joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cba80
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword gs:[0x58]
mov ecx, dword [0x1402374f4]
mov edx, 0x1c
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140210930], eax
jg 0x1400cbc6b
mov ecx, dword [0x140210928]
test ecx, ecx
je 0x1400cbac5
lea eax, [rcx - 1]
test eax, eax
jne 0x1400cbc54
lea r9, [rbp + 0x10]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140142980]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400cbc4e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x68], rdi
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x60], r14
xor r14d, r14d
mov qword [rbp - 0x30], r14
mov edx, r14d
mov dword [rbp - 0x28], edx
mov ecx, r14d
mov dword [rbp - 0x24], ecx
test rdi, rdi
je 0x1400cbb69
cmp word [rdi], cx
je 0x1400cbb69
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], cx
jne 0x1400cbb24
inc ebx
test ebx, ebx
jle 0x1400cbb44
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.140019590
mov ecx, dword [rbp - 0x24]
mov edx, dword [rbp - 0x28]
lea eax, [rbx + rdx]
mov dword [rbp - 0x28], eax
cmp eax, ecx
jle 0x1400cbb57
lea rcx, [rbp - 0x30]
call fcn.1400191f0
mov rcx, qword [rbp - 0x30]
mov rdx, rdi
movsxd r8, ebx
add r8, r8
call fcn.140032f10
lea r9, [0x140128070]
mov dword [rsp + 0x20], 1
lea r8, [0x14011dca0]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call fcn.14001f930
mov rcx, qword [rax]
mov r9d, dword [rax + 8]
mov qword [rax], r14
mov qword [rbp - 0x40], rcx
mov ecx, dword [rax + 0xc]
mov qword [rax + 8], r14
mov eax, r9d
neg eax
mov dword [rbp - 0x38], r9d
mov dword [rbp - 0x34], ecx
sbb edx, edx
add edx, 2
add edx, r9d
cmp edx, ecx
jle 0x1400cbbc2
lea rcx, [rbp - 0x40]
call fcn.140019590
mov r8d, 1
lea rdx, [0x140128070]
lea rcx, [rbp - 0x40]
call fcn.14001cc20
mov rcx, qword [0x140210920]
mov rsi, qword [rbp - 0x40]
mov ebx, dword [rbp - 0x38]
mov edi, dword [rbp - 0x34]
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
mov r14, qword [rsp + 0x60]
test rcx, rcx
je 0x1400cbc00
call fcn.140044390
mov rcx, qword [rbp - 0x20]
mov qword [0x140210920], rsi
mov rsi, qword [rsp + 0x90]
mov dword [0x140210928], ebx
mov rbx, qword [rsp + 0x88]
mov dword [0x14021092c], edi
mov rdi, qword [rsp + 0x68]
test rcx, rcx
je 0x1400cbc36
call fcn.140044390
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400cbc44
call fcn.140044390
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [0x140210928]
test ecx, ecx
lea rax, [0x14011b550]
cmovne rax, qword [0x140210920]
add rsp, 0x70
pop rbp
ret
lea rcx, [0x140210930]
call fcn.14010f50c
cmp dword [0x140210930], 0xffffffff
jne 0x1400cbab0
lea rcx, [0x140117600]
call fcn.14010f270
lea rcx, [0x140210930]
call fcn.14010f4ac
jmp 0x1400cbab0
Function at 0x1400cbcb0
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x1400cbd43
cmp word [0x140210b80], 0
jne 0x1400cbd37
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
lea rcx, [0x140210b80]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], 0x100
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
movzx eax, word [0x140210b80]
lea rbx, [0x140210b80]
lea rdi, [0x140210b80]
test ax, ax
je 0x1400cbd28
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswalnum]
test eax, eax
je 0x1400cbd1b
movzx eax, word [rbx]
mov word [rdi], ax
add rdi, 2
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x1400cbd04
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
mov word [rdi], cx
mov rdi, qword [rsp + 0x20]
lea rax, [0x140210b80]
add rsp, 0x28
ret
cmp word [0x140210980], 0
jne 0x1400cbd67
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x100
lea rcx, [0x140210980]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rax, [0x140210980]
add rsp, 0x28
ret
Function at 0x1400cbd80
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword gs:[0x58]
mov ecx, dword [0x1402374f4]
mov edx, 0x1c
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140210960], eax
jg 0x1400cbf6b
mov ecx, dword [0x140210958]
test ecx, ecx
je 0x1400cbdc5
lea eax, [rcx - 1]
test eax, eax
jne 0x1400cbf54
lea r9, [rbp + 0x10]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401429a0]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400cbf4e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x68], rdi
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x60], r14
xor r14d, r14d
mov qword [rbp - 0x30], r14
mov edx, r14d
mov dword [rbp - 0x28], edx
mov ecx, r14d
mov dword [rbp - 0x24], ecx
test rdi, rdi
je 0x1400cbe69
cmp word [rdi], cx
je 0x1400cbe69
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], cx
jne 0x1400cbe24
inc ebx
test ebx, ebx
jle 0x1400cbe44
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.140019590
mov ecx, dword [rbp - 0x24]
mov edx, dword [rbp - 0x28]
lea eax, [rbx + rdx]
mov dword [rbp - 0x28], eax
cmp eax, ecx
jle 0x1400cbe57
lea rcx, [rbp - 0x30]
call fcn.1400191f0
mov rcx, qword [rbp - 0x30]
mov rdx, rdi
movsxd r8, ebx
add r8, r8
call fcn.140032f10
lea r9, [0x140128070]
mov dword [rsp + 0x20], 1
lea r8, [0x14011dca0]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call fcn.14001f930
mov rcx, qword [rax]
mov r9d, dword [rax + 8]
mov qword [rax], r14
mov qword [rbp - 0x40], rcx
mov ecx, dword [rax + 0xc]
mov qword [rax + 8], r14
mov eax, r9d
neg eax
mov dword [rbp - 0x38], r9d
mov dword [rbp - 0x34], ecx
sbb edx, edx
add edx, 2
add edx, r9d
cmp edx, ecx
jle 0x1400cbec2
lea rcx, [rbp - 0x40]
call fcn.140019590
mov r8d, 1
lea rdx, [0x140128070]
lea rcx, [rbp - 0x40]
call fcn.14001cc20
mov rcx, qword [0x140210950]
mov rsi, qword [rbp - 0x40]
mov ebx, dword [rbp - 0x38]
mov edi, dword [rbp - 0x34]
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
mov r14, qword [rsp + 0x60]
test rcx, rcx
je 0x1400cbf00
call fcn.140044390
mov rcx, qword [rbp - 0x20]
mov qword [0x140210950], rsi
mov rsi, qword [rsp + 0x90]
mov dword [0x140210958], ebx
mov rbx, qword [rsp + 0x88]
mov dword [0x14021095c], edi
mov rdi, qword [rsp + 0x68]
test rcx, rcx
je 0x1400cbf36
call fcn.140044390
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400cbf44
call fcn.140044390
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [0x140210958]
test ecx, ecx
lea rax, [0x14011b550]
cmovne rax, qword [0x140210950]
add rsp, 0x70
pop rbp
ret
lea rcx, [0x140210960]
call fcn.14010f50c
cmp dword [0x140210960], 0xffffffff
jne 0x1400cbdb0
lea rcx, [0x140117620]
call fcn.14010f270
lea rcx, [0x140210960]
call fcn.14010f4ac
jmp 0x1400cbdb0
Function at 0x1400cbfb0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x488
mov rax, qword [0x1401664b8]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1402374f4]
mov edx, 0x1c
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140210948], eax
jg 0x1400cc1a2
mov ecx, dword [0x140210940]
test ecx, ecx
je 0x1400cc005
lea eax, [rcx - 1]
test eax, eax
jne 0x1400cc179
mov qword [rsp + 0x490], rbx
lea rcx, [rsp + 0x260]
xor edx, edx
mov qword [rsp + 0x480], rdi
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x260]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor edi, edi
mov edx, edi
mov ecx, edi
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], ecx
mov qword [rsp + 0x30], rdi
cmp word [rsp + 0x50], di
je 0x1400cc0dd
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], cx
jne 0x1400cc090
inc ebx
test ebx, ebx
jle 0x1400cc0b3
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140019590
mov ecx, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x38]
lea eax, [rdx + rbx]
mov dword [rsp + 0x38], eax
cmp eax, ecx
jle 0x1400cc0c8
lea rcx, [rsp + 0x30]
call fcn.1400191f0
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x50]
movsxd r8, ebx
add r8, r8
call fcn.140032f10
lea r9, [0x140128070]
mov dword [rsp + 0x20], 1
lea r8, [0x14011dca0]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14001f930
mov rbx, rax
lea rax, [0x140210938]
cmp rax, rbx
je 0x1400cc145
mov rcx, qword [0x140210938]
test rcx, rcx
je 0x1400cc122
call fcn.140044390
mov rcx, qword [rbx]
mov qword [0x140210938], rcx
mov qword [rbx], rdi
mov eax, dword [rbx + 8]
mov dword [0x140210940], eax
mov eax, dword [rbx + 0xc]
mov dword [0x140210944], eax
mov qword [rbx + 8], rdi
mov rcx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x480]
mov rbx, qword [rsp + 0x490]
test rcx, rcx
je 0x1400cc164
call fcn.140044390
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400cc173
call fcn.140044390
mov ecx, dword [0x140210940]
test ecx, ecx
lea rax, [0x14011b550]
cmovne rax, qword [0x140210938]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14010f320
add rsp, 0x488
ret
lea rcx, [0x140210948]
call fcn.14010f50c
cmp dword [0x140210948], 0xffffffff
jne 0x1400cbff0
lea rcx, [0x140117640]
call fcn.14010f270
lea rcx, [0x140210948]
call fcn.14010f4ac
jmp 0x1400cbff0

Function at 0x1400cc3e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r9
test r8d, r8d
je 0x1400cc41f
test rcx, rcx
je 0x1400cc41f
xor eax, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
test rbx, rbx
je 0x1400cc421
mov ecx, dword [rsp + 0x50]
mov dword [rbx], ecx
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x1400d9920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x18], 0
mov rbp, r9
movzx esi, r8b
mov rbx, rdx
mov rdi, rcx
jle 0x1400d9958
add rcx, 0x10
call fcn.14004aa60
test al, al
je case.default.0x1400d9a59
lea rcx, [rdi + 0x20]
mov rdx, rbx
call fcn.14004aa60
test al, al
jne case.default.0x1400d9a59
cmp dword [rdi + 0x38], 0
movzx ebx, byte [rsp + 0x50]
jle 0x1400d99a1
mov rax, qword [rdi + 0x30]
movsxd rcx, dword [rdi + 0x38]
add rcx, rax
cmp rax, rcx
je case.default.0x1400d9a59
nop dword [rax + rax]
cmp byte [rax], bl
je 0x1400d99a1
inc rax
cmp rax, rcx
jne 0x1400d9990
jmp case.default.0x1400d9a59
mov rax, qword [rdi + 0x40]
movsxd rcx, dword [rdi + 0x48]
add rcx, rax
cmp rax, rcx
je 0x1400d99c1
cmp byte [rax], bl
je case.default.0x1400d9a59
inc rax
cmp rax, rcx
jne 0x1400d99b1
cmp dword [rdi + 0x58], 0
jle 0x1400d99f2
mov rax, qword [rdi + 0x50]
movsxd rcx, dword [rdi + 0x58]
add rcx, rax
cmp rax, rcx
je case.default.0x1400d9a59
nop dword [rax + rax]
cmp byte [rax], sil
je 0x1400d99f2
inc rax
cmp rax, rcx
jne 0x1400d99e0
jmp case.default.0x1400d9a59
mov rax, qword [rdi + 0x60]
movsxd rcx, dword [rdi + 0x68]
add rcx, rax
cmp rax, rcx
je 0x1400d9a13
cmp byte [rax], sil
je case.default.0x1400d9a59
inc rax
cmp rax, rcx
jne 0x1400d9a02
cmp bl, 5
jne 0x1400d9a3f
cmp dword [rdi + 0x78], 0
mov rdx, rbp
jle 0x1400d9a2f
lea rcx, [rdi + 0x70]
call fcn.14004aa60
jmp 0x1400d9ab0
lea rcx, [rdi + 0x80]
call fcn.14004aa60
test al, al
jne case.default.0x1400d9a59
movsxd rax, dword [rdi + 8]
cmp eax, 0xd
ja case.default.0x1400d9a59
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0xd9ac8]
add rcx, rdx
jmp rcx
cmp bl, 5
setne al
jmp 0x1400d9ab0
mov al, 1
jmp 0x1400d9ab0
movzx eax, byte [rsp + 0x60]
jmp 0x1400d9ab0
movzx eax, byte [rsp + 0x60]
xor al, 1
jmp 0x1400d9ab0
sub bl, 4
cmp bl, 1
setbe al
jmp 0x1400d9ab0
movzx eax, byte [rsp + 0x58]
jmp 0x1400d9ab0
cmp bl, 4
sete al
jmp 0x1400d9ab0
cmp bl, 5
sete al
jmp 0x1400d9ab0
sub bl, 3
test bl, 0xfd
setne al
jmp 0x1400d9ab0
cmp bl, 5
je case.default.0x1400d9a59
cmp bl, 2
jne case.0x1400d9a59.2
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f34b0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1401664b8]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor ebx, ebx
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x38], rbx
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x60]
mov r15, rdx
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
mov r13, rcx
mov r12d, ebx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x1400f3632
test eax, eax
jne 0x1400f365e
mov rsi, rbx
mov qword [rsp + 0x48], rbx
mov edi, ebx
mov qword [rsp + 0x50], 0
mov r14d, ebx
cmp word [rsp + 0x60], ax
je 0x1400f35b7
lea rax, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400f3555
inc ebx
test ebx, ebx
jle 0x1400f357f
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140019590
mov r14d, dword [rsp + 0x54]
mov edi, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov edx, edi
add edi, ebx
mov dword [rsp + 0x50], edi
cmp edi, r14d
jle 0x1400f35a4
lea rcx, [rsp + 0x48]
call fcn.1400191f0
mov r14d, dword [rsp + 0x54]
mov edi, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
movsxd r8, ebx
lea rdx, [rsp + 0x60]
add r8, r8
mov rcx, rsi
call fcn.140032f10
movsxd rbx, dword [r15 + 8]
lea eax, [rbx + 1]
mov dword [r15 + 8], eax
cmp eax, dword [r15 + 0xc]
jle 0x1400f35d2
mov edx, ebx
mov rcx, r15
call fcn.1400190f0
mov rax, rbx
lea r9, [rsp + 0x40]
xor ebx, ebx
shl rax, 4
add rax, qword [r15]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rbx
inc r12d
mov qword [rsp + 0x30], rbx
mov edx, r12d
mov qword [rsp + 0x28], rbx
mov rcx, r13
mov qword [rax], rsi
mov dword [rax + 8], edi
mov dword [rax + 0xc], r14d
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x1400f3524
mov al, 1
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14010f320
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor al, al
jmp 0x1400f3634
Function at 0x1400f3670
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1401664b8]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor ebx, ebx
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x38], rbx
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x60]
mov r15, rdx
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
mov r13, rcx
mov r12d, ebx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x1400f37f2
test eax, eax
jne 0x1400f381e
mov rsi, rbx
mov qword [rsp + 0x48], rbx
mov edi, ebx
mov qword [rsp + 0x50], 0
mov r14d, ebx
cmp word [rsp + 0x60], ax
je 0x1400f3777
lea rax, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400f3715
inc ebx
test ebx, ebx
jle 0x1400f373f
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140019590
mov r14d, dword [rsp + 0x54]
mov edi, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov edx, edi
add edi, ebx
mov dword [rsp + 0x50], edi
cmp edi, r14d
jle 0x1400f3764
lea rcx, [rsp + 0x48]
call fcn.1400191f0
mov r14d, dword [rsp + 0x54]
mov edi, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
movsxd r8, ebx
lea rdx, [rsp + 0x60]
add r8, r8
mov rcx, rsi
call fcn.140032f10
movsxd rbx, dword [r15 + 8]
lea eax, [rbx + 1]
mov dword [r15 + 8], eax
cmp eax, dword [r15 + 0xc]
jle 0x1400f3792
mov edx, ebx
mov rcx, r15
call fcn.1400190f0
mov rax, rbx
lea r9, [rsp + 0x40]
xor ebx, ebx
shl rax, 4
add rax, qword [r15]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], rbx
inc r12d
mov qword [rsp + 0x30], rbx
mov edx, r12d
mov qword [rsp + 0x28], rbx
mov rcx, r13
mov qword [rax], rsi
mov dword [rax + 8], edi
mov dword [rax + 0xc], r14d
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x1400f36e4
mov al, 1
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14010f320
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor al, al
jmp 0x1400f37f4
Function at 0x1400f8760
Capabilities:
Get file version info

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
cmp dword [rdx + 8], 0
lea rsi, [0x14011b550]
mov rdi, rdx
je 0x1400f877d
mov rcx, qword [rdx]
jmp 0x1400f8780
mov rcx, rsi
xor edx, edx
mov qword [rsp + 0x50], rbx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
je 0x1400f8840
xor ebx, ebx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x2c], ebx
test eax, eax
jle 0x1400f87ba
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14003ea60
mov rbx, qword [rsp + 0x20]
cmp dword [rdi + 8], 0
je 0x1400f87c3
mov rsi, qword [rdi]
mov r9, rbx
mov r8d, ebp
xor edx, edx
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400f8833
lea r9, [rsp + 0x58]
mov rcx, rbx
lea r8, [rsp + 0x60]
lea rdx, str.StringFileInfo040904b0ShellIntegrationVersion
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400f8833
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov rdx, qword [rsp + 0x68]
mov edi, eax
cmp word [rdx], 0
jne 0x1400f8833
test rbx, rbx
je 0x1400f8824
mov rcx, rbx
call fcn.140044390
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
test rbx, rbx
je 0x1400f8840
mov rcx, rbx
call fcn.140044390
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400fc890
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push r12
push r14
sub rsp, 0x38
mov r14, rcx
lea rbp, [0x14011b550]
xor ecx, ecx
mov rsi, r8
mov r12, rdx
mov dword [rsp + 0x70], ecx
cmp dword [r8 + 8], ecx
je 0x1400fc8bc
mov rdx, qword [r8]
jmp 0x1400fc8bf
mov rdx, rbp
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400fc9a6
mov eax, dword [rsp + 0x78]
mov dword [r14], eax
mov eax, dword [rsp + 0x70]
mov qword [rsp + 0x60], rbx
movsxd rbx, dword [r14 + 0x10]
mov qword [rsp + 0x68], rdi
cmp eax, ebx
jle 0x1400fc93c
mov qword [rsp + 0x30], r15
mov r15d, eax
sub r15d, ebx
mov dword [r14 + 0x10], eax
cmp eax, dword [r14 + 0x14]
jle 0x1400fc924
mov edx, ebx
lea rcx, [r14 + 8]
call fcn.14003ea60
mov rcx, rbx
movsxd r8, r15d
add rcx, qword [r14 + 8]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r15, qword [rsp + 0x30]
jmp 0x1400fc953
jge 0x1400fc953
mov ecx, ebx
sub ecx, eax
je 0x1400fc953
sub ebx, ecx
lea rcx, [r14 + 8]
mov dword [r14 + 0x10], ebx
call fcn.14007b290
cmp dword [rsi + 8], 0
mov rbx, qword [rsp + 0x60]
je 0x1400fc961
mov rbp, qword [rsi]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rax, qword [r14 + 8]
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdi, qword [rsp + 0x68]
test eax, eax
jne 0x1400fc9a6
mov eax, dword [r14 + 0x10]
cmp dword [rsp + 0x70], eax
jne 0x1400fc9a6
mov al, 1
add rsp, 0x38
pop r14
pop r12
pop rsi
pop rbp
ret
xor al, al
add rsp, 0x38
pop r14
pop r12
pop rsi
pop rbp
ret
Function at 0x1401005c0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
lea rbp, [rsp - 0x178]
sub rsp, 0x278
mov rax, qword [0x1401664b8]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov r15, rcx
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8026
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14010076f
mov qword [rsp + 0x2a0], rsi
xor esi, esi
mov qword [rsp + 0x2a8], rdi
mov edi, esi
mov qword [rsp + 0x270], r14
mov r14d, esi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
cmp word [rsp + 0x50], si
je 0x1401006c6
mov qword [rsp + 0x298], rbx
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], si
jne 0x140100654
inc ebx
test ebx, ebx
jle 0x14010067d
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140019590
mov r14d, dword [rsp + 0x3c]
mov edi, dword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov edx, edi
add edi, ebx
mov dword [rsp + 0x38], edi
cmp edi, r14d
jle 0x1401006a2
lea rcx, [rsp + 0x30]
call fcn.1400191f0
mov r14d, dword [rsp + 0x3c]
mov edi, dword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
movsxd r8, ebx
lea rdx, [rsp + 0x50]
add r8, r8
mov rcx, rsi
call fcn.140032f10
mov rbx, qword [rsp + 0x298]
mov eax, 0x1d
test edi, edi
jne 0x1401006cb
mov eax, 0x1e
lea edx, [rdi + rax]
mov qword [rsp + 0x40], rsi
mov rsi, qword [rsp + 0x2a0]
cmp edx, r14d
mov dword [rsp + 0x48], edi
mov rdi, qword [rsp + 0x2a8]
mov dword [rsp + 0x4c], r14d
mov r14, qword [rsp + 0x270]
jle 0x140100703
lea rcx, [rsp + 0x40]
call fcn.140019590
mov r8d, 0x1c
lea rdx, str.MSBuild_14.0_bin_MSBuild.exe
lea rcx, [rsp + 0x40]
call fcn.14001e570
lea rcx, [rsp + 0x40]
call fcn.14009d3d0
test al, al
je 0x140100760
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.140010b80
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140100744
call fcn.140044390
mov al, 1
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14010f320
add rsp, 0x278
pop r15
pop rbp
ret
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14010076f
call fcn.140044390
mov r9, r15
lea r8, str.MSBuild.exe
lea rdx, str.MSBuildToolsPath
lea rcx, str.MicrosoftMSBuildToolsVersions14.0
call fcn.140100920
test al, al
jne 0x140100744
mov r9, r15
lea r8, str.MSBuild15.0_binMSBuild.exe
lea rdx, str.15.0
lea rcx, str.MicrosoftVisualStudioSxSVS7
call fcn.140100920
test al, al
jne 0x140100744
mov r9, r15
lea r8, str.MSBuild.exe
lea rdx, str.MSBuildToolsPath
lea rcx, str.MicrosoftMSBuildToolsVersions12.0
call fcn.140100920
test al, al
jne 0x140100744
mov r9, r15
lea r8, str.MSBuild.exe
lea rdx, str.MSBuildToolsPath
lea rcx, str.MicrosoftMSBuildToolsVersions4.0
call fcn.140100920
test al, al
jne 0x140100744
jmp 0x140100746