joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005acb0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x278
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r13d, r13d
mov r12, r8
mov r14, rdx
mov rbp, rcx
mov ebx, 1
test rdx, rdx
je 0x14005adab
test r9d, r9d
mov eax, 0x1000
cmovne eax, r9d
mov esi, eax
mov ecx, eax
mov rax, qword [0x14008e048]
call qword [case.0x140006f84.0]
mov r15, rax
mov edi, r13d
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
mov edx, edi
mov qword [rsp + 0x20], r13
mov rcx, rbp
mov dword [rsp + 0x44], esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x14005ad91
cmp dword [rsp + 0x40], 0x104
jae 0x14005ad8c
mov eax, dword [rsp + 0x44]
cmp eax, esi
ja 0x14005ad8c
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], r12
mov r9, r15
mov dword [rsp + 0x20], eax
mov rcx, rbp
mov rax, r14
call qword [case.0x140006f84.0]
jmp 0x14005ada1
mov ebx, r13d
jmp 0x14005ada1
cmp eax, 0x103
je 0x14005adab
cmp eax, 0xea
cmovne ebx, r13d
inc edi
test ebx, ebx
jne 0x14005ad13
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14002cdb0
add rsp, 0x278
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005b3b0
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x3a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov rdi, rdx
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
or r9, 0xffffffffffffffff
xor ebx, ebx
inc r9
cmp word [rdi + r9*2], bx
jne 0x14005b3f2
mov dword [rsp + 0x3c], r9d
mov dword [rsp + 0x38], r9d
mov qword [rsp + 0x30], rdi
lea rax, [0x14008c158]
mov qword [rsp + 0x28], rax
lea r8d, [r9 - 1]
movsxd rdx, r8d
test r8d, r8d
js 0x14005b439
movzx ecx, word [rdi + rdx*2]
call fcn.1400251c8
test eax, eax
jne 0x14005b439
dec r8d
sub rdx, 1
jns 0x14005b423
inc r8d
sub r9d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.14001f408
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x78]
mov edx, 0x21
lea rcx, [rsp + 0x60]
call fcn.14001f378
lea rax, fcn.1400198e0
mov qword [rsp + 0x60], rax
mov r9d, 0xf003f
mov r8, qword [rsp + 0x68]
mov rdx, rsi
lea rcx, [rsp + 0xc0]
call fcn.14005b178
nop
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x180]
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.140044cdc
test eax, eax
jne 0x14005b513
lea rcx, [rsp + 0xc0]
call fcn.140013e30
nop
mov rcx, qword [rsi + 0xb0]
test rcx, rcx
jne 0x14005b4de
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
jmp 0x14005b504
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
test eax, eax
je 0x14005b4f7
mov ecx, eax
jmp 0x14005b4d6
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov ebx, 1
lea rcx, [rsp + 0x60]
call fcn.14002a448
nop
mov eax, ebx
jmp 0x14005b566
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0xc0]
call fcn.14005b3b0
test eax, eax
jne 0x14005b48f
lea rcx, [rsp + 0xc0]
call fcn.140013e30
nop
lea rcx, [rsp + 0x60]
call fcn.14002a448
nop
lea rax, fcn.14001b3f0
mov qword [rsp + 0x28], rax
xor eax, eax
jmp 0x14005b566
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.14002cdb0
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14005b91c
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 0xb0]
xor ebx, ebx
test rcx, rcx
jne 0x14005b93d
lea ecx, [rbx + 6]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x14005b97f
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], bx
jne 0x14005b941
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x14005b972
mov ecx, eax
jmp 0x14005b933
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x14005b988
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 0xb0]
test rcx, rcx
jne 0x14005b9a7
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x14005b9df
mov dword [rsp + 0x28], 8
lea rdx, str.SchemaCacheTimestamp
mov qword [rsp + 0x20], r8
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x14005b9d2
mov ecx, eax
jmp 0x14005b99d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 1
add rsp, 0x38
ret

Function at 0x14005b9e4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0xb0], 0
mov rsi, rdx
mov rdi, rcx
jne 0x14005ba12
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x14005ba5d
mov eax, dword [r8 + 0x14]
xor edx, edx
mov rcx, r8
lea ebx, [rax*2 + 2]
call fcn.14001459c
mov rcx, qword [rdi + 0xb0]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov rdx, rsi
mov ebx, 1
mov qword [rsp + 0x20], rax
mov r9d, ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x14005ba53
mov ecx, eax
jmp 0x14005ba08
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14005ba70
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx + 0xb0]
test rcx, rcx
jne 0x14005ba94
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x14005bac7
mov r9d, 4
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x14005baba
mov ecx, eax
jmp 0x14005ba8a
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 1
add rsp, 0x38
ret
Function at 0x14005bd30
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor edx, edx
mov rsi, rcx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x14005be54
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 3
jne 0x14005be2e
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.14005c710
test al, al
je 0x14005be07
mov rdi, qword [rsp + 0x38]
mov rcx, 0xffffffffffffffff
mov eax, 2
lea rbp, [rdi + 1]
mul rbp
lea rdx, [0x140096844]
cmovo rax, rcx
mov rcx, rax
call fcn.14002d21c
mov rbx, rax
test rax, rax
jne 0x14005bdbb
mov edi, 0x8007000e
lea edx, [rax + 0x7d]
mov r9d, edi
jmp 0x14005bdda
mov r9, rdi
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.14002527c
mov edi, eax
test eax, eax
jns 0x14005bdf7
mov r9d, eax
mov edx, 0x7e
mov rcx, qword [rsp + 0x28]
lea r8, str.internal_sdkincwil_filesystem.h
call fcn.1400069dc
mov rcx, rbx
call fcn.14000abd8
mov eax, edi
jmp 0x14005be56
mov rcx, rbx
call fcn.14005bd30
mov rcx, rbx
call fcn.14000abd8
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x14005be54
mov rcx, qword [rsp + 0x28]
lea r8, str.internal_sdkincwil_filesystem.h
mov edx, 0x81
call fcn.1400489d0
jmp 0x14005be56
cmp eax, 0xb7
je 0x14005be54
test eax, eax
je 0x14005be54
mov rcx, qword [rsp + 0x28]
lea r8, str.internal_sdkincwil_filesystem.h
mov r9d, eax
mov edx, 0x85
call fcn.14005c500
jmp 0x14005be56
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14005be6c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x350
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov ebx, r8d
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x30], edx
mov rsi, rcx
mov edi, 1
test rcx, rcx
je 0x14005bebb
lea rdx, [0x140094bd0]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
jne 0x14005bebd
xor edi, edi
test edi, edi
je 0x14005c067
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.14001f204
nop
lea rcx, [rsp + 0x50]
call fcn.14005a6e4
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x64]
lea rdx, [0x1400a2bc0]
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x140006f84.0]
and qword [rsp + 0x38], 0
test ebx, ebx
je 0x14005bf22
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
imul rax, rbx, 0x989680
sub qword [rsp + 0x38], rax
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rbx, rax
mov qword [rsp + 0x48], rax
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005c033
lea rdx, [0x140094b34]
lea rcx, [rsp + 0x11c]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
je 0x14005c01a
lea rdx, [0x1400a2bec]
lea rcx, [rsp + 0x11c]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
je 0x14005c01a
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x140006f84.0]
lea rcx, [rsp + 0x50]
call fcn.14005a6e4
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x64]
lea rdx, [rsp + 0x11c]
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x140006f84.0]
test byte [rsp + 0xf0], 0x10
je 0x14005bff1
mov r8d, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
call fcn.14005be6c
jmp 0x14005c01a
cmp dword [rsp + 0x34], 0
je 0x14005c00f
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xfc]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CompareFileTime]
test eax, eax
jg 0x14005c01a
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x14005bf3d
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005c046
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
cmp dword [rsp + 0x30], 0
je 0x14005c05c
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
neg eax
sbb ecx, ecx
and edi, ecx
lea rcx, [rsp + 0x50]
call fcn.1400282a4
nop
jmp 0x14005c06d
mov eax, edi
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.14002cdb0
add rsp, 0x350
pop rdi
pop rsi
pop rbx
ret
Function at 0x14005c20c
Capabilities:
Create directory
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
mov rdx, r8
mov rdi, rcx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x14005c26e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbx], eax
cmp eax, 0x50
je 0x14005c249
cmp eax, 0xb7
je 0x14005c249
xor eax, eax
jmp 0x14005c28e
test rsi, rsi
je 0x14005c26e
mov r8, qword [rsi + 8]
mov edx, 4
mov rcx, rdi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetFileSecurityW]
test eax, eax
jne 0x14005c26e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbx], eax
jmp 0x14005c245
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
bts eax, 0xd
mov rcx, rdi
mov edx, eax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
and dword [rbx], 0
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14005c528
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x268]
sub rsp, 0x350
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov rdi, rdx
mov qword [rsp + 0x30], rdx
mov rsi, rcx
lea rcx, [rsp + 0x50]
call fcn.14001f244
nop
lea rcx, [rsp + 0x50]
call fcn.14005a6e4
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x64]
lea rdx, [0x1400a2bc0]
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x140006f84.0]
lea rdx, [rbp - 0x10]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005c69e
lea rdx, [0x140094b34]
lea rcx, [rbp + 0x1c]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
je 0x14005c689
lea rdx, [0x1400a2bec]
lea rcx, [rbp + 0x1c]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpW]
test eax, eax
je 0x14005c689
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, qword [rdi + 8]
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x140006f84.0]
lea rcx, [rsp + 0x50]
call fcn.14005a6e4
mov rax, qword [rsp + 0x50]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x64]
lea rdx, [rbp + 0x1c]
lea rcx, [rsp + 0x50]
mov rax, qword [rax + 0x20]
call qword [case.0x140006f84.0]
mov rax, qword [rsi]
mov r8d, dword [rbp - 0x10]
lea rdx, [rsp + 0x50]
mov rcx, rsi
test r8b, 0x10
je 0x14005c675
mov rax, qword [rax + 8]
call qword [case.0x140006f84.0]
mov edi, eax
test eax, eax
js 0x14005c6e1
jne 0x14005c684
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14005c528
jmp 0x14005c67e
mov rax, qword [rax]
call qword [case.0x140006f84.0]
test eax, eax
mov edi, eax
js 0x14005c6e1
mov rdi, qword [rsp + 0x30]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x14005c5b5
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005c6b1
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
xor edi, edi
lea rcx, [rsp + 0x50]
call fcn.1400282a4
mov eax, edi
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.14002cdb0
mov rbx, qword [rsp + 0x380]
add rsp, 0x350
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005c6b3
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
jmp 0x14005c6b3
Function at 0x14005cb0c
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov rbx, rcx
call fcn.1400285c8
test al, al
je 0x14005ccc2
mov eax, dword [rcx + 0x14]
lea rdx, str.SoftwareMicrosoftWindows_SearchTracingEventThrottleLastReported
and dword [rsp + 0x58], 0
lea rcx, [rsp + 0x58]
and qword [rsp + 0x5c], 0
and dword [rsp + 0x64], 0
and dword [rsp + 0x68], 0
mov dword [rsp + 0x6c], eax
call fcn.1400286cc
test al, al
je 0x14005cb93
mov eax, dword [rbx]
cmp dword [rsp + 0x58], eax
jne 0x14005cb93
mov rax, qword [rbx + 4]
cmp qword [rsp + 0x5c], rax
jne 0x14005cb93
mov eax, dword [rbx + 0x10]
cmp dword [rsp + 0x68], eax
je 0x14005ccc2
mov r9d, dword [rbx + 0x14]
lea r8, [0x1400a2bf8]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rbp - 0x60]
call fcn.140006ce0
test eax, eax
js 0x14005ccc2
mov r9d, dword [rbx + 0x10]
lea r8, [0x1400a0f48]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rbp - 0x40]
call fcn.140006ce0
test eax, eax
js 0x14005ccc2
imul rax, qword [rbx + 4], 0x2710
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x50]
shr rax, 0x20
mov dword [rsp + 0x54], eax
call qword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_FileTimeToSystemTime]
test eax, eax
je 0x14005ccc2
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
je 0x14005ccc2
lea rax, [rbp - 0x20]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.api_ms_win_core_datetime_l1_1_0.dll_GetTimeFormatW]
test eax, eax
jle 0x14005ccc2
lea rax, [0x140094bd0]
xor ecx, ecx
mov qword [rbp - 0x80], rax
lea rdx, str.Windows_Search_Service
lea rax, [rbp - 0x60]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x68], rax
call qword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x14005ccc2
and qword [rsp + 0x40], 0
lea rax, [rbp - 0x80]
mov ecx, 4
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov r9d, 0x800003f7
mov word [rsp + 0x28], cx
and qword [rsp + 0x20], 0
lea edx, [rcx - 2]
lea r8d, [rcx - 3]
mov rcx, rbx
call qword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_DeregisterEventSource]
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.14002cdb0
mov rbx, qword [rsp + 0x208]
add rsp, 0x1f0
pop rbp
ret
Function at 0x14005d7d4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea r8, [rsp + 0x20]
mov rbx, rdx
mov rdi, rcx
call fcn.140017440
test al, al
lea rdx, [rsp + 0x20]
mov rcx, rdi
cmove rdx, rbx
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14002cdb0
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret

Function at 0x14005d838
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, qword [rsp + 0x280]
lea r8, [rsp + 0x30]
mov rdi, rdx
mov rsi, rcx
call fcn.140017440
test al, al
lea rdx, [rsp + 0x30]
mov rcx, rsi
cmove rdx, rdi
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyTransactedW]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14002cdb0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14005d9b4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, qword [rsp + 0x280]
lea rdi, str.SOFTWAREMicrosoftWindows_SearchPreviousSettings
mov rdx, rdi
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call fcn.140017440
test al, al
lea rdx, [rsp + 0x30]
mov r9d, 4
lea r8, str.IncludeIPSPlugin
mov dword [rsp + 0x28], r9d
cmove rdx, rdi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14002cdb0
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret
Function at 0x14005db5c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, r8
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x40], r9
mov r8d, 0xd0
mov r14, r9
call sub.msvcrt.dll_memset
xor esi, esi
test r14, r14
je 0x14005dbb5
mov word [r14], si
lea rcx, [rsp + 0x30]
call fcn.14005ddfc
mov ebx, eax
mov ebp, 0x1a
test eax, eax
js 0x14005dc85
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetLogicalDrives]
movzx r12d, word [rsp + 0x30]
mov r13d, eax
mov r14, qword [rsp + 0x48]
cmp esi, ebp
jae 0x14005dc6f
bt r13d, esi
jae 0x14005dc65
movabs rax, 0x5c003a0020
lea r15d, [rsi + 0x41]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
mov word [rsp + 0x48], r15w
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
cmp eax, 3
jne 0x14005dc65
mov r8, qword [rsp + 0x38]
lea r9, [rsp + 0x50]
movzx edx, r12w
movzx ecx, r15w
call fcn.14005de88
mov ebx, eax
test eax, eax
js 0x14005dc65
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.14005da48
mov ebx, eax
cmp eax, 1
jne 0x14005dc4e
xor ebx, ebx
jmp 0x14005dc65
test eax, eax
js 0x14005dc65
mov eax, esi
lea rcx, [rsp + 0x50]
lea rdx, [rdi + rax*8]
call qword [sym.imp.SHCORE.dll_SHStrDupW]
mov ebx, eax
inc esi
test ebx, ebx
jns 0x14005dbe2
mov r14, qword [rsp + 0x40]
xor esi, esi
test ebx, ebx
js 0x14005dc85
test r14, r14
je 0x14005dc9b
mov word [r14], r12w
jmp 0x14005dc9b
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rdi], rsi
lea rdi, [rdi + 8]
sub rbp, 1
jne 0x14005dc85
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14002cdb0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14005ddfc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov r9d, 1
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x23]
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
mov ebx, eax
test eax, eax
js 0x14005de63
movzx ecx, word [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_towupper]
mov word [rdi], ax
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14002cdb0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x14005de88
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, r9
mov rbp, r8
movzx ebx, dx
xor edi, edi
call qword [sym.imp.msvcrt.dll_towupper]
movzx ecx, bx
movzx r14d, ax
call qword [sym.imp.msvcrt.dll_towupper]
cmp r14w, ax
jne 0x14005dee1
mov r8, rbp
mov edx, 0x104
mov rcx, rsi
call fcn.1400252d0
jmp 0x14005df6c
movabs rax, 0x5c003a0020
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
mov r8d, 0x104
mov word [rsp + 0x20], r14w
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x14005df29
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x14005df25
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x14005df6e
mov edx, 0x7b
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_wcschr]
mov rbx, rax
mov eax, 0x8000ffff
test rbx, rbx
cmove edi, eax
test edi, edi
js 0x14005df6e
mov r8, rbp
mov edx, 0x104
mov rcx, rsi
call fcn.1400252d0
mov edi, eax
test eax, eax
js 0x14005df6e
mov r8, rbx
mov rcx, rsi
call fcn.14005df90
mov edi, eax
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14002cdb0
add rsp, 0x250
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret