joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012d934
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14012d99b
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14012d9af
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14012d9af
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call qword [case.0x14012952d.0]
jmp 0x14012d9b4
cmp dword [rcx + 8], 0
je 0x14012d9af
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14012d9b4
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14012ec58
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax - 0x18], 0
mov rbp, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.140169ae0
test eax, eax
jne 0x14012ecbc
mov eax, dword [rsp + 0x30]
lea r8, str._s_s_X.tmp
mov dword [rsp + 0x28], eax
mov r9, rsi
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.140113db0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14012ecce
jmp 0x14012ec7c
mov r9, rbx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14012eecc
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r8d, 1
mov rcx, rbx
bt eax, 0
mov rax, qword [rbx]
mov rax, qword [rax + 0x1c0]
jae 0x14012ef0f
xor edx, edx
call qword [case.0x14012952d.0]
test eax, eax
je 0x14012ef0b
mov eax, 1
jmp 0x14012ef22
xor eax, eax
jmp 0x14012ef22
mov rdx, qword [rbx + 0x48]
call qword [case.0x14012952d.0]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x1401352b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x150], 0
mov rbx, rcx
jne 0x1401353a1
cmp qword [rcx + 0x130], 0
je 0x1401353a1
call fcn.1401247a8
mov rdx, qword [rbx + 0x130]
mov r8d, 5
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1401353a1
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1401353a1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x1401353a1
call fcn.1401247a8
mov rdi, qword [rax + 0x68]
test rdi, rdi
je 0x1401353a1
mov ecx, 0x20
call fcn.140111d34
mov rcx, qword [rdi]
mov rbp, rax
mov r8, rsi
mov rdx, rbp
mov rax, qword [rcx + 0x28]
mov rcx, rdi
call qword [case.0x14012952d.0]
mov rdx, qword [rbx + 0x158]
mov qword [rbx + 0x150], rbp
test rdx, rdx
je 0x14013539a
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x30]
call qword [case.0x14012952d.0]
mov rcx, qword [rbx + 0x158]
mov edx, 0x20
call fcn.140017d60
mov qword [rbx + 0x158], rbp
mov rax, qword [rbx + 0x150]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14013abcc
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
call fcn.14013ad0c
xor r14d, r14d
mov esi, 1
mov rbp, rax
mov dword [rbx + 0x14], esi
mov rcx, rax
cmp dword [rbx], r14d
je 0x14013ac81
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
movsxd rbx, eax
test eax, eax
js 0x14013aca4
mov rcx, qword [rdi]
mov edx, dword [rcx - 0xc]
sub esi, dword [rcx - 8]
sub edx, ebx
or esi, edx
jge 0x14013ac30
mov edx, ebx
mov rcx, rdi
call fcn.140017f20
mov rdx, qword [rdi]
cmp ebx, dword [rdx - 0xc]
jg 0x14013aca4
mov dword [rdx - 0x10], ebx
lea r8d, [rbx + 1]
mov rax, qword [rdi]
mov rcx, rbp
mov word [rax + rbx*2], r14w
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14013ac5d
mov eax, r14d
jmp 0x14013ac6a
movsxd rdx, dword [rcx - 0xc]
call fcn.14015d120
test eax, eax
js 0x14013aca4
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x14013aca4
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rdi]
mov word [rax + rcx*2], r14w
jmp 0x14013ac89
mov rdx, qword [rdi]
call fcn.14013f4f4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ecx, 0x80070057
call fcn.1400180c0
int3
Function at 0x14013e6dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.140018c80
nop
cmp rbx, 0xffffffff80000000
jne 0x14013e764
call fcn.14012481c
cmp eax, 1
jne 0x14013e764
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x20]
call fcn.14001bd80
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140020670
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14013e75d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14012952d.0]
mov rbx, 0xffffffff80000001
mov r9, rdi
mov r8, rsi
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14013e7a0
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14012952d.0]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14013e7b4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, r9
mov esi, r8d
mov rbx, rcx
lea rcx, [rsp + 0x50]
call fcn.140018c80
nop
cmp rbx, 0xffffffff80000000
jne 0x14013e83c
call fcn.14012481c
cmp eax, 1
jne 0x14013e83c
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x30]
call fcn.14001bd80
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140020670
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14013e835
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14012952d.0]
mov rbx, 0xffffffff80000001
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, esi
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14013e880
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14012952d.0]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14013ee1c
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov r13, r8
mov edx, 1
mov r15, rcx
mov r12d, edx
mov r14d, edx
lea rdi, [rsi + 0x18]
cmp dword [rsi + 0x10], edx
jle 0x14013eeb5
lea ebx, [rdx + 7]
lea ebp, [rdx + 0xf]
test r13, r13
je 0x14013ee7a
mov rax, qword [r15 + 0x10]
cmp qword [rax + rbp + 8], r13
je 0x14013ee7a
mov rax, qword [rdi]
cmp qword [rbx + rax], 0
je 0x14013ee9f
xor r12d, r12d
jmp 0x14013ee9f
mov rax, qword [rdi]
mov rcx, qword [rbx + rax]
test rcx, rcx
je 0x14013ee97
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x14012952d.0]
mov edx, 1
mov rax, qword [rdi]
and qword [rbx + rax], 0
add r14d, edx
add rbp, 0x10
add rbx, 8
cmp r14d, dword [rsi + 0x10]
jl 0x14013ee5b
test r12d, r12d
je 0x14013eefd
lea rcx, [r15 + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [r15 + 0x18]
mov rdx, rsi
call fcn.14013f1d0
lea rcx, [r15 + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
mov rax, qword [rax]
call qword [case.0x14012952d.0]
mov ecx, dword [r15]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140141968
Capabilities:
Identify system language via api

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14021b668]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edi, ecx
xor esi, esi
mov rcx, qword [0x140227898]
mov r12, r9
mov r15, r8
mov r14, rdx
test rcx, rcx
jne 0x1401419d8
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401419ff
lea rdx, str.GetThreadPreferredUILanguages
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140227898], rax
jmp 0x1401419e1
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rbx, rax
test rbx, rbx
je 0x1401419ff
mov r9, r12
mov r8, r15
mov rdx, r14
mov ecx, edi
mov rax, rbx
call qword [case.0x14012952d.0]
jmp 0x140141b51
mov dword [r14], esi
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov r8d, 7
mov esi, ecx
lea rdx, [rbp - 0x20]
and ecx, 0xfc00
and esi, 0x3ff
or ecx, esi
call fcn.140141f94
lea rcx, [rbp - 0x20]
call fcn.14015cff4
mov edx, dword [r12]
lea r8, [rbp - 0x20]
mov rcx, r15
lea rdi, [rax + 1]
call fcn.140169698
inc dword [r14]
lea rdx, [rbp - 0x20]
mov r8d, 7
mov ecx, esi
call fcn.140141f94
lea rcx, [rbp - 0x20]
call fcn.14015cff4
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
lea rbx, [rax + 1]
call fcn.140169698
inc dword [r14]
add rdi, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ecx, ax
mov r8d, 7
mov esi, ecx
lea rdx, [rbp - 0x20]
and ecx, 0xfc00
and esi, 0x3ff
or ecx, esi
call fcn.140141f94
lea rcx, [rbp - 0x20]
call fcn.14015cff4
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
lea rbx, [rax + 1]
call fcn.140169698
inc dword [r14]
lea rdx, [rbp - 0x20]
mov r8d, 7
mov ecx, esi
add rdi, rbx
call fcn.140141f94
lea rcx, [rbp - 0x20]
call fcn.14015cff4
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
lea rbx, [rax + 1]
call fcn.140169698
inc dword [r14]
lea rdx, [rbp - 0x20]
mov r8d, 7
mov ecx, 0x800
add rdi, rbx
call fcn.140141f94
lea rcx, [rbp - 0x20]
call fcn.14015cff4
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
mov rbx, rax
call fcn.140169698
inc dword [r14]
lea rcx, [rdi + rbx]
xor eax, eax
mov word [r15 + rcx*2 + 2], ax
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140151370
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140142f8c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r9
mov r15, r8
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14014304d
mov esi, 0x811c9dc5
xor ebx, ebx
mov rcx, rdx
call fcn.14015cff4
mov r8, rax
mov eax, 0xcccccccd
mul r8d
shr edx, 3
inc edx
test r8d, r8d
je 0x140142ff0
movzx ecx, word [rdi + rbx*2]
imul esi, esi, 0x1000193
xor esi, ecx
add ebx, edx
cmp ebx, r8d
jb 0x140142fdd
mov dword [r14], esi
xor edx, edx
mov eax, esi
div dword [rbp + 0x10]
mov dword [r15], edx
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x140143032
mov rbx, qword [rbx + rdx*8]
test rbx, rbx
je 0x140143032
mov eax, dword [r14]
cmp dword [rbx + 8], eax
jne 0x140143028
mov rdx, rdi
mov rcx, qword [rbx + 0x10]
call fcn.140169874
nop
test eax, eax
je 0x14014302d
mov rbx, qword [rbx]
jmp 0x14014300a
mov rax, rbx
jmp 0x140143034
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
call fcn.140111f70
int3

Function at 0x140144268
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], 0
je 0x14014429a
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14014429a
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.14014f4ac
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x1401442ac
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1401442d2
mov r8, rdx
mov rdx, qword [rbx]
call fcn.14012d934
jmp 0x14014433e
cmp byte [0x140227c10], 0
jne 0x140144316
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140144306
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140227c08], rax
jmp 0x14014430d
mov rax, qword [0x140227c08]
mov byte [0x140227c10], 1
jmp 0x14014431d
mov rax, qword [0x140227c08]
mov rdx, rdi
mov rcx, qword [rbx]
test rax, rax
je 0x140144337
xor r9d, r9d
mov r8d, dword [rbx + 8]
call qword [case.0x14012952d.0]
jmp 0x14014433e
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1401469b4
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0x88
mov rdi, rcx
mov esi, 1
mov rax, qword [rcx + 0x20]
neg rax
sbb rdx, rdx
mov qword [rbp + 0x77], rdx
cmp qword [rcx + 0x20], 0
je 0x140146a9f
xor esi, esi
and qword [rbp + 0x17], rsi
and dword [rbp + 0x1f], esi
and qword [rbp + 0x27], rsi
mov rax, qword [rcx]
lea rdx, [rbp + 0xf]
mov rax, qword [rax + 0x40]
call qword [case.0x14012952d.0]
nop
mov rbx, qword [rax]
call fcn.1401247a8
xor edx, edx
mov rcx, qword [rax + 8]
call fcn.14012c4a4
nop
and qword [rbp + 0x7f], rsi
lea rcx, [rbp + 0x67]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x7f]
mov qword [rsp + 0x38], rcx
and qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x140146a63
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x17], rax
and dword [rbp + 0x1f], ebx
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140146a88
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14012952d.0]
test ebx, ebx
je 0x140146b8e
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x140146a9f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
add rsp, 0x88
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140121d48
mov rcx, rax
test rax, rax
je 0x140146bbd
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14012952d.0]
add rax, 0x18
mov qword [rbp + 0x6f], rax
call fcn.140121d48
mov rcx, rax
test rax, rax
je 0x140146bb2
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14012952d.0]
add rax, 0x18
mov qword [rbp + 7], rax
lea rcx, [rdi + 8]
lea r9, [rbp + 7]
lea r8, [rbp + 0x6f]
lea rdx, [rbp + 0x77]
call fcn.140144964
mov rbx, qword [rbp + 7]
test rbx, rbx
je 0x140146b47
mov rcx, rbx
call fcn.14015cff4
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x6f]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140146b69
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14012952d.0]
nop
mov rdx, qword [rbp + 0x6f]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140146b8e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14012952d.0]
cmp qword [rbp + 0x77], 0
jne 0x140146aad
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x140146ba8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140146aa1
mov ecx, 0x80004005
call fcn.1400180c0
nop
mov ecx, 0x80004005
call fcn.1400180c0
int3
Function at 0x14014a224
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
test r8, r8
jne 0x14014a282
test rdx, rdx
jne 0x14014a251
mov eax, ebx
jmp 0x14014a259
mov rcx, rdi
call fcn.14015cff4
add eax, eax
mov r9, rdi
mov r8d, 1
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, 0xffffffff80000000
call fcn.14013e7b4
test eax, eax
jne 0x14014a2ef
mov eax, 1
jmp 0x14014a2f1
xor r9d, r9d
lea r8, [rsp + 0x50]
mov rdx, rbp
mov rcx, 0xffffffff80000000
call fcn.14013e488
test eax, eax
jne 0x14014a2ef
test rdi, rdi
jne 0x14014a2a6
mov eax, ebx
jmp 0x14014a2ae
mov rcx, rdi
call fcn.14015cff4
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14014a2ef
test edi, edi
sete bl
mov eax, ebx
jmp 0x14014a2f1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14014a630
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [rdx]
xor r15d, r15d
mov qword [rbp - 8], r15
mov rbx, rdx
mov edx, 0x104
mov rsi, rcx
mov edi, r15d
mov r8d, dword [rax - 0xc]
lea r9d, [r15 + 1]
sub r9d, dword [rax - 8]
sub r8d, edx
or r9d, r8d
jge 0x14014a677
mov rcx, rbx
call fcn.140017f20
mov r14, qword [rbx]
lea rax, [rbp - 8]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x38], 0x208
lea rdx, str.CLSID
mov dword [rbp + 0x40], r15d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14014a74f
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x10], r15
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14014a745
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x48]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x48], r15
lea rdx, str.InProcServer32
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14014a73b
mov rcx, qword [rbp + 0x48]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [0x1401acff0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x48]
test eax, eax
sete dil
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14014a75c
mov eax, r15d
jmp 0x14014a769
movsxd rdx, dword [rcx - 0xc]
call fcn.14015d120
test eax, eax
js 0x14014a791
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14014a791
mov dword [rcx - 0x10], eax
mov rcx, qword [rbx]
mov rbx, qword [rsp + 0x70]
mov edx, eax
mov eax, edi
mov word [rcx + rdx*2], r15w
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400180c0
int3

Function at 0x14014aea8
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
je 0x14014aef3
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14014af04
lea rdx, str.DeleteFileTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14014af04
mov rdx, qword [rbx]
mov rcx, rdi
call qword [case.0x14012952d.0]
jmp 0x14014af06
cmp dword [rcx + 8], 0
je 0x14014af04
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14014af06
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14014b14c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [rsp + 0x34]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x14014b177
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14014b182
mov rax, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 0x18]
call fcn.140017b50
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rbx
call fcn.14014c03c
int3

Function at 0x14014b25c
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14014b2c5
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14014b2d9
lea rdx, str.MoveFileTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14014b2d9
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x20], 2
mov rdx, rdi
call qword [case.0x14012952d.0]
jmp 0x14014b2db
cmp dword [rcx + 8], 0
je 0x14014b2d9
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x14014b2db
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14014b53c
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test r8d, r8d
jne 0x14014b54e
xor eax, eax
jmp 0x14014b56b
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x50]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14014b571
mov eax, dword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
lea rcx, [rbx + 0x18]
call fcn.140017b50
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rbx
call fcn.14014c03c
int3

Function at 0x14014b590
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x14014b5ae
mov rdx, rcx
mov rcx, rax
call fcn.14014aea8
jmp 0x14014b5b4
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14014b5be
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rbx
call fcn.14014c03c
int3

Function at 0x14014b5d0
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
mov rax, r8
mov rbx, rcx
test r8, r8
je 0x14014b5f1
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call fcn.14014b25c
jmp 0x14014b5f7
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14014b601
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rbx
call fcn.14014c03c
int3