joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022490
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1270
call fcn.14003f620
sub rsp, rax
mov rax, qword [0x140055b28]
xor rax, rsp
mov qword [rsp + 0x1260], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov r9, rdx
lea r8, str.KuaiZipMount
lea rcx, [rsp + 0x260]
lea rdx, str._s_s
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14002216b
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x14002216b
xor eax, eax
jmp 0x140022299
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x30]
xor edx, edx
lea eax, [rax + rax + 2]
lea r9, [rsp + 0x260]
lea r8d, [rdx + 1]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x260]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140022164
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, str.DefaultIcon
lea r8, [rsp + 0x260]
lea rdx, str._s_s
lea rcx, [rsp + 0xa60]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0xa60]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140022286
test rbx, rbx
je 0x140022225
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140022238
lea rdx, [rsp + 0x50]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8, [rsp + 0x50]
lea rdx, str._s__d
lea rcx, [rsp + 0x50]
xor r9d, r9d
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x38]
xor edx, edx
lea eax, [rax + rax + 2]
lea r9, [rsp + 0x50]
lea r8d, [rdx + 1]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x260]
mov r8, rbx
mov rcx, rsi
call fcn.140021fc0
mov rcx, qword [rsp + 0x1260]
xor rcx, rsp
call fcn.1400253c0
lea r11, [rsp + 0x1270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.1400222c0
test eax, eax
je 0x1400224b9
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rbx
mov rcx, rdi
call fcn.140021e70
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400220e0
Function at 0x140022750
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x850
mov rax, qword [0x140055b28]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rdi, rdx
mov rbx, rcx
call fcn.1400222c0
test eax, eax
jne 0x140022785
mov eax, 1
jmp 0x1400227e6
mov rcx, qword [rbx]
mov qword [rsp + 0x870], rsi
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
xor esi, esi
mov rdx, rdi
mov dword [rsp + 0x38], 0x800
mov word [rsp + 0x40], si
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1400227cc
lea rdx, str.NoAssociate.KuaiZipMount
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140022807
mov rdx, rdi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor eax, eax
mov rsi, qword [rsp + 0x870]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400253c0
mov rbx, qword [rsp + 0x878]
add rsp, 0x850
pop rdi
ret
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x30], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400227dc
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x30]
xor edx, edx
lea eax, [rax + rax + 2]
lea r9, [rsp + 0x40]
lea r8d, [rdx + 1]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.1400224e0
test ebx, ebx
sete sil
mov eax, esi
jmp 0x1400227de
Function at 0x140022890
Capabilities:
Query service status

Disassembly:
push rbx
push rsi
sub rsp, 0x68
mov rsi, rcx
xor edx, edx
mov r8d, 0x20000
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x1400228b9
add rsp, 0x68
pop rsi
pop rbx
ret
lea rdx, str.KuaiZipDrive
mov r8d, 5
mov rcx, rax
mov qword [rsp + 0x60], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1400228f1
mov rdi, qword [rsp + 0x60]
mov dword [rsi + 4], 1
mov al, 1
add rsp, 0x68
pop rsi
pop rbx
ret
mov edx, 0x2000
mov ecx, 0x40
mov qword [rsp + 0x80], rbp
mov dword [rsp + 0x88], 0
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x88]
mov r8d, 0x2000
mov rcx, rdi
mov rdx, rax
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x14002295b
cmp dword [rbp + 4], 2
je 0x14002295b
mov rcx, rbx
mov dword [rsi + 4], 2
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x1400229f2
xor eax, eax
lea r8, [rsp + 0x30]
mov r9d, 0x24
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x90], eax
lea rax, [rsp + 0x90]
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov ecx, dword [rsp + 0x34]
test eax, eax
je 0x1400229bc
cmp ecx, 3
je 0x1400229c1
cmp ecx, 1
jne 0x1400229de
mov rcx, rbx
mov dword [rsi + 4], 3
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x1400229f2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov rbp, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x60]
add rsp, 0x68
pop rsi
pop rbx
ret
Function at 0x1400243a4
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x140057b30]
test rcx, rcx
jne 0x1400242fb
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x1400242f4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140024326
and qword [rax], 0
and qword [rax + 8], 0
xor eax, eax
lock cmpxchg qword [rbx + 0x40], rdi
je 0x1400242f0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx + 0x40]
mov qword [0x140057b30], rcx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x140024399
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140024349
xor edx, edx
lea r9, [rsp + 0x30]
mov ecx, 0xc0000017
lea r8d, [rdx + 1]
mov qword [rsp + 0x30], 0x20
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x140057b30]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x140024376
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x140024399
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x140057b30]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x14002437d
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jmp 0x140024280

Function at 0x1400278c4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140027738
