joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a2b70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, rdx
mov rdx, r8
mov rsi, rcx
call fcn.1401a2600
test eax, eax
jne 0x1401a2c77
call fcn.140049470
lea rbx, [0x140c480f0]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea rcx, [0x140369398]
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x1401a2be1
xor ebx, ebx
jmp 0x1401a2c60
xor eax, eax
lea rdx, [0x14036967c]
lea rcx, [rsp + 0x48]
lea r8d, [rax + 0x5d]
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x49], rax
mov word [rsp + 0x51], ax
mov byte [rsp + 0x53], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1401a2c20
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x48]
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1401a2c50
mov rax, qword [rsi]
lea rdx, [0x1403693b8]
mov r8, rbx
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x1401a2cf4
lea rax, [rsp + 0x44]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x70000
mov rcx, rsi
mov dword [rsp + 0x28], 0x18
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [rsp + 0x5c]
mov ecx, reloc.MFC80U.DLL_Ordinal_512
test eax, eax
lea r9, [rsp + 0x40]
mov rdx, rbp
cmove edi, ecx
mov rcx, rsi
mov dword [rsp + 0x40], ebx
mov r8d, edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401a2cf2
mov eax, dword [rsp + 0x40]
xor edx, edx
div edi
test edx, edx
jne 0x1401a2cf2
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401ba170
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_320], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, Ordinal_280
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_280
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1401ba218
mov qword [rsp + 0x160], rbx
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_336], rdi
call fcn.140049470
mov rdi, qword [rax]
lea rcx, str..WizardMakeWinPEWelcomeDlg.cpp
mov edx, 0x5f
mov rbx, rax
call fcn.1401ba020
lea rdx, [0x14036aed0]
mov r8, rax
mov rcx, rbx
call qword [rdi + 0x10]
mov rdi, qword [rsp + reloc.MFC80U.DLL_Ordinal_336]
mov rbx, qword [rsp + 0x160]
xor eax, eax
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_320]
xor rcx, rsp
call fcn.140161080
add rsp, 0x158
ret
mov eax, dword [rsp + 0x24]
cmp eax, 6
ja 0x1401ba22d
cmp eax, 6
jne 0x1401ba1fe
cmp dword [rsp + 0x28], 1
jb 0x1401ba1fe
mov eax, 1
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_320]
xor rcx, rsp
call fcn.140161080
add rsp, 0x158
ret
Function at 0x1401ceb90
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x1b0
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov ebx, ecx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, Ordinal_280
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], Ordinal_280
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x44], 6
jae 0x1401cec46
xor eax, eax
lea rdx, [0x14036cdc8]
lea rcx, [rsp + 0x160]
mov r8d, ebx
mov word [rsp + 0x160], 0
mov qword [rsp + 0x162], rax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_362], rax
mov qword [rsp + 0x172], rax
mov qword [rsp + 0x17a], rax
mov qword [rsp + 0x182], rax
mov qword [rsp + 0x18a], rax
mov qword [rsp + 0x192], rax
mov dword [rsp + 0x19a], eax
mov word [rsp + 0x19e], ax
call qword [sym.imp.MSVCR80.dll__swprintf]
jmp 0x1401cec7c
call fcn.1400494c0
mov edx, ebx
mov r8, qword [rax]
mov rcx, rax
call qword [r8 + 0x18]
test eax, eax
jns 0x1401cec61
or rax, 0xffffffffffffffff
jmp 0x1401cecaf
lea rdx, [0x14036cdf0]
lea rcx, [rsp + 0x160]
mov r9d, ebx
mov r8d, eax
call qword [sym.imp.MSVCR80.dll__swprintf]
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x160]
lea r8d, [r9 + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140161080
add rsp, 0x1b0
pop rbx
ret
Function at 0x1401cecd0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, rdx
mov rdx, r8
mov rbp, r9
mov rsi, rcx
call fcn.1401cea00
test eax, eax
jne 0x1401cedda
call fcn.140049470
lea rbx, [0x140c484f0]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea rcx, [0x14036ce58]
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x1401ced43
xor ebx, ebx
jmp 0x1401cedc0
xor eax, eax
lea rdx, [0x14036d1e8]
lea rcx, [rsp + 0x48]
lea r8d, [rax + 0x5d]
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x49], rax
mov word [rsp + 0x51], ax
mov byte [rsp + 0x53], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1401ced80
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x48]
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1401cedb0
mov rax, qword [rsi]
lea rdx, [0x14036ce70]
mov r8, rbx
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x1401cee5a
lea rax, [rsp + 0x44]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x70000
mov rcx, rsi
mov dword [rsp + 0x28], 0x18
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [rsp + 0x5c]
mov ecx, reloc.MFC80U.DLL_Ordinal_512
test eax, eax
lea r9, [rsp + 0x40]
mov rdx, r12
cmove edi, ecx
mov rcx, rsi
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rbx
imul ebp, edi
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401cee58
mov eax, dword [rsp + 0x40]
xor edx, edx
div edi
test edx, edx
jne 0x1401cee58
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140161080
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401db3f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rbp, rcx
call sub.MFC80U.DLL_Ordinal_583
nop
lea rax, [0x1403a8938]
mov qword [rbp], rax
lea rcx, [rbp + 0xc0]
call sub.MFC80U.DLL_Ordinal_574
nop
lea rcx, [rbp + reloc.MFC80U.DLL_Ordinal_576]
call sub.MFC80U.DLL_Ordinal_541
nop
lea rcx, [rbp + 0x268]
call sub.MFC80U.DLL_Ordinal_568
nop
lea rcx, [rbp + reloc.MFC80U.DLL_Ordinal_424]
xor edx, edx
lea r8d, [rdx + 0x5c]
call sub.ntdll.dll_memset
mov dword [rbp + 0x204], 1
xor esi, esi
mov dword [rbp + 0x20c], esi
mov qword [rbp + 0x290], rsi
mov qword [rbp + 0x2b0], rsi
mov dword [rbp + reloc.MFC80U.DLL_Ordinal_684], esi
mov dword [rbp + reloc.MFC80U.DLL_Ordinal_672], esi
mov dword [rbp + 0x2a4], esi
mov dword [rbp + 0x208], esi
mov qword [rbp + 0xa8], rsi
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xb8], rsi
or r8, 0xffffffffffffffff
xor edx, edx
lea rcx, [rbp + reloc.MFC80U.DLL_Ordinal_576]
call sub.MFC80U.DLL_Ordinal_6041
or r8, 0xffffffffffffffff
xor edx, edx
lea rcx, [rbp + 0x268]
call sub.MFC80U.DLL_Ordinal_6042
call sub.MFC80U.DLL_Ordinal_1095
mov edx, 0x7f89
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp + 0x290], rax
test rax, rax
jne 0x1401db57d
lea rcx, [rsp + 0x58]
call qword [sym.imp.MFC80U.DLL_Ordinal_296]
nop
mov edx, 0x104
lea rcx, [rsp + 0x58]
call qword [sym.imp.MFC80U.DLL_Ordinal_2491]
mov rcx, rax
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
or edx, 0xffffffff
lea rcx, [rsp + 0x58]
call qword [sym.imp.MFC80U.DLL_Ordinal_5437]
lea rdx, str.winhlp32.exe
lea rcx, [rsp + 0x58]
call qword [sym.imp.MFC80U.DLL_Ordinal_913]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x1401db568
lea edx, [rsi + 0x6a]
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadCursorW]
test rax, rax
je 0x1401db568
mov rcx, rax
call qword [sym.imp.USER32.dll_CopyIcon]
mov qword [rbp + 0x290], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.MFC80U.DLL_Ordinal_588]
cmp qword [str.amp_], 0
je 0x1401db5aa
mov rcx, rsi
lea rdx, str.amp_
lea eax, [rsi + 2]
mov word [rcx + rdx + 8], ax
add esi, 1
movsxd rcx, esi
shl rcx, 4
cmp qword [rcx + rdx], 0
jne 0x1401db591
mov rcx, rbp
call fcn.1401db120
nop
mov rax, rbp
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401ee600
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
cmp dword [0x140c455e8], 0
mov rbp, rcx
je 0x1401ee72e
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r13
xor r13d, r13d
xor r12d, r12d
nop
mov rax, qword [rbp + 0x690]
test rax, rax
jne 0x1401ee640
xor ecx, ecx
jmp 0x1401ee64e
mov rcx, qword [rbp + 0x698]
sub rcx, rax
sar rcx, 3
movsxd rax, r13d
cmp rax, rcx
jae 0x1401ee7d6
mov rcx, qword [rbp + 0x690]
test rcx, rcx
je 0x1401ee679
mov rax, qword [rbp + 0x698]
sub rax, rcx
sar rax, 3
cmp r12, rax
jb 0x1401ee67f
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rbp + 0x690]
xor edi, edi
xor esi, esi
mov rbx, qword [rax + r12*8]
nop
mov rax, qword [rbx + reloc.MFC80U.DLL_Ordinal_424]
test rax, rax
jne 0x1401ee6a0
xor ecx, ecx
jmp 0x1401ee6ae
mov rcx, qword [rbx + 0x1b0]
sub rcx, rax
sar rcx, 3
movsxd rax, edi
cmp rax, rcx
jae 0x1401ee6ff
mov rcx, qword [rbx + reloc.MFC80U.DLL_Ordinal_424]
test rcx, rcx
je 0x1401ee6d5
mov rax, qword [rbx + 0x1b0]
sub rax, rcx
sar rax, 3
cmp rsi, rax
jb 0x1401ee6db
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rbx + reloc.MFC80U.DLL_Ordinal_424]
xor edx, edx
mov rcx, qword [rax + rsi*8]
lea r8d, [rdx + 1]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_InvalidateRect]
add edi, 1
add rsi, 1
jmp 0x1401ee690
mov rcx, qword [rbx + 0x40]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rdx, qword [rbx + 0x198]
mov r8, rbx
mov rcx, rbp
call fcn.1401ed4c0
add r13d, 1
add r12, 1
jmp 0x1401ee630
xor edi, edi
xor esi, esi
mov rax, qword [rbp + reloc.MFC80U.DLL_Ordinal_672]
test rax, rax
jne 0x1401ee742
xor ecx, ecx
jmp 0x1401ee750
mov rcx, qword [rbp + 0x2a8]
sub rcx, rax
sar rcx, 3
movsxd rax, edi
cmp rax, rcx
jae 0x1401ee7a1
mov rcx, qword [rbp + reloc.MFC80U.DLL_Ordinal_672]
test rcx, rcx
je 0x1401ee777
mov rax, qword [rbp + 0x2a8]
sub rax, rcx
sar rax, 3
cmp rsi, rax
jb 0x1401ee77d
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rbp + reloc.MFC80U.DLL_Ordinal_672]
xor edx, edx
mov rcx, qword [rax + rsi*8]
lea r8d, [rdx + 1]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_InvalidateRect]
add edi, 1
add rsi, 1
jmp 0x1401ee732
mov rcx, qword [rbp + 0x138]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rdx, qword [rbp + 0x290]
lea r8, [rbp + 0xf8]
mov rcx, rbp
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.1401ed4c0
mov r12, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401f6610
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_336], rax
mov rbx, rcx
mov rcx, qword [rcx + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rbx + 0xc8]
mov word [rbx + 0xd8], ax
mov rax, qword [rcx]
call qword [rax + 0xf0]
test eax, eax
je 0x1401f66b8
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, Ordinal_280
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], Ordinal_280
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x34], 6
jb 0x1401f66b8
call fcn.140049500
lea rdx, str.0585
mov r8, qword [rax]
mov rcx, rax
call qword [r8]
lea rdx, [rbx + 0x100]
movzx ecx, word [rax]
add rdx, 2
add rax, 2
test cx, cx
mov word [rdx - 2], cx
jne 0x1401f66a2
jmp 0x1401f66d8
mov rcx, qword [rbx + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0x48]
cmp eax, 0xb
ja 0x1401f66d8
lea rcx, [rbx + 0x100]
mov edx, eax
call fcn.1401f4420
mov rcx, qword [rbx + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0x58]
lea rdx, [rbx + reloc.MFC80U.DLL_Ordinal_320]
nop
movzx ecx, word [rax]
add rdx, 2
add rax, 2
test cx, cx
mov word [rdx - 2], cx
jne 0x1401f66f0
mov rcx, qword [rbx + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0x48]
cmp eax, 0xb
ja case.default.0x1401f6729
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x1f6890]
add rcx, rdx
jmp rcx
mov eax, 0x9b6cf2
jmp 0x1401f6759
mov eax, 0xa86d00
jmp 0x1401f6759
mov eax, 0xbb4aaf
jmp 0x1401f6759
mov eax, 0x3f3f3f
jmp 0x1401f6759
mov eax, 0x277a81
jmp 0x1401f6759
mov eax, 0x969696
jmp 0x1401f6759
mov eax, dword [rsp + 0x20]
mov rcx, qword [rbx + 0xc8]
mov dword [rbx + 0x1c0], eax
mov rax, qword [rcx]
call qword [rax + 0x90]
mov rcx, qword [rbx + 0xc8]
xor edi, edi
mov qword [rbx + 0xe0], rax
mov rax, qword [rcx]
call qword [rax + 0xc0]
test eax, eax
jne 0x1401f679c
mov rcx, qword [rbx + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0x70]
mov rdi, rax
mov rcx, qword [rbx + 0xc8]
mov rdx, qword [rcx]
call qword [rdx + 0x88]
mov rcx, qword [rbx + 0xc8]
add rax, rdi
mov qword [rbx + 0xe8], rax
mov rax, qword [rcx]
call qword [rax + 0xc0]
test eax, eax
jne 0x1401f67e3
mov rax, qword [rbx + 0xf8]
cmp qword [rbx + 0xe0], rax
jg 0x1401f67e3
mov qword [rbx + 0x1c8], rax
jmp 0x1401f6827
mov rcx, qword [rbx + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0xc0]
test eax, eax
je 0x1401f6827
mov rcx, qword [rbx + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0xa0]
mov r11d, eax
cmp qword [rbx + 0xe0], r11
jg 0x1401f6827
mov qword [rbx + 0x1c8], 0
mov rcx, qword [rbx + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0xc0]
mov rcx, qword [rbx + 0xc8]
mov dword [rbx + 0xb8], eax
mov rax, qword [rcx]
call qword [rax + 0x70]
mov rcx, qword [rbx + 0x40]
xor edx, edx
lea r8d, [rdx + 1]
mov qword [rbx + 0xc0], rax
call qword [sym.imp.USER32.dll_InvalidateRect]
mov edx, 0x1029
mov rcx, rbx
call fcn.1401f4db0
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_336]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + reloc.MFC80U.DLL_Ordinal_376]
add rsp, 0x160
pop rdi
ret
Function at 0x1401fdcb0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_320], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, Ordinal_277
call sub.ntdll.dll_memset
mov dword [rsp + 0x20], Ordinal_280
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1401fdd93
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1401fdd08
call fcn.1401fc1e0
mov eax, dword [rsp + 0x24]
cmp eax, 4
jne 0x1401fdd2e
mov eax, 5
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_320]
xor rcx, rsp
call fcn.140161080
add rsp, 0x158
ret
cmp eax, 5
jne 0x1401fdd57
cmp dword [rsp + 0x28], 0
jne 0x1401fdd59
mov eax, 6
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_320]
xor rcx, rsp
call fcn.140161080
add rsp, 0x158
ret
jb 0x1401fdd76
mov eax, 7
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_320]
xor rcx, rsp
call fcn.140161080
add rsp, 0x158
ret
mov eax, 1
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_320]
xor rcx, rsp
call fcn.140161080
add rsp, 0x158
ret
cmp al, 4
jae 0x1401fddb1
xor eax, eax
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_320]
xor rcx, rsp
call fcn.140161080
add rsp, 0x158
ret
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1401fddc5
call fcn.1401fc1e0
cmp dword [rsp + 0x24], 4
jne 0x1401fddfc
mov eax, dword [rsp + 0x28]
cmp eax, 0xa
jne 0x1401fddf2
mov eax, 3
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_320]
xor rcx, rsp
call fcn.140161080
add rsp, 0x158
ret
cmp eax, 0x5a
mov eax, 4
je 0x1401fde01
mov eax, 2
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_320]
xor rcx, rsp
call fcn.140161080
add rsp, 0x158
ret
Function at 0x1401fe580
Capabilities:
Capture screenshot

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x90
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov r12, rdx
xor ebx, ebx
mov qword [rax + 0x20], rbx
lea r8, [rax + 0x20]
lea rcx, [0x140c45c38]
call sub.MFC80U.DLL_Ordinal_4092
mov rdi, rbx
test eax, eax
cmovne rdi, qword [rsp + 0xc8]
cmp qword [rdi + 0x28], rbx
jne 0x1401fe6f2
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowDC]
mov rbp, rax
mov rcx, rax
call sub.MFC80U.DLL_Ordinal_2392
mov rsi, rax
lea rcx, [rsp + 0x68]
call sub.MFC80U.DLL_Ordinal_355
nop
test rsi, rsi
jne 0x1401fe5fb
mov rcx, rbx
jmp 0x1401fe5ff
mov rcx, qword [rsi + 8]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rdx, rax
lea rcx, [rsp + 0x68]
call sub.MFC80U.DLL_Ordinal_1288
lea rdx, [rsp + 0x58]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r8d, dword [rsp + 0x64]
sub r8d, dword [rsp + 0x5c]
add r8d, 0xa
mov edx, dword [rsp + 0x60]
sub edx, dword [rsp + 0x58]
add edx, 0xa
lea r12, [rdi + 0x20]
mov rcx, qword [rsi + 8]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov rcx, r12
call sub.MFC80U.DLL_Ordinal_1289
test r12, r12
jne 0x1401fe65c
mov rdx, rbx
jmp 0x1401fe661
mov rdx, qword [r12 + 8]
mov rcx, qword [rsp + 0x70]
call sub.MFC80U.DLL_Ordinal_5672
mov r12, rax
mov edx, dword [rdi + 0xc]
mov r8d, dword [rdi + 8]
mov r10d, dword [rsp + 0x64]
sub r10d, dword [rsp + 0x5c]
add r10d, 0xa
mov r9d, dword [rsp + 0x60]
sub r9d, dword [rsp + 0x58]
add r9d, 0xa
mov rcx, qword [rsi + 8]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r10d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.GDI32.dll_BitBlt]
test r12, r12
je 0x1401fe6ca
mov rbx, qword [r12 + 8]
mov rdx, rbx
mov rcx, qword [rsp + 0x70]
call sub.MFC80U.DLL_Ordinal_5672
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop
lea rcx, [rsp + 0x68]
call sub.MFC80U.DLL_Ordinal_614
mov rax, rdi
jmp 0x1401fe6f5
mov rax, rdi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140222740
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x6c0
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov ecx, Ordinal_588
call sub.MFC80U.DLL_Ordinal_774
test rax, rax
je 0x14022277b
mov rcx, rax
call fcn.140024aa0
mov rbx, rax
jmp 0x14022277d
xor ebx, ebx
mov ecx, 0x18
call sub.MFC80U.DLL_Ordinal_774
test rax, rax
mov rdi, rax
je 0x1402227a3
lea rax, fcn.140001470
mov qword [rdi + 8], 0
mov qword [rdi], rax
jmp 0x1402227a5
xor edi, edi
lea rcx, [rsp + 0x2b2]
xor edx, edx
mov r8d, reloc.MFC80U.DLL_Ordinal_1022
mov word [rsp + 0x2b0], 0
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x2b0]
mov r8d, reloc.MFC80U.DLL_Ordinal_512
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0xb2]
xor edx, edx
mov r8d, 0xfe
mov word [rsp + 0xb0], 0
call sub.ntdll.dll_memset
movzx r11d, word [rsp + 0x2b0]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x1b0]
mov r8d, 0x80
mov word [rsp + 0x1b0], r11w
mov word [rsp + 0x1b2], 0x3a
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov r11, qword [rdi]
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call qword [r11 + 8]
test al, al
jne 0x14022285f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11]
xor eax, eax
jmp 0x14022298c
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x58]
call sub.ntdll.dll_memset
mov r11, qword [rdi]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [r11 + 0x58]
test al, al
jne 0x1402228a4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11]
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11 + 0x68]
xor eax, eax
jmp 0x14022298c
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x68]
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11]
mov ecx, dword [rsp + 0x50]
xor eax, eax
test ecx, ecx
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov qword [rsp + 0x39], rax
mov qword [rsp + 0x41], rax
je 0x140222905
cmp ecx, 1
jne 0x140222847
mov rax, qword [rsp + 0x58]
mov byte [rsp + 0x30], cl
lea rcx, [rsp + 0x74]
mov qword [rsp + 0x31], rax
mov rax, qword [rcx]
lea rdx, [rsp + 0x39]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
jmp 0x14022291b
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x31], rax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x39], eax
mov rax, qword [rbx]
lea r8, [0x140372c20]
mov r9b, 1
mov rdx, 0xffffffff80000002
mov rcx, rbx
mov byte [rsp + 0x20], 0
call qword [rax + 8]
mov rcx, rbx
test al, al
mov rax, qword [rbx]
jne 0x14022294a
call qword [rax]
xor eax, eax
jmp 0x14022298c
lea r8, [rsp + 0x30]
lea rdx, str.SetupData
mov r9d, 0x19
call qword [rax + 0x78]
mov dl, 1
mov rcx, rbx
test al, al
mov rax, qword [rbx]
jne 0x14022297b
call qword [rax + 0x10]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11]
xor eax, eax
jmp 0x14022298c
call qword [rax + 0x10]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11]
mov eax, 1
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + 0x6d0]
add rsp, 0x6c0
pop rdi
ret
Function at 0x140222ae0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push rdi
sub rsp, 0x4f0
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
lea rcx, [rsp + 0xe2]
xor edx, edx
mov r8d, reloc.MFC80U.DLL_Ordinal_1022
mov word [rsp + 0xe0], 0
call sub.ntdll.dll_memset
lea rcx, [rsp + 0xe0]
mov edx, reloc.MFC80U.DLL_Ordinal_512
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xe0]
xor edx, edx
repne scasw ax, word [rdi]
mov rax, qword [str.wpeutil.exe_reboot]
lea r8d, [rdx + 0x68]
mov qword [rdi - 2], rax
mov rax, qword [0x1403724f0]
lea rcx, [rsp + 0x70]
mov qword [rdi + 6], rax
mov rax, qword [0x1403724f8]
mov qword [rdi + 0xe], rax
mov rax, qword [0x140372500]
mov qword [rdi + 0x16], rax
mov rax, qword [0x140372508]
mov qword [rdi + 0x1e], rax
call sub.ntdll.dll_memset
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x40], rax
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], 1
mov word [rsp + 0xb0], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140222bfc
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140222c11
call fcn.140049470
lea rdx, str._s_wpeutile.exe_reboot_fail
mov rdi, qword [rax]
mov rcx, rax
call qword [rdi + 0x10]
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.140161080
add rsp, 0x4f0
pop rdi
ret