joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a4500
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400c7430
sub rsp, rax
mov rax, qword [0x14010a080]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140134b90]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400a4715
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1400a4659
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400a4659
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1400a4639
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1400a45c8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400a46d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400a4734
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x44], eax
jae 0x1400a4710
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400a4734
jmp 0x1400a459e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14005e370
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1400a9f00
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov edx, 8
lea rcx, [rsp + 0x60]
call fcn.14006a1e0
movzx eax, al
test eax, eax
je 0x1400a9f27
mov al, 1
jmp 0x1400aa01c
lea rcx, [rsp + 0x60]
call fcn.14006a220
movzx eax, al
test eax, eax
je 0x1400a9f66
lea rcx, [rsp + 0x60]
call fcn.14005ba30
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
call fcn.14005ba30
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x40]
cmp qword [rcx], rax
jne 0x1400a9f66
xor al, al
jmp 0x1400aa01c
lea rcx, [rsp + 0x60]
call fcn.14006be60
mov ecx, eax
call fcn.1400b81f0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x1400a9f8b
xor al, al
jmp 0x1400aa01c
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov r9d, 1
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1400a9fd0
xor al, al
jmp 0x1400aa01c
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400a9ff9
xor al, al
jmp 0x1400aa01c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jne 0x1400aa00f
mov dword [rsp + 0x20], 1
jmp 0x1400aa017
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x50
pop rdi
ret
Function at 0x1400aefe0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400b6700
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14005dbd0
lea rcx, [rsp + 0x40]
call fcn.1400b66c0
movzx eax, al
test eax, eax
jne 0x1400b6748
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1400b65f0
mov rax, qword [rsp + 0x70]
jmp 0x1400b6919
lea rcx, [rsp + 0x40]
call fcn.14005ba30
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1400b6670
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.14005ba30
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400b38e0
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1400b67ee
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1400b65f0
mov rax, qword [rsp + 0x80]
jmp 0x1400b6919
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.14008e2a0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14005dbd0
lea rcx, [rsp + 0x48]
call fcn.14005e310
movzx eax, al
test eax, eax
jne 0x1400b6855
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.14005e2f0
lea rcx, [rsp + 0x40]
call fcn.1400b65f0
mov rax, qword [rsp + 0x88]
jmp 0x1400b6919
lea rcx, [rsp + 0x48]
call fcn.14005ba30
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.14005ba30
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400b38e0
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1400b68eb
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.14005e2f0
lea rcx, [rsp + 0x40]
call fcn.1400b65f0
mov rax, qword [rsp + 0xa0]
jmp 0x1400b6919
lea rcx, [rsp + 0x48]
call fcn.140062240
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.14005e2f0
lea rcx, [rsp + 0x40]
call fcn.1400b65f0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400bcda0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
cmp qword [rsp + 0x40], 0
je 0x1400bcddf
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
test eax, eax
je 0x1400bcddf
lea rdx, [0x1400ea348]
mov rcx, qword [rsp + 0x40]
call fcn.1400ba7c0
test eax, eax
jne 0x1400bce16
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x20001004
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1400bce05
xor eax, eax
jmp 0x1400bce65
cmp dword [rsp + 0x20], 0
jne 0x1400bce14
call qword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x1400bce65
jmp 0x1400bce61
lea rdx, [0x1400ea360]
mov rcx, qword [rsp + 0x40]
call fcn.1400ba7c0
test eax, eax
jne 0x1400bce53
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x2000000b
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1400bce51
xor eax, eax
jmp 0x1400bce65
jmp 0x1400bce61
mov rcx, qword [rsp + 0x40]
call fcn.14009dfb0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1400bced0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
movzx eax, word [rsp + 0x50]
and eax, 0x3ff
movzx eax, ax
bts eax, 0xa
movzx eax, ax
mov dword [rsp + 0x24], eax
call fcn.14009f1e0
add rax, 0x98
mov qword [rsp + 0x30], rax
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x20000001
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1400bcf33
xor eax, eax
jmp 0x1400bcf73
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x50], eax
je 0x1400bcf6e
cmp dword [rsp + 0x58], 0
je 0x1400bcf6e
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.1400bc6a0
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call fcn.140095ee0
mov ecx, dword [rsp + 0x28]
cmp ecx, eax
jne 0x1400bcf6e
xor eax, eax
jmp 0x1400bcf73
mov eax, 1
add rsp, 0x48
ret
Function at 0x1400c3940
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x14010a080]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1400c3969
jmp 0x1400c39ee
mov rcx, qword [rbp + 0x30]
call fcn.1400d2a50
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1400c3982
jmp 0x1400c39ee
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1400c399f
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400c7430
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 0
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400b1de0
test eax, eax
jne 0x1400c39ee
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.14005e370
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x140001000
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
xor ecx, ecx
call sub.IMM32.dll_ImmDisableIME
xor edi, edi
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea rcx, [rsp + 0x38]
mov rsi, rax
call fcn.14003b5c0
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x34]
lea rcx, [rsp + 0x38]
mov r8, rsi
mov rdx, rbx
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rax
call fcn.140003358
cmp al, dil
jne 0x140001083
lea rcx, [rsp + 0x38]
xor edx, edx
call fcn.14003ca20
lea rcx, [rsp + 0x38]
xor edx, edx
call fcn.14003b890
or edi, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rsp + 0x38]
call fcn.14003b520
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x50
pop rdi
ret
Function at 0x140001168
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x7b0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x7a0], rax
xor ebx, ebx
mov word [rsp + 0x590], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x592]
call fcn.140010930
mov edx, 0x104
lea rcx, [rsp + 0x590]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
je 0x1400013a0
inc eax
cmp eax, 0x104
jae 0x1400013a0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0x450]
call fcn.14003d780
nop
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14004a610]
lea rcx, [rsp + 0x58]
call fcn.14003d780
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x450]
call fcn.14003d690
lea rcx, [rsp + 0x58]
call fcn.14003cdf0
lea rdx, [0x140058520]
lea rcx, [rsp + 0x310]
call fcn.14003acc0
nop
lea rcx, [rsp + 0x450]
call fcn.14003cdb0
mov rdx, rax
lea rcx, [rsp + 0x310]
call fcn.14003a880
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0x1d0]
call fcn.14003d780
nop
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.regsvr32.exe
lea rcx, [rsp + 0x58]
call fcn.14003d780
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x1d0]
call fcn.14003d690
lea rcx, [rsp + 0x58]
call fcn.14003cdf0
lea rcx, [rsp + 0x40]
call fcn.14003b5c0
nop
lea rcx, [rsp + 0x310]
call fcn.14003a130
mov r9, rax
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x28], 5
lea rax, [0x140058544]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x1d0]
call fcn.14003f1b0
mov dword [rsp + 0x20], 0xe0000804
mov r9d, 0xf000ffff
lea r8, str.SogouPY.ime
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x40]
call fcn.140005284
cmp al, bl
je 0x140001368
xor r8d, r8d
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x40]
call fcn.140005a40
nop
lea rcx, [rsp + 0x40]
call fcn.14003b520
nop
lea rcx, [rsp + 0x1d0]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x310]
call fcn.14003a260
nop
lea rcx, [rsp + 0x450]
call fcn.14003cdf0
mov al, 1
jmp 0x1400013a2
xor al, al
mov rcx, qword [rsp + 0x7a0]
xor rcx, rsp
call fcn.14000fd20
add rsp, 0x7b0
pop rbx
ret
Function at 0x1400013bc
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x7b0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x7a0], rax
xor ebx, ebx
mov word [rsp + 0x590], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x592]
call fcn.140010930
mov edx, 0x104
lea rcx, [rsp + 0x590]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
je 0x1400015f0
inc eax
cmp eax, 0x104
jae 0x1400015f0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0x450]
call fcn.14003d780
nop
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14004a610]
lea rcx, [rsp + 0x58]
call fcn.14003d780
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x450]
call fcn.14003d690
lea rcx, [rsp + 0x58]
call fcn.14003cdf0
lea rdx, [0x140058548]
lea rcx, [rsp + 0x310]
call fcn.14003acc0
nop
lea rcx, [rsp + 0x450]
call fcn.14003cdb0
mov rdx, rax
lea rcx, [rsp + 0x310]
call fcn.14003a880
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0x1d0]
call fcn.14003d780
nop
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.regsvr32.exe
lea rcx, [rsp + 0x58]
call fcn.14003d780
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x1d0]
call fcn.14003d690
lea rcx, [rsp + 0x58]
call fcn.14003cdf0
lea rcx, [rsp + 0x40]
call fcn.14003b5c0
nop
lea rcx, [rsp + 0x310]
call fcn.14003a130
mov r9, rax
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x28], 5
lea rax, [0x140058544]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x1d0]
call fcn.14003f1b0
mov dword [rsp + 0x20], 0xe0000804
mov r9d, 0xf000ffff
lea r8, str.SogouPY.ime
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x40]
call fcn.140005284
xor r8d, r8d
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x40]
call fcn.140005a40
nop
lea rcx, [rsp + 0x40]
call fcn.14003b520
nop
lea rcx, [rsp + 0x1d0]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x310]
call fcn.14003a260
nop
lea rcx, [rsp + 0x450]
call fcn.14003cdf0
mov al, 1
jmp 0x1400015f2
xor al, al
mov rcx, qword [rsp + 0x7a0]
xor rcx, rsp
call fcn.14000fd20
add rsp, 0x7b0
pop rbx
ret
Function at 0x14000160c
Capabilities:
Get session information
Get session user name
Get user security identifier

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x880
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x870], rax
xor edi, edi
lea rax, [rsp + 0x64]
lea r9, [rsp + 0x40]
lea r8d, [rdi + 5]
or edx, 0xffffffff
xor ecx, ecx
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x64], 0x104
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
cmp eax, edi
jne 0x14000166c
mov rcx, qword [rsp + 0x40]
call sub.WTSAPI32.dll_WTSFreeMemory
xor eax, eax
jmp 0x1400017bf
mov rbx, qword [rsp + 0x40]
cmp word [rbx], di
jne 0x14000167b
mov rcx, rbx
jmp 0x140001660
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x7fe
mov dword [rsp + 0x48], edi
mov word [rsp + 0x70], di
call fcn.140010930
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x4c]
mov rdx, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x4c], 0x400
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov r11d, dword [rsp + 0x48]
cmp r11d, edi
je 0x14000165b
mov rcx, r11
call fcn.1400104f8
mov rdx, qword [rsp + 0x40]
lea r9, [rsp + 0x48]
mov rbx, rax
lea rax, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x4c]
mov r8, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
cmp eax, edi
jne 0x140001732
mov rcx, qword [rsp + 0x40]
call sub.WTSAPI32.dll_WTSFreeMemory
mov rcx, rbx
call fcn.1400102e4
jmp 0x140001665
lea rdx, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x58], rdi
call sub.ADVAPI32.dll_ConvertSidToStringSidW
cmp eax, edi
jne 0x14000175f
mov rcx, qword [rsp + 0x40]
call sub.WTSAPI32.dll_WTSFreeMemory
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140001725
mov rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov r8d, 0xf003f
mov r9d, r8d
mov rcx, 0xffffffff80000003
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x14000179d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rdi
mov rcx, qword [rsp + 0x40]
call sub.WTSAPI32.dll_WTSFreeMemory
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call fcn.1400102e4
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.14000fd20
mov rbx, qword [rsp + 0x890]
add rsp, 0x880
pop rdi
ret
Function at 0x140001b88
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rsi, rcx
xor edi, edi
call fcn.140001c9c
mov rbx, rax
test rax, rax
jne 0x140001bd8
mov rcx, rsi
call fcn.140001d74
mov rbx, rax
test rax, rax
jne 0x140001bd8
mov edi, 0xfffffec3
jmp 0x140001c75
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnloadKeyboardLayout]
test eax, eax
jne 0x140001bed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.14000160c
mov rcx, rbx
mov rsi, rax
test rax, rax
je 0x140001c10
mov rdx, rax
call fcn.140002fa4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140001c1c
mov rdx, 0xffffffff80000001
call fcn.140002fa4
lea rdx, str.SystemCurrentControlSetControlKeyboard_Layouts_08X
lea rcx, [rsp + 0x20]
mov r8, rbx
call fcn.140003554
test eax, eax
jns 0x140001c47
mov r8, rbx
lea rdx, str.SystemCurrentControlSetControlKeyboard_Layouts_08X
lea rcx, [0x140058758]
jmp 0x140001c70
lea rdx, [rsp + 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x140001c75
lea r8, [rsp + 0x20]
lea rdx, str.HKEY_LOCAL_MACHINE_s
lea rcx, [0x140058770]
call fcn.140003328
mov eax, edi
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.14000fd20
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140001c9c
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x70
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r13, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov ecx, 0x40
mov edx, eax
mov r12d, eax
shl rdx, 3
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor ebx, ebx
mov rsi, rax
cmp rax, rbx
jne 0x140001cf2
xor eax, eax
jmp 0x140001d4c
mov rdx, rax
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov edi, ebx
cmp r12d, ebx
jbe 0x140001d40
mov rbp, rsi
mov rcx, qword [rbp]
lea rdx, [rsp + 0x20]
mov r8d, 0x20
call sub.IMM32.dll_ImmGetIMEFileNameW
lea rcx, [rsp + 0x20]
mov rdx, r13
call fcn.14000ffa4
cmp eax, ebx
je 0x140001d3a
inc edi
add rbp, 8
cmp edi, r12d
jb 0x140001d08
jmp 0x140001d40
mov eax, edi
mov rbx, qword [rsi + rax*8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000fd20
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140001d74
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
sub rsp, 0x7b0
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x7a0], rax
lea rax, [rsp + 0x68]
mov r13, rcx
lea rbx, str.SystemCurrentControlSetControlKeyboard_Layouts
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140001ddd
lea rcx, [0x140058718]
mov rdx, rbx
call fcn.140003328
jmp 0x140001e47
and qword [rsp + 0x58], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x68]
and qword [rsp + 0x28], 0
and dword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x140001e71
lea rcx, [0x140058728]
mov rdx, rbx
call fcn.140003328
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x7a0]
xor rcx, rsp
call fcn.14000fd20
lea r11, [rsp + 0x7b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop rdi
pop rsi
ret
mov eax, dword [rsp + 0x60]
mov ecx, 0xfa
cmp eax, ecx
cmova eax, ecx
xor ebp, ebp
xor ebx, ebx
mov dword [rsp + 0x60], eax
test eax, eax
jle 0x140001f1f
lea rdi, [rsp + 0x90]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x480]
mov edx, ebx
mov dword [rsp + 0x70], 0xc8
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140001ee3
cmp eax, 0xea
jne 0x140001f13
lea r8, [rsp + 0x64]
lea rdx, [0x140058740]
lea rcx, [rsp + 0x480]
call fcn.140010ad0
test eax, eax
je 0x140001f13
mov ecx, dword [rsp + 0x64]
cmp cx, 0x804
jne 0x140001f13
mov dword [rdi], ecx
inc ebp
add rdi, 4
inc ebx
cmp ebx, dword [rsp + 0x60]
jl 0x140001e97
movsxd rbp, ebp
xor ebx, ebx
xor edi, edi
xor esi, esi
test rbp, rbp
jle 0x140001e3c
mov r9d, dword [rsp + rsi*4 + 0x90]
lea r8, str._08x
lea rcx, [rsp + 0x480]
mov edx, 0xc8
call fcn.14000fd9c
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x78]
lea rdx, [rsp + 0x480]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001fe5
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x64]
lea rdx, [0x140057aa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x610]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x64], 0x190
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001fda
lea rcx, [rsp + 0x610]
mov rdx, r13
call fcn.14000ffa4
test eax, eax
je 0x140001ff8
cmp ebx, dword [rsp + rsi*4 + 0x90]
cmovb ebx, dword [rsp + rsi*4 + 0x90]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc rsi
inc edi
cmp rsi, rbp
jge 0x140001e3c
jmp 0x140001f31
movsxd rax, edi
mov eax, dword [rsp + rax*4 + 0x90]
jmp 0x140001e49