joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f748
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14002f7cf
mov rsi, rbx
cmp word [rax], bp
je 0x14002f78e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14002f778
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14002f774
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140026ec0
mov rdi, rax
test rax, rax
je 0x14002f7bc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140016e90
mov rbp, rdi
xor ecx, ecx
call fcn.140026e84
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140036040
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140036068
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140036068
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
push rcx
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
add rax, rdx
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x10005417c
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov qword [rsp + 0xd8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbp, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
lea r13, [0x100008f60]
mov qword [rsp + 0x30], r13
lea r14, [0x100008fb0]
mov qword [rsp + 0x38], r14
lea r15, [0x100008f48]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], 0x183
mov dword [rsp + 0x4c], 0xb
mov dword [rsp + 0x50], 0xff
xor r12d, r12d
mov word [rax - 0xa8], r12w
mov byte [rax - 0xa6], r12b
mov byte [rax - 0xa5], 1
xor edx, edx
lea r8d, [r12 + 0x78]
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.1000e7c38
nop
mov word [rbp], r12w
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], 0x18b
mov dword [rsp + 0x4c], 0xb
mov dword [rsp + 0x50], 0xff
mov word [rsp + 0xd0], r12w
mov byte [rsp + 0xd2], r12b
mov byte [rsp + 0xd3], 1
xor edx, edx
lea r8d, [r12 + 0x78]
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
mov r9, rdi
lea r8, [0x100008fe0]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.1000e8e14
mov r8d, dword [rsp + 0x1a0]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, r12d
jne 0x1000542f7
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1000e760c
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea r9, [0x100009050]
mov r8d, esi
mov rdx, rbx
lea rcx, [rsp + 0xe0]
call fcn.1000e8ff8
int3
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], 0x193
mov dword [rsp + 0x4c], 0xb
mov dword [rsp + 0x50], 0xff
mov word [rsp + 0xd0], r12w
mov byte [rsp + 0xd2], r12b
mov byte [rsp + 0xd3], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
mov r9, rbp
lea r8, [0x1000090e0]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.1000e8e14
nop
lea rcx, [rsp + 0xe0]
call fcn.1000e7d24
nop
mov rcx, rbx
call fcn.1000e7688
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x10005ec58
Capabilities:
Get common file path
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push r12
push r13
push r14
sub rsp, 0x790
mov rax, qword [0x100175150]
xor rax, rsp
mov qword [rsp + 0x780], rax
xor edi, edi
mov rbx, rdx
lea r12, [0x1000091d0]
lea r13, [0x10000c368]
lea r14, [0x1000091b8]
lea rcx, [rsp + 0x58]
lea r8d, [rdi + 0x78]
xor edx, edx
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], 0xe3f
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0xff
mov word [rsp + 0xd0], di
mov byte [rsp + 0xd2], dil
mov byte [rsp + 0xd3], 1
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
xor r8d, r8d
call fcn.1000e7c38
lea rcx, [rsp + 0x360]
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
je 0x10005ee3d
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x360]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
cmp eax, edi
je 0x10005ee3d
lea rdx, [rsp + 0x570]
lea rcx, [rsp + 0x150]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, edi
je 0x10005edb4
lea rcx, [rsp + 0x570]
mov rdx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
lea rcx, [0x100008430]
lea r9, [0x100008450]
cmp eax, edi
lea rax, [0x100008440]
lea rdx, [0x100008420]
sete bl
mov r8d, 0xaa
cmp bl, dil
cmovne rax, rcx
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
call fcn.1000e826c
jmp 0x10005ee6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
lea rcx, [rsp + 0x58]
lea r8d, [rdx + 0x78]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r13
mov ebx, eax
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], 0xe4b
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0xff
mov word [rsp + 0xd0], di
mov byte [rsp + 0xd2], dil
mov byte [rsp + 0xd3], 1
call sub.msvcrt.dll_memset
movzx eax, bx
lea r9, [rsp + 0x150]
lea r8, [0x10000c2f0]
or eax, 0x80070000
cmp ebx, edi
lea rdx, [rsp + 0x30]
cmovle eax, ebx
lea rcx, [rsp + 0xe0]
mov dword [rsp + 0x20], eax
call fcn.1000e8e14
lea rax, [0x100008440]
lea r9, [0x100008450]
lea rdx, [0x100008420]
lea rcx, [rsp + 0xe0]
mov r8d, 0xaa
mov qword [rsp + 0x20], rax
call fcn.1000e826c
mov bl, dil
lea rcx, [rsp + 0xe0]
call fcn.1000e7d24
mov al, bl
mov rcx, qword [rsp + 0x780]
xor rcx, rsp
call fcn.1001303c0
lea r11, [rsp + 0x790]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x10006449c
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0xe0
mov rbp, rcx
mov r12, 0xffffffff80000002
mov rdx, r8
mov rcx, r12
mov rsi, r8
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor ebx, ebx
mov edi, eax
cmp eax, 2
jne 0x100064566
lea rax, [0x10000e360]
lea r8d, [rdi + 0x76]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [0x10000e320]
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [0x10000e348]
mov dword [rsp + 0x48], 0x5c
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0xff
mov word [rsp + 0xd0], bx
mov qword [rsp + 0x40], rax
mov byte [rsp + 0xd2], bl
mov byte [rsp + 0xd3], 1
call sub.msvcrt.dll_memset
lea r9, [0x10000e2e0]
lea rdx, [rsp + 0x30]
mov r8d, 0x80042308
mov rcx, rbp
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r12
call fcn.1000e8ff8
int3
cmp eax, ebx
je 0x100064601
lea rax, [0x10000e360]
xor edx, edx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [0x10000e320]
lea r8d, [rdx + 0x78]
mov qword [rsp + 0x38], rax
lea rax, [0x10000e348]
mov dword [rsp + 0x48], 0x5f
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0xff
mov word [rsp + 0xd0], bx
mov qword [rsp + 0x40], rax
mov byte [rsp + 0xd2], bl
mov byte [rsp + 0xd3], 1
call sub.msvcrt.dll_memset
movzx r8d, di
lea r9, [0x10000e3d0]
or r8d, 0x80070000
cmp edi, ebx
lea rdx, [rsp + 0x30]
mov rcx, rbp
cmovle r8d, edi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r12
call fcn.1000e9a68
int3
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x100064628
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3c8
mov rax, qword [0x100175150]
xor rax, rsp
mov qword [rsp + 0x3b8], rax
mov rbx, qword [rsp + 0x438]
mov rsi, rcx
mov r15, r8
mov rdi, rdx
lea r13, [0x10000e3f8]
lea rcx, [r11 - 0x78]
mov r8d, 0x22
mov rdx, r13
mov rbp, r9
call sub.msvcrt.dll_memcpy
xor r14d, r14d
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
mov dword [rsi + 8], r14d
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
mov dword [rsp + 0x44], 0x1fe
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ebx, [r14 + 1]
mov edi, eax
cmp eax, r14d
je 0x100064759
mov qword [rsp + 0x50], r13
lea r12, [0x10000e360]
lea r13, [0x10000e348]
lea r8d, [r14 + 0x78]
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x60], 0xa8
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r14w
mov byte [rsp + 0xea], r14b
mov byte [rsp + 0xeb], bl
call sub.msvcrt.dll_memset
movzx r8d, di
xor eax, eax
lea r9, [0x10000e420]
or r8d, 0x80070000
cmp edi, eax
lea rdx, [rsp + 0x48]
mov rcx, rsi
cmovle r8d, edi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r15
call fcn.1000e9a68
int3
cmp dword [rsp + 0x40], ebx
je 0x1000648e2
mov qword [rsp + 0x50], r13
mov word [rsp + 0xe8], r14w
mov byte [rsp + 0xea], r14b
lea r13, [0x10000e348]
mov r14d, 0x78
lea r12, [0x10000e360]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8, r14
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x60], 0xae
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x68], 0xff
mov byte [rsp + 0xeb], bl
call sub.msvcrt.dll_memset
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x48]
call fcn.1000e76d4
lea rdx, [rsp + 0xf0]
mov r8d, ebx
mov rcx, rax
call fcn.1000e76d4
lea rdx, [rsp + 0x198]
mov r8, rbp
mov rcx, rax
call fcn.1000e7a68
lea rdx, [rsp + 0x2e8]
mov r8, r15
mov rcx, rax
call fcn.1000e7a68
mov r9d, ebx
mov edx, 0x3007
mov r8, rax
mov rcx, rsi
call fcn.1000eb278
lea rcx, [rsp + 0x198]
call fcn.1000e7688
lea rcx, [rsp + 0xf0]
call fcn.1000e7688
lea rcx, [rsp + 0x240]
call fcn.1000e7688
lea rcx, [rsp + 0x48]
call fcn.1000e7688
lea rax, [0x10000e3f8]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x50], rax
xor eax, eax
mov r8, r14
xor edx, edx
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r13
mov word [rsp + 0xe8], ax
mov byte [rsp + 0xea], al
mov dword [rsp + 0x60], 0xaf
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x68], 0xff
mov byte [rsp + 0xeb], bl
call sub.msvcrt.dll_memset
mov r11d, dword [rsp + 0x40]
lea rax, [rsp + 0x390]
mov dword [rsp + 0x38], r11d
mov qword [rsp + 0x30], r15
lea r9, [0x10000e460]
lea rdx, [rsp + 0x48]
mov r8d, 0x80042302
mov rcx, rsi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.1000e8ff8
int3
mov rcx, qword [rsp + 0x3b8]
xor rcx, rsp
call fcn.1001303c0
add rsp, 0x3c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10006490c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x3c0
mov rax, qword [0x100175150]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov rbx, qword [rsp + 0x420]
mov rsi, rcx
mov r14, r8
mov rdi, rdx
lea r12, [0x10000e508]
lea rcx, [r11 - 0x68]
mov rdx, r12
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
xor r15d, r15d
lea rax, [rsp + 0x44]
mov dword [rsi + 8], r15d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rdx, [0x100005eb8]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rbx
mov dword [rbx], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x44], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, r15d
je 0x100064a3b
mov qword [rsp + 0x50], r12
lea edi, [r15 + 1]
lea rbp, [0x10000e360]
lea r12, [0x10000e348]
lea r8d, [r15 + 0x78]
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x60], 0xf3
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x64], edi
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r15w
mov byte [rsp + 0xea], r15b
mov byte [rsp + 0xeb], dil
call sub.msvcrt.dll_memset
movzx r8d, bx
lea r9, [0x10000e420]
or r8d, 0x80070000
cmp ebx, r15d
lea rdx, [rsp + 0x48]
cmovle r8d, ebx
lea rbx, [0x100005eb8]
mov rcx, rsi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
call fcn.1000e9a68
int3
cmp dword [rsp + 0x40], 4
je 0x100064bd0
mov edi, 1
mov qword [rsp + 0x50], r12
lea rbp, [0x10000e360]
lea r12, [0x10000e348]
lea rcx, [rsp + 0x70]
lea r8d, [rdi + 0x77]
xor edx, edx
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x60], 0xf9
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x64], edi
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r15w
mov byte [rsp + 0xea], r15b
mov byte [rsp + 0xeb], dil
call sub.msvcrt.dll_memset
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x48]
call fcn.1000e76d4
lea r8d, [rdi + 3]
lea rdx, [rsp + 0xf0]
mov rcx, rax
call fcn.1000e76d4
lea rbx, [0x100005eb8]
lea rdx, [rsp + 0x198]
mov r8, rbx
mov rcx, rax
call fcn.1000e7a68
lea rdx, [rsp + 0x2e8]
mov r8, r14
mov rcx, rax
call fcn.1000e7a68
mov r9d, edi
mov edx, 0x3007
mov r8, rax
mov rcx, rsi
call fcn.1000eb278
lea rcx, [rsp + 0x198]
call fcn.1000e7688
lea rcx, [rsp + 0xf0]
call fcn.1000e7688
lea rcx, [rsp + 0x240]
call fcn.1000e7688
lea rcx, [rsp + 0x48]
call fcn.1000e7688
lea rax, [0x10000e508]
lea r8d, [rdi + 0x77]
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], 0xfa
mov dword [rsp + 0x64], edi
mov dword [rsp + 0x68], 0xff
mov word [rsp + 0xe8], r15w
mov byte [rsp + 0xea], r15b
mov byte [rsp + 0xeb], dil
call sub.msvcrt.dll_memset
mov r11d, dword [rsp + 0x40]
lea rax, [rsp + 0x390]
lea r9, [0x10000e530]
mov dword [rsp + 0x38], r11d
mov qword [rsp + 0x30], r14
lea rdx, [rsp + 0x48]
mov r8d, 0x80042302
mov rcx, rsi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.1000e8ff8
int3
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.1001303c0
add rsp, 0x3c0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10006db48
Capabilities:
Resume thread

Disassembly:
mov rax, rsp
push rdi
push r12
push r14
sub rsp, 0x150
mov qword [rsp + 0xd8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbx, rcx
lea rsi, [0x100010cc0]
mov qword [rsp + 0x30], rsi
lea rbp, [0x100010dc0]
mov qword [rsp + 0x38], rbp
lea r12, [0x100010ca8]
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], 0x171
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0xff
xor edi, edi
mov word [rax - 0x98], di
mov byte [rax - 0x96], dil
mov byte [rax - 0x95], 1
lea r14d, [rdi + 0x78]
mov r8, r14
xor edx, edx
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.1000e7c38
nop
mov rcx, qword [rbx + 0x10]
cmp rcx, rdi
je 0x10006dd3a
cmp dword [rbx + 0x1c], 2
jne 0x10006dd3a
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x10006dd25
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], 0x184
mov dword [rsp + 0x4c], 0xb
mov dword [rsp + 0x50], 0xff
mov word [rsp + 0xd0], di
mov byte [rsp + 0xd2], dil
mov byte [rsp + 0xd3], 1
mov r8, r14
xor edx, edx
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx + 0x1c]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
mov r9, qword [rbx + 0x10]
lea r8, [0x100010e00]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.1000eac7c
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], 0x187
mov dword [rsp + 0x4c], 0xb
mov dword [rsp + 0x50], 0xff
mov word [rsp + 0xd0], di
mov byte [rsp + 0xd2], dil
mov byte [rsp + 0xd3], 1
mov r8, r14
xor edx, edx
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov eax, dword [rbx + 0x1c]
mov dword [rsp + 0x20], eax
lea r8, [0x100010e90]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.1000e8e14
mov dword [rbx + 0x1c], 5
lea rcx, [rsp + 0xe0]
call fcn.1000e7d24
mov eax, 0x8007000e
jmp 0x10006ddb8
mov byte [rbx + 0x20], 1
lea rcx, [rsp + 0xe0]
call fcn.1000e7d24
xor eax, eax
jmp 0x10006ddb8
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], 0x176
mov dword [rsp + 0x4c], 0xb
mov dword [rsp + 0x50], 0xff
mov word [rsp + 0xd0], di
mov byte [rsp + 0xd2], dil
mov byte [rsp + 0xd3], 1
mov r8, r14
xor edx, edx
lea rcx, [rsp + 0x58]
call sub.msvcrt.dll_memset
mov r9d, dword [rbx + 0x1c]
lea r8, [0x100010d10]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.1000e8e14
nop
lea rcx, [rsp + 0xe0]
call fcn.1000e7d24
mov eax, 0x8000ffff
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x10009cd1c
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push r13
push r14
push r15
sub rsp, 0x420
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x100175150]
xor rax, rsp
mov qword [rsp + 0x410], rax
mov rdi, rcx
lea r13, [0x10001d9c0]
mov qword [rsp + 0x28], r13
lea r14, [0x10001d950]
mov qword [rsp + 0x30], r14
lea r15, [0x10001d9a8]
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x40], 0x53
mov dword [rsp + 0x44], 1
mov dword [rsp + 0x48], 0xff
xor esi, esi
mov word [rsp + 0xc8], si
mov byte [rsp + 0xca], sil
mov byte [rsp + 0xcb], 1
xor edx, edx
lea r8d, [rsi + 0x78]
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0xe0]
call fcn.1000e7c38
nop
mov edx, 0x104
lea rcx, [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
jne 0x10009ce9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, esi
cmovle ebx, eax
mov dword [rsp + 0xe8], ebx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x40], 0x5a
mov dword [rsp + 0x44], 1
mov dword [rsp + 0x48], 0xff
mov word [rsp + 0xc8], si
mov byte [rsp + 0xca], sil
mov byte [rsp + 0xcb], 1
xor edx, edx
lea r8d, [rsi + 0x78]
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x28]
mov qword [rsp + 0x20], r11
cmp ebx, esi
jge 0x10009ce95
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x150]
call fcn.1000e760c
lea r9, [0x10001da30]
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.1000e9408
nop
lea rcx, [rsp + 0x28]
call fcn.1000e7688
mov r8d, 0x104
mov rdx, rdi
lea rcx, [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
cmp eax, esi
jne 0x10009cf6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, esi
cmovle ebx, eax
mov dword [rsp + 0xe8], ebx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x44], 1
mov dword [rsp + 0x48], 0xff
mov word [rsp + 0xc8], si
mov byte [rsp + 0xca], sil
mov byte [rsp + 0xcb], 1
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x28]
mov qword [rsp + 0x20], r11
cmp ebx, esi
jge 0x10009cf63
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x150]
call fcn.1000e760c
lea r9, [0x10001da58]
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.1000e9408
nop
lea rcx, [rsp + 0x28]
call fcn.1000e7688
nop
lea rcx, [rsp + 0xe0]
call fcn.1000e7d24
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.1001303c0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x10009e050
Capabilities:
Move file

Disassembly:
mov rax, rsp
push r12
push r13
push r14
sub rsp, 0x1f0
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rbx, r8
mov rdi, rdx
lea r12, [0x10001d9c0]
mov qword [rsp + 0x20], r12
lea r13, [0x10001dc30]
mov qword [rsp + 0x28], r13
lea r14, [0x10001d9a8]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x38], 0x16b
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x40], 0xff
xor esi, esi
mov word [rax - 0x148], si
mov byte [rax - 0x146], sil
mov byte [rax - 0x145], 1
xor edx, edx
lea r8d, [rsi + 0x78]
lea rcx, [rsp + 0x48]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xd0]
call fcn.1000e7c38
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, esi
jne 0x10009e1c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, esi
cmovle ebx, eax
mov dword [rsp + 0xd8], ebx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x38], 0x179
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x40], 0xff
mov word [rsp + 0xc0], si
mov byte [rsp + 0xc2], sil
mov byte [rsp + 0xc3], 1
xor edx, edx
lea r8d, [rsi + 0x78]
lea rcx, [rsp + 0x48]
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x20]
mov qword [rsp + 0x228], r11
cmp ebx, esi
jge 0x10009e1b6
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x140]
call fcn.1000e760c
lea r9, [0x10001dc88]
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.1000e9408
nop
lea rcx, [rsp + 0x20]
call fcn.1000e7688
nop
lea rcx, [rsp + 0xd0]
call fcn.1000e7d24
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop r12
ret