joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035bf0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rdi
sub rsp, reloc.mfc90u.dll_AfxCriticalNewHandler
mov rax, qword [0x1400c2038]
xor rax, rsp
mov qword [rsp + AfxAbort], rax
mov rdi, rdx
lea rdx, [0x14008ac98]
mov rbx, rcx
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
mov rax, qword [0x1400ce800]
cmp dword [rax - 0x10], 0
jne 0x140035c38
lea rcx, [0x1400ce800]
call fcn.1400351c0
lea rcx, [0x1400ce800]
xor edx, edx
call qword [sym.imp.mfc90u.dll_CStdioFile::Flush]
lea r9, [rsp + 0x30]
lea r8, [0x14008ac98]
mov qword [rsp + 0x28], rax
lea rcx, [0x14008f490]
mov rdx, rdi
mov dword [rsp + 0x20], 0x1f4
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x140035cec
mov edi, 0x20
mov qword [rsp + 0x460], rbp
mov qword [rsp + 0x430], rsi
lea esi, [rdi - 0x13]
lea ebp, [rdi - 0x16]
lea rax, [rsp + 0x30]
nop word [rax + rax]
lea rdx, [0x140094b68]
mov rcx, rax
call qword [sym.imp.MSVCR90.dll_wcsstr]
test rax, rax
je 0x140035cce
mov word [rax], di
mov word [rax + 2], di
mov word [rax + 4], si
add rax, 6
add rax, 2
mov word [rax - 2], bp
jne 0x140035ca0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
mov rsi, qword [rsp + 0x430]
mov rbp, qword [rsp + 0x460]
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.140077470
add rsp, reloc.mfc90u.dll_AfxCriticalNewHandler
pop rdi
pop rbx
ret
Function at 0x140036d90
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
mov r10, rdx
mov eax, 0xaaaaaaab
mov qword [rsp + 0x10], rsi
mov rbx, r8
mov r11, r9
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mul ecx
shr edx, 1
lea eax, [rdx + rdx*2]
cmp ecx, eax
seta sil
add eax, 2
cmp ecx, eax
movzx eax, sil
sete bpl
add eax, edx
shl eax, 2
mov dword [r8], eax
xor r8d, r8d
test edx, edx
je 0x140036e5d
add r9, 2
lea rdi, [r10 + 2]
mov r8d, edx
nop
movzx eax, byte [r9 - 2]
add rdi, 4
add r9, 3
shr rax, 2
movzx eax, byte [rax + r12]
mov byte [rdi - 6], al
movzx ecx, byte [r9 - 5]
movzx eax, byte [r9 - 4]
shr rax, 4
shl ecx, 4
or rcx, rax
and ecx, 0x3f
movzx eax, byte [rcx + r12]
mov byte [rdi - 5], al
movzx eax, byte [r9 - 4]
movzx ecx, byte [r9 - 3]
shl eax, 2
shr rcx, 6
or rcx, rax
and ecx, 0x3f
movzx eax, byte [rcx + r12]
mov byte [rdi - 4], al
movzx eax, byte [r9 - 3]
and eax, 0x3f
sub rdx, 1
movzx eax, byte [rax + r12]
mov byte [rdi - 3], al
jne 0x140036df0
test sil, sil
mov rsi, qword [rsp + 0x10]
je 0x140036f02
lea edi, [r8 + r8*2]
lea r9d, [r8*4]
movzx eax, byte [rdi + r11]
shr rax, 2
movzx eax, byte [rax + r12]
mov byte [r9 + r10], al
test bpl, bpl
je 0x140036ed5
movzx edx, byte [rdi + r11]
lea ecx, [r9 + 1]
lea eax, [rdi + 1]
mov r8d, eax
movzx eax, byte [rax + r11]
shl edx, 4
shr rax, 4
or rdx, rax
and edx, 0x3f
movzx eax, byte [rdx + r12]
mov byte [rcx + r10], al
movzx eax, byte [r8 + r11]
lea ecx, [r9 + 2]
and eax, 0xf
shl eax, 2
movsxd rdx, eax
movzx eax, byte [rdx + r12]
mov byte [rcx + r10], al
jmp 0x140036ef9
movzx eax, byte [rdi + r11]
lea ecx, [r9 + 1]
and eax, 3
shl eax, 4
movsxd rdx, eax
movzx eax, byte [rdx + r12]
mov byte [rcx + r10], al
lea eax, [r9 + 2]
mov byte [rax + r10], 0x3d
lea eax, [r9 + 3]
mov byte [rax + r10], 0x3d
movsxd rax, dword [rbx]
mov rbp, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov byte [rax + r10], 0
mov eax, dword [rbx]
mov rbx, qword [rsp + 0x18]
pop r12
ret

Function at 0x140036f20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x400
xor r9d, r9d
mov edi, edx
mov r11, rcx
mov r10d, r9d
lea rbx, [rsp]
nop dword [rax]
mov r8d, r10d
mov ecx, r9d
mov edx, 8
shl r8d, 0x18
nop
mov eax, ecx
add ecx, ecx
xor eax, r8d
bt eax, 0x1f
jae 0x140036f63
xor ecx, 0x4c10db7
add r8d, r8d
sub rdx, 1
jne 0x140036f50
inc r10d
mov dword [rbx], ecx
add rbx, 4
cmp r10d, 0x100
jb 0x140036f40
test edi, edi
je 0x140036fb4
mov r8, rdi
nop word [rax + rax]
movzx eax, byte [r11]
mov edx, r9d
mov ecx, r9d
shr rdx, 0x18
shl ecx, 8
inc r11
xor rdx, rax
mov r9d, dword [rsp + rdx*4]
xor r9d, ecx
sub r8, 1
jne 0x140036f90
mov eax, r9d
mov rbx, qword [rsp + reloc.mfc90u.dll_CObList::AddTail]
add rsp, 0x400
pop rdi
ret
Function at 0x1400370e0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0xf0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1400c2038]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov r12, rdx
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x60], dil
xor edx, edx
lea r8d, [rdi + 0x7e]
lea rcx, [rsp + 0x61]
call sub.MSVCR90.dll_memset
mov dword [rsp + 0x40], 0x10
mov rax, qword [r12]
mov esi, dword [rax - 0x10]
mov edx, esi
mov rcx, r12
call qword [sym.imp.mfc90u.dll_CStdioFile::Flush]
mov rbp, rax
mov dword [rsp + 0x20], 0xf0000020
lea r9d, [rdi + 1]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14003726f
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140037259
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140037243
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
lea edx, [rdi + 2]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14003722d
add rbx, 8
mov rcx, rbx
call qword [sym.imp.mfc90u.dll_CDocObjectServer::DoBeginPrinting]
lea rcx, [rsp + 0x38]
call qword [0x14008a728]
nop
movzx r8d, byte [rsp + rdi + 0x60]
lea rdx, str._02x
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc90u.dll_COleServerDoc::XOleObject::EnumAdvise]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.mfc90u.dll_]
inc rdi
cmp rdi, 0x10
jl 0x1400371f1
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc90u.dll_CView::CView]
jmp 0x140037283
add rbx, 8
lea rdx, str.Error_getting_hash_param
mov rcx, rbx
call qword [sym.imp.mfc90u.dll_CTreeCtrl::CTreeCtrl]
jmp 0x140037283
add rbx, 8
lea rdx, str.Error_hashing_data
mov rcx, rbx
call qword [sym.imp.mfc90u.dll_CTreeCtrl::CTreeCtrl]
jmp 0x140037283
add rbx, 8
lea rdx, str.Error_creating_hash
mov rcx, rbx
call qword [sym.imp.mfc90u.dll_CTreeCtrl::CTreeCtrl]
jmp 0x140037283
add rbx, 8
lea rdx, str.Error_acquiring_context
mov rcx, rbx
call qword [sym.imp.mfc90u.dll_CTreeCtrl::CTreeCtrl]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140037293
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400372a5
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
or edx, 0xffffffff
mov rcx, r12
call qword [sym.imp.mfc90u.dll_CDataPathProperty::Open]
mov rax, rbx
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140077470
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14003a930
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, reloc.mfc90u.dll_CChevronOwnerDrawMenu::CChevronOwnerDrawMenu
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x160], rbx
mov rax, qword [0x1400c2038]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rbx, [0x1400cfbc0]
mov qword [rsp + 0x20], rbx
mov rcx, rbx
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void____ptr64]
nop
lea rcx, [0x1400cfbe8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void____ptr64]
nop
lea rcx, [0x1400cfc10]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void____ptr64]
nop
mov byte [rsp + 0x30], 0
xor edx, edx
mov r8d, new[]
lea rcx, [rsp + 0x31]
call sub.MSVCR90.dll_memset
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
je 0x14003a9e8
cmp byte [rsp + rcx + 0x2f], 0x5c
je 0x14003a9e8
lea rdi, [rsp + 0x30]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x14008ee14]
mov word [rdi - 1], ax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const____ptr64____ptr64]
xor edx, edx
mov r8d, delete[]
lea rcx, [rsp + 0x30]
call sub.MSVCR90.dll_memset
mov r8d, new[]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x14003aa71
lea edx, [rax + 0x5c]
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCR90.dll_strrchr]
test rax, rax
je 0x14003aa48
mov byte [rax + 1], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x14003aa71
lea rdx, [rsp + 0x30]
lea rcx, [0x1400cfbe8]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const____ptr64____ptr64]
nop
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140077470
mov rbx, qword [rsp + 0x160]
add rsp, reloc.mfc90u.dll_CChevronOwnerDrawMenu::CChevronOwnerDrawMenu
pop rdi
ret
Function at 0x140051e50
Capabilities:
Encode data using xor

Disassembly:
add rcx, 0xfffffffffffffc48
jmp fcn.1400502f0
Function at 0x140057e30
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400c2038]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, word [rcx + 0x190]
mov ecx, 0xff
cmp ax, cx
je 0x140057e99
cmp ax, 0x2a
je 0x140057e99
xor edx, edx
cmp dx, ax
je 0x140057e99
movabs rcx, 0x5c003a0020
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x30], rcx
lea rdx, [0x14008b1c0]
lea r8, [rsp + 0x30]
xor ecx, ecx
xor r9d, r9d
mov word [rsp + 0x30], ax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140077470
add rsp, 0x48
ret

Function at 0x140057eb0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x170
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1400c2038]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 0
jne 0x140057ee5
xor eax, eax
jmp 0x140057fcd
lea rdx, str.BitLocker_Password.txt
lea rcx, [rsp + 0x140]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64____ptr64]
nop
lea rdx, [rsp + 0x148]
cmp qword [rsp + 0x160], 0x10
cmovae rdx, qword [rsp + 0x148]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x37]
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_ofstream_char__struct_std::char_traits_char__::constructor_char_const____ptr64__int__int____ptr64]
nop
cmp qword [rbx + 0x20], 0x10
jb 0x140057f40
mov rbx, qword [rbx + 8]
jmp 0x140057f44
add rbx, 8
lea rdx, str.Your_BitLocker_Volumes_password_is_:
lea rcx, [rsp + 0x40]
call fcn.1400426b0
mov rcx, rax
mov rdx, rbx
call fcn.1400426b0
mov rcx, rax
mov rdx, qword [sym.imp.MSVCP90.dll_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r8, [rsp + 0x148]
cmp qword [rsp + 0x160], 0x10
cmovae r8, qword [rsp + 0x148]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_ofstream_char__struct_std::char_traits_char__::vbase_dtor_void____ptr64]
nop
lea rcx, [rsp + 0x140]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov eax, 1
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140077470
add rsp, 0x170
pop rbx
ret
Function at 0x14005c1f0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1400c2038]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov eax, 0x2a
movzx edi, dx
cmp ax, dx
je 0x14005c324
mov eax, 0xff
cmp ax, dx
je 0x14005c324
xor esi, esi
cmp si, dx
je 0x14005c324
movabs rax, 0x5c003a0020
lea rcx, [rsp + 0x162]
xor edx, edx
mov r8d, 0xfe
mov qword [rsp + 0x280], rbx
mov word [rsp + 0x160], si
mov qword [rsp + 0x50], rax
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0xfe
mov word [rsp + 0x60], si
call sub.MSVCR90.dll_memset
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x48], esi
mov word [rsp + 0x50], di
lea ebx, [rsi + 5]
nop dword [rax + rax]
mov dword [rsp + 0x38], 0x80
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x160]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
lea rcx, [rsp + 0x50]
mov r8d, 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
mov edi, esi
not rcx
cmp rcx, 1
setne dil
test edi, edi
jne 0x14005c30e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
dec ebx
test ebx, ebx
jle 0x14005c318
test edi, edi
je 0x14005c2a0
mov rbx, qword [rsp + 0x280]
mov eax, edi
jmp 0x14005c329
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140077470
mov rsi, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x14005c350
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1f0
mov rax, qword [0x1400c2038]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
movzx ebx, dx
lea rcx, [rsp + 0xe2]
xor edi, edi
xor edx, edx
mov r8d, 0xfe
mov word [rsp + 0xe0], di
call sub.MSVCR90.dll_memset
lea rdx, str.chkdsk__c:__f__x__L:65536
lea rcx, [rsp + 0xe0]
mov r8d, ebx
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8d, [rdi + 0x60]
lea rcx, [rsp + 0x78]
xor edx, edx
call sub.MSVCR90.dll_memset
xor eax, eax
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14005c426
mov rcx, qword [rsp + 0x50]
mov edx, 0x1b7740
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, str.fsutil_usn_deletejournal__D__c:
lea rcx, [rsp + 0xe0]
mov r8d, ebx
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call sub.MSVCR90.dll_memset
xor r11d, r11d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x60], r11
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test eax, eax
je 0x14005c4c0
mov rcx, qword [rsp + 0x50]
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, ebx
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140077470
mov rbx, qword [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
add rsp, 0x1f0
pop rdi
ret
Function at 0x14005c4f0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x1400c2038]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor ecx, ecx
mov eax, 0x2a
movzx ebx, r8w
mov rdi, rdx
mov dword [rsp + 0x20], ecx
cmp ax, r8w
je 0x14005c58f
mov eax, 0xff
cmp ax, bx
je 0x14005c58f
cmp cx, bx
je 0x14005c58f
mov word [rsp + 0x50], cx
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, COleStreamFile::COleStreamFile
call sub.MSVCR90.dll_memset
xor eax, eax
movabs r11, 0x5c003a0020
mov qword [rsp + 0x28], r11
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
mov r8d, 0x100
mov word [rsp + 0x28], bx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
lea rdx, [rsp + 0x50]
jmp 0x14005c596
lea rdx, [0x14008ac98]
mov rcx, rdi
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140077470
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x140062ae0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1400c2038]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor edi, edi
mov rbx, rdx
lea rcx, [rsp + 0x32]
mov dword [rsp + 0x20], edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], di
call sub.MSVCR90.dll_memset
lea r8, [rsp + 0x20]
lea edx, [rdi + 5]
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140062b52
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea rdx, [rsp + 0x30]
test eax, eax
jne 0x140062b59
lea rdx, [0x14008ac98]
mov rcx, rbx
call qword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140077470
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret
Function at 0x140062b90
Capabilities:
Check if file exists
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rdi, rdx
mov rcx, qword [rdx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140062cf3
xor esi, esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], esi
lea rdx, str.IDS_REGISTER_REG_PATH
lea rcx, [rsp + 0x80]
call qword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x88]
call fcn.140004960
nop
mov r9, rax
lea r8, [rsp + 0x38]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x78]
call fcn.14001f570
mov ebx, eax
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0x80]
call qword [sym.imp.mfc90u.dll_CView::CView]
test ebx, ebx
je 0x140062ca2
lea rdx, str.IDS_REGISTER_REG_PATH
lea rcx, [rsp + 0x80]
call qword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x88]
call fcn.140004960
nop
mov r9, rax
lea r8, [rsp + 0x38]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x78]
call fcn.140055c40
mov ebx, eax
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0x80]
call qword [sym.imp.mfc90u.dll_CView::CView]
test ebx, ebx
je 0x140062ca2
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140062cf3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140062cf3
mov rdi, qword [rdi]
test rdi, rdi
setne sil
mov rbx, qword [rsp + 0x38]
test esi, esi
je 0x140062ce5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14009b370]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
test rbx, rbx
je 0x140062cf3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140062d00
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400c2038]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rdx
mov rsi, rcx
xor ebp, ebp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
lea rdx, str.IDS_REGISTER_REG_PATH
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.140004960
nop
mov r9, rax
lea r8, [rsp + 0x48]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x30]
call fcn.14001f570
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc90u.dll_CView::CView]
test ebx, ebx
je 0x140062dc4
mov rdx, rdi
mov rcx, rsi
call fcn.140062ae0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140062dbc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
jmp 0x140062ec3
mov word [rsp + 0x60], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call sub.MSVCR90.dll_memset
mov dword [rsp + 0x40], 0x208
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, [0x14009b370]
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140062ea6
mov eax, dword [rsp + 0x38]
cmp eax, 1
je 0x140062e2a
cmp eax, 2
jne 0x140062ea6
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x140062e47
test cl, 1
jne 0x140062ea6
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0x5e], 0
je 0x140062e4c
jmp 0x140062ea6
mov word [rsp + 0x60], bp
shr ecx, 1
lea eax, [rcx + 1]
mov word [rsp + rax*2 + 0x60], bp
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140062e84
mov rdx, rdi
mov rcx, rsi
call fcn.140062ae0
nop
test rbx, rbx
je 0x140062e7f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
jmp 0x140062ec3
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
nop
test rbx, rbx
je 0x140062ea1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
jmp 0x140062ec3
mov rdx, rdi
mov rcx, rsi
call fcn.140062ae0
nop
test rbx, rbx
je 0x140062ec0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140077470
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret