joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012efc
Capabilities:
Delete file
Terminate process

Disassembly:
sub rsp, 0x28
cmp byte [0x140087b37], 0
je 0x140012f22
cmp qword [0x140087b20], 0
je 0x140012f22
cmp qword [0x1400981e0], 0
je 0x140012f22
call fcn.1400255e4
cmp qword [0x140086a68], 0
je 0x140012f4a
mov rcx, qword [0x1400980a8]
test rcx, rcx
je 0x140012f4a
call fcn.14001c8bc
mov rcx, qword [0x140086a68]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
cmp qword [0x140086a80], 0
je 0x140012f72
mov rcx, qword [0x140087b80]
test rcx, rcx
je 0x140012f72
call fcn.14001c8bc
mov rcx, qword [0x140086a80]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov rcx, qword [0x1400981e0]
test rcx, rcx
je 0x140012f83
call fcn.14001c8bc
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14001628c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x20
mov eax, ecx
mov ebx, ecx
xor ecx, ecx
shr eax, 4
inc ax
movzx edx, ax
lea r8d, [rcx + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400162ea
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rax
test rax, rax
je 0x1400162ea
and ebx, 0xf
je 0x1400162d8
movzx ecx, word [rdx]
lea rdx, [rdx + rcx*2]
add rdx, 2
add ebx, 0xffffffff
jne 0x1400162c8
movzx eax, word [rdx]
lea rcx, [rdx + 2]
neg ax
sbb rax, rax
and rax, rcx
jmp 0x1400162ec
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400164f0
Capabilities:
Delete file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x268
mov rax, qword [0x14007cb88]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov eax, dword [0x14007cbf4]
mov r13d, ecx
add eax, 4
mov rbp, r9
imul ecx, eax, 0x3e8
mov r12, r8
mov r14d, edx
cmp edx, ecx
jge 0x140016722
mov ecx, edx
mov rbx, r9
call fcn.14001628c
xor r9d, r9d
or rsi, 0xffffffffffffffff
mov r15, rax
test rax, rax
je 0x140016562
mov rbx, rsi
inc rbx
cmp word [rax + rbx*2], r9w
jne 0x140016555
add rbx, rbp
mov rax, qword [0x140086a40]
test rax, rax
je 0x140016587
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x140016587
mov rcx, rsi
inc rcx
cmp word [rdx + rcx*2], r9w
jne 0x14001657a
add rbx, rcx
add rbx, 0x23
cmp rbx, 0x100
jae 0x14001659b
lea rdi, [rsp + 0x50]
jmp 0x1400165b1
lea rcx, [rbx + rbx]
call fcn.14002adb4
mov rdi, rax
xor r9d, r9d
mov rax, qword [0x140086a40]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r9
test rax, rax
je 0x1400165ec
mov r8, qword [rax + 0x10]
test r8, r8
je 0x1400165ec
mov rcx, qword [0x14007cc18]
lea rdx, str._s__u_
mov r9d, dword [rcx + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140034d00
jmp 0x1400165fd
lea rdx, str.MASM
lea rcx, [rsp + 0x30]
call fcn.140034d00
cmp r14d, 0x7d0
mov qword [rsp + 0x20], r15
lea rax, str.fatal_error
mov r9d, r14d
lea r8, str.error
cmovl r8, rax
lea rdx, str._:__s_A_u:_s
lea rax, str.warning
cmp r14d, 0xfa0
lea rcx, [rsp + 0x30]
cmovge r8, rax
call fcn.140034d00
xor r15d, r15d
test rbp, rbp
je 0x140016666
cmp qword [rsp + 0x38], rbp
lea rcx, str._:__b
mov rdx, r12
cmovb rbp, qword [rsp + 0x38]
mov r8, rbp
call fcn.140034d30
mov al, byte [0x140087b3e]
test al, al
jne 0x14001668a
lea rcx, [0x1400785e0]
call fcn.140034d30
mov rcx, rdi
call fcn.14002ebfc
mov al, byte [0x140087b3e]
cmp al, 1
jne 0x1400166cf
cmp r14d, 0x3ea
je 0x1400166cf
mov rdx, qword [rsp + 0x30]
mov rcx, rdi
sub rdx, rdi
sar rdx, 1
call fcn.14002af28
mov rbx, rax
inc rsi
cmp byte [rax + rsi], r15b
jne 0x1400166ad
mov rcx, rsi
mov rdx, rbx
call fcn.140024954
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.14002423c
cmp byte [0x1400982e7], r15b
je 0x140016722
cmp r14d, 0x3ec
jne 0x140016715
mov rcx, qword [0x140086a68]
test rcx, rcx
je 0x140016715
mov rax, qword [0x1400980a8]
test rax, rax
je 0x14001670f
mov rcx, rax
call fcn.14001c8bc
mov rcx, qword [0x140086a68]
mov qword [0x1400980a8], r15
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov edx, r13d
mov rcx, rdi
call fcn.1400162f4
jmp 0x140016724
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400361e0
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400345cc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov rdi, rdx
mov r14, rcx
test rdx, rdx
jne 0x1400345fe
xor eax, eax
jmp 0x1400347dd
mov r9, rdi
lea r13, [0x140000000]
mov r8, r14
movzx edx, r15w
mov r10d, 0x80
movzx eax, byte [r8]
inc r8
movsx ecx, byte [rax + r13 + 0x7db70]
add cx, dx
movzx edx, cx
imul edx, r10d
mov word [0x14009cbd0], dx
sub r9, 1
jne 0x140034615
movzx esi, dx
movzx ecx, dx
shr si, 8
xor sil, dl
cmp word [0x140098008], r15w
je 0x14003466f
mov rax, qword [0x140098c68]
mov rbx, qword [rax + 0x40]
test rbx, rbx
je 0x14003466f
mov bpl, 1
mov dword [0x14009cbd4], r15d
jmp 0x140034694
shr rcx, 2
and ecx, 0x1ff
mov dword [0x14009cbd4], r15d
mov rbx, qword [r13 + rcx*8 + 0x99560]
mov bpl, r15b
test rbx, rbx
je 0x1400347da
cmp byte [rbx + 8], sil
jne 0x140034826
movzx eax, byte [rbx + 9]
cmp rax, rdi
jne 0x140034826
mov rdx, rbx
mov r8, rdi
sub rdx, rax
mov rcx, r14
cmp byte [0x14009a598], 0xff
jne 0x1400346c8
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
jmp 0x1400346ce
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
test eax, eax
jne 0x14003481f
mov al, byte [rbx + 0xa]
cmp al, 0xb
jne 0x1400346fc
movzx eax, word [rbx + 0x2a]
cmp ax, word [0x1400981b4]
je 0x1400346f3
test ax, ax
jns 0x14003481f
mov dword [0x14009cbd4], r15d
jmp 0x140034752
cmp word [0x1400981b4], r15w
jne 0x14003481f
mov dword [0x14009cbd4], r15d
cmp al, 3
jne 0x1400347fc
movzx ecx, word [rbx + 0x3c]
test cl, 8
je 0x140034748
movzx eax, word [0x140098008]
cmp word [rbx + 0x40], ax
je 0x140034752
cmp byte [0x14009ccfa], r15b
je 0x140034815
mov eax, 0xfff7
and cx, ax
mov word [rbx + 0x3c], cx
mov dword [0x14009cbd4], 2
cmp byte [0x140086347], r15b
je 0x140034771
cmp byte [0x140086362], r15b
je 0x140034771
mov edx, 3
mov rcx, rbx
call fcn.140034db8
mov dil, byte [rbx + 0xb]
mov al, dil
and al, 3
cmp al, 3
jne 0x1400347da
mov al, byte [0x140087b5f]
cmp al, 1
jae 0x1400347da
cmp byte [0x140099487], r15b
jne 0x1400347da
cmp byte [0x140099486], r15b
jne 0x1400347da
test al, al
jne 0x1400347d2
cmp word [0x140098318], 0x27
jne 0x1400347d2
movzx eax, byte [rbx + 9]
movsxd rcx, dword [0x140098334]
cmp cx, ax
jne 0x1400347d2
movsx r8, cx
mov rdx, rbx
mov rcx, qword [0x140098340]
sub rdx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400347da
or dil, 0x80
mov byte [rbx + 0xb], dil
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
cmp al, 9
jne 0x140034752
movzx eax, word [0x140098008]
cmp word [rbx + 0x2c], ax
je 0x140034752
mov dword [0x14009cbd4], 1
movzx edx, word [0x14009cbd0]
mov rbx, qword [rbx]
test bpl, bpl
je 0x14003468b
test rbx, rbx
jne 0x140034694
movzx eax, dx
shr rax, 2
and eax, 0x1ff
mov rbx, qword [r13 + rax*8 + 0x99560]
jmp 0x140034688
Function at 0x140034854
