joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010de8
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov dword [r11 + 0x20], r9d
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
and qword [r11 + 8], 0
lea rax, [r11 + 8]
mov rdi, r8
mov qword [r11 - 0x18], rax
xor r8d, r8d
mov r9d, 2
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x180010e5a
mov rcx, qword [rsp + 0x40]
lea r9d, [rax + 4]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180010e70
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180010e84
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov dword [r11 + 0x20], r9d
mov qword [r11 + 0x10], rdx
push rdi
sub rsp, 0x50
and qword [r11 + 0x10], 0
lea rax, [r11 + 0x10]
mov rdi, r8
mov qword [r11 - 0x38], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionSeCEdit
mov r9d, 2
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x180010f14
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionSeCEdit
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rbx
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x180010f4b
mov eax, dword [rsp + 0x88]
mov r9d, 1
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rdi
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x180010f61
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1800113a8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
or rax, 0xffffffffffffffff
mov r10, r8
mov edi, edx
mov rbx, rcx
cmp rcx, rax
jne 0x1800113cf
mov eax, 0x57
jmp 0x180011436
xor esi, esi
inc rax
cmp word [r8 + rax*2], si
jne 0x1800113d1
lea r8d, [rax + rax]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov rdx, r10
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
je 0x18001142a
test edi, edi
je 0x180011426
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rsi
mov r8d, 4
lea rdx, [0x18007ad78]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
xor eax, eax
jmp 0x180011436
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180011450
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
lea rax, [rcx - 1]
mov ebp, edx
mov rsi, rcx
cmp rax, 0xfffffffffffffffd
ja 0x180011556
xor r14d, r14d
test r8, r8
je 0x180011556
lea ebx, [r14 + 8]
mov edx, 0x1000
lea ecx, [rbx + 0x38]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x180011552
mov r9, qword [rsp + 0x80]
lea rax, [rsp + 0x88]
mov edx, 0x800
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea r8d, [rdx - 1]
call qword [sym.imp.msvcrt.dll__vsnwprintf_s]
nop dword [rax + rax]
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r14w
jne 0x1800114d8
lea r8d, [rax + rax]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
je 0x180011535
test ebp, ebp
je 0x180011530
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r14
mov r8d, 4
lea rdx, [0x18007ad78]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
mov ebx, r14d
jmp 0x180011543
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov eax, ebx
jmp 0x18001155b
mov eax, 0x57
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800134bc
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
movzx eax, word [rdx]
mov r14, r9
movzx r9d, word [r8]
xor ebx, ebx
mov r8, qword [r8 + 8]
mov rdi, rcx
and qword [rbp + 0x28], 0
lea rcx, [rbp + 0x28]
and qword [rbp - 0x20], 0
shr eax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rdx + 8]
lea edx, [rbx + 1]
shr r9d, 1
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x30], rbx
call fcn.1800129f0
mov rsi, qword [rbp + 0x28]
test eax, eax
je 0x18001351f
mov edi, 0xc0000017
jmp 0x180013589
mov rdx, qword [rsi]
lea rcx, [rbp - 0x18]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
and dword [rbp + 0x28], ebx
lea rax, [rbp + 0x28]
mov qword [rsp + 0x40], rax
lea r9, [rbp - 0x18]
lea rax, [rbp + 0x30]
mov edx, 0x80000000
mov qword [rsp + 0x28], rax
mov rcx, rdi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
call fcn.180061b9c
mov rbx, qword [rbp + 0x30]
mov edi, eax
test eax, eax
js 0x180013589
mov rdx, qword [rbx + 8]
mov rcx, r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x40]
test eax, eax
sete dl
mov byte [rcx], dl
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x18001359e
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test rbx, rbx
je 0x1800135b2
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test rsi, rsi
je 0x1800135bf
mov rcx, rsi
call fcn.1800119d0
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1800143fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov rdi, rcx
test rcx, rcx
jne 0x18001442a
lea eax, [rcx + 0x57]
jmp 0x18001455e
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bp
jne 0x18001442e
dec rax
lea rbx, [rcx + rax*2]
lea rax, [rcx + 2]
jmp 0x18001444e
cmp word [rbx], 0x5c
je 0x180014453
sub rbx, 2
cmp rbx, rax
ja 0x180014444
add rcx, 4
mov r15d, 3
cmp rbx, rcx
jbe 0x1800144f2
sub rbx, rdi
sar rbx, 1
mov esi, ebx
lea rcx, [rsi + 1]
cmp rcx, rsi
jb 0x1800144eb
lea r8, [rsp + 0x48]
mov qword [rsp + 0x48], rcx
call fcn.18001462c
test eax, eax
jne 0x1800144eb
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x1800144eb
lea edx, [rbx + 1]
mov r9d, esi
mov r8, rdi
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
mov rcx, r14
mov word [r14 + rsi*2], bp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebx, ebp
mov rcx, r14
cmp eax, 0xffffffff
cmove ebx, r15d
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x1800144fd
mov ebx, 8
jmp 0x1800144fd
jne 0x1800144fa
cmp word [rax], 0x3a
je 0x18001451d
mov ebx, r15d
test ebx, ebx
je 0x18001451d
cmp ebx, r15d
jne 0x180014519
mov r8d, 0x44cc
mov ecx, r15d
xor edx, edx
mov r9, rdi
call fcn.18000dc90
mov eax, ebx
jmp 0x18001455e
mov rcx, rdi
call fcn.180014580
lea rdx, [0x18007b720]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wfopen]
nop dword [rax + rax]
test rax, rax
jne 0x18001454d
lea ebx, [rax + 5]
mov r8d, 0x44cb
mov ecx, ebx
jmp 0x18001450f
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fclose]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x180014580
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x40
xor ebx, ebx
xor r9d, r9d
mov qword [rax - 0x18], rbx
xor r8d, r8d
mov dword [rax - 0x20], 0x80
mov edx, 0xc0000000
mov dword [rax - 0x28], 1
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800145d6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xb7
sete bl
jmp 0x180014616
lea r9, [rsp + 0x58]
mov word [str.0_Unicode__r_nUnicodeyes_r_n], 0xfeff
mov r8d, 0x32
mov qword [rsp + 0x20], rbx
lea rdx, str.0_Unicode__r_nUnicodeyes_r_n
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1800157d8
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x18008ab58]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, qword [rsp + 0x2c8]
mov rbx, rdx
mov rsi, qword [rsp + 0x2d0]
call qword [sym.imp.api_ms_win_core_localization_obsolete_l1_2_0.dll_GetSystemDefaultUILanguage]
nop dword [rax + rax]
mov r8, rbx
lea rcx, [rsp + 0x60]
mov edx, 0x104
movzx ebp, ax
call fcn.180017538
test eax, eax
jns 0x18001583e
movzx eax, ax
jmp 0x180015868
lea rcx, [rsp + 0x60]
call fcn.1800190a8
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rdi
mov rdx, rbx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
call fcn.18001803c
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180002a90
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180018f48
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
and qword [rax - 0x10], 0
mov rsi, r9
mov ebx, edx
xor r9d, r9d
mov rdi, r8
mov dword [rax - 0x18], ebx
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_CreateFileMappingW]
nop dword [rax + rax]
mov qword [rdi], rax
test rax, rax
je 0x180018fd2
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
nop dword [rax + rax]
mov qword [rsi], rax
test rax, rax
je 0x180018faf
xor eax, eax
jmp 0x180018fe2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [rdi]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
and qword [rdi], 0
jmp 0x180018fe0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180018ffc
Capabilities:
Get file size

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x40
and dword [rdx], 0
mov rbx, r8
or qword [r8], 0xffffffffffffffff
mov r14, r9
and qword [r9], 0
mov rsi, rdx
mov r15, qword [rsp + 0x70]
mov qword [rax - 0x18], rbx
and qword [r15], 0
call fcn.1800176e8
mov edi, eax
test eax, eax
jne 0x180019054
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
nop dword [rax + rax]
mov dword [rsi], eax
test edi, edi
jne 0x180019081
mov edx, dword [rsi]
mov r9, r15
mov rcx, qword [rbx]
mov r8, r14
call fcn.180018f48
mov edi, eax
test eax, eax
je 0x180019081
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
or qword [rbx], 0xffffffffffffffff
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret
Function at 0x18001ddc4
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x150
mov rax, qword [0x18008ab58]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbp, rcx
xor r14d, r14d
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x100
mov edi, r14d
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x40]
lea ecx, [r14 + 0x7f]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetLogicalDriveStringsW]
nop dword [rax + rax]
test eax, eax
je 0x18001dedd
lea rbx, [rsp + 0x40]
cmp word [rsp + 0x40], r14w
je 0x18001df02
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
nop dword [rax + rax]
mov edx, eax
or rsi, 0xffffffffffffffff
inc rsi
cmp word [rbx + rsi*2], r14w
jne 0x18001de49
mov eax, esi
dec rax
lea rcx, [rbx + rax*2]
lea rax, [rsp + 0x13e]
cmp rcx, rax
ja 0x18001df02
cmp edx, 3
je 0x18001de77
cmp edx, 6
jne 0x18001dec3
lea r8d, [rsi - 1]
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], r14d
mov r9d, 1
mov rdx, rbx
mov word [rbx + r8*2], r14w
mov rcx, rbp
mov byte [rsp + 0x20], 1
call fcn.18000d6e0
mov edi, eax
test eax, eax
je 0x18001dec3
mov r9, rbx
mov r8d, 0x1c36
mov edx, eax
mov ecx, 1
call fcn.180038d90
cmp edi, 8
je 0x18001ded6
mov edi, r14d
lea eax, [rsi + 1]
lea rbx, [rbx + rax*2]
cmp word [rbx], r14w
jne 0x18001de34
jmp 0x18001df02
mov edi, 8
jmp 0x18001df02
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r9, str.file_system
mov ecx, 1
mov edx, eax
mov r8d, 0x1c6d
call fcn.180038d90
mov eax, edi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180002a90
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18002afac
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
push rdi
sub rsp, 0x30
xor ebx, ebx
mov dword [rax + 8], 1
mov qword [rax + 0x10], rbx
mov rcx, qword [section..data]
lea rbp, section..data
cmp rcx, rbp
je 0x18002aff5
test byte [rcx + 0x1c], 8
je 0x18002aff5
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x1c]
lea r8, [0x180073228]
call fcn.18001171c
lea rax, [rsp + 0x48]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x18002b05c
mov rcx, qword [rsp + 0x48]
lea r9d, [rax + 4]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.FilterAdministratorToken
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x18002b06e
mov r8d, 0x1d68
mov edx, eax
mov ecx, 1
call fcn.180038d90
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18002b084
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [section..data]
cmp rcx, rbp
je 0x18002b0ae
test byte [rcx + 0x1c], 8
je 0x18002b0ae
mov rcx, qword [rcx + 0x10]
lea r8, [0x180073228]
mov edx, 0x1d
mov r9d, edi
call fcn.180011748
mov rbp, qword [rsp + 0x58]
sub ebx, edi
neg ebx
mov rbx, qword [rsp + 0x50]
sbb eax, eax
and eax, 0xc0000001
add rsp, 0x30
pop rdi
ret
Function at 0x180030194
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x18008ab58]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor esi, esi
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1800302bf
test rdx, rdx
je 0x1800302bf
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea r9d, [rsi + 5]
mov r8, rbx
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
lea r8, [0x18007a640]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
nop dword [rax + rax]
cmp eax, 3
je 0x180030241
cmp eax, 6
je 0x180030241
mov r8d, 0x1d1c
jmp 0x180030283
and dword [rsp + 0x38], esi
lea rax, [rsp + 0x40]
and qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor r9d, r9d
and qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
nop dword [rax + rax]
test eax, eax
je 0x180030293
test byte [rsp + 0x40], 8
jne 0x1800302bb
mov r8d, 0x1d1a
xor edx, edx
xor ecx, ecx
mov r9, rbx
call fcn.180038d90
and dword [rdi], esi
jmp 0x1800302bb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
xor edx, edx
mov qword [rsp + 0x20], rbx
mov r9d, eax
xor ecx, ecx
mov r8d, 0x1d1b
mov esi, eax
call fcn.180038d90
and dword [rdi], 0
mov eax, esi
jmp 0x1800302c4
mov eax, 0x57
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180002a90
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180030608
Capabilities:
Get common file path

Disassembly:
test rcx, rcx
je 0x18003072a
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x18008ab58]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov dword [rsp + 0x20], 0x104
xor r14d, r14d
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov word [rsp + 0x30], r14w
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x1800306db
mov edi, r14d
cmp word [rsp + 0x30], r14w
je 0x180030703
mov eax, r14d
movzx ebp, word [rax + rsi]
test bp, bp
je 0x1800306c4
movzx ecx, word [rsp + rax + 0x30]
cmp cx, 0x3a
je 0x1800306c4
cmp bp, 0x3a
je 0x1800306c4
call qword [sym.imp.msvcrt.dll_towlower]
nop dword [rax + rax]
movzx ecx, bp
movzx ebx, ax
call qword [sym.imp.msvcrt.dll_towlower]
nop dword [rax + rax]
cmp bx, ax
jne 0x1800306c4
inc edi
mov eax, edi
add rax, rax
cmp word [rsp + rax + 0x30], r14w
jne 0x180030678
test edi, edi
je 0x180030703
mov eax, edi
cmp word [rsp + rax*2 + 0x30], 0x3a
jne 0x180030703
cmp word [rsi + rax*2], 0x3a
je 0x1800306f1
jmp 0x180030703
lea r9, str._USERPROFILE_
xor edx, edx
xor ecx, ecx
mov r8d, 0x1d32
call fcn.180038d90
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov r8d, 0x1d1f
call fcn.180038d90
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180002a90
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18003db24
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x18008ab58]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor r12d, r12d
mov r14d, edx
mov qword [rsp + 0x48], r12
mov eax, r8d
mov dword [rsp + 0x44], eax
mov rdi, rcx
test edx, edx
je 0x18003dcf6
test eax, eax
je 0x18003dcf6
lea rdx, [r14 + r14]
lea ecx, [r12 + 0x40]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov qword [rsp + 0x50], rax
mov r15, rax
test rax, rax
je 0x18003dcd4
lea r9d, [r14 - 1]
mov r8, rdi
mov edx, r14d
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
lea r9, [rsp + 0x48]
mov r8d, 0x20019
mov rdx, r15
lea ecx, [r12 + 4]
call fcn.18005cd24
mov ebx, eax
test eax, eax
jne 0x18003dcc3
xor r15d, r15d
mov r13d, r15d
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], r15
mov edx, r13d
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov ebx, eax
mov r12, r14
test eax, eax
jne 0x18003dc56
lea rcx, [rdi + r14*2]
inc r13d
lea rdx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x18003dc5e
cmp ebx, 0x103
jne 0x18003dbe0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov r15, qword [rsp + 0x50]
test ebx, ebx
jne 0x18003dcb5
mov eax, dword [rsp + 0x40]
lea rcx, [rdi + r12*2]
cmp eax, dword [rsp + 0x44]
lea r8, [rsp + 0x60]
cmova eax, dword [rsp + 0x44]
mov r9d, eax
mov dword [rsp + 0x40], eax
lea edx, [rax + 1]
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
mov eax, dword [rsp + 0x40]
add rax, r12
xor r12d, r12d
mov word [rdi + rax*2], r12w
jmp 0x18003dcc3
cmp ebx, 0x103
mov eax, 2
cmove ebx, eax
mov rcx, r15
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x18003dcd9
mov ebx, 8
test ebx, ebx
je 0x18003dced
lea rcx, [rdi + r14*2]
call qword [sym.imp.msvcrt.dll__wcsupr]
nop dword [rax + rax]
mov ecx, ebx
call fcn.18000ec90
jmp 0x18003dd04
call qword [sym.imp.msvcrt.dll__wcsupr]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.180002a90
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret