joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400011c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
lea r14d, [rbp + 4]
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r15d, 0x20
mov eax, dword [r15 + rsi]
mov r12d, 0x30
test al, 1
jne 0x140001259
or eax, 1
mov dword [r15 + rsi], eax
mov ebx, r12d
add rbx, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
lea ecx, [rbp + 1]
lea r8, [rbx + 8]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140001231
mov dword [rbx], 0x270
mov eax, dword [r15 + rsi]
mov ecx, 0x10
test al, 2
jne 0x14000127a
or eax, 2
mov dword [r15 + rsi], eax
mov qword [rsi + rcx], rbp
mov qword [rsi + rcx + 8], 0xf
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
lea r15, [rsi + rcx]
mov ebx, r12d
add rbx, rsi
lea r12, str.0123456789ABCDEF
nop dword [rax + rax]
dec r14
mov qword [rsp + 0x28], rbx
mov rbp, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, rbp
cmp rdx, 0xffffffffffffffff
jne 0x1400012e5
mov rcx, rbx
call fcn.14000ef20
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.14000ef20
mov eax, eax
or rsi, rax
jmp 0x1400012f5
inc rdx
lea rcx, [rsp + 0x28]
call fcn.14000ed70
mov rsi, rax
lea rax, [rsi + rbp]
movzx r9d, byte [rax + r12]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14000132a
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14000131f
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140001332
mov rcx, rdi
call fcn.14000e6a0
test r14, r14
jne 0x1400012b0
mov rax, rdi
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000ef20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14000ef81
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14000ef40
mov ecx, dword [r9]
jmp 0x14000f068
cmp ecx, 0x4e0
jb 0x14000f068
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14000efa0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14000eff0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14000fc00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fc4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fc4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fc4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fc4a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fc4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000fc4c
xor al, al
add rsp, 0x28
ret
Function at 0x140004ba0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r8d, dword [rcx + 0xc8]
mov rbx, rcx
mov esi, 8
lea rdx, str.CRecorder__d_::AddGLID__
mov ecx, esi
call fcn.140001110
xor edi, edi
cmp dword [rbx + 0x118], edi
jne 0x14001ccc9
cmp byte [rbx + 0x2c8], dil
jne 0x140006c26
cmp qword [rbx + 0x2c0], rdi
jne 0x140006c26
lea rdx, str.CRecorder__d_::AddGLID__:_GLID_is_not_needed_for_this_graph
jmp 0x140004bfd
mov r8d, dword [rbx + 0xc8]
mov ecx, esi
call fcn.140001110
mov eax, 1
jmp 0x140004c12
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
and qword [rsp + 0x28], rdi
and dword [rsp + 0x20], edi
lea r8, [0x140006c98]
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
je 0x14001ccd5
or edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140006c81
and dword [rsp + 0x40], eax
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x140006c81
mov edi, dword [rsp + 0x40]
test edi, edi
js 0x14001cd0f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x140004c12
lea rdx, str.CRecorder__d_::AddGLID__:_GLID_already_added__ignoring_
jmp 0x140004bfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [rbx + 0xc8]
lea rdx, str.CRecorder__d_::AddGLID___Failed_to_create_thread__0x_08X
movzx edi, ax
lea ecx, [rsi + 1]
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov r9d, edi
call fcn.140001110
test edi, edi
jns 0x140006c4f
jmp 0x140006c8a
mov r8d, dword [rbx + 0xc8]
lea rdx, str.CRecorder__d_::AddGLID___failed__0x_08X_
mov r9d, edi
mov ecx, 1
call fcn.140001110
nop
jmp 0x140006c81
Function at 0x140008e94
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
and qword [rax - 0x30], 0
and qword [rax - 0x38], 0
and qword [rax - 0x20], 0
and qword [rax - 0x18], 0
and qword [rax - 0x10], 0
mov dword [rax - 0x40], 0x2001f
and dword [rax - 0x48], 0
lea r8, str.UserSettings
lea rcx, [rax - 0x20]
xor r9d, r9d
call fcn.1400039c8
mov rcx, qword [rsp + 0x48]
test eax, eax
jne 0x140022d8c
and dword [rsp + 0x80], 0
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rdx, str.EnabledForMCE
xor r8d, r8d
mov dword [rsp + 0x88], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140022d93
cmp dword [rsp + 0x40], 4
jne 0x140022d93
test eax, eax
jne 0x140022d93
xor edi, edi
cmp dword [rsp + 0x80], edi
setne dil
cmp qword [rsp + 0x48], 0
je 0x140008f5d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x140008f61
add rsp, 0x60
pop rdi
ret
test rcx, rcx
je 0x140022da6
jmp 0x140022da0
cmp qword [rsp + 0x48], 0
je 0x140022da6
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140008f61
Function at 0x140011aac
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rbp
push rdi
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rdi, rcx
mov ebp, 1
cmp dword [rcx + 0x128], 0xffffffff
jne 0x140011c25
and qword [rax - 0x30], 0
and qword [rax - 0x28], 0
and qword [rax - 0x20], 0
and dword [rcx + 0x128], 0
and qword [rax - 0x40], 0
and qword [rax - 0x48], 0
mov dword [rax - 0x50], 0x2001f
and dword [rax - 0x58], 0
xor r9d, r9d
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionMedia_CenterServiceVideoTuners
mov rdx, 0xffffffff80000002
lea rcx, [rax - 0x30]
call fcn.1400039c8
mov rbx, qword [rsp + 0x48]
test eax, eax
jne 0x140022e2a
and dword [rsp + 0x80], eax
mov dword [rsp + 0x88], 4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x90]
xor r8d, r8d
lea rdx, str.RecInfoVersion
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011b81
cmp dword [rsp + 0x90], 4
jne 0x140022dad
xor eax, eax
test eax, eax
jne 0x140022dbd
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x140011b9d
cmp eax, 4
jb 0x140022db2
cmp dword [rdi + 0x128], ebp
je 0x140011c17
mov dword [rsp + 0x88], 8
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x90]
xor r8d, r8d
lea rdx, str.ServiceVersion
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011bf7
cmp dword [rsp + 0x90], 0xb
jne 0x140022dfe
test eax, eax
jne 0x140022dee
mov r8, qword [rdi + 0x130]
mov r9, qword [rsp + 0x98]
cmp r9, r8
jb 0x140022dd4
test rbx, rbx
je 0x140011c25
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rdi + 0x128], ebp
je 0x140022e41
xor ebx, ebx
cmp dword [rdi + 0x128], ebp
sete bl
lea rax, [0x14005a108]
lea r8, [0x14005a118]
test ebx, ebx
cmovne r8, rax
lea rdx, str.CRecorderMgr::UpgradeDetected:_returning__s
mov ecx, 4
call fcn.140001110
mov eax, ebx
add rsp, 0x60
pop rdi
pop rbp
pop rbx
ret
lea eax, [rbp + 0xc]
jmp 0x140022dbd
mov dword [rdi + 0x128], ebp
jmp 0x140011b9d
mov r8d, eax
lea rdx, str.CRecorderMgr::UpgradeDetected:_failed_to_query_RecInfoVersion__error__x
mov ecx, ebp
call fcn.140001110
nop
jmp 0x140011b9d
mov dword [rdi + 0x128], ebp
lea rdx, str.CRecorderMgr::UpgradeDetected:_current_ServiceVersion:_d_is_higher_than_stored_Service_version:__d__were_upgrading_Windows_7_Build_to_Build_
lea ecx, [rax + 8]
call fcn.140001110
jmp 0x140011c17
cmp eax, 0xd
je 0x140022dfe
cmp eax, 0xea
jne 0x140011c17
mov dword [rdi + 0x128], ebp
lea rdx, str.CRecorderMgr::UpgradeDetected:_Upgrading_from_Windows_7_Beta
mov ecx, 8
call fcn.140001110
lea rdx, str.ServiceVersion
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140011c17
mov r8d, eax
lea rdx, str.CRecorderMgr::UpgradeDetected:_failed_to_open_EHOME_TUNERS__error__x
mov ecx, ebp
call fcn.140001110
nop
jmp 0x140011c17
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [rdi + 0x138]
cmp rax, 0x927c0
jbe 0x140011c31
and dword [rdi + 0x128], 0
jmp 0x140011c31
Function at 0x14001350c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0xf0]
lea rdx, str.SetupDiDestroyDeviceInfoList
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x160], rax
cmp rax, rbx
je 0x1400201e2
mov rcx, qword [rdi + 0xf0]
lea rdx, str.SetupDiOpenDeviceInterfaceW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x168], rax
cmp rax, rbx
je 0x1400201e2
mov rcx, qword [rdi + 0xf0]
lea rdx, [0x14005aae0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x150], rax
cmp rax, rbx
je 0x1400201e2
mov rcx, qword [rdi + 0xf0]
lea rdx, str.SetupDiCreateDeviceInfoList
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x148], rax
cmp rax, rbx
je 0x1400201e2
mov rcx, qword [rdi + 0xf0]
lea rdx, str.SetupDiGetDeviceInstanceIdW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x158], rax
cmp rax, rbx
je 0x1400201e2
mov rcx, qword [rdi + 0xf0]
lea rdx, str.SetupDiGetDeviceRegistryPropertyW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x178], rax
cmp rax, rbx
je 0x1400201e2
mov rcx, qword [rdi + 0xf0]
lea rdx, str.SetupDiOpenDeviceInterfaceRegKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x170], rax
cmp rax, rbx
je 0x1400201e2
mov ebx, 1
jmp 0x14001361e
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, str.CRecorderMgr::LoadSetupApiProcAdds:_Failed_to_load_setupapi_procs
mov ecx, 1
call fcn.140001110
nop
jmp 0x14001361e

Function at 0x140013a80
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
xor ecx, ecx
cmp eax, 0xb7
mov r11d, eax
cmove r11d, ecx
movzx eax, r11w
or eax, 0x80070000
cmp r11d, ecx
cmovle eax, r11d
add rsp, 0x28
ret
Function at 0x140015050
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor ebp, ebp
mov rbx, rdx
mov rsi, rcx
cmp rdx, rbp
je 0x1400151d2
mov r8, rdx
lea ecx, [rbp + 8]
lea rdx, str.CRecorderMgr::CleanupThreadProcedure:_Cleaning_...__s
call fcn.140001110
lea rax, [rsp + 0x60]
mov rdi, rbx
mov edx, 0x104
lea rcx, [rsp + 0x60]
mov r8d, ebp
sub rdi, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbp
je 0x1400150ce
movzx eax, word [rdi + rcx]
cmp ax, bp
je 0x1400150ce
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400150ac
cmp rdx, rbp
je 0x1400222ac
cmp r8d, ebp
mov word [rcx], bp
jl 0x1400222bb
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, ebp
je 0x14001510e
lea eax, [rcx - 1]
mov edi, 0x5c
cmp word [rsp + rax*2 + 0x60], di
jne 0x1400222d1
xor edx, edx
lea rcx, [rsp + 0x24]
mov dword [rsp + 0x20], 0x2a
lea r8d, [rdx + 0x3c]
call sub.msvcrt.dll_memset
lea r8, str..TmpSBE
lea rcx, [rsp + 0x20]
mov edx, 0x20
call fcn.1400119d0
cmp eax, ebp
jl 0x140015152
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.1400151fc
lea r8, [0x14005b8f0]
lea rcx, [rsp + 0x60]
mov edx, 0x114
call fcn.1400119d0
cmp eax, ebp
jl 0x1400222e5
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x60]
mov edx, 0x80
mov edi, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea r8, [0x14005b8ec]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.1400151fc
mov rdx, qword [rsi + 0x90]
lea r8, [0x14005b8ec]
mov rcx, rsi
call fcn.1400151fc
lea rcx, [rsp + 0x60]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140001170
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2a0
pop rdi
pop rsi
pop rbp
ret
sub rcx, 2
mov r8d, 0x8007007a
jmp 0x1400150d7
lea rdx, str.CRecorderMgr::CleanupThreadProcedure:_Failed_to_call_StringCchCopy__0x_x.
mov ecx, 1
call fcn.140001110
jmp 0x1400151d2
mov eax, ecx
mov word [rsp + rax*2 + 0x60], di
lea eax, [rcx + 1]
mov word [rsp + rax*2 + 0x60], bp
jmp 0x14001510e
mov r8d, eax
lea rdx, str.CRecorderMgr::CleanupThreadProcedure:_Failed_to_call_StringCchCat__0x_x.
jmp 0x1400222c2
Function at 0x1400151fc
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x6b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
and dword [rsp + 0x20], 0
mov rbx, r8
mov r9, r8
mov r8, rdx
mov rdi, rdx
lea rcx, [rsp + 0x490]
mov edx, 0x104
call fcn.14000ca68
test eax, eax
js 0x140022207
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140015288
test byte [rsp + 0x30], 0x10
je 0x140022227
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140015262
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.140001170
mov rbx, qword [rsp + 0x6c0]
add rsp, 0x6b0
pop rdi
ret
lea rdx, str.CRecorderMgr::DeleteFiles:_PathCchCombine_failed_for__s_and__s__hr_0x_08X
mov r9, rbx
mov r8, rdi
mov ecx, 1
mov dword [rsp + 0x20], eax
call fcn.140001110
jmp 0x140015288
and dword [rsp + 0x20], 0
lea r9, [rsp + 0x5c]
lea rcx, [rsp + 0x280]
mov r8, rdi
mov edx, 0x104
call fcn.14000ca68
test eax, eax
js 0x140022289
lea rcx, [rsp + 0x280]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, [rsp + 0x280]
lea rdx, str.CRecorderMgr::DeleteFiles_Deleting_File:__s
mov ecx, 8
call fcn.140001110
jmp 0x14001526d
lea r9, [rsp + 0x5c]
lea rdx, str.CRecorderMgr::DeleteFiles:_PathCchCombine_failed_for_dir__s__file__s__hr_0x_08X
mov r8, rdi
mov ecx, 1
mov dword [rsp + 0x20], eax
call fcn.140001110
nop
jmp 0x14001526d
Function at 0x140015708
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
and qword [rsp + 0x30], 0
mov rdi, rcx
lea r9, [rsp + 0x30]
lea rcx, [0x14005b2e8]
xor r8d, r8d
mov edx, 0x400
call sub.SHELL32.dll_SHGetKnownFolderPath
mov ebx, eax
test eax, eax
jne 0x1400228fa
mov r8, qword [rsp + 0x30]
and dword [rsp + 0x20], 0
mov esi, 0x104
lea r9, [0x14005b908]
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.14000ca68
mov rcx, qword [rsp + 0x30]
mov ebx, eax
test eax, eax
js 0x140022915
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea r8, str.eHome
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.140015830
mov ebx, eax
test eax, eax
js 0x140022927
lea r8, str.SharedSBE
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.140015830
mov ebx, eax
test eax, eax
js 0x140022930
mov rcx, qword [rdi + 0x90]
lea rax, [rsp + 0x40]
cmp rax, rcx
je 0x1400157fe
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi + 0x90], rax
test rax, rax
je 0x140022939
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140001170
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rdx, str.CRecorderMgr::InitializeSBESharedPath:_SHGetKnownFolderPath_failed__0x_08X
mov r8d, eax
mov ecx, 1
call fcn.140001110
mov eax, ebx
jmp 0x140015800
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r8d, ebx
lea rdx, str.CRecorderMgr::InitializeSBESharedPath:_PathCchCombine_failed__0x_08X
jmp 0x140022904
lea rdx, str.CRecorderMgr::InitializeSBESharedPath:_PathCchAppend_product_failed__0x_08X
jmp 0x140022901
lea rdx, str.CRecorderMgr::InitializeSBESharedPath:_PathCchAppend_dir_failed__0x_08X
jmp 0x140022901
mov ecx, 0x8007000e
call fcn.140029690
int3
Function at 0x140015ee0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbp, rcx
lea rdx, str.CRecorderMgr::GetProcessVersionInfo
mov ecx, 8
call fcn.140001110
lea rdx, [rsp + 0x40]
xor ebx, ebx
mov r8d, 0x104
xor ecx, ecx
mov word [rsp + 0x40], bx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp bx, word [rsp + 0x40]
je 0x140022ed3
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp eax, ebx
jbe 0x140022ec4
mov rcx, rsi
call fcn.1400025a0
mov rdi, rax
cmp rax, rbx
je 0x140022ea9
lea rcx, [rsp + 0x40]
mov r9, rax
mov r8d, esi
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, ebx
je 0x140022e75
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, [0x14005b998]
mov rcx, rdi
mov qword [rsp + 0x30], rbx
call sub.VERSION.dll_VerQueryValueA
cmp eax, ebx
je 0x140022e66
mov rdx, qword [rsp + 0x30]
lea ecx, [rbx + 8]
mov eax, dword [rdx + 8]
mov dword [rbp + 0x134], eax
mov r10d, dword [rdx + 0xc]
movzx r9d, word [rbp + 0x134]
movzx r8d, word [rbp + 0x136]
movzx eax, r10w
mov dword [rbp + 0x130], r10d
shr r10d, 0x10
mov dword [rsp + 0x28], eax
lea rdx, str.CRecorderMgr::GetProcessVersionInfo_processVersion_is__u._u._u._u
mov dword [rsp + 0x20], r10d
call fcn.140001110
jmp 0x140015ffa
mov rcx, rdi
call sub.msvcrt.dll_free
jmp 0x140016004
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140001170
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CRecorderMgr::GetProcessVersionInfo_VerQueryValueA_failed_with_hr:_0x_x
jmp 0x140022e82
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CRecorderMgr::GetProcessVersionInfo_GetFileVersionInfo_failed_with_hr:_0x_x
mov r11d, eax
movzx eax, ax
mov ecx, 1
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov r8d, eax
mov ebx, eax
call fcn.140001110
nop
jmp 0x140015ffa
lea rdx, str.CRecorderMgr::GetProcessVersionInfo__malloca_failed_to_allocate_memory
mov ecx, 1
call fcn.140001110
mov ebx, 0x8007000e
jmp 0x140016004
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CRecorderMgr::GetProcessVersionInfo_GetFileVersionInfoSize_failed_with_hr:_0x_x
jmp 0x140022ee0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CRecorderMgr::GetProcessVersionInfo_GetModuleFileName_failed_with_hr:_0x_X
mov r11d, eax
movzx eax, ax
mov ecx, 1
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov r8d, eax
mov ebx, eax
call fcn.140001110
nop
jmp 0x140016004
Function at 0x140016168
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1400161af
cmp rcx, 0xffffffffffffffff
je 0x1400161af
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400161ad
cmp dword [rcx + 0x3c], edx
jl 0x1400161ad
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400161ad
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400161af
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400161e8
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x140000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x140024bdc
cmp dword [rsp + 0x24], 5
jb 0x140016283
jmp 0x14001627f
mov byte [rbx + 0x18], sil
lea rax, [0x14005ad38]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.140015eb4
movzx ecx, byte [0x1400a4e20]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x1400a4e20], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140001170
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp dword [rsp + 0x30], esi
jne 0x140016283
cmp dword [rsp + 0x24], 4
ja 0x14001627f
jne 0x140016283
cmp dword [rsp + 0x28], 0
ja 0x14001627f
jmp 0x140016283