joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ef30
Capabilities:
Delete directory

Disassembly:
push rbp
sub rsp, 0x3d0
lea rbp, [rsp + 0x80]
mov rax, qword [0x00442300]
mov rax, qword [rax]
xor rax, rbp
mov qword [rbp + 0x348], rax
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], rdx
mov dword [rbp - 0x24], 1
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
call fcn.00431e40
mov qword [rbp - 0x20], rax
cmp rax, 0
jne 0x43ef8a
mov dword [rbp], 0
jmp 0x43f143
jmp 0x43ef8f
mov rcx, qword [rbp - 0x20]
call fcn.00431fa0
mov qword [rbp - 0x18], rax
cmp rax, 0
je 0x43f10d
mov rcx, qword [rbp - 0x18]
lea rdx, [0x00449813]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
cmp eax, 0
je 0x43efd8
mov rcx, qword [rbp - 0x18]
lea rdx, [0x004497e0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
cmp eax, 0
jne 0x43efdd
jmp 0x43ef8f
mov rcx, qword [rbp - 8]
lea r8, [rbp + 0x30]
mov rdx, qword [rbp - 0x10]
mov r9, qword [rbp - 0x18]
mov rax, rsp
mov qword [rax + 0x30], r9
mov qword [rax + 0x28], rdx
lea rdx, str._s__s
mov qword [rax + 0x20], rdx
lea rdx, [rbp + 4]
mov r9d, 0x30c
call fcn.0041efc0
lea rcx, [rbp + 8]
add rcx, 8
xor edx, edx
mov r8d, 0x20
call fcn.0041ba90
cmp dword [rbp + 4], 0
je 0x43f03d
mov dword [rbp - 0x24], 0
jmp 0x43ef8f
mov rcx, qword [rbp - 8]
lea rdx, [rbp + 0x30]
lea r8, [rbp + 8]
add r8, 8
call fcn.00422900
cmp eax, 0
jne 0x43f0ba
mov rax, qword [rbp - 8]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rbp - 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_strerror
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
mov r8, rax
mov rax, rsp
mov qword [rax + 0x38], r8
mov qword [rax + 0x30], rdx
lea r8, str.remove_directory
mov qword [rax + 0x28], r8
lea rdx, str._s:_mg_stat__s__failed:__s
mov qword [rax + 0x20], rdx
xor eax, eax
mov edx, eax
mov r9d, 0x275c
call fcn.0041e440
mov dword [rbp - 0x24], 0
cmp dword [rbp + 0x20], 0
je 0x43f0e6
mov rcx, qword [rbp - 8]
lea rdx, [rbp + 0x30]
call fcn.0043ef30
cmp eax, 0
jne 0x43f0e1
mov dword [rbp - 0x24], 0
jmp 0x43f108
mov rcx, qword [rbp - 8]
lea rdx, [rbp + 0x30]
call fcn.004324f0
cmp eax, 0
jne 0x43f103
mov dword [rbp - 0x24], 0
jmp 0x43f108
jmp 0x43ef8f
mov rcx, qword [rbp - 0x20]
call fcn.00432140
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__rmdir]
mov ecx, eax
xor eax, eax
cmp ecx, 0
mov byte [rbp - 0x39], al
je 0x43f13a
mov al, 1
mov byte [rbp - 0x39], al
jmp 0x43f13a
mov al, byte [rbp - 0x39]
mov eax, dword [rbp - 0x24]
mov dword [rbp], eax
mov eax, dword [rbp]
mov dword [rbp - 0x40], eax
mov rcx, qword [rbp + 0x348]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x43f16b
jmp 0x43f170
call fcn.0041bf30
mov eax, dword [rbp - 0x40]
add rsp, 0x3d0
pop rbp
ret
Function at 0x43fb40
Capabilities:
Set socket configuration

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov rax, qword [0x00442300]
mov rax, qword [rax]
xor rax, rbp
mov qword [rbp - 8], rax
mov qword [rbp - 0x18], rcx
mov dword [rbp - 0xc], edx
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 8]
cmp eax, 2
je 0x43fb84
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 8]
cmp eax, 0x17
jne 0x43fbc2
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
mov edx, 6
mov r8d, 1
lea r9, [rbp - 0xc]
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0
je 0x43fbbd
mov dword [rbp - 0x10], 1
jmp 0x43fbc9
jmp 0x43fbc2
mov dword [rbp - 0x10], 0
mov eax, dword [rbp - 0x10]
mov dword [rbp - 0x1c], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x43fbee
jmp 0x43fbf3
call fcn.0041bf30
mov eax, dword [rbp - 0x1c]
add rsp, 0x50
pop rbp
ret

Function at 0x4401e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
mov rax, qword [0x00442310]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x44024d
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x44024d
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x44024d
movzx edx, word [rax + 6]
test edx, edx
je 0x44024d
sub rcx, qword [0x00442310]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x440239
add rax, 0x28
add edx, 0xffffffff
je 0x44024d
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x440230
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x440230
jmp 0x44024f
xor eax, eax
pop rbp
ret

Function at 0x440260
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [0x00442310]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x440299
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x440299
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x440299
movzx eax, word [rcx + rdx + 6]
pop rbp
ret

Function at 0x440310
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
mov rax, qword [0x00442310]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x440340
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x440340
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x440342
xor eax, eax
pop rbp
ret
Function at 0x140002e88
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x14002a288]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
lea rax, [rsp + 0x30]
mov qword [r8], r15
lea rdx, [rsp + 0x30]
sub rcx, rax
mov r14, r8
mov r9d, 0x104
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x140002ef9
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140002ef9
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x140002ed7
test r9, r9
lea rax, [rdx - 2]
lea r8, [0x1400217b8]
cmovne rax, rdx
lea rcx, [rsp + 0x30]
mov word [rax], r15w
call fcn.140001730
mov ebx, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, ebx
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rdi, rax
test rax, rax
jne 0x140002f63
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x140003030
mov edx, 0xc0
mov rcx, qword [rbp + 0x168]
lea r8, [0x140021784]
call fcn.140002c6c
mov esi, eax
jmp 0x140003033
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r15d
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call fcn.140002d34
mov esi, eax
test eax, eax
jns 0x140002fa0
mov rcx, qword [rbp + 0x168]
lea r8, [0x140021784]
mov r9d, eax
mov edx, 0xc6
call fcn.140002c38
jmp 0x140003033
lea r8, [0x1400217c0]
lea rcx, [rsp + 0x30]
call fcn.140001730
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rbx, rax
test rax, rax
jne 0x140002fd2
mov edx, 0xcc
jmp 0x140002f49
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140002d34
mov esi, eax
test eax, eax
jns 0x14000300f
mov rcx, qword [rbp + 0x168]
lea r8, [0x140021784]
mov r9d, eax
mov edx, 0xce
call fcn.140002c38
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140003085
jmp 0x140003033
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140003097
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
mov esi, r15d
test rdi, rdi
je 0x140003045
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140003073
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14001ae30
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [rbp + 0x168]
mov edx, 0x8f0
call fcn.140002c8c
int3
mov rcx, qword [rbp + 0x168]
mov edx, 0x8f0
call fcn.140002c8c
int3
mov rcx, qword [rbp + 0x168]
mov edx, 0x8f0
call fcn.140002c8c
int3
Function at 0x14000a4b8
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14002a288]
xor rax, rsp
mov qword [rbp + 0x20], rax
and qword [rsp + 0x58], 0
mov r14, rdx
mov rcx, r14
lea rdx, [rsp + 0x58]
call qword [sym.imp.ext_ms_win_session_usermgr_l1_1_0.dll_UMgrQueryUserContext]
test eax, eax
jns 0x14000a653
and dword [rsp + 0x30], 0
lea rcx, [rbp - 0x40]
mov ebx, 0x54
xor edx, edx
mov r8d, ebx
call sub.msvcrt.dll_memset
mov r8d, ebx
lea rcx, [rsp + 0x60]
xor edx, edx
call sub.msvcrt.dll_memset
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
and qword [rsp + 0x48], 0
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x50], 1
call qword [sym.imp.ext_ms_win_session_usermgr_l1_1_0.dll_UMgrQueryDefaultAccountToken]
cmp byte [rsp + 0x50], 0
mov edi, eax
je 0x14000a591
mov rsi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov r15, qword [rsi]
lea rax, [r15 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000a58e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ebx, 0x54
mov qword [rsi], r12
test edi, edi
jns 0x14000a59f
mov edx, 0x5b5
jmp 0x14000a625
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov r9d, ebx
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x40]
mov edx, 1
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
jne 0x14000a5cb
mov edx, 0x5b6
jmp 0x14000a5f4
lea rax, [rsp + 0x30]
mov r9d, ebx
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
jne 0x14000a608
mov edx, 0x5b7
mov rcx, qword [rbp + 0x58]
lea r8, str.onecore_sdktoolsconnectivitydevtoolsbootstrappingwinrtlibdevelopertoolsmanager.cpp
call fcn.140002c6c
mov edi, eax
jmp 0x14000a63c
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
test eax, eax
jne 0x14000a63a
mov edi, 0x80070005
mov edx, 0x5bb
mov rcx, qword [rbp + 0x58]
lea r8, str.onecore_sdktoolsconnectivitydevtoolsbootstrappingwinrtlibdevelopertoolsmanager.cpp
mov r9d, edi
call fcn.140002c38
jmp 0x14000a63c
xor edi, edi
mov rcx, qword [rsp + 0x38]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x14000a651
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.14001ae30
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14000cc34
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov r11, r8
mov r10, rdx
xor r8d, r8d
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
mov rdi, rcx
mov rbx, rdx
shr rbx, 1
lea rax, [rbx + rbx*2]
sub r10, rax
cmp r10, 1
mov rax, r10
setne r8b
add r8, 2
neg rax
sbb rax, rax
and rax, r8
lea rax, [rax + rbx*4]
inc rax
cmp rax, 0x81
ja 0x14000cda4
xor r9d, r9d
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_D
xor esi, esi
test rbx, rbx
je 0x14000cd1a
movzx ecx, byte [rdi]
inc esi
movzx edx, byte [rdi + 2]
mov eax, ecx
movzx r8d, byte [rdi + 1]
and cl, 3
shr rax, 2
add rdi, 3
shl cl, 4
movzx ecx, cl
mov al, byte [rax + r14]
mov byte [r9 + r11], al
mov eax, r8d
shr rax, 4
and r8b, 0xf
or rcx, rax
shl r8b, 2
mov al, byte [rcx + r14]
mov byte [r9 + r11 + 1], al
mov eax, edx
shr rax, 6
and edx, 0x3f
movzx ecx, r8b
or rcx, rax
mov al, byte [rcx + r14]
mov byte [r9 + r11 + 2], al
mov al, byte [rdx + r14]
mov byte [r9 + r11 + 3], al
add r9, 4
mov eax, esi
cmp rax, rbx
jb 0x14000cca9
sub r10, 1
je 0x14000cd70
cmp r10, 1
jne 0x14000cd9f
movzx ecx, byte [rdi]
movzx edx, byte [rdi + 1]
mov eax, ecx
shr rax, 2
and cl, 3
shl cl, 4
movzx ecx, cl
mov al, byte [rax + r14]
mov byte [r9 + r11], al
mov eax, edx
shr rax, 4
and dl, 0xf
or rcx, rax
shl dl, 2
mov al, byte [rcx + r14]
mov byte [r9 + r11 + 1], al
movzx eax, dl
mov al, byte [rax + r14]
mov byte [r9 + r11 + 2], al
mov byte [r9 + r11 + 3], 0x3d
jmp 0x14000cd9b
movzx ecx, byte [rdi]
mov eax, ecx
and cl, 3
shr rax, 2
shl cl, 4
mov al, byte [rax + r14]
mov byte [r9 + r11], al
movzx eax, cl
mov al, byte [rax + r14]
mov byte [r9 + r11 + 1], al
mov word [r9 + r11 + 2], 0x3d3d
add r9, 4
mov byte [r9 + r11], 0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
ret
Function at 0x140011b1c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
lea r12, [rcx + 8]
mov byte [rbp - 0x10], 1
mov r13, rcx
mov qword [rbp - 0x20], r12
mov rax, r8
lea rcx, [rbp - 0x18]
mov r10, rdx
mov qword [rsp + 0x20], rcx
xor esi, esi
mov rcx, r10
mov r9d, 0x20019
mov qword [rbp - 0x18], rsi
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov r14d, eax
cmp byte [rbp - 0x10], sil
je 0x140011ba3
mov rdi, qword [rbp - 0x20]
mov r15, qword [rbp - 0x18]
mov rsi, qword [rdi]
test rsi, rsi
je 0x140011b9e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov qword [rdi], r15
xor esi, esi
test r14d, r14d
je 0x140011bc5
mov rcx, qword [rbp + 0x38]
lea r8, [0x140022678]
mov r9d, r14d
mov edx, 0xcd
call fcn.14000d2e8
jmp 0x140011d27
lea rcx, [rbp + 0x40]
mov dword [rbp + 0x40], 0x100
mov qword [rsp + 0x30], rcx
lea rax, [r13 + 0x18]
mov rcx, qword [r12]
lea r8, str.ExtensionClass
mov qword [rsp + 0x28], rax
mov r15d, 2
mov r9d, r15d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
lea rbx, [0x140022678]
mov r14d, 0x105
cmp eax, r15d
cmove eax, esi
test eax, eax
je 0x140011c2c
mov rcx, qword [rbp + 0x38]
mov r9d, eax
mov r8, rbx
mov edx, r14d
call fcn.14000d2e8
mov edi, eax
jmp 0x140011c2e
mov edi, esi
test edi, edi
jns 0x140011c4d
mov edx, 0xd0
mov rcx, qword [rbp + 0x38]
mov r9d, edi
mov r8, rbx
call fcn.140002c38
mov eax, edi
jmp 0x140011d27
mov rcx, qword [r12]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, str.Test
lea rax, [rbp + 0x58]
mov dword [rbp + 0x58], esi
mov qword [rsp + 0x28], rax
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], rsi
mov dword [rbp + 0x40], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
cmp eax, r15d
cmove eax, esi
test eax, eax
je 0x140011ca7
mov rcx, qword [rbp + 0x38]
mov r9d, eax
mov r8, rbx
mov edx, r14d
call fcn.14000d2e8
mov edi, eax
jmp 0x140011ca9
mov edi, esi
test edi, edi
jns 0x140011cb4
mov edx, 0xd4
jmp 0x140011c37
cmp dword [rbp + 0x58], esi
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x30], rcx
lea r8, str.VelocityFeatureId
mov rcx, qword [r12]
setne al
mov byte [r13 + 0x10], al
mov r9d, 0x10
lea rax, [r13 + 0x14]
mov dword [rbp + 0x40], 4
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
cmp eax, r15d
cmove eax, esi
test eax, eax
je 0x140011d15
mov rcx, qword [rbp + 0x38]
mov r9d, eax
mov r8, rbx
mov edx, r14d
call fcn.14000d2e8
mov edi, eax
jmp 0x140011d17
mov edi, esi
test edi, edi
jns 0x140011d25
mov edx, 0xd8
jmp 0x140011c37
xor eax, eax
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140011d50
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14002a288]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor ebp, ebp
mov dword [rsp + 0x40], 0x80
mov qword [rsp + 0x38], rbp
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
mov rsi, r8
mov rdi, rcx
mov qword [rsp + 0x28], rbp
mov rcx, qword [rcx + 8]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x140011dce
mov rcx, qword [rsp + 0x178]
lea r8, [0x140022678]
mov r9d, eax
mov edx, 0x12e
call fcn.14000d2e8
jmp 0x140011eb7
lea rdx, [0x14002085f]
mov ecx, 0x118
call fcn.14001b338
mov rbx, rax
test rax, rax
je 0x140011e13
lea rax, [0x14001f300]
xor edx, edx
mov qword [rbx], rax
lea rcx, [rbx + 0x1a]
mov qword [rbx + 8], rbp
mov r8d, 0xfe
mov byte [rbx + 0x10], bpl
mov dword [rbx + 0x14], ebp
mov word [rbx + 0x18], bp
call sub.msvcrt.dll_memset
jmp 0x140011e16
mov rbx, rbp
test rbx, rbx
jne 0x140011e40
mov rcx, qword [rsp + 0x178]
lea r8, [0x140022678]
mov ebx, 0x8007000e
mov edx, 0x130
mov r9d, ebx
call fcn.140002c38
mov eax, ebx
jmp 0x140011eb7
mov rdx, qword [rdi + 8]
lea r8, [rsp + 0x50]
mov rcx, rbx
call fcn.140011b1c
mov edi, eax
test eax, eax
jns 0x140011e99
mov rcx, qword [rsp + 0x178]
lea r8, [0x140022678]
mov r9d, eax
mov edx, 0x131
call fcn.140002c38
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140011e82
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rax, [0x14001f360]
mov rcx, rbx
mov qword [rbx], rax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, edi
jmp 0x140011eb7
mov rcx, qword [rsi]
mov qword [rsi], rbx
test rcx, rcx
je 0x140011eb5
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x1400202c0]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14001ae30
mov rbx, qword [rsp + 0x198]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014c68
Capabilities:
Add user account

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
cmp qword [rcx + 0x18], 8
lea rax, [0x140022350]
mov qword [rsp + 0x28], rax
mov rbx, rcx
jb 0x140014c92
mov rax, qword [rcx]
jmp 0x140014c95
mov rax, rbx
xor esi, esi
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
mov dword [rsp + 0x38], esi
lea r9, [rsp + 0x20]
mov dword [rsp + 0x50], 0x10241
lea r8, [rsp + 0x28]
mov qword [rsp + 0x58], rsi
lea edx, [rsi + 1]
xor ecx, ecx
mov dword [rsp + 0x3c], edx
movdqu xmmword [rsp + 0x40], xmm0
call qword [sym.imp.samcli.dll_NetUserAdd]
test eax, eax
je 0x140014d10
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x140014cfc
mov rcx, qword [rsp + 0x68]
lea r8, str.onecore_sdktoolsconnectivitydevtoolsbootstrappingwinrtlibdevtoolsuseraccount.cpp
mov r9d, edi
lea edx, [rsi + 0x3c]
call fcn.140002c38
cmp qword [rbx + 0x18], 8
jb 0x140014d0c
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, edi
jmp 0x140014d22
cmp qword [rbx + 0x18], 8
jb 0x140014d20
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
xor eax, eax
mov qword [rbx + 0x10], rsi
lea r11, [rsp + 0x60]
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400158cc
Capabilities:
Delete file
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x270
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14002a288]
xor rax, rsp
mov qword [rbp + 0x160], rax
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov byte [rsp + 0x30], 1
lea rcx, [rsp + 0x28]
call fcn.140014f3c
mov edi, eax
cmp byte [rsp + 0x30], 0
je 0x140015969
mov r15, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov r14, qword [rsi]
lea rax, [r14 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140015966
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov qword [rsi], r15
test edi, edi
jns 0x14001598d
mov rcx, qword [rbp + 0x188]
mov r9d, edi
lea r8, str.onecore_sdktoolsconnectivitydevtoolsbootstrappingwinrtlibdevtoolsuseraccount.cpp
mov edx, 0x144
call fcn.140002c38
jmp 0x140015a73
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov byte [rsp + 0x30], 1
lea r9, [rsp + 0x28]
mov r8, qword [rsp + 0x40]
xor edx, edx
lea rcx, [0x140021548]
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
mov edi, eax
cmp byte [rsp + 0x30], 0
je 0x1400159f8
mov r15, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov r14, qword [rsi]
test r14, r14
je 0x1400159f5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov qword [rsi], r15
test edi, edi
jns 0x140015a19
mov rcx, qword [rbp + 0x188]
mov r9d, edi
lea r8, str.onecore_sdktoolsconnectivitydevtoolsbootstrappingwinrtlibdevtoolsuseraccount.cpp
mov edx, 0x148
call fcn.140002c38
jmp 0x140015a62
mov r9, qword [rsp + 0x38]
lea r8, str._s.ssh_authorized_keys
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_swprintf_s]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x140015a60
mov rcx, qword [rbp + 0x188]
lea r8, str.onecore_sdktoolsconnectivitydevtoolsbootstrappingwinrtlibdevtoolsuseraccount.cpp
mov edx, 0x14f
call fcn.140002c6c
mov edi, eax
jmp 0x140015a62
xor edi, edi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140015a73
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x140015a88
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14001ae30
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret