joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008a7cc
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov r14, rcx
mov rcx, qword [0x14016f048]
lea r12, [0x14016f048]
cmp rcx, r12
je 0x14008a824
test byte [rcx + 0x1c], 1
je 0x14008a824
cmp byte [rcx + 0x19], 4
jb 0x14008a824
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c448]
mov edx, 0x23
call fcn.1400049d8
mov eax, dword [rsp + 0x70]
mov r9d, esi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, r14
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
je 0x14008a890
mov rcx, qword [0x14016f048]
cmp rcx, r12
je 0x14008a880
test byte [rcx + 0x1c], 1
je 0x14008a880
cmp byte [rcx + 0x19], 2
jb 0x14008a880
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x24]
xor r9d, r9d
lea r8, [0x14014c448]
call fcn.1400049f8
mov rcx, qword [0x14016f048]
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x14008a897
mov rcx, qword [0x14016f048]
cmp rcx, r12
je 0x14008a8bd
test byte [rcx + 0x1c], 1
je 0x14008a8bd
cmp byte [rcx + 0x19], 4
jb 0x14008a8bd
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c448]
mov edx, 0x25
call fcn.1400049d8
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x14008a8d8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov ebp, r9d
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x14008a923
test byte [rcx + 0x1c], 1
je 0x14008a923
cmp byte [rcx + 0x19], 4
jb 0x14008a923
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c448]
mov edx, 0x26
call fcn.1400049d8
xor ebx, ebx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x78], ebx
mov dword [rdi], ebx
test rsi, rsi
jne 0x14008a950
lea r8, str.wszValueName
mov edx, 0x2d5
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.140082070
lea rax, [rsp + 0x78]
mov dword [rsp + 0x78], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test ebp, ebp
je 0x14008a990
cmp eax, 2
jne 0x14008a990
lea ebx, [rax - 1]
jmp 0x14008aa06
test ecx, ecx
je 0x14008a9e4
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov ebx, eax
mov rcx, qword [0x14016f048]
lea rdi, [0x14016f048]
cmp rcx, rdi
je 0x14008aa3a
test byte [rcx + 0x1c], 1
je 0x14008aa14
cmp byte [rcx + 0x19], 3
jb 0x14008aa14
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c448]
mov edx, 0x27
mov dword [rsp + 0x20], eax
mov r9, rsi
call fcn.140005938
jmp 0x14008aa0d
cmp dword [rsp + 0x68], 4
je 0x14008a9f2
mov ebx, 0x8007065d
jmp 0x14008aa06
cmp dword [rsp + 0x78], 4
je 0x14008aa00
mov ebx, 0x80004005
jmp 0x14008aa06
mov eax, dword [rsp + 0x70]
mov dword [rdi], eax
lea rdi, [0x14016f048]
mov rcx, qword [0x14016f048]
cmp rcx, rdi
je 0x14008aa3a
test byte [rcx + 0x1c], 1
je 0x14008aa3a
cmp byte [rcx + 0x19], 4
jb 0x14008aa3a
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c448]
mov edx, 0x28
call fcn.1400049d8
mov eax, ebx
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14008aa48
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, r9
mov r15, r8
mov rbp, rcx
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x14008aa9a
test byte [rcx + 0x1c], 1
je 0x14008aa9a
cmp byte [rcx + 0x19], 4
jb 0x14008aa9a
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c448]
mov edx, 0x2c
call fcn.1400049d8
xor ebx, ebx
mov dword [rsp + 0x70], ebx
xor ecx, ecx
mov qword [r15], rbx
mov dword [r14], ebx
lea esi, [rbx + 0x40]
mov dword [rsp + 0x68], esi
jmp 0x14008ab29
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x14008aae8
test byte [rcx + 0x1c], 1
je 0x14008aae8
cmp byte [rcx + 0x19], 4
jb 0x14008aae8
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c448]
mov edx, 0x2d
mov r9d, esi
call fcn.1400049f8
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.RestoredVolumes
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14008abe3
cmp eax, 0xea
jne 0x14008ab99
mov esi, dword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
jne 0x14008aab1
mov ebx, 0x8007000e
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x14008ab86
test byte [rcx + 0x1c], 1
je 0x14008ab86
cmp byte [rcx + 0x19], 4
jb 0x14008ab86
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c448]
mov edx, 0x2f
call fcn.1400049d8
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x14008ab49
test byte [rcx + 0x1c], 1
je 0x14008ab49
cmp byte [rcx + 0x19], 2
jb 0x14008ab49
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c448]
mov edx, 0x2e
mov r9d, ebx
call fcn.1400049f8
jmp 0x14008ab49
cmp dword [rsp + 0x70], 7
je 0x14008abf4
mov ebx, 0x8000ffff
jmp 0x14008ab49
mov eax, dword [rsp + 0x68]
mov qword [r15], rdi
mov rdi, rbx
mov dword [r14], eax
jmp 0x14008ab49
Function at 0x14008ac9c
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, rcx
mov qword [rax + 8], rbx
test rcx, rcx
jne 0x14008acd7
lea r8, str.pwszBlbWindowsDirectoryPath___NULL
mov edx, 0x63c
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.140082070
and qword [r14], rbx
mov edi, 0x208
mov ecx, edi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rsi, rax
test rax, rax
jne 0x14008acf6
mov edi, 0x8007000e
jmp 0x14008ad50
mov r8, rdi
xor edx, edx
mov rcx, rsi
call sub.msvcrt.dll_memset
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
test eax, eax
js 0x14008ad39
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140082c18
mov edi, eax
test eax, eax
js 0x14008ad34
mov rax, qword [rsp + 0x30]
mov qword [r14], rax
jmp 0x14008ad39
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rbx, rbx
je 0x14008ad50
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14008b384
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x50
mov rax, qword [0x14016f608]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebp, r8d
mov rdi, rcx
mov rcx, qword [0x14016f048]
lea r15, [0x14016f048]
lea r12, [0x14014c448]
cmp rcx, r15
je 0x14008b3e8
test byte [rcx + 0x1c], 1
je 0x14008b3e8
cmp byte [rcx + 0x19], 4
jb 0x14008b3e8
mov rcx, qword [rcx + 0x10]
mov edx, 0x5f
mov r8, r12
call fcn.1400049d8
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rsi, rax
test rdi, rdi
jne 0x14008b410
lea r8, str.phService
mov edx, 0x78f
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.140082070
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14008b476
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov ebx, eax
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x14008b5b2
test byte [rcx + 0x1c], 1
je 0x14008b590
cmp byte [rcx + 0x19], 2
jb 0x14008b590
mov rcx, qword [rcx + 0x10]
mov edx, 0x60
mov r9d, eax
mov r8, r12
call fcn.1400049f8
jmp 0x14008b589
mov ecx, dword [rsp + 0x24]
cmp ecx, 1
jne 0x14008b4c0
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x14008b5b2
test byte [rcx + 0x1c], 1
je 0x14008b590
cmp byte [rcx + 0x19], 4
jb 0x14008b590
mov edx, 0x61
mov rcx, qword [rcx + 0x10]
lea r9, str.Stopped
mov r8, r12
call fcn.1400058d8
jmp 0x14008b589
lea eax, [rcx - 3]
mov edx, 0x1388
cmp eax, 1
ja 0x14008b57f
mov ecx, dword [rsp + 0x38]
cmp ecx, edx
cmovb ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14008b569
cmp dword [rsp + 0x24], 1
je 0x14008b547
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
sub rcx, rsi
cmp rcx, rbp
ja 0x14008b510
mov ecx, dword [rsp + 0x24]
jmp 0x14008b4c0
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x14008b540
test byte [rcx + 0x1c], 1
je 0x14008b540
cmp byte [rcx + 0x19], 2
jb 0x14008b540
mov rcx, qword [rcx + 0x10]
mov edx, 0x63
mov r8, r12
call fcn.1400049d8
mov rcx, qword [0x14016f048]
mov ebx, 0x800705b4
jmp 0x14008b590
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x14008b5b2
test byte [rcx + 0x1c], 1
je 0x14008b590
cmp byte [rcx + 0x19], 4
jb 0x14008b590
mov edx, 0x62
jmp 0x14008b4a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14008b589
cmp ecx, 1
je 0x14008b589
mov ebx, 0x80780129
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x14008b5b2
test byte [rcx + 0x1c], 1
je 0x14008b5b2
cmp byte [rcx + 0x19], 4
jb 0x14008b5b2
mov rcx, qword [rcx + 0x10]
mov edx, 0x64
mov r8, r12
call fcn.1400049d8
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14013e290
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r12
pop rdi
ret
Function at 0x14008beb4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
and qword [rax + 8], 0
mov r14, rcx
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x14008bf05
test byte [rcx + 0x1c], 1
je 0x14008bf05
cmp byte [rcx + 0x19], 4
jb 0x14008bf05
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c448]
mov edx, 0x8f
call fcn.1400049d8
test r14, r14
jne 0x14008bf22
lea r8, str.pwszWindowsTempPath
mov edx, 0xa75
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.140082070
and qword [r14], 0
lea rcx, [rsp + 0x30]
mov edx, 0x14
lea r8d, [rdx - 0x12]
call fcn.14000f99c
mov ebx, eax
test eax, eax
js 0x14008c04a
mov rdi, qword [rsp + 0x30]
mov ecx, 0x14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
cmp eax, 0x14
jbe 0x14008c005
test rdi, rdi
je 0x14008bf75
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rsp + 0x30], 0
mov r8d, 2
lea rcx, [rsp + 0x30]
mov edx, esi
call fcn.14000f99c
mov ebx, eax
test eax, eax
js 0x14008c04a
mov rdi, qword [rsp + 0x30]
mov ecx, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
ja 0x14008bfad
test eax, eax
jne 0x14008c043
test eax, eax
jne 0x14008bfc7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14008bfcc
mov ebx, 0x8007000e
mov rcx, qword [0x14016f048]
lea rsi, [0x14016f048]
cmp rcx, rsi
je 0x14008c05d
test byte [rcx + 0x1c], 1
je 0x14008c05d
cmp byte [rcx + 0x19], 2
jb 0x14008c05d
mov edx, 0x90
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c448]
mov r9d, ebx
call fcn.1400049f8
jmp 0x14008c056
test esi, esi
jne 0x14008c043
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016f048]
lea rsi, [0x14016f048]
cmp rcx, rsi
je 0x14008c05d
test byte [rcx + 0x1c], 1
je 0x14008c05d
cmp byte [rcx + 0x19], 2
jb 0x14008c05d
mov edx, SysAllocStringByteLen
jmp 0x14008bff0
mov qword [r14], rdi
xor edi, edi
jmp 0x14008c04f
mov rdi, qword [rsp + 0x30]
lea rsi, [0x14016f048]
mov rcx, qword [0x14016f048]
test rdi, rdi
je 0x14008c072
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14016f048]
cmp rcx, rsi
je 0x14008c098
test byte [rcx + 0x1c], 1
je 0x14008c098
cmp byte [rcx + 0x19], 4
jb 0x14008c098
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c448]
mov edx, DllRegisterServer
call fcn.1400049d8
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14008c9f0
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov esi, r9d
mov rdi, r8
mov rbp, rdx
test rdx, rdx
jne 0x14008ca2c
lea r8, str.hCryptHash
mov edx, 0x206
lea rcx, str.base_stor_blbutilchecksum.cpp
call fcn.140082070
test rdi, rdi
jne 0x14008ca49
lea r8, [0x14014c4a8]
mov edx, 0x207
lea rcx, str.base_stor_blbutilchecksum.cpp
call fcn.140082070
test esi, esi
je 0x14008caa5
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
jns 0x14008cadc
mov ecx, eax
call fcn.140039d4c
mov ebx, eax
mov rcx, qword [0x14016f048]
lea rdx, [0x14016f048]
cmp rcx, rdx
je 0x14008cadc
test byte [rcx + 0x1c], 1
je 0x14008cadc
cmp byte [rcx + 0x19], 2
jb 0x14008cadc
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c570]
mov edx, 0x13
mov r9d, eax
call fcn.1400049f8
jmp 0x14008cadc
mov rcx, qword [0x14016f048]
lea rdx, [0x14016f048]
cmp rcx, rdx
je 0x14008cadc
test byte [rcx + 0x1c], 1
je 0x14008cadc
cmp byte [rcx + 0x19], 5
jb 0x14008cadc
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c570]
mov edx, 0x14
mov r9, rdi
call fcn.14000fcd0
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14008ea08
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, rcx
xor r13d, r13d
xor ecx, ecx
xor edx, edx
mov ebp, r13d
mov r12d, r8d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
test eax, eax
jne 0x14008ea9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x14008ec3b
test byte [rcx + 0x1c], 1
je 0x14008ec3b
cmp byte [rcx + 0x19], 2
jb 0x14008ec3b
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x3e]
mov r9d, ebx
lea r8, [0x14014c850]
call fcn.1400049f8
jmp 0x14008ec3b
or rbx, 0xffffffffffffffff
mov rdx, rbx
inc rdx
cmp word [r15 + rdx*2], r13w
jne 0x14008eaa1
lea r14d, [rax + 1]
xor ecx, ecx
inc r14
add r14, rdx
lea rdx, [r14 + r14]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x14008ead3
mov ebx, 0x8007000e
jmp 0x14008ec57
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
ja 0x14008ebf1
test eax, eax
je 0x14008ebdb
inc rbx
cmp word [rdi + rbx*2], r13w
jne 0x14008eaee
mov eax, 0x5c
cmp ax, word [rdi + rbx*2 - 2]
je 0x14008eb64
lea r8, [0x140145788]
mov rdx, r14
mov rcx, rdi
call fcn.1400506ec
mov ebx, eax
test eax, eax
jns 0x14008eb64
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x14008ec2d
test byte [rcx + 0x1c], 1
je 0x14008ec2d
cmp byte [rcx + 0x19], 2
jb 0x14008ec2d
mov edx, 0x40
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c850]
mov r9d, ebx
call fcn.1400049f8
jmp 0x14008ec2d
mov r8, r15
mov rdx, r14
mov rcx, rdi
call fcn.1400506ec
mov ebx, eax
test eax, eax
jns 0x14008ebaa
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x14008ec2d
test byte [rcx + 0x1c], 1
je 0x14008ec2d
cmp byte [rcx + 0x19], 2
jb 0x14008ec2d
mov edx, 0x41
jmp 0x14008eb4c
mov r8d, r12d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbp, rax
test rax, rax
jne 0x14008ebd6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14008ec2d
mov ebx, r13d
jmp 0x14008ec2d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14008ebf6
mov ebx, 0x8007006f
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x14008ec2d
test byte [rcx + 0x1c], 1
je 0x14008ec2d
cmp byte [rcx + 0x19], 2
jb 0x14008ec2d
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014c850]
mov edx, 0x3f
mov r9d, ebx
call fcn.1400049f8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbp, rbp
jne 0x14008ec5f
test ebx, ebx
jne 0x14008ec57
lea r8, str.S_OK___hr
mov edx, 0x64c
lea rcx, str.base_stor_blbutil_blbutility.cpp
call fcn.140082070
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x50]
mov rax, rbp
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140090c50
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x14016f608]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
test rcx, rcx
jne 0x140090c94
lea r8, str.pwszLogsDirectory
mov edx, 0x23c
lea rcx, str.base_stor_blbutil_blbtrace.cpp
call fcn.140082070
and qword [rdi], 0
mov rcx, qword [0x14016f048]
lea rsi, [0x14016f048]
cmp rcx, rsi
je 0x140090ccc
test byte [rcx + 0x1c], 1
je 0x140090ccc
cmp byte [rcx + 0x19], 4
jb 0x140090ccc
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014cc28]
mov edx, 0x23
call fcn.1400049d8
mov ebx, 0x208
lea rcx, [rsp + 0x20]
mov r8d, ebx
xor edx, edx
call sub.msvcrt.dll_memset
mov r8d, ebx
lea rcx, [rsp + 0x230]
xor edx, edx
call sub.msvcrt.dll_memset
lea r8, str._SystemRoot_Logs
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.140039dd4
mov ebx, eax
test eax, eax
js 0x140090d56
mov r8d, 0x104
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140090d41
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140090d56
xor r8d, r8d
lea rcx, [rsp + 0x230]
mov rdx, rdi
call fcn.140082e28
mov ebx, eax
mov rcx, qword [0x14016f048]
cmp rcx, rsi
je 0x140090d83
test byte [rcx + 0x1c], 1
je 0x140090d83
cmp byte [rcx + 0x19], 4
jb 0x140090d83
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014cc28]
mov edx, 0x24
call fcn.1400049d8
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14013e290
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14009fdfc
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x30
mov rsi, rdx
lea r15, [0x14016f048]
mov rbp, rcx
xor edi, edi
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14009fe8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x20
jne 0x14009fec3
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x14009fe7a
test byte [rcx + 0x1c], 1
je 0x14009fe7a
cmp byte [rcx + 0x19], 3
jb 0x14009fe7a
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x32]
mov r9, rbp
mov qword [rsp + 0x20], rsi
lea r8, [0x14014db08]
call fcn.1400059ac
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 5
jb 0x14009fe24
cmp edi, 5
jne 0x14009ff0b
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x14009febc
test byte [rcx + 0x1c], 1
je 0x14009febc
cmp byte [rcx + 0x19], 2
jb 0x14009febc
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x4f]
lea r8, [0x14014db08]
call fcn.1400049d8
mov eax, 0x80780163
jmp 0x14009ff0d
mov rcx, qword [0x14016f048]
cmp rcx, r15
je 0x14009fefc
test byte [rcx + 0x1c], 1
je 0x14009fefc
cmp byte [rcx + 0x19], 2
jb 0x14009fefc
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014db08]
mov edx, 0x53
mov dword [rsp + 0x28], ebx
mov r9, rbp
mov qword [rsp + 0x20], rsi
call fcn.140005a64
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x14009ff0d
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x1400a0e7c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14016f608]
xor rax, rsp
mov qword [rsp + 0x78], rax
and dword [rsp + 0x30], 0
mov edi, edx
mov rsi, rcx
mov ebx, 0x20
mov r8d, ebx
lea rcx, [rsp + 0x58]
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x58]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400a0f2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x1400a0f19
test byte [rcx + 0x1c], 2
je 0x1400a0f19
cmp byte [rcx + 0x19], 2
jb 0x1400a0f19
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x43]
mov r9d, edi
lea r8, [0x14014db08]
call fcn.1400049f8
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x1400a0fca
mov r9d, dword [rsp + 0x30]
cmp r9d, ebx
je 0x1400a0f70
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x1400a0fc0
test byte [rcx + 0x1c], 2
je 0x1400a0fc0
cmp byte [rcx + 0x19], 2
jb 0x1400a0fc0
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014db08]
mov edx, 0x64
mov dword [rsp + 0x20], ebx
call fcn.14000fa80
jmp 0x1400a0fc0
mov rsi, qword [rsi + 0x10]
lea rcx, [rsp + 0x38]
mov r8, rbx
xor edx, edx
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.14008c704
mov ebx, eax
test eax, eax
js 0x1400a0faf
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
call fcn.14008cda4
test al, al
mov ecx, 0x80004005
cmove ebx, ecx
lea r8, [rsi + 0x10]
lea rdx, [rsi + 8]
call fcn.14008cef0
test ebx, ebx
jns 0x1400a0fca
neg edi
sbb ebx, ebx
add ebx, 0x80780002
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14013e290
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400a0ff0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14016f608]
xor rax, rsp
mov qword [rsp + 0x58], rax
and dword [rsp + 0x30], 0
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x38]
call fcn.14008c704
mov ebx, eax
test eax, eax
js 0x1400a10cb
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x38]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400a10ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x14016f048]
lea rax, [0x14016f048]
cmp rcx, rax
je 0x1400a109c
test byte [rcx + 0x1c], 2
je 0x1400a109c
cmp byte [rcx + 0x19], 2
jb 0x1400a109c
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014db08]
mov edx, 0x65
mov r9d, edi
call fcn.1400049f8
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x1400a10cb
cmp dword [rsp + 0x30], 0x20
je 0x1400a10cb
lea r8, str.dwWritten__sizeof_rgChecksum_
mov edx, 0xd2f
lea rcx, [0x14014d288]
call fcn.140082070
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14013e290
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret