joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b838
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x218]
sub rsp, 0x300
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400548d0]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov rdi, rdx
xor esi, esi
mov dword [rsp + 0x6c], esi
mov qword [rbp - 0x48], rsi
lea r14d, [rsi + 7]
mov qword [rbp - 0x40], r14
mov word [rbp - 0x58], si
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], r14
mov word [rbp - 0x78], si
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov dword [rsp + 0x20], esi
mov edx, 0x104
lea rcx, [rbp - 0x20]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14002b90e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmove ebx, eax
mov r8d, ebx
lea rdx, str.Error_retrieving_Windows_system_directoryhr__0x_08x.
mov ecx, ebx
call fcn.14000ad50
test ebx, ebx
jns 0x14002b90e
mov rcx, qword [rbp + 0x218]
mov r9d, ebx
lea r8, str.onecoreenduserupgradeenablersdssdsslibraryunenrollmentexecutor.cpp
lea edx, [rsi + 0x73]
call fcn.14000533c
jmp 0x14002ba17
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x58]
call fcn.14000d008
lea rdx, [0x140036f78]
lea rcx, [rbp - 0x58]
call fcn.14000d008
lea rdx, str.msiexec.exe
lea rcx, [rbp - 0x58]
call fcn.14000d008
lea rdx, str.__x
lea rcx, [rbp - 0x78]
call fcn.14000d008
cmp qword [rdi + 0x18], 8
jb 0x14002b955
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.14000d008
lea rdx, str.__qn
lea rcx, [rbp - 0x78]
call fcn.14000d008
lea rax, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rax, qword [rbp - 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rax, qword [rbp - 0x78]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x68], esi
lea rax, str.Uninstall_dss_client
mov qword [rsp + 0x58], rax
lea rax, str.MicrosoftWindows
mov qword [rsp + 0x50], rax
lea rax, [0x140043fb0]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov byte [rsp + 0x38], sil
lea rdx, [rbp - 0x38]
call fcn.14001ab80
movups xmm0, xmmword [rbp - 0x38]
movdqu xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.140030860
mov ebx, eax
test eax, eax
je 0x14002ba0c
mov r8d, eax
lea rdx, str.Error_creating_removal_task__0x_08x.
mov ecx, eax
call fcn.14000ad50
nop
lea rcx, [rsp + 0x28]
call fcn.14002efcc
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14002ba32
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
call fcn.14000ec50
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], r14
mov word [rbp - 0x78], si
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14002ba59
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
call fcn.14000ec50
mov eax, ebx
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.140031070
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14002c5f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
and qword [rsp + 0x48], 0
xor ebx, ebx
mov rdi, r8
mov rsi, rcx
test rdx, rdx
jne 0x14002c620
mov ecx, 0x80070057
mov ebx, ecx
call fcn.14000b6d0
jmp 0x14002c67c
test rdi, rdi
je 0x14002c612
mov byte [rcx], bl
lea rax, [rsp + 0x48]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14002c67c
and qword [rsp + 0x28], rbx
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
and qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14002c67c
mov byte [rsi], 1
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002c692
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000b5f4
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14002c6b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x40
and qword [rsp + 0x30], 0
mov rbx, r9
mov dword [rsp + 0x58], 4
mov rax, r8
mov rdi, rcx
test rcx, rcx
jne 0x14002c6eb
mov ecx, 0x80070057
mov edx, ecx
jmp 0x14002c76c
test rax, rax
je 0x14002c6df
test rbx, rbx
je 0x14002c6df
lea rcx, [rsp + 0x30]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14002c75c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14002c75c
xor edx, edx
cmp dword [rsp + 0x50], 4
je 0x14002c771
jmp 0x14002c6df
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
mov ecx, edx
call fcn.14000b6d0
mov rcx, qword [rsp + 0x30]
xor ebx, ebx
cmp edx, 0x80070002
cmovne ebx, edx
test rcx, rcx
je 0x14002c792
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000b5f4
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14002c7b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor r12d, r12d
mov dword [rbp + 0x30], 2
cmp qword [rcx + 0x18], 8
mov rbx, r9
mov r10, r8
mov qword [rbp - 8], r12
mov rsi, rcx
mov rax, rcx
jb 0x14002c7f2
mov rax, qword [rcx]
lea r15, [rcx + 0x10]
mov r9d, 0x20019
mov qword [r15], r12
xor r8d, r8d
mov word [rax], r12w
mov rdx, r10
lea rax, [rbp - 8]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14002c926
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea rax, [rbp + 0x38]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
cmp eax, 0xea
jne 0x14002c91d
mov eax, dword [rbp - 0x10]
dec eax
cmp eax, 1
jbe 0x14002c87a
mov ecx, 0x80070057
mov edi, ecx
jmp 0x14002c936
mov ecx, dword [rbp + 0x30]
mov eax, 2
shr rcx, 1
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400321f0
mov rcx, qword [rbp - 8]
lea r9, [rbp - 0x10]
mov r14, rax
xor r8d, r8d
lea rax, [rbp + 0x30]
mov rdx, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14002c926
cmp dword [rbp + 0x30], 2
mov edi, r12d
jbe 0x14002c86e
mov edx, dword [rbp + 0x30]
shr rdx, 1
dec rdx
cmp rdx, qword [rsi + 0x18]
ja 0x14002c908
cmp qword [rsi + 0x18], 8
jb 0x14002c8ec
mov rsi, qword [rsi]
lea rbx, [rdx + rdx]
mov qword [r15], rdx
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov word [rbx + rsi], r12w
jmp 0x14002c913
mov r9, r14
mov rcx, rsi
call fcn.14000e8f8
mov rcx, r14
call fcn.140031098
jmp 0x14002c93b
test eax, eax
jne 0x14002c926
mov edi, r12d
jmp 0x14002c93b
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14000b6d0
mov ecx, edi
call fcn.14000b5f4
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14002ccdc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, r8
mov rdi, rdx
movabs rbp, 0xcbf29ce484222325
xor ecx, ecx
movzx eax, byte [rcx + r8]
xor rbp, rax
movabs rdx, 0x100000001b3
imul rbp, rdx
inc rcx
cmp rcx, 4
jb 0x14002cd0f
mov rcx, qword [0x140055710]
and rcx, rbp
add rcx, rcx
mov rdx, qword [0x1400556f8]
mov rax, qword [rdx + rcx*8 + 8]
mov rsi, qword [0x1400556e8]
cmp rax, rsi
je 0x14002cd85
mov r8, qword [rdx + rcx*8]
mov ecx, dword [r14]
jmp 0x14002cd65
cmp rax, r8
je 0x14002cd7e
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x14002cd5c
mov rsi, qword [rax]
test rax, rax
je 0x14002cd85
mov qword [rdi], rax
mov byte [rdi + 8], 0
jmp 0x14002cf12
mov rsi, rax
xor eax, eax
jmp 0x14002cd6d
movabs rax, 0x7ffffffffffffff
cmp qword [0x1400556f0], rax
je 0x14002cf31
lea rax, [0x1400556e8]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x38], 0
mov ecx, 0x20
call fcn.14000ec94
mov rbx, rax
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [r14]
movdqu xmmword [rax + 0x10], xmm0
mov r8, qword [0x1400556f0]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x14002cde3
cvtsi2ss xmm0, rcx
jmp 0x14002cdf8
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x140055718]
xorps xmm1, xmm1
test rcx, rcx
js 0x14002ce0e
cvtsi2ss xmm1, rcx
jmp 0x14002ce23
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x1400556e0]
seta al
test al, al
je 0x14002cea7
call fcn.14002cf68
mov rax, qword [0x140055710]
and rax, rbp
add rax, rax
mov r8, qword [0x1400556f8]
mov rcx, qword [r8 + rax*8 + 8]
mov rdx, qword [0x1400556e8]
cmp rcx, rdx
jne 0x14002ce6c
mov qword [rsp + 0x30], rdx
and qword [rsp + 0x38], 0
jmp 0x14002ce90
mov rdx, qword [r8 + rax*8]
mov eax, dword [rbx + 0x10]
jmp 0x14002ce7e
cmp rcx, rdx
je 0x14002ceea
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x14002ce75
mov rax, qword [rcx]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rsi, qword [rsp + 0x30]
mov r8, qword [0x1400556f0]
mov rdx, qword [rsi + 8]
inc r8
mov qword [0x1400556f0], r8
mov qword [rbx], rsi
mov qword [rbx + 8], rdx
mov qword [rdx], rbx
mov qword [rsi + 8], rbx
mov rax, qword [0x140055710]
and rax, rbp
add rax, rax
mov rcx, qword [0x1400556f8]
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x1400556e8]
jne 0x14002cef4
mov qword [rcx + rax*8], rbx
jmp 0x14002cf06
mov qword [rsp + 0x30], rcx
jmp 0x14002ce64
cmp r8, rsi
jne 0x14002ceff
mov qword [rcx + rax*8], rbx
jmp 0x14002cf0b
cmp qword [rcx + rax*8 + 8], rdx
jne 0x14002cf0b
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
lea rcx, str.unordered_map_set_too_long
call fcn.14000fd9c
int3
Function at 0x14002cf68
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rcx, qword [0x1400556f0]
xorps xmm0, xmm0
add rcx, 1
js 0x14002cf8e
cvtsi2ss xmm0, rcx
jmp 0x14002cfa3
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x1400556e0]
call sub.api_ms_win_crt_private_l1_1_0.dll__o_ceilf
movss xmm1, dword [0x140045ddc]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x14002cfd5
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x14002cfd5
movabs rax, 0x8000000000000000
mov rcx, rax
mov rdx, qword [0x140055718]
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x14002d00a
cmp rdx, 0x200
jae 0x14002d007
shl rdx, 3
cmp rdx, rcx
jae 0x14002d00a
mov rdx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
ja 0x14002d19c
mov rbx, qword [0x1400556e8]
lea rax, [rdx - 1]
or rax, 1
mov edi, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1400556f8]
lea rdx, [rdi + rdi]
call fcn.14000d5e8
mov rax, qword [0x1400556e8]
lea r9, [rdi - 1]
mov qword [0x140055710], r9
mov qword [0x140055718], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14002d180
mov rcx, qword [rcx]
movabs r10, 0xcbf29ce484222325
xor r8d, r8d
movzx edx, byte [r8 + rax + 0x10]
movabs r11, 0x100000001b3
xor r10, rdx
inc r8
imul r10, r11
cmp r8, 4
jb 0x14002d091
mov r11, qword [0x1400556f8]
and r10, r9
add r10, r10
cmp qword [r11 + r10*8], rbx
jne 0x14002d0cf
mov qword [r11 + r10*8], rax
mov qword [r11 + r10*8 + 8], rax
jmp 0x14002d146
mov rdx, qword [r11 + r10*8 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14002d109
mov rdi, qword [rdx]
cmp rdi, rax
je 0x14002d0c8
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], rdi
mov rdx, qword [rdi + 8]
mov qword [rdx], rax
mov qword [rdi + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14002d0c8
mov rdi, rdx
jmp 0x14002d11b
mov rdx, qword [rdx + 8]
mov rdi, rdx
cmp r8d, dword [rdx + 0x10]
je 0x14002d15a
cmp qword [r11 + r10*8], rdx
jne 0x14002d10e
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], rdi
mov rdx, qword [rdi + 8]
mov qword [rdx], rax
mov qword [rdi + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + r10*8], rax
mov rax, rcx
cmp rcx, rbx
je 0x14002d180
mov r9, qword [0x140055710]
jmp 0x14002d081
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14002d146
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14002d1b0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.14000fd9c
int3
Function at 0x14002d274
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, r8
mov r15, rdx
mov r13, rcx
cmp rdx, r8
je 0x14002d36a
mov rsi, qword [rdx + 8]
movabs r14, 0xcbf29ce484222325
mov r12, qword [rcx + 8]
movabs rdx, 0x100000001b3
mov rbp, qword [rcx + 0x18]
xor ecx, ecx
mov qword [rsp + 0x20], rsi
movzx eax, byte [r15 + rcx + 0x10]
inc rcx
xor r14, rax
imul r14, rdx
cmp rcx, 4
jb 0x14002d2c1
and r14, qword [r13 + 0x30]
mov edx, 0x20
mov rbx, qword [r15]
add r14, r14
mov rcx, r15
mov rax, qword [rbp + r14*8]
mov qword [rsp + 0x80], rax
mov rax, qword [rbp + r14*8 + 8]
mov qword [rsp + 0x78], rax
call fcn.14000ec50
dec qword [r13 + 0x10]
cmp r15, qword [rsp + 0x78]
je 0x14002d340
mov qword [rsp + 0x88], rbx
cmp rbx, rdi
je 0x14002d354
mov rcx, rbx
mov edx, 0x20
mov rbx, qword [rbx]
call fcn.14000ec50
mov rax, qword [rsp + 0x78]
dec qword [r13 + 0x10]
cmp qword [rsp + 0x88], rax
jne 0x14002d310
cmp qword [rsp + 0x80], r15
jne 0x14002d383
mov qword [rbp + r14*8], r12
mov rax, r12
jmp 0x14002d386
cmp qword [rsp + 0x80], r15
jne 0x14002d363
mov qword [rbp + r14*8], rbx
mov qword [rsi], rbx
mov qword [rbx + 8], rsi
mov rbx, qword [rsp + 0x70]
mov rax, rdi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, rsi
mov qword [rbp + r14*8 + 8], rax
cmp rbx, rdi
je 0x14002d363
mov qword [rsp + 0x78], rbx
xor ecx, ecx
movabs rsi, 0x100000001b3
movabs r14, 0xcbf29ce484222325
movzx eax, byte [rbx + rcx + 0x10]
inc rcx
xor r14, rax
imul r14, rsi
cmp rcx, 4
jb 0x14002d3ab
and r14, qword [r13 + 0x30]
mov rcx, rbx
mov rsi, qword [rsp + 0x20]
add r14, r14
mov rbx, qword [rbx]
mov edx, 0x20
mov r15, qword [rbp + r14*8 + 8]
mov qword [rsp + 0x80], r15
call fcn.14000ec50
dec qword [r13 + 0x10]
cmp qword [rsp + 0x78], r15
je 0x14002d41e
mov r15, rbx
cmp rbx, rdi
je 0x14002d35e
mov rcx, rbx
mov edx, 0x20
mov rbx, qword [rbx]
call fcn.14000ec50
dec qword [r13 + 0x10]
cmp r15, qword [rsp + 0x80]
jne 0x14002d3f4
mov qword [rbp + r14*8], r12
mov qword [rbp + r14*8 + 8], r12
jmp 0x14002d38b
Function at 0x14002da10
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1400548d0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov ebx, dword [rcx + 0x24]
mov edi, 0x40
mov eax, ebx
mov rsi, rdx
and eax, 0x3f
mov r14, rcx
sub edi, eax
lea rcx, [rsp + 0x20]
cmp edi, 8
lea eax, [rdi + 0x40]
cmova eax, edi
xor edx, edx
mov edi, eax
lea r8d, [rax - 8]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ecx, dword [r14 + 0x20]
lea rdx, [rsp + 0x20]
shl ecx, 3
mov eax, ebx
shr eax, 0x1d
mov r8d, edi
or ecx, eax
mov byte [rsp + 0x20], 0x80
bswap ecx
lea eax, [rbx*8]
mov dword [rsp + rdi + 0x18], ecx
bswap eax
mov rcx, r14
mov dword [rsp + rdi + 0x1c], eax
call fcn.14002d8f0
mov eax, dword [r14]
lea rdi, [r14 + 0x28]
bswap eax
mov dword [rsi], eax
mov ecx, 0x40
mov eax, dword [r14 + 4]
bswap eax
mov dword [rsi + 4], eax
mov eax, dword [r14 + 8]
bswap eax
mov dword [rsi + 8], eax
mov eax, dword [r14 + 0xc]
bswap eax
mov dword [rsi + 0xc], eax
mov eax, dword [r14 + 0x10]
bswap eax
mov dword [rsi + 0x10], eax
mov eax, dword [r14 + 0x14]
bswap eax
mov dword [rsi + 0x14], eax
mov eax, dword [r14 + 0x18]
bswap eax
mov dword [rsi + 0x18], eax
mov eax, dword [r14 + 0x1c]
bswap eax
mov dword [rsi + 0x1c], eax
xor eax, eax
mov dword [r14 + 0x24], eax
mov dword [r14], 0x6a09e667
mov dword [r14 + 4], 0xbb67ae85
mov dword [r14 + 8], 0x3c6ef372
mov dword [r14 + 0xc], 0xa54ff53a
mov dword [r14 + 0x10], 0x510e527f
mov dword [r14 + 0x14], 0x9b05688c
mov dword [r14 + 0x18], 0x1f83d9ab
mov qword [r14 + 0x1c], 0x5be0cd19
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140031070
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r14
pop rdi
pop rsi
ret
Function at 0x14002e7e8
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1400548d0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x105
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
je 0x14002e90b
mov edx, 0x105
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveFileSpec]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x14002e884
mov edx, 0x267
mov rcx, qword [rsp + 0x248]
lea r8, str.onecoreenduserupgradeenablers_shellhelpers_servicehelpers.cpp
mov r9d, edi
call fcn.14000533c
mov eax, edi
jmp 0x14002e910
mov r9, rsi
lea r8, [rsp + 0x20]
mov edx, 0x105
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x14002e8af
mov edx, 0x268
jmp 0x14002e866
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
nop dword [rax + rax]
test eax, eax
je 0x14002e8f0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000dbfc
cmp qword [rbx + 0x18], 8
jb 0x14002e8db
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str.Found_existing_DLL:__s
xor ecx, ecx
call fcn.14000ad50
xor eax, eax
jmp 0x14002e910
cmp qword [rbx + 0x18], 8
jb 0x14002e8fa
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str.Cound_not_find_DLL:__s
xor ecx, ecx
call fcn.14000ad50
mov eax, 2
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140031070
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002edb4
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov r15, r9
mov qword [rsp + 0x28], rbx
mov rbp, r8
mov r12, rdx
mov rsi, rcx
test rcx, rcx
jne 0x14002edf3
mov ecx, 0x80070057
mov edi, ecx
call fcn.14000b6d0
jmp 0x14002eee0
test r12, r12
je 0x14002ede2
test rbp, rbp
je 0x14002ede2
test r15, r15
je 0x14002ede2
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x14002ede2
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoSizeW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14002ee48
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
je 0x14002ee48
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
jmp 0x14002ede9
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.14002ef14
mov rbx, qword [rsp + 0x28]
test rbx, rbx
jne 0x14002ee66
mov edi, 0x8007000e
jmp 0x14002ee44
mov r9, rbx
mov r8d, edi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW]
nop dword [rax + rax]
test eax, eax
jne 0x14002ee98
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14002ee36
mov edi, 0x80004005
jmp 0x14002ee44
lea r9, [rsp + 0x20]
mov rcx, rbx
lea r8, [rsp + 0x30]
lea rdx, [0x140036f78]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
je 0x14002ee81
mov rcx, qword [rsp + 0x30]
xor edi, edi
movzx eax, word [rcx + 0xa]
mov dword [r12], eax
movzx eax, word [rcx + 8]
mov dword [rbp], eax
movzx eax, word [rcx + 0xe]
mov dword [r15], eax
movzx eax, word [rcx + 0xc]
mov dword [r14], eax
mov ecx, edi
call fcn.14000b5f4
mov rcx, rbx
call fcn.140031098
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret