joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009700c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x140097038
lea r8, str.wcsPath
mov edx, 0x817
lea rcx, str.base_stor_blbutil_fileutils.cpp
call fcn.14008f4c8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x1400970d1
xor r9d, r9d
xor r8d, r8d
mov dl, dil
mov rcx, rbx
call fcn.14009454c
test eax, eax
js 0x1400970d3
mov edx, 0x2000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop dword [rax + rax]
test eax, eax
jne 0x1400970d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x1400970c2
test byte [rcx + 0x1c], 2
je 0x1400970c2
cmp byte [rcx + 0x19], 2
jb 0x1400970c2
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161978]
mov edx, 0x40
mov r9d, ebx
call fcn.140004e7c
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1400970d3
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400976f4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r14, rdx
mov rsi, rcx
mov rcx, qword [0x140183048]
lea r13, [0x140183048]
lea r12, [0x140161d98]
cmp rcx, r13
je 0x14009774e
test byte [rcx + 0x1c], 1
je 0x14009774e
cmp byte [rcx + 0x19], 4
jb 0x14009774e
mov rcx, qword [rcx + 0x10]
mov edx, 0xa
mov r8, r12
call fcn.140004e50
xor ebx, ebx
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov edi, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov ebp, eax
test eax, eax
jne 0x1400977c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov ebx, eax
mov rcx, qword [0x140183048]
cmp rcx, r13
je 0x14009787b
test byte [rcx + 0x1c], 1
je 0x14009787b
cmp byte [rcx + 0x19], 2
jb 0x14009787b
lea edx, [rdi + 0xb]
mov rcx, qword [rcx + 0x10]
mov r9, rsi
mov r8, r12
mov dword [rsp + 0x20], eax
call fcn.140005f80
jmp 0x14009787b
mov rcx, rbp
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x1400977ec
mov ebx, 0x8007000e
jmp 0x14009787b
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
jne 0x140097844
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov ebx, eax
mov rcx, qword [0x140183048]
cmp rcx, r13
je 0x14009787b
test byte [rcx + 0x1c], 1
je 0x14009787b
cmp byte [rcx + 0x19], 2
jb 0x14009787b
mov edx, 0xc
jmp 0x1400977b0
mov rcx, qword [0x140183048]
cmp rcx, r13
je 0x140097875
test byte [rcx + 0x1c], 1
je 0x140097875
cmp byte [rcx + 0x19], 4
jb 0x140097875
mov rcx, qword [rcx + 0x10]
mov edx, 0xd
mov r9, rsi
mov qword [rsp + 0x20], rdi
mov r8, r12
call fcn.140006004
mov qword [r14], rdi
mov rdi, rbx
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x140183048]
cmp rcx, r13
je 0x1400978b3
test byte [rcx + 0x1c], 1
je 0x1400978b3
cmp byte [rcx + 0x19], 4
jb 0x1400978b3
mov rcx, qword [rcx + 0x10]
mov edx, 0xe
mov r8, r12
call fcn.140004e50
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x1400978dc
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and dword [rax + 0x10], 0
lea r8, [rax + 0x10]
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
je 0x140097924
lea r8, str._fRet
mov edx, 0x78
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.14008f4c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x800700ea
jne 0x1400979d7
mov ecx, dword [rsp + 0x38]
xor ebx, ebx
inc ecx
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140097970
mov ebx, 0x8007000e
jmp 0x1400979d7
mov r8d, dword [rsp + 0x38]
xor edx, edx
inc r8d
mov rcx, rdi
add r8, r8
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x38]
mov rdx, rdi
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400979be
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400979c3
mov qword [rsi], rdi
xor edi, edi
test rdi, rdi
je 0x1400979d7
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140097ff4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, r9
mov r14, r8
mov rsi, rdx
mov r12, rcx
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x14009804a
test byte [rcx + 0x1c], 1
je 0x14009804a
cmp byte [rcx + 0x19], 4
jb 0x14009804a
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x18
call fcn.140004e50
mov r15, qword [rsp + 0x90]
xor ebx, ebx
and dword [rsp + 0x30], ebx
and dword [rsp + 0x80], ebx
test r14, r14
je 0x140098073
test rsi, rsi
je 0x140098073
test rbp, rbp
je 0x140098073
test r15, r15
jne 0x14009808b
lea r8, str.ppbValue___NULL__wszValueName___NULL__lpType___NULL__lpSize___NULL
mov edx, 0x1c0
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.14008f4c8
and qword [r14], rbx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
xor r9d, r9d
and qword [rsp + 0x20], rbx
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140098116
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x140183048]
lea rbp, [0x140183048]
cmp rcx, rbp
je 0x140098259
test byte [rcx + 0x1c], 1
je 0x140098233
cmp byte [rcx + 0x19], 3
jb 0x140098233
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x19
mov dword [rsp + 0x20], ebx
mov r9, rsi
call fcn.140005f80
jmp 0x14009822c
mov eax, dword [rsp + 0x80]
test eax, eax
jne 0x140098140
lea r8, str.cbSize___0
mov edx, 0x1ce
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.14008f4c8
mov eax, dword [rsp + 0x80]
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140098167
mov ebx, 0x8007000e
lea rbp, [0x140183048]
jmp 0x14009822c
mov r8d, dword [rsp + 0x80]
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x1400981f4
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x140183048]
lea rbp, [0x140183048]
cmp rcx, rbp
je 0x140098218
test byte [rcx + 0x1c], 1
je 0x140098218
cmp byte [rcx + 0x19], 2
jb 0x140098218
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x1a
mov dword [rsp + 0x20], ebx
mov r9, rsi
call fcn.140005f80
jmp 0x140098211
mov eax, dword [rsp + 0x30]
mov dword [rbp], eax
lea rbp, [0x140183048]
mov eax, dword [rsp + 0x80]
mov qword [r14], rdi
xor edi, edi
mov dword [r15], eax
mov rcx, qword [0x140183048]
test rdi, rdi
je 0x140098233
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x140183048]
cmp rcx, rbp
je 0x140098259
test byte [rcx + 0x1c], 1
je 0x140098259
cmp byte [rcx + 0x19], 4
jb 0x140098259
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x1b
call fcn.140004e50
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140098444
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140183808]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov rcx, qword [0x140183048]
lea r14, [0x140183048]
cmp rcx, r14
je 0x14009849a
test byte [rcx + 0x1c], 1
je 0x14009849a
cmp byte [rcx + 0x19], 4
jb 0x14009849a
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x1f
call fcn.140004e50
xor ebx, ebx
lea r8, [rsp + 0x38]
xor eax, eax
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
mov rcx, rdi
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x34]
lea r9d, [rbx + 0xc]
mov dword [rsp + 0x34], ebx
lea edx, [rbx + 5]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryKey]
nop dword [rax + rax]
test eax, eax
jns 0x140098504
mov ecx, eax
call fcn.14003bf04
mov ebx, eax
mov rcx, qword [0x140183048]
cmp rcx, r14
je 0x140098597
test byte [rcx + 0x1c], 1
je 0x140098571
cmp byte [rcx + 0x19], 2
jb 0x140098571
mov edx, 0x20
jmp 0x140098557
mov eax, dword [rsp + 0x40]
lea r8, [rsp + 0x30]
mov r9d, 4
or eax, 0xe
mov rcx, rdi
mov dword [rsp + 0x30], eax
lea edx, [r9 - 2]
call qword [sym.imp.ntdll.dll_NtSetInformationKey]
nop dword [rax + rax]
test eax, eax
jns 0x14009856a
mov ecx, eax
call fcn.14003bf04
mov ebx, eax
mov rcx, qword [0x140183048]
cmp rcx, r14
je 0x140098597
test byte [rcx + 0x1c], 1
je 0x140098571
cmp byte [rcx + 0x19], 2
jb 0x140098571
mov edx, 0x21
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov r9d, eax
call fcn.140004e7c
mov rcx, qword [0x140183048]
cmp rcx, r14
je 0x140098597
test byte [rcx + 0x1c], 1
je 0x140098597
cmp byte [rcx + 0x19], 4
jb 0x140098597
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x22
call fcn.140004e50
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401534b0
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x1400985c0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov r14, rcx
mov rcx, qword [0x140183048]
lea r12, [0x140183048]
cmp rcx, r12
je 0x140098618
test byte [rcx + 0x1c], 1
je 0x140098618
cmp byte [rcx + 0x19], 4
jb 0x140098618
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x23
call fcn.140004e50
mov eax, dword [rsp + 0x70]
mov r9d, esi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, r14
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x14009868a
mov rcx, qword [0x140183048]
cmp rcx, r12
je 0x14009867a
test byte [rcx + 0x1c], 1
je 0x14009867a
cmp byte [rcx + 0x19], 2
jb 0x14009867a
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x24]
xor r9d, r9d
lea r8, [0x140161d98]
call fcn.140004e7c
mov rcx, qword [0x140183048]
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x140098691
mov rcx, qword [0x140183048]
cmp rcx, r12
je 0x1400986b7
test byte [rcx + 0x1c], 1
je 0x1400986b7
cmp byte [rcx + 0x19], 4
jb 0x1400986b7
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x25
call fcn.140004e50
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x1400986dc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov ebp, r9d
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x140098727
test byte [rcx + 0x1c], 1
je 0x140098727
cmp byte [rcx + 0x19], 4
jb 0x140098727
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x26
call fcn.140004e50
xor ebx, ebx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x78], ebx
mov dword [rdi], ebx
test rsi, rsi
jne 0x140098750
lea r8, str.wszValueName
mov edx, 0x2d5
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.14008f4c8
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ecx, eax
test ebp, ebp
je 0x140098796
cmp eax, 2
jne 0x140098796
lea ebx, [rax - 1]
jmp 0x14009880c
test ecx, ecx
je 0x1400987ea
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov ebx, eax
mov rcx, qword [0x140183048]
lea rdi, [0x140183048]
cmp rcx, rdi
je 0x140098840
test byte [rcx + 0x1c], 1
je 0x14009881a
cmp byte [rcx + 0x19], 3
jb 0x14009881a
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x27
mov dword [rsp + 0x20], eax
mov r9, rsi
call fcn.140005f80
jmp 0x140098813
cmp dword [rsp + 0x78], 4
je 0x1400987f8
mov ebx, 0x8007065d
jmp 0x14009880c
cmp dword [rsp + 0x68], 4
je 0x140098806
mov ebx, 0x80004005
jmp 0x14009880c
mov eax, dword [rsp + 0x70]
mov dword [rdi], eax
lea rdi, [0x140183048]
mov rcx, qword [0x140183048]
cmp rcx, rdi
je 0x140098840
test byte [rcx + 0x1c], 1
je 0x140098840
cmp byte [rcx + 0x19], 4
jb 0x140098840
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x28
call fcn.140004e50
mov eax, ebx
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140098854
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, r9
mov r15, r8
mov rbp, rcx
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x1400988a6
test byte [rcx + 0x1c], 1
je 0x1400988a6
cmp byte [rcx + 0x19], 4
jb 0x1400988a6
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x2c
call fcn.140004e50
xor ebx, ebx
mov dword [rsp + 0x70], ebx
xor ecx, ecx
mov qword [r15], rbx
mov dword [r14], ebx
lea esi, [rbx + 0x40]
mov dword [rsp + 0x68], esi
jmp 0x140098942
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x1400988f7
test byte [rcx + 0x1c], 1
je 0x1400988f7
cmp byte [rcx + 0x19], 4
jb 0x1400988f7
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x2d
mov r9d, esi
call fcn.140004e7c
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.RestoredVolumes
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140098a13
cmp eax, 0xea
jne 0x1400989c5
mov esi, dword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x1400988c0
mov ebx, 0x8007000e
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x1400989b1
test byte [rcx + 0x1c], 1
je 0x1400989b1
cmp byte [rcx + 0x19], 4
jb 0x1400989b1
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x2f
call fcn.140004e50
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x140183048]
lea rax, [0x140183048]
cmp rcx, rax
je 0x14009896e
test byte [rcx + 0x1c], 1
je 0x14009896e
cmp byte [rcx + 0x19], 2
jb 0x14009896e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x2e
mov r9d, ebx
call fcn.140004e7c
jmp 0x14009896e
cmp dword [rsp + 0x70], 7
je 0x140098a24
mov ebx, 0x8000ffff
jmp 0x14009896e
mov eax, dword [rsp + 0x68]
mov qword [r15], rdi
mov rdi, rbx
mov dword [r14], eax
jmp 0x14009896e
Function at 0x140098ae4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, rcx
mov qword [rax + 8], rbx
test rcx, rcx
jne 0x140098b1f
lea r8, str.pwszBlbWindowsDirectoryPath___NULL
mov edx, 0x63c
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.14008f4c8
and qword [r14], rbx
mov edi, 0x208
mov ecx, edi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x140098b44
mov edi, 0x8007000e
jmp 0x140098bb0
mov r8, rdi
xor edx, edx
mov rcx, rsi
call sub.msvcrt.dll_memset
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x140098b8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140090160
mov edi, eax
test eax, eax
js 0x140098b88
mov rax, qword [rsp + 0x30]
mov qword [r14], rax
jmp 0x140098b8d
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
test rbx, rbx
je 0x140098bb0
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140099b64
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [0x140183048]
lea r15, [0x140183048]
cmp rcx, r15
je 0x140099bb4
test byte [rcx + 0x1c], 1
je 0x140099bb4
cmp byte [rcx + 0x19], 4
jb 0x140099bb4
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, 0x8f
call fcn.140004e50
test rsi, rsi
jne 0x140099bd1
lea r8, str.pwszWindowsTempPath
mov edx, 0xa75
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.14008f4c8
and qword [rsi], 0
mov ecx, 0x28
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140099bf8
mov ebx, 0x8007000e
jmp 0x140099d46
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov rdx, rdi
movups xmmword [rdi + 0x10], xmm0
lea ecx, [rax + 0x14]
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x14
jbe 0x140099ce7
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov eax, ebx
mov ecx, 0xffffffff
add rax, rax
cmp rax, rcx
ja 0x140099ce0
mov ecx, eax
mov ebp, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140099bee
mov r8d, ebp
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rdx, rdi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
nop dword [rax + rax]
cmp eax, ebx
ja 0x140099c89
test eax, eax
jne 0x140099d24
test eax, eax
jne 0x140099ca9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140099cae
mov ebx, 0x8007000e
mov rcx, qword [0x140183048]
cmp rcx, r15
je 0x140099d32
test byte [rcx + 0x1c], 1
je 0x140099d32
cmp byte [rcx + 0x19], 2
jb 0x140099d32
mov edx, 0x90
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov r9d, ebx
call fcn.140004e7c
jmp 0x140099d2b
mov ebx, 0x80070216
jmp 0x140099d46
test eax, eax
jne 0x140099d24
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x140183048]
cmp rcx, r15
je 0x140099d32
test byte [rcx + 0x1c], 1
je 0x140099d32
cmp byte [rcx + 0x19], 2
jb 0x140099d32
mov edx, SysAllocStringByteLen
jmp 0x140099ccb
mov qword [rsi], rdi
xor edi, edi
xor ebx, ebx
mov rcx, qword [0x140183048]
test rdi, rdi
je 0x140099d4d
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x140183048]
cmp rcx, r15
je 0x140099d73
test byte [rcx + 0x1c], 1
je 0x140099d73
cmp byte [rcx + 0x19], 4
jb 0x140099d73
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161d98]
mov edx, DllRegisterServer
call fcn.140004e50
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x14009a77c
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov esi, r9d
mov rdi, r8
mov rbp, rdx
test rdx, rdx
jne 0x14009a7b8
lea r8, str.hCryptHash
mov edx, 0x206
lea rcx, str.base_stor_blbutilchecksum.cpp
call fcn.14008f4c8
test rdi, rdi
jne 0x14009a7d5
lea r8, [0x140161df8]
mov edx, 0x207
lea rcx, str.base_stor_blbutilchecksum.cpp
call fcn.14008f4c8
test esi, esi
je 0x14009a837
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.bcrypt.dll_BCryptHashData]
nop dword [rax + rax]
test eax, eax
jns 0x14009a86e
mov ecx, eax
call fcn.14003bf04
mov ebx, eax
mov rcx, qword [0x140183048]
lea rdx, [0x140183048]
cmp rcx, rdx
je 0x14009a86e
test byte [rcx + 0x1c], 1
je 0x14009a86e
cmp byte [rcx + 0x19], 2
jb 0x14009a86e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161ec0]
mov edx, 0x13
mov r9d, eax
call fcn.140004e7c
jmp 0x14009a86e
mov rcx, qword [0x140183048]
lea rdx, [0x140183048]
cmp rcx, rdx
je 0x14009a86e
test byte [rcx + 0x1c], 1
je 0x14009a86e
cmp byte [rcx + 0x19], 5
jb 0x14009a86e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140161ec0]
mov edx, 0x14
mov r9, rdi
call fcn.140010758
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14009ede0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x140183808]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
test rcx, rcx
jne 0x14009ee24
lea r8, str.pwszLogsDirectory
mov edx, 0x23c
lea rcx, str.base_stor_blbutil_blbtrace.cpp
call fcn.14008f4c8
and qword [rdi], 0
mov rcx, qword [0x140183048]
lea rsi, [0x140183048]
cmp rcx, rsi
je 0x14009ee5c
test byte [rcx + 0x1c], 1
je 0x14009ee5c
cmp byte [rcx + 0x19], 4
jb 0x14009ee5c
mov rcx, qword [rcx + 0x10]
lea r8, [0x140162548]
mov edx, 0x23
call fcn.140004e50
mov ebx, 0x208
lea rcx, [rsp + 0x20]
mov r8d, ebx
xor edx, edx
call sub.msvcrt.dll_memset
mov r8d, ebx
lea rcx, [rsp + 0x230]
xor edx, edx
call sub.msvcrt.dll_memset
lea r8, str._SystemRoot_Logs
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.14003bf98
mov ebx, eax
test eax, eax
js 0x14009eef2
mov r8d, 0x104
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
jne 0x14009eedd
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14009eef2
xor r8d, r8d
lea rcx, [rsp + 0x230]
mov rdx, rdi
call fcn.14009039c
mov ebx, eax
mov rcx, qword [0x140183048]
cmp rcx, rsi
je 0x14009ef1f
test byte [rcx + 0x1c], 1
je 0x14009ef1f
cmp byte [rcx + 0x19], 4
jb 0x14009ef1f
mov rcx, qword [rcx + 0x10]
lea r8, [0x140162548]
mov edx, 0x24
call fcn.140004e50
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1401534b0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret