joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140068750
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
cmp byte [rcx + 0x240], 0
mov rbx, rcx
je 0x140068882
xor ebp, ebp
mov qword [rcx + 0x248], rdx
mov dword [rcx + 0x250], r8d
test rdx, rdx
jne 0x140068791
mov eax, ebp
jmp 0x14006879f
mov ecx, dword [rcx + 0x2dc]
mov r8d, r8d
call fcn.140073240
mov dword [rbx + 0x2dc], eax
nop word [rax + rax]
cmp dword [rbx + 0x250], ebp
jbe 0x14006887e
cmp dword [rbx + 0x268], ebp
jne 0x140068841
mov rcx, qword [rbx + 0x228]
mov r8d, dword [rbx + 0x2ac]
mov rdx, qword [rbx + 0x2d0]
mov eax, ebp
mov dword [rsp + 0x50], eax
cmp rcx, 0xffffffffffffffff
je 0x14006880f
test rdx, rdx
je 0x14006880f
test r8d, r8d
je 0x14006880f
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14006880b
mov eax, ebp
mov dword [rsp + 0x50], eax
jmp 0x14006880f
mov eax, dword [rsp + 0x50]
lock add qword [0x1401f3d68], rax
mov eax, dword [rbx + 0x2ac]
cmp dword [rsp + 0x50], eax
jne 0x140068882
mov rax, qword [rbx + 0x2d0]
mov qword [rbx + 0x260], rax
mov dword [rbx + 0x2ac], ebp
mov dword [rbx + 0x268], 0x100000
mov rdi, qword [rbx + 0x270]
lea rcx, [rbx + 0x248]
xor edx, edx
lea r14, [rbx + 0x2ac]
call fcn.140077d30
mov ecx, dword [rbx + 0x270]
sub ecx, edi
add ecx, dword [rbx + 0x2ac]
mov dword [r14], ecx
test eax, eax
je 0x1400687b0
cmp eax, 2
sete al
jmp 0x140068884
mov al, 1
jmp 0x140068884
xor al, al
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140069020
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
movsxd rdi, r8d
test r8d, r8d
jle 0x140069050
mov eax, ebx
nop word [rax + rax]
mov byte [rsp + rax + 0x40], dl
inc rax
shr rdx, 8
cmp rax, rdi
jl 0x140069040
mov rcx, qword [rcx + 0x228]
mov dword [rsp + 0x50], ebx
cmp rcx, 0xffffffffffffffff
je 0x14006908c
test r8d, r8d
je 0x14006908c
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
mov r8d, edi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140069088
mov dword [rsp + 0x50], ebx
jmp 0x14006908c
mov ebx, dword [rsp + 0x50]
mov eax, ebx
lock add qword [0x1401f3d68], rax
cmp dword [rsp + 0x50], edi
mov rbx, qword [rsp + 0x48]
sete al
add rsp, 0x30
pop rdi
ret

Function at 0x1400690b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
movsxd rdi, r8d
test r8d, r8d
jle 0x1400690df
mov eax, ebx
nop word [rax + rax]
mov byte [rsp + rax + 0x40], dl
inc rax
shr edx, 8
cmp rax, rdi
jl 0x1400690d0
mov rcx, qword [rcx + 0x228]
mov dword [rsp + 0x50], ebx
cmp rcx, 0xffffffffffffffff
je 0x14006911b
test r8d, r8d
je 0x14006911b
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
mov r8d, edi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140069117
mov dword [rsp + 0x50], ebx
jmp 0x14006911b
mov ebx, dword [rsp + 0x50]
mov eax, ebx
lock add qword [0x1401f3d68], rax
cmp dword [rsp + 0x50], edi
mov rbx, qword [rsp + 0x48]
sete al
add rsp, 0x30
pop rdi
ret
Function at 0x14006c2a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r13
push r15
sub rsp, 0x30
mov rsi, rcx
mov ebx, edx
xor ecx, ecx
xor r15b, r15b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
lea r8, [0x1401c1fd8]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x14006c449
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp eax, 0x10
jbe 0x14006c449
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14006c449
mov edx, ebx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
je 0x14006c449
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14006c41f
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call fcn.14014cbf0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x50], 0
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x14006c41f
mov rcx, qword [rsp + 0x50]
call fcn.140018fd0
mov rcx, qword [rsp + 0x50]
mov rdi, rax
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
test rdi, rdi
je 0x14006c41f
mov r9d, dword [rsp + 0x70]
lea rcx, [rsi + 0x48]
mov edx, 0x1e0
mov qword [rsp + 0x20], 0
mov r8d, 0xfc
call fcn.1400190a0
test al, al
je 0x14006c412
mov r8d, dword [rsp + 0x70]
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 8]
call qword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x14006c3e5
mov dword [rdi + 0x10], eax
jmp 0x14006c412
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x14006c412
mov r8d, dword [rsp + 0x70]
mov rdx, rbx
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
test rbx, rbx
je 0x14006c40f
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r15b, 1
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test r15b, r15b
je 0x14006c449
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov dword [rsi + 0x58], eax
mov al, 1
mov dword [rsi + 0x5c], 0
mov byte [rsi + 0x60], 0
jmp 0x14006c44b
xor al, al
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r13
pop rdi
ret
Function at 0x14006dd20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp qword [rcx + 0x120], rbp
je 0x14006dd4f
mov qword [rcx + 0x120], rbp
mov rcx, qword [rcx + 0x118]
test rcx, rcx
je 0x14006dd68
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rbx + 0x118], rbp
mov rdx, rdi
mov qword [rbx + 0x128], rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbx + 0x128], eax
cmp eax, 0x390
jb 0x14006ddc9
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbx + 0x118], rax
test rax, rax
je 0x14006ddc9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbx + 0x120], rax
test rax, rax
jne 0x14006ddd3
mov rcx, qword [rbx + 0x118]
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rbx + 0x118], rbp
mov dword [rbx + 0x128], ebp
xor al, al
jmp 0x14006ddd5
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140070f90
Capabilities:
Read file on windows

Disassembly:
push rsi
mov eax, 0x2040
call fcn.14002ef70
sub rsp, rax
mov rsi, rcx
mov rcx, qword [rdx + 8]
test rcx, rcx
je 0x14007108c
mov qword [rsp + 0x2060], rbp
xor r9d, r9d
xor ebp, ebp
mov qword [rsp + 0x2068], rdi
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [rbp + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14007107c
mov qword [rsp + 0x2050], rbx
nop dword [rax]
mov ebx, ebp
mov r8d, 0x2000
mov eax, ebx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x2058], ebp
sub r8d, ebx
mov qword [rsp + 0x20], rbp
add rdx, rax
lea r9, [rsp + 0x2058]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007104b
mov eax, dword [rsp + 0x2058]
test eax, eax
je 0x14007104b
add ebx, eax
cmp ebx, 0x2000
jb 0x140071002
mov eax, ebx
lock add qword [0x1401f3d70], rax
test ebx, ebx
je 0x14007106b
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400713a0
jmp 0x140071000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x2050]
mov rbp, qword [rsp + 0x2060]
mov rdi, qword [rsp + 0x2068]
add rsp, 0x2040
pop rsi
ret

Function at 0x140071200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r11d, edx
mov ebx, r9d
test r8, r8
je 0x14007125b
test ebx, ebx
je 0x14007125b
test rcx, rcx
je 0x140071291
xor r10d, r10d
test edx, edx
je 0x140071291
xor r9b, r9b
nop dword [rax + rax]
xor edx, edx
lea rcx, [rcx + 1]
mov eax, r10d
inc r10d
div ebx
add r9b, byte [rdx + r8]
xor byte [rcx - 1], r9b
movzx r9d, byte [rcx - 1]
cmp r10d, r11d
jb 0x140071230
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
test rcx, rcx
je 0x140071291
test edx, edx
je 0x140071291
xor dl, dl
lea r9, [0x1401bd1e0]
xor r10d, r10d
mov r8, r11
mov rax, r10
lea rcx, [rcx + 1]
and eax, 0xf
inc r10
add dl, byte [r9 + rax*4]
xor byte [rcx - 1], dl
movzx edx, byte [rcx - 1]
sub r8, 1
jne 0x140071273
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140071310
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
test rcx, rcx
je 0x140071341
test edx, edx
je 0x140071341
xor r9b, r9b
mov edx, edx
xor r10d, r10d
mov rax, r10
lea rcx, [rcx + 1]
and eax, 0xf
inc r10
add r9b, byte [r8 + rax*4]
xor byte [rcx - 1], r9b
movzx r9d, byte [rcx - 1]
sub rdx, 1
jne 0x140071321
ret

Function at 0x140071350
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r9, rcx
test rcx, rcx
je 0x140071394
test edx, edx
je 0x140071394
xor al, al
mov r11d, edx
xor r10d, r10d
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov rcx, r10
inc r10
and ecx, 0xf
add al, byte [r8 + rcx*4]
xor al, dl
mov byte [r9 - 1], al
movzx eax, dl
sub r11, 1
jne 0x140071370
ret
Function at 0x140076a30
Capabilities:
Compute adler32 checksum

Disassembly:
mov r9d, ecx
mov r10, rdx
shr r9d, 0x10
movzx ecx, cx
cmp r8, 1
jne 0x140076a74
movzx edx, byte [rdx]
add edx, ecx
cmp edx, 0xfff1
lea r8d, [rdx - 0xfff1]
cmovb r8d, edx
lea eax, [r8 + r9]
cmp eax, 0xfff1
lea ecx, [rax - 0xfff1]
cmovb ecx, eax
shl ecx, 0x10
or ecx, r8d
mov eax, ecx
ret
test rdx, rdx
jne 0x140076a7d
lea eax, [rdx + 1]
ret
cmp r8, 0x10
jae 0x140076acc
test r8, r8
je 0x140076aa3
nop dword [rax + rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
add ecx, eax
add r9d, ecx
sub r8, 1
jne 0x140076a90
cmp ecx, 0xfff1
lea r8d, [rcx - 0xfff1]
mov eax, 0x80078071
cmovb r8d, ecx
mul r9d
shr edx, 0xf
imul eax, edx, 0xf
add eax, r9d
shl eax, 0x10
or eax, r8d
ret
cmp r8, 0x15b0
jb 0x140076ba7
mov r11, r8
movabs rax, 0x79baa6bb6398b6f7
mul r8
sub r11, rdx
shr r11, 1
add r11, rdx
shr r11, 0xc
imul rax, r11, 0xffffffffffffea50
add r8, rax
mov edx, 0x2b6
nop word [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add r10, 8
add ecx, eax
add r9d, ecx
add edx, 0xffffffff
jne 0x140076b10
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
sub r11, 1
jne 0x140076b00
test r8, r8
je 0x140076c59
cmp r8, 8
jb 0x140076c20
mov rdx, r8
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r8, rax
nop word [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add r10, 8
add ecx, eax
add r9d, ecx
sub rdx, 1
jne 0x140076bc0
test r8, r8
je 0x140076c33
nop
movzx eax, byte [r10]
lea r10, [r10 + 1]
add ecx, eax
add r9d, ecx
sub r8, 1
jne 0x140076c20
mov eax, 0x80078071
mul ecx
mov eax, 0x80078071
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mul r9d
shr edx, 0xf
imul edx, edx, 0xffff000f
add r9d, edx
shl r9d, 0x10
or r9d, ecx
mov eax, r9d
ret
Function at 0x14007f180
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
movzx esi, dl
add rcx, 0x4df0
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x4e18]
test rcx, rcx
je 0x14007f1b3
call fcn.140024a20
lea rcx, [rbx + 0x4df0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x4de0]
test rcx, rcx
je 0x14007f1d7
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call fcn.14007f290
test sil, sil
je 0x14007f249
mov byte [rbx + 0x5e28], 1
mov dword [rbx + 0x5b14], 3
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
mov edx, 2
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov r9d, 4
xor r8d, r8d
mov rcx, rax
mov edx, 0x470
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rbx + 0x5ee8]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140080cd0
mov rsi, qword [rsp + 0x38]
mov word [rbx + 0x5e28], 0x100
mov dword [rbx + 0x5b14], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400840c0
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x580]
sub rsp, 0x680
xor r15d, r15d
mov dword [rsp + 0x64], 0x104
mov esi, edx
mov dword [rsp + 0x60], r15d
lea rax, [rsp + 0x68]
mov word [rsp + 0x68], r15w
mov qword [rsp + 0x58], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea rax, [0x1401b6698]
mov qword [rbp + 0x5c8], r15
mov qword [rsp + 0x50], rax
mov r14, rcx
lea rax, [rbp + 0x5c8]
or esi, 0x20019
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov edi, r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140084304
mov rcx, qword [rbp + 0x5c8]
lea r9, [rbp + 0x5b8]
mov qword [rsp + 0x38], r15
lea r8, [rbp + 0x370]
mov qword [rsp + 0x30], r15
xor edx, edx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov dword [rbp + 0x5b8], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400842f7
mov qword [rsp + 0x678], rbx
cmp dword [rbp + 0x5b8], r15d
jbe 0x1400842ef
xor edx, edx
mov word [rbp + 0x170], r15w
mov r8d, 0x1fe
lea rcx, [rbp + 0x172]
call fcn.14014d290
lea r8, [rbp + 0x370]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
lea rcx, [rsp + 0x50]
call fcn.140003670
mov rdx, qword [rsp + 0x58]
xor eax, eax
mov dword [rbp + 0x5b0], 0x1fe
mov dword [rbp + 0x170], eax
test rdx, rdx
je 0x140084282
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r15
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x5c0], r15d
mov rcx, 0xffffffff80000002
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140084267
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0x5b0]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x5c0]
lea rax, [rbp + 0x170]
xor r8d, r8d
lea rdx, str.InstallLocation
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete bl
test bl, bl
je 0x140084282
mov rdx, qword [0x1401f23a8]
lea rcx, [rbp + 0x170]
call fcn.14003e590
test eax, eax
je 0x1400842c9
mov rcx, qword [rbp + 0x5c8]
lea r9, [rbp + 0x5b8]
mov qword [rsp + 0x38], r15
lea r8, [rbp + 0x370]
mov qword [rsp + 0x30], r15
inc edi
mov qword [rsp + 0x28], r15
mov edx, edi
mov qword [rsp + 0x20], r15
mov dword [rbp + 0x5b8], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140084191
jmp 0x1400842ef
mov rcx, qword [r14 + 0xa8]
lea r8, [rbp + 0x370]
add rcx, 0x418
mov r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.14003c218
mov rbx, qword [rsp + 0x678]
mov rcx, qword [rbp + 0x5c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [r14 + 0xa8]
cmp word [rax + 0x418], r15w
setne al
add rsp, 0x680
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140084700
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x490
mov rdi, rdx
mov rsi, rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor eax, eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0x104
mov word [rsp + 0x38], ax
lea rax, [0x1401b6698]
mov qword [rsp + 0x20], rax
test rdx, rdx
je 0x1400847e8
mov r8, rdx
lea rdx, str._s.
lea rcx, [rsp + 0x20]
call fcn.140003670
lea rdx, [rsp + 0x240]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400847e8
nop word [rax + rax]
test byte [rsp + 0x240], 0x10
je 0x1400847c9
cmp word [rsp + 0x26c], 0x2e
je 0x1400847c9
lea r9, [rsp + 0x26c]
mov r8, rdi
lea rdx, [0x1401bff50]
lea rcx, [rsp + 0x20]
call fcn.140003670
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140084700
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, [rsp + 0x240]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140084780
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140084810
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
test rdx, rdx
je 0x1400849a0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x490
mov rdi, rdx
mov rbx, rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor eax, eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0x104
mov word [rsp + 0x38], ax
lea rax, [0x1401b6698]
mov qword [rsp + 0x20], rax
mov r8, rdx
lea rdx, str._s.
lea rcx, [rsp + 0x20]
call fcn.140003670
lea rdx, [rsp + 0x240]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14008498c
nop
lea r9, [rsp + 0x26c]
mov r8, rdi
lea rdx, [0x1401bff50]
lea rcx, [rsp + 0x20]
call fcn.140003670
test byte [rsp + 0x240], 0x10
je 0x14008495e
movzx ecx, word [rsp + 0x26c]
movzx eax, word [rsp + 0x26e]
cmp cx, 0x2e
jne 0x1400848ee
test ax, ax
je 0x140084969
cmp cx, cx
jne 0x1400848ee
cmp ax, cx
jne 0x1400848ee
cmp word [rsp + 0x270], 0
je 0x140084969
mov rax, qword [rbx + 0xa8]
test byte [rax + 0x850], 1
jne 0x140084946
lea rdx, str.MQL4
lea rcx, [rsp + 0x26c]
call fcn.14003e590
test eax, eax
je 0x140084969
lea rdx, [0x1401c5f48]
lea rcx, [rsp + 0x26c]
call fcn.14003e590
test eax, eax
je 0x140084969
lea rdx, str.config
lea rcx, [rsp + 0x26c]
call fcn.14003e590
test eax, eax
je 0x140084969
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call fcn.140084810
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x240]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140084890
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140085470
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x240
mov rax, qword [rcx + 0xa8]
mov rsi, rcx
test byte [rax + 0x850], 1
je 0x14008549a
call fcn.1400849b0
mov rdi, qword [rsi + 0xa8]
mov edx, 0x19
mov rbx, qword [0x1401f23a8]
mov r8, rbx
lea r9, [rdi + 0x85c]
call fcn.140092660
lea r9, [rdi + 0x85c]
mov r8, rbx
mov edx, reloc.WS2_32.dll_recv
call fcn.140092660
mov rax, qword [rsi + 0xa8]
cmp dword [rax + 0x858], 0xb
jne 0x14008550f
mov rbx, qword [0x1401f23a8]
lea r9, str.MetaEditor_4
mov r8, rbx
mov edx, 0x19
call fcn.140092660
lea r9, str.MetaEditor_4
mov r8, rbx
mov edx, reloc.WS2_32.dll_recv
call fcn.140092660
mov rax, qword [rsi + 0xa8]
cmp dword [rax + 0x858], 3
jne 0x14008554e
mov rbx, qword [0x1401f23a8]
lea r9, str.MetaEditor_5
mov r8, rbx
mov edx, 0x19
call fcn.140092660
lea r9, str.MetaEditor_5
mov r8, rbx
mov edx, reloc.WS2_32.dll_recv
call fcn.140092660
mov rdx, qword [0x1401f23a8]
mov rcx, rsi
call fcn.140084810
mov rdx, qword [0x1401f23a8]
mov rcx, rsi
call fcn.140084700
mov r8, qword [rsi + 0xa8]
xor ebx, ebx
add r8, 0x418
cmp word [r8], bx
je 0x140085609
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
lea rax, [0x1401b6698]
mov dword [rsp + 0x34], 0x104
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov word [rsp + 0x38], bx
call fcn.140003670
mov rdx, qword [rsp + 0x28]
xor r9d, r9d
mov r8d, 0x20206
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov rdx, qword [rsp + 0x28]
xor r9d, r9d
mov r8d, 0x20106
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
lea rax, [0x1401b6738]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebx
mov rcx, qword [rsi + 0x298]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [rsi + 0x310]
test rdx, rdx
je 0x14008563b
mov rcx, qword [rsi + 0x298]
call qword [sym.imp.USER32.dll_KillTimer]
mov qword [rsi + 0x310], rbx
mov qword [rsi + 0x308], rbx
mov dword [rsi + 0x2f8], 8
mov dword [rsi + 0x2f4], 8
mov dword [rsi + 0x2e8], 9
mov dword [rsi + 0x2ec], ebx
mov byte [rsi + 0x2f0], bl
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xor edx, edx
mov qword [rsi + 0x300], rax
mov rcx, qword [rsi + 0x298]
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov edx, 0x464
lea r8d, [r9 + 4]
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
jmp qword [sym.imp.USER32.dll_PostMessageW]