joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006940
Capabilities:
Get file size
Read file on windows

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov rdi, r9
mov ebp, r8d
mov rsi, rdx
mov qword [rsp + 0x40], 0xffffffffffffffff
xor eax, eax
mov dword [rsp + 0x48], eax
mov r8, qword [rsp + 0x90]
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.140006890
test eax, eax
jne 0x1400069ae
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
je 0x1400069a7
test byte [rsp + 0x48], 1
je 0x1400069a7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140006a61
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400069c4
jmp 0x14000698f
test rdi, rdi
je 0x1400069e0
mov r8, qword [rsp + 0x80]
mov edx, eax
lea rcx, [rsp + 0x40]
call rdi
test eax, eax
jne 0x1400069e0
jmp 0x14000698f
lea edx, [rbx + rbp]
mov rcx, rsi
cmp dword [rsp + 0x88], 0
je 0x1400069fb
call fcn.140005a30
test eax, eax
jne 0x140006a06
jmp 0x14000698f
call fcn.140005a90
test eax, eax
jne 0x140006a06
jmp 0x14000698f
mov r8d, ebx
xor edx, edx
mov rcx, rsi
call fcn.140005720
mov rcx, rsi
call fcn.140005920
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmove ecx, edi
cmp ebx, ecx
sete dil
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
je 0x140006a5f
test byte [rsp + 0x48], 1
je 0x140006a5f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400073d0
Capabilities:
Accept command line arguments
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
test rax, rax
jne 0x140007406
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.NULL_CommandLine
mov edx, 0x288
mov r8d, eax
call fcn.140008040
xor eax, eax
add rsp, 0x60
pop rbp
ret
lea rdx, [rsp + 0x20]
mov rcx, rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor ebx, ebx
mov rsi, rax
cmp dword [rsp + 0x20], ebx
jle 0x140007481
mov qword [rsp + 0x80], rdi
mov rdi, rax
nop word [rax + rax]
mov rcx, qword [rdi]
lea rdx, str._logfile
call fcn.14001df24
test rax, rax
jne 0x140007462
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x20]
jl 0x140007440
jmp 0x140007479
movsxd rax, ebx
mov rcx, qword [rsi + rax*8]
add rcx, 0x12
call fcn.14001e1ec
mov qword [0x14005d6b8], rax
mov rdi, qword [rsp + 0x80]
xor edx, edx
lea rcx, [rsp + 0x2c]
mov dword [rsp + 0x28], 0
lea r8d, [rdx + 0x2c]
call fcn.14001d3c0
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11d, 9
cmp r11w, word [rsp + 0x28]
jne 0x1400074d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.x64_architecture
mov edx, 0x29c
mov r8d, eax
call fcn.140008040
mov dword [0x14005d6f8], 1
lea rcx, str.WinMain__u_n
mov edx, 0x2a0
call fcn.140008040
mov ecx, dword [rsp + 0x20]
mov rdx, rsi
mov qword [0x14005d6c0], rbp
call fcn.140006fe0
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140008430
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rsi, r8
mov rbp, rcx
mov rbx, qword [rdx + 8]
test rbx, rbx
je 0x14000854e
lea rcx, [rsp + 0x28]
call fcn.140005570
nop
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx - 2]
mov rdx, rbp
lea rcx, [rsp + 0x28]
call fcn.140005720
lea rdx, [rbx + 0x10]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx]
lea rcx, [rsp + 0x28]
call fcn.140005720
test rsi, rsi
je 0x1400084e1
lea rcx, [rsp + 0x28]
call fcn.140005920
mov edx, 0x2e
mov rcx, rax
call fcn.14001e518
mov rdx, rsi
sub rax, rsi
movzx ecx, word [rdx]
mov word [rax + rdx + 2], cx
add rdx, 2
test cx, cx
jne 0x1400084d0
lea rcx, [rsp + 0x28]
call fcn.140005920
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140008513
lea rcx, [rsp + 0x28]
call fcn.140005920
mov rdx, rax
lea rcx, str.File__ws_DELETED_OK...
call fcn.140008040
jmp 0x140008538
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rcx, [rsp + 0x28]
call fcn.140005920
mov rdx, rax
mov r8d, edi
lea rcx, str.File__ws_COULD_NOT_be_deleted____u__...
call fcn.140008040
nop
lea rcx, [rsp + 0x28]
call fcn.140005690
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140008461
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140009130
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
test rcx, rcx
je 0x1400092fa
push rdi
sub rsp, 0x40
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x38], rbp
xor ebp, ebp
mov rdi, rcx
lea r8, [rsp + 0x60]
lea rdx, str.SYSTEMCurrentControlSetControlNetwork
mov rcx, 0xffffffff80000002
mov ebx, ebp
mov qword [rsp + 0x60], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x30], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140009272
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, str.FilterClasses
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x50]
xor ecx, ecx
call fcn.14001d2d4
mov rsi, rax
test rax, rax
je 0x140009296
mov rcx, qword [rsp + 0x60]
mov rbx, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rdx, str.FilterClasses
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140009272
lea r8, [rsp + 0x60]
lea rdx, str.SYSTEMCurrentControlSetControlNetwork
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140009272
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, str.FilterClasses
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x50]
mov rcx, rbx
call fcn.14001d2d4
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov rbx, rax
lea rax, [rsp + 0x50]
lea rdx, str.FilterClasses
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jns 0x140009296
test rbx, rbx
je 0x140009284
mov rcx, rbx
call fcn.14001ccf0
mov rbx, rbp
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400092d3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400092d3
lea rcx, str.IMDriver:_Removing_FilterClass___s
mov rdx, rdi
call fcn.140008040
mov rdx, rbx
mov rcx, rdi
call fcn.140007f30
mov r9d, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x28], eax
lea rdx, str.FilterClasses
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call fcn.14001ccf0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
repz ret
Function at 0x14000a310
Capabilities:
Check os version

Disassembly:
sub rsp, 0x198
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x14005bed0]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x60], 0x114
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14000a3c4
mov edx, dword [rsp + 0x64]
cmp edx, 6
jb 0x14000a3bb
lea rcx, str.Adding_catalog_file...
call fcn.140008040
lea rcx, [rsp + 0x38]
call fcn.140005570
nop
lea rcx, str.avfwot.cat
call fcn.14000e410
mov rdx, rax
mov r8d, 1
lea rcx, [rsp + 0x38]
call fcn.140005b00
lea rcx, [rsp + 0x38]
call fcn.140005920
test rax, rax
je 0x14000a3af
lea rcx, [rsp + 0x38]
call fcn.140005920
mov rcx, rax
mov edx, 1
call fcn.140004000
nop
lea rcx, [rsp + 0x38]
call fcn.140005690
jmp 0x14000a3d8
lea rcx, str.NOT_Adding_catalog_file____u__
jmp 0x14000a3d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.NOT_Adding_catalog_file_GetVersionEx_FAILED____u__
call fcn.140008040
lea rcx, str.avfwot.sys
call fcn.140009cb0
lea rcx, [rsp + 0x20]
call fcn.140005570
nop
lea rdx, [rsp + 0x20]
lea rcx, str.DefaultInstall
call fcn.140009450
test eax, eax
jne 0x14000a41a
lea rdx, str.InstallOMInf
lea rcx, str._s_FAILED_to_Add_cmd_args
call fcn.140008040
nop
jmp 0x14000a463
lea rcx, [rsp + 0x20]
call fcn.140005920
mov r8, rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call sub.SETUPAPI.dll_InstallHinfSectionW
lea rcx, str.avfwot
call fcn.1400098a0
test eax, eax
je 0x14000a463
mov edx, eax
lea rcx, str.FAILED_to_configure_registry_0x_x..._uninstalling_driver
call fcn.140008040
nop
lea rcx, [rsp + 0x20]
call fcn.140005690
mov eax, 0x80070005
jmp 0x14000a46f
lea rcx, [rsp + 0x20]
call fcn.140005690
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14001d550
add rsp, 0x198
ret
Function at 0x14000b4a0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx]
mov esi, r8d
mov rbx, rcx
mov qword [rax], rdx
mov r8, qword [rcx + 8]
xor edx, edx
mov ecx, esi
mov edi, r9d
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rdx, qword [rbx]
mov qword [rdx + 8], rax
mov rcx, qword [rbx]
mov rcx, qword [rcx]
test rax, rax
jne 0x14000b54b
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov eax, dword [rbx + 0x10]
mov r8d, edi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, qword [rbx]
mov qword [rcx + 8], rax
test byte [rbx + 0x20], 2
mov rcx, qword [rbx]
je 0x14000b513
mov eax, dword [rbx + 0x10]
jmp 0x14000b521
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rbx]
mov dword [rcx + 0x10], eax
mov rcx, qword [rbx]
cmp qword [rcx + 8], 0
jne 0x14000b545
call fcn.14000b430
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov edi, dword [rsp + 0x60]
jmp 0x14000b560
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rbx]
mov edi, dword [rsp + 0x60]
mov dword [rcx + 0x10], eax
or edi, 4
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rcx + 8]
mov edx, esi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, qword [rbx]
mov qword [rcx + 0x18], rax
test rax, rax
je 0x14000b58d
or edi, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret

Function at 0x14000cff0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14005bed0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, dword [0x14004ec14]
xor ebp, ebp
mov rbx, rcx
mov dword [rsp + 0x20], eax
movzx eax, word [0x14004ec18]
mov edi, ebp
mov word [rsp + 0x24], ax
movzx eax, word [rcx]
mov esi, ebp
mov word [rsp + 0x20], ax
nop word [rax + rax]
add edi, 0x104
mov rcx, rsi
mov edx, edi
add rdx, rdx
call fcn.14001d2d4
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp eax, 0x7a
je 0x14000d040
test eax, eax
je 0x14000d0e3
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdi, rsi
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
dec rcx
add rdx, rcx
lea rcx, [rdx + rdx + 2]
call fcn.14001cc38
mov rbp, rax
test rax, rax
je 0x14000d0ee
mov rcx, rax
mov rdx, rsi
sub rcx, rsi
movzx eax, word [rdx]
add rdx, 2
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x14000d0b1
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
xor ecx, ecx
movzx eax, word [rbx + rcx + 4]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x14000d0d0
mov rcx, rsi
call fcn.14001ccf0
mov rax, rbp
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001d550
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14000d260
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x188]
sub rsp, 0x280
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x14005bed0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rbx, rdx
mov rdi, rcx
mov rcx, rdx
call fcn.140005940
xor r11d, r11d
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
lea rax, str.REG_APPDATADIR
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rcx, [rsp + 0x30]
call fcn.140007570
nop
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400075d0
test eax, eax
jne 0x14000d30b
lea rcx, [rsp + 0x30]
call fcn.140007580
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000d304
call fcn.14001ccf0
xor eax, eax
jmp 0x14000d4ab
mov r8d, 0x100
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
cmp dword [0x14005d6f8], 0
je 0x14000d32b
call fcn.1400077e0
jmp 0x14000d330
call fcn.1400078e0
test eax, eax
jne 0x14000d341
lea rcx, [rsp + 0x30]
call fcn.140007580
nop
jmp 0x14000d2f5
xor edi, edi
lea r9d, [rdi + 0x10]
lea r8d, [rdi + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400076e0
test eax, eax
je 0x14000d428
cmp qword [rsp + 0x48], rdi
je 0x14000d428
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14000d428
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x34], edi
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000d40b
mov ecx, dword [rsp + 0x34]
inc ecx
call fcn.14001cc38
mov rdi, rax
test rax, rax
je 0x14000d40b
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000d40b
mov rcx, rdi
call fcn.14001ccf0
xor edi, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x14000d428
mov rdx, rdi
mov rcx, rbx
call fcn.140005c20
jmp 0x14000d438
call fcn.14000e150
mov rdx, rax
mov rcx, rbx
call fcn.140005b40
mov rcx, rbx
call fcn.140005920
test rax, rax
jne 0x14000d455
lea rcx, [rsp + 0x30]
call fcn.140007580
nop
jmp 0x14000d2f5
mov rcx, rbx
call fcn.140005920
mov r11, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r11
repne scasw ax, word [rdi]
not rcx
mov eax, 0x5c
cmp ax, word [r11 + rcx*2 - 4]
je 0x14000d48c
lea rdx, [0x14004beac]
mov rcx, rbx
call fcn.1400058e0
nop
lea rcx, [rsp + 0x30]
call fcn.140007580
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000d4a6
call fcn.14001ccf0
mov eax, 1
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14001d550
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000d4d0
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x258
mov rax, qword [0x14005bed0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r12, r8
mov rbp, rdx
mov rsi, rcx
mov ebx, 0x41
mov qword [rsp + 0x250], rdi
nop word [rax + rax]
lea rdx, [0x14004ece0]
lea rcx, [rsp + 0x20]
movzx r8d, bx
call fcn.14000cb70
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x14000d565
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
mov rdx, rsi
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.14001f7dc
test eax, eax
je 0x14000d595
inc bx
cmp bx, 0x5a
jbe 0x14000d510
xor eax, eax
mov rdi, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14001d550
add rsp, 0x258
pop r12
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
mov eax, 1
not rcx
dec rcx
mov dword [r12], ecx
mov word [rbp], bx
jmp 0x14000d570

Function at 0x14000d730
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
lea rax, [rsp + 0x58]
mov rbp, r8
xor ebx, ebx
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000d7bb
mov edx, dword [rsp + 0x58]
mov rcx, rbp
call fcn.140005a30
xor edx, edx
mov rcx, rbp
call fcn.1400058a0
mov rcx, rbp
call fcn.140005920
lea rcx, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000de00
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
test eax, eax
je 0x14000de61
mov ecx, edi
mov qword [rsp + 0x30], rbx
add rcx, rcx
call fcn.14001cc38
mov rbx, rax
test rax, rax
je 0x14000de48
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
inc eax
cmp edi, eax
jbe 0x14000de53
mov rcx, rbx
call fcn.14001ccf0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14000ffa0
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
sub rsp, 0xa8
mov rax, qword [0x14005bed0]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
movsxd rdi, r9d
mov rsi, r8
mov r12, rdx
mov ebp, ecx
mov byte [r11 - 0x48], 0
mov qword [r11 - 0x47], rax
mov dword [r11 - 0x3f], eax
mov word [r11 - 0x3b], ax
mov byte [r11 - 0x39], al
test r9d, r9d
jg 0x14000fff3
mov eax, 8
jmp 0x1400100ad
mov ecx, 0x200
mov qword [rsp + 0xa0], rbx
call fcn.14001cc38
mov rbx, rax
test rax, rax
jne 0x140010015
lea eax, [rbx + 4]
jmp 0x1400100a5
movzx edx, word [r12 + 0x16]
movzx eax, word [r12 + 8]
xor r8d, r8d
add edx, eax
mov ecx, ebp
shl edx, 4
and edx, 0xfffff
call fcn.140020c5c
mov r8d, 0x200
mov rdx, rbx
mov ecx, ebp
call fcn.140020928
test eax, eax
jne 0x140010059
mov rcx, rbx
call fcn.14001ccf0
mov eax, 1
jmp 0x1400100a5
lea rcx, [rsp + 0x20]
call fcn.140012e50
lea rcx, [rsp + 0x20]
mov r8d, 0x200
mov rdx, rbx
call fcn.1400137b0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x80]
call fcn.140013880
lea rdx, [rsp + 0x80]
mov r8, rdi
mov rcx, rsi
call fcn.14001cd80
mov rcx, rbx
call fcn.14001ccf0
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14001d550
add rsp, 0xa8
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400100d0
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push r14
push r15
sub rsp, 0x358
mov rax, qword [0x14005bed0]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov r15d, ecx
xor ecx, ecx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x28], r8
mov r14, rdx
mov byte [r11 - 0x58], 0
mov qword [r11 - 0x57], rcx
mov dword [r11 - 0x4f], ecx
mov word [r11 - 0x4b], cx
mov byte [r11 - 0x49], cl
test r9d, r9d
jg 0x140010125
lea eax, [rcx + 8]
jmp 0x1400102bd
mov qword [rsp + 0x378], rbx
mov qword [rsp + 0x340], rdi
xor edi, edi
mov ecx, 0x200
mov qword [rsp + 0x330], r13
mov ebx, edi
call fcn.14001cc38
mov r13, rax
test rax, rax
jne 0x14001015b
lea eax, [rdi + 4]
jmp 0x1400102a5
mov qword [rsp + 0x350], rbp
xor r8d, r8d
xor edx, edx
mov ecx, r15d
mov qword [rsp + 0x348], rsi
mov qword [rsp + 0x338], r12
call fcn.140020c5c
mov r12d, edi
mov rbp, rdi
cmp di, word [r14 + 6]
jae 0x1400101f3
lea rsi, [rsp + 0xb4]
nop word [rax + rax]
movsxd rax, r12d
mov r8d, 0x28
lea rcx, [rax + rax*4]
lea rdx, [rsp + rcx*8 + 0x90]
mov ecx, r15d
call fcn.140020928
cmp eax, 0x28
jne 0x1400102d9
test byte [rsi], 0x60
jne 0x1400101d6
inc ebx
inc rbp
add rsi, 0x28
jmp 0x1400101dc
cmp rbp, 0x10
je 0x1400101e9
movzx eax, word [r14 + 6]
inc r12d
cmp r12d, eax
jl 0x1400101a0
mov eax, 3
cmp ebx, eax
cmovg ebx, eax
test ebx, ebx
jle 0x14001023d
mov eax, 0x200
lea rsi, [rsp + 0xa4]
cdq
idiv ebx
mov ebp, eax
nop dword [rax]
mov edx, dword [rsi]
xor r8d, r8d
mov ecx, r15d
call fcn.140020c5c
mov r8d, ebp
mov rdx, r13
mov ecx, r15d
call fcn.140020928
cmp eax, ebp
jne 0x1400102d9
inc edi
add rsi, 0x28
cmp edi, ebx
jl 0x140010210
lea rcx, [rsp + 0x30]
call fcn.140012e50
lea rcx, [rsp + 0x30]
mov r8d, 0x200
mov rdx, r13
call fcn.1400137b0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x310]
call fcn.140013880
movsxd r8, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x310]
call fcn.14001cd80
mov rcx, r13
call fcn.14001ccf0
xor eax, eax
mov r12, qword [rsp + 0x338]
mov rsi, qword [rsp + 0x348]
mov rbp, qword [rsp + 0x350]
mov rdi, qword [rsp + 0x340]
mov rbx, qword [rsp + 0x378]
mov r13, qword [rsp + 0x330]
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.14001d550
add rsp, 0x358
pop r15
pop r14
ret
mov rcx, r13
call fcn.14001ccf0
mov eax, 1
jmp 0x14001028d