11 - 0x40], rax
mov rcx, rbp
mov qword [r11 - 0x48], rbx
mov qword [r11 - 0x50], rbx
mov qword [r11 - 0x58], rbx
mov dword [r11 + 8], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1400409a8
xor eax, eax
jmp 0x140040a22
mov esi, 1
cmp dword [rsp + 0x80], esi
jne 0x140040a16
mov ecx, 0x2000
mov dword [rsp + 0x90], 0x1000
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400409a4
mov qword [rsp + 0x38], rbx
lea r9, [rsp + 0x90]
mov qword [rsp + 0x30], rbx
mov r8, rax
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x140040a07
cmp word [rdi], bx
jne 0x140040a09
mov esi, ebx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov eax, esi
jmp 0x140040a22
cmp dword [rsp + 0x80], ebx
seta bl
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400413c8
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x198]
sub rsp, 0x280
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401543b0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov r9d, 0x2001f
mov r8, rdx
mov rdx, qword [rcx]
lea rcx, [rsp + 0x48]
call fcn.140041018
jmp 0x140041433
lea rdx, [rsp + 0x70]
call fcn.1400413c8
xor ecx, ecx
test eax, eax
mov ebx, eax
jne 0x14004148e
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x40], 0x100
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
lea rcx, [rsp + 0x48]
test eax, eax
je 0x140041429
call fcn.14003ff40
mov rdx, rsi
mov rcx, rdi
call fcn.14004055c
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.14003ff40
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14001ff30
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004165c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], rdi
mov rax, qword [0x1401543b0]
xor rax, rbp
mov qword [rbp + 0x20], rax
mov rbx, r9
mov rsi, r8
mov rax, rdx
xor edi, edi
mov qword [rbp], rdi
mov qword [rbp + 0x10], rcx
mov qword [rbp + 8], rdi
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov r15, rax
test rax, rax
jne 0x1400416dd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140041861
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140041861
xor r9d, r9d
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FindResourceExW]
mov rbx, rax
test rax, rax
jne 0x140041715
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140041857
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140041857
mov rdx, rax
mov rcx, r15
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x1400416f7
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov rsi, r14
mov r12d, eax
movabs r13, 0xffffffffffffff0
cmp byte [r12 + r14], dil
je 0x1400417b3
lea esi, [rax + 1]
cmp esi, 0x400
ja 0x140041782
mov ebx, esi
mov ecx, esi
call fcn.140042720
test al, al
je 0x140041782
lea rax, [rsi + 0xf]
cmp rax, rbx
ja 0x14004176f
mov rax, r13
and rax, 0xfffffffffffffff0
call fcn.140021440
sub rsp, rax
lea rsi, [rsp + 0x30]
jmp 0x140041792
mov ebx, esi
mov edx, esi
lea rcx, [rbp]
call fcn.14003feb0
mov rsi, rax
test rsi, rsi
jne 0x1400417a1
mov ebx, 0x8007000e
jmp 0x140041857
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov byte [r12 + rsi], dil
test rsi, rsi
je 0x140041842
or r12, 0xffffffffffffffff
mov r14, r12
inc r14
cmp byte [rsi + r14], dil
jne 0x1400417c3
inc r14d
movsxd rbx, r14d
add rbx, rbx
cmp rbx, 0x400
ja 0x140041809
mov rcx, rbx
call fcn.140042720
test al, al
je 0x140041809
lea rax, [rbx + 0xf]
cmp rax, rbx
ja 0x1400417f6
mov rax, r13
and rax, 0xfffffffffffffff0
call fcn.140021440
sub rsp, rax
lea rbx, [rsp + 0x30]
jmp 0x140041818
mov rdx, rbx
lea rcx, [rbp]
call fcn.14003feb0
mov rbx, rax
test rbx, rbx
je 0x140041842
mov word [rbx], di
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
mov r9d, r12d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
neg eax
sbb rdi, rdi
and rdi, rbx
mov r8d, dword [rbp + 0x80]
mov rdx, rdi
lea rcx, [rbp + 8]
call fcn.1400414d0
mov ebx, eax
mov rcx, r15
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop
lea rcx, [rbp]
call fcn.14003f444
mov eax, ebx
mov rcx, qword [rbp + 0x20]
xor rcx, rbp
call fcn.14001ff30
mov rbx, qword [rbp + 0x60]
mov rsi, qword [rbp + 0x68]
mov rdi, qword [rbp + 0x70]
lea rsp, [rbp + 0x30]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400421d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp word [rdx], 0
mov r14, rdx
mov rbx, rcx
jne 0x1400421fd
mov rax, rcx
jmp 0x140042289
cmp word [rcx], 0
je 0x140042287
cmp word [rbx], 0
mov rdi, rbx
mov rsi, r14
je 0x14004226f
cmp word [rsi], 0
je 0x1400422a4
movzx ecx, word [rdi]
movzx eax, word [rsi]
cmp ecx, eax
jne 0x14004226f
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
sub rax, rsi
mov rcx, rbp
sub rcx, rdi
xor rax, rcx
test rax, 0xfffffffffffffffe
jne 0x14004226f
jmp 0x140042264
add rdi, 2
add rsi, 2
movzx ecx, word [rsi]
movzx eax, word [rdi]
cmp eax, ecx
je 0x140042269
cmp rdi, rbp
jb 0x140042252
cmp word [rdi], 0
jne 0x140042213
cmp word [rsi], 0
je 0x1400422a4
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharNextW]
mov rbx, rax
cmp word [rax], 0
jne 0x140042207
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rbx
jmp 0x140042289
Function at 0x1400427b8
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x1c0
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x1c0], rbx
mov qword [rbp + 0x1c8], rsi
mov qword [rbp + 0x1d0], rdi
mov rax, qword [0x1401543b0]
xor rax, rbp
mov qword [rbp + 0x190], rax
mov eax, dword [0x14015505c]
mov r15d, 1
test r15b, al
jne 0x140042836
or eax, r15d
lea rcx, [rbp + 0x70]
mov ebx, VarUI4FromDisp
mov dword [0x14015505c], eax
mov r8d, ebx
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [rbp + 0x70]
mov dword [rbp + 0x70], ebx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetVersionExW]
mov eax, dword [rbp + 0x80]
mov dword [0x140154b70], eax
mov eax, dword [rsp]
sub rsp, 0x10
lea rsi, [rsp + 0x20]
mov eax, dword [rsi]
mov r8d, 0x30
lea rdx, [rbp + 8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_VirtualQuery]
test rax, rax
jne 0x140042863
xor eax, eax
jmp 0x140042930
mov rbx, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetSystemInfo]
mov eax, dword [rbp + 0x3c]
mov edx, 0x11000
mov ecx, dword [0x140154b70]
mov r14d, eax
lea edi, [rax - 1]
not rdi
and rdi, rsi
sub rdi, rax
mov eax, 0x2000
cmp ecx, r15d
cmove eax, edx
movsxd rsi, eax
add rsi, rbx
cmp rdi, rsi
jb 0x14004285c
cmp ecx, r15d
je 0x140042910
mov r8d, 0x30
lea rdx, [rbp + 8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_VirtualQuery]
test rax, rax
je 0x14004285c
add rbx, qword [rbp + 0x20]
test dword [rbp + 0x28], 0x1000
je 0x1400428a9
test dword [rbp + 0x2c], 0x100
mov rbx, qword [rbp + 8]
je 0x1400428e0
mov eax, r15d
jmp 0x140042930
cmp rdi, rbx
jb 0x14004285c
cmp rbx, rsi
mov r9d, 4
mov r8d, 0x1000
mov rdx, r14
cmovb rbx, rsi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_VirtualAlloc]
mov ecx, dword [0x140154b70]
jmp 0x140042913
mov rbx, rdi
cmp ecx, r15d
lea r9, [rbp]
mov r8d, 0x104
mov rdx, r14
cmove r8d, r15d
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_VirtualProtect]
mov rcx, qword [rbp + 0x190]
xor rcx, rbp
call fcn.14001ff30
mov rbx, qword [rbp + 0x1c0]
mov rsi, qword [rbp + 0x1c8]
mov rdi, qword [rbp + 0x1d0]
lea rsp, [rbp + 0x1a0]
pop r15
pop r14
pop rbp
ret
Function at 0x140047308
Capabilities:
Get common file path
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r15
lea rbp, [rax - 0x6a8]
sub rsp, 0x790
mov rax, qword [0x1401543b0]
xor rax, rsp
mov qword [rbp + 0x680], rax
mov rbx, rdx
mov dword [rsp + 0x48], 0xb21
xor edx, edx
mov dword [rsp + 0x4c], 1
lea r15, str.base_stor_vssmodulescoord_srccoord.cxx
mov dword [rsp + 0x50], 0xff
lea r12, str.CVssCoordinator::IsBootVolume
mov qword [rsp + 0x30], r15
lea r13, str.CORCOORC
mov qword [rsp + 0x38], r12
lea r8d, [rdx + 0x78]
mov qword [rsp + 0x40], r13
lea rcx, [rsp + 0x58]
mov dword [rbp - 0x30], 0x1000000
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.140003840
mov edx, 0x105
lea rcx, [rbp + 0x260]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetSystemDirectoryW]
test eax, eax
je 0x14004747d
mov r8d, 0x104
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x260]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetVolumePathNameW]
test eax, eax
je 0x14004747d
mov r8d, 0x104
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x14004740d
mov rdx, rbx
lea rcx, [rbp + 0x470]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
sete dl
jmp 0x14004747f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140047422
movzx ebx, ax
or ebx, 0x80070000
xor edx, edx
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x48], 0xb2d
lea r8d, [rdx + 0x78]
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0xff
mov dword [rbp - 0x30], 0x1000000
call sub.msvcrt.dll_memset
lea r9, [rbp + 0x50]
mov dword [rsp + 0x20], ebx
lea r8, str.GetVolumeNameForVolumeMountPoint__s__failed_with_0x_08lx
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.1400037d0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.140013f94
lea rcx, [rbp - 0x20]
mov bl, al
call fcn.140003960
mov al, bl
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.14001ff30
lea r11, [rsp + 0x790]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop rbp
ret
Function at 0x14004f070
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov r14, rcx
mov r15, 0xffffffff80000002
mov rcx, r15
mov rdx, r8
mov rsi, r8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteTreeW]
mov ebx, eax
cmp eax, 2
jne 0x14004f11f
lea rax, str.base_stor_vssmodulescoord_src_reg_util.cxx
mov dword [rbp - 0x51], 0x5a
mov qword [rbp - 0x69], rax
lea r8d, [rbx + 0x76]
lea rax, str.RecursiveDeleteKey
mov dword [rbp - 0x4d], 1
mov qword [rbp - 0x61], rax
lea rcx, [rbp - 0x41]
lea rax, str.CORREGUC
mov dword [rbp - 0x49], 0xff
xor edx, edx
mov qword [rbp - 0x59], rax
mov dword [rbp + 0x37], 0x1000000
call sub.msvcrt.dll_memset
lea r9, str.Key_with_path__p_s_not_found
mov qword [rsp + 0x28], rsi
mov r8d, 0x80042308
mov qword [rsp + 0x20], r15
lea rdx, [rbp - 0x69]
mov rcx, r14
call fcn.1400b8238
int3
test eax, eax
je 0x14004f19d
lea rax, str.base_stor_vssmodulescoord_src_reg_util.cxx
mov dword [rbp - 0x51], 0x5d
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x41]
xor edx, edx
mov dword [rbp - 0x4d], 1
lea rax, str.RecursiveDeleteKey
mov dword [rbp - 0x49], 0xff
mov qword [rbp - 0x61], rax
lea rax, str.CORREGUC
mov qword [rbp - 0x59], rax
lea r8d, [rdx + 0x78]
mov dword [rbp + 0x37], 0x1000000
call sub.msvcrt.dll_memset
test ebx, ebx
jle 0x14004f17c
movzx ebx, bx
or ebx, 0x80070000
mov qword [rsp + 0x28], rsi
lea r9, str.SHDeleteKey__p__s_
mov r8d, ebx
mov qword [rsp + 0x20], r15
lea rdx, [rbp - 0x69]
mov rcx, r14
call fcn.1400b8b90
int3
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140076284
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x140
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rbx, rdx
lea r14, str.base_stor_vssmodulescoord_srchwwrpdb.cxx
mov qword [rsp + 0x20], r14
lea r15, str.CVssHardwareProviderWrapper::DeleteDatabase
mov qword [rsp + 0x28], r15
lea r12, str.CORHWDBC
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x38], 0x179
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x40], 0xff
mov dword [rbp - 0x40], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x48]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x30]
call fcn.140003840
nop
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_DeleteFileW]
test eax, eax
jne 0x140076389
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x140076332
movzx eax, ax
or eax, 0x80070000
mov dword [rbp - 0x28], eax
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x38], 0x181
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x40], 0xff
mov dword [rbp - 0x40], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x48]
call sub.msvcrt.dll_memset
lea r8, str.DeleteFile
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x30]
call fcn.1400139c0
nop
lea rcx, [rbp - 0x30]
call fcn.140003960
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400763c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov rcx, rdx
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret
Function at 0x1400763e4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r13
push r15
lea rbp, [rax - 0x288]
sub rsp, 0x370
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x1401543b0]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov rbx, rcx
lea r15, str.base_stor_vssmodulescoord_srchwwrpdb.cxx
mov qword [rsp + 0x28], r15
lea r12, str.CVssHardwareProviderWrapper::GetBootDrive
mov qword [rsp + 0x30], r12
lea r13, str.CORHWDBC
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x40], 0x49
mov dword [rsp + 0x44], 1
mov dword [rsp + 0x48], 0xff
mov dword [rbp - 0x38], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x20]
call fcn.140003840
nop
mov edx, 0x104
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140076502
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x1400764ac
movzx eax, ax
or eax, 0x80070000
mov dword [rbp - 0x18], eax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x40], 0x50
mov dword [rsp + 0x44], 1
mov dword [rsp + 0x48], 0xff
mov dword [rbp - 0x38], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
lea r8, str.GetSystemDirectory
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x20]
call fcn.1400139c0
mov r8d, 0x104
mov rdx, rbx
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetVolumePathNameW]
test eax, eax
jne 0x140076582
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x14007652b
movzx eax, ax
or eax, 0x80070000
mov dword [rbp - 0x18], eax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x40], 0x56
mov dword [rsp + 0x44], 1
mov dword [rsp + 0x48], 0xff
mov dword [rbp - 0x38], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
lea r8, str.GetVolumePathName
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x20]
call fcn.1400139c0
nop
lea rcx, [rbp - 0x20]
call fcn.140003960
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.14001ff30
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop rbp
ret
Function at 0x14007704c
Capabilities:
Move file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r8
mov rdi, rdx
lea r15, str.base_stor_vssmodulescoord_srchwwrpdb.cxx
mov qword [rsp + 0x20], r15
lea r12, str.CVssHardwareProviderWrapper::MoveDatabase
mov qword [rsp + 0x28], r12
lea r13, str.CORHWDBC
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x38], 0x161
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x40], 0xff
mov dword [rbp - 0x40], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x48]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x30]
call fcn.140003840
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l2_1_1.dll_MoveFileExW]
test eax, eax
jne 0x140077159
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x140077102
movzx eax, ax
or eax, 0x80070000
mov dword [rbp - 0x28], eax
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x38], 0x16f
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x40], 0xff
mov dword [rbp - 0x40], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x48]
call sub.msvcrt.dll_memset
lea r8, str.MoveFileEx
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x30]
call fcn.1400139c0
nop
lea rcx, [rbp - 0x30]
call fcn.140003960
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x140097100
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x150
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
lea r14, str.base_stor_vssmodulescoord_srchwutils.cxx
mov qword [rsp + 0x30], r14
lea r15, str.CVssHardwareProviderWrapper::GetLocalComputerName
mov qword [rsp + 0x38], r15
lea r12, str.CORHWUTC
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], 0x903
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0xff
xor edi, edi
mov dword [rbp - 0x30], 0x1000000
lea ebx, [rdi + 0x78]
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.140003840
nop
mov dword [rbp + 0x80], edi
lea r8, [rbp + 0x80]
xor edx, edx
lea ecx, [rdi + 3]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetComputerNameExW]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 0xea
je 0x140097215
test eax, eax
jle 0x1400971c0
movzx eax, ax
or eax, 0x80070000
mov dword [rbp - 0x18], eax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], 0x90e
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0xff
mov dword [rbp - 0x30], 0x1000000
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
lea r8, str.GetComputerName
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.1400139c0
mov ecx, dword [rbp + 0x80]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
lea rdx, [0x14015452c]
mov rcx, rax
call fcn.14002016c
mov rbx, rax
test rax, rax
jne 0x14009729f
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], 0x914
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0xff
mov dword [rbp - 0x30], 0x1000000
xor edx, edx
lea r8d, [rax + 0x78]
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
lea r9, str.Cannot_allocate_space_for_computer_name
mov r8d, 0x8007000e
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.1400b8238
int3
lea r8, [rbp + 0x80]
mov rdx, rax
mov ecx, 3
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetComputerNameExW]
test eax, eax
jne 0x140097329
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x1400972ca
movzx eax, ax
or eax, 0x80070000
mov dword [rbp - 0x18], eax
mov rcx, rbx
call fcn.14001fa98
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], 0x91b
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0xff
mov dword [rbp - 0x30], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
lea r8, str.GetComputerName
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.1400b9c70
int3
mov qword [rsp + 0x20], rbx
lea r9, str.Returning_string:__s
mov r8d, 0xaa
lea rdx, str.RETURN
lea rcx, [rbp - 0x20]
call fcn.1400035a0
nop
lea rcx, [rbp - 0x20]
call fcn.140003960
mov rax, rbx
mov rbx, qword [rsp + 0x190]
add rsp, 0x150
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret