joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000dbb0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rcx
test dl, dl
je 0x14000dbdb
mov edx, 0x9016929
mov ecx, 0xd8da4f55
mov r8d, 0x6719d6a4
jmp 0x14000dbeb
mov edx, 0x14437820
mov ecx, 0xc5985eba
mov r8d, 0x7a5bc7a7
call fcn.1400014e0
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rdi]
lea eax, [rax*2 + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rdi]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegCloseKey]

Function at 0x14000dc3c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov ecx, 0xe97e7723
mov r8d, 0x56bdee22
mov edx, 0x38a551a7
call fcn.1400014e0
lea rcx, [rsp + 0x40]
xor edx, edx
mov rdi, rax
call fcn.14000d8c0
xor ebp, ebp
test eax, eax
je 0x14000dcd2
mov rcx, qword [rsp + 0x40]
mov r9d, 0x104
mov r8, rsi
mov rdx, rdi
call fcn.14000d124
mov rcx, qword [rsp + 0x40]
mov bl, al
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x14000dcd2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rbx, [rsi + rcx*2]
cmp rbx, rsi
je 0x14000dd0b
cmp word [rbx - 2], 0x2f
je 0x14000dd0b
lea eax, [rbp + 0x5c]
cmp word [rbx - 2], ax
je 0x14000dd0b
mov word [rbx], ax
add rbx, 2
jmp 0x14000dd08
mov rcx, rsi
call fcn.14000dfa8
mov rbx, rax
sub rax, rdi
movzx ecx, word [rdi]
mov word [rax + rdi], cx
lea rdi, [rdi + 2]
test cx, cx
jne 0x14000dce0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, 0x5c
add rbx, 8
mov word [rbx - 2], ax
mov word [rbx], bp
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000dd24
Capabilities:
Create directory
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x518]
sub rsp, 0x600
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
movzx edi, dx
movzx eax, dil
sub eax, 0x41
cdqe
lea r14, [0x140175bc0]
mov r14, qword [r14 + rax*8]
test r14, r14
je 0x14000df7e
lea rcx, [rbp + 0xc0]
call fcn.14000d96c
xor edx, edx
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rsi, [rbp + 0xc0]
lea rsi, [rsi + rcx*2]
mov eax, 0x5c
mov word [rsi], ax
lea rcx, [rsp + 0x50]
call fcn.1400204c0
nop
movzx ebx, di
mov edx, 0xa277353
mov ecx, 0xdbfc55eb
mov r8d, 0x643fccd5
call fcn.1400014e0
mov rdx, rax
mov r8d, ebx
lea rcx, [rsi + 2]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0xc0]
call fcn.140022910
test al, al
je 0x14000df74
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xc0]
call fcn.140022ddc
mov rbx, rax
test rax, rax
je 0x14000df74
mov edx, 0xba575877
mov r8d, 8
lea rcx, [0x1401689ca]
call fcn.140001468
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x40]
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14002080c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rbx, [r14 + 0xb0]
movsx edi, dil
mov edx, 0x38744335
mov ecx, 0xe9af65e3
mov r8d, 0x566cfca4
call fcn.1400014e0
mov rdx, rax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edi
lea r9, [0x140129d48]
lea r8, [0x140129d88]
lea rcx, [rsi + 2]
call qword [sym.imp.USER32.dll_wsprintfW]
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [rbp + 0xc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x50]
call fcn.1400216c0
mov edx, 0x513dba22
mov r8d, InitCommonControls
lea rcx, [0x1401689f6]
call fcn.140001468
lea r8, [rbp + 0x2d0]
mov rdx, rax
lea rcx, [rbp + 0x3e0]
call fcn.1400e9c20
mov edx, 0xdcae7d1c
mov r8d, 9
lea rcx, [0x140168a0c]
call fcn.140001468
mov rbx, rax
mov edx, 0x9acca331
mov r8d, 5
lea rcx, [0x140168a04]
call fcn.140001468
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x3e0]
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rsp + 0x50]
call fcn.14002057c
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000dfa8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor r9d, r9d
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea edx, [r9 + 0x23]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
mov edi, 0x5c
test eax, eax
jle 0x14000dff5
movsxd rcx, eax
cmp word [rbx + rcx*2 - 2], di
je 0x14000dff5
mov word [rbx + rcx*2], di
inc eax
cdqe
lea rdx, [0x140129d88]
lea rbx, [rbx + rax*2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [0x140129d88]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rax, [rbx + rcx*2]
mov rbx, qword [rsp + 0x40]
mov word [rax], di
add rax, 2
mov word [rax], si
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000e69c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov r8d, 0x6505b2ce
mov edx, 0xb1d0d47
mov ecx, 0xdac62ab7
mov dword [rsp + 0x58], 3
mov dword [rsp + 0x50], InitCommonControls
call fcn.1400014e0
mov rcx, qword [rdi]
mov rdx, rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rdi]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x50]
xor ecx, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x40]
cmovne eax, ecx
shr rax, 2
add rsp, 0x30
pop rdi
ret

Function at 0x14000e71c
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rcx, [rax + 8]
xor edx, edx
call fcn.14000d8c0
xor esi, esi
test eax, eax
je 0x14000e780
mov edx, 0xf41bc33c
mov ecx, 0x25c0e35c
mov r8d, 0x9a037cba
call fcn.1400014e0
mov rcx, qword [rsp + 0x40]
mov r9d, 0x104
mov rdx, rax
mov r8, rdi
call fcn.14000d124
mov rcx, qword [rsp + 0x40]
mov bl, al
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x14000e797
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 5]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], si
jne 0x14000e79b
lea rax, [rdi + rax*2]
mov ecx, 0x5c
cmp word [rax - 2], cx
je 0x14000e7bd
mov word [rax], cx
add rax, 2
mov word [rax], si
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000e7d0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rcx, rdx
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea rcx, [rsp + 0x40]
mov edx, 0x5c
call fcn.1400e9f08
xor ebx, ebx
test rax, rax
je 0x14000e81c
mov word [rax], bx
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.14000d8c0
test eax, eax
je 0x14000e887
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x14000e87c
mov edx, 0xe732439
mov ecx, 0xdfa804a9
mov r8d, 0x606b9bbf
lea ebx, [rax*2 + 2]
call fcn.1400014e0
mov rcx, qword [rsp + 0x30]
mov rdx, rax
lea rax, [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x260
pop rbx
ret
Function at 0x14000fce0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov qword [rsp + 0x20], rdx
mov edx, ecx
xor esi, esi
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov ebx, esi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14000fd36
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
test eax, eax
jle 0x14000fd36
lea ecx, [rsi + 0x5c]
cmp word [rdi + rbx*2 - 2], cx
je 0x14000fd36
mov word [rdi + rbx*2], cx
inc ebx
movsxd rcx, ebx
mov word [rdi + rcx*2], si
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000fd48
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x30
mov rbx, r8
mov rdx, rcx
lea rax, [rsp + 0x48]
mov rcx, qword [rbx]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x140010544
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov r8d, 0x901305d6
mov ecx, 0xfb1f65bb
mov edx, 0xb4e5749a
call fcn.140001600
mov r9d, 0x20219
xor r8d, r8d
mov rdx, rax
lea rax, [rbp - 0x28]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140010605
mov byte [rbp - 0x20], al
xor eax, eax
mov edx, 0x6716e5ca
mov r8d, 0x43e09499
mov ecx, 0x28ecf495
mov dword [rbp - 0x30], 3
mov qword [rbp - 0x1f], rax
mov dword [rbp - 0x17], eax
mov word [rbp - 0x13], ax
mov byte [rbp - 0x11], al
mov dword [rbp - 0x2c], InitCommonControls
call fcn.140001600
mov rcx, qword [rbp - 0x28]
mov rdx, rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
lea r9, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140010605
movups xmm0, xmmword [rbp - 0x20]
movdqu xmmword [rbx], xmm0
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140010b48
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp - 8], rax
xor r9d, r9d
mov rsi, r8
lea r8, [0x140168c10]
sub rdx, r8
mov r10d, 3
mov r11d, r9d
lea rax, [r11 + r8]
inc r11
mov cl, byte [rdx + rax]
xor cl, byte [rax]
mov byte [rbp + r11 - 0x21], cl
cmp r11, 0x18
jl 0x140010b86
mov ebx, 5
lea r11, [rbp - 0x28]
lea r8, [rbp - 0x1f]
lea edi, [rbx + 3]
cmp r10d, 8
jge 0x140010bc5
mov dl, byte [r8 + 1]
mov al, byte [r8]
mov cl, r10b
shr dl, cl
mov ecx, ebx
shl al, cl
jmp 0x140010bef
mov ecx, r10d
and ecx, 0x80000007
jge 0x140010bd7
dec ecx
or ecx, 0xfffffff8
inc ecx
mov dl, byte [r8 - 1]
mov eax, 8
sub eax, ecx
mov cl, al
mov al, byte [r8]
shl dl, cl
lea ecx, [r10 - 8]
shr al, cl
add dl, al
inc r10d
dec ebx
mov byte [r11], dl
inc r11
add r8, 3
dec rdi
jne 0x140010bad
mov al, byte [rbp - 0x28]
mov byte [rbp - 0x2c], al
mov al, byte [rbp - 0x27]
mov byte [rbp - 0x2b], al
mov al, byte [rbp - 0x26]
mov byte [rbp - 0x2d], al
mov al, byte [rbp - 0x25]
mov byte [rbp - 0x2e], al
mov al, byte [rbp - 0x24]
mov byte [rbp - 0x2f], al
mov al, byte [rbp - 0x23]
mov byte [rbp - 0x30], al
mov al, byte [rbp - 0x22]
mov byte [rbp - 0x29], al
mov al, byte [rbp - 0x21]
mov byte [rbp - 0x2a], al
lea rax, [0x140129ed8]
mov al, byte [r9 + rax]
inc r9
xor byte [rbp + r9 - 0x31], al
cmp r9, 8
jl 0x140010c35
mov rax, qword [rbp - 0x30]
mov qword [rsi], rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x140011078
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x160], rax
movsxd rdi, edx
call fcn.140011250
lea rdx, [rsp + 0x50]
mov ecx, 0x23
call fcn.14000fce0
mov edx, 0x568c1155
mov ecx, 0x19760306
mov r8d, 0x727a601b
movsxd rbx, eax
call fcn.140001600
lea rcx, [rsp + 0x50]
lea rcx, [rcx + rbx*2]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 2]
lea rcx, [rsp + 0x50]
mov edx, 0x40000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001119e
xor eax, eax
lea ecx, [rdi - 1]
mov word [rsp + 0x40], 0x8b88
mov word [rsp + 0x45], ax
mov byte [rsp + 0x47], al
mov byte [rsp + 0x42], 0x8d
cmp ecx, 2
ja 0x140011143
mov al, byte [rsp + rdi + 0x3f]
jmp 0x140011145
mov al, 1
and qword [rsp + 0x20], 0
mov edi, 4
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x44]
mov r8d, edi
mov rcx, rbx
mov byte [rsp + 0x44], al
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
and qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov r8d, edi
mov rcx, rbx
mov word [rsp + 0x41], ax
mov byte [rsp + 0x43], al
mov byte [rsp + 0x40], 0x8c
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140011250
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
lea rdx, [rsp + 0x30]
lea rcx, [0x1400111c4]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400112a0
lea edx, [rbx + 2]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [rbx + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x30]
test rax, rax
setne al
add rsp, 0x20
pop rbx
ret
Function at 0x1400112ac
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x50], rax
and dword [rsp + 0x24], 0
and dword [rsp + 0x34], 0
mov rdi, rdx
mov dword [rdx + 8], 6
lea rcx, [rsp + 0x38]
mov r8d, 0x10c
xor edx, edx
mov dword [rsp + 0x30], 0x114
call fcn.1400ebf40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x34], 5
jne 0x1400113ab
mov edx, 0x169e4165
mov ecx, 0x596453e8
mov r8d, 0x3268301e
mov dword [rsp + 0x20], 4
call fcn.140001600
mov rbx, 0xffffffff80000000
lea r9, [rsp + 0x20]
lea r8, [rdi + 0x10]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov edx, 0x9e554dd8
mov ecx, 0xd1af5f39
mov r8d, 0xbaa33ca3
mov dword [rsp + 0x20], 4
call fcn.140001600
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x24]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [rsp + 0x24]
dec ecx
je 0x1400113a4
dec ecx
je 0x14001139b
cmp ecx, 2
jne 0x1400113ab
mov dword [rdi + 0xc], 3
jmp 0x1400113ab
mov dword [rdi + 0xc], 2
jmp 0x1400113ab
mov dword [rdi + 0xc], 1
mov al, 1
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400113d0
Capabilities:
Check os version
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x260], rax
and dword [rsp + 0x24], 0
movsxd rdi, edx
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0x10c
mov dword [rsp + 0x20], 0x114
call fcn.1400ebf40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 5
jne 0x1400114fe
mov edx, 0x43424b51
mov ecx, 0xcb85f56
mov r8d, 0x67b43a06
call fcn.140001600
mov edx, 0x975366a3
mov ecx, 0xd8a97500
mov r8d, 0xb3a517d8
mov rbx, rax
call fcn.140001600
lea r8, [rbp + 0x40]
mov rcx, 0xffffffff80000000
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140011487
lea r8, [rbp + 0x40]
lea edx, [rax + 5]
mov rcx, rbx
call fcn.14000fd48
lea eax, [rdi - 1]
mov ebx, 1
mov dword [rbp + 0x44], 2
mov dword [rbp + 0x40], ebx
mov dword [rbp + 0x48], 4
cmp eax, 2
ja 0x1400114a9
mov ebx, dword [rbp + rdi*4 + 0x3c]
mov edx, 0x65ebe3b9
mov ecx, 0x2a11f7de
mov r8d, 0x411d92ee
call fcn.140001600
mov edx, 0x72adfb89
mov ecx, 0x3d57ef8a
mov r8d, 0x565b8af2
mov rdi, rax
call fcn.140001600
lea r8, [rbp + 0x40]
mov rcx, 0xffffffff80000000
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14001153f
lea r8, [rbp + 0x40]
mov edx, ebx
mov rcx, rdi
call fcn.14000fd48
jmp 0x14001153f
lea rdx, [rbp + 0x50]
mov ecx, 0x23
call fcn.14000fce0
mov edx, 0x662d67b0
mov ecx, 0x29d773d3
mov r8d, 0x42db16c6
movsxd rbx, eax
call fcn.140001600
lea rcx, [rbp + 0x50]
lea rcx, [rcx + rbx*2]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001157c
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x460
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rdx
lea rdx, [rsp + 0x240]
mov ecx, 0x1a
mov r14d, r8d
call fcn.14000fce0
xor r13d, r13d
mov edx, 0x125baa65
mov ecx, 0x5da1bec8
mov r8d, 0x36addb15
movsxd rbx, eax
mov esi, r13d
mov ebp, r13d
mov word [rsp + 0x30], r13w
call fcn.140001600
lea rcx, [rsp + 0x240]
lea rcx, [rcx + rbx*2]
mov rdx, rax
mov r8d, r14d
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0xfa59e373
mov ecx, 0xb5a3f780
mov r8d, 0xdeaf9229
call fcn.140001600
lea ebx, [r13 + 1]
lea r9, [0x140011564]
mov rdx, rax
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x240]
mov r8b, bl
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call fcn.140022694
cmp word [rsp + 0x30], r13w
je 0x1400116c8
lea rcx, [rsp + 0x30]
call fcn.140022910
test al, al
je 0x1400116c8
cmp r14d, 6
jne 0x140011663
mov dword [rdi + 8], 3
jmp 0x14001167b
cmp r14d, 5
jne 0x140011672
mov dword [rdi + 8], 2
jmp 0x14001167b
cmp r14d, 3
jne 0x14001167b
mov dword [rdi + 8], ebx
lea r9, [rsp + 0x30]
lea rdx, str.BDRegionCode
lea rcx, str.General
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, 0xcfa333a1
mov ecx, 0x805926b4
mov r8d, 0xeb5542fb
mov esi, eax
call fcn.140001600
lea r9, [rsp + 0x30]
lea rcx, str.General
mov rdx, rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, eax
dec esi
je 0x1400116e7
dec esi
je 0x1400116de
cmp esi, 2
jne 0x1400116ea
mov dword [rdi + 0xc], 3
jmp 0x1400116ea
mov dword [rdi + 0xc], 2
jmp 0x1400116ea
mov dword [rdi + 0xc], ebx
cmp ebp, 0xaf01cec2
je 0x14001173c
cmp ebp, 0xbc110012
je 0x140011737
cmp ebp, 0xd3a535fb
je 0x14001172e
cmp ebp, 0xdcab1f36
je 0x140011725
cmp ebp, 0xf0cc1274
je 0x14001171c
test ebp, ebp
jne 0x140011743
mov dword [rdi + 0x10], r13d
jmp 0x140011743
mov dword [rdi + 0x10], 3
jmp 0x140011743
mov dword [rdi + 0x10], 4
jmp 0x140011743
mov dword [rdi + 0x10], 5
jmp 0x140011743
mov dword [rdi + 0x10], ebx
jmp 0x140011743
mov dword [rdi + 0x10], 2
mov al, bl
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x140011f54
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
cmp r8d, 4
jne 0x140011f8f
mov cl, r9b
call fcn.14000fbf4
mov eax, 5
jmp 0x140012081
cmp r8d, 5
jne 0x14001207f
mov dword [rbp - 0x18], 0x320030
mov dword [rbp - 0x14], 0x470050
mov dword [rbp - 0x10], 0x560031
mov dword [rbp - 0xc], 0x30
cmp r9d, 1
je 0x140011fd5
cmp r9d, 2
jne 0x140011fc7
lea eax, [r8 + 0x32]
jmp 0x140011fd1
cmp r9d, 3
jne 0x140011fd5
lea eax, [r9 + 0x3f]
mov word [rbp - 0x10], ax
mov edx, 0x6a2abcb4
mov ecx, 0x25d0ab57
mov r8d, 0x4edccdef
call fcn.140001600
lea r8, [rbp - 0x20]
mov rcx, 0xffffffff80000000
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14001209d
mov edx, 0x190ac2c6
mov ecx, 0x56f0dac1
mov r8d, 0x3dfcb396
call fcn.140001600
mov rcx, qword [rbp - 0x20]
mov r9d, 1
mov rdx, rax
lea rax, [rbp - 0x18]
xor r8d, r8d
mov dword [rsp + 0x28], InitCommonControls
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 5
jne 0x14001209d
mov edx, 0x64ad768e
mov ecx, 0x2b576e9b
mov r8d, 0x405b07f5
call fcn.140001600
lea r9d, [rbx + 0xb]
lea r8, [0x140129d88]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
mov eax, 4
jmp 0x140012081

Function at 0x140012c50
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rdi
mov rax, qword [0x140163470]
xor rax, rbp
mov qword [rbp], rax
movzx r10d, byte [rcx + 1]
mov eax, 0xffbf
mov rdi, r8
xor r10w, ax
mov al, byte [rcx]
mov rsi, rdx
xor al, 0xbf
shl r10w, 8
mov rbx, rcx
movzx eax, al
or r10w, ax
movzx r8d, r10w
lea rax, [r8 + 0xf]
cmp rax, r8
ja 0x140012cb3
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400eda30
sub rsp, rax
lea rdx, [rsp + 0x30]
test r8, r8
jle 0x140012cdf
mov rcx, rdx
sub rbx, rdx
mov al, byte [rbx + rcx + 2]
xor al, 0xbf
mov byte [rcx], al
inc rcx
dec r8
jne 0x140012ccf
mov rcx, qword [0x140175aa0]
mov qword [rsp + 0x20], r9
mov r8, rsi
mov r9, rdi
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1400e8bc0
mov rbx, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x30]
lea rsp, [rbp + 0x10]
pop rbp
ret