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r8d, r8d
mov qword [rsp + 8], rcx
mov r9d, r8d
mov r10, rcx
movabs rdx, 0xcbf29ce484222325
movsx rax, byte [rsp + r9 + 8]
movabs rcx, 0x100000001b3
xor rdx, rax
inc r9
imul rdx, rcx
cmp r9, 8
jb 0x14003486c
mov ecx, dword [0x140085a70]
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor edx, edx
div rcx
mov rax, qword [0x140085a78]
mov ecx, edx
mov rdx, qword [rax + rcx*8]
jmp 0x1400348b9
cmp r10, qword [rdx]
je 0x1400348c0
mov rdx, qword [rdx + 0x10]
test rdx, rdx
jne 0x1400348b0
jmp 0x1400348c4
lea r8, [rdx + 8]
mov rax, r8
ret

Function at 0x1400348c8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov qword [rax + 8], rcx
mov rbx, rcx
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movsx rax, byte [rsp + r9 + 0x30]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 8
jb 0x1400348f2
mov ecx, dword [0x140085a70]
mov rax, r8
shr rax, 0x20
xor edx, edx
xor rax, r8
div rcx
mov rax, qword [0x140085a78]
mov ebp, edx
mov rcx, qword [rax + rbp*8]
mov rdi, rcx
jmp 0x140034945
cmp rbx, qword [rcx]
je 0x140034971
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
jne 0x140034939
mov ecx, 0x18
call fcn.14002adb4
and qword [rax + 0x10], 0
mov qword [rax], rbx
mov dword [rax + 8], esi
test rdi, rdi
jne 0x140034976
mov rcx, qword [0x140085a78]
mov qword [rcx + rbp*8], rax
jmp 0x14003497a
mov dword [rcx + 8], esi
jmp 0x14003497a
mov qword [rdi + 0x10], rax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140002aa4
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edi, edi
mov r14d, r8d
mov ebp, edx
mov rsi, rcx
test rcx, rcx
je 0x140002bc0
mov qword [rsp + 0x20], rcx
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea rcx, [rsp + 0x40]
mov edx, 0x104
lea r8, [0x140048e70]
call fcn.140010e44
test eax, eax
js 0x140002bc0
mov qword [rsp + 0x30], rdi
mov ebx, 0x2001f
call fcn.14002dc10
test eax, eax
lea rdx, [rsp + 0x40]
mov ecx, 0x2011f
lea rax, [rsp + 0x30]
cmovne ebx, ecx
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140002bc0
mov rcx, qword [rsp + 0x30]
lea rdx, str.SystemComponent
test ebp, ebp
je 0x140002b99
lea r9d, [rdi + 4]
xor r8d, r8d
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], r9d
lea ebx, [rdi + 1]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140002baf
mov edx, r14d
mov rcx, rsi
mov edi, ebx
call fcn.14000d284
jmp 0x140002baf
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, eax
mov ebx, 1
cmove edi, ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140003d70
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x260
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov esi, 0x105
lea rcx, [rsp + 0x40]
xor r13d, r13d
mov r14d, 0xffff
mov edx, esi
mov word [rsp + 0x20], r13w
mov edi, 1
movzx ebx, r14w
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140003ecd
lea r8, [0x140048780]
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.140010d0c
test eax, eax
js 0x140003ecd
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140003ecd
test al, 0x10
jne 0x140003ecd
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x24], r13d
movzx r14d, r13w
mov r15d, r13d
call fcn.14001ab20
test eax, eax
je 0x140003ec7
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
nop dword [rax + rax]
mov ecx, eax
mov r12d, eax
call fcn.1400014a0
mov rsi, rax
test rax, rax
je 0x140003ec7
mov r9, rax
lea rcx, [rsp + 0x40]
mov r8d, r12d
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
nop dword [rax + rax]
test eax, eax
je 0x140003eb7
lea r9, [rsp + 0x28]
mov dword [rsp + 0x28], 4
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
je 0x140003eb7
mov rax, qword [rsp + 0x30]
mov r15d, edi
movzx r14d, word [rax]
mov rcx, rsi
call fcn.140001454
test r15d, r15d
cmovne bx, r14w
mov r14d, 0xffff
lea rcx, [rsp + 0x20]
call fcn.14001c278
test eax, eax
je 0x140003eed
cmp r14w, bx
je 0x140003eed
cmp word [rsp + 0x20], bx
mov edi, r13d
sete dil
mov eax, edi
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400050a0
Capabilities:
Get common file path
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor ebx, ebx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rbx
lea rdx, str.SoftwareMicrosoftMediaPlayerSetupReentrant
mov qword [rsp + 0x38], rax
mov rdi, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140005209
lea rax, [rsp + 0x50]
xor r8d, r8d
lea r9d, [rbx + 3]
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400051f8
mov edi, 0x104
lea rcx, [rsp + 0x60]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x1400051e7
lea r8, str.unregmp2.exe
mov edx, edi
lea rcx, [rsp + 0x60]
call fcn.140010d0c
test eax, eax
js 0x1400051e7
lea r8, str.__EnsureFileVersions
mov edx, edi
lea rcx, [rsp + 0x60]
call fcn.140010d0c
test eax, eax
js 0x1400051e7
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x1400051a8
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.MP10_EnsureFileVer
lea rax, [rsp + 0x60]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14000654c
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor ebx, ebx
mov ebp, edx
mov rsi, rcx
mov edi, ebx
test rcx, rcx
jne 0x14000658a
xor eax, eax
jmp 0x140006663
mov edx, 0x104
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140006661
test ebp, ebp
lea rcx, [0x14004a148]
lea rax, str._NTUninstallWMP11_
mov edx, 0x208
cmove rax, rcx
lea r8, str._s_swmploc.dll
lea rcx, str._s_swmvcore.dll
mov qword [rsp + 0x20], rax
cmove r8, rcx
lea r9, [rsp + 0x250]
lea rcx, [rsp + 0x40]
call fcn.140010c94
test eax, eax
js 0x140006661
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140006661
test al, 0x10
jne 0x140006661
lea r8, [rsp + 0x34]
mov dword [rsp + 0x30], ebx
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], ebx
lea rcx, [rsp + 0x40]
mov edi, 1
call fcn.14001aeb8
test eax, eax
js 0x14000665e
mov ebx, dword [rsp + 0x30]
movzx eax, word [rsp + 0x30]
and rbx, 0xffffffffffff0000
mov ecx, dword [rsp + 0x34]
or rbx, rax
shl rbx, 0x10
shr rcx, 0x10
or rbx, rcx
movzx ecx, word [rsp + 0x34]
shl rbx, 0x10
or rbx, rcx
mov qword [rsi], rbx
mov eax, edi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140007584
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x388]
sub rsp, 0x480
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0x370], rax
xor edi, edi
mov esi, edx
test rcx, rcx
je 0x1400076da
mov qword [rsp + 0x20], rcx
lea r9, str.SoftwareMicrosoftUpdates
lea rcx, [rbp + 0x160]
mov edx, 0x104
lea r8, [0x140048e70]
call fcn.140010e44
test eax, eax
js 0x1400076da
and qword [rsp + 0x48], rdi
mov ebx, 0x20019
call fcn.14002dc10
test eax, eax
lea rdx, [rbp + 0x160]
mov ecx, 0x20119
lea rax, [rsp + 0x48]
cmovne ebx, ecx
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400076da
xor ebx, ebx
and qword [rsp + 0x38], rbx
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
xor edx, edx
jmp 0x1400076a2
lea rcx, [rsp + 0x50]
inc ebx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcslwr]
nop dword [rax + rax]
cmp word [rsp + 0x50], 0x6b
jne 0x140007688
cmp word [rsp + 0x52], 0x62
jne 0x140007688
mov r8d, esi
lea rcx, [rsp + 0x50]
mov edx, 1
call fcn.140002aa4
mov edi, eax
and qword [rsp + 0x38], 0
mov edx, ebx
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140007651
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x1400078ac
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp qword [0x14005a6d0], 0
mov rdi, rcx
mov ebx, 0x80004005
jne 0x14000794e
mov ecx, 0x88
call fcn.140001460
test rax, rax
je 0x140007944
mov rcx, rax
call fcn.140017260
mov qword [0x14005a6d0], rax
test rax, rax
je 0x140007953
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140007953
mov rcx, qword [0x14005a6d0]
lea r8, [rsp + 0x20]
mov eax, dword [0x140059cc4]
mov rdx, rdi
mov dword [rcx + 0x74], eax
mov eax, dword [0x1400592e8]
mov dword [rcx + 0x6c], eax
call fcn.140017550
xor ebx, ebx
jmp 0x140007953
and qword [0x14005a6d0], 0
jmp 0x140007953
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400017f0
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x1400083ac
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp byte [0x14005a798], 0
jne 0x1400083ff
call fcn.140041938
movzx ecx, word [0x14005a79c]
lea r8, [rsp + 0x20]
mov r9d, 0x10
test eax, eax
setne byte [0x14005a79e]
lea edx, [r9 + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax + rax]
mov byte [0x14005a798], 1
mov al, byte [0x14005a79e]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400017f0
add rsp, 0x58
ret

Function at 0x140008420
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rdi, rcx
xor ebx, ebx
call fcn.14001ab20
test eax, eax
je 0x140008548
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000080
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
je 0x14000849a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x140008548
lea rax, [rsp + 0x40]
mov r8d, 0x104
sub rdi, rax
lea rcx, [rsp + 0x40]
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x1400084cf
movzx eax, word [rdi + rcx]
test ax, ax
je 0x1400084cf
mov word [rcx], ax
add rcx, 2
sub r8, 1
jne 0x1400084ad
test r8, r8
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bx
je 0x140008548
lea rcx, [rsp + 0x40]
call fcn.14001ab54
lea r9, [rsp + 0x40]
mov edx, 0x104
lea r8, str._s.bak
lea rcx, [rsp + 0x250]
call fcn.140010e44
test eax, eax
js 0x140008548
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
nop dword [rax + rax]
test eax, eax
je 0x140008543
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
nop dword [rax + rax]
jmp 0x140008548
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400017f0
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret

Function at 0x1400088c0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
cmp dword [0x140059cc4], ebx
je 0x1400088f0
lea eax, [rbx + 1]
jmp 0x140008964
test rax, rax
je 0x140008962
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140008962
mov edi, ebx
cmp dword [rsp + 0x30], ebx
jle 0x140008953
mov r14, rax
mov rcx, qword [r14]
lea rdx, [0x140048d30]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140008948
inc edi
add r14, 8
cmp edi, dword [rsp + 0x30]
jl 0x140008920
jmp 0x140008953
mov ebx, 1
mov dword [0x140059cc4], ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret