joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140112f00
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1401177d0
mov cl, al
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140112f20

Function at 0x140112f20
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, rdx
mov bpl, cl
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
xor edi, edi
call fcn.14003a220
mov al, bpl
lea rdx, [rsp + 0x20]
neg al
sbb r8d, r8d
xor r9d, r9d
and r8d, 0xa
xor ecx, ecx
add r8d, 0x1c
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor r8d, r8d
lea rdx, [0x1403613f0]
mov rcx, rsi
mov ebx, eax
call fcn.14001b664
test ebx, ebx
jne 0x140112f9a
mov edi, 0x80004005
jmp 0x140112ffb
or rbx, 0xffffffffffffffff
lea rax, [rsp + 0x20]
mov r8, rbx
inc r8
cmp word [rax + r8*2], di
jne 0x140112fa6
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14001b664
mov r8d, 1
lea rdx, [0x1403613ec]
mov rcx, rsi
call fcn.140019e88
test bpl, bpl
lea rax, [0x14031b0f8]
lea rdx, str.MicrosoftOneDrive
cmovne rdx, rax
inc rbx
cmp word [rdx + rbx*2], di
jne 0x140112fe7
mov r8, rbx
mov rcx, rsi
call fcn.140019e88
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140038910
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401137c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.14003a220
mov dword [rsp + 0x34], 1
xor ebx, ebx
mov dword [rsp + 0x30], 0x104
call fcn.140112ecc
mov rcx, rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r8, [0x14035e720]
lea rax, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftOneDrive
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x140113865
lea rax, [rsp + 0x40]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bx
jne 0x14011384c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14001b664
jmp 0x14011386a
mov ebx, 0x80004005
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140038910
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x14011393c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, qword [rsp + 0xa0]
mov rdi, r8
mov rbp, qword [rsp + 0xa8]
test rsi, rsi
jne 0x140113976
mov eax, 0x80070057
jmp 0x140113a0e
movzx r9d, r9b
shl r9d, 8
add r9d, 0x20019
cmp qword [rdx + 0x18], 8
jb 0x14011398f
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140113a0c
cmp qword [rdi + 0x18], 8
jb 0x1401139be
mov rdi, qword [rdi]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rbp
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140113a01
mov eax, dword [rsp + 0x38]
sub eax, 3
neg eax
sbb ebx, ebx
and ebx, 0x8007065d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140038910
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140113a24
Capabilities:
Query or enumerate registry value

Disassembly:
movzx r9d, r9b
add r9d, r9d
jmp fcn.140113a30

Function at 0x140113a30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rsp + 0x90]
mov rdi, r8
xor r8d, r8d
mov eax, 0x200
cmp r9d, 1
mov r10d, 0x100
cmove r8d, eax
xor eax, eax
cmp r9d, 2
cmove eax, r10d
or r8d, eax
or r8d, 0x20019
cmp qword [rdx + 0x18], 8
jb 0x140113a86
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov r9d, r8d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x38], 4
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140113b1d
cmp qword [rdi + 0x18], 8
jb 0x140113ac0
mov rdi, qword [rdi]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140113b12
cmp dword [rsp + 0x3c], 4
jne 0x140113b0d
mov eax, dword [rsp + 0x40]
xor ebx, ebx
mov dword [rsi], eax
jmp 0x140113b12
mov ebx, 0x8007065d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140038910
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140113b34
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rsp + 0x90]
mov rdi, r8
test rsi, rsi
jne 0x140113b65
mov eax, 0x80070057
jmp 0x140113c16
movzx r9d, r9b
shl r9d, 8
add r9d, 0x20019
cmp qword [rdx + 0x18], 8
jb 0x140113b7e
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x38], 8
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140113c14
cmp qword [rdi + 0x18], 8
jb 0x140113bb5
mov rdi, qword [rdi]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140113c09
cmp dword [rsp + 0x3c], 0xb
jne 0x140113c04
mov rax, qword [rsp + 0x40]
xor ebx, ebx
mov qword [rsi], rax
jmp 0x140113c09
mov ebx, 0x8007065d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140038910
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140115a18
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov rcx, qword [0x1403c32e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x378]
call qword [str.0B__]
mov rbx, rax
mov qword [rsi], rbp
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], 7
mov word [rsi], bp
mov dword [rsp + 0x20], 1
mov r8b, 1
lea rdx, str._url:
mov rcx, rax
call fcn.14010a240
test al, al
je 0x140115af2
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14, rax
mov ebx, ebp
cmp dword [rsp + 0x30], ebp
jle 0x140115af2
mov rdi, rax
mov r8b, 1
lea rdx, str._url:
mov rcx, qword [rdi]
call fcn.14010c324
test al, al
jne 0x140115ad5
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x30]
jl 0x140115ab1
jmp 0x140115af2
movsxd rax, ebx
mov rdx, qword [r14 + rax*8]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], bp
jne 0x140115ae0
mov rcx, rsi
call fcn.14001b664
mov rax, rsi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140038910
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x140118e58
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rcx + 0x18], 8
mov r8, rcx
jb 0x140118e65
mov r8, qword [rcx]
mov eax, dword [rcx + 0x10]
mov edx, 0x811c9dc5
xor ecx, ecx
add eax, eax
mov r9d, eax
je 0x140118e8b
movzx eax, byte [r8 + rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r9
jb 0x140118e76
mov eax, edx
ret
Function at 0x14011ca28
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rsp + 0x58], rax
neg byte [rsp + 0xa0]
mov rsi, r9
mov rbx, r8
sbb eax, eax
and eax, 0xfffe00fc
add eax, 0x20006
cmp qword [rdx + 0x18], 8
jb 0x14011ca62
mov rdx, qword [rdx]
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], r8
xor r9d, r9d
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], eax
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test eax, eax
jne 0x14011cad9
cmp qword [rbx + 0x10], 0
jne 0x14011ca9e
xor ebx, ebx
jmp 0x14011caa8
cmp qword [rbx + 0x18], 8
jb 0x14011caa8
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x50]
mov r9d, listen
mov dword [rsp + 0x28], 8
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140038910
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x14011cc58
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rsp + 0x38], rax
neg byte [rsp + 0x80]
mov rdi, r9
mov rbx, r8
sbb r9d, r9d
and r9d, 0xfffe00fc
add r9d, 0x20006
cmp qword [rdx + 0x18], 8
jb 0x14011cc97
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x14011cd0c
cmp qword [rdi + 0x18], 8
mov eax, dword [rdi + 0x10]
lea eax, [rax*2 + 2]
jb 0x14011ccc4
mov rdi, qword [rdi]
movzx r9d, byte [rsp + 0x88]
inc r9d
cmp qword [rbx + 0x10], 0
jne 0x14011ccdb
xor ebx, ebx
jmp 0x14011cce5
cmp qword [rbx + 0x18], 8
jb 0x14011cce5
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovle eax, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140038910
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140121be4
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov dword [rsp + 0x20], setsockopt
lea rcx, [rsp + 0x28]
xor ebx, ebx
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x140121c40
lea rax, [rsp + 0x28]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bx
jne 0x140121c27
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14001b664
mov bl, 1
mov al, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140038910
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140121d10
Capabilities:
Get user security identifier

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, rdx
mov rdi, rcx
xor r15d, r15d
mov sil, r15b
mov dword [rbp - 0x15], r15d
mov dword [rbp - 0x11], r15d
mov rdx, rcx
cmp qword [rcx + 0x18], 8
jb 0x140121d57
mov rdx, qword [rcx]
lea rax, [rbp - 0xd]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x15]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x11]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
xorps xmm0, xmm0
mov word [rbp - 0x19], r15w
mov edx, dword [rbp - 0x15]
inc edx
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r15
lea r8, [rbp - 0x19]
lea rcx, [rbp - 9]
call fcn.1401213fc
nop
xorps xmm0, xmm0
mov byte [rbp - 0x19], r15b
mov edx, dword [rbp - 0x11]
movdqu xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], r15
lea r8, [rbp - 0x19]
lea rcx, [rbp + 0xf]
call fcn.140109610
nop
cmp qword [rdi + 0x18], 8
jb 0x140121dcc
mov rdi, qword [rdi]
lea rax, [rbp - 0xd]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x15]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 9]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x11]
mov rbx, qword [rbp + 0xf]
mov r8, rbx
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x140121e1e
mov rdx, qword [rbp - 9]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r15w
jne 0x140121e09
mov rcx, r14
call fcn.14001b664
mov sil, 1
mov edi, 0x1000
test rbx, rbx
je 0x140121e55
mov rdx, qword [rbp + 0x1f]
sub rdx, rbx
mov rax, rbx
cmp rdx, rdi
jb 0x140121e4c
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140121eb9
mov rcx, rbx
call fcn.1400385dc
nop
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140121e8d
mov rdx, qword [rbp + 7]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rax, rcx
cmp rdx, rdi
jb 0x140121e88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140121eb3
call fcn.1400385dc
mov al, sil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140038910
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14004689c
nop
call fcn.14004689c
nop
int3
Function at 0x140121ec0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0x101
lea rcx, [rsp + 0x30]
xor ebx, ebx
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140121f22
lea rax, [rsp + 0x30]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bx
jne 0x140121f09
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14001b664
mov bl, 1
mov al, bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140038910
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret

Function at 0x140122f90
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov esi, r9d
mov rdi, rdx
mov rdx, r8
lea rcx, [rsp + 0x40]
call fcn.14010aeb8
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x140122fbf
mov rbx, qword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14010aeb8
cmp qword [rax + 0x18], 8
jb 0x140122fd6
mov rax, qword [rax]
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.14001b814
nop
lea rcx, [rsp + 0x40]
call fcn.14001b814
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x140123010
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, [rsp + 0x20]
mov rbx, r8
call fcn.14010aeb8
cmp qword [rax + 0x18], 8
jb 0x14012302d
mov rax, qword [rax]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.14001b814
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x140123360
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, [rsp + 0x20]
call fcn.14010aeb8
cmp qword [rax + 0x18], 8
jb 0x14012337a
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.14001b814
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x1401236b0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, [rsp + 0x20]
call fcn.14010aeb8
cmp qword [rax + 0x18], 8
jb 0x1401236ca
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.14001b814
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x140123dd0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rdx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x200
call fcn.14003a220
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x100
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor ecx, ecx
mov ebx, eax
test eax, eax
je 0x140123e50
mov eax, 0x4c00
cmp word [rsp + 0x30], ax
je 0x140123e50
lea rax, [rsp + 0x30]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], cx
jne 0x140123e39
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14001b664
neg ebx
sbb eax, eax
not eax
and eax, 0x80004005
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140038910
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret

Function at 0x140124080
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov esi, r9d
mov rdi, rdx
mov rdx, r8
lea rcx, [rsp + 0x40]
call fcn.14010aeb8
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x1401240af
mov rbx, qword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14010aeb8
cmp qword [rax + 0x18], 8
jb 0x1401240c6
mov rax, qword [rax]
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.14001b814
nop
lea rcx, [rsp + 0x40]
call fcn.14001b814
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x140124690
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x88]
mov r10, r9
mov r9d, dword [rsp + 0x70]
mov r11, r8
mov qword [rsp + 0x30], rax
mov rcx, rdx
mov rax, qword [rsp + 0x80]
mov r8, r10
mov qword [rsp + 0x28], rax
mov rdx, r11
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
add rsp, 0x40
pop rbx
ret

Function at 0x140124790
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add rsp, 0x30
pop rbx
ret

Function at 0x1401247d0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov r10, r9
mov r9d, dword [rsp + 0x60]
mov r11, r8
mov dword [rsp + 0x28], eax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
add rsp, 0x30
pop rbx
ret

Function at 0x140124810
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov r10d, r9d
mov r9d, dword [rsp + 0x60]
mov r11, r8
mov dword [rsp + 0x28], eax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8d, r10d
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
pop rbx
ret
Function at 0x140124910
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, [rsp + 0x20]
call fcn.14010aeb8
cmp qword [rax + 0x18], 8
jb 0x14012492a
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.14001b814
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x140124d70
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9d, dword [rsp + 0x60]
mov r11d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8, r10
mov edx, r11d
mov qword [rsp + 0x20], rax
call sub.SHELL32.dll_SHGetFolderPathAndSubDirW
add rsp, 0x30
pop rbx
ret

Function at 0x140124ed0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
add rsp, 0x30
pop rbx
ret

Function at 0x140124f30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x88]
mov r10, r9
mov r9d, dword [rsp + 0x70]
mov r11, r8
mov qword [rsp + 0x30], rax
mov rcx, rdx
mov rax, qword [rsp + 0x80]
mov r8, r10
mov qword [rsp + 0x28], rax
mov rdx, r11
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
add rsp, 0x40
pop rbx
ret

Function at 0x140124fd0
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, [rsp + 0x20]
mov ebx, r8d
call fcn.14010aeb8
cmp qword [rax + 0x18], 8
jb 0x140124fed
mov rax, qword [rax]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.14001b814
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x140125b90
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov r12, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rdx, [0x1403613f0]
call fcn.14001b664
mov r8b, byte [rbp + 0x2e8]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140125708
test al, al
je 0x140125e08
cmp qword [rsp + 0x28], rdi
je 0x140125e08
mov r9, qword [rsp + 0x28]
mov r8, r14
mov ebx, 0x104
mov edx, ebx
lea rcx, [rbp + 0x70]
call fcn.1401259a4
test al, al
je 0x140125dfe
cmp word [rbp + 0x70], di
je 0x140125dfe
lea rcx, [rbp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140125dfe
mov r8, r12
mov edx, ebx
lea rcx, [rbp + 0x70]
call fcn.140065770
test eax, eax
js 0x140125dfe
xor edx, edx
lea rcx, [rbp + 0x70]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r14d, eax
test eax, eax
je 0x140125dfe
mov ecx, r14d
call fcn.140047c60
mov rbx, rax
test rax, rax
je 0x140125dfe
mov r9, rax
mov r8d, r14d
xor edx, edx
lea rcx, [rbp + 0x70]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140125df6
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x68]
lea rdx, [0x1403613ec]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140125df6
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp - 0x80]
call fcn.14003a220
lea edx, [rdi + 1]
lea rcx, [rbp - 0x80]
call fcn.14009fe7c
nop
mov rax, qword [rsp + 0x68]
movzx edx, word [rax + 0xa]
lea rcx, [rbp - 0x80]
call fcn.14002a0d8
lea r14, [0x140364078]
mov rdx, r14
lea rcx, [rbp - 0x80]
call fcn.14002c7c8
mov rax, qword [rsp + 0x68]
movzx edx, word [rax + 8]
lea rcx, [rbp - 0x80]
call fcn.14002a0d8
mov rdx, r14
lea rcx, [rbp - 0x80]
call fcn.14002c7c8
mov rax, qword [rsp + 0x68]
movzx edx, word [rax + 0xe]
lea rcx, [rbp - 0x80]
call fcn.14002a0d8
mov rdx, r14
lea rcx, [rbp - 0x80]
call fcn.14002c7c8
mov rax, qword [rsp + 0x68]
movzx edx, word [rax + 0xc]
lea rcx, [rbp - 0x80]
call fcn.14002a0d8
nop
mov qword [rsp + 0x30], rdi
movdqa xmm0, xmmword [0x140364f60]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], di
mov dword [rsp + 0x20], 2
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.14002c118
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140125d94
mov r8, qword [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.14001b664
nop
lea rax, [rsp + 0x30]
cmp rsi, rax
je 0x140125dca
mov rcx, rsi
call fcn.14001b814
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rsi + 0x10], xmm1
movdqa xmm0, xmmword [0x140364f60]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], di
lea rcx, [rsp + 0x30]
call fcn.14001b814
mov dil, 1
lea rcx, [rbp + 8]
call fcn.1400a0080
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 8], rax
lea rcx, [rbp + 8]
call fcn.14014a318
nop
mov rcx, rbx
call fcn.140046478
mov rcx, qword [rsp + 0x28]
call fcn.140046478
mov al, dil
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.140038910
mov rbx, qword [rsp + 0x3d8]
add rsp, 0x390
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret