joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004b080
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rdx
mov r12, rcx
mov r14d, 0x104
lea rcx, [rsp + 0x70]
mov r8d, r14d
xor edx, edx
mov r15, r9
call fcn.140136960
xor esi, esi
mov dword [rsp + 0x58], 0xffffffff
xor eax, eax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x5c], 4
mov dword [r15], eax
test rdi, rdi
je 0x14004b262
mov rax, 0xffffffffffffffff
mov rbx, rax
nop dword [rax]
inc rbx
cmp byte [rdi + rbx], sil
jne 0x14004b100
test rbx, rbx
je 0x14004b11c
nop
cmp byte [rdi + rbx], 0x5c
je 0x14004b14d
sub rbx, 1
jne 0x14004b110
lea rax, [rsp + 0x60]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14004b1b5
mov qword [rsp + 0x60], rsi
jmp 0x14004b24e
cmp rbx, r14
jae 0x14004b262
inc rax
cmp byte [rdi + rax], sil
jne 0x14004b156
inc rax
lea rcx, [rsp + 0x70]
cmp rax, r14
mov rdx, rdi
cmovb r14, rax
mov r8, r14
call fcn.1401362c0
lea rax, [rsp + 0x50]
mov byte [rsp + r14 + 0x6f], sil
mov byte [rsp + rbx + 0x70], sil
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r12
inc rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14004b1fd
mov qword [rsp + 0x50], rsi
jmp 0x14004b23e
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, str.Akeo_ConsultingRufus
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14004b1fd
mov qword [rsp + 0x50], rsi
jmp 0x14004b23e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x14004b239
test eax, eax
jne 0x14004b23e
cmp dword [rsp + 0x58], 4
jne 0x14004b23e
cmp dword [rsp + 0x5c], esi
jbe 0x14004b23e
mov esi, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14004b24e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14004b25e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x14004b264
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400b1f80
add rsp, 0x190
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14004d900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbp, r9
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x14004d93d
call fcn.140050120
mov r8, rax
lea rcx, str.Could_not_locate_resource__s:__s
mov rdx, rbp
call fcn.14004f910
xor eax, eax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
mov rdx, rdi
mov qword [rsp + 0x50], r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
test rax, rax
jne 0x14004d97c
call fcn.140050120
mov r8, rax
lea rcx, str.Could_not_load_resource__s:__s
mov rdx, rbp
call fcn.14004f910
mov r15, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x48], r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [rsp + 0x68], 0
mov edi, eax
mov r14, qword [rsp + 0x60]
je 0x14004da10
mov eax, dword [r14]
test eax, eax
jne 0x14004d9ac
mov dword [r14], edi
mov eax, edi
mov ecx, eax
mov edx, 1
call fcn.1400c537c
mov rsi, rax
test rax, rax
jne 0x14004d9d1
mov rdx, rbp
lea rcx, str.Could_not_allocate_resource__s
call fcn.14004f910
jmp 0x14004da1f
mov eax, dword [r14]
mov rcx, r15
cmp edi, eax
cmovb eax, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, ebx
mov rcx, rsi
mov rdx, rax
call fcn.1401362c0
mov eax, dword [r14]
cmp edi, eax
jbe 0x14004da1c
mov r8d, edi
lea rcx, str.WARNING:_Resource__s_was_truncated_by__d_bytes_
sub r8d, eax
mov rdx, rbp
call fcn.14004f910
jmp 0x14004da1c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov dword [r14], edi
mov r14, qword [rsp + 0x48]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x14004e980
Capabilities:
Create thread
Terminate thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rdx, qword [0x14019f500]
lea rax, [0x1401e27d8]
mov qword [rsp + 0x38], rax
xor esi, esi
mov dword [rsp + 0x30], ecx
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov qword [rsp + 0x40], rax
lea rax, str.NoDriveTypeAutorun
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0xa0], esi
test rdx, rdx
je 0x14004ea05
lea r8d, [rsi + 1]
mov edi, esi
lea rcx, str.DisableLGP
call fcn.140026d90
mov rbx, rax
test rax, rax
je 0x14004ea01
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140102588
mov rcx, rbx
mov edi, eax
call fcn.1400e9080
test edi, edi
jmp 0x14004ea27
lea r9, [rsp + 0x80]
mov rcx, 0xffffffff80000001
lea rdx, str.DisableLGP
call fcn.14004b080
cmp dword [rsp + 0x80], esi
mov ecx, esi
mov qword [rsp + 0x88], rbp
setne cl
mov qword [rsp + 0x90], r14
test ecx, ecx
je 0x14004eab2
mov rax, qword [0x1401d0520]
lea rsi, [0x1401e67a0]
mov r14d, 0xffc
lea r9, str.LPG_handling_disabled__per_settings
sub r14, rax
mov rbx, 0xffffffffffffffff
mov r8, rbx
mov rdx, r14
lea rdi, [rax + rsi]
mov rcx, rdi
call fcn.140004960
mov byte [rdi + r14 - 1], 0
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14004ea80
mov word [rbx + rsi], 0xa0d
add rbx, 2
mov qword [0x1401d0520], rbx
cmp rbx, 0x1000
jae 0x14004ebec
mov byte [rbx + rsi], 0
xor eax, eax
jmp 0x14004ebd4
mov qword [rsp + 0x28], rsi
lea r9, [rsp + 0x30]
lea r8, [0x14004e300]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
jne 0x14004eb23
mov rax, qword [0x1401d0520]
lea rsi, [0x1401e67a0]
mov r14d, 0xffc
lea r9, str.SetLGP:_Unable_to_start_thread
sub r14, rax
mov rbx, 0xffffffffffffffff
mov r8, rbx
mov rdx, r14
lea rdi, [rax + rsi]
mov rcx, rdi
call fcn.140004960
mov byte [rdi + r14 - 1], bpl
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14004eb15
jmp 0x14004ea89
mov edx, 0x1388
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14004ebb5
mov rax, qword [0x1401d0520]
lea rsi, [0x1401e67a0]
mov r14d, 0xffc
lea r9, str.SetLGP:_Killing_stuck_thread_
sub r14, rax
mov rbx, 0xffffffffffffffff
mov r8, rbx
mov rdx, r14
lea rdi, [rax + rsi]
mov rcx, rdi
call fcn.140004960
mov byte [rdi + r14 - 1], 0
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14004eb76
mov word [rbx + rsi], 0xa0d
add rbx, 2
mov qword [0x1401d0520], rbx
cmp rbx, 0x1000
jae 0x14004ebec
xor edx, edx
mov byte [rbx + rsi], 0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14004ebd4
lea rdx, [rsp + 0xa0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, dword [rsp + 0xa0]
test eax, eax
cmove ecx, esi
mov eax, ecx
mov r14, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
call fcn.1400b20a8
int3
Function at 0x14004f910
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rdi
sub rsp, 0x60
mov qword [rax - 0x10], rbx
lea rdi, [rax + 0x10]
mov qword [rax - 0x18], rbp
mov rbx, rcx
mov qword [rax - 0x28], r14
call fcn.140001000
mov qword [rsp + 0x30], rdi
lea rbp, [0x1401e2f60]
xor edi, edi
mov r14, 0xffffffffffffffff
mov qword [rsp + 0x28], rdi
mov r9, r14
mov rcx, qword [rax]
mov rdx, rbp
mov qword [rsp + 0x20], rbx
mov ebx, 0xffd
mov r8d, ebx
call fcn.1400e8448
test eax, eax
cmovs eax, r14d
test eax, eax
js 0x14004f982
movsxd rbx, eax
add rbx, rbp
mov qword [rsp + 0x48], rsi
cmp rbx, rbp
jbe 0x14004f9ac
nop
movzx ecx, byte [rbx - 1]
lea rsi, [rbx - 1]
call fcn.1400fe410
test eax, eax
je 0x14004f9ac
mov byte [rsi], dil
mov rbx, rsi
cmp rsi, rbp
ja 0x14004f990
mov word [rbx], 0xa0d
mov byte [rbx + 2], dil
cmp byte [0x1401e2f60], dil
jne 0x14004f9d0
mov edx, 2
lea ecx, [rdx - 1]
call fcn.1400c537c
mov rdi, rax
jmp 0x14004fa36
mov dword [rsp + 0x28], edi
mov r9d, r14d
mov r8, rbp
mov qword [rsp + 0x20], rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
cmp esi, 1
jle 0x14004fa36
mov rcx, rsi
mov edx, 2
call fcn.1400c537c
mov rbx, rax
test rax, rax
je 0x14004fa36
mov dword [rsp + 0x28], esi
mov r9d, r14d
mov r8, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x14004fa33
mov rcx, rbx
call fcn.1400e9080
jmp 0x14004fa36
mov rdi, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [0x14019f5c8]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14004fac0
mov r9d, 0x7ffffffe
mov edx, 0xb1
mov r8d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14019f5c8]
mov r9, rdi
xor r8d, r8d
mov edx, 0xc2
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14019f5c8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xba
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14019f5c8]
xor r8d, r8d
movsxd r9, eax
mov edx, 0xb6
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.1400e9080
add rsp, 0x60
pop rdi
ret

Function at 0x14004fad0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
call fcn.14004f5b0
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [0x14019f5c8]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x14004fb54
mov r9d, 0x7ffffffe
mov edx, 0xb1
mov r8d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14019f5c8]
mov r9, rbx
xor r8d, r8d
mov edx, 0xc2
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14019f5c8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xba
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14019f5c8]
xor r8d, r8d
movsxd r9, eax
mov edx, 0xb6
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400e9080
Function at 0x14004fb70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov r14, rdx
mov qword [rsp + 0x60], r15
mov rbp, rcx
call fcn.14004f5b0
lea r9d, [r15 - 1]
mov dword [rsp + 0x28], r15d
lea r8, [0x140162384]
mov qword [rsp + 0x20], r15
xor edx, edx
mov ecx, 0xfde9
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
cmp esi, 1
jle 0x14004fc09
mov rcx, rsi
lea edx, [r15 + 2]
call fcn.1400c537c
mov rbx, rax
test rax, rax
je 0x14004fc09
mov dword [rsp + 0x28], esi
lea r9d, [r15 - 1]
lea r8, [0x140162384]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x14004fc0c
mov rcx, rbx
call fcn.1400e9080
mov rbx, r15
mov r8, rbx
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.1400e94b0
test rdi, rdi
je 0x14004fc29
mov rcx, rdi
call fcn.1400e9080
test rbx, rbx
je 0x14004fc36
mov rcx, rbx
call fcn.1400e9080
mov rsi, qword [rsp + 0x60]
test rsi, rsi
jne 0x14004fc56
mov rdx, rbp
lea rcx, str.Error:_Cant_open_file__s
call fcn.14004f910
xor eax, eax
jmp 0x14004fcf5
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 2]
call fcn.140109828
mov rcx, rsi
call fcn.14010490c
xor r8d, r8d
mov edi, eax
xor edx, edx
mov rcx, rsi
call fcn.140109828
lea ecx, [rdi + 1]
call fcn.1400e9094
mov qword [r14], rax
test rax, rax
jne 0x14004fca9
mov r8, rbp
lea rcx, str.Error:_Cant_allocate__d_bytes_buffer_for_file__s
mov edx, edi
call fcn.14004f910
mov rcx, rsi
mov edi, r15d
call fcn.1400e9730
jmp 0x14004fce8
mov r9, rsi
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.14010ab00
cmp rax, rdi
je 0x14004fcd3
mov rdx, rbp
lea rcx, str.Error:_Cant_read__s
call fcn.14004f910
mov edi, r15d
mov rax, qword [r14]
mov edx, edi
mov byte [rdx + rax], r15b
mov rcx, rsi
call fcn.1400e9730
test edi, edi
jne 0x14004fcf3
mov rcx, qword [r14]
call fcn.1400e9080
mov qword [r14], r15
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140050e40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
call fcn.14004f5b0
mov rdi, rax
mov qword [rsp + 0x30], rax
xor eax, eax
mov dword [rsp + 0x38], 0x80000000
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, [0x140050dd0]
mov dword [rsp + 0x20], eax
xor edx, edx
mov dword [rsp + 0x3c], 3
xor ecx, ecx
mov dword [rsp + 0x40], 3
mov dword [rsp + 0x44], 0x80
mov qword [rsp + 0x48], 0xffffffffffffffff
mov dword [rsp + 0x50], 0x3e5
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x140050ef0
mov edx, 0xbb8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140050ee5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CancelSynchronousIo]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x50], 0x102
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140050efa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
test rdi, rdi
je 0x140050f07
mov rcx, rdi
call fcn.1400e9080
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140050f30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
lea rsi, [rsp + 0x30]
test r9, r9
mov qword [rsp + 0x88], r12
mov edi, r8d
mov r15, rdx
cmovne rsi, r9
lea r8, [rsp + 0x38]
lea r9d, [r12 + 1]
mov edx, r12d
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r14d, eax
test eax, eax
jne 0x140050f94
call fcn.140050120
mov rdx, rax
lea rcx, str.Warning:_Could_not_read_file_pointer__s
call fcn.14004f910
mov ebx, 1
nop dword [rax]
cmp ebx, 1
jbe 0x140050fc1
mov rdx, qword [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140051094
mov r9, rsi
mov qword [rsp + 0x20], r12
mov r8d, edi
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14005100f
mov edx, dword [rsi]
mov dword [0x14019f0c8], r12d
cmp edi, edx
je 0x1400510ae
cmp dword [0x14019f51c], r12d
je 0x140050ffe
test edx, edx
je 0x1400510a2
mov r8d, edi
lea rcx, str.Wrote__d_bytes_but_requested__d
call fcn.14004f910
jmp 0x140051034
call fcn.140050120
mov rdx, rax
lea rcx, str.Write_error__s
call fcn.14004f910
call qword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xc0030000
mov dword [0x14019f0c8], eax
test r14d, r14d
je 0x140051065
cmp ebx, 4
jae 0x14005105a
mov edx, 5
lea rcx, str.Retrying_in__d_seconds...
call fcn.14004f910
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 4
jbe 0x140050fa0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ax, ax
jne 0x14005107b
mov ecx, 0xc003001d
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
lea rcx, str.Could_not_set_file_pointer___Aborting
call fcn.14004f910
jmp 0x140051065
lea rcx, str.Warning:_Possible_short_write
call fcn.14004f910
mov eax, 1
jmp 0x14005107d
Function at 0x140051b20
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
xor ebx, ebx
mov rdi, rdx
mov r14, rcx
lea ebp, [rbx + 0x57]
test rdx, rdx
je 0x140051bd5
mov byte [rdx], bl
lea ecx, [rbp + 0x29]
lea edx, [rbx + 2]
mov qword [rsp + 0x50], rsi
call fcn.1400c537c
lea r8d, [rbp + 0x29]
mov rdx, rax
mov rcx, r14
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test ebx, ebx
je 0x140051bbf
mov qword [rsp + 0x38], 0
mov r9d, 0xffffffff
mov qword [rsp + 0x30], 0
mov r8, rsi
mov dword [rsp + 0x28], 0x80
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test eax, eax
jne 0x140051bbf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test rsi, rsi
je 0x140051bcc
mov rcx, rsi
call fcn.1400e9080
mov rsi, qword [rsp + 0x50]
mov byte [rdi + 0x7f], 0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400520b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r12d, r8d
mov rdi, rdx
mov r15, rcx
mov r14d, 0x104
mov r8d, r14d
lea rcx, [rsp + 0x70]
xor edx, edx
mov r13, r9
call fcn.140136960
mov eax, dword [rbp + 0xf0]
xor esi, esi
mov r8d, eax
mov qword [rsp + 0x60], rsi
xor edx, edx
mov qword [rsp + 0x50], rsi
mov rcx, r13
mov dword [rsp + 0x58], 0xffffffff
mov dword [rsp + 0x5c], eax
call fcn.140136960
test rdi, rdi
je 0x1400522a2
mov rax, 0xffffffffffffffff
mov rbx, rax
nop
inc rbx
cmp byte [rdi + rbx], sil
jne 0x140052140
test rbx, rbx
je 0x14005215c
nop
cmp byte [rdi + rbx], 0x5c
je 0x14005218d
sub rbx, 1
jne 0x140052150
lea rax, [rsp + 0x60]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400521f5
mov qword [rsp + 0x60], rsi
jmp 0x14005228e
cmp rbx, r14
jae 0x1400522a2
inc rax
cmp byte [rdi + rax], sil
jne 0x140052196
inc rax
lea rcx, [rsp + 0x70]
cmp rax, r14
mov rdx, rdi
cmovb r14, rax
mov r8, r14
call fcn.1401362c0
lea rax, [rsp + 0x50]
mov byte [rsp + r14 + 0x6f], sil
mov byte [rsp + rbx + 0x70], sil
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r15
inc rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14005223d
mov qword [rsp + 0x50], rsi
jmp 0x14005227e
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, str.Akeo_ConsultingRufus
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14005223d
mov qword [rsp + 0x50], rsi
jmp 0x14005227e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r13
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x140052279
test eax, eax
jne 0x14005227e
cmp dword [rsp + 0x58], r12d
jne 0x14005227e
cmp dword [rsp + 0x5c], esi
jbe 0x14005227e
mov esi, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14005228e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14005229e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1400522a4
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400b1f80
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400522d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rsi, r9
mov qword [rsp + 0x70], rbx
mov ebp, r8d
mov qword [rsp + 0x78], rbx
mov rdi, rdx
test rdx, rdx
jne 0x140052326
mov r8d, 0x8a
lea rdx, str.D:_a_rufus_rufus_src_registry.h
lea rcx, str.key_name___NULL
call fcn.1400fc264
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov edx, 0x5c
mov rcx, rdi
call fcn.1400b35d4
test rax, rax
je 0x140052351
mov r8d, 0x91
lea rdx, str.D:_a_rufus_rufus_src_registry.h
lea rcx, str.strchr_key_name_____NULL
call fcn.1400fc264
mov edx, 0x5c
mov rcx, rdi
call fcn.1400b35d4
test rax, rax
jne 0x140052314
lea rax, [rsp + 0x70]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140052393
mov qword [rsp + 0x70], rbx
jmp 0x140052417
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREAkeo_ConsultingRufus
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1400523de
mov qword [rsp + 0x78], rbx
jmp 0x140052407
mov eax, dword [rsp + 0x90]
mov r9d, ebp
mov rcx, qword [rsp + 0x78]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140052417
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140052427
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140057f50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.SoftwareMicrosoftPowerShell1Install
mov rcx, 0xffffffff80000002
call fcn.1400520b0
cmp dword [rsp + 0x40], 0
jg 0x140058030
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov r8d, 4
lea rdx, str.SoftwareMicrosoftPowerShell3Install
mov rcx, 0xffffffff80000002
call fcn.1400520b0
cmp dword [rsp + 0x40], 0
jg 0x140058030
mov rax, qword [0x1401d0520]
lea rsi, [0x1401e67a0]
mov ebp, 0xffc
lea r9, str.Notice:_The_ISO_download_feature_has_been_deactivated_because_a_compatible_PowerShell_version_was_not_detected_on_this_system.
sub rbp, rax
mov rbx, 0xffffffffffffffff
mov r8, rbx
mov rdx, rbp
lea rdi, [rax + rsi]
mov rcx, rdi
call fcn.140004960
mov byte [rdi + rbp - 1], 0
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140058000
mov word [rbx + rsi], 0xa0d
add rbx, 2
mov qword [0x1401d0520], rbx
cmp rbx, 0x1000
jae 0x1400580c2
mov byte [rbx + rsi], 0
jmp 0x1400580ad
cmp dword [0x1401a03d8], 0
jne 0x14005808e
call fcn.140052800
test eax, eax
jg 0x14005808e
mov rax, qword [0x1401d0520]
lea rsi, [0x1401e67a0]
mov ebp, 0xffc
lea r9, str.Notice:_The_ISO_download_feature_has_been_deactivated_because_Check_for_updates_is_disabled_in_your_settings.
sub rbp, rax
mov rbx, 0xffffffffffffffff
mov r8, rbx
mov rdx, rbp
lea rdi, [rax + rsi]
mov rcx, rdi
call fcn.140004960
mov byte [rdi + rbp - 1], 0
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140058080
jmp 0x140058009
xor eax, eax
lea r8, [0x140057cb0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.1400b20a8
int3