joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008fadc
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
and dword [rax + 0x10], 0
lea r8, [rax + 0x10]
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
je 0x14008fb24
lea r8, str._fRet
mov edx, 0x78
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.1400876c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x800700ea
jne 0x14008fbd7
mov ecx, dword [rsp + 0x38]
xor ebx, ebx
inc ecx
add rcx, rcx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14008fb70
mov ebx, 0x8007000e
jmp 0x14008fbd7
mov r8d, dword [rsp + 0x38]
xor edx, edx
inc r8d
mov rcx, rdi
add r8, r8
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x38]
mov rdx, rdi
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
jne 0x14008fbbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14008fbc3
mov qword [rsi], rdi
xor edi, edi
test rdi, rdi
je 0x14008fbd7
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400901f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, r9
mov r14, r8
mov rsi, rdx
mov r12, rcx
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x14009024a
test byte [rcx + 0x1c], 1
je 0x14009024a
cmp byte [rcx + 0x19], 4
jb 0x14009024a
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x18
call fcn.140004b70
mov r15, qword [rsp + 0x90]
xor ebx, ebx
and dword [rsp + 0x30], ebx
and dword [rsp + 0x80], ebx
test r14, r14
je 0x140090273
test rsi, rsi
je 0x140090273
test rbp, rbp
je 0x140090273
test r15, r15
jne 0x14009028b
lea r8, str.ppbValue___NULL__wszValueName___NULL__lpType___NULL__lpSize___NULL
mov edx, 0x1c0
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.1400876c8
and qword [r14], rbx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
xor r9d, r9d
and qword [rsp + 0x20], rbx
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140090316
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017a048]
lea rbp, [0x14017a048]
cmp rcx, rbp
je 0x140090459
test byte [rcx + 0x1c], 1
je 0x140090433
cmp byte [rcx + 0x19], 3
jb 0x140090433
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x19
mov dword [rsp + 0x20], ebx
mov r9, rsi
call fcn.140005ca0
jmp 0x14009042c
mov eax, dword [rsp + 0x80]
test eax, eax
jne 0x140090340
lea r8, str.cbSize___0
mov edx, 0x1ce
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.1400876c8
mov eax, dword [rsp + 0x80]
mov ecx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140090367
mov ebx, 0x8007000e
lea rbp, [0x14017a048]
jmp 0x14009042c
mov r8d, dword [rsp + 0x80]
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x1400903f4
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017a048]
lea rbp, [0x14017a048]
cmp rcx, rbp
je 0x140090418
test byte [rcx + 0x1c], 1
je 0x140090418
cmp byte [rcx + 0x19], 2
jb 0x140090418
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x1a
mov dword [rsp + 0x20], ebx
mov r9, rsi
call fcn.140005ca0
jmp 0x140090411
mov eax, dword [rsp + 0x30]
mov dword [rbp], eax
lea rbp, [0x14017a048]
mov eax, dword [rsp + 0x80]
mov qword [r14], rdi
xor edi, edi
mov dword [r15], eax
mov rcx, qword [0x14017a048]
test rdi, rdi
je 0x140090433
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
cmp rcx, rbp
je 0x140090459
test byte [rcx + 0x1c], 1
je 0x140090459
cmp byte [rcx + 0x19], 4
jb 0x140090459
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x1b
call fcn.140004b70
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140090644
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14017a608]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov rcx, qword [0x14017a048]
lea r14, [0x14017a048]
cmp rcx, r14
je 0x14009069a
test byte [rcx + 0x1c], 1
je 0x14009069a
cmp byte [rcx + 0x19], 4
jb 0x14009069a
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x1f
call fcn.140004b70
xor ebx, ebx
lea r8, [rsp + 0x38]
xor eax, eax
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
mov rcx, rdi
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x34]
lea r9d, [rbx + 0xc]
mov dword [rsp + 0x34], ebx
lea edx, [rbx + 5]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryKey]
nop dword [rax + rax]
test eax, eax
jns 0x140090704
mov ecx, eax
call fcn.14003bb54
mov ebx, eax
mov rcx, qword [0x14017a048]
cmp rcx, r14
je 0x140090797
test byte [rcx + 0x1c], 1
je 0x140090771
cmp byte [rcx + 0x19], 2
jb 0x140090771
mov edx, 0x20
jmp 0x140090757
mov eax, dword [rsp + 0x40]
lea r8, [rsp + 0x30]
mov r9d, 4
or eax, 0xe
mov rcx, rdi
mov dword [rsp + 0x30], eax
lea edx, [r9 - 2]
call qword [sym.imp.ntdll.dll_NtSetInformationKey]
nop dword [rax + rax]
test eax, eax
jns 0x14009076a
mov ecx, eax
call fcn.14003bb54
mov ebx, eax
mov rcx, qword [0x14017a048]
cmp rcx, r14
je 0x140090797
test byte [rcx + 0x1c], 1
je 0x140090771
cmp byte [rcx + 0x19], 2
jb 0x140090771
mov edx, 0x21
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov r9d, eax
call fcn.140004b9c
mov rcx, qword [0x14017a048]
cmp rcx, r14
je 0x140090797
test byte [rcx + 0x1c], 1
je 0x140090797
cmp byte [rcx + 0x19], 4
jb 0x140090797
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x22
call fcn.140004b70
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014b700
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x1400907c0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov r14, rcx
mov rcx, qword [0x14017a048]
lea r12, [0x14017a048]
cmp rcx, r12
je 0x140090818
test byte [rcx + 0x1c], 1
je 0x140090818
cmp byte [rcx + 0x19], 4
jb 0x140090818
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x23
call fcn.140004b70
mov eax, dword [rsp + 0x70]
mov r9d, esi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, r14
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x14009088a
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x14009087a
test byte [rcx + 0x1c], 1
je 0x14009087a
cmp byte [rcx + 0x19], 2
jb 0x14009087a
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x24]
xor r9d, r9d
lea r8, [0x140159578]
call fcn.140004b9c
mov rcx, qword [0x14017a048]
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x140090891
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400908b7
test byte [rcx + 0x1c], 1
je 0x1400908b7
cmp byte [rcx + 0x19], 4
jb 0x1400908b7
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x25
call fcn.140004b70
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x1400908dc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov ebp, r9d
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140090927
test byte [rcx + 0x1c], 1
je 0x140090927
cmp byte [rcx + 0x19], 4
jb 0x140090927
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x26
call fcn.140004b70
xor ebx, ebx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x78], ebx
mov dword [rdi], ebx
test rsi, rsi
jne 0x140090950
lea r8, str.wszValueName
mov edx, 0x2d5
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.1400876c8
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ecx, eax
test ebp, ebp
je 0x140090996
cmp eax, 2
jne 0x140090996
lea ebx, [rax - 1]
jmp 0x140090a0c
test ecx, ecx
je 0x1400909ea
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov ebx, eax
mov rcx, qword [0x14017a048]
lea rdi, [0x14017a048]
cmp rcx, rdi
je 0x140090a40
test byte [rcx + 0x1c], 1
je 0x140090a1a
cmp byte [rcx + 0x19], 3
jb 0x140090a1a
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x27
mov dword [rsp + 0x20], eax
mov r9, rsi
call fcn.140005ca0
jmp 0x140090a13
cmp dword [rsp + 0x78], 4
je 0x1400909f8
mov ebx, 0x8007065d
jmp 0x140090a0c
cmp dword [rsp + 0x68], 4
je 0x140090a06
mov ebx, 0x80004005
jmp 0x140090a0c
mov eax, dword [rsp + 0x70]
mov dword [rdi], eax
lea rdi, [0x14017a048]
mov rcx, qword [0x14017a048]
cmp rcx, rdi
je 0x140090a40
test byte [rcx + 0x1c], 1
je 0x140090a40
cmp byte [rcx + 0x19], 4
jb 0x140090a40
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x28
call fcn.140004b70
mov eax, ebx
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140090a54
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, r9
mov r15, r8
mov rbp, rcx
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140090aa6
test byte [rcx + 0x1c], 1
je 0x140090aa6
cmp byte [rcx + 0x19], 4
jb 0x140090aa6
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x2c
call fcn.140004b70
xor ebx, ebx
mov dword [rsp + 0x70], ebx
xor ecx, ecx
mov qword [r15], rbx
mov dword [r14], ebx
lea esi, [rbx + 0x40]
mov dword [rsp + 0x68], esi
jmp 0x140090b42
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140090af7
test byte [rcx + 0x1c], 1
je 0x140090af7
cmp byte [rcx + 0x19], 4
jb 0x140090af7
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x2d
mov r9d, esi
call fcn.140004b9c
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.RestoredVolumes
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140090c13
cmp eax, 0xea
jne 0x140090bc5
mov esi, dword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140090ac0
mov ebx, 0x8007000e
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140090bb1
test byte [rcx + 0x1c], 1
je 0x140090bb1
cmp byte [rcx + 0x19], 4
jb 0x140090bb1
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x2f
call fcn.140004b70
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x140090b6e
test byte [rcx + 0x1c], 1
je 0x140090b6e
cmp byte [rcx + 0x19], 2
jb 0x140090b6e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x2e
mov r9d, ebx
call fcn.140004b9c
jmp 0x140090b6e
cmp dword [rsp + 0x70], 7
je 0x140090c24
mov ebx, 0x8000ffff
jmp 0x140090b6e
mov eax, dword [rsp + 0x68]
mov qword [r15], rdi
mov rdi, rbx
mov dword [r14], eax
jmp 0x140090b6e
Function at 0x140090ce4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, rcx
mov qword [rax + 8], rbx
test rcx, rcx
jne 0x140090d1f
lea r8, str.pwszBlbWindowsDirectoryPath___NULL
mov edx, 0x63c
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.1400876c8
and qword [r14], rbx
mov edi, 0x208
mov ecx, edi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x140090d44
mov edi, 0x8007000e
jmp 0x140090db0
mov r8, rdi
xor edx, edx
mov rcx, rsi
call sub.msvcrt.dll_memset
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x140090d8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140088360
mov edi, eax
test eax, eax
js 0x140090d88
mov rax, qword [rsp + 0x30]
mov qword [r14], rax
jmp 0x140090d8d
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
test rbx, rbx
je 0x140090db0
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140091d64
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [0x14017a048]
lea r15, [0x14017a048]
cmp rcx, r15
je 0x140091db4
test byte [rcx + 0x1c], 1
je 0x140091db4
cmp byte [rcx + 0x19], 4
jb 0x140091db4
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, 0x8f
call fcn.140004b70
test rsi, rsi
jne 0x140091dd1
lea r8, str.pwszWindowsTempPath
mov edx, 0xa75
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.1400876c8
and qword [rsi], 0
mov ecx, 0x28
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140091df8
mov ebx, 0x8007000e
jmp 0x140091f46
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov rdx, rdi
movups xmmword [rdi + 0x10], xmm0
lea ecx, [rax + 0x14]
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x14
jbe 0x140091ee7
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov eax, ebx
mov ecx, 0xffffffff
add rax, rax
cmp rax, rcx
ja 0x140091ee0
mov ecx, eax
mov ebp, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140091dee
mov r8d, ebp
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rdx, rdi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
nop dword [rax + rax]
cmp eax, ebx
ja 0x140091e89
test eax, eax
jne 0x140091f24
test eax, eax
jne 0x140091ea9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140091eae
mov ebx, 0x8007000e
mov rcx, qword [0x14017a048]
cmp rcx, r15
je 0x140091f32
test byte [rcx + 0x1c], 1
je 0x140091f32
cmp byte [rcx + 0x19], 2
jb 0x140091f32
mov edx, 0x90
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov r9d, ebx
call fcn.140004b9c
jmp 0x140091f2b
mov ebx, 0x80070216
jmp 0x140091f46
test eax, eax
jne 0x140091f24
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017a048]
cmp rcx, r15
je 0x140091f32
test byte [rcx + 0x1c], 1
je 0x140091f32
cmp byte [rcx + 0x19], 2
jb 0x140091f32
mov edx, SysAllocStringByteLen
jmp 0x140091ecb
mov qword [rsi], rdi
xor edi, edi
xor ebx, ebx
mov rcx, qword [0x14017a048]
test rdi, rdi
je 0x140091f4d
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
cmp rcx, r15
je 0x140091f73
test byte [rcx + 0x1c], 1
je 0x140091f73
cmp byte [rcx + 0x19], 4
jb 0x140091f73
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159578]
mov edx, DllRegisterServer
call fcn.140004b70
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x14009297c
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov esi, r9d
mov rdi, r8
mov rbp, rdx
test rdx, rdx
jne 0x1400929b8
lea r8, str.hCryptHash
mov edx, 0x206
lea rcx, str.base_stor_blbutilchecksum.cpp
call fcn.1400876c8
test rdi, rdi
jne 0x1400929d5
lea r8, [0x1401595d8]
mov edx, 0x207
lea rcx, str.base_stor_blbutilchecksum.cpp
call fcn.1400876c8
test esi, esi
je 0x140092a37
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.bcrypt.dll_BCryptHashData]
nop dword [rax + rax]
test eax, eax
jns 0x140092a6e
mov ecx, eax
call fcn.14003bb54
mov ebx, eax
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x140092a6e
test byte [rcx + 0x1c], 1
je 0x140092a6e
cmp byte [rcx + 0x19], 2
jb 0x140092a6e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401596a0]
mov edx, 0x13
mov r9d, eax
call fcn.140004b9c
jmp 0x140092a6e
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x140092a6e
test byte [rcx + 0x1c], 1
je 0x140092a6e
cmp byte [rcx + 0x19], 5
jb 0x140092a6e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401596a0]
mov edx, 0x14
mov r9, rdi
call fcn.140010438
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140096fe0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x14017a608]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
test rcx, rcx
jne 0x140097024
lea r8, str.pwszLogsDirectory
mov edx, 0x23c
lea rcx, str.base_stor_blbutil_blbtrace.cpp
call fcn.1400876c8
and qword [rdi], 0
mov rcx, qword [0x14017a048]
lea rsi, [0x14017a048]
cmp rcx, rsi
je 0x14009705c
test byte [rcx + 0x1c], 1
je 0x14009705c
cmp byte [rcx + 0x19], 4
jb 0x14009705c
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159d28]
mov edx, 0x23
call fcn.140004b70
mov ebx, 0x208
lea rcx, [rsp + 0x20]
mov r8d, ebx
xor edx, edx
call sub.msvcrt.dll_memset
mov r8d, ebx
lea rcx, [rsp + 0x230]
xor edx, edx
call sub.msvcrt.dll_memset
lea r8, str._SystemRoot_Logs
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.14003bbe8
mov ebx, eax
test eax, eax
js 0x1400970f2
mov r8d, 0x104
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
jne 0x1400970dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400970f2
xor r8d, r8d
lea rcx, [rsp + 0x230]
mov rdx, rdi
call fcn.14008859c
mov ebx, eax
mov rcx, qword [0x14017a048]
cmp rcx, rsi
je 0x14009711f
test byte [rcx + 0x1c], 1
je 0x14009711f
cmp byte [rcx + 0x19], 4
jb 0x14009711f
mov rcx, qword [rcx + 0x10]
lea r8, [0x140159d28]
mov edx, 0x24
call fcn.140004b70
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14014b700
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400a659c
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x30
mov rsi, rdx
lea r15, [0x14017a048]
mov rbp, rcx
xor edi, edi
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400a6642
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x20
jne 0x1400a6679
mov rcx, qword [0x14017a048]
cmp rcx, r15
je 0x1400a662a
test byte [rcx + 0x1c], 1
je 0x1400a662a
cmp byte [rcx + 0x19], 3
jb 0x1400a662a
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x32]
mov r9, rbp
mov qword [rsp + 0x20], rsi
lea r8, [0x14015ac58]
call fcn.140005d24
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax + rax]
inc edi
cmp edi, 5
jb 0x1400a65c4
cmp edi, 5
jne 0x1400a66c1
mov rcx, qword [0x14017a048]
cmp rcx, r15
je 0x1400a6672
test byte [rcx + 0x1c], 1
je 0x1400a6672
cmp byte [rcx + 0x19], 2
jb 0x1400a6672
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x4f]
lea r8, [0x14015ac58]
call fcn.140004b70
mov eax, 0x80780163
jmp 0x1400a66c3
mov rcx, qword [0x14017a048]
cmp rcx, r15
je 0x1400a66b2
test byte [rcx + 0x1c], 1
je 0x1400a66b2
cmp byte [rcx + 0x19], 2
jb 0x1400a66b2
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015ac58]
mov edx, 0x53
mov dword [rsp + 0x28], ebx
mov r9, rbp
mov qword [rsp + 0x20], rsi
call fcn.140005de0
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1400a66c3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x1400a770c
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14017a608]
xor rax, rsp
mov qword [rsp + 0x78], rax
and dword [rsp + 0x30], 0
lea r9, [r11 - 0x58]
and qword [r11 - 0x68], 0
xorps xmm0, xmm0
mov edi, edx
mov rsi, rcx
mov rcx, qword [rcx + 8]
lea rdx, [r11 - 0x30]
mov ebx, 0x20
mov r8d, ebx
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
jne 0x1400a77c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x1400a77b1
test byte [rcx + 0x1c], 2
je 0x1400a77b1
cmp byte [rcx + 0x19], 2
jb 0x1400a77b1
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x43]
mov r9d, edi
lea r8, [0x14015ac58]
call fcn.140004b9c
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x1400a7860
mov r9d, dword [rsp + 0x30]
cmp r9d, ebx
je 0x1400a7808
mov rcx, qword [0x14017a048]
lea rax, [0x14017a048]
cmp rcx, rax
je 0x1400a7856
test byte [rcx + 0x1c], 2
je 0x1400a7856
cmp byte [rcx + 0x19], 2
jb 0x1400a7856
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015ac58]
mov edx, 0x64
mov dword [rsp + 0x20], ebx
call fcn.1400101b0
jmp 0x1400a7856
mov rsi, qword [rsi + 0x10]
lea rdx, [rsp + 0x38]
xorps xmm0, xmm0
mov rcx, rsi
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140092664
mov ebx, eax
test eax, eax
js 0x1400a7845
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
call fcn.140092d60
test al, al
mov ecx, 0x80004005
cmove ebx, ecx
lea r8, [rsi + 0x10]
lea rdx, [rsi + 8]
call fcn.140092eb4
test ebx, ebx
jns 0x1400a7860
neg edi
sbb ebx, ebx
add ebx, 0x80780002
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14014b700
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret