joyce8/EMBER2024-capa huggingface dataset:
Function at 0x128240e0
Capabilities:
Get session user name

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
xor edi, edi
mov ecx, 0x800
call fcn.12958238
mov rbx, rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0x4b4
lea r8, [rsp + 0x40]
mov rdx, rax
lea ecx, [rdi + 2]
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x12824162
mov rdx, rbx
lea rcx, str.NT_AUTHORITY
call fcn.12886680
test al, al
jne 0x1282415d
mov rdx, rbx
lea rcx, str.BUILTIN
call fcn.12886680
test al, al
jne 0x1282415d
mov rdx, rbx
lea rcx, str.WORKGROUP
call fcn.12886680
test al, al
je 0x12824162
mov edi, 1
mov rcx, rbx
call fcn.12958250
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x128243d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ecx, ecx
lea rdx, [0x12a22210]
nop dword [rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor al, 0x69
mov byte [rsp + rcx + 0x1f], al
cmp rcx, 0x1f
jb 0x128243f0
lea rcx, [0x12a2211c]
xor edx, edx
mov r8d, 0xf4
mov byte [rsp + 0x3f], 0
call fcn.12959590
lea rcx, [0x12a22028]
xor edx, edx
mov r8d, 0xf4
call fcn.12959590
lea rdx, [0x12a2211c]
lea rcx, [rsp + 0x20]
call fcn.12801000
lea rdx, [0x12a22028]
lea rcx, [rsp + 0x20]
call fcn.12801590
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.12959850
add rsp, 0x58
ret
Function at 0x128249b0
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov esi, edx
mov ebx, ecx
test cl, 0x40
je 0x12824ae8
xor ebp, ebp
mov qword [r11 + 0x20], rbp
lea rax, [r11 + 0x20]
mov qword [r11 - 0x48], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareHopedotVOS
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x70], ebp
mov dword [rsp + 0x80], ebp
mov ecx, 0x1000
call fcn.12958238
mov rdi, rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x70], 0x1000
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, [0x129c5510]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x12824ad1
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x12824ad1
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea r9d, [rbp + 1]
xor r8d, r8d
lea rdx, [0x129c5510]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x12824ac6
lea rdx, [0x129c5510]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, rdi
call fcn.12958250
mov edx, esi
mov ecx, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
jmp 0x12885390
sub rsp, 0x38
mov r9d, edx
mov r8d, ecx
lea rdx, [0x129d22e6]
lea rcx, [0x129d26a0]
call sub.RPCRT4.dll_NdrClientCall2
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], eax
jmp 0x128853bc
add rsp, 0x38
ret

Function at 0x128287f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp dword [rcx + 0x30], 0
mov rax, rcx
je 0x128287fe
mov rax, qword [rcx + 0x28]
ret
mov rcx, qword [rcx + 0x20]
lea rdx, [rax + 8]
cmp rcx, 8
jb 0x12828811
mov r9, qword [rdx]
jmp 0x12828814
mov r9, rdx
mov r10, qword [rax + 0x18]
cmp rcx, 8
jb 0x12828821
mov rdx, qword [rdx]
lea r10, [r9 + r10*2]
mov r8d, 0x811c9dc5
cmp rdx, r10
je 0x12828846
movzx ecx, word [rdx]
imul r8, r8, 0x1000193
add rdx, 2
xor r8, rcx
cmp rdx, r10
jne 0x12828830
mov qword [rax + 0x28], r8
mov dword [rax + 0x30], 1
mov rax, r8
ret
Function at 0x128300e0
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rbx, rcx
xor edi, edi
cmp dword [rcx], edi
je 0x1283011e
cmp qword [rcx + 0x28], 8
jb 0x1283010e
mov rcx, qword [rcx + 0x10]
jmp 0x12830112
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1283011e
mov dword [rbx], edi
add rbx, 8
mov qword [rsp + 0x40], rbx
cmp qword [rbx + 0x20], 8
jb 0x12830137
mov rcx, qword [rbx + 8]
call fcn.12958250
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rdi
mov word [rbx + 8], di
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x12835e70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov esi, r9d
mov rbp, r8
mov rbx, rcx
mov qword [rsp + 0x68], 7
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
test rdx, rdx
je 0x12835f1b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x48]
call fcn.12803dc0
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x12835f08
lea rdi, [rdx - 1]
cmp rdx, rdi
ja 0x12835ef0
call fcn.129581ac
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rax, qword [rsp + 0x50]
cmp word [rax + rdi*2], 0x5c
je 0x12835f1b
mov edx, 1
lea r8d, [rdx + 0x5b]
lea rcx, [rsp + 0x48]
call fcn.12803b90
mov r8d, 0x15
lea rdx, str.Control_PanelDesktop
lea rcx, [rsp + 0x48]
call fcn.12803a10
mov rcx, rbx
call fcn.12803f90
mov qword [rsp + 0x38], r12
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
or esi, 0x20019
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x12836060
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], r12d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.Wallpaper
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x12836054
mov rdx, rax
shr rdx, 1
add rdx, 2
cmp rdx, 0xffffffffffffffff
je 0x12835ff4
mov rax, qword [rbx + 0x18]
cmp rdx, rax
je 0x12835ff4
cmp rdx, rax
ja 0x12835fe6
or r8, 0xffffffffffffffff
mov rcx, rbx
call fcn.128033a0
jmp 0x12835ff4
xor r8d, r8d
sub rdx, rax
mov rcx, rbx
call fcn.12803b90
cmp qword [rbx + 0x20], 8
jb 0x12836001
mov rcx, qword [rbx + 8]
jmp 0x12836005
lea rcx, [rbx + 8]
mov rax, qword [rbx + 0x18]
add eax, eax
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.Wallpaper
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1283604c
or rdx, 0xffffffffffffffff
mov rcx, rbx
call fcn.1280d350
jmp 0x12836054
mov rcx, rbx
call fcn.12803f90
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rsp + 0x68], 8
jb 0x12836072
mov rcx, qword [rsp + 0x50]
call fcn.12958250
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
mov eax, edi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.12959850
add rsp, 0x80
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x128360b0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbp, r9
mov r9, r8
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x60], 7
xor r12d, r12d
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], r12w
test rcx, rcx
je 0x12836217
cmp rcx, 0xffffffffffffffff
je 0x12836217
test r8, r8
je 0x12836171
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.12803dc0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1283615e
lea rdi, [rdx - 1]
cmp rdx, rdi
ja 0x12836146
call fcn.129581ac
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rax, qword [rsp + 0x48]
cmp word [rax + rdi*2], 0x5c
je 0x12836171
mov edx, 1
lea r8d, [rdx + 0x5b]
lea rcx, [rsp + 0x40]
call fcn.12803b90
mov r8d, 0x15
lea rdx, str.Control_PanelDesktop
lea rcx, [rsp + 0x40]
call fcn.12803a10
mov qword [rsp + 0x30], r12
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
mov r9d, dword [rsp + 0xc0]
or r9d, 0x2001f
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r11, qword [rsp + 0x30]
test r11, r11
je 0x12836217
cmp rsi, 0xffffffffffffffff
jne 0x128361e5
xor eax, eax
or rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea rsi, [rcx - 1]
lea eax, [rsi + rsi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Wallpaper
mov rcx, r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rsp + 0x60], 8
jb 0x12836229
mov rcx, qword [rsp + 0x48]
call fcn.12958250
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], r12w
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.12959850
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x12837750
Capabilities:
Get common file path
Set current directory

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x310
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov qword [r11 - 0x260], 7
xor edi, edi
mov qword [r11 - 0x268], rdi
mov word [rsp + 0xa0], di
lea rdx, [r11 - 0x228]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
cmp eax, 0x104
jb 0x1283781f
mov rdx, rbx
mov rax, qword [rsp + 0xb0]
cmp rbx, rax
ja 0x128377d7
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x98]
call fcn.128033a0
jmp 0x128377ea
xor r8d, r8d
sub rdx, rax
lea rcx, [rsp + 0x98]
call fcn.12803b90
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rdx, qword [rsp + 0xa0]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
or rdx, 0xffffffffffffffff
lea rcx, [rsp + 0x98]
call fcn.1280d350
jmp 0x12837837
mov r8, rbx
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x98]
call fcn.12803dc0
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], 8
jb 0x12837850
mov rcx, qword [rax + 8]
jmp 0x12837854
lea rcx, [rax + 8]
lea rdx, str.services.exe
call fcn.1295a6e4
test eax, eax
jne 0x128378a1
lea rcx, [0x12a21e00]
cmp qword [0x12a21e18], 8
cmovae rcx, qword [0x12a21e00]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov word [rsp + 0xf0], di
lea rdx, [rsp + 0xf0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x128379cf
mov qword [rsp + 0xe0], 7
mov qword [rsp + 0xd8], rdi
mov word [rsp + 0xc8], di
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xb0]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x80], edi
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x70], edi
mov byte [rsp + 0x68], 0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xc0]
xor r8d, r8d
call fcn.12888cb0
test eax, eax
je 0x1283799b
cmp qword [rsp + 0xd8], 0
je 0x1283799b
lea rcx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 8
cmovae rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x1283799b
lea r9, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 8
cmovae r9, qword [rsp + 0xc8]
mov r8d, eax
xor edx, edx
lea rcx, str.Scd__d__0x_x___s
call fcn.12805270
nop
cmp qword [rsp + 0xe0], 8
jb 0x128379b3
mov rcx, qword [rsp + 0xc8]
call fcn.12958250
mov qword [rsp + 0xe0], 7
mov qword [rsp + 0xd8], rdi
mov word [rsp + 0xc8], di
cmp qword [rsp + 0xb8], 8
jb 0x128379e7
mov rcx, qword [rsp + 0xa0]
call fcn.12958250
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rdi
mov word [rsp + 0xa0], di
xor eax, eax
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.12959850
mov rbx, qword [rsp + 0x320]
add rsp, 0x310
pop rdi
ret
Function at 0x1283ca40
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbp, rcx
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rbx, [0x12a22710]
lea r13, str.soffice.bin
mov r12, rax
nop word [rax + rax]
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rsi, qword [rbx]
call fcn.12836c30
cmp qword [rax + 0x20], 8
jb 0x1283ca9c
mov rcx, qword [rax + 8]
jmp 0x1283caa0
lea rcx, [rax + 8]
mov rdx, rsi
call fcn.1295a6e4
test eax, eax
je 0x1283cab7
add rbx, 0x18
cmp rbx, r13
jne 0x1283ca80
jmp 0x1283cada
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1283cacd
mov rcx, r12
call fcn.1288b010
test rax, rax
jne 0x1283cacf
xor edi, edi
test rbp, rbp
je 0x1283cada
mov eax, dword [rbx + 0x10]
mov dword [rbp], eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x1283cb00
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rbx, str.soffice.bin
lea rsi, vtable.type_info.0
nop word [rax + rax]
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdi, qword [rbx]
call fcn.12836c30
cmp qword [rax + 0x20], 8
jb 0x1283cb4c
mov rcx, qword [rax + 8]
jmp 0x1283cb50
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.1295a6e4
test eax, eax
je 0x1283cb77
add rbx, 8
cmp rbx, rsi
jne 0x1283cb30
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1283f340
Capabilities:
Read file via mapping

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rsi, rcx
call fcn.12803f90
mov edx, dword [0x129adc08]
xor ebx, ebx
test dl, 1
jne 0x1283f3a7
or edx, 1
mov dword [0x129adc08], edx
mov qword [0x129adc00], 7
mov qword [0x129adbf8], rbx
mov word [0x129adbe8], bx
lea rcx, [0x129a9b40]
call fcn.12959210
nop
cmp qword [0x129adbf8], 0
jne 0x1283f443
lea r8, [0x129bf650]
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test r12, r12
je 0x1283f443
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbp, rbp
je 0x1283f43a
lea rdx, [rbp + 0x18]
test rdx, rdx
je 0x1283f425
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [0x129adbe0]
call fcn.12803dc0
jmp 0x1283f431
lea rcx, [0x129adbe0]
call fcn.12803f90
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x129adbe0]
mov rcx, rsi
call fcn.12803c90
cmp qword [rsi + 0x18], 0
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x1284f5d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor r12d, r12d
mov edi, dword [0x129ad8d8]
mov rdx, qword [0x129ad910]
cmp dword [0x129ad8d0], r12d
je 0x1284f719
test rdx, rdx
je 0x1284f719
test edi, edi
je 0x1284f637
lea rcx, str.UpF.beg
call fcn.12805270
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1284f290
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
test edi, edi
je 0x1284f715
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.__elapsedtime:
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, str.__elapsedtime:
lea rcx, [rsp + 0x40]
call fcn.12803dc0
nop
sub esi, ebp
mov edx, esi
lea r8, str._.2f__s
lea rcx, [rsp + 0x40]
call fcn.1281bf90
mov qword [rsp + 0x28], rax
mov rax, qword [0x129ad918]
mov qword [rsp + 0x20], rax
mov r9, qword [0x129ad920]
mov r8, qword [0x129ad910]
mov rdx, qword [rsp + 0x30]
lea rcx, str.UpF.end__count_files:__Iu__need_count:__Iu__other_count:__Iu__org_count:__Iu__s
call fcn.12805270
nop
cmp qword [rsp + 0x60], 8
jb 0x1284f6fd
mov rcx, qword [rsp + 0x48]
call fcn.12958250
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], r12w
mov eax, ebx
jmp 0x1284f73f
mov eax, ebx
jmp 0x1284f73f
test edi, edi
je 0x1284f73c
mov r9, qword [0x129ad918]
mov r8, qword [0x129ad920]
lea rcx, str.UpF.end__not_update__need_count:__Iu__other_count:__Iu__org_count:__Iu_
call fcn.12805270
mov eax, r12d
jmp 0x1284f73f
mov eax, r12d
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.12959850
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x12850cf0
Capabilities:
Compare security identifiers

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x90
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov rdi, rdx
mov rsi, rcx
xor ebp, ebp
mov ebx, ebp
test rcx, rcx
je 0x12850e6c
test rdx, rdx
je 0x12850e68
cmp rcx, rdx
jne 0x12850d35
lea eax, [rbp + 1]
jmp 0x12850e6e
mov ecx, 8
call fcn.12958d80
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc0], rax
test rax, rax
je 0x12850d5e
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
jmp 0x12850d61
mov rax, rbp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rbp
mov ecx, 8
call fcn.12958d80
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc0], rax
test rax, rax
je 0x12850da1
lea rcx, [rsp + 0x28]
mov qword [rax], rcx
jmp 0x12850da4
mov rax, rbp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rbp
xor r9d, r9d
lea r8, [rsp + 0x58]
lea edx, [r9 + 1]
mov rcx, rsi
call fcn.1281ccd0
test eax, eax
jne 0x12850e10
xor r9d, r9d
lea r8, [rsp + 0x28]
lea edx, [rax + 1]
mov rcx, rdi
call fcn.1281ccd0
test eax, eax
jne 0x12850e10
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.1280ac30
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.1280ac30
mov rdx, qword [rax]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x12850e1f
call fcn.12958250
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rbp
mov rcx, qword [rsp + 0x28]
call fcn.12958250
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x12850e48
call fcn.12958250
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rbp
mov rcx, qword [rsp + 0x58]
call fcn.12958250
mov eax, ebx
jmp 0x12850e6e
mov eax, ebx
jmp 0x12850e6e
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x1285ae90
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov ebx, edx
mov rdi, rcx
mov dword [rsp + 0x20], edx
lea rdx, [rsp + 0x30]
lea rcx, [0x129bead0]
mov r8d, 0x80
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1285af6b
cmp word [rsp + 0x30], 0x30
je 0x1285af6b
lea rdx, [0x1285ab50]
mov r9d, ebx
mov r8, rdi
mov ecx, 0xc
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rcx, qword [0x129ac4b0]
xor edi, edi
mov rbx, rax
xor eax, eax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x2c], eax
call qword [0x129ae010]
cmp eax, 0x80
jne 0x1285af40
mov rcx, qword [0x129ac4b0]
xor eax, eax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x2c], eax
call qword [0x129ae010]
lea rdx, [rsp + 0x20]
lea rcx, [0x129ac470]
call fcn.128579f0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], edi
mov qword [rax + 8], rbx
mov rcx, qword [0x129ac4b0]
call qword [0x129ae008]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.12959850
mov rbx, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret
Function at 0x1285e900
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xc0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov r13, rdx
mov rdi, rcx
xor al, al
mov r14, qword [rcx + 0x18]
test r14, r14
je 0x1285eb62
xor bl, bl
mov edx, 0x25
xor r8d, r8d
call fcn.1282a340
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1285eb60
lea r12, [rax + 1]
mov edx, 0x25
mov r8, r12
mov rcx, rdi
call fcn.1282a340
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1285eb60
cmp r12, rax
je 0x1285eb60
sub rsi, rbp
lea r9, [rsi - 1]
mov r8, r12
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.12833030
nop
mov qword [rsp + 0xb0], 7
xor r12d, r12d
mov qword [rsp + 0xa8], r12
mov word [rsp + 0x98], r12w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.12803c90
nop
cmp qword [rsp + 0x50], 8
jb 0x1285e9f2
mov rcx, qword [rsp + 0x38]
call fcn.12958250
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], r12
mov word [rsp + 0x70], r12w
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x90]
call fcn.12888930
test eax, eax
je 0x1285ea5a
lea r8, [rsi + 1]
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x68]
mov rdx, rbp
mov rcx, rdi
call fcn.12819e00
mov bl, 1
cmp qword [rsp + 0x88], 8
jb 0x1285ea6f
mov rcx, qword [rsp + 0x70]
call fcn.12958250
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], r12
mov word [rsp + 0x70], r12w
cmp qword [rsp + 0xb0], 8
jb 0x1285eaa1
mov rcx, qword [rsp + 0x98]
call fcn.12958250
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r12
mov word [rsp + 0x98], r12w
test bl, bl
jne 0x1285eb60
mov ecx, 0x2000
call fcn.12958238
mov rsi, rax
mov qword [rsp + 0x58], rax
cmp qword [rdi + 0x20], 8
jb 0x1285eae5
mov rcx, qword [rdi + 8]
jmp 0x1285eae9
lea rcx, [rdi + 8]
mov r8d, 0x1000
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r12d, eax
lea eax, [r12 - 1]
cmp eax, 0xffe
ja 0x1285eb50
mov rbx, r12
mov r8, r12
mov rdx, rsi
mov rcx, rdi
call fcn.12803dc0
mov rdx, r12
mov rcx, rdi
call fcn.1280d350
mov bl, 1
lea eax, [r12 - 1]
mov ecx, eax
cmp rcx, r14
jne 0x1285eb47
mov rdx, rbp
mov rcx, rdi
call fcn.1280d060
cmp word [rax], 0x25
setne bl
test bl, bl
je 0x1285eb50
mov rcx, rdi
call fcn.12858bf0
nop
mov rcx, rsi
call fcn.12958250
test bl, bl
jne 0x1285eb60
xor al, al
jmp 0x1285eb62
mov al, 1
test r13, r13
je 0x1285eb70
mov byte [r13], al
mov rax, rdi
jmp 0x1285eb73
mov rax, rdi
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.12959850
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret