joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009114
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x14001a170]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r15, rdx
mov edi, 0x104
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, edi
mov qword [rsp + 0x20], rbx
mov r12, rcx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x14000919c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x140009182
mov edi, 0x80004005
jmp 0x140009190
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14000b708
jmp 0x140009263
cmp esi, edi
ja 0x1400091e4
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14000b4bc
mov edi, eax
test eax, eax
js 0x1400091cc
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.14000b580
mov edi, eax
test eax, eax
jns 0x1400091d3
mov ecx, eax
call fcn.14000b708
mov ecx, edi
call fcn.14000b77c
test edi, edi
jns 0x140009263
jmp 0x140009190
xor ecx, ecx
call fcn.14000b77c
mov rax, rsi
sub rax, rsi
neg rax
sbb edi, edi
and edi, 0x80070216
mov ecx, edi
call fcn.14000b77c
lea r8, [rsp + 0x20]
mov edx, esi
call fcn.14000a8c4
mov edi, eax
test eax, eax
jns 0x14000921c
mov ecx, eax
call fcn.14000b708
mov rbx, qword [rsp + 0x20]
mov ecx, edi
call fcn.14000b77c
test edi, edi
js 0x140009190
mov r8d, esi
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
je 0x14000916b
cmp eax, esi
je 0x14000925b
mov edi, 0x8007007a
jmp 0x140009190
mov rax, rbx
xor ebx, ebx
mov qword [r15], rax
mov ecx, edi
call fcn.14000b77c
test rbx, rbx
je 0x140009297
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.14000b77c
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000f210
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000b004
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov r11, r8
mov r10, rdx
xor r8d, r8d
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
mov rdi, rcx
mov rbx, rdx
shr rbx, 1
lea rax, [rbx + rbx*2]
sub r10, rax
cmp r10, 1
mov rax, r10
setne r8b
add r8, 2
neg rax
sbb rax, rax
and rax, r8
lea rax, [rax + rbx*4]
inc rax
cmp rax, 0x81
ja 0x14000b174
xor r9d, r9d
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
xor esi, esi
test rbx, rbx
je 0x14000b0ea
movzx ecx, byte [rdi]
inc esi
movzx edx, byte [rdi + 2]
mov eax, ecx
movzx r8d, byte [rdi + 1]
and cl, 3
shr rax, 2
add rdi, 3
shl cl, 4
movzx ecx, cl
mov al, byte [rax + r14]
mov byte [r9 + r11], al
mov eax, r8d
shr rax, 4
and r8b, 0xf
or rcx, rax
shl r8b, 2
mov al, byte [rcx + r14]
mov byte [r9 + r11 + 1], al
mov eax, edx
shr rax, 6
and edx, 0x3f
movzx ecx, r8b
or rcx, rax
mov al, byte [rcx + r14]
mov byte [r9 + r11 + 2], al
mov al, byte [rdx + r14]
mov byte [r9 + r11 + 3], al
add r9, 4
mov eax, esi
cmp rax, rbx
jb 0x14000b079
sub r10, 1
je 0x14000b140
cmp r10, 1
jne 0x14000b16f
movzx ecx, byte [rdi]
movzx edx, byte [rdi + 1]
mov eax, ecx
shr rax, 2
and cl, 3
shl cl, 4
movzx ecx, cl
mov al, byte [rax + r14]
mov byte [r9 + r11], al
mov eax, edx
shr rax, 4
and dl, 0xf
or rcx, rax
shl dl, 2
mov al, byte [rcx + r14]
mov byte [r9 + r11 + 1], al
movzx eax, dl
mov al, byte [rax + r14]
mov byte [r9 + r11 + 2], al
mov byte [r9 + r11 + 3], 0x3d
jmp 0x14000b16b
movzx ecx, byte [rdi]
mov eax, ecx
and cl, 3
shr rax, 2
shl cl, 4
mov al, byte [rax + r14]
mov byte [r9 + r11], al
movzx eax, cl
mov al, byte [rax + r14]
mov byte [r9 + r11 + 1], al
mov word [r9 + r11 + 2], 0x3d3d
add r9, 4
mov byte [r9 + r11], 0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
ret
Function at 0x14000c558
Capabilities:
Create http request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor edi, edi
xor ebx, ebx
mov rsi, r9
mov r14, r8
mov r15d, edx
mov rbp, rcx
test rcx, rcx
je 0x14000c600
test r8, r8
je 0x14000c600
test r9, r9
je 0x14000c600
and dword [rax - 0x28], ebx
lea rcx, str.DTUHandlerAgent
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000c5dc
and qword [rsp + 0x28], rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], r15d
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
nop dword [rax + rax]
test rax, rax
jne 0x14000c5f8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14000c605
mov qword [r14], rbx
mov qword [rsi], rax
jmp 0x14000c619
mov edi, 0x80070057
test rbx, rbx
je 0x14000c619
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14000c63c
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x14001a170]
xor rax, rsp
mov qword [rbp + 0x360], rax
and qword [rsp + 0x58], 0
mov r15d, r8d
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
lea rcx, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x48], rbx
mov r8d, 0x400
or rdi, 0xffffffffffffffff
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
and dword [rsp + 0x50], ebx
test r14, r14
je 0x14000c7f1
test rsi, rsi
je 0x14000c7f1
lea r9, [rsp + 0x48]
mov edx, r15d
lea r8, [rsp + 0x58]
mov rcx, rsi
call fcn.14000c558
mov esi, eax
test eax, eax
js 0x14000c7ea
and qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000c725
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x48]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x14000c7f6
mov rbx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov rcx, rbx
lea rdx, [rsp + 0x60]
mov r8d, 0x400
call qword [sym.imp.WININET.dll_InternetReadFile]
nop dword [rax + rax]
mov r14d, 0x80070000
jmp 0x14000c79d
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x14000c7a3
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
je 0x14000c7d1
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
nop dword [rax + rax]
test eax, eax
jne 0x14000c751
jmp 0x14000c7a7
test eax, eax
jne 0x14000c7be
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx esi, ax
or esi, r14d
test eax, eax
cmovle esi, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FlushFileBuffers]
nop dword [rax + rax]
test eax, eax
jne 0x14000c7f6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx esi, ax
or esi, r14d
test eax, eax
cmovle esi, eax
jmp 0x14000c7f6
mov rbx, qword [rsp + 0x48]
jmp 0x14000c80f
mov esi, 0x80070057
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000c80f
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x14000c823
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000c839
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop dword [rax + rax]
mov eax, esi
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.14000f210
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x470
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c9a4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14001a170]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
lea rcx, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x20], rbx
mov r8d, 0x208
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
test rbp, rbp
je 0x14000ca89
test rsi, rsi
je 0x14000ca89
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140011dc0]
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x14000ca82
mov r8, qword [rsp + 0x20]
lea r9, [0x140014c70]
mov ebx, 0x104
lea rcx, [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x14000ca82
mov r9, rbp
lea r8, [rsp + 0x30]
mov edx, ebx
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x14000ca82
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov qword [rsi], rax
test rax, rax
jne 0x14000ca82
mov edi, 0x8007000e
mov rbx, qword [rsp + 0x20]
jmp 0x14000ca8e
mov edi, 0x80070057
test rbx, rbx
je 0x14000caa2
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000f210
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000d2c4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x14001a170]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
test rcx, rcx
jne 0x14000d2f5
mov ebx, 0x80070057
jmp 0x14000d38e
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x410
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
lea rdx, [rsp + 0x30]
lea rcx, str._WinDir_
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d350
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14000d340
mov ebx, 0x80004005
jmp 0x14000d38e
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14000d38e
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14000b4bc
mov ebx, eax
test eax, eax
js 0x14000d37c
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r8, rdi
call fcn.14000b580
mov ebx, eax
test eax, eax
jns 0x14000d383
mov ecx, eax
call fcn.14000b708
mov ecx, ebx
call fcn.14000b77c
test ebx, ebx
jns 0x14000d395
mov ecx, ebx
call fcn.14000b708
mov ecx, ebx
call fcn.14000b77c
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14000f210
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret
Function at 0x14000d434
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
mov rbp, rsp
sub rsp, 0x20
xor esi, esi
lea r8, [rbp + 0x30]
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rsi
lea edx, [rsi + 1]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathAllocCanonicalize]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x14000d540
mov rcx, qword [rbp + 0x30]
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rcx + rdx*2], si
jne 0x14000d478
inc rdx
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveBackslash]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x14000d540
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x28]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchSkipRoot]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x14000d540
mov rax, qword [rbp + 0x28]
mov edi, esi
cmp si, word [rax]
sete dil
je 0x14000d540
mov r15d, 0x5c
cmp si, word [rax]
jne 0x14000d4d9
mov edi, 1
jmp 0x14000d4e6
cmp r15w, word [rax]
jne 0x14000d4e6
mov word [rax], si
mov rax, qword [rbp + 0x28]
cmp si, word [rax]
jne 0x14000d59a
mov rcx, qword [rbp + 0x30]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14000d58a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x800700b7
je 0x14000d56b
cmp ebx, 0x80070005
je 0x14000d56b
cmp ebx, 0x80070003
jne 0x14000d586
mov ebx, 0x800700b7
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14000d555
call qword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rbp
ret
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14000d584
test al, 0x10
je 0x14000d586
mov ebx, esi
test ebx, ebx
js 0x14000d540
mov rax, qword [rbp + 0x28]
test edi, edi
jne 0x14000d59a
mov word [rax], r15w
mov rax, qword [rbp + 0x28]
add rax, 2
mov qword [rbp + 0x28], rax
test edi, edi
jne 0x14000d540
jmp 0x14000d4cd
Function at 0x14000d980
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x14001a170]
xor rax, rsp
mov qword [rbp + 0x150], rax
lea rcx, [0x140014c88]
mov rdi, r9
mov qword [rsp + 0x48], rcx
mov rsi, r8
test r8, r8
jne 0x14000d9e4
mov rcx, qword [rbp + 0x178]
lea r8, str.onecoreenduserwindowsupdatemuseorchestratorcommonlibusocommon_registrymanager.cpp
mov ebx, 0x80070057
mov edx, 0x3cb
mov r9d, ebx
call fcn.140003d08
jmp 0x14000db17
lea r8, [rsp + 0x50]
call fcn.14000e090
mov ebx, eax
test eax, eax
jns 0x14000da14
mov rcx, qword [rbp + 0x178]
lea r8, str.onecoreenduserwindowsupdatemuseorchestratorcommonlibusocommon_registrymanager.cpp
mov r9d, eax
mov edx, 0x3ce
call fcn.140003d08
jmp 0x14000db0f
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
cmp eax, 2
jne 0x14000da88
mov rcx, qword [rsp + 0x40]
mov byte [rdi], 0
test rcx, rcx
je 0x14000da63
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.14000f210
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
test eax, eax
je 0x14000daba
mov edx, 0x3dc
mov rcx, qword [rbp + 0x178]
mov r9d, eax
call fcn.14000ed10
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x14000db0f
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x14000db0f
and qword [rsp + 0x28], 0
xor r9d, r9d
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
and qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
cmp eax, 2
je 0x14000da4a
test eax, eax
je 0x14000daf4
mov edx, 0x3ea
jmp 0x14000da91
mov rcx, qword [rsp + 0x40]
mov byte [rdi], 1
test rcx, rcx
je 0x14000db0d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor ebx, ebx
test ebx, ebx
jns 0x14000da63
lea rdx, [rsp + 0x48]
call fcn.14000e22c
test rax, rax
je 0x14000db35
lea rdx, [rsp + 0x48]
call fcn.14000e2fc
mov rdx, qword [rax]
jmp 0x14000db3a
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rbp + 0x178]
lea rax, str.Etag
mov qword [rsp + 0x38], rsi
lea r8, str.onecoreenduserwindowsupdatemuseorchestratorcommonlibusocommon_registrymanager.cpp
mov qword [rsp + 0x30], rax
mov r9d, ebx
mov qword [rsp + 0x28], rdx
lea rax, str.Failed_to_determine_if_registry_value_HKLM_ws_ws__ws__exists
mov edx, 0x137
mov qword [rsp + 0x20], rax
call fcn.14000ee4c
mov eax, ebx
jmp 0x14000da65
Function at 0x14000db84
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14001a170]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, qword [rsp + 0x278]
mov rdi, r9
test rdx, rdx
jne 0x14000dbdd
mov edx, 0x1e7
mov ebx, 0x80070057
mov rcx, qword [rsp + 0x248]
lea r8, str.onecoreenduserwindowsupdatemuseorchestratorcommonlibusocommon_registrymanager.cpp
mov r9d, ebx
call fcn.140003d08
mov eax, ebx
jmp 0x14000dc57
test rdi, rdi
jne 0x14000dbe9
mov edx, 0x1e8
jmp 0x14000dbbd
test rsi, rsi
jne 0x14000dbf5
mov edx, 0x1e9
jmp 0x14000dbbd
lea r8, [rsp + 0x30]
mov rcx, rdx
call fcn.14000e090
mov ebx, eax
test eax, eax
jns 0x14000dc0f
mov edx, 0x1ec
jmp 0x14000dbc2
mov eax, dword [rsp + 0x280]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov r9d, 1
mov r8, rdi
mov qword [rsp + 0x20], rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
je 0x14000dc55
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x14000dc57
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000f210
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140001470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1080
call fcn.14000bf50
sub rsp, rax
mov rax, qword [0x140031920]
xor rax, rsp
mov qword [rsp + 0x1070], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140001529
mov ecx, eax
call fcn.140004e18
xor esi, esi
test al, al
je 0x140001529
mov ecx, ebx
call fcn.140004e2c
test al, al
jne 0x140001529
mov r8d, 0x800
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.14000822c
lea rcx, [rsp + 0x60]
call fcn.14000fc48
lea rax, [rax*2 + 2]
cmp rax, 0x1002
jae 0x14000154e
xor edx, edx
mov word [rsp + rax + 0x60], si
lea r8d, [rsi + 0x38]
lea rcx, [rsp + 0x20]
call fcn.14000cd10
lea eax, [rsi + 0x14]
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.14000bfc0
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14000bca4
int3

Function at 0x1400015a8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov eax, r8d
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x104
jb 0x1400015e8
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
mov edx, eax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400015e8
mov bl, 1
jmp 0x1400015fa
mov r8, rdi
lea rdx, str.unknown_folder
mov rcx, rsi
call fcn.14000822c
mov rsi, qword [rsp + 0x48]
mov al, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140003b90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [rcx + 4], 0
mov r8, rcx
jne 0x140003bd7
xor r9d, r9d
mov r10d, r9d
mov r11d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
and cl, 1
cmovne r10d, eax
sub r11, 1
jne 0x140003ba5
mov dword [r8], r10d
inc r9d
add r8, 4
cmp r9d, 0x100
jb 0x140003b9c
ret

Function at 0x1400043ec
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
jne 0x140004419
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140004498
mov rcx, rbx
call fcn.140004544
test al, al
je 0x14000445c
mov r8d, 0x4e20
cmp rdi, r8
jbe 0x14000445c
mov rdx, rsi
mov rcx, rbx
call fcn.1400043ec
jmp 0x14000449c
cmp dword [rbx + 0x14], 1
jne 0x140004471
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x140004471
xor eax, eax
jmp 0x14000449c
cmp dword [rbx + 0x14], 0
jne 0x140004493
cmp rdi, 0x8000
jbe 0x140004493
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x140004493
mov r8d, 0x8000
jmp 0x14000444f
or eax, 0xffffffff
jmp 0x14000449c
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000d2d1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
jmp 0x14001269b
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x1a0]
jmp 0x140011aee
add byte [rax], al
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a0]
jmp 0x14000d85c