joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400593f0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rdi
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov rbp, rcx
mov qword [rsp + 0x48], rsi
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov rsi, rdx
mov qword [rsp + 0x20], r14
call qword [sym.imp.USER32.dll_GetDC]
mov rdi, rax
test rax, rax
je 0x1400594cc
xor r9d, r9d
lea edx, [rbx + 0x31]
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageA]
test rax, rax
je 0x1400594cc
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
test rsi, rsi
jne 0x140059492
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
test eax, eax
jle 0x1400594cc
lea r14d, [rax + 1]
movsxd rcx, r14d
lea edx, [rbx + 2]
call fcn.1400c537c
mov rbx, rax
test rax, rax
je 0x1400594cc
mov r8d, r14d
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x1400594cc
mov r8d, esi
mov rdx, rbx
jmp 0x1400594be
mov rcx, rsi
call fcn.140051830
mov rbx, rax
test rax, rax
je 0x1400594cc
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400594b0
mov rdx, rax
lea r9, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov rcx, rbx
call fcn.1400e9080
mov r14, qword [rsp + 0x20]
lea rax, [rdi - 1]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
cmp rax, 0xfffffffffffffffd
ja 0x1400594f9
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rax, qword [rsp + 0x50]
add rsp, 0x28
pop rdi
pop rbp
ret
Function at 0x14005bf00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rdx
lea rcx, [rsp + 0x70]
mov r14d, 0x104
xor edx, edx
mov r8d, r14d
mov r15, r9
call fcn.140136960
xor esi, esi
mov dword [rsp + 0x58], 0xffffffff
xor eax, eax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x5c], 4
mov dword [r15], eax
test rdi, rdi
je 0x14005c0f0
mov rax, 0xffffffffffffffff
mov rbx, rax
nop dword [rax + rax]
inc rbx
cmp byte [rdi + rbx], sil
jne 0x14005bf80
test rbx, rbx
je 0x14005bf9c
nop
cmp byte [rdi + rbx], 0x5c
je 0x14005bfd1
sub rbx, 1
jne 0x14005bf90
lea rax, [rsp + 0x60]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14005c043
mov qword [rsp + 0x60], rsi
jmp 0x14005c0dc
cmp rbx, r14
jae 0x14005c0f0
nop word [rax + rax]
inc rax
cmp byte [rdi + rax], sil
jne 0x14005bfe0
inc rax
lea rcx, [rsp + 0x70]
cmp rax, r14
mov rdx, rdi
cmovb r14, rax
mov r8, r14
call fcn.1401362c0
lea rax, [rsp + 0x50]
mov byte [rsp + r14 + 0x6f], sil
mov byte [rsp + rbx + 0x70], sil
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
inc rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14005c08b
mov qword [rsp + 0x50], rsi
jmp 0x14005c0cc
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, str.Akeo_ConsultingRufus
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14005c08b
mov qword [rsp + 0x50], rsi
jmp 0x14005c0cc
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x14005c0c7
test eax, eax
jne 0x14005c0cc
cmp dword [rsp + 0x58], 4
jne 0x14005c0cc
cmp dword [rsp + 0x5c], esi
jbe 0x14005c0cc
mov esi, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14005c0dc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14005c0ec
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x14005c0f2
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400b1f80
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x190
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400678e0
Capabilities:
Get graphical window text

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rcx, qword [0x1401e86f0]
xor eax, eax
xor r9d, r9d
mov qword [rbp - 0x48], rax
xor r8d, r8d
mov qword [rbp - 0x34], rax
mov edx, 0x147
mov qword [rbp - 0x50], 0x55
mov dword [rbp - 0x40], 0x55
mov qword [rbp - 0x3c], 0xaa
mov dword [rbp - 0x2c], 0xff
mov dword [rbp - 0x28], 0x55
mov qword [rbp - 0x24], 0xaa
mov dword [rbp - 0x1c], 0xff
mov dword [rbp - 0x18], 0x33
mov qword [rbp - 0x14], 0xcc
mov dword [rbp - 0xc], 0xff
mov dword [rbp - 8], 0x1c71c7
mov dword [rbp - 4], 0xe38e38
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rdx, eax
mov ecx, 3
add rdx, rdx
cmp eax, 2
cmovge eax, ecx
mov ecx, dword [rbp + rdx*8 - 0x44]
mov r9d, dword [rbp + rdx*8 - 0x48]
mov r8d, dword [rbp + rdx*8 - 0x4c]
mov edx, dword [rbp + rdx*8 - 0x50]
mov dword [rsp + 0x20], ecx
lea ecx, [rax + 0xc51]
call fcn.1400207e0
mov rcx, qword [0x1401e86f0]
mov rdx, rax
mov r8d, 0xffffffff
add rsp, 0x80
pop rbp
jmp fcn.140055ec0
Function at 0x1400681e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r12d, r8d
mov rdi, rdx
mov r15, rcx
mov r14d, 0x104
mov r8d, r14d
lea rcx, [rsp + 0x70]
xor edx, edx
mov r13, r9
call fcn.140136960
mov eax, dword [rbp + 0xf0]
xor esi, esi
mov r8d, eax
mov qword [rsp + 0x60], rsi
xor edx, edx
mov qword [rsp + 0x50], rsi
mov rcx, r13
mov dword [rsp + 0x58], 0xffffffff
mov dword [rsp + 0x5c], eax
call fcn.140136960
test rdi, rdi
je 0x1400683d2
mov rax, 0xffffffffffffffff
mov rbx, rax
nop
inc rbx
cmp byte [rdi + rbx], sil
jne 0x140068270
test rbx, rbx
je 0x14006828c
nop
cmp byte [rdi + rbx], 0x5c
je 0x1400682bd
sub rbx, 1
jne 0x140068280
lea rax, [rsp + 0x60]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140068325
mov qword [rsp + 0x60], rsi
jmp 0x1400683be
cmp rbx, r14
jae 0x1400683d2
inc rax
cmp byte [rdi + rax], sil
jne 0x1400682c6
inc rax
lea rcx, [rsp + 0x70]
cmp rax, r14
mov rdx, rdi
cmovb r14, rax
mov r8, r14
call fcn.1401362c0
lea rax, [rsp + 0x50]
mov byte [rsp + r14 + 0x6f], sil
mov byte [rsp + rbx + 0x70], sil
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r15
inc rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14006836d
mov qword [rsp + 0x50], rsi
jmp 0x1400683ae
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, str.Akeo_ConsultingRufus
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14006836d
mov qword [rsp + 0x50], rsi
jmp 0x1400683ae
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x1400683a9
test eax, eax
jne 0x1400683ae
cmp dword [rsp + 0x58], r12d
jne 0x1400683ae
cmp dword [rsp + 0x5c], esi
jbe 0x1400683ae
mov esi, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400683be
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400683ce
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1400683d4
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400b1f80
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400687e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebp, ebp
mov rdi, rcx
mov ebx, ebp
mov r15d, ebp
mov byte [0x1401e8fec], bl
test rcx, rcx
je 0x140068851
mov rax, 0xffffffffffffffff
mov rcx, rax
nop dword [rax + rax]
inc rcx
cmp byte [rdi + rcx], bl
jne 0x140068820
cmp rcx, 4
jbe 0x140068851
nop
inc rax
cmp byte [rdi + rax], bl
jne 0x140068830
lea rbx, [rdi - 1]
add rbx, rax
cmp byte [rbx], 0x2e
je 0x140068851
cmp rbx, rdi
je 0x140068851
dec rbx
cmp byte [rbx], 0x2e
jne 0x140068844
test rbx, rbx
lea r12, str._NULL_
lea r13, str..zip
mov esi, ebp
cmove rbx, r12
mov r14, r13
nop dword [rax + rax]
mov rax, qword [r14]
mov rdx, r12
test rax, rax
mov rcx, rbx
cmovne rdx, rax
call fcn.140108174
test eax, eax
je 0x1400688b6
inc esi
add r14, 0x10
cmp esi, 0xa
jb 0x140068870
xor al, al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movsxd r14, esi
mov ecx, 0x200
add r14, r14
movzx eax, byte [r13 + r14*8 + 8]
mov byte [0x1401e8fec], al
call fcn.1400e9094
mov rbx, rax
test rax, rax
je 0x140068894
cmp byte [0x1401e8fec], 9
mov esi, 1
mov dword [0x14019f0a0], ebp
jae 0x14006893c
lea rax, [0x14019f0a0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rdx, [fcn.14004f910]
mov qword [rsp + 0x28], rbp
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call fcn.140087550
movzx r9d, byte [r13 + r14*8 + 8]
mov r8d, 0x200
mov rdx, rbx
mov rcx, rdi
call fcn.140087970
mov r15, rax
call fcn.140087500
jmp 0x140068a37
jne 0x1400689ed
cmp dword [0x14019f534], ebp
je 0x1400689d4
mov rcx, rdi
call fcn.1400680c0
mov r14, rax
test rax, rax
je 0x1400689b0
mov r9, rax
mov byte [0x1401e8fce], sil
mov r8d, 0x200
mov rdx, rsi
mov rcx, rbx
call fcn.14010ab00
mov rcx, r14
mov r15, rax
call fcn.1400e9730
lea rcx, [rbx + 4]
mov r8d, 0xc
lea rdx, str.SignedImage
call fcn.1400fe780
test eax, eax
jne 0x140068a37
mov word [rbx + 0x1fe], 0xaa55
jmp 0x140068a37
call fcn.14010cbf8
mov rdx, rdi
lea rcx, str.Could_not_open__s:__d
mov r8d, dword [rax]
call fcn.14004f910
mov rcx, rbx
call fcn.1400e9080
jmp 0x140068894
lea rcx, str.__An_FFU_image_was_selected__but_this_system_does_not_have_FFU_support_
call fcn.14004f910
mov rcx, rbx
call fcn.1400e9080
jmp 0x140068894
xor edx, edx
mov rcx, rdi
call fcn.14006b4b0
test rax, rax
je 0x140068a32
mov rcx, rax
mov byte [0x1401e8fce], sil
call fcn.1400680c0
mov rdi, rax
test rax, rax
je 0x140068a32
mov r9, rax
mov r8d, 0x200
mov rdx, rsi
mov rcx, rbx
call fcn.14010ab00
mov rcx, rdi
mov r15, rax
call fcn.1400e9730
call fcn.14006b900
cmp r15, 0x200
je 0x140068a4d
mov rcx, rbx
call fcn.1400e9080
jmp 0x140068894
cmp byte [rbx + 0x1fe], 0x55
jne 0x140068a5f
cmp byte [rbx + 0x1ff], 0xaa
je 0x140068a6f
cmp dword [0x14019f5b0], ebp
mov eax, 2
cmovne ebp, eax
mov esi, ebp
mov rcx, rbx
call fcn.1400e9080
movzx eax, sil
jmp 0x140068896
Function at 0x140068a80
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rdi, qword [0x14019f508]
lea rcx, str.Disk_image_analysis:
xor ebx, ebx
mov qword [rsp + 0x88], rbx
call fcn.14004f910
mov rcx, rdi
call fcn.140067e00
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test rsi, rsi
je 0x140068afa
mov rcx, rsi
call fcn.1400e9080
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rbp, 0xffffffffffffffff
jne 0x140068b27
mov rdx, rdi
lea rcx, str.__Could_not_open_image__s
call fcn.14004f910
movzx eax, bpl
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, rdi
call fcn.1400687e0
test al, al
setne dil
cmp byte [0x1401e8fec], bl
jne 0x140068bfc
mov eax, dword [0x1401e9110]
mov dword [0x140196fb0], eax
add eax, 0xfffffe00
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbp
cmp eax, 0xfe00
jbe 0x140068b6d
mov dword [0x140196fb0], 0x200
lea rcx, [rsp + 0x40]
call fcn.14007b710
test eax, eax
jne 0x140068b9f
lea rdx, str.__Image
lea rcx, str._s_does_not_have_a_Boot_Marker
call fcn.14004f910
mov eax, dword [0x14019f5b0]
neg eax
sbb dil, dil
and dil, 2
jmp 0x140068bfc
lea r14, [0x14014fea0]
mov edi, ebx
mov rsi, r14
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
call qword [rsi]
test eax, eax
jne 0x140068bdb
inc edi
add rsi, 0x10
cmp edi, 0xd
jb 0x140068bb0
lea rdx, str.__Image
lea rcx, str._s_has_an_unknown_Master_Boot_Record
call fcn.14004f910
jmp 0x140068bf9
movsxd r8, edi
lea rdx, str.__Image
add r8, r8
lea rcx, str._s_has_a__s_Master_Boot_Record
mov r8, qword [r14 + r8*8 + 8]
call fcn.14004f910
mov dil, 1
lea rdx, [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140068c2a
call fcn.140050120
mov rdx, rax
lea rcx, str.__Could_not_get_image_size:__s
call fcn.14004f910
mov dil, 0xfe
jmp 0x140068ca1
mov rax, qword [rsp + 0x90]
xor r9d, r9d
xor r8d, r8d
mov qword [0x1401e8fb0], rax
mov rdx, rbx
mov dword [rsp + 0x80], 8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r8d, dword [rsp + 0x80]
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140068c9b
movabs rax, 0x4d4957534d
mov byte [0x1401e8fcf], 1
cmp qword [rsp + 0x88], rax
je 0x140068ca1
mov byte [0x1401e8fcf], bl
test rbp, rbp
je 0x140068caf
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14006c500
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rdx
mov r15, rcx
mov r14d, 0x104
lea rcx, [rsp + 0x70]
mov r8d, r14d
xor edx, edx
call fcn.140136960
xor esi, esi
mov dword [rsp + 0x58], 0xffffffff
lea r12, [0x1401e5f30]
mov qword [rsp + 0x60], rsi
mov rcx, r12
mov qword [rsp + 0x50], rsi
xor edx, edx
mov dword [rsp + 0x5c], 0x1ff
mov r8d, 0x1ff
call fcn.140136960
test rdi, rdi
je 0x14006c6f3
mov rax, 0xffffffffffffffff
mov rbx, rax
inc rbx
cmp byte [rdi + rbx], sil
jne 0x14006c593
test rbx, rbx
je 0x14006c5ad
cmp byte [rdi + rbx], 0x5c
je 0x14006c5de
sub rbx, 1
jne 0x14006c5a1
lea rax, [rsp + 0x60]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14006c646
mov qword [rsp + 0x60], rsi
jmp 0x14006c6df
cmp rbx, r14
jae 0x14006c6f3
inc rax
cmp byte [rdi + rax], sil
jne 0x14006c5e7
inc rax
lea rcx, [rsp + 0x70]
cmp rax, r14
mov rdx, rdi
cmovb r14, rax
mov r8, r14
call fcn.1401362c0
lea rax, [rsp + 0x50]
mov byte [rsp + r14 + 0x6f], sil
mov byte [rsp + rbx + 0x70], sil
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r15
inc rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14006c68e
mov qword [rsp + 0x50], rsi
jmp 0x14006c6cf
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, str.Akeo_ConsultingRufus
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14006c68e
mov qword [rsp + 0x50], rsi
jmp 0x14006c6cf
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r12
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x14006c6ca
test eax, eax
jne 0x14006c6cf
cmp dword [rsp + 0x58], 1
jne 0x14006c6cf
cmp dword [rsp + 0x5c], esi
jbe 0x14006c6cf
mov esi, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14006c6df
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14006c6ef
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x14006c6f5
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400b1f80
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14006ca20
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
lea rcx, [0x1401e84c0]
mov r15, r9
call fcn.14006c740
lea rcx, [0x1401569ec]
mov rdi, rax
call fcn.14006c740
mov rsi, rax
test r15, r15
jne 0x14006ca62
xor ebx, ebx
jmp 0x14006ca74
mov edx, 2
mov ecx, 0x104
call fcn.1400c537c
mov rbx, rax
mov r9, rbx
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test ebp, ebp
je 0x14006cad9
mov qword [rsp + 0x38], 0
mov r9d, 0xffffffff
mov qword [rsp + 0x30], 0
mov r8, rbx
mov dword [rsp + 0x28], 0x104
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test eax, eax
jne 0x14006cad9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test rbx, rbx
je 0x14006cae6
mov rcx, rbx
call fcn.1400e9080
test rsi, rsi
je 0x14006caf3
mov rcx, rsi
call fcn.1400e9080
test rdi, rdi
je 0x14006cb00
mov rcx, rdi
call fcn.1400e9080
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x60]
mov eax, ebp
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14006ddc0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
xor edx, edx
mov byte [rsp + 0x30], 0
mov r8d, 0x103
lea rcx, [rsp + 0x31]
call fcn.140136960
xor eax, eax
cmp dword [0x1401d0480], 0x62
mov qword [0x1401e8fee], rax
jb 0x14006de3c
mov ebx, 1
mov ecx, ebx
call fcn.140068fe0
test al, 4
je 0x14006de3c
cmp byte [0x1401e8fcf], 0
jne 0x14006de90
mov rcx, qword [0x14019f508]
xor edx, edx
call fcn.14006b4b0
test rax, rax
jne 0x14006de57
lea rcx, str.Could_not_mount_Windows_ISO_for_build_number_detection
call fcn.14004f910
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400b1f80
add rsp, 0x1d0
pop rbx
ret
lea rcx, [0x1401e8d02]
mov edx, 0x80
mov qword [rsp + 0x28], rcx
lea r9, [0x1401638d0]
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x20], rax
mov r8, 0xffffffffffffffff
call fcn.140004960
mov byte [rsp + 0x1bf], 0
mov qword [rsp + 0x1e0], rsi
lea r9, [rsp + 0x30]
mov qword [rsp + 0x1e8], rdi
call fcn.14006ca20
test eax, eax
je 0x14006deb5
cmp byte [rsp + 0x30], 0
jne 0x14006dede
mov eax, dword [0x140172158]
movsd xmm0, qword [str..RufVXml.tmp]
mov dword [rsp + 0x38], eax
movzx eax, word [0x14017215c]
mov word [rsp + 0x3c], ax
mov byte [rsp + 0x3d], 0
movsd qword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call fcn.14006c740
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rdi, rdi
je 0x14006df09
mov rcx, rdi
call fcn.1400e9080
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [0x1401e8fcf], 0
lea rcx, [rsp + 0x140]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], ebx
cmovne rcx, qword [0x14019f508]
lea r8, str._1_.xml
xor edx, edx
call fcn.140069fc0
test eax, eax
jne 0x14006df51
lea rcx, str.Could_not_acquire_WIM_index
call fcn.14004f910
jmp 0x14006df5d
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.14006dc00
lea rcx, [rsp + 0x30]
call fcn.14006c740
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rdi, rdi
je 0x14006df88
mov rcx, rdi
call fcn.1400e9080
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [0x1401e8fcf], 0
mov rdi, qword [rsp + 0x1e8]
mov rsi, qword [rsp + 0x1e0]
jne 0x14006dfae
call fcn.14006b900
cmp word [0x1401e8fee], 0
je 0x14006dfc2
cmp word [0x1401e8ff2], 0
jne 0x14006dfc4
xor ebx, ebx
mov eax, ebx
jmp 0x14006de3e
Function at 0x1400773b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, rdx
mov eax, 0xffffffff
imul rbx, r9
mov r14, r9
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
cmp rbx, rax
jbe 0x1400773f7
lea rcx, str.read_sectors:_nSectors_x_SectorSize_is_too_big_n
call fcn.14004f910
mov rax, 0xffffffffffffffff
jmp 0x1400774bb
mov eax, r14d
xor r9d, r9d
imul eax, esi
xor r8d, r8d
imul rdx, rdi
mov dword [rsp + 0x58], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x140077438
call fcn.140050120
mov r8, rax
lea rcx, str.read_sectors:_Could_not_access_sector_0x_08llx____s_n
mov rdx, rdi
call fcn.14004f910
mov rax, 0xffffffffffffffff
jmp 0x1400774bb
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, qword [rsp + 0x70]
mov rcx, rbp
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140077466
mov ecx, dword [rsp + 0x58]
cmp rcx, rbx
je 0x1400774b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140077477
call fcn.140050120
jmp 0x14007747e
lea rax, [0x14015644e]
mov rdx, rax
lea rcx, str.read_sectors:_Read_error__s_n
call fcn.14004f910
mov edx, dword [rsp + 0x58]
lea rcx, str.__Read:__d__Expected:__llu_n
mov r8, rbx
call fcn.14004f910
mov r9, rsi
lea rcx, str.__StartSector:_0x_08llx__nSectors:_0x_llx__SectorSize:_0x_llx_n
mov r8, r14
mov rdx, rdi
call fcn.14004f910
mov ecx, dword [rsp + 0x58]
mov eax, ecx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret