joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10000eac0
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x60
mov rbx, rcx
lea rdx, [0x100006de0]
lea rcx, [rax - 0x58]
mov r9d, 1
mov r8d, 0xa19
call fcn.10001ed8c
and dword [rsp + 0x80], 0
mov eax, 0xa21
test rbx, rbx
jne 0x10000eb1c
mov edi, 0x80070057
mov dword [rsp + 0x20], edi
mov word [rsp + 0x26], ax
jmp 0x10000ed01
and dword [rsp + 0x20], 0
and dword [rbx], 0
mov word [rsp + 0x24], ax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
test rax, rax
jne 0x10000eb49
call fcn.100020b84
mov edi, eax
mov dword [rsp + 0x20], eax
mov eax, 0xa27
jmp 0x10000eb12
and dword [rsp + 0x20], 0
mov eax, 0xa27
lea rdx, [rsp + 0x80]
mov word [rsp + 0x24], ax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbp, rax
test rax, rax
jne 0x10000eb88
call fcn.100020b84
mov ecx, 0xa2a
mov edi, eax
mov dword [rsp + 0x20], eax
mov word [rsp + 0x26], cx
jmp 0x10000ecef
xor edi, edi
cmp dword [rsp + 0x80], 1
mov ecx, 0xa2a
mov dword [rsp + 0x20], edi
mov word [rsp + 0x24], cx
jne 0x10000ebb5
lea eax, [rcx + 5]
mov dword [rbx], 1
mov word [rsp + 0x24], ax
jmp 0x10000eceb
mov r12d, 1
cmp dword [rsp + 0x80], r12d
jle 0x10000ecd0
lea rsi, [rax + 8]
mov r15d, 0xa39
mov rdi, qword [rsi]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
cmp ecx, 9
jbe 0x10000ec34
mov rcx, qword [rsi]
lea r8d, [rax + 9]
lea rdx, [0x100006110]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x10000ec34
mov rdx, qword [rsi]
lea rcx, [rbx + 8]
mov dword [rbx], 2
add rdx, 0x12
call fcn.100020638
mov edi, eax
mov dword [rsp + 0x20], eax
test eax, eax
js 0x10000ed27
mov word [rsp + 0x24], r15w
jmp 0x10000ecbb
mov rcx, qword [rsi]
lea rdx, [0x100006128]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x10000ec50
mov dword [rbx], 3
jmp 0x10000ec6a
mov rcx, qword [rsi]
lea rdx, [0x100006140]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x10000ec70
mov dword [rbx], 4
mov edi, dword [rsp + 0x20]
jmp 0x10000ecbb
cmp edi, 0xb
jbe 0x10000ed36
mov rcx, qword [rsi]
lea rdx, [0x100006160]
mov r8d, 0xb
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x10000ed36
mov rdx, qword [rsi]
lea rcx, [rbx + 0x10]
add rdx, 0x16
call fcn.100020638
mov edi, eax
mov dword [rsp + 0x20], eax
test eax, eax
mov eax, 0xa45
js 0x10000ed2f
mov word [rsp + 0x24], ax
inc r12d
add rsi, 8
cmp r12d, dword [rsp + 0x80]
jl 0x10000ebd3
cmp dword [rbx], 2
jne 0x10000ecef
cmp qword [rbx + 8], 0
jne 0x10000ecef
mov eax, 0xa51
mov word [rsp + 0x26], ax
mov edi, 0x80070057
mov dword [rsp + 0x20], edi
test rbp, rbp
je 0x10000ed01
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, dword [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.10001eea4
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r12
pop rdi
ret
mov word [rsp + 0x26], r15w
jmp 0x10000ecef
mov word [rsp + 0x26], ax
jmp 0x10000ecef
mov eax, 0xa49
jmp 0x10000ece1
Function at 0x10000fb50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x70
mov r12, rdx
mov r13, rcx
mov rbp, r8
mov esi, 1
lea rdx, [0x100006e68]
lea rcx, [rsp + 0x30]
mov r9d, esi
mov r8d, 0xbb5
call fcn.10001ed8c
and dword [rsp + 0xa0], 0
mov eax, 0xbbb
test r13, r13
jne 0x10000fbb3
mov ebx, 0x80070057
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x36], ax
jmp 0x10000fd51
mov word [rsp + 0x34], ax
mov eax, 0xbbc
test r12, r12
je 0x10000fba0
mov word [rsp + 0x34], ax
mov eax, 0xbbd
test rbp, rbp
je 0x10000fba0
and dword [rsp + 0x30], 0
mov ebx, 0x20
mov word [rsp + 0x34], ax
mov rcx, rbx
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rdi, rax
test rax, rax
jne 0x10000fbfc
mov ebx, 0x8007000e
mov eax, 0xbc2
jmp 0x10000fba5
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.10002a670
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r15d, 0x80070000
mov qword [rdi], rax
test rax, rax
jne 0x10000fc4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
mov eax, 0xbce
mov dword [rsp + 0x30], ebx
test ebx, ebx
js 0x10000fba9
mov word [rsp + 0x34], ax
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 8], rax
test rax, rax
jne 0x10000fc8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
mov eax, 0xbd8
mov dword [rsp + 0x30], ebx
test ebx, ebx
js 0x10000fba9
mov word [rsp + 0x34], ax
lea rax, [rsp + 0xa0]
lea r8, [0x10000f978]
mov r9, rdi
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x10000fce3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
mov eax, 0xbde
mov dword [rsp + 0x30], ebx
test ebx, ebx
js 0x10000fba9
mov word [rsp + 0x34], ax
mov eax, dword [rsp + 0xa0]
mov rcx, qword [rdi]
or edx, 0xffffffff
mov qword [r12], rsi
mov qword [r13], rdi
mov dword [rbp], eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10000fd2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
mov eax, 0xbe8
mov dword [rsp + 0x30], ebx
test ebx, ebx
js 0x10000fba9
mov word [rsp + 0x34], ax
jmp 0x10000fd32
mov ebx, dword [rsp + 0x30]
cmp dword [rdi + 0x1c], 0
jge 0x10000fd51
mov ebx, dword [rdi + 0x1c]
mov eax, 0xbee
mov dword [rsp + 0x30], ebx
test ebx, ebx
js 0x10000fba9
mov word [rsp + 0x34], ax
lea rcx, [rsp + 0x30]
call fcn.10001eea4
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x100018414
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov rdi, rdx
mov r12, rcx
mov rsi, r9
mov rbp, r8
lea rdx, [0x100007aa0]
lea rcx, [rsp + 0x20]
mov r9d, 1
mov r8d, 0xf4a
call fcn.10001ed8c
and qword [rsp + 0x90], 0
and dword [rsp + 0x88], 0
test rbp, rbp
je 0x10001846c
mov dword [rbp], 0
test rsi, rsi
je 0x100018477
mov dword [rsi], 0
mov eax, 0xf53
test rdi, rdi
jne 0x100018494
mov ebx, 0x80070057
mov dword [rsp + 0x20], ebx
mov word [rsp + 0x26], ax
jmp 0x100018648
mov word [rsp + 0x24], ax
mov eax, 0xf54
test rbp, rbp
je 0x100018481
mov word [rsp + 0x24], ax
mov eax, 0xf55
test rsi, rsi
je 0x100018481
and dword [rsp + 0x20], 0
mov edx, 0x3ec
mov rcx, r12
mov word [rsp + 0x24], ax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
test rax, rax
jne 0x1000184e4
call fcn.100020b84
mov ebx, eax
mov dword [rsp + 0x20], eax
mov eax, 0xf58
jmp 0x10001848a
and dword [rsp + 0x20], 0
mov eax, 0xf58
lea rdx, [rsp + 0x90]
mov word [rsp + 0x24], ax
call fcn.1000167c8
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
mov eax, 0xf5a
js 0x10001848a
mov rdx, qword [rsp + 0x90]
mov word [rsp + 0x24], ax
test rdx, rdx
jne 0x10001855c
and qword [rdi + 0xd8], rdx
or r8, 0xffffffffffffffff
mov rcx, r12
call fcn.1000103c0
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
jns 0x10001854c
mov eax, 0xf5f
jmp 0x10001848a
xor ebx, ebx
mov eax, 0xf60
mov dword [rsp + 0x20], ebx
jmp 0x100018643
mov qword [rdi + 0xd8], rdx
cmp dword [rdx + 0x4c], 2
jne 0x1000185ac
lea r8, [rsp + 0x88]
mov r9, rsi
mov rdx, rdi
mov rcx, r12
call fcn.1000180cc
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
mov eax, 0xf67
js 0x10001848a
cmp dword [rsi], 0
mov word [rsp + 0x24], ax
je 0x1000185db
xor ebx, ebx
mov eax, 0xf6b
mov dword [rsp + 0x20], ebx
jmp 0x100018643
lea r9, [rsp + 0x88]
add rdx, 0x30
xor r8d, r8d
mov rcx, rdi
call fcn.1000143d8
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
mov eax, 0xf70
js 0x10001848a
mov word [rsp + 0x24], ax
test dword [rsp + 0x88], 0x3fc
mov eax, 0
mov ecx, 0x11
setne al
mov dword [rdi + 0x108], eax
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x100018613
mov dword [rdi + 0x108], 1
xor edx, edx
mov rcx, r12
cmp dword [rdi + 0x108], edx
je 0x100018669
lea r8d, [rdx + 0x7a]
call fcn.1000103c0
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
mov eax, 0xf7c
js 0x10001848a
mov dword [rbp], 1
mov word [rsp + 0x24], ax
lea rcx, [rsp + 0x20]
call fcn.10001eea4
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
mov r8d, 0x67
call fcn.1000103c0
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
mov eax, 0xf81
jmp 0x100018636
Function at 0x10001aa2c
Capabilities:
Hide graphical window

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x70
mov rbx, rdx
mov rdi, rcx
mov r12d, 1
lea rdx, [0x100007c50]
lea rcx, [rax - 0x48]
mov r8d, 0x1380
mov r9d, r12d
call fcn.10001ed8c
and qword [rsp + 0x28], 0
and qword [rsp + 0x88], 0
lea r11, [0x100005e20]
xor esi, esi
mov eax, 0x1389
mov qword [rsp + 0x20], r11
test rbx, rbx
jne 0x10001aaa0
mov ebx, 0x80070057
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x36], ax
jmp 0x10001ac38
mov word [rsp + 0x34], ax
cmp qword [rbx + 0xf8], rsi
jne 0x10001aaba
mov ebx, 0x81000203
mov eax, 0x138c
jmp 0x10001aa92
and dword [rsp + 0x30], esi
mov eax, 0x138e
lea rcx, [rsp + 0x88]
mov word [rsp + 0x34], ax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r11, qword [rbx + 0xd8]
mov rax, qword [rsp + 0x88]
cmp rax, qword [r11 + 0x40]
jb 0x10001ab00
sub rax, qword [r11 + 0x40]
movabs rcx, 0x2f25f0c90000
cmp rax, rcx
cmova esi, r12d
cmp dword [rbx + 0x28], 0
je 0x10001ab48
mov edx, 0x446
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
test rax, rax
jne 0x10001ab31
call fcn.100020b84
mov ebx, eax
mov dword [rsp + 0x30], eax
mov eax, 0x139b
jmp 0x10001aa96
and dword [rsp + 0x30], 0
mov eax, 0x139b
xor edx, edx
mov word [rsp + 0x34], ax
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x405
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
test rax, rax
jne 0x10001ab73
call fcn.100020b84
mov ebx, eax
mov dword [rsp + 0x30], eax
mov eax, 0x13a0
jmp 0x10001aa96
and dword [rsp + 0x30], 0
neg esi
mov eax, 0x13a0
sbb esi, esi
mov word [rsp + 0x34], ax
and esi, 5
mov edx, esi
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x8f
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
test rax, rax
jne 0x10001abbc
call fcn.100020b84
mov ebx, eax
mov dword [rsp + 0x30], eax
mov eax, 0x13a4
jmp 0x10001aa96
and dword [rsp + 0x30], 0
mov eax, 0x13a4
mov edx, esi
mov word [rsp + 0x34], ax
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x404
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
test rax, rax
jne 0x10001abfe
call fcn.100020b84
mov ebx, eax
mov dword [rsp + 0x30], eax
mov eax, 0x13a8
jmp 0x10001aa96
and dword [rsp + 0x30], 0
mov eax, 0x13a8
mov edx, esi
mov word [rsp + 0x34], ax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, rbx
mov rcx, rdi
call fcn.10001a98c
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
mov eax, 0x13ab
js 0x10001aa96
mov word [rsp + 0x34], ax
lea rcx, [rsp + 0x20]
call fcn.100027da0
lea rcx, [rsp + 0x30]
call fcn.10001eea4
lea r11, [rsp + 0x70]
cmp bh, byte es:[rbx + rdi]
cmp byte [0xcd5f7dc3], ch
bnd call 0x16e2f9246
stosd dword [rdi], eax
sub eax, 0x722dd66e
cli
invalid
Function at 0x100020ffc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov r9d, 2
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea rdx, [0x1000080a8]
lea r8d, [r9 + 0x1f]
lea rcx, [rsp + 0x38]
call fcn.10001ed8c
and dword [rsp + 0x30], 0
and dword [rsp + 0x90], 0
and dword [rsp + 0x88], 0
test rdi, rdi
je 0x10002104f
mov dword [rdi], 0
mov eax, 0x2a
test rbx, rbx
jne 0x100021068
mov ebx, 0x80070057
mov word [rsp + 0x3e], ax
jmp 0x100021130
mov word [rsp + 0x3c], ax
mov eax, 0x2b
test rdi, rdi
je 0x100021059
and dword [rsp + 0x38], 0
mov word [rsp + 0x3c], ax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x90]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x88], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x34
mov dword [rsp + 0x38], ebx
test ebx, ebx
jns 0x1000210e4
mov word [rsp + 0x3e], ax
mov dword [rsp + 0x40], 1
jmp 0x100021134
cmp dword [rsp + 0x90], 4
mov word [rsp + 0x3c], ax
mov eax, 0x36
je 0x100021102
mov ebx, 0x8007065d
jmp 0x10002105e
cmp dword [rsp + 0x88], 4
mov word [rsp + 0x3c], ax
je 0x100021120
mov ebx, 0x80004005
mov eax, 0x37
jmp 0x10002105e
mov eax, dword [rsp + 0x30]
xor ebx, ebx
mov dword [rdi], eax
lea eax, [rbx + 0x3b]
mov word [rsp + 0x3c], ax
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x38]
call fcn.10001eea4
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x100021158
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rbp, rdx
mov rsi, rcx
mov rdi, r8
lea rdx, [0x1000080b8]
lea rcx, [rsp + 0x30]
mov r9d, 2
mov r8d, 0x9c
call fcn.10001ed8c
and dword [rsp + 0xb0], 0
mov dword [rsp + 0xb8], 1
mov eax, 0xa3
test rdi, rdi
jne 0x1000211be
mov ebx, 0x80070057
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x36], ax
jmp 0x100021372
mov word [rsp + 0x34], ax
mov eax, 0xa4
test rsi, rsi
je 0x1000211ab
and dword [rsp + 0x30], 0
mov edx, 0x20
mov rcx, rdi
mov word [rsp + 0x34], ax
call fcn.100027ff8
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
mov eax, 0xa9
js 0x1000211b4
mov word [rsp + 0x34], ax
mov eax, dword [rdi + 0xc]
lea rcx, [rsp + 0xb0]
lea eax, [rax + rax - 2]
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0xb8]
mov dword [rsp + 0xb0], eax
mov rax, qword [rdi]
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rdi + 0xc]
mov rcx, rdi
mov r11d, eax
call fcn.1000280b0
test r11d, r11d
je 0x1000212e2
mov r15d, 0xbf
lea r14d, [r15 + 7]
cmp r11d, 0xea
jne 0x10002130d
mov edx, dword [rsp + 0xb0]
and dword [rsp + 0x30], 0
mov rcx, rdi
add rdx, 3
mov word [rsp + 0x34], r15w
shr rdx, 1
call fcn.100027ff8
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x100021305
mov eax, dword [rdi + 0xc]
lea rcx, [rsp + 0xb0]
lea r9, [rsp + 0xb8]
lea eax, [rax + rax - 2]
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov dword [rsp + 0xb0], eax
mov rax, qword [rdi]
mov rdx, rbp
mov rcx, rsi
mov word [rsp + 0x34], r14w
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rdi + 0xc]
mov rcx, rdi
mov r11d, eax
call fcn.1000280b0
test r11d, r11d
jne 0x100021253
cmp dword [rsp + 0xb8], 1
je 0x100021332
cmp dword [rsp + 0xb8], 2
je 0x100021332
mov ebx, 0x8000ffff
mov eax, 0xc9
jmp 0x1000211b0
mov word [rsp + 0x36], r14w
jmp 0x100021372
movzx ebx, r11w
mov word [rsp + 0x36], r15w
mov dword [rsp + 0x38], 1
or ebx, 0x80070000
test r11d, r11d
cmovle ebx, r11d
mov dword [rsp + 0x30], ebx
jmp 0x100021372
mov edx, dword [rsp + 0xb0]
mov eax, 0xc9
mov word [rsp + 0x34], ax
mov al, dl
not al
test al, 1
mov eax, 0xd5
jne 0x10002135a
mov ebx, 0x8000ffff
jmp 0x1000211b0
and dword [rsp + 0x30], 0
shr edx, 1
mov rcx, rdi
mov word [rsp + 0x34], ax
call fcn.1000280b0
mov ebx, dword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.10001eea4
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x100022590
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x6a0
mov rax, qword [0x10002e110]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov rbx, rcx
mov rcx, qword [0x10002e120]
lea rax, [0x10002e120]
cmp rcx, rax
je 0x1000225e9
bt dword [rcx + 0x1c], 0x1d
jae 0x1000225e9
mov rcx, qword [rcx + 0x10]
lea r8, [0x100005ed8]
mov edx, 0x18
mov r9, rbx
call fcn.10001f2b0
lea rdx, [0x100008248]
lea rcx, [rsp + 0x20]
mov r9d, 1
mov r8d, 0x327
call fcn.10001ed8c
mov edi, 0x208
lea rcx, [rsp + 0x62]
xor esi, esi
mov r8, rdi
xor edx, edx
mov word [rsp + 0x60], si
call fcn.10002a670
lea rcx, [rsp + 0x482]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x480], si
call fcn.10002a670
lea rcx, [rsp + 0x272]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x270], si
call fcn.10002a670
mov eax, 0x32e
cmp rbx, rsi
jne 0x100022672
mov ebx, 0x80070057
mov dword [rsp + 0x20], ebx
mov word [rsp + 0x26], ax
jmp 0x10002275c
mov edi, 0x105
lea rdx, [rsp + 0x270]
mov rcx, rbx
mov r8d, edi
mov dword [rsp + 0x20], esi
mov word [rsp + 0x24], ax
call fcn.100022258
mov ebx, eax
mov dword [rsp + 0x20], eax
cmp eax, esi
mov eax, 0x333
jl 0x100022668
lea rdx, [rsp + 0x60]
lea rcx, [0x100008258]
mov r8d, edi
mov word [rsp + 0x24], ax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r11d, eax
cmp eax, esi
jne 0x1000226d5
call fcn.100020b84
mov ebx, eax
mov dword [rsp + 0x20], eax
mov eax, 0x33c
jmp 0x100022668
mov eax, 0x33c
mov word [rsp + 0x24], ax
mov eax, 0x33d
cmp r11d, edi
jbe 0x1000226f3
mov ebx, 0x8007007a
jmp 0x100022664
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x60]
mov r8d, edi
mov dword [rsp + 0x20], esi
mov word [rsp + 0x24], ax
call fcn.100022258
mov ebx, eax
mov dword [rsp + 0x20], eax
cmp eax, esi
mov eax, 0x33f
jl 0x100022668
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x480]
mov word [rsp + 0x24], ax
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, esi
je 0x100022758
mov ebx, 1
mov eax, 0x343
mov dword [rsp + 0x20], ebx
mov word [rsp + 0x24], ax
jmp 0x10002275c
mov ebx, dword [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.10001eea4
mov eax, ebx
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.10002a0b0
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100022794
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x10002e110]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov rcx, qword [0x10002e120]
lea rax, [0x10002e120]
cmp rcx, rax
je 0x1000227e5
bt dword [rcx + 0x1c], 0x1d
jae 0x1000227e5
mov rcx, qword [rcx + 0x10]
lea r8, [0x100005ed8]
mov edx, 0x19
call fcn.10001031c
lea rdx, [0x100008278]
lea rcx, [rsp + 0x20]
mov r9d, 1
mov r8d, 0x351
call fcn.10001ed8c
lea rcx, [rsp + 0x62]
xor edi, edi
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x60], di
call fcn.10002a670
cmp rbx, rdi
je 0x1000228c2
cmp dword [rbx + 8], edi
je 0x100022832
mov rax, qword [rbx]
mov dword [rbx + 8], edi
mov word [rax], di
mov eax, 0x357
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov dword [rsp + 0x20], edi
mov word [rsp + 0x24], ax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov r11d, eax
cmp eax, edi
jne 0x100022869
call fcn.100020b84
mov ebx, eax
mov dword [rsp + 0x20], eax
mov eax, 0x360
jmp 0x1000228d0
mov eax, 0x360
mov word [rsp + 0x24], ax
mov eax, 0x361
cmp r11d, 0x105
jb 0x100022888
mov ebx, 0x8007007a
jmp 0x1000228cc
mov dword [rsp + 0x20], edi
mov word [rsp + 0x24], ax
cmp dword [rbx + 8], edi
je 0x10002289f
mov rax, qword [rbx]
mov dword [rbx + 8], edi
mov word [rax], di
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.10002897c
mov ebx, eax
mov dword [rsp + 0x20], eax
cmp eax, edi
mov eax, 0x363
jl 0x1000228d0
mov word [rsp + 0x24], ax
jmp 0x1000228d5
mov ebx, 0x80070057
mov eax, 0x357
mov dword [rsp + 0x20], ebx
mov word [rsp + 0x26], ax
lea rcx, [rsp + 0x20]
call fcn.10001eea4
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10002a0b0
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret
Function at 0x100022908
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x10002e110]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov ebx, edx
mov rdi, rcx
mov rcx, qword [0x10002e120]
lea rax, [0x10002e120]
cmp rcx, rax
je 0x100022967
bt dword [rcx + 0x1c], 0x1d
jae 0x100022967
mov rcx, qword [rcx + 0x10]
lea r8, [0x100005ed8]
mov edx, 0x1a
mov r9, rdi
mov dword [rsp + 0x20], ebx
call fcn.100021d0c
lea rdx, [0x100008290]
lea rcx, [rsp + 0x30]
mov r9d, 1
mov r8d, 0x371
call fcn.10001ed8c
lea rcx, [rsp + 0x72]
xor esi, esi
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x70], si
call fcn.10002a670
mov eax, 0x376
cmp rdi, rsi
jne 0x1000229ba
mov ebx, 0x80070057
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x36], ax
jmp 0x100022a55
mov word [rsp + 0x34], ax
mov eax, 0x377
cmp ebx, esi
jbe 0x1000229a7
lea rdx, [rsp + 0x70]
lea rcx, [0x100008258]
mov r8d, 0x105
mov dword [rsp + 0x30], esi
mov word [rsp + 0x34], ax
mov word [rdi], si
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r11d, eax
cmp eax, esi
jne 0x100022a05
call fcn.100020b84
mov ebx, eax
mov dword [rsp + 0x30], eax
mov eax, 0x382
jmp 0x1000229b0
mov eax, 0x382
mov word [rsp + 0x34], ax
mov eax, 0x383
cmp r11d, 0x105
jbe 0x100022a24
mov ebx, 0x8007007a
jmp 0x1000229ac
lea rcx, [rsp + 0x70]
mov r8d, ebx
mov rdx, rdi
mov dword [rsp + 0x30], esi
mov word [rsp + 0x34], ax
call fcn.100022258
mov ebx, eax
mov dword [rsp + 0x30], eax
cmp eax, esi
mov eax, 0x385
jl 0x1000229b0
mov word [rsp + 0x34], ax
lea rcx, [rsp + 0x30]
call fcn.10001eea4
mov eax, ebx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.10002a0b0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1000231fc
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x10002e110]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
mov rcx, qword [0x10002e120]
lea rax, [0x10002e120]
cmp rcx, rax
je 0x100023252
bt dword [rcx + 0x1c], 0x1d
jae 0x100023252
mov rcx, qword [rcx + 0x10]
lea r8, [0x100005ed8]
mov edx, 0x35
call fcn.10001031c
mov ebx, 1
lea rdx, [0x100008330]
lea rcx, [rsp + 0x40]
mov r9d, ebx
mov r8d, 0x621
call fcn.10001ed8c
lea rcx, [rsp + 0x82]
xor esi, esi
xor edx, edx
mov r8d, 0xc6
mov word [rsp + 0x80], si
call fcn.10002a670
mov eax, 0x625
cmp rdi, rsi
jne 0x1000232a9
mov ebx, 0x80070057
mov word [rsp + 0x46], ax
jmp 0x10002332e
mov rcx, rdi
mov dword [rsp + 0x40], esi
mov word [rsp + 0x44], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x1000232c7
mov eax, 0x62e
jmp 0x100023329
mov dword [rsp + 0x38], 0x64
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp eax, esi
jne 0x100023302
mov eax, 0x633
jmp 0x100023329
lea rdx, [0x100008050]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, esi
jne 0x100023322
mov eax, 0x638
jmp 0x100023329
mov ebx, esi
mov eax, 0x63b
mov word [rsp + 0x44], ax
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
call fcn.10001eea4
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.10002a0b0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret