joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b170c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov r14, rcx
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400b1764
test byte [rcx + 0x1c], 1
je 0x1400b1764
cmp byte [rcx + 0x19], 4
jb 0x1400b1764
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x23
call fcn.14001dd24
mov eax, dword [rsp + 0x70]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rdi
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
je 0x1400b17d0
mov rcx, qword [0x14017d3a8]
cmp rcx, r12
je 0x1400b17c0
test byte [rcx + 0x1c], 1
je 0x1400b17c0
cmp byte [rcx + 0x19], 2
jb 0x1400b17c0
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x24]
lea r8, [0x14000a328]
xor r9d, r9d
call fcn.14001de24
mov rcx, qword [0x14017d3a8]
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x1400b17d7
mov rcx, qword [0x14017d3a8]
cmp rcx, r12
je 0x1400b17fd
test byte [rcx + 0x1c], 1
je 0x1400b17fd
cmp byte [rcx + 0x19], 4
jb 0x1400b17fd
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x25
call fcn.14001dd24
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x1400b1820
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov ebp, r9d
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1400b186b
test byte [rcx + 0x1c], 1
je 0x1400b186b
cmp byte [rcx + 0x19], 4
jb 0x1400b186b
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x26
call fcn.14001dd24
xor ebx, ebx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x78], ebx
mov dword [rdi], ebx
test rsi, rsi
jne 0x1400b1898
lea r8, [0x14000a0e8]
lea rcx, [0x140009f80]
mov edx, 0x2d5
call fcn.1400a8be8
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov rdx, rsi
mov rcx, r14
mov dword [rsp + 0x78], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test ebp, ebp
je 0x1400b18d9
cmp eax, 2
jne 0x1400b18d9
lea ebx, [rax - 1]
jmp 0x1400b1951
test eax, eax
je 0x1400b192f
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
mov ebx, eax
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x1400b1985
test byte [rcx + 0x1c], 1
je 0x1400b195f
cmp byte [rcx + 0x19], 3
jb 0x1400b195f
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x27
mov r9, rsi
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
jmp 0x1400b1958
cmp dword [rsp + 0x68], 4
je 0x1400b193d
mov ebx, 0x8007065d
jmp 0x1400b1951
cmp dword [rsp + 0x78], 4
je 0x1400b194b
mov ebx, 0x80004005
jmp 0x1400b1951
mov eax, dword [rsp + 0x70]
mov dword [rdi], eax
lea rdi, [0x14017d3a8]
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x1400b1985
test byte [rcx + 0x1c], 1
je 0x1400b1985
cmp byte [rcx + 0x19], 4
jb 0x1400b1985
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x28
call fcn.14001dd24
mov eax, ebx
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b1998
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, r8
mov r15, rdx
mov rbp, rcx
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1400b19e5
test byte [rcx + 0x1c], 1
je 0x1400b19e5
cmp byte [rcx + 0x19], 4
jb 0x1400b19e5
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x2c
call fcn.14001dd24
xor ebx, ebx
xor ecx, ecx
lea esi, [rbx + 0x40]
mov qword [r15], rbx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], esi
mov dword [r14], ebx
jmp 0x1400b1a74
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1400b1a33
test byte [rcx + 0x1c], 1
je 0x1400b1a33
cmp byte [rcx + 0x19], 4
jb 0x1400b1a33
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x2d
mov r9d, esi
call fcn.14001de24
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x70]
lea rdx, [0x1400168c8]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x68], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400b1b2e
cmp eax, 0xea
jne 0x1400b1ae4
mov esi, dword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
jne 0x1400b19fc
mov ebx, 0x8007000e
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1400b1ad1
test byte [rcx + 0x1c], 1
je 0x1400b1ad1
cmp byte [rcx + 0x19], 4
jb 0x1400b1ad1
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x2f
call fcn.14001dd24
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1400b1a94
test byte [rcx + 0x1c], 1
je 0x1400b1a94
cmp byte [rcx + 0x19], 2
jb 0x1400b1a94
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x2e
mov r9d, ebx
call fcn.14001de24
jmp 0x1400b1a94
cmp dword [rsp + 0x70], 7
je 0x1400b1b3f
mov ebx, 0x8000ffff
jmp 0x1400b1a94
mov eax, dword [rsp + 0x68]
mov qword [r15], rdi
mov rdi, rbx
mov dword [r14], eax
jmp 0x1400b1a94
Function at 0x1400b1bf0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, rcx
mov qword [rax + 8], rbx
test rcx, rcx
jne 0x1400b1c2b
lea r8, [0x14000a110]
lea rcx, [0x140009f80]
mov edx, 0x63c
call fcn.1400a8be8
and qword [r14], rbx
mov edi, 0x208
mov ecx, edi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rsi, rax
test rax, rax
jne 0x1400b1c4a
mov edi, 0x8007000e
jmp 0x1400b1ca4
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
test eax, eax
js 0x1400b1c8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400a97c0
mov edi, eax
test eax, eax
js 0x1400b1c88
mov rax, qword [rsp + 0x30]
mov qword [r14], rax
jmp 0x1400b1c8d
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rbx, rbx
je 0x1400b1ca4
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400b2068
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor esi, esi
xor r12b, r12b
xor bpl, bpl
and dword [rax + 8], esi
mov r15, rcx
mov qword [rax + 0x10], rsi
test rcx, rcx
jne 0x1400b20ae
lea r8, [0x14000a1a8]
lea rcx, [0x140009f80]
mov edx, 0x70d
call fcn.1400a8be8
mov ecx, CoDisconnectObject
mov byte [r15], sil
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov r14, rax
test rax, rax
jne 0x1400b20ce
mov edi, 0x8007000e
jmp 0x1400b22cd
xor eax, eax
lea rcx, [0x14000a1b8]
mov rdx, r14
mov qword [r14], rax
lea ebx, [rax + 9]
mov qword [r14 + 8], rax
mov r8d, ebx
mov word [r14 + 0x10], ax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400b2224
mov ecx, ebx
lea rdi, [0x14000a190]
mov rsi, r14
repe cmpsw word [rsi], word [rdi]
lea rbx, [0x14017d3a8]
jne 0x1400b2142
mov bpl, 1
mov rcx, qword [0x14017d3a8]
cmp rcx, rbx
je 0x1400b2142
test byte [rcx + 0x1c], bpl
je 0x1400b2142
cmp byte [rcx + 0x19], 4
jb 0x1400b2142
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x5a
call fcn.14001dd24
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [0x14000a1d8]
lea rcx, [0x14000a1f0]
call fcn.1400b13f0
mov rsi, qword [rsp + 0x68]
mov edi, eax
test eax, eax
js 0x1400b22b6
lea rdx, [0x14000a250]
mov rcx, rsi
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x1400b2194
lea rdx, [0x14000a268]
mov rcx, rsi
call sub.msvcrt.dll__wcsicmp
test eax, eax
jne 0x1400b2197
mov r12b, 1
mov rcx, qword [0x14017d3a8]
cmp rcx, rbx
je 0x1400b21d7
test byte [rcx + 0x1c], 1
je 0x1400b21d7
cmp byte [rcx + 0x19], 4
jb 0x1400b21d7
mov rcx, qword [rcx + 0x10]
movzx eax, r12b
lea r8, [0x14000a328]
movzx r9d, bpl
mov edx, 0x5d
mov dword [rsp + 0x20], eax
call fcn.1400285b4
mov rcx, qword [0x14017d3a8]
test bpl, bpl
je 0x1400b22b6
test r12b, r12b
je 0x1400b22b6
mov byte [r15], 1
cmp rcx, rbx
je 0x1400b22b6
test byte [rcx + 0x1c], 1
je 0x1400b22b6
cmp byte [rcx + 0x19], 4
jb 0x1400b22b6
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x5e
call fcn.14001dd24
jmp 0x1400b22b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
cmp edi, 0x800700cb
je 0x1400b2279
mov rcx, qword [0x14017d3a8]
lea rbx, [0x14017d3a8]
cmp rcx, rbx
je 0x1400b22c4
test byte [rcx + 0x1c], 1
je 0x1400b22c4
cmp byte [rcx + 0x19], 2
jb 0x1400b22c4
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x5c
mov r9d, edi
call fcn.14001de24
jmp 0x1400b22c4
mov rcx, qword [0x14017d3a8]
lea rbx, [0x14017d3a8]
cmp rcx, rbx
je 0x1400b22b4
test byte [rcx + 0x1c], 1
je 0x1400b22b4
cmp byte [rcx + 0x19], 4
jb 0x1400b22b4
mov rcx, qword [rcx + 0x10]
lea r9, [0x14000a1b8]
lea r8, [0x14000a328]
mov edx, 0x5b
call fcn.14001ec40
xor edi, edi
test rsi, rsi
je 0x1400b22c4
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov eax, edi
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400b22ec
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x50
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebp, edx
mov rdi, rcx
mov rcx, qword [0x14017d3a8]
lea r15, [0x14017d3a8]
lea r12, [0x14000a328]
cmp rcx, r15
je 0x1400b234d
test byte [rcx + 0x1c], 1
je 0x1400b234d
cmp byte [rcx + 0x19], 4
jb 0x1400b234d
mov rcx, qword [rcx + 0x10]
mov edx, 0x5f
mov r8, r12
call fcn.14001dd24
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rsi, rax
test rdi, rdi
jne 0x1400b2375
lea r8, [0x14000a290]
lea rcx, [0x140009f80]
mov edx, 0x78f
call fcn.1400a8be8
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400b23de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
mov ebx, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x1400b2523
test byte [rcx + 0x1c], 1
je 0x1400b2501
cmp byte [rcx + 0x19], 2
jb 0x1400b2501
mov rcx, qword [rcx + 0x10]
mov edx, 0x60
mov r9d, eax
mov r8, r12
call fcn.14001de24
jmp 0x1400b24fa
mov eax, dword [rsp + 0x24]
cmp eax, 1
jne 0x1400b2425
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x1400b2523
test byte [rcx + 0x1c], al
je 0x1400b2501
cmp byte [rcx + 0x19], 4
jb 0x1400b2501
lea edx, [rax + 0x60]
mov rcx, qword [rcx + 0x10]
lea r9, [0x14000a280]
mov r8, r12
call fcn.14001ec40
jmp 0x1400b24fa
mov r13d, 0x1388
cmp eax, 3
je 0x1400b2435
cmp eax, 4
jne 0x1400b247a
mov ecx, dword [rsp + 0x38]
cmp ecx, r13d
cmovb ecx, r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400b24e6
cmp dword [rsp + 0x24], 1
je 0x1400b24c4
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r11, rax
sub r11, rsi
cmp r11, rbp
ja 0x1400b248d
mov eax, dword [rsp + 0x24]
jmp 0x1400b242b
mov rcx, qword [0x14017d3a8]
cmp eax, 1
je 0x1400b2501
mov ebx, 0x80780129
jmp 0x1400b2501
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x1400b24bd
test byte [rcx + 0x1c], 1
je 0x1400b24bd
cmp byte [rcx + 0x19], 2
jb 0x1400b24bd
mov rcx, qword [rcx + 0x10]
mov edx, 0x63
mov r8, r12
call fcn.14001dd24
mov rcx, qword [0x14017d3a8]
mov ebx, 0x800705b4
jmp 0x1400b2501
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x1400b2523
test byte [rcx + 0x1c], 1
je 0x1400b2501
cmp byte [rcx + 0x19], 4
jb 0x1400b2501
mov edx, 0x62
jmp 0x1400b240d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x1400b2523
test byte [rcx + 0x1c], 1
je 0x1400b2523
cmp byte [rcx + 0x19], 4
jb 0x1400b2523
mov rcx, qword [rcx + 0x10]
mov edx, 0x64
mov r8, r12
call fcn.14001dd24
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140168920
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400b2e44
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [0x14017d3a8]
lea r15, [0x14017d3a8]
cmp rcx, r15
je 0x1400b2e94
test byte [rcx + 0x1c], 1
je 0x1400b2e94
cmp byte [rcx + 0x19], 4
jb 0x1400b2e94
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x8e
call fcn.14001dd24
test rsi, rsi
jne 0x1400b2eb1
lea r8, [0x14000a2c0]
lea rcx, [0x140009f80]
mov edx, 0xa62
call fcn.1400a8be8
and qword [rsi], 0
mov ebx, 0x28
mov ecx, ebx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
jne 0x1400b2ed4
mov ebx, 0x8007000e
jmp 0x1400b2ff9
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
xor ebx, ebx
mov rdx, rdi
lea ecx, [rbx + 0x14]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebp, eax
cmp eax, 0x14
jbe 0x1400b2fa8
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r11d, ebp
mov eax, reloc.ADVAPI32.dll_TraceEvent
add r11, r11
cmp r11, rax
jbe 0x1400b2f1d
mov ebx, 0x80070216
jmp 0x1400b2ff9
mov ecx, r11d
mov ebx, r11d
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
je 0x1400b2eca
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rdx, rdi
mov ecx, ebp
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebp
ja 0x1400b2f57
test eax, eax
jne 0x1400b2fdf
test eax, eax
jne 0x1400b2f71
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400b2f76
mov ebx, 0x8007000e
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x1400b2feb
test byte [rcx + 0x1c], 1
je 0x1400b2feb
cmp byte [rcx + 0x19], 2
jb 0x1400b2feb
mov edx, 0x8f
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov r9d, ebx
call fcn.14001de24
jmp 0x1400b2fe4
test eax, eax
jne 0x1400b2fdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x1400b2feb
test byte [rcx + 0x1c], 1
je 0x1400b2feb
cmp byte [rcx + 0x19], 2
jb 0x1400b2feb
mov edx, 0x90
jmp 0x1400b2f93
mov qword [rsi], rdi
xor edi, edi
mov rcx, qword [0x14017d3a8]
test rdi, rdi
je 0x1400b3000
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x1400b3026
test byte [rcx + 0x1c], 1
je 0x1400b3026
cmp byte [rcx + 0x19], 4
jb 0x1400b3026
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a328]
mov edx, 0x91
call fcn.14001dd24
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r15
ret
Function at 0x1400b39a8
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov esi, r8d
mov rdi, rdx
mov rbp, rcx
test rcx, rcx
jne 0x1400b39e4
lea r8, [0x14000a3d0]
lea rcx, [0x14000a358]
mov edx, 0x206
call fcn.1400a8be8
test rdi, rdi
jne 0x1400b3a01
lea r8, [0x14000a388]
lea rcx, [0x14000a358]
mov edx, 0x207
call fcn.1400a8be8
test esi, esi
je 0x1400b3a5d
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
jns 0x1400b3a94
mov ecx, eax
call fcn.14005246c
mov ebx, eax
mov rcx, qword [0x14017d3a8]
lea rdx, [0x14017d3a8]
cmp rcx, rdx
je 0x1400b3a94
test byte [rcx + 0x1c], 1
je 0x1400b3a94
cmp byte [rcx + 0x19], 2
jb 0x1400b3a94
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a450]
mov edx, reloc.ole32.dll_CoDisconnectObject
mov r9d, eax
call fcn.14001de24
jmp 0x1400b3a94
mov rcx, qword [0x14017d3a8]
lea rdx, [0x14017d3a8]
cmp rcx, rdx
je 0x1400b3a94
test byte [rcx + 0x1c], 1
je 0x1400b3a94
cmp byte [rcx + 0x19], 5
jb 0x1400b3a94
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a450]
mov edx, 0x14
mov r9, rdi
call fcn.140029954
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b5a98
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12d, edx
mov r15, rcx
xor r13d, r13d
xor edx, edx
xor ecx, ecx
mov ebp, r13d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
test eax, eax
jne 0x1400b5b2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1400b5ccb
test byte [rcx + 0x1c], 1
je 0x1400b5ccb
cmp byte [rcx + 0x19], 2
jb 0x1400b5ccb
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x3e]
lea r8, [0x14000a730]
mov r9d, ebx
call fcn.14001de24
jmp 0x1400b5ccb
or rbx, 0xffffffffffffffff
mov rdx, rbx
inc rdx
cmp word [r15 + rdx*2], r13w
jne 0x1400b5b31
lea r14d, [rax + 1]
xor ecx, ecx
inc r14
add r14, rdx
lea rdx, [r14 + r14]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x1400b5b63
mov ebx, 0x8007000e
jmp 0x1400b5ce7
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
ja 0x1400b5c81
test eax, eax
je 0x1400b5c6b
inc rbx
cmp word [rdi + rbx*2], r13w
jne 0x1400b5b7e
mov eax, 0x5c
cmp ax, word [rdi + rbx*2 - 2]
je 0x1400b5bde
lea r8, [0x140001800]
mov rdx, r14
mov rcx, rdi
call fcn.14006892c
mov ebx, eax
test eax, eax
jns 0x1400b5bde
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1400b5cbd
test byte [rcx + 0x1c], 1
je 0x1400b5cbd
cmp byte [rcx + 0x19], 2
jb 0x1400b5cbd
mov edx, 0x40
jmp 0x1400b5c22
mov r8, r15
mov rdx, r14
mov rcx, rdi
call fcn.14006892c
mov ebx, eax
test eax, eax
jns 0x1400b5c3a
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1400b5cbd
test byte [rcx + 0x1c], 1
je 0x1400b5cbd
cmp byte [rcx + 0x19], 2
jb 0x1400b5cbd
mov edx, 0x41
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a730]
mov r9d, ebx
call fcn.14001de24
jmp 0x1400b5cbd
mov r8d, r12d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbp, rax
test rax, rax
jne 0x1400b5c66
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400b5cbd
mov ebx, r13d
jmp 0x1400b5cbd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400b5c86
mov ebx, 0x8007006f
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1400b5cbd
test byte [rcx + 0x1c], 1
je 0x1400b5cbd
cmp byte [rcx + 0x19], 2
jb 0x1400b5cbd
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000a730]
mov edx, 0x3f
mov r9d, ebx
call fcn.14001de24
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbp, rbp
jne 0x1400b5cef
test ebx, ebx
jne 0x1400b5ce7
lea r8, [0x14000a720]
lea rcx, [0x14000a4a0]
mov edx, 0x649
call fcn.1400a8be8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rax, rbp
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400b7d70
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x450
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor ebp, ebp
mov rsi, rcx
test rcx, rcx
jne 0x1400b7db9
lea r8, [0x14000a990]
lea rcx, [0x14000a8e0]
mov edx, 0x23c
call fcn.1400a8be8
mov qword [rsi], rbp
mov rbx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
cmp rbx, r14
je 0x1400b7df7
test byte [rbx + 0x1c], 1
je 0x1400b7df7
cmp byte [rbx + 0x19], 4
jb 0x1400b7df7
mov rcx, qword [rbx + 0x10]
lea r8, [0x14000aa00]
mov edx, 0x23
call fcn.14001dd24
mov rbx, qword [0x14017d3a8]
mov edi, 0x208
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, edi
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x230]
mov r8d, edi
xor edx, edx
call sub.msvcrt.dll_memset
lea r8, [0x1400026d0]
lea rax, [rsp + 0x20]
mov r11d, 0x104
sub r8, rax
lea rcx, [rsp + 0x20]
mov edx, r11d
mov edi, ebp
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400b7e5e
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400b7e5e
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400b7e3c
test rdx, rdx
jne 0x1400b7e6c
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], bp
test edi, edi
js 0x1400b7ebf
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8d, r11d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1400b7ea3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x1400b7eb8
lea rcx, [rsp + 0x230]
xor r8d, r8d
mov rdx, rsi
call fcn.1400a99e4
mov edi, eax
mov rbx, qword [0x14017d3a8]
cmp rbx, r14
je 0x1400b7ee5
test byte [rbx + 0x1c], 1
je 0x1400b7ee5
cmp byte [rbx + 0x19], 4
jb 0x1400b7ee5
mov rcx, qword [rbx + 0x10]
lea r8, [0x14000aa00]
mov edx, 0x24
call fcn.14001dd24
mov eax, edi
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140168920
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400c71ac
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x30
mov rsi, rdx
mov rbp, rcx
xor edi, edi
lea r15, [0x14017d3a8]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400c723c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x20
jne 0x1400c7273
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x1400c722a
test byte [rcx + 0x1c], 1
je 0x1400c722a
cmp byte [rcx + 0x19], 3
jb 0x1400c722a
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x32]
lea r8, [0x14000bbb0]
mov r9, rbp
mov qword [rsp + 0x20], rsi
call fcn.14001ed50
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 5
jb 0x1400c71d4
cmp edi, 5
jne 0x1400c72bb
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x1400c726c
test byte [rcx + 0x1c], 1
je 0x1400c726c
cmp byte [rcx + 0x19], 2
jb 0x1400c726c
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x4f]
lea r8, [0x14000bbb0]
call fcn.14001dd24
mov eax, 0x80780163
jmp 0x1400c72bd
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x1400c72ac
test byte [rcx + 0x1c], 1
je 0x1400c72ac
cmp byte [rcx + 0x19], 2
jb 0x1400c72ac
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
lea r8, [0x14000bbb0]
mov edx, 0x53
mov r9, rbp
mov qword [rsp + 0x20], rsi
call fcn.140028ec8
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1400c72bd
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret