joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019a90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x200
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov r14, r8
mov rbx, rdx
mov rdi, rcx
xor r12d, r12d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0xc1
mov word [rsp + 0x68], r12w
lea r13, fcn.140008d70
mov qword [rsp + 0x50], r13
lea r8, [rsp + 0x50]
lea rdx, [0x140095a98]
mov rcx, rbx
call fcn.1400178f0
test eax, eax
je 0x14003d01c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov dword [rsp + 0x34], 4
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x14003cf7e
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.ProvidesNotifications
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14003d014
cmp dword [rsp + 0x38], 4
jne 0x14003d014
mov eax, dword [rsp + 0x30]
mov dword [rdi + 0x24], eax
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x14003cfa2
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140019b80
test ebx, ebx
je 0x14003cfa2
mov rax, qword [r14]
mov r15d, dword [rax - 0x10]
mov rsi, rdi
sub rsi, rax
sar rsi, 1
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or eax, ecx
jge 0x140019bbd
mov edx, ebx
mov rcx, r14
call fcn.1400164a0
mov rcx, qword [r14]
movsxd rdx, ebx
add rdx, rdx
mov r9, rdx
cmp rsi, r15
jbe 0x14003cf88
mov r8, rdi
call qword [sym.imp.msvcrt.dll_memcpy_s]
test ebx, ebx
js 0x14003cf98
mov rax, qword [r14]
cmp ebx, dword [rax - 0xc]
jg 0x14003cf98
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [r14]
mov word [rax + rcx*2], r12w
mov rdi, qword [rsp + 0x58]
mov qword [rsp + 0x50], r13
test rdi, rdi
je 0x140019c1a
lea rax, [rsp + 0x68]
cmp rdi, rax
jne 0x14003cff1
mov eax, r12d
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14002dd40
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 6
jmp 0x14003d016
lea r8, [rcx + rsi*2]
call qword [sym.imp.msvcrt.dll_memmove_s]
nop
jmp 0x140019bdb
mov ecx, 0x80070057
call fcn.14004a0f0
mov rcx, qword [r14]
sub rcx, 0x18
mov rbx, qword [rcx]
cmp dword [rcx + 8], 0
je 0x140019c02
mov eax, dword [rcx + 0x10]
shr eax, 0x1f
test al, al
je 0x14003cfd0
xor edx, edx
mov rcx, r14
call fcn.1400165c8
nop
jmp 0x140019bfd
call fcn.1400176e0
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x14000702c.0]
add rax, 0x18
mov qword [r14], rax
jmp 0x140019bfd
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop
jmp 0x140019c1a
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r12d, eax
test eax, eax
jle 0x14003d034
movzx r12d, ax
or r12d, 0x80070000
lea rcx, [rsp + 0x50]
call fcn.140009bb0
nop
jmp 0x140019c1a
Function at 0x14001c754
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x48
cmp byte [0x1400c9ff8], 0
jne 0x14001c83c
cmp byte [0x1400c9ff9], 0
jne 0x14001c83c
and qword [rbp - 0x18], 0
lea rax, [rbp - 0x18]
mov bl, 1
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov byte [0x1400c9ff8], bl
lea rdx, str.SOFTWAREMicrosoftWindows_Search
mov rcx, 0xffffffff80000002
call fcn.14001e414
test eax, eax
jne 0x14001c83c
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x28]
mov dword [rbp + 0x18], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140094dd0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x140035376
xor bl, bl
cmp dword [0x1400cb258], 0
mov byte [0x1400c9ff9], bl
mov dword [rbp + 0x18], 4
ja 0x14001c832
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x30]
xor r8d, r8d
lea rdx, str.ETWBufferSize
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x14003538f
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
add rsp, 0x48
pop rbx
pop rbp
ret
cmp dword [rbp + 0x20], 4
jne 0x14001c7e8
cmp dword [rbp + 0x28], 0
ja 0x14001c7ea
jmp 0x14001c7e8
cmp dword [rbp + 0x20], 4
jne 0x14001c832
mov ebx, dword [rbp + 0x30]
test ebx, ebx
je 0x14001c832
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
and dword [0x1400cb25c], 0
mov edx, 8
shr ebx, 0xb
mov rcx, rax
mov r8d, ebx
mov dword [0x1400cb258], r8d
shl r8, 0xb
mov qword [0x1400cb250], rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov qword [0x1400cb260], rax
jmp 0x14001c832

Function at 0x14001e06c
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x480
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r8d, 0x105
lea rax, [rsp + 0x50]
mov dword [rsp + 0x38], r8d
lea rdx, [rsp + 0x260]
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
test eax, eax
je 0x14001e10f
lea rdx, [0x140094e70]
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_wcscmp
mov ecx, dword [rbx + 0x30]
lea r8, [rsp + 0x260]
test eax, eax
lea rdx, [rsp + 0x50]
setne al
mov byte [rbx + 0x34], al
call fcn.14001e120
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14002dd40
add rsp, 0x480
pop rbx
ret
call fcn.14001e36c
test eax, eax
jns 0x14001e0c8
mov byte [rbx + 0x34], 0
jmp 0x14001e0f6
Function at 0x14001e23c
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, dword [0x14009f8b8]
mov rbx, rcx
mov dword [rbp - 0x14], eax
xor edi, edi
movzx eax, word [0x14009f8bc]
xor r9d, r9d
mov word [rbp - 0x10], ax
xor r8d, r8d
mov rax, qword [rcx]
mov word [rbp - 0x14], dx
lea rdx, [rbp - 0x14]
mov qword [rbp - 0x20], rdi
mov rcx, qword [rax]
mov rax, qword [rbx + 8]
mov qword [r11 - 0x38], rax
lea rax, [rbp - 0x20]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001e33e
mov rcx, qword [rbp - 0x20]
lea r9d, [rdi + 4]
lea rax, [rbp - 0x18]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DriveType
mov dword [rbp - 0x18], 3
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x140094e70]
mov rcx, qword [rcx]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x14001e33e
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x14001e30b
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, str.VolumeLabel
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14001e34d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002dd40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001efa0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x360
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x378], rbx
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rdi, rcx
mov byte [rsp + 0x30], 0
mov ebx, 0x104
mov edx, ebx
lea rcx, [rsp + 0x140]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test eax, eax
je 0x140035a9e
xor al, al
mov rcx, qword [rsp + 0x368]
test al, al
jne 0x140035aa5
mov rcx, rbx
lea rax, [rsp + 0x140]
nop
cmp word [rax], 0
je 0x14001f025
add rax, 2
sub rcx, 1
jne 0x14001f010
jmp 0x140035ac5
test rcx, rcx
je 0x140035ac5
sub rbx, rcx
lea rax, [rsp + 0x140]
lea rax, [rax + rbx*2]
xor ebx, ebx
mov r10d, ebx
test rcx, rcx
je 0x140035ab6
mov edx, 0x7ffffffe
lea r9, str.propsys.dll
sub r9, rax
nop word [rax + rax]
test rdx, rdx
je 0x14001f086
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x14001f086
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, 1
jne 0x14001f060
jmp 0x140035ab6
test rcx, rcx
je 0x140035ab6
mov word [rax], bx
mov rcx, qword [rsp + 0x368]
test r10d, r10d
js 0x140035ad2
lea r8, [rsp + 0x50]
xor edx, edx
lea rcx, [rsp + 0x140]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesExW]
mov rcx, qword [rsp + 0x368]
test eax, eax
je 0x140035ae6
mov r9d, 0x20019
lea r8, str.SOFTWAREMicrosoftWindows_Search
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x80]
call fcn.140021940
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], 8
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
lea rdx, str.SchemaCacheTimestamp
lea rcx, [rsp + 0x80]
call fcn.140021a64
test eax, eax
je 0x140035af7
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CompareFileTime]
test eax, eax
jne 0x140035af7
xor bl, bl
mov byte [rsp + 0x30], bl
lea rcx, [rsp + 0x80]
call fcn.140017740
nop
movzx eax, bl
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.14002dd40
mov rbx, qword [rsp + 0x378]
add rsp, 0x360
pop rdi
ret
mov al, 1
jmp 0x14001eff3
lea r8, [0x140098ec0]
mov edx, 0xdd
call fcn.14005eaa8
sub rax, 2
mov r10d, 0x8007007a
jmp 0x14001f08f
xor ebx, ebx
mov r10d, 0x80070057
jmp 0x14001f092
mov r9d, r10d
lea r8, [0x140098ec0]
mov edx, 0xde
call fcn.140048df4
lea r8, [0x140098ec0]
mov edx, 0xe1
call fcn.14005eaa8
mov eax, dword [rsp + 0x64]
mov dword [rdi], eax
mov eax, dword [rsp + 0x68]
mov dword [rdi + 4], eax
mov bl, 1
jmp 0x14001f140
Function at 0x14001f4e4
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x778]
sub rsp, 0x870
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rbp + 0x760], rax
mov rdi, rcx
xor esi, esi
test rcx, rcx
je 0x14001f613
cmp word [rcx], si
je 0x14001f613
xor r8d, r8d
xor edx, edx
lea rcx, str.PATH
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rdi + rcx*2], si
jne 0x14001f549
lea ebx, [rcx + rax]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x401
mov word [rsp + 0x58], si
lea rax, [0x14008b990]
mov qword [rsp + 0x40], rax
lea edx, [rbx + 0x104]
lea rcx, [rsp + 0x40]
call fcn.140017eac
mov rdx, rax
lea r8d, [rbx + 0x104]
lea rcx, str.PATH
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
lea rcx, [rsp + 0x40]
call fcn.140017e78
mov rax, qword [rsp + 0x40]
or ebx, 0xffffffff
mov r9d, ebx
mov r8d, dword [rsp + 0x54]
lea rdx, [0x140095134]
lea rcx, [rsp + 0x40]
mov rax, qword [rax + 0x20]
call qword [case.0x14000702c.0]
mov rax, qword [rsp + 0x40]
mov r9d, ebx
mov r8d, dword [rsp + 0x54]
mov rdx, rdi
lea rcx, [rsp + 0x40]
mov rax, qword [rax + 0x20]
call qword [case.0x14000702c.0]
mov rdx, qword [rsp + 0x48]
lea rcx, str.PATH
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
test eax, eax
je 0x140035fce
lea rcx, [rsp + 0x40]
call fcn.140029298
xor eax, eax
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.14002dd40
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rcx, qword [rbp + 0x778]
mov r9d, 0x8000ffff
lea r8, str.onecoreuap_base_appmodel_search_searchcommonpkmutill_ssfsutil.cxx
mov edx, 0x8f
call fcn.140048df4
int3
Function at 0x14001f8e4
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r9d, dword [rcx + 0x14]
lea r8, str._08x
mov rdi, rdx
lea rcx, [rsp + 0x38]
xor ebx, ebx
lea edx, [rbx + 0x10]
call fcn.140009728
test eax, eax
js 0x14001f967
lea rax, [rsp + 0x30]
mov rdx, rdi
lea r9d, [rbx + 2]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call fcn.14001e414
test eax, eax
jne 0x14001f967
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
mov edx, 1
test eax, eax
movzx ebx, bl
cmove ebx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov al, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002dd40
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140021080
Capabilities:
Create directory

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x250
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, r8
mov r14, rdx
mov qword [rsp + 0x40], rdx
xor r15d, r15d
test r8, r8
je 0x1400210c0
mov byte [r8], r15b
mov edx, 2
mov rcx, qword [rcx + 8]
call fcn.140029be4
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.140021744
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.140020b8c
nop
mov ebx, r15d
mov dword [rsp + 0x30], ebx
mov rcx, qword [rsp + 0x108]
call fcn.140021d88
test al, al
je 0x140036c7a
mov rcx, qword [rsp + 0x108]
call fcn.140021d88
test al, al
je 0x140036d68
lea rcx, [rsp + 0x100]
call fcn.140029258
nop
mov rcx, r14
call fcn.140029258
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14002dd40
add rsp, 0x250
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathSkipRootW]
mov rdi, rax
mov r9, rdi
sub r9, qword [rsp + 0x108]
sar r9, 1
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x100]
call fcn.140021908
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1a0]
call fcn.1400447dc
mov rcx, qword [rsp + 0x1a8]
call fcn.140021d88
test al, al
jne 0x140036d37
xor edx, edx
mov rcx, qword [rsp + 0x1a8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x140036d37
test ebx, ebx
js 0x140036d37
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140036cfe
movzx ebx, bx
or ebx, 0x80070000
mov dword [rsp + 0x30], ebx
mov rcx, qword [rsp + 0x278]
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x28], rax
lea rax, str.PathComponent:__ls
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_searchcommonpkmutillindexmove.cxx
mov edx, 0x189
call fcn.140050168
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindNextComponentW]
mov rdi, rax
lea rcx, [rsp + 0x1a0]
call fcn.140029258
test rdi, rdi
je 0x140021108
cmp word [rdi], r15w
jne 0x140036c8b
jmp 0x140021108
test rsi, rsi
je 0x140036d70
mov byte [rsi], 1
mov rcx, qword [rsp + 0x108]
call fcn.14005a308
nop
jmp 0x14002111d
Function at 0x140021a30
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0xb0]
test rcx, rcx
je 0x140021a5d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
test eax, eax
je 0x140036f2a
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
add rsp, 0x28
ret
mov ecx, 6
jmp 0x140021a50
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 1
jmp 0x140021a58

Function at 0x140021a64
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, r9
xor ecx, ecx
mov rsi, r8
mov rbp, rdx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x140036f3c
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x140036f52
test eax, eax
jne 0x140036f43
mov eax, 1
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, 6
jmp 0x140036f45
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x140021acf
mov ecx, 0x7a
jmp 0x140036f45

Function at 0x140021d88
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathIsUNCServerW]
test eax, eax
jne 0x140021dc9
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathIsUNCServerShareW]
test eax, eax
jne 0x140021dc9
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140021dc9
test al, 0x10
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400233bc
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
mov r9d, 0x7cf
lea r12, [0x1400ca210]
mov r8, rax
mov rcx, r12
lea r13d, [r9 + 1]
mov edx, r13d
call fcn.140025868
xor r15d, r15d
test eax, eax
js 0x1400235ce
mov rbx, r12
mov dword [rdi], r15d
lea edx, [r15 + 0x22]
cmp word [rbx], r15w
je 0x140023495
mov rax, rbx
sub rax, r12
sar rax, 1
cmp rax, r13
jae 0x140023444
movzx ecx, word [rbx]
test cx, cx
je 0x14002343f
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
jne 0x1400235b3
mov edx, 0x22
mov rax, rbx
sub rax, r12
and rax, 0xfffffffffffffffe
cmp rax, 0xfa0
je 0x140023495
movzx ecx, word [rbx]
test cx, cx
je 0x140023495
cmp cx, dx
je 0x1400401de
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
jne 0x140023480
cmp word [rbx], r15w
je 0x140023480
add rbx, 2
movzx ecx, word [rbx]
jmp 0x140023467
inc dword [rdi]
mov rcx, rbx
sub rcx, r12
mov edx, 0x22
sar rcx, 1
cmp rcx, r13
jb 0x140023415
cmp dword [rdi], r15d
je 0x1400235ce
movsxd rcx, dword [rdi]
mov eax, 8
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
mov rax, qword [0x14008e1f8]
call qword [case.0x14000702c.0]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400235ce
mov rbx, r12
mov ebp, r15d
mov r14, rax
mov esi, 0x22
cmp word [rbx], r15w
je 0x140023591
cmp ebp, dword [rdi]
jge 0x140023591
mov rax, rbx
sub rax, r12
sar rax, 1
cmp rax, r13
jae 0x140023516
movzx ecx, word [rbx]
test cx, cx
je 0x140023516
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
jne 0x140040200
mov rcx, rbx
sub rcx, r12
sar rcx, 1
cmp rcx, r13
je 0x140023591
cmp word [rbx], r15w
je 0x140023591
cmp word [rbx], si
lea rax, [rbx + 2]
cmovne rax, rbx
inc ebp
mov qword [r14], rax
add r14, 8
cmp word [rbx], si
je 0x140040209
cmp rcx, r13
jae 0x140023571
movzx ecx, word [rbx]
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
jne 0x140023571
cmp word [rbx], r15w
je 0x14002357f
add rbx, 2
mov rax, rbx
sub rax, r12
sar rax, 1
cmp rax, r13
jb 0x14002354c
cmp word [rbx], r15w
je 0x14002357f
mov word [rbx], r15w
add rbx, 2
mov rcx, rbx
sub rcx, r12
sar rcx, 1
cmp rcx, r13
jb 0x1400234e0
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
add rbx, 2
mov rax, rbx
sub rax, r12
sar rax, 1
cmp rax, r13
jb 0x140023429
jmp 0x14002343f
xor eax, eax
jmp 0x140023596
lea rcx, [rbx + 2]
call qword [sym.imp.msvcrt.dll_wcschr]
mov rbx, rax
test rax, rax
je 0x1400401f9
add rbx, 2
jmp 0x140023480
inc dword [rdi]
jmp 0x140023495
add rbx, 2
jmp 0x1400234f2
mov edx, esi
lea rcx, [rbx + 2]
call qword [sym.imp.msvcrt.dll_wcschr]
mov rbx, rax
test rax, rax
je 0x140023591
jmp 0x140023571
Function at 0x140023f3c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, qword [rcx + 0x18]
lea rdx, [0x140096784]
mov r15, rcx
xor r12d, r12d
mov ecx, 0x208
mov ebp, r12d
mov ebx, r12d
call fcn.14002e1ac
lea r9, [rsp + 0x50]
mov r8d, 0x104
mov rdx, rax
mov rcx, r14
mov rdi, rax
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
or r13, 0xffffffffffffffff
test eax, eax
je 0x140040500
mov esi, r12d
mov rbx, rdi
mov rdi, r12
mov rcx, rdi
call fcn.14000e5b8
test esi, esi
js 0x140024002
mov rdi, rbx
cmp word [rbx], r12w
je 0x140023ffe
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathIsRootW]
test eax, eax
je 0x140023fe3
movzx edx, word [rdi]
mov eax, 1
cmp edx, 0x5a
lea ecx, [rdx - 0x20]
cmovbe cx, dx
sub ecx, 0x41
shl eax, cl
or ebp, eax
mov rax, r13
inc rax
cmp word [rdi + rax*2], r12w
jne 0x140023fe6
lea rdi, [rdi + rax*2]
add rdi, 2
cmp word [rdi], r12w
jne 0x140023fbd
mov dword [r15 + 0x30], ebp
mov rcx, rbx
call fcn.14000e5b8
mov rbx, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14001e36c
mov esi, eax
cmp eax, 0x800700ea
jne 0x14004056f
mov ecx, dword [rsp + 0x50]
mov eax, 2
mul rcx
lea rdx, [0x140096784]
cmovo rax, r13
mov rcx, rax
call fcn.14002e1ac
mov rcx, rdi
mov rsi, rax
call fcn.14000e5b8
mov rdi, rsi
test rsi, rsi
jne 0x14004054a
mov esi, 0x8007000e
jmp 0x140023fa8
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
jne 0x140023f9f
call fcn.14001e36c
mov esi, eax
test esi, esi
js 0x140023fa8
jmp 0x140023fa2