joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001739c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r8, rcx
mov edx, 0x104
lea rcx, [rsp + 0x20]
xor ebx, ebx
call fcn.140001470
test eax, eax
js 0x140017427
or rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x20]
mov rax, rcx
inc rax
cmp word [rdx + rax*2], bx
jne 0x1400173db
test rax, rax
je 0x14001740e
cmp word [rsp + rax*2 + 0x1e], 0x5c
jne 0x14001740e
lea rdx, [rsp + 0x20]
mov rax, rcx
inc rax
cmp word [rdx + rax*2], bx
jne 0x1400173f9
test rax, rax
je 0x14001740e
mov word [rsp + rax*2 + 0x1e], bx
jmp 0x1400173d3
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140017427
test al, 0x10
je 0x140017427
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14003c6c0
add rsp, 0x240
pop rbx
ret

Function at 0x140017448
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140017467
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140017467
test al, 0x10
jne 0x140017467
mov eax, 1
jmp 0x140017469
xor eax, eax
add rsp, 0x28
ret

Function at 0x140017474
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
or rcx, 0xffffffffffffffff
mov rsi, rcx
xor ebx, ebx
inc rsi
cmp word [rbp + rsi*2], bx
jne 0x140017496
add rsi, 0x14
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.14003c310
mov rdi, rax
test rax, rax
je 0x1400175af
mov r8, rbp
mov rdx, rsi
mov rcx, rax
call fcn.140001470
lea rdx, [0x140042138]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcsstr]
mov r14, rax
test rax, rax
je 0x1400175a7
add r14, 4
mov r15d, ebx
lea rdx, [0x140042140]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x14001759c
mov rcx, rdi
mov word [rax], bx
lea r14, [rax + 2]
call fcn.14001739c
test eax, eax
jne 0x14001756c
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x57
cmove eax, ecx
mov rcx, rdi
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
call fcn.14001739c
mov r8, rdi
test eax, eax
je 0x140017588
xor r9d, r9d
lea edx, [r9 + 5]
lea ecx, [rdx + 3]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call fcn.140001470
inc r15d
cmp r15d, 0xa
jge 0x14001759c
jmp 0x1400174f5
mov r9d, r12d
lea rdx, str.ERROR:_Could_not_create_directory__S.__Error:_0x_x._r_n
mov ecx, 2
call fcn.140016868
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, rdi
call fcn.14003c2b8
test rbp, rbp
je 0x1400175be
mov rcx, rbp
call fcn.14001739c
mov ebx, eax
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400179e0
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x47], rax
or qword [rbp + 0x2f], 0xffffffffffffffff
xor r14d, r14d
mov esi, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x2f]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140017b2d
mov rcx, qword [rbp + 0x2f]
lea rax, [rbp + 0x27]
lea edi, [r14 + 2]
mov dword [rbp + 0x27], r14d
mov edx, edi
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [rbp + 0x27]
call fcn.14003c310
mov rbx, rax
test rax, rax
je 0x140017b1e
mov r9d, dword [rbp + 0x27]
lea rax, [rbp + 0x27]
mov rcx, qword [rbp + 0x2f]
mov r8, rbx
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140017b16
lea rax, [rbp + 0x37]
mov dword [rbp + 0x3f], r14d
mov qword [rsp + 0x50], rax
lea r8d, [r14 + 0x20]
mov dword [rsp + 0x48], r14d
lea rcx, [rbp + 0x3f]
mov dword [rsp + 0x40], r14d
mov r9d, 0x220
mov dword [rsp + 0x38], r14d
mov dl, dil
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov word [rbp + 0x43], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140017b16
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x140017b0c
mov rcx, qword [rbp + 0x37]
mov edx, edi
add rdx, rdx
mov rdx, qword [rbx + rdx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140017b07
inc edi
cmp edi, dword [rbx]
jb 0x140017ae7
jmp 0x140017b0c
mov esi, 1
mov rcx, qword [rbp + 0x37]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rbx
call fcn.14003c2b8
mov rcx, qword [rbp + 0x2f]
test rcx, rcx
je 0x140017b2d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14003c6c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140017b60
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x48]
and qword [rsp + 0x48], 0
lea rdx, [0x140042298]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140017bcd
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.PendingFileRenameOperations
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x14001812c
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rdx
mov rsi, rcx
mov ebp, 0x104
lea rcx, [rsp + 0x20]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140018194
lea r8, [0x14003f558]
mov edx, ebp
lea rcx, [rsp + 0x20]
call fcn.140001584
test eax, eax
js 0x140018194
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140018194
test al, 0x10
je 0x1400181d3
mov edx, ebp
lea rcx, [rsp + 0x20]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400181ed
lea r8, str.msdxm.ocx
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.140001584
test eax, eax
js 0x1400181ed
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400181ed
test al, 0x10
jne 0x1400181ed
shr rdi, 1
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rsi
call fcn.140001470
xor ebx, ebx
test eax, eax
setns bl
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14003c6c0
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018534
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x50
mov ebx, dword [0x1400516cc]
lea rax, [r11 + 8]
xor edi, edi
lea rdx, str.SoftwareMicrosoftMediaPlayerSetupUserOptions
mov qword [r11 - 0x18], rdi
xor r9d, r9d
mov qword [r11 - 0x20], rax
xor r8d, r8d
mov qword [r11 - 0x28], rdi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], edi
mov qword [r11 + 8], rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400185e1
test ebx, ebx
lea rax, [0x140040b28]
lea rcx, [0x140042554]
cmovne rcx, rax
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x1400185a2
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, str.DesktopShortcut
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1400185f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp - 8], rax
lea rax, [rbp - 0x3c]
mov dword [rbp - 0x3c], 0x28
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov rdi, rdx
mov ebx, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x40], ebx
lea rdx, str.DesktopShortcut
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400186be
cmp dword [rbp - 0x40], ebx
jne 0x140018671
lea rdx, [rbp - 0x30]
lea rcx, [0x140040b28]
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor ecx, ecx
test eax, eax
sete cl
mov dword [rdi], ecx
jmp 0x1400186bc
cmp dword [rbp - 0x40], 4
jne 0x1400186be
lea rax, [rbp - 0x3c]
mov dword [rbp - 0x38], ebx
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x40]
lea rax, [rbp - 0x38]
mov dword [rbp - 0x3c], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DesktopShortcut
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400186be
cmp dword [rbp - 0x40], 4
jne 0x1400186be
cmp dword [rbp - 0x38], ebx
sete al
mov dword [rdi], eax
xor ebx, ebx
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003c6c0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018cd0
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140018d47
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
mov esi, 0x57
cmove ebx, esi
cmp ebx, 5
jne 0x140018d47
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140018d47
test al, 1
je 0x140018d47
and eax, 0xfffffffe
mov rcx, rdi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140018d47
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140018d3a
xor ebx, ebx
jmp 0x140018d47
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
cmove ebx, esi
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140018d60
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x390], rax
or rbx, 0xffffffffffffffff
mov dword [rdx], 1
xor r12d, r12d
mov r15, rdx
mov rdi, rcx
inc rbx
cmp word [rcx + rbx*2], r12w
jne 0x140018da3
lea rax, [rbx + 3]
mov r13d, 0x104
cmp rax, r13
jbe 0x140018deb
call fcn.140018cd0
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.14003c6c0
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, rdi
lea rcx, [rbp + 0x180]
mov rdx, r13
call fcn.140001470
test rbx, rbx
je 0x140018e2b
cmp word [rdi + rbx*2 - 2], 0x3a
je 0x140018e2b
cmp word [rdi + rbx*2 - 2], 0x5c
je 0x140018e2b
lea r8, [0x140042140]
mov rdx, r13
lea rcx, [rbp + 0x180]
call fcn.140001584
inc rbx
lea r8, [0x1400427dc]
mov rdx, r13
lea rcx, [rbp + 0x180]
call fcn.140001584
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140018e64
mov rcx, rdi
jmp 0x140018dbc
lea rsi, [rbx + rbx]
cmp rsi, 0x208
jae 0x140018fd4
mov word [rbp + rsi + 0x180], r12w
lea rcx, [rbp + 0x164]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140018e89
test rax, rax
lea rcx, [rbp + 0x164]
lea r8, [rsp + 0x5c]
mov rdx, r13
cmovne r8, rcx
lea rcx, [rbp + 0x180]
call fcn.140001584
mov ebx, dword [rsp + 0x30]
test bl, 0x10
je 0x140018f20
movzx ecx, word [rsp + 0x5c]
cmp cx, word [0x1400427e0]
movzx eax, word [rsp + 0x5e]
jne 0x140018ede
cmp ax, word [0x1400427e2]
je 0x140018fb0
cmp cx, word [0x1400427e4]
jne 0x140018f02
cmp ax, word [0x1400427e6]
jne 0x140018f02
movzx eax, word [rsp + 0x60]
cmp ax, word [0x1400427e8]
je 0x140018fb0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x180]
call fcn.140018d60
test eax, eax
je 0x140018fb0
jmp 0x140018fad
test bl, 1
je 0x140018f37
mov edx, ebx
lea rcx, [rbp + 0x180]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140018fb0
lea rcx, [rbp + 0x164]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140018f53
test rax, rax
je 0x140018f9e
lea r8, [rsp + 0x5c]
mov word [rbp + rsi + 0x180], r12w
mov rdx, r13
lea rcx, [rbp + 0x180]
call fcn.140001584
lea r8, [rbp + 0x164]
mov word [rbp + rsi + 0x180], r12w
mov rdx, r13
lea rcx, [rbp + 0x180]
call fcn.140001584
mov edx, ebx
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [r15], r12d
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140018e75
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140018e5c
call fcn.14003c898
int3
Function at 0x1400191f0
Capabilities:
Copy file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xe
jae 0x140019267
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
and qword [rsp + 0x28], 0
call fcn.1400169fc
test eax, eax
je 0x140019257
mov rax, qword [rsp + 0x20]
xor edx, edx
mov rcx, rdi
call qword [0x14003f118]
test eax, eax
jne 0x140019257
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rbx
lea rdx, str.ERROR:_Decryption_failed_for_file__S.__Last_result:_0x_x._r_n
mov r9d, eax
mov ecx, 2
call fcn.140016868
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140019267
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xe
jae 0x1400192e2
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
and qword [rsp + 0x28], 0
call fcn.1400169fc
test eax, eax
je 0x1400192d2
mov rax, qword [rsp + 0x20]
xor edx, edx
mov rcx, rbx
call qword [0x14003f118]
test eax, eax
jne 0x1400192d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rbx
lea rdx, str.ERROR:_Decryption_failed_for_file__S.__Last_result:_0x_x._r_n
mov r9d, eax
mov ecx, 2
call fcn.140016868
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400192e2
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret

Function at 0x1400192f8
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
mov edi, 0x104
mov edx, edi
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400193c7
mov r8, rbx
lea rcx, [rsp + 0x240]
mov edx, edi
call fcn.140001470
lea r8, str.DllCache
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140001584
mov edx, 0x5c
lea rcx, [rsp + 0x240]
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
je 0x1400193c7
mov r8, rax
lea rcx, [rsp + 0x30]
mov edx, edi
call fcn.140001584
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400193c7
test al, 0x10
jne 0x1400193c7
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call fcn.1400191f0
test eax, eax
jne 0x1400193c7
and dword [rsp + 0x20], eax
lea r8d, [rax + 1]
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call fcn.140018810
mov r8, rbx
lea rdx, str._Copied_file__S_to_DllCache._r_n
mov ecx, 4
call fcn.140016868
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14003c6c0
mov rbx, qword [rsp + 0x478]
add rsp, 0x460
pop rdi
ret
Function at 0x140019404
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov r14, rcx
mov qword [rax + 0x10], r15
lea ecx, [r15 + 0x28]
call fcn.14003c310
mov rsi, rax
test rax, rax
jne 0x140019441
mov eax, 0x8007000e
jmp 0x140019628
lea rax, [rsp + 0x78]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or rbp, 0xffffffffffffffff
test eax, eax
jne 0x1400194f5
mov ecx, 0x208
call fcn.14003c310
mov rbx, rax
test rax, rax
je 0x1400194ea
mov edi, 0x104
mov rcx, rax
mov edx, edi
call fcn.140016a5c
test eax, eax
je 0x1400194e2
lea r8, str.__Fixups
mov edx, edi
mov rcx, rbx
call fcn.140001584
mov rax, rbp
inc rax
cmp word [rbx + rax*2], r15w
jne 0x1400194ad
mov rcx, qword [rsp + 0x78]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.MPlayer2_FixUp
mov r9d, 1
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call fcn.14003c2b8
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetupFileMoveCacheSource
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test eax, eax
jne 0x1400195f9
mov r9d, dword [0x1400516e8]
lea ebx, [rax + 0x14]
jmp 0x140019560
mov r9d, dword [0x1400516e8]
cmp r9d, 0x3e8
jge 0x140019594
inc r9d
mov dword [0x1400516e8], r9d
lea r8, [0x140042130]
mov rdx, rbx
mov rcx, rsi
call fcn.140001734
mov rcx, qword [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov rdx, rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140019546
inc rbp
cmp word [r14 + rbp*2], r15w
jne 0x140019594
mov rcx, qword [rsp + 0x78]
lea eax, [rbp*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
jne 0x1400195d1
inc dword [0x1400516e8]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1400195f9
mov r8, r14
lea rdx, str.File_replacement_for__S_queued_in_non_admin_file_cache._r_n
lea ecx, [rdi + 4]
call fcn.140016868
mov ebx, 0xd2af9
jmp 0x14001961e
movzx ebx, di
lea rdx, str.ERROR:_Could_not_store_delayed_file_move_for__S:_0x_x._r_n
or ebx, 0x80070000
mov r8, r14
test edi, edi
mov ecx, 2
cmovle ebx, edi
mov r9d, ebx
call fcn.140016868
mov rcx, rsi
call fcn.14003c2b8
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14001a0b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r13d, r13d
lea rax, [rbp + 0x48]
mov qword [r11 - 0x50], r13
mov r15, r8
mov qword [r11 - 0x58], r13
mov r12, rdx
mov qword [r11 - 0x60], r13
xor r9d, r9d
mov qword [r11 - 0x68], r13
xor r8d, r8d
mov qword [r11 - 0x70], r13
xor edx, edx
mov qword [r11 - 0x78], r13
mov r14, rcx
mov qword [r11 - 0x80], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x20], r13d
mov dword [rbp + 0x48], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14001a12c
xor eax, eax
jmp 0x14001a2ab
or r8, 0xffffffffffffffff
mov rcx, r8
inc rcx
cmp word [r12 + rcx*2], r13w
jne 0x14001a133
mov eax, dword [rbp + 0x48]
cmp ecx, eax
mov dword [rbp - 0x1c], ecx
cmova eax, ecx
inc dword [rbp - 0x20]
add eax, 5
mov ecx, eax
mov dword [rbp + 0x48], eax
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.14003c310
mov rsi, rax
test rax, rax
jne 0x14001a17a
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14001a125
mov qword [rbp - 0x10], r13
mov edi, r13d
mov edx, dword [rbp + 0x48]
lea r8, str._s_lu
mov r9, r12
mov dword [rsp + 0x20], edi
mov rcx, rsi
call fcn.140001734
lea rax, [rbp - 0x10]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001a25f
test r15, r15
je 0x14001a23b
mov ecx, 0x208
call fcn.14003c310
mov rbx, rax
test rax, rax
je 0x14001a23b
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov dword [rbp - 0x18], 1
mov dword [rbp - 0x1c], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001a233
cmp dword [rbp - 0x18], 1
jne 0x14001a233
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r13w
jne 0x14001a214
test rax, rax
je 0x14001a233
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14001a255
mov rcx, rbx
call fcn.14003c2b8
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
mov qword [rbp - 0x10], r13
cmp edi, dword [rbp - 0x20]
ja 0x14001a29f
jmp 0x14001a181
mov rcx, rbx
call fcn.14003c2b8
jmp 0x14001a29f
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov rdx, rsi
mov rcx, r14
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp - 0x10]
test eax, eax
cmovne rcx, r13
mov qword [rbp - 0x10], rcx
mov rcx, rsi
call fcn.14003c2b8
mov rax, qword [rbp - 0x10]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret