joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140298c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x480
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r14, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140298cff
call fcn.14027ca10
mov ebx, eax
jmp 0x140298e37
xor r9d, r9d
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FindResourceExW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140298d29
call fcn.14027ca10
jmp 0x140298e25
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
nop dword [rax + rax]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140298d1f
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
nop dword [rax + rax]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x140298d86
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x140298d7c
lea rcx, [rsp + 0x60]
call fcn.14027de30
mov ebx, 0x8007000e
jmp 0x140298e4e
mov ecx, eax
mov edx, 2
call fcn.140276158
cmp rax, 0x400
jbe 0x140298dae
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14027c540
mov rax, qword [rsp + 0x60]
jmp 0x140298db8
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x140298dcf
test rax, rax
jne 0x140298ddb
mov ebx, 0x8007000e
jmp 0x140298e27
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
nop dword [rax + rax]
test eax, eax
je 0x140298d1f
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4c0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140298958
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x140298e4e
lea rcx, [rsp + 0x60]
call fcn.14027de30
nop
lea rcx, [rsp + 0x48]
call fcn.14027ab0c
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400a15a0
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x480
pop r14
pop rdi
pop rsi
ret
Function at 0x14029a878
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x70
xorps xmm0, xmm0
lea r9, [rax - 0x28]
xorps xmm1, xmm1
mov rsi, r8
movdqu xmmword [rax - 0x28], xmm0
mov rdi, rcx
movdqu xmmword [rax - 0x18], xmm1
call fcn.140020a14
test eax, eax
jns 0x14029a8b5
mov ebx, 8
jmp 0x14029a945
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, str.UserChoice
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x60000
xor r8d, r8d
and dword [rsp + 0x20], 0
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14029a945
lea rcx, [rsp + 0x50]
call fcn.14029d190
mov eax, dword [rsp + 0xa8]
lea r9d, [rbx + 1]
mov dword [rsp + 0x28], eax
lea rdx, str.UserChoice
mov rax, qword [rsp + 0xa0]
mov r8, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
nop dword [rax + rax]
lea rcx, [rsp + 0x50]
mov ebx, eax
call fcn.1402962ec
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14029a95b
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14029ac84
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
mov r10, rdx
mov r11, rcx
test r8, r8
jne 0x14029aca2
mov ecx, 0x80004005
call fcn.14024e120
int3
mov r9d, ebx
mov rdx, r8
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rdx + rcx*2], bx
jne 0x14029acac
inc ecx
lea rdx, [rdx + rcx*2]
lea r9d, [r9 + rcx*2]
cmp ecx, 1
jne 0x14029aca8
mov dword [rsp + 0x28], r9d
mov rdx, r10
mov qword [rsp + 0x20], r8
lea r9d, [rcx + 6]
mov rcx, qword [r11]
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
add rsp, 0x30
pop rbx
ret
Function at 0x14029e574
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x190], rax
movsxd rdi, r9d
movzx r14d, r8b
mov rsi, rdx
mov rbx, rcx
mov r8, rdx
lea rdx, [rsp + 0x40]
call fcn.14029e230
cmp byte [rsp + 0x40], 0
je 0x14029e74f
cmp byte [rsp + 0x42], r14b
jne 0x14029e74f
cmp qword [r8 + 0x10], 0
je 0x14029e74f
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov r15d, eax
lea rax, str.xa8_
mov r12d, SafeArrayDestroy
mov rcx, qword [str.xa8_]
cmp rcx, rax
je 0x14029e622
test byte [rcx + 0x1c], 8
je 0x14029e622
mov edx, r12d
mov dword [rsp + 0x30], r14d
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9d, r15d
mov rcx, qword [rcx + 0x10]
call fcn.1402a3a4c
lea rbp, [rbx + 0x188]
mov r8d, r12d
mov edx, edi
mov rcx, rbp
call fcn.14004155c
test edi, edi
js 0x14029e652
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
lea rdx, [rdi + rdi*2]
mov rcx, qword [rbp + 0x30]
mov dword [rcx + rdx*8 + 0x10], eax
lea rcx, [rsp + 0x50]
call fcn.14004152c
nop
cmp byte [rbx + 0xdc], 0
je 0x14029e693
cmp r14b, 6
je 0x14029e67d
lea rdx, [rbx + 0x1c8]
lea rcx, [rsp + 0x50]
call fcn.140277518
mov r8d, 1
mov r9d, r8d
mov rdx, qword [rsi]
lea rcx, [rsp + 0x50]
call fcn.14029adb8
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov rax, qword [rsi + 0x10]
call qword [case.0x14006b68f.0]
mov r12d, eax
test byte [0x14038bd84], 2
je 0x14029e6c7
mov r9, qword [rsi]
mov r8d, dword [rbx + 0xc8]
lea rdx, [0x14030cf28]
call fcn.1400417a0
mov rcx, qword [str.xa8_]
lea rax, str.xa8_
cmp rcx, rax
je 0x14029e703
test byte [rcx + 0x1c], 8
je 0x14029e703
mov edx, SafeArrayDestroy
mov dword [rsp + 0x30], r14d
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9d, r15d
mov rcx, qword [rcx + 0x10]
call fcn.1402a3a4c
cmp byte [rbx + 0xdc], 0
je 0x14029e719
mov edx, r12d
lea rcx, [rsp + 0x50]
call fcn.140095718
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov edx, edi
mov rcx, rbp
call fcn.14004155c
test edi, edi
js 0x14029e745
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
lea rdx, [rdi + rdi*2]
mov rcx, qword [rbp + 0x30]
mov dword [rcx + rdx*8 + 0x14], eax
lea rcx, [rsp + 0x50]
call fcn.140041500
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400a15a0
add rsp, 0x1a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14029eec0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
call fcn.14028aec4
xor ebx, ebx
test eax, eax
je 0x14029eed8
mov bl, 1
jmp 0x14029ef85
lea rax, [rsp + 0x58]
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x30], rax
lea r8, str.LockedStartLayout
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwarePoliciesMicrosoftWindowsExplorer
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14029ef2e
cmp dword [rsp + 0x50], ebx
jne 0x14029eed1
lea rax, [rsp + 0x58]
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x30], rax
lea r8, str.LockedStartLayout
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwarePoliciesMicrosoftWindowsExplorer
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14029ef85
cmp dword [rsp + 0x50], ebx
setne bl
mov al, bl
add rsp, 0x40
pop rbx
ret

Function at 0x14029ef94
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
call fcn.14028aec4
mov ebx, 1
test eax, eax
jne 0x14029f02c
lea rdx, str.NoPinningToTaskbar
mov dword [rsp + 0x20], ebx
mov r9, rdx
lea r8, str.SoftwarePoliciesMicrosoftWindowsExplorer
lea rcx, str.Start
call fcn.140295f64
mov bl, al
test al, al
jne 0x14029f02c
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea r8, str.TaskbarNoPinnedList
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwarePoliciesMicrosoftWindowsExplorer
and qword [rsp + 0x20], 0
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14029f02c
cmp dword [rsp + 0x50], eax
setne bl
mov al, bl
add rsp, 0x40
pop rbx
ret
Function at 0x14029f448
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x68
lea rax, str.Microsoft.Windows.Documents
mov qword [rbp - 0x40], rax
lea rax, str.Microsoft.Windows.Pictures
mov qword [rbp - 0x38], rax
mov r8d, SHRestricted
lea rdx, [0x140313c60]
lea rcx, [rbp - 0x30]
call fcn.14027a67c
nop
and qword [rbp - 0x48], 0
lea rcx, [rbp - 0x48]
call fcn.14000a6a4
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x30]
call fcn.1402966d4
test al, al
je 0x14029f5c8
mov rbx, qword [rbp - 0x48]
mov rax, qword [rbx]
lea r8, [rbp + 0x28]
mov edx, 0x10000
mov rcx, rbx
mov rax, qword [rax + 0x30]
call qword [case.0x14006b68f.0]
test eax, eax
js 0x14029f486
test dword [rbp + 0x28], 0x10000
je 0x14029f486
and qword [rbp + 0x40], 0
mov rax, qword [rbx]
lea r8, [rbp + 0x30]
lea rdx, [0x140313e98]
mov rcx, rbx
mov rax, qword [rax + 0x90]
call qword [case.0x14006b68f.0]
test eax, eax
js 0x14029f5aa
cmp dword [rbp + 0x30], 1
jne 0x14029f5aa
mov rax, qword [rbx]
mov rdi, qword [rax + 0x88]
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.140032750
lea r8, [rbp + 0x40]
lea rdx, [0x14031bc88]
mov rcx, rbx
mov rax, rdi
call qword [case.0x14006b68f.0]
test eax, eax
js 0x14029f5aa
lea rsi, [rbp - 0x40]
mov rdx, qword [rsi]
mov rcx, qword [rbp + 0x40]
call fcn.14000e380
test eax, eax
je 0x14029f59d
and qword [rbp + 0x38], 0
mov rax, qword [rbx]
mov rdi, qword [rax + 0x28]
xor edx, edx
lea rcx, [rbp + 0x38]
call fcn.140032750
lea r8, [rbp + 0x38]
mov edx, 0x80058000
mov rcx, rbx
mov rax, rdi
call qword [case.0x14006b68f.0]
test eax, eax
js 0x14029f588
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
nop
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14029f59d
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
add rsi, 8
lea rax, [rbp - 0x30]
cmp rsi, rax
jne 0x14029f537
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14029f486
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
jmp 0x14029f486
lea rcx, [rbp - 0x48]
call fcn.14000a6a4
nop
mov rcx, qword [rbp - 0x20]
and qword [rbp - 0x20], 0
test rcx, rcx
je 0x14029f5ed
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14006b68f.0]
lea rcx, [rbp - 0x28]
call fcn.14003944c
nop
add rsp, 0x68
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1402a55a8
Capabilities:
Lock the desktop

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
mov ecx, eax
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ProcessIdToSessionId]
nop dword [rax + rax]
test eax, eax
je 0x1402a5688
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
nop dword [rax + rax]
test rax, rax
je 0x1402a5650
mov ecx, dword [rsp + 0x30]
mov rdx, rax
call fcn.1402a5ce0
call fcn.1402a5e2c
call qword [sym.imp.USER32.dll_LockWorkStation]
nop dword [rax + rax]
test eax, eax
jne 0x1402a56d8
mov rcx, qword [str.xa8_]
lea rax, str.xa8_
cmp rcx, rax
je 0x1402a56d8
test byte [rcx + 0x1c], 2
je 0x1402a56d8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x1402a5649
movzx eax, ax
or eax, 0x80070000
mov edx, SafeArrayDestroy
jmp 0x1402a56be
mov rcx, qword [str.xa8_]
lea rax, str.xa8_
cmp rcx, rax
je 0x1402a56d8
test byte [rcx + 0x1c], 2
je 0x1402a56d8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x1402a5681
movzx eax, ax
or eax, 0x80070000
mov edx, SafeArrayDestroy
jmp 0x1402a56be
mov rcx, qword [str.xa8_]
lea rax, str.xa8_
cmp rcx, rax
je 0x1402a56d8
test byte [rcx + 0x1c], 2
je 0x1402a56d8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x1402a56b9
movzx eax, ax
or eax, 0x80070000
mov edx, SafeArrayDestroy
mov rcx, qword [str.xa8_]
lea r8, [0x140348b38]
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.1401bb4c4
xor eax, eax
add rsp, 0x28
ret
Function at 0x1402a5ce0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
xor edi, edi
cmp qword [0x14038c6d0], rdi
jne 0x1402a5e17
mov dword [0x14038c6c4], ecx
lea rcx, [rsp + 0x50]
call fcn.1402a5848
lea rcx, [rsp + 0x58]
xor ebx, ebx
cmp rcx, rax
je 0x1402a5d23
mov rbx, qword [rax]
and qword [rax], rdi
mov rdi, rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1402a5d40
and qword [rsp + 0x50], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14006b68f.0]
test rdi, rdi
jne 0x1402a5d4f
mov edi, 0x8007000e
jmp 0x1402a5e17
and qword [rsp + 0x28], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x20], 0
lea r8, [0x1402a5980]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
nop dword [rax + rax]
mov qword [0x14038c6d0], rax
test rax, rax
je 0x1402a5db2
xor edi, edi
mov rcx, qword [str.xa8_]
lea rax, str.xa8_
cmp rcx, rax
je 0x1402a5e07
test byte [rcx + 0x1c], 8
je 0x1402a5e07
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0xa]
lea r8, [0x140348b70]
call fcn.1402a3a20
jmp 0x1402a5e07
mov edi, 0x80004005
mov rcx, qword [str.xa8_]
lea rax, str.xa8_
cmp rcx, rax
je 0x1402a5e07
test byte [rcx + 0x1c], 2
je 0x1402a5e07
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x1402a5de8
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [str.xa8_]
lea r8, [0x140348b70]
mov edx, SafeArrayDestroy
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.1401bb4c4
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
mov rcx, rbx
call qword [case.0x14006b68f.0]
mov rbx, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1402a7260
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0x3f8]
sub rsp, 0x4f0
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov ebx, 0x488
lea rcx, [rsp + 0x50]
mov r8d, ebx
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, qword [str._LocalAppData_MicrosoftWindowsExplorer]
lea rdx, [rbp - 0x38]
mov rdi, qword [0x1402fb748]
mov r14d, 0x104
mov dword [rsp + 0x50], ebx
mov r8d, r14d
mov dword [rsp + 0x7c], 0x20000
mov ebx, 0x80004005
mov dword [rbp - 0x80], 8
mov dword [rbp - 0x70], 0x20801
mov dword [rbp - 0x40], Ordinal_126
mov dword [rbp - 0x3c], SHChangeNotification_Unlock
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_SHExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
je 0x1402a7460
lea rdx, [rbp - 0x38]
xor ecx, ecx
call qword [sym.imp.api_ms_win_shell_shdirectory_l1_1_0.dll_Ordinal_292_1]
nop dword [rax + rax]
mov r8, rdi
lea rcx, [rbp - 0x38]
mov edx, r14d
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAppend]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x1402a7460
lea r8, str..etl
mov edx, r14d
lea rcx, [rbp - 0x38]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAddExtension]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x1402a7460
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x50]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_eventing_controller_l1_1_0.dll_StartTraceW]
nop dword [rax + rax]
mov ebx, eax
mov r14d, 0x80070000
test eax, eax
jle 0x1402a7386
movzx ebx, ax
or ebx, r14d
cmp ebx, 0x80070057
jne 0x1402a73d0
lea rcx, [rbp - 0x38]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
je 0x1402a73c9
lea r8, [rsp + 0x50]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_eventing_controller_l1_1_0.dll_StartTraceW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1402a73d0
movzx ebx, ax
or ebx, r14d
jmp 0x1402a73d0
call fcn.140020b4c
mov ebx, eax
test ebx, ebx
js 0x1402a7460
xor edi, edi
test ebx, ebx
js 0x1402a7438
mov rax, qword [str._8_]
lea rcx, [rdi + rdi*2]
and qword [rsp + 0x38], 0
mov r9b, 4
and dword [rsp + 0x30], 0
mov r8d, 1
and qword [rsp + 0x28], 0
lea rdx, [rax + rcx*8]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_eventing_controller_l1_1_0.dll_EnableTraceEx2]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1402a742d
movzx ebx, ax
or ebx, r14d
inc edi
cmp edi, 1
jb 0x1402a73da
test ebx, ebx
jns 0x1402a7460
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.api_ms_win_eventing_controller_l1_1_0.dll_StopTraceW]
nop dword [rax + rax]
lea rcx, [rbp - 0x38]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.1400a15a0
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1402a7824
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r12d, edx
mov rbx, rcx
xor r13d, r13d
lea rcx, [rsp + 0x50]
mov edx, 0x104
mov r14d, r13d
mov r15, r8
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x1402a79f2
lea ecx, [r13 + 0x43]
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
nop dword [rax + rax]
mov ebp, eax
test eax, eax
jne 0x1402a79f2
movzx ecx, word [rbx]
mov rdi, rbx
test cx, cx
je 0x1402a78c5
movzx eax, cx
movzx ecx, ax
cmp ax, 0x20
je 0x1402a78c0
cmp ax, 0x2c
je 0x1402a78c0
add rdi, 2
movzx ecx, word [rdi]
movzx eax, cx
test cx, cx
jne 0x1402a78a2
test cx, cx
jne 0x1402a78cc
mov ebp, 1
jmp 0x1402a78d0
mov word [rdi], r13w
cmp word [rbx], r13w
je 0x1402a79e6
test byte [0x14038bd81], 0x40
je 0x1402a78fa
mov rcx, rbx
call fcn.14009cf0c
mov r8, rax
lea rdx, [0x14030dc48]
call fcn.14004186c
lea rax, [rsp + 0x40]
mov r9d, r12d
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x30], r15
mov rcx, rbx
call fcn.14009d274
test eax, eax
jns 0x1402a798b
lea rcx, str.explorer.exe
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleA]
nop dword [rax + rax]
test byte [0x14038bd81], 0x40
mov rsi, rax
je 0x1402a7958
mov rcx, rbx
call fcn.14009cf0c
mov r9, rax
lea rdx, [0x14030dc38]
xor r8d, r8d
call fcn.1400417a0
test rsi, rsi
je 0x1402a79e6
mov r9d, 0x20c
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], 0x1030
mov rcx, rsi
lea r8d, [r9 - 9]
call qword [sym.imp.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_ShellMessageBoxW]
nop dword [rax + rax]
jmp 0x1402a79e6
mov rdx, qword [rsp + 0x40]
mov rcx, r15
call fcn.14009d98c
test byte [0x14038bd81], 0x40
je 0x1402a79cf
mov rcx, rbx
call fcn.14009cf0c
mov rcx, qword [rsp + 0x40]
mov rbx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetProcessId]
nop dword [rax + rax]
mov r9, rbx
lea rdx, [0x14030dc38]
mov r8d, eax
call fcn.1400417a0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov r14d, 1
lea rbx, [rdi + 2]
test ebp, ebp
je 0x1402a7894
mov eax, r14d
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400a15a0
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402a8454
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
and qword [r8], 0
mov rdi, r8
test ecx, ecx
jne 0x1402a84e8
mov rax, qword gs:[0x60]
cmp dword [rax + 0x2c0], ecx
je 0x1402a84e8
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, [0x140348f78]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
nop dword [rax + rax]
test eax, eax
je 0x1402a84ce
cmp dword [rsp + 0x38], 0
jne 0x1402a84ce
lea rcx, [rsp + 0x40]
call fcn.1402a8334
mov ebx, eax
test eax, eax
js 0x1402a84d3
mov rcx, qword [rsp + 0x40]
mov r8, rdi
call fcn.1402a850c
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call sub.api_ms_win_core_heap_l2_1_0.dll_LocalFree
jmp 0x1402a84f6
mov ebx, 0x80004005
call fcn.1402a85ec
test eax, eax
je 0x1402a84f6
mov r8, rdi
lea rcx, [0x140348f6c]
jmp 0x1402a84ef
lea rcx, [0x140348f64]
call fcn.1402a850c
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1402a850c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x370
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0x11c
lea rcx, [rsp + 0x30]
mov rdi, r8
call sub.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersionExW
test eax, eax
je 0x1402a855e
cmp dword [rsp + 0x40], 2
jne 0x1402a855c
cmp dword [rsp + 0x34], 6
jb 0x1402a855c
mov eax, 1
jmp 0x1402a855e
xor eax, eax
and qword [rdi], 0
lea rcx, str.D:_A__GA___SY__A__0x_x____s_
test eax, eax
mov qword [rsp + 0x20], rbx
lea r8, str.D:_A__GA___SY__A__0x_x____s_S:_ML__1___LW_
mov edx, 0x104
cmove r8, rcx
mov r9d, 0x100002
lea rcx, [rsp + 0x150]
call fcn.14002d868
mov ebx, eax
test eax, eax
js 0x1402a85c2
xor r9d, r9d
lea rcx, [rsp + 0x150]
mov r8, rdi
lea edx, [r9 + 1]
call qword [0x1403ad2c8]
nop dword [rax + rax]
test eax, eax
jne 0x1402a85c2
call fcn.140020b4c
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.1400a15a0
mov rbx, qword [rsp + 0x388]
add rsp, 0x370
pop rdi
ret