joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019520
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov esi, edx
mov rdi, rcx
lea rbx, [rcx + 0x208]
mov eax, dword [rbx]
cmp eax, 0xfe
jge 0x140019553
add eax, 1
mov dword [rbx], eax
cmp dword [rbx], 0
jge 0x14001955e
mov dword [rbx], 0
movsxd rax, dword [rbx]
mov dword [rcx + rax*4 + 0x20c], edx
mov r10, qword [0x1401370f0]
test r10, r10
jne 0x14001959f
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140019595
mov rcx, rax
call fcn.140050830
mov r10, rax
jmp 0x140019598
xor r10d, r10d
mov qword [0x1401370f0], r10
mov edx, esi
mov rcx, rdi
call fcn.140019210
mov r8, rax
mov r9d, esi
lea rdx, str._____PUSH_step__s___d_
mov rcx, r10
call fcn.140050c00
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x1400195f1
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400195e8
mov rcx, rax
call fcn.140050830
jmp 0x1400195ea
xor eax, eax
mov qword [0x1401370f0], rax
lea r9, str.SeqStack
lea r8, [rdi + 8]
lea rdx, str.SaveValueToHKLM__s__s
mov rcx, rax
call fcn.140050c00
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x58]
call fcn.140048010
mov rdi, rax
test rax, rax
je 0x140019652
mov dword [rsp + 0x28], 0x404
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
lea rdx, str.SeqStack
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140019699
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x140019685
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14001967c
mov rcx, rax
call fcn.140050830
jmp 0x14001967e
xor eax, eax
mov qword [0x1401370f0], rax
lea r8, str.SaveValueToHKLM__RegCreateKeyEx_failed
mov edx, 0x3f3
mov rcx, rax
call fcn.140050e40
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400280c0
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov byte [rcx], 0
mov byte [rcx + 1], 0
mov qword [rcx + 0x10b0], 0
lea rcx, str.Mvnwiwzd64.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rbx + 0x10b0], rax
je 0x14002823a
lea rdx, str.RunNtwkSetupDialogs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x10b8], rax
je 0x14002823a
mov rcx, qword [rbx + 0x10b0]
lea rdx, str.RunNtwkSetupDialogs2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x10c0], rax
je 0x14002823a
mov rcx, qword [rbx + 0x10b0]
lea rdx, str.GetNtwkPrinterInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x10c8], rax
je 0x14002823a
mov rcx, qword [rbx + 0x10b0]
lea rdx, str.CreateNtwkPort
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x10d0], rax
je 0x14002823a
mov rcx, qword [rbx + 0x10b0]
lea rdx, str.IsFirewallEnabled
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x10d8], rax
jne 0x1400281ba
lea rcx, str.Failed_to_load_the_ISFIREWALLENABLED_FUNCTIONNAME
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx + 0x10b0]
lea rdx, str.SetupFirewall
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x10e0], rax
jne 0x1400281f0
lea rcx, str.Failed_to_load_the_SETUPFIREWALL_FUNCTIONNAME
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx + 0x10b0]
lea rdx, str.RemoveFirewall
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rbx + 0x10e8], rax
jne 0x140028226
lea rcx, str.Failed_to_load_the_REMOVEFIREWALL_FUNCTIONNAME
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 4]
xor edx, edx
mov r8d, 0x10a8
call fcn.1400b57e0
mov byte [rbx], 1
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14002be70
Capabilities:
Delete directory
Enumerate files on windows
Set file attributes

Disassembly:
push rbx
push rbp
push rdi
push r13
push r14
push r15
sub rsp, 0x498
mov rax, qword [0x14012ce40]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rbx, r8
mov r14, rdx
lea rcx, [rsp + 0x272]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x270], 0
call fcn.1400b57e0
mov rax, qword [rbx + 8]
xor edi, edi
test rax, rax
mov ebp, edi
je 0x14002becd
mov rax, qword [rax]
test rax, rax
jne 0x14002bec5
mov rcx, qword [rbx + 0x28]
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 8], rdi
call fcn.14008be00
lea rcx, [rsp + 0x270]
mov r8, r14
mov edx, 0x104
mov qword [rbx + 0x28], rdi
call fcn.1400b1b70
lea rdx, [0x1400f15b8]
lea rcx, [rsp + 0x270]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
mov r13, rax
jne 0x14002bf37
xor eax, eax
jmp 0x14002c06c
mov qword [rsp + 0x4d0], rsi
mov qword [rsp + 0x490], r12
mov r12d, 1
nop
lea rsi, [rsp + 0x4c]
lea rdi, [0x1400f15a8]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x14002c014
lea rsi, [rsp + 0x4c]
lea rdi, [0x1400f15ac]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x14002c014
mov rcx, qword [rbx + 0x20]
mov rdi, qword [rbx + 8]
xor r12d, r12d
test rcx, rcx
jne 0x14002bfde
mov rdx, qword [rbx + 0x30]
lea r8d, [r12 + 0x18]
lea rcx, [rbx + 0x28]
call fcn.14008bdc8
mov rcx, qword [rbx + 0x30]
mov rdx, rax
lea rax, [rcx + rcx*2]
add rcx, 0xffffffffffffffff
lea rdx, [rdx + rax*8 - 0x10]
js 0x14002bfd5
nop
mov rax, qword [rbx + 0x20]
mov qword [rdx], rax
mov qword [rbx + 0x20], rdx
sub rdx, 0x18
sub rcx, 1
jns 0x14002bfc0
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14002c03d
mov rax, qword [rcx]
mov qword [rbx + 0x20], rax
lea rax, [rsp + 0x4c]
mov qword [rcx + 8], r12
mov qword [rcx], rdi
add qword [rbx + 0x18], 1
mov qword [rcx + 0x10], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x14002c009
mov qword [rax + 8], rcx
jmp 0x14002c00d
mov qword [rbx + 0x10], rcx
mov qword [rbx + 8], rcx
add ebp, 1
lea rdx, [rsp + 0x20]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x14002bf50
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
test r12d, r12d
jne 0x14002c043
mov eax, ebp
jmp 0x14002c05c
call fcn.14008bf60
int3
mov edx, 0x80
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov rsi, qword [rsp + 0x4d0]
mov r12, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1400b09d0
add rsp, 0x498
pop r15
pop r14
pop r13
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400481e0
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov ebx, r9d
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
mov dword [rsp + 0x68], ebx
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x140048241
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140048238
mov rcx, rax
call fcn.140050830
jmp 0x14004823a
xor eax, eax
mov qword [0x1401370f0], rax
mov dword [rsp + 0x20], ebx
mov r9, rsi
mov r8, rdi
lea rdx, str.SaveDwordToHKLM__s__s__d
mov rcx, rax
call fcn.140050c00
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x14004828d
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140048284
mov rcx, rax
call fcn.140050830
jmp 0x140048286
xor eax, eax
mov qword [0x1401370f0], rax
mov r9, rsi
mov r8, rdi
lea rdx, str.SaveValueToHKLM__s__s
mov rcx, rax
call fcn.140050c00
mov rdx, rdi
mov rcx, rbp
call fcn.140048010
mov rdi, rax
test rax, rax
je 0x1400482eb
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140048337
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x14004831e
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140048315
mov rcx, rax
call fcn.140050830
jmp 0x140048317
xor eax, eax
mov qword [0x1401370f0], rax
lea r8, str.SaveValueToHKLM__RegCreateKeyEx_failed
mov edx, 0x3f3
mov rcx, rax
call fcn.140050e40
mov eax, 0x3f3
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400483b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x140048405
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400483fc
mov rcx, rax
call fcn.140050830
jmp 0x1400483fe
xor eax, eax
mov qword [0x1401370f0], rax
mov r9, rdi
mov r8, rbx
lea rdx, str.GetDwordFromHKLM__s__s
mov rcx, rax
call fcn.140050c00
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x40], 0
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x14004845e
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140048455
mov rcx, rax
call fcn.140050830
jmp 0x140048457
xor eax, eax
mov qword [0x1401370f0], rax
mov r9, rdi
mov r8, rbx
lea rdx, str.GetValueFromHKLM__s__s
mov rcx, rax
call fcn.140050c00
lea r11, [rsp + 0x40]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400484d3
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140048519
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x140048506
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400484fd
mov rcx, rax
call fcn.140050830
jmp 0x1400484ff
xor eax, eax
mov qword [0x1401370f0], rax
lea r8, str.GetValueFromHKLM__RegOpenKeyEx_failed
mov edx, ebx
mov rcx, rax
call fcn.140050e40
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140048590
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, 0x2768
call fcn.1400dab40
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x14012ce40]
xor rax, rsp
mov qword [rsp + 0x2750], rax
mov rbx, r9
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
mov word [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x270e
lea rcx, [rsp + 0x42]
call fcn.1400b57e0
mov r9d, 0x1388
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rbp
call fcn.140049440
mov ebx, eax
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x14004862d
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140048624
mov rcx, rax
call fcn.140050830
jmp 0x140048626
xor eax, eax
mov qword [0x1401370f0], rax
mov r9, rsi
mov r8, rdi
lea rdx, str.SaveValueToHKLM__s__s
mov rcx, rax
call fcn.140050c00
mov rdx, rdi
mov rcx, rbp
call fcn.140048010
mov rdi, rax
test rax, rax
je 0x140048687
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400486d3
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x1400486ba
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400486b1
mov rcx, rax
call fcn.140050830
jmp 0x1400486b3
xor eax, eax
mov qword [0x1401370f0], rax
lea r8, str.SaveValueToHKLM__RegCreateKeyEx_failed
mov edx, 0x3f3
mov rcx, rax
call fcn.140050e40
mov eax, 0x3f3
mov rcx, qword [rsp + 0x2750]
xor rcx, rsp
call fcn.1400b09d0
add rsp, 0x2768
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140048730
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x2780
call fcn.1400dab40
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x27a0], rbx
mov rax, qword [0x14012ce40]
xor rax, rsp
mov qword [rsp + 0x2770], rax
mov rbp, r9
mov rbx, r8
mov rdi, rdx
mov word [rsp + 0x60], 0
xor edx, edx
mov r8d, 0x270e
lea rcx, [rsp + 0x62]
call fcn.1400b57e0
mov dword [rsp + 0x38], 0x1388
mov qword [rsp + 0x30], 0
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x1400487ca
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400487c1
mov rcx, rax
call fcn.140050830
jmp 0x1400487c3
xor eax, eax
mov qword [0x1401370f0], rax
mov r9, rbx
mov r8, rdi
lea rdx, str.GetValueFromHKLM__s__s
mov rcx, rax
call fcn.140050c00
lea r11, [rsp + 0x30]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140048840
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140048884
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x140048873
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14004886a
mov rcx, rax
call fcn.140050830
jmp 0x14004886c
xor eax, eax
mov qword [0x1401370f0], rax
lea r8, str.GetValueFromHKLM__RegOpenKeyEx_failed
mov edx, edi
mov rcx, rax
call fcn.140050e40
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x1400488b7
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400488ae
mov rcx, rax
call fcn.140050830
jmp 0x1400488b0
xor eax, eax
mov qword [0x1401370f0], rax
lea rdx, str.MultiStringToModelList__
mov rcx, rax
call fcn.140050c00
lea rbx, [rsp + 0x60]
mov rcx, rbp
call fcn.14008a174
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x140048945
mov esi, dword [rsp + 0x27c0]
test esi, esi
je 0x14004890f
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
mov rdx, rcx
mov rcx, rbx
call fcn.1400b2470
mov rdx, rbx
mov rcx, rbp
call fcn.14008a454
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea rbx, [rbx + rcx*2]
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
jne 0x1400488f1
mov eax, dword [rbp + 0x18]
jmp 0x140048948
mov eax, dword [rbp + 0x18]
mov rcx, qword [rsp + 0x2770]
xor rcx, rsp
call fcn.1400b09d0
mov rbx, qword [rsp + 0x27a0]
add rsp, 0x2780
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004dd30
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx esi, ax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp di, bx
jne 0x14004ddc0
cmp di, ax
jne 0x14004ddc0
lea r8, [0x14012f770]
xor eax, eax
movzx edx, di
mov rcx, r8
nop
nop
cmp dword [rcx], edx
je 0x14004dda3
add eax, 1
add rcx, 0x18
cmp eax, 0x26
jb 0x14004dd80
mov ax, di
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, [rax + rax*2]
mov di, word [r8 + rcx*8 + 4]
mov ax, di
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea r8, [0x14012f770]
xor eax, eax
movzx edx, si
mov rcx, r8
nop
cmp dword [rcx], edx
je 0x14004ddf3
add eax, 1
add rcx, 0x18
cmp eax, 0x26
jb 0x14004ddd0
mov ax, si
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov si, word [r8 + rcx*8 + 4]
mov ax, si
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14004de10
Capabilities:
Identify system language via api

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ebp, ax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp di, bx
jne 0x14004de8e
cmp di, ax
jne 0x14004de8e
xor ecx, ecx
movzx edx, di
lea r12, [0x14012f770]
mov rax, r12
nop
nop
cmp dword [rax], edx
je 0x14004de82
add ecx, 1
add rax, 0x18
cmp ecx, 0x26
jb 0x14004de70
jmp 0x14004debf
lea rcx, [rcx + rcx*2]
mov di, word [r12 + rcx*8 + 4]
jmp 0x14004debf
xor ecx, ecx
movzx edx, bp
lea r12, [0x14012f770]
mov rax, r12
nop
cmp dword [rax], edx
je 0x14004deb5
add ecx, 1
add rax, 0x18
cmp ecx, 0x26
jb 0x14004dea0
mov di, bp
jmp 0x14004debf
lea rcx, [rcx + rcx*2]
mov di, word [r12 + rcx*8 + 4]
movzx edx, di
mov ebx, edx
and ebx, 0x1ff
xor ecx, ecx
mov rax, r12
nop
cmp dword [rax], edx
je 0x14004dfb5
add ecx, 1
add rax, 0x18
cmp ecx, 0x26
jb 0x14004ded0
mov r8, qword [0x14012f780]
mov word [rsi], 0
test r8, r8
je 0x14004df02
mov edx, 0xa
mov rcx, rsi
call fcn.1400b1b70
xor ecx, ecx
mov rax, r12
cmp dword [rax], ebx
je 0x14004df93
add ecx, 1
add rax, 0x18
cmp ecx, 0x26
jb 0x14004df07
mov r8, qword [0x14012f780]
mov word [rsi], 0
test r8, r8
je 0x14004df39
mov edx, 0xa
mov rcx, rsi
call fcn.1400b1b70
xor ecx, ecx
mov rax, r12
nop
cmp dword [rax], 9
je 0x14004df71
add ecx, 1
add rax, 0x18
cmp ecx, 0x26
jb 0x14004df40
mov r8, qword [0x14012f780]
mov word [rsi], 0
test r8, r8
je 0x14004dfd5
mov edx, 0xa
mov rcx, rsi
call fcn.1400b1b70
jmp 0x14004dfd5
lea rcx, [rcx + rcx*2]
mov r8, qword [r12 + rcx*8 + 0x10]
mov word [rsi], 0
test r8, r8
je 0x14004dfd5
mov edx, 0xa
mov rcx, rsi
call fcn.1400b1b70
jmp 0x14004dfd5
lea rcx, [rcx + rcx*2]
mov r8, qword [r12 + rcx*8 + 0x10]
mov word [rsi], 0
test r8, r8
je 0x14004dfd5
mov edx, 0xa
mov rcx, rsi
call fcn.1400b1b70
jmp 0x14004dfd5
lea rcx, [rcx + rcx*2]
mov r8, qword [r12 + rcx*8 + 0x10]
mov word [rsi], 0
test r8, r8
je 0x14004dfd5
mov edx, 0xa
mov rcx, rsi
call fcn.1400b1b70
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x14004e008
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14004dfff
mov rcx, rax
call fcn.140050830
jmp 0x14004e001
xor eax, eax
mov qword [0x1401370f0], rax
mov r8, rsi
lea rdx, str.GetLangExt____s
mov rcx, rax
call fcn.140050c00
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x14004e610
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
xor ebx, ebx
mov rax, qword [0x1401370f0]
test rax, rax
jne 0x14004e655
mov ecx, 0x310
call fcn.140084d88
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14004e64b
mov rcx, rax
call fcn.140050830
jmp 0x14004e64e
mov rax, rbx
mov qword [0x1401370f0], rax
lea rdx, str.In_RebootSystemNow
mov rcx, rax
call fcn.140050c00
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x60]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14004e6e9
lea r8, [rsp + 0x3c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14004e6d2
xor eax, eax
jmp 0x14004e6e9
mov edx, 0x80020003
mov ecx, 6
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne bl
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x14004f0b0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14012ce40]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 5
jne 0x14004f107
cmp dword [rsp + 0x28], 1
jne 0x14004f107
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400b09d0
add rsp, 0x158
ret
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400b09d0
add rsp, 0x158
ret

Function at 0x14004f130
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14012ce40]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jne 0x14004f187
cmp dword [rsp + 0x28], 0
jne 0x14004f187
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400b09d0
add rsp, 0x158
ret
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400b09d0
add rsp, 0x158
ret

Function at 0x14004f1b0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14012ce40]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jne 0x14004f207
cmp dword [rsp + 0x28], 1
jne 0x14004f207
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400b09d0
add rsp, 0x158
ret
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400b09d0
add rsp, 0x158
ret