Function at 0x1400278d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140030cf0
nop
cmp dword [0x140057c70], 1
je 0x140027870
mov dword [0x140057c6c], 1
mov byte [0x140057c68], r12b
test ebx, ebx
jne 0x14002785c
mov rcx, qword [0x14005a1b0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140027849
mov rcx, qword [0x14005a1a8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x1400277e8
call fcn.14002c9a8
cmp qword [rdi], rax
jne 0x1400277e8
jmp 0x1400277ce
cmp rdi, rsi
jb 0x140027849
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14002c9a8
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14005a1b0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14005a1a8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140027827
cmp r13, rax
je 0x140027847
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x1400277ce
lea rdx, [0x140043a48]
lea rcx, [0x140043a30]
call fcn.140027618
lea rdx, [0x140043a58]
lea rcx, [0x140043a50]
call fcn.140027618
nop
test r12d, r12d
je 0x14002787f
mov ecx, 8
call fcn.140030bf0
test r12d, r12d
jne 0x1400278aa
mov dword [0x140057c70], 1
lea ecx, [r12 + 8]
call fcn.140030bf0
mov ecx, r15d
call fcn.1400275ac
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140027738
Function at 0x14002e7c7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140055b28]
jne 0x1400253da
rol rcx, 0x10
test cx, 0xffff
jne 0x1400253d6
repz ret
ror rcx, 0x10
jmp 0x14002e720
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140057d80]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140057e78]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14002e7a5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140057d80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14002e7c7
mov rax, qword [rsp + 0x88]
mov qword [0x140057e78], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140057e18], rax
mov rax, qword [0x140057e78]
mov qword [0x140057cf0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140057e00], rax
mov dword [0x140057ce0], 0xc0000409
mov dword [0x140057ce4], 1
mov rax, qword [0x140055b28]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140055b30]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140057d78], eax
mov ecx, 1
call fcn.14002f4e4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140045d10]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140057d78], 0
jne 0x14002e84e
mov ecx, 1
call fcn.14002f4e4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400363e8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14002c9a8
xor ebx, ebx
mov rdi, rax
cmp qword [0x140058b88], rbx
jne 0x1400364ee
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400365c3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400365c3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140048318]
mov rcx, rsi
mov qword [0x140058b88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140058b90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140058b98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140058ba8], rax
test rax, rax
je 0x1400364e5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140058ba0], rax
jmp 0x1400364f5
mov rax, qword [0x140058ba0]
jmp 0x1400364fc
mov rax, qword [0x140058ba0]
mov r11, qword [0x140058ba8]
cmp rax, rdi
je 0x140036564
cmp r11, rdi
je 0x140036564
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140058ba8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140036564
test rax, rax
je 0x140036564
call rsi
test rax, rax
je 0x14003655e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14003655e
test byte [rsp + 0x38], 1
jne 0x140036564
bts ebp, 0x15
jmp 0x1400365a2
mov rcx, qword [0x140058b90]
cmp rcx, rdi
je 0x1400365a2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400365a2
call rax
mov rbx, rax
test rax, rax
je 0x1400365a2
mov rcx, qword [0x140058b98]
cmp rcx, rdi
je 0x1400365a2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400365a2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140058b88]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400365c3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400365c5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x14003cbf0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call fcn.14003ca80
movzx eax, al
test eax, eax
jne 0x14003cc13
xor al, al
jmp 0x14003cc39
mov rcx, qword [rsp + 0x38]
call fcn.14000d820
mov rdx, rax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x14003cc37
xor al, al
jmp 0x14003cc39
mov al, 1
add rsp, 0x28
ret
Function at 0x14003cc50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [rsp + 0x50]
call fcn.14003ca80
movzx eax, al
test eax, eax
jne 0x14003cc78
xor al, al
jmp 0x14003ccdb
mov dword [rsp + 0x34], 4
mov rcx, qword [rsp + 0x58]
call fcn.14000d820
mov rdx, rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14003ccca
cmp dword [rsp + 0x30], 4
je 0x14003ccce
cmp dword [rsp + 0x30], 5
je 0x14003ccce
xor al, al
jmp 0x14003ccdb
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x38]
mov dword [rcx], eax
mov al, 1
add rsp, 0x48
ret

Function at 0x14003ccf0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [rsp + 0x50]
call fcn.14003ca80
movzx eax, al
test eax, eax
jne 0x14003cd18
xor al, al
jmp 0x14003cd61
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x58]
call fcn.14000d820
mov rdx, rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14003cd5f
xor al, al
jmp 0x14003cd61
mov al, 1
add rsp, 0x48
ret

Function at 0x14003cd70
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x38
mov rcx, qword [rsp + 0x50]
call fcn.14003ca80
movzx eax, al
test eax, eax
jne 0x14003cd9d
xor al, al
jmp 0x14003ce40
mov rcx, qword [rsp + 0x60]
call fcn.14000eb40
test rax, rax
jne 0x14003cdec
mov rcx, qword [rsp + 0x58]
call fcn.14000d820
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 3
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14003cdea
xor al, al
jmp 0x14003ce40
jmp 0x14003ce3e
mov rcx, qword [rsp + 0x60]
call fcn.14000eb40
mov rdi, rax
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.14000eb60
mov rbx, rax
mov rcx, qword [rsp + 0x58]
call fcn.14000d820
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14003ce3e
xor al, al
jmp 0x14003ce40
mov al, 1
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x14003cef0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x80
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov dword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x90]
call fcn.14003ca80
movzx eax, al
test eax, eax
jne 0x14003cf51
mov rcx, qword [rsp + 0x98]
call fcn.14000e990
mov eax, dword [rsp + 0x68]
or eax, 1
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x98]
jmp 0x14003d05d
lea rcx, [rsp + 0x38]
call fcn.14000e990
nop
mov rcx, qword [rsp + 0xa0]
call fcn.14000d820
mov rdx, rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14003cfa4
cmp dword [rsp + 0x30], 3
je 0x14003cfd3
mov rcx, qword [rsp + 0x98]
call fcn.14000e990
mov eax, dword [rsp + 0x68]
or eax, 1
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x38]
call fcn.14000eae0
mov rax, qword [rsp + 0x98]
jmp 0x14003d05d
cmp dword [rsp + 0x34], 0
jbe 0x14003d02e
mov edx, dword [rsp + 0x34]
lea rcx, [rsp + 0x38]
call fcn.14000eb10
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.14000eb60
mov rbx, rax
mov rcx, qword [rsp + 0xa0]
call fcn.14000d820
mov rdx, rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x98]
call fcn.14000e9e0
mov eax, dword [rsp + 0x68]
or eax, 1
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x38]
call fcn.14000eae0
mov rax, qword [rsp + 0x98]
add rsp, 0x80
pop rbx
ret
Function at 0x14003d990
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x310
mov qword [rsp + 0x2f0], 0xfffffffffffffffe
mov rax, qword [0x140055b28]
xor rax, rsp
mov qword [rsp + 0x308], rax
mov rcx, qword [rsp + 0x320]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14003d9d9
xor al, al
jmp 0x14003db7e
mov rcx, qword [rsp + 0x320]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
jmp 0x14003da01
mov eax, dword [rsp + 0x28]
add eax, 1
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
cmp rax, 9
jae 0x14003db7c
mov eax, dword [rsp + 0x28]
lea rdx, str.7z.dll
mov rdx, qword [rdx + rax*8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
je 0x14003db77
movzx eax, byte [0x140058e8c]
test eax, eax
jne 0x14003dae6
xor eax, eax
mov word [rsp + 0x60], ax
lea rdi, [rsp + 0x62]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x328]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call fcn.140001050
nop
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x298]
call fcn.14003d600
mov qword [rsp + 0x2f8], rax
mov rax, qword [rsp + 0x2f8]
mov qword [rsp + 0x300], rax
mov rdx, qword [rsp + 0x300]
lea rcx, [0x140058e90]
call fcn.140001120
nop
lea rcx, [rsp + 0x298]
call fcn.140001100
nop
lea rcx, [rsp + 0x270]
call fcn.140001100
mov byte [0x140058e8c], 1
mov rdx, qword [rsp + 0x320]
lea rcx, [rsp + 0x2c0]
call fcn.140001050
nop
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x38]
call fcn.14003d600
nop
lea rcx, [rsp + 0x2c0]
call fcn.140001100
lea rdx, [0x140058e90]
lea rcx, [rsp + 0x38]
call fcn.140001950
movzx eax, al
test eax, eax
je 0x14003db51
mov byte [rsp + 0x2e8], 0
lea rcx, [rsp + 0x38]
call fcn.140001100
mov al, byte [rsp + 0x2e8]
jmp 0x14003db7e
mov byte [rsp + 0x2e9], 1
lea rcx, [rsp + 0x38]
call fcn.140001100
mov al, byte [rsp + 0x2e9]
jmp 0x14003db7e
jmp 0x14003d9f6
mov al, 1
mov rcx, qword [rsp + 0x308]
xor rcx, rsp
call fcn.1400253c0
add rsp, 0x310
pop rdi
ret
Function at 0x1407332c0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140733447
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407332f1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407332d7
add dl, dl
jne 0x1407332fe
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14073335e
xor eax, eax
add dl, dl
jne 0x14073330d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140733415
add dl, dl
jne 0x14073331e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14073332b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140733338
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140733345
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140733352
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407332e6
mov eax, 1
add dl, dl
jne 0x14073336e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14073337b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140733363
sub eax, ebx
mov ebx, 1
jne 0x1407333b4
mov ecx, 1
add dl, dl
jne 0x140733396
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407333a3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14073338b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407332e6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407333d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407333dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407333c5
cmp eax, 0x7d00
jae 0x140733403
cmp eax, 0x500
jb 0x1407333fe
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407332e6
cmp eax, 0x7f
ja 0x140733406
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407332e6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14073343a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407332e6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20