joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009d850
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14009d875
xor eax, eax
jmp 0x14009d972
cmp qword [rcx + 0x68], 0
je 0x14009d886
call fcn.14007d800
jmp 0x14009d972
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x14009d89d
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14009d89f
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14009d8d4
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14003a540
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov r8, rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14009d96c
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14009d90f
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x14009d947
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.1402cbe90
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x14009d983
cmp rbp, r15
ja 0x14009d91d
mov r8, rbx
test rbx, rbx
je 0x14009d96c
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.1402cbe90
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
sub rdi, rbp
jmp 0x14009d96f

Function at 0x1400a9714
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
lea rdx, [rbp + 0x1b0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, str.aria_.log
lea rdx, [rbp + 0x1b0]
lea rcx, [rsp + 0x40]
call fcn.14007abb0
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400a97dc
lea r8, [rbp - 0x74]
lea rdx, [rbp + 0x1b0]
lea rcx, [rsp + 0x20]
call fcn.14007abb0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x20]
call fcn.14001b814
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400a978a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x40]
call fcn.14001b814
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.140038910
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4d0
pop rbp
ret
Function at 0x1400a9be0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov qword [rbp - 0x38], rdx
xor edi, edi
mov dword [rbp - 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], di
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x1400a9c2a
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.14001b664
nop
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov r8d, 0x18
lea rdx, str.parentTelemetryCache.otc
mov rcx, rbx
call fcn.14001b664
mov dword [rbp - 0x40], 1
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
mov qword [rsp + 0x20], 8
lea r9, str._peruser
xor r8d, r8d
mov rdx, qword [rbp - 0x20]
call fcn.14001a52c
cmp rax, 0xffffffffffffffff
je 0x1400a9cae
mov r8d, socket
lea rdx, str.userTelemetryCache.otc
jmp 0x1400a9ceb
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
mov qword [rsp + 0x20], listen
lea r9, str._permachine
xor r8d, r8d
mov rdx, qword [rbp - 0x20]
call fcn.14001a52c
cmp rax, 0xffffffffffffffff
je 0x1400a9cf4
mov r8d, 0x19
lea rdx, str.machineTelemetryCache.otc
mov rcx, rbx
call fcn.14001b664
nop
lea rcx, [rbp - 0x30]
call fcn.14001b814
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140038910
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x1400b8820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + rcx]
movabs r9, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r9
cmp r8, 2
jb 0x1400b882d
mov rax, rdx
ret
Function at 0x1400b8df4
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rbp + 0x2f], rax
and qword [rbp - 1], 0
mov rdi, r9
movsxd r14, r8d
mov rsi, rdx
mov rbx, rcx
lea rdx, [0x140302f30]
xor r9d, r9d
lea rcx, [rbp - 1]
xor r8d, r8d
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
jns 0x1400b8e4a
mov eax, 0x8004fb21
jmp 0x1400b8f81
mov rcx, qword [rbp - 1]
lea r8, str.ChainingModeCBC
and dword [rsp + 0x20], 0
lea rdx, str.ChainingMode
mov r9d, 0x20
call sub.bcrypt.dll_BCryptSetProperty
test eax, eax
jns 0x1400b8e7a
mov eax, 0x8004fb22
jmp 0x1400b8f81
mov ecx, dword [rbx + 0x18]
lea rdx, [rbp + 7]
sub ecx, dword [rbx + 0x10]
xor r9d, r9d
and dword [rsp + 0x30], 0
xor r8d, r8d
mov rax, qword [rbx + 0x10]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp - 1]
mov qword [rsp + 0x20], rax
call sub.bcrypt.dll_BCryptGenerateSymmetricKey
test eax, eax
jns 0x1400b8eb3
mov eax, 0x8004fb24
jmp 0x1400b8f81
mov r9b, byte [rbp - 9]
lea r8, [rsi + r14]
and dword [rbp + 0xf], 0
lea rcx, [rbp + 0x17]
and qword [rbp + 0x27], 0
xorps xmm0, xmm0
mov rdx, rsi
movdqu xmmword [rbp + 0x17], xmm0
call fcn.1400b8850
mov ecx, dword [rdi + 8]
lea rdx, [rbp + 0xf]
sub ecx, dword [rdi]
xor r9d, r9d
mov rax, qword [rdi]
mov r8d, dword [rbp + 0x1f]
mov rbx, qword [rbp + 0x17]
mov dword [rsp + 0x48], 1
sub r8d, ebx
mov qword [rsp + 0x40], rdx
mov rdx, rbx
mov dword [rsp + 0x38], ecx
mov rcx, qword [rbp + 7]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
jns 0x1400b8f2a
mov edi, 0x8004fb23
jmp 0x1400b8f4a
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x1400b8f3a
xor edx, edx
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x1400b8f48
call sub.bcrypt.dll_BCryptDestroyKey
xor edi, edi
test rbx, rbx
je 0x1400b8f7f
mov rdx, qword [rbp + 0x27]
mov rax, rbx
sub rdx, rbx
cmp rdx, 0x1000
jb 0x1400b8f77
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b8f9b
mov rcx, rbx
call fcn.1400385dc
mov eax, edi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140038910
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14004689c
int3

Function at 0x1400bb470
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x28
mov rdx, qword [rdx]
mov r9d, 2
xor ecx, ecx
lea r8d, [r9 + 0x1e]
call sub.bcrypt.dll_BCryptGenRandom
xor ecx, ecx
mov edx, 0x8004fb29
test eax, eax
cmovs ecx, edx
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1400deff0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp fcn.140036a80
Function at 0x1400f2374
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x1400f24fc
cmp ecx, 0x7c
je 0x1400f24fc
cmp ecx, 0x29
jne 0x1400f23b7
cmp dword [rbx + 0x1c], 0
jne 0x1400f24fc
test dword [rbx + 0x80], 0x10000000
je 0x1400f2523
cmp ecx, 0x2e
jne 0x1400f23d7
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.1400f508c
mov rcx, rbx
call fcn.1400f50f0
jmp 0x1400f24ea
cmp ecx, 0x5c
jne 0x1400f2438
mov rcx, rbx
call fcn.1400f50f0
test byte [rbx + 0x80], 0x80
je 0x1400f242b
mov al, byte [rbx + 0x78]
cmp al, 0x62
jne 0x1400f240f
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.1400f508c
mov rcx, rbx
call fcn.1400f50f0
jmp 0x1400f24f2
cmp al, 0x42
jne 0x1400f242b
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.1400f508c
mov rax, qword [rbx + 0x48]
xor dword [rax + 0xc], 1
jmp 0x1400f2402
mov rcx, rbx
call fcn.1400f2540
jmp 0x1400f24ea
cmp ecx, 0x5b
jne 0x1400f245c
mov rcx, rbx
call fcn.1400f50f0
mov rcx, rbx
call fcn.1400f2a58
cmp dword [rbx + 0x7c], 0x5d
jne 0x1400f2515
jmp 0x1400f23ca
cmp ecx, 0x28
jne 0x1400f2480
mov rcx, rbx
call fcn.1400f50f0
mov rcx, rbx
call fcn.1400f53d4
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x1400f2523
jmp 0x1400f24dd
cmp ecx, 0x5e
jne 0x1400f248d
lea edx, [rcx - 0x5c]
jmp 0x1400f23f9
cmp ecx, 0x24
jne 0x1400f249a
lea edx, [rcx - 0x21]
jmp 0x1400f23f9
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x1400f2507
cmp ecx, 0x3f
je 0x1400f2507
cmp ecx, 0x7b
je 0x1400f2507
cmp ecx, 0x7d
jne 0x1400f24bd
test dword [rbx + 0x80], 0x10000000
je 0x1400f2531
cmp ecx, 0x5d
jne 0x1400f24ce
test dword [rbx + 0x80], 0x10000000
je 0x1400f2515
mov dl, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.1400f1938
mov dil, 1
mov rcx, rbx
call fcn.1400f50f0
test dil, dil
je 0x1400f24f2
mov rcx, rbx
call fcn.1400f5140
mov ecx, dword [rbx + 0x7c]
mov al, 1
jmp 0x1400f2386
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
mov rcx, rbx
call fcn.1400f3c1c
int3
mov edx, 4
mov rcx, rbx
call fcn.1400f3c1c
int3
mov edx, 5
mov rcx, rbx
call fcn.1400f3c1c
int3
mov edx, 6
mov rcx, rbx
call fcn.1400f3c1c
int3
Function at 0x1401057bc
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor edx, edx
mov rcx, qword [rcx + 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1401057f1
mov edi, 0x80004004
mov r8d, 0x274
mov ecx, edi
jmp 0x1401058f8
lea rdi, [rbx + 0x108]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x14010581e
and qword [rbx + 0x58], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.0B__]
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, str.BITS
lea rax, str.URLMon
cmp byte [rbx + 0x175], 0
cmovne rax, rcx
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, str.WebClient__p_:_BeginDownloadAttempt:_using__ls
lea rdx, str.WebClient
mov ecx, dword [rbx + 0x16c]
call fcn.140065bb0
cmp byte [rbx + 0x175], 0
je 0x140105884
mov rcx, rbx
call fcn.140105940
mov edi, eax
test eax, eax
jns 0x140105904
mov r8d, 0x27d
jmp 0x1401058f6
cmp byte [rbx + 0x40], 0
je 0x1401058c7
mov r9, rbx
lea r8, str.WebClient__p_:_BeginDownloadAttempt:_using_WinHTTP_instead_of_URLMon
lea rdx, str.WebClient
mov ecx, dword [rbx + 0x16c]
call fcn.140065bb0
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x90]
call qword [str.0B__]
mov edi, eax
test eax, eax
jns 0x140105904
mov r8d, 0x282
jmp 0x1401058f6
call fcn.1400718fc
lea rdx, [rbx + 0xb0]
cmp qword [rdx + 0x18], 8
jb 0x1401058dd
mov rdx, qword [rdx]
mov r9, rbx
xor r8d, r8d
xor ecx, ecx
call sub.urlmon.dll_URLOpenStreamW
mov edi, eax
test eax, eax
jns 0x140105904
mov r8d, 0x286
mov ecx, eax
lea rdx, str.D:dbs_shodct0417_084611_0cmdwclientonedriveSetup_standalonewebclientwebclient.cpp
call fcn.140064438
mov r9, rbx
lea r8, str.WebClient__p_:_Leaving_BeginDownloadAttempt__
lea rdx, str.WebClient
mov ecx, edi
call fcn.140064998
test edi, edi
jns 0x140105932
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x78]
mov edx, edi
mov rcx, rbx
call qword [str.0B__]
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1401061e4
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
cmp qword [rcx + 0xf0], rsi
je 0x1401062a6
cmp qword [rcx + 0xa0], rsi
je 0x1401062a6
call fcn.1400718fc
lea rbx, [rdi + 0x90]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x14010622b
mov rdx, qword [rbx]
mov rcx, qword [rdi + 0xf0]
lea r8, str.GUID
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call fcn.1400718fc
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x140106251
mov rdx, qword [rbx]
mov rcx, qword [rdi + 0xf0]
lea r8, str.File
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call fcn.1400718fc
cmp qword [rbx + 0x18], 8
jb 0x140106274
mov rbx, qword [rbx]
mov rcx, qword [rdi + 0xf0]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp qword [rdi + 0xe8], 8
lea rax, [rdi + 0xd0]
jb 0x14010629c
mov rax, qword [rdi + 0xd0]
mov qword [rdi + 0xe0], rsi
mov word [rax], si
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401062b8
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
cmp qword [rcx + 0xe0], rdi
je 0x1401063fa
lea rbx, [rcx + 0xd0]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140106304
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401063e6
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
lea rsi, vtable.ClassPtr_struct_IFSManager_.0
mov qword [rbp + 7], rsi
mov qword [rbp + 0xf], rdi
lea rcx, [rbp + 0xf]
call fcn.140064b5c
test eax, eax
js 0x1401063c7
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140106346
mov rdx, qword [rbx]
mov qword [rbp - 0x19], rdi
movdqa xmm0, xmmword [0x140364f60]
movdqu xmmword [rbp - 9], xmm0
mov word [rbp - 0x19], di
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], di
jne 0x14010635f
lea rcx, [rbp - 0x19]
call fcn.14001b664
nop
mov qword [rbp + 0x17], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x27], xmm0
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x17]
call fcn.140019c78
mov qword [rbp + 0x37], 0xffffffff80000001
mov byte [rbp + 0x3f], dil
lea rcx, [rbp - 0x19]
call fcn.14001b814
mov rcx, qword [rbp + 0xf]
test rcx, rcx
jne 0x1401063ab
int3
mov rax, qword [rcx]
lea rdx, [rbp + 0x17]
mov rax, qword [rax + 0x78]
call qword [str.0B__]
nop
lea rcx, [rbp + 0x17]
call fcn.14001b814
nop
mov qword [rbp + 7], rsi
mov rcx, qword [rbp + 0xf]
mov qword [rbp + 0xf], rdi
test rcx, rcx
je 0x1401063e6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.0B__]
nop
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1401063f3
mov rax, qword [rbx]
mov qword [rbx + 0x10], rdi
mov word [rax], di
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140038910
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140107644
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rsi, rcx
mov ebx, 0x208
mov r8d, ebx
lea rcx, [r11 - 0x228]
xor edx, edx
call fcn.14003a220
mov r8d, ebx
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.14003a220
mov edi, 0x104
lea rdx, [rsp + 0x230]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor ebp, ebp
test eax, eax
jne 0x1401076e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x140107786
mov r8d, 0x53c
lea rdx, str.D:dbs_shodct0417_084611_0cmdwclientonedriveSetup_standalonewebclientwebclient.cpp
mov ecx, ebx
call fcn.140064438
jmp 0x140107786
lea r9, [rsp + 0x20]
xor r8d, r8d
lea rdx, [0x1403225c8]
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x140107726
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x140107786
mov r8d, 0x53d
jmp 0x1401076d2
lea rax, [rsp + 0x20]
cmp word [rax], bp
je 0x14010773a
add rax, 2
sub rdi, 1
jne 0x14010772b
mov rax, rdi
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rdi, rdi
jne 0x14010775a
mov r8d, 0x53e
jmp 0x1401076d2
mov rcx, rsi
call fcn.1401062b8
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bp
jne 0x14010776b
lea rcx, [rsi + 0xd0]
lea rdx, [rsp + 0x20]
call fcn.14001b664
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140038910
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140108a0c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x14035dea0]
lea rbp, [rcx + 0x130]
mov rdi, rcx
cmp rax, qword [rbp]
jne 0x140108a66
mov rax, qword [0x14035dea8]
cmp rax, qword [rbp + 8]
jne 0x140108a66
mov r8d, 0x4bd
mov ecx, 0x80004005
mov ebx, ecx
lea rdx, str.D:dbs_shodct0417_084611_0cmdwclientonedriveSetup_standalonewebclientwebclient.cpp
call fcn.140064438
jmp 0x140108b8b
xor esi, esi
cmp qword [rcx + 0xe0], rsi
jne 0x140108a79
mov r8d, 0x4be
jmp 0x140108a4e
add rcx, 0xd0
cmp qword [rcx + 0x18], 8
jb 0x140108a8a
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r14, rax
test rax, rax
jne 0x140108aa7
mov ebx, 0x8000ffff
mov r8d, 0x4c4
mov ecx, ebx
jmp 0x140108a55
mov edx, 0x104
mov ecx, edx
cmp word [rax], si
je 0x140108abd
add rax, 2
sub rcx, 1
jne 0x140108aae
mov rax, rcx
neg rax
mov rax, rcx
sbb ebx, ebx
sub rdx, rcx
not ebx
and ebx, 0x80070057
neg rax
sbb r15, r15
and r15, rdx
test rcx, rcx
jne 0x140108ae9
mov r8d, 0x4c5
jmp 0x140108aa3
cmp qword [rdi + 0xe0], r15
ja 0x140108af3
int3
mov rcx, rdi
call fcn.140106114
mov ebx, eax
test eax, eax
jns 0x140108b0e
mov r8d, 0x4c9
mov ecx, eax
jmp 0x140108a55
call fcn.1400718fc
lea rsi, [rdi + 0x90]
cmp qword [rsi + 0x18], 8
mov rdx, rsi
jb 0x140108b27
mov rdx, qword [rsi]
mov rcx, qword [rdi + 0xf0]
lea r8, str.GUID
mov dword [rsp + 0x28], setsockopt
mov r9d, 3
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.1400718fc
cmp qword [rsi + 0x18], 8
lea eax, [r15*2 + 2]
jb 0x140108b65
mov rsi, qword [rsi]
mov rcx, qword [rdi + 0xf0]
lea r8, str.File
mov dword [rsp + 0x28], eax
mov r9d, 1
mov rdx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14010b550
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.14010aeb8
xor ebx, ebx
cmp qword [rsp + 0x30], rbx
je 0x14010b5b3
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14010b5b3
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x14010b5b3
mov bl, 1
lea rcx, [rsp + 0x20]
call fcn.14001b814
mov al, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140038910
add rsp, 0x50
pop rbx
ret
Function at 0x14010f8c0
Capabilities:
Delete registry value

Disassembly:
movzx r9d, r9b
add r9d, r9d
jmp 0x14010f8cc
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r8
mov eax, 0x200
xor r8d, r8d
mov r10, rcx
cmp r9d, 1
mov ecx, 0x100
cmove r8d, eax
xor eax, eax
cmp r9d, 2
cmove eax, ecx
mov rcx, qword [0x1403c32e8]
or r8d, eax
or r8d, 0x1000b
cmp qword [rdx + 0x18], 8
mov rax, qword [rcx]
jb 0x14010f924
mov rdx, qword [rdx]
mov rax, qword [rax + 0x128]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], r9
xor r9d, r9d
mov dword [rsp + 0x20], r8d
mov r8, rdx
mov rdx, r10
call qword [str.0B__]
mov ebx, eax
test eax, eax
jne 0x14010f985
cmp qword [rdi + 0x18], 8
jb 0x14010f959
mov rdi, qword [rdi]
mov rcx, qword [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [0x1403c32e8]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x120]
call qword [str.0B__]
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140038910
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x14010ff84
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, r9
movzx r15d, r8b
mov rdi, rdx
mov r12, rcx
mov r14, qword [r9 + 8]
mov rbx, qword [r9]
cmp rbx, r14
je 0x14010ffdc
mov rcx, rbx
call fcn.14001b814
add rbx, 0x20
cmp rbx, r14
jne 0x14010ffc8
mov rbx, qword [rsi]
mov qword [rsi + 8], rbx
mov r9d, r15d
shl r9d, 8
or r9d, 0x20019
xor r15d, r15d
mov qword [rsp + 0x40], r15
cmp qword [rdi + 0x18], 8
jb 0x140110000
mov rdi, qword [rdi]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
mov r12d, 0x80070000
or ebx, r12d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140110120
mov r14, r15
mov dword [rsp + 0x48], 0xff
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x70]
mov edx, r14d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test eax, eax
jne 0x1401100f5
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x140110095
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14001b664
nop
mov rax, qword [rsi + 8]
cmp rax, qword [rsi + 0x10]
je 0x1401100d8
mov qword [rax], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140019c78
add qword [rsi + 8], 0x20
jmp 0x1401100e9
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, rsi
call fcn.140033040
nop
lea rcx, [rsp + 0x50]
call fcn.14001b814
jmp 0x1401100fd
cmp edi, 0x103
jne 0x14011010a
inc r14
test edi, edi
je 0x140110035
jmp 0x140110115
movzx ebx, di
or ebx, r12d
test edi, edi
cmovle ebx, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140038910
add rsp, 0x280
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret