joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003e9f0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400a7328]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r10, qword [rdx + 0x18]
movzx esi, r8b
mov r9, qword [rdx + 0x10]
mov rdi, rdx
mov qword [rsp + 0x28], rcx
mov rbx, rcx
cmp r10, 8
jb 0x14003ea2e
mov rdx, qword [rdx]
test r9, r9
je 0x14003eaee
lea rcx, [r9 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
cmp word [rdx + rax*2], 0x2e
lea r8, [rdx + rax*2]
je 0x14003ea68
cmp r8, rdx
je 0x14003eaee
sub r8, 2
cmp word [r8], 0x2e
jne 0x14003ea54
sub r8, rdx
sar r8, 1
cmp r8, 0xffffffffffffffff
je 0x14003eaee
cmp r9, r8
xorps xmm0, xmm0
xorps xmm1, xmm1
mov rdx, rdi
cmovb r8, r9
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
cmp r10, 8
jb 0x14003ea98
mov rdx, qword [rdi]
lea rcx, [rsp + 0x30]
call fcn.14001ec20
test sil, sil
je 0x14003eacb
cmp qword [rsp + 0x48], 8
lea rdx, [rsp + 0x30]
cmovae rdx, qword [rsp + 0x30]
cmp qword [rdi + 0x18], 8
jb 0x14003eac2
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
movups xmm0, xmmword [rsp + 0x30]
mov qword [rbx + 0x10], 0
movups xmm1, xmmword [rsp + 0x40]
mov qword [rbx + 0x18], 0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
jmp 0x14003eaf9
mov rdx, rdi
mov rcx, rbx
call fcn.140019bc0
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14004afd0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14003ec80
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14003ed04
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400836c0]
cmp byte [rcx + rax], 0
je 0x14003ed04
dec r8
sub rdx, 1
jne 0x14003ecea
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140043450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x50
mov rax, r8
mov rbx, rcx
test rdx, rdx
jne 0x140043475
mov eax, 0xfffffff7
add rsp, 0x50
pop rbx
ret
test rax, rax
je 0x140043568
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov ecx, dword [rbx + 0x88]
test ecx, ecx
jne 0x140043513
mov eax, dword [rbx + 0x10]
lea edx, [rcx + 1]
mov r14d, dword [rbx + 0x94]
mov rcx, rbx
mov edi, dword [rbx + 0x3c]
mov esi, dword [rbx + 0x8c]
mov ebp, dword [rbx]
mov r13d, dword [rbx + 0x98]
mov r15d, dword [rbx + 0x14]
mov r12d, dword [rbx + 0x90]
mov dword [rsp + 0x78], eax
call fcn.140043570
lea eax, [r14 + rdi]
mov dword [rbx + 0x88], 8
xor eax, esi
mov ecx, 8
xor eax, ebp
bswap eax
mov dword [rbx + 0x80], eax
lea eax, [r15 + r13]
xor eax, r12d
xor eax, dword [rsp + 0x78]
bswap eax
mov dword [rbx + 0x84], eax
mov eax, 8
sub eax, ecx
cdqe
movzx ecx, byte [rax + rbx + 0x80]
mov rax, qword [rsp + 0x68]
xor byte [rax], cl
inc rax
dec dword [rbx + 0x88]
sub qword [rsp + 0x70], 1
mov qword [rsp + 0x68], rax
jne 0x1400434a1
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x140043750
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
movzx eax, dl
lea r10, str.cw
movzx esi, byte [rax + r10]
mov eax, edx
shr eax, 8
movzx ecx, al
mov eax, edx
shr eax, 0x10
lea edi, [rsi + rsi]
movzx r15d, byte [rcx + r10]
movzx ecx, al
mov eax, edx
shr rax, 0x18
lea r9d, [r15 + r15]
movzx r14d, byte [rcx + r10]
mov r8d, r9d
xor r8d, r15d
movzx r10d, byte [rax + r10]
movzx eax, dil
xor al, 0x1b
movzx ebp, al
bt edi, 8
movzx eax, dil
cmovae ebp, eax
movzx eax, r8b
xor al, 0x1b
movzx ecx, al
bt r8d, 8
movzx eax, r8b
lea r8d, [r14 + r14]
cmovae ecx, eax
mov edx, r8d
xor bpl, cl
xor edx, r14d
xor bpl, r10b
movzx eax, dl
xor al, 0x1b
xor bpl, r14b
movzx r11d, al
bt edx, 8
movzx eax, dl
cmovae r11d, eax
movzx eax, r9b
xor al, 0x1b
movzx ecx, al
bt r9d, 8
movzx eax, r9b
lea r9d, [r10 + r10]
cmovae ecx, eax
mov edx, r9d
xor edx, r10d
xor r11b, cl
xor r11b, r10b
movzx eax, dl
xor al, 0x1b
xor r11b, sil
movzx r10d, al
bt edx, 8
movzx eax, dl
cmovae r10d, eax
movzx eax, r8b
xor al, 0x1b
movzx ecx, al
bt r8d, 8
movzx eax, r8b
cmovae ecx, eax
xor edi, esi
xor r10b, cl
movzx eax, dil
xor al, 0x1b
xor r10b, r15b
movzx ecx, al
xor r10b, sil
movzx eax, dil
bt edi, 8
cmovae ecx, eax
movzx eax, r9b
xor al, 0x1b
movzx r8d, cl
movzx ecx, al
movzx eax, r9b
mov rbx, qword [rsp + 0x18]
bt r9d, 8
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
cmovae ecx, eax
movzx eax, cl
xor eax, r8d
movzx ecx, r10b
xor eax, r14d
xor eax, r15d
shl eax, 8
or eax, ecx
movzx ecx, r11b
shl eax, 8
or eax, ecx
movzx ecx, bpl
mov rbp, qword [rsp + 0x20]
shl eax, 8
or eax, ecx
pop r15
pop r14
ret
Function at 0x1400492e0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov r9, rdx
mov r8, rcx
mov edx, 8
lea ecx, [rdx + 6]
jmp 0x140049760
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor r11d, r11d
mov r10d, edx
lea esi, [rcx*4 + 4]
mov rdi, r8
lea rbp, [0x1400852f0]
test edx, edx
je 0x1400497d1
mov rbx, r8
lea eax, [r11*4]
inc r11d
movzx edx, byte [rax + r9 + 3]
lea rbx, [rbx + 4]
shl edx, 8
mov ecx, eax
movzx eax, byte [rax + r9 + 2]
or edx, eax
shl edx, 8
movzx eax, byte [rcx + r9 + 1]
or edx, eax
movzx eax, byte [rcx + r9]
shl edx, 8
or edx, eax
mov dword [rbx - 4], edx
cmp r11d, r10d
jb 0x140049792
mov r9d, r10d
cmp r10d, esi
jae 0x1400498b4
lea r11, [r8 + r10*4]
lea rbx, [0x140085300]
nop dword [rax + rax]
lea eax, [r9 - 1]
xor edx, edx
mov ecx, dword [rdi + rax*4]
mov eax, r9d
div r10d
test edx, edx
jne 0x14004984c
mov r8d, ecx
movzx eax, cl
movzx ecx, byte [rax + rbx]
mov eax, r8d
shr rax, 0x18
shl ecx, 8
movzx eax, byte [rax + rbx]
or ecx, eax
mov eax, r8d
shr rax, 0x10
shl ecx, 8
movzx edx, al
shr r8, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
movzx eax, byte [rbp]
or ecx, edx
xor ecx, eax
inc rbp
jmp 0x140049898
cmp r10d, 6
jbe 0x140049898
cmp edx, 4
jne 0x140049898
mov r8, rcx
mov rax, rcx
shr rax, 0x10
movzx ecx, al
mov rax, r8
shr rax, 0x18
movzx ecx, byte [rcx + rbx]
movzx eax, byte [rax + rbx]
shl eax, 8
or ecx, eax
mov rax, r8
shr rax, 8
movzx edx, al
shl ecx, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
or ecx, edx
mov eax, r9d
inc r9d
sub eax, r10d
xor ecx, dword [rdi + rax*4]
mov dword [r11], ecx
add r11, 4
cmp r9d, esi
jb 0x1400497f0
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x140049300
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rdx, rcx
mov qword [rsp + 0x20], r8
mov ecx, 0xe
lea r8, [0x140085300]
call fcn.1400498d0
add rsp, 0x38
ret

Function at 0x140049330
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140049460
movups xmm0, xmmword [0x1400852b0]
xor eax, eax
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x1400852c0]
mov qword [rbx + 0x20], rax
mov dword [rbx + 0x28], eax
movups xmmword [rbx + 0x10], xmm1
add rsp, 0x20
pop rbx
ret
Function at 0x140049760
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov r9, rdx
mov r8, rcx
mov edx, 8
lea ecx, [rdx + 6]
jmp 0x140049760
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor r11d, r11d
mov r10d, edx
lea esi, [rcx*4 + 4]
mov rdi, r8
lea rbp, [0x1400852f0]
test edx, edx
je 0x1400497d1
mov rbx, r8
lea eax, [r11*4]
inc r11d
movzx edx, byte [rax + r9 + 3]
lea rbx, [rbx + 4]
shl edx, 8
mov ecx, eax
movzx eax, byte [rax + r9 + 2]
or edx, eax
shl edx, 8
movzx eax, byte [rcx + r9 + 1]
or edx, eax
movzx eax, byte [rcx + r9]
shl edx, 8
or edx, eax
mov dword [rbx - 4], edx
cmp r11d, r10d
jb 0x140049792
mov r9d, r10d
cmp r10d, esi
jae 0x1400498b4
lea r11, [r8 + r10*4]
lea rbx, [0x140085300]
nop dword [rax + rax]
lea eax, [r9 - 1]
xor edx, edx
mov ecx, dword [rdi + rax*4]
mov eax, r9d
div r10d
test edx, edx
jne 0x14004984c
mov r8d, ecx
movzx eax, cl
movzx ecx, byte [rax + rbx]
mov eax, r8d
shr rax, 0x18
shl ecx, 8
movzx eax, byte [rax + rbx]
or ecx, eax
mov eax, r8d
shr rax, 0x10
shl ecx, 8
movzx edx, al
shr r8, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
movzx eax, byte [rbp]
or ecx, edx
xor ecx, eax
inc rbp
jmp 0x140049898
cmp r10d, 6
jbe 0x140049898
cmp edx, 4
jne 0x140049898
mov r8, rcx
mov rax, rcx
shr rax, 0x10
movzx ecx, al
mov rax, r8
shr rax, 0x18
movzx ecx, byte [rcx + rbx]
movzx eax, byte [rax + rbx]
shl eax, 8
or ecx, eax
mov rax, r8
shr rax, 8
movzx edx, al
shl ecx, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
or ecx, edx
mov eax, r9d
inc r9d
sub eax, r10d
xor ecx, dword [rdi + rax*4]
mov dword [r11], ecx
add r11, 4
cmp r9d, esi
jb 0x1400497f0
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x14004be5c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004bea6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004bea6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004bea6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004bea6
cmp dword [rcx + 0x84], 0xe
jbe 0x14004bea6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004bea8
xor al, al
add rsp, 0x28
ret

Function at 0x14005dd08
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14005db34
Function at 0x1400729e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140072a08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140072a08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140005bd0
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x90
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, rcx
mov ecx, 0x5000
call fcn.140017d00
mov rdi, rax
mov ecx, 0x5000
call fcn.140017d00
mov rbp, rax
xor edx, edx
mov r8d, 0x5000
mov rcx, rdi
call fcn.14001a650
xor edx, edx
mov r8d, 0x5000
mov rcx, rbp
call fcn.14001a650
mov esi, 1
lea rax, [0x140065980]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2800
mov r9, rdi
lea r8, [0x1400476d0]
lea rdx, str.Filter
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or r14, 0xffffffffffffffff
mov rax, r14
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140005c70
test rax, rax
je 0x140005d6a
mov rdx, rbx
lea rcx, str._nChecking_Filter__s
call fcn.14000b8c0
mov r8, rdi
lea rdx, str.function_filter__WShell__new_ActiveXObject__WScript.Shell____nEnv__WShell.Environment__PROCESS____n_s_nfilter___
mov rcx, rbp
call fcn.14001c9d4
lea rdx, str.JScript
lea rcx, [rsp + 0x70]
call fcn.1400044d0
nop
cmp dword [rsp + 0x88], 0
jne 0x140005d25
lea rcx, [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rcx, [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
xor ebx, ebx
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], 0x20
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
call qword [rax + 0x28]
mov dword [rsp + 0x88], eax
cmp r14w, word [rsp + 0x60]
je 0x140005d29
jmp 0x140005d27
xor ebx, ebx
mov esi, ebx
lea rax, vtable.WIZScriptSite.0
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140005d57
mov rax, qword [rcx]
call qword [rax + 0x38]
mov dword [rsp + 0x88], eax
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140005d6a
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, rdi
call fcn.14001961c
mov rcx, rbp
call fcn.14001961c
mov eax, esi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14000a890
Capabilities:
Check if file exists
Get file attributes
Set registry value

Disassembly:
push rdi
sub rsp, 0x470
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x488], rbx
mov rax, qword [0x1400623d0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rdi, rcx
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x50], rbx
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x60]
call fcn.14001a650
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x260]
call fcn.14001a650
mov rcx, rdi
call fcn.140005bd0
test eax, eax
je 0x14000aa8d
mov dword [rsp + 0x30], ebx
lea rbx, [0x140065980]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x100
lea r9, [rsp + 0x60]
lea r8, [0x1400476d0]
lea rdx, str.OEMKey
mov rcx, rdi
call fcn.14000e830
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x100
lea r9, [rsp + 0x260]
lea r8, [0x1400476d0]
lea rdx, str.TargetLink
mov rcx, rdi
call fcn.14000e830
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0x60]
lea rcx, str._nCreating_MFU__s_pointing_to__s
call fcn.14000b8c0
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000a9a1
lea rcx, str._nError_:Creating_MFU__Target_Link_does_not_exists
jmp 0x14000aa09
test al, 0x10
je 0x14000a9ae
lea rcx, str._nError_:Creating_MFU__Directory_cannot_be_set_as_MFU
jmp 0x14000aa09
lea rdx, str.OEM0
lea rcx, [rsp + 0x60]
call fcn.14001b25c
test eax, eax
je 0x14000aa18
lea rdx, str.OEM1
lea rcx, [rsp + 0x60]
call fcn.14001b25c
test eax, eax
je 0x14000aa18
lea rdx, str.OEM2
lea rcx, [rsp + 0x60]
call fcn.14001b25c
test eax, eax
je 0x14000aa18
lea rdx, str.OEM3
lea rcx, [rsp + 0x60]
call fcn.14001b25c
test eax, eax
je 0x14000aa18
lea rcx, str._nError_:Creating_MFU__Invalid_OEM_Key
call fcn.14000b8c0
mov dword [0x1400667b8], 1
mov r9d, 0x2001f
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionSMDEn
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.140011540
lea rcx, [rsp + 0x260]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000aa42
inc eax
add eax, eax
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x14000aa8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
test rbx, rbx
je 0x14000aa9b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14001a120
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret
Function at 0x14000aeb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x470
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400623d0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rcx
xor esi, esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x50], rsi
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x60]
call fcn.14001a650
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x260]
call fcn.14001a650
mov rcx, rbx
call fcn.140005bd0
test eax, eax
je 0x14000b085
mov dword [rsp + 0x30], esi
lea rdi, [0x140065980]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
lea r9, [rsp + 0x60]
lea r8, [0x1400476d0]
lea rdx, str.OEMKey
mov rcx, rbx
call fcn.14000e830
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
lea r9, [rsp + 0x260]
lea r8, [0x1400476d0]
lea rdx, str.TargetLink
mov rcx, rbx
call fcn.14000e830
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0x60]
lea rcx, str._nCreating_MFU__s_pointing_to__s_in_C:HPHPQWareBTBHostMFU.ini
call fcn.14000b8c0
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000afc3
lea rcx, str._nError_:Creating_MFU__Target_Link_does_not_exists
jmp 0x14000b02b
test al, 0x10
je 0x14000afd0
lea rcx, str._nError_:Creating_MFU__Directory_cannot_be_set_as_MFU
jmp 0x14000b02b
lea rdx, str.OEM0
lea rcx, [rsp + 0x60]
call fcn.14001b25c
test eax, eax
je 0x14000b03a
lea rdx, str.OEM1
lea rcx, [rsp + 0x60]
call fcn.14001b25c
test eax, eax
je 0x14000b03a
lea rdx, str.OEM2
lea rcx, [rsp + 0x60]
call fcn.14001b25c
test eax, eax
je 0x14000b03a
lea rdx, str.OEM3
lea rcx, [rsp + 0x60]
call fcn.14001b25c
test eax, eax
je 0x14000b03a
lea rcx, str._nError_:Creating_MFU__Invalid_OEM_Key
call fcn.14000b8c0
mov dword [0x1400667b8], 1
mov dword [rsp + 0x20], esi
lea r9, str.C:HPHPQWareBTBHostMFU.ini
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0x60]
lea rcx, [0x14004ad80]
call fcn.1400147a0
test eax, eax
jne 0x14000b085
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0x60]
lea rcx, str._nError_Creating_MFU_Entry_key__s__link___s
call fcn.14000b8c0
mov dword [0x1400667b8], 1
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14001a120
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000b650
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x850
mov rax, qword [0x1400623d0]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x200
call fcn.14001a650
lea rcx, [rsp + 0x640]
xor edx, edx
mov r8d, 0x200
call fcn.14001a650
lea rcx, [rsp + 0x240]
xor edx, edx
mov r8d, 0x200
call fcn.14001a650
lea rcx, [rsp + 0x440]
xor edx, edx
mov r8d, 0x200
call fcn.14001a650
mov rcx, rbx
call fcn.140005bd0
test eax, eax
je 0x14000b8a1
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x868], rdi
lea rdi, [0x140065980]
lea r9, [rsp + 0x40]
lea r8, [0x1400476d0]
lea rdx, str.SBOEMKey
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
call fcn.14000e830
mov dword [rsp + 0x30], 0
lea r9, [rsp + 0x640]
lea r8, [0x1400476d0]
lea rdx, str.AppID
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
call fcn.14000e830
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x240]
lea r8, [0x1400476d0]
lea rdx, str.ShortCutPath
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
call fcn.14000e830
lea r8, [rsp + 0x240]
lea rdx, [rsp + 0x40]
lea rcx, str._nCreating_MFU__s_pointing_to__s_in_C:HPHPQWareBTBHostTaskbar.ini
call fcn.14000b8c0
lea rdx, str.SBOEM
lea rcx, [rsp + 0x40]
mov r8d, 5
call fcn.14001b3d0
mov rdi, qword [rsp + 0x868]
test eax, eax
je 0x14000b7cb
lea rdx, [rsp + 0x40]
lea rcx, str._nError_:Creating_Taskbar__Invalid_SBOEM_Key___s
call fcn.14000b8c0
mov dword [0x1400667b8], 1
lea rcx, [rsp + 0x640]
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000b7e0
test rax, rax
je 0x14000b800
lea r8, [rsp + 0x640]
lea rdx, str.UWA___s
jmp 0x14000b845
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000b81c
lea rcx, str._nError_:Creating_Taskbar__Target_Link_does_not_exists
jmp 0x14000b827
test al, 0x10
je 0x14000b836
lea rcx, str._nError_:Creating_Taskbar__Directory_cannot_be_set_as_MFU
call fcn.14000b8c0
mov dword [0x1400667b8], 1
lea r8, [rsp + 0x240]
lea rdx, str.LNK___s
lea rcx, [rsp + 0x440]
call fcn.140004060
lea r9, str.C:HPHPQWareBTBHostTaskbar.ini
lea r8, [rsp + 0x440]
lea rdx, [rsp + 0x40]
lea rcx, str.Taskbar
mov dword [rsp + 0x20], 0
call fcn.1400147a0
test eax, eax
jne 0x14000b8a1
lea r8, [rsp + 0x440]
lea rdx, [rsp + 0x40]
lea rcx, str._nError_Creating_UWA_Taskbar_Entry_key__s__value___s
call fcn.14000b8c0
mov dword [0x1400667b8], 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14001a120
add rsp, 0x850
pop rbx
ret
Function at 0x14000ddd0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x70
xor ebx, ebx
lea rax, [r11 + 8]
lea rdx, str.SOFTWAREPoliciesMicrosoftMicrosoftEdgeMain
mov qword [r11 - 0x38], rax
lea rax, [r11 + 0x10]
mov qword [r11 - 0x28], rbx
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x58], ebx
mov qword [r11 + 0x10], rbx
mov dword [rsp + 0x20], ebx
mov qword [r11 - 0x18], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000dee9
mov rax, qword [rsp + 0x88]
lea r8, str.SOFTWAREPoliciesMicrosoftMicrosoftEdgeMain
lea rcx, [rsp + 0x50]
mov r9d, 0x2001f
mov rdx, 0xffffffff80000002
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x50], rax
call fcn.140011540
test eax, eax
je 0x14000de8b
lea rcx, str._nError:_EnableEdgeFavBar_open_registry_path_fail
call fcn.14000b8c0
mov rcx, qword [rsp + 0x50]
mov dword [0x1400667b8], 1
test rcx, rcx
je 0x14000defa
add rsp, 0x70
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str._nEnableEdgeFavBar__set_ConfigureFavoritesBar__1
mov dword [rsp + 0x80], 1
call fcn.14000b8c0
mov rbx, qword [rsp + 0x50]
lea rax, [rsp + 0x80]
lea rdx, str.ConfigureFavoritesBar
mov rcx, rbx
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x14000defa
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x70
pop rbx
ret
lea rcx, str._nError:_EnableEdgeFavBar__create_registry_path__SOFTWAREPoliciesMicrosoftMicrosoftEdgeMain
add rsp, 0x70
pop rbx
jmp fcn.14000b8c0
add rsp, 0x70
pop rbx
ret