joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005516c
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x4b0
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
mov dword [rdx], 1
repne scasw ax, word [rdi]
mov r9d, 0x104
mov qword [rsp + 0x30], rdx
not rcx
lea rax, [rcx + 2]
lea rbp, [rcx - 1]
cmp rax, r9
jbe 0x1000551ca
mov rcx, rbx
jmp 0x1000553f0
lea rax, [rsp + 0x290]
mov rdi, rbx
mov rdx, r9
sub rdi, rax
xor esi, esi
lea rcx, [rsp + 0x290]
lea rax, [rdx + 0x7ffffefa]
cmp rax, rsi
je 0x100055207
movzx eax, word [rdi + rcx]
cmp ax, si
je 0x100055207
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000551e5
cmp rdx, rsi
jne 0x100055210
sub rcx, 2
mov word [rcx], si
cmp rbp, rsi
je 0x100055248
cmp word [rbx + rbp*2 - 2], 0x3a
je 0x100055248
cmp word [rbx + rbp*2 - 2], 0x5c
je 0x100055248
lea r8, [0x1000297b8]
lea rcx, [rsp + 0x290]
mov rdx, r9
call fcn.100039ee4
inc rbp
mov r9d, 0x104
lea r8, [0x100029f7c]
lea rcx, [rsp + 0x290]
mov rdx, r9
call fcn.100039ee4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x1000551c2
mov rbx, qword [rsp + 0x30]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x274]
repne scasw ax, word [rdi]
mov edx, 0x104
lea r8, [rsp + 0x274]
not rcx
mov word [rsp + rbp*2 + 0x290], ax
cmp rcx, 1
lea rcx, [rsp + 0x290]
jne 0x1000552c2
lea r8, [rsp + 0x6c]
call fcn.100039ee4
mov esi, dword [rsp + 0x40]
test sil, 0x10
je 0x100055328
lea rsi, [rsp + 0x6c]
lea rdi, [0x100029f80]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x1000553c7
lea rsi, [rsp + 0x6c]
lea rdi, [0x100029f84]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x1000553c7
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x290]
call fcn.10005516c
xor ecx, ecx
cmp eax, ecx
je 0x1000553c7
mov dword [rbx], ecx
jmp 0x1000553c7
test sil, 1
je 0x100055341
mov edx, esi
lea rcx, [rsp + 0x290]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
cmp eax, edx
jne 0x1000553c7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x274]
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x1000553b3
mov word [rsp + rbp*2 + 0x290], dx
mov edi, 0x104
lea r8, [rsp + 0x6c]
lea rcx, [rsp + 0x290]
mov rdx, rdi
call fcn.100039ee4
xor eax, eax
lea r8, [rsp + 0x274]
lea rcx, [rsp + 0x290]
mov rdx, rdi
mov word [rsp + rbp*2 + 0x290], ax
call fcn.100039ee4
lea rcx, [rsp + 0x290]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
mov dword [rbx], eax
mov rsi, qword [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100055286
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x28]
call fcn.1000550dc
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.10007fa70
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4b0
pop rdi
pop rsi
pop rbp
ret
Function at 0x100056038
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
and qword [r11 + 8], 0
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x100056172
test rdx, rdx
je 0x100056172
lea rax, [r11 + 8]
mov edi, 3
lea rdx, [0x100025960]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, edi
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000560bd
lea rax, [rsp + 0x50]
lea rdx, [0x100025960]
mov r9d, edi
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x10005612a
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002a598]
mov r8, rsi
call fcn.1000573fc
mov r12, rax
test rax, rax
je 0x100056116
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
lea r9d, [rax + 1]
xor r8d, r8d
not rcx
lea edx, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], edx
mov rdx, r12
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, r12
mov ebx, eax
call qword [sym.imp.msvcrt.dll_free]
jmp 0x10005611b
mov ebx, 0x80004005
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x100056151
movzx edi, bx
lea rdx, [0x10002a5b0]
mov r8, rbp
or edi, 0x80070000
test ebx, ebx
mov ecx, 2
cmovle edi, ebx
mov r9d, edi
call fcn.1000527f4
jmp 0x10005616e
lea rdx, [0x10002a5f8]
mov ecx, 4
call fcn.1000527a0
or dword [0x100087148], 1
mov edi, 0xd2af9
mov eax, edi
jmp 0x100056177
mov eax, 0x80004003
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x10005795c
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov rbp, rdx
mov rdi, rcx
cmp rcx, rbx
jne 0x10005797b
xor eax, eax
jmp 0x1000579fb
mov dword [rsp + 0x50], ebx
call fcn.100053454
cmp eax, ebx
je 0x1000579f9
lea rdx, [rsp + 0x50]
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ecx, eax
mov r12d, eax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rsi, rax
cmp rax, rbx
je 0x1000579f9
mov r9, rax
mov r8d, r12d
xor edx, edx
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, ebx
je 0x1000579f1
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [0x10002aaf0]
mov rcx, rsi
mov dword [rsp + 0x60], 4
call sub.VERSION.dll_VerQueryValueW
cmp eax, ebx
je 0x1000579f1
mov rcx, qword [rsp + 0x68]
mov ebx, 1
movzx edx, word [rcx]
mov word [rbp], dx
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov eax, ebx
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x100057a0c
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ebx, ebx
cmp eax, ebx
je 0x100057a73
lea r8, [0x100025da0]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.100039ee4
cmp eax, ebx
jl 0x100057a73
lea rax, [rsp + 0x20]
cmp rax, rbx
je 0x100057a6e
lea rcx, [rsp + 0x20]
call fcn.100054858
mov rbx, rax
mov rax, rbx
jmp 0x100057a75
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.10007fa70
add rsp, 0x240
pop rbx
ret

Function at 0x100057a94
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
mov edx, 0x104
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
je 0x100057b62
lea r8, [0x100025da0]
lea rcx, [rsp + 0x50]
mov edx, 0x104
call fcn.100039ee4
cmp eax, ebx
jl 0x100057b62
lea rax, [rsp + 0x50]
mov ecx, ebx
mov dword [rsp + 0x44], ebx
mov r9d, ebx
mov dword [rsp + 0x40], ebx
cmp rax, rbx
je 0x100057b20
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.100054598
mov ecx, dword [rsp + 0x44]
mov r9d, dword [rsp + 0x40]
jmp 0x100057b25
mov eax, 0x80004005
cmp eax, ebx
jl 0x100057b62
movzx eax, cx
movzx r8d, r9w
shr ecx, 0x10
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r8d
lea r8, [0x1000296c8]
shr r9d, 0x10
mov edx, 0x104
mov rcx, rdi
call fcn.10003a080
mov ecx, 1
cmp eax, ebx
cmovge ebx, ecx
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.10007fa70
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x100057ca8
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x4a0
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x490], rax
and qword [rsp + 0x40], 0
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rsi, 0xffffffff80000002
lea rdx, [0x10002ac70]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100057e41
xor ebx, ebx
lea rax, [rsp + 0x5c]
mov dword [rsp + 0x58], 4
and dword [rsp + 0x50], ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov dword [rsp + 0x5c], 4
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbx
xor edx, edx
jmp 0x100057e11
lea rax, [rsp + 0x70]
lea r9, [0x10002abf0]
lea r8, [0x100025e98]
lea rcx, [rsp + 0x280]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.10003a080
test eax, eax
js 0x100057de9
and qword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
lea rdx, [rsp + 0x280]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100057de9
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
lea rdx, [0x100027008]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x5c]
inc ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov edx, ebx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x70]
mov dword [rsp + 0x54], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x100057d55
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x10002ac70]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.10007fa70
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x4a0
pop rsi
ret

Function at 0x100058634
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
test rax, rax
je 0x100058682
lea rcx, [0x10002ae98]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x100058682
mov edx, 0xbba
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x100058679
mov rcx, rbx
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x10005b218
Capabilities:
Delete directory
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor ebp, ebp
mov esi, edx
mov rbx, rcx
cmp dword [rcx + 0x7c], ebp
je 0x10005b373
mov r8, qword [rcx + 0x30]
cmp r8, rbp
je 0x10005b373
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 6
jbe 0x10005b373
lea edx, [rbp + 0x5c]
mov rcx, r8
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov r8, qword [rbx + 0x30]
lea rdx, [0x10002b610]
lea ecx, [rbp + 4]
mov rdi, rax
mov dword [rsp + 0x20], 1
call fcn.1000527f4
cmp rdi, rbp
je 0x10005b2ac
mov word [rdi], bp
mov edi, 0x104
lea rdx, [rsp + 0x240]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebp
je 0x10005b373
lea rax, [rsp + 0x240]
cmp rax, rbp
je 0x10005b2e4
lea rcx, [rsp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov r8, qword [rbx + 0x30]
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x30]
sub r8, rax
lea rax, [rdi + 0x7ffffefa]
cmp rax, rbp
je 0x10005b318
movzx eax, word [r8 + rcx]
cmp ax, bp
je 0x10005b318
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x10005b2f5
cmp rdi, rbp
jne 0x10005b321
sub rcx, 2
mov word [rcx], bp
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, rbp
je 0x10005b33d
mov word [rax + 2], bp
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebp
jne 0x10005b368
mov rcx, qword [rbx + 0x30]
lea rdx, [rsp + 0x20]
call fcn.10005516c
mov rcx, qword [rbx + 0x30]
jmp 0x10005b36d
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp dword [rbx + 0x80], ebp
je 0x10005b38e
cmp esi, ebp
je 0x10005b38e
mov rcx, qword [rbx + 0x38]
cmp rcx, rbp
je 0x10005b38e
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [rbx + 0x84], ebp
je 0x10005b3b2
mov rcx, qword [rbx + 0x50]
cmp rcx, rbp
je 0x10005b3b2
call fcn.100053354
cmp eax, ebp
je 0x10005b3b2
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x10005d488
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rax, [0x10002cb68]
mov rbx, rcx
xor ebp, ebp
mov qword [rcx], rax
mov rcx, qword [rcx + 0x30]
cmp rcx, rbp
je 0x10005d4bd
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov qword [rbx + 0x30], rbp
mov rcx, qword [rbx + 0x38]
cmp rcx, rbp
je 0x10005d4cf
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov qword [rbx + 0x38], rbp
mov rcx, qword [rbx + 0x40]
cmp rcx, rbp
je 0x10005d4e1
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov qword [rbx + 0x40], rbp
mov rcx, qword [rbx + 0x48]
cmp rcx, rbp
je 0x10005d4f3
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov qword [rbx + 0x48], rbp
mov rcx, qword [rbx + 0x50]
cmp rcx, rbp
je 0x10005d505
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov qword [rbx + 0x50], rbp
mov rcx, qword [rbx + 0x260]
cmp rcx, rbp
je 0x10005d517
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rbx + 0x260]
cmp rcx, rbp
je 0x10005d52f
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov qword [rbx + 0x260], rbp
mov rcx, qword [rbx + 0x2a0]
cmp rcx, rbp
je 0x10005d548
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x2a0], rbp
cmp qword [rbx + 8], rbp
je 0x10005d595
mov rax, qword [rbx + 8]
mov rsi, qword [rax + 8]
cmp qword [rax], rbp
je 0x10005d57a
mov rdi, qword [rax]
cmp rdi, rbp
je 0x10005d573
mov rcx, rdi
call fcn.100060d20
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rax, qword [rbx + 8]
mov qword [rax], rbp
mov rcx, qword [rbx + 8]
cmp rcx, rbp
je 0x10005d58c
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbx + 8], rbp
mov qword [rbx + 8], rsi
cmp rsi, rbp
jne 0x10005d54e
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x100064090
Capabilities:
Delete file

Disassembly:
test rcx, rcx
je 0x1000640cd
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1000640c8
call fcn.100053454
test eax, eax
je 0x1000640b7
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1000640c8
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
and qword [rbx], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1000646dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor esi, esi
mov rdi, rcx
mov ebx, esi
cmp qword [rcx], rsi
je 0x10006482c
lea rax, [rsp + 0x30]
mov ebp, 0x20019
lea rdx, [0x10002d0e0]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, ebp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x10006477d
lea rax, [rsp + 0x30]
lea rdx, [0x10002d0e0]
mov r9d, ebp
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
cmp eax, esi
cmovne rcx, rsi
mov qword [rsp + 0x30], rcx
jmp 0x100064782
mov rcx, qword [rsp + 0x30]
cmp rcx, rsi
je 0x100064818
mov rdx, qword [rdi]
lea rax, [rsp + 0x40]
mov ebp, 1
mov r9d, ebp
xor r8d, r8d
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100064802
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [0x10002d140]
xor r8d, r8d
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x48], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x1000647f7
cmp dword [rsp + 0x38], ebp
cmove ebx, ebp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x10002d170]
cmp ebx, esi
jne 0x10006481f
lea rdx, [0x10002d1a0]
mov r8, qword [rdi]
mov ecx, 4
call fcn.1000527f4
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x100064860
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor edx, edx
mov rdi, rcx
xor r9d, r9d
lea ecx, [rdx + 6]
xor r8d, r8d
call fcn.100053900
test eax, eax
je 0x10006492f
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov ebx, 1
lea rdx, [0x10002d1f0]
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006492b
and dword [rsp + 0x60], eax
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
lea rdx, [0x10002d268]
xor r8d, r8d
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100064920
cmp dword [rsp + 0x58], 4
jne 0x100064920
cmp dword [rsp + 0x60], eax
jne 0x100064920
lea rdx, [0x10002d2a0]
lea ecx, [rbx + 3]
call fcn.1000527a0
mov ebx, dword [rdi + 0x11c]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x100064935
mov eax, dword [rdi + 0x11c]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x100064d64
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x280
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp qword [rcx], 0
mov rbx, rcx
je 0x100064f08
and qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov rbp, 0xffffffff80000001
lea rdx, [0x1000255f0]
mov rcx, rbp
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100064e02
mov rdx, qword [rbx]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov r9d, 1
xor r8d, r8d
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100026128]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [rsp + 0x50]
lea rdx, [0x10002d0e0]
mov r9d, 0x20006
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100064e91
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002d538]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002d558]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r11, qword [rbx]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r11
lea rdx, [0x10002d558]
repne scasw ax, word [rdi]
mov r9d, 1
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9, qword [rbx]
lea r8, [0x10002d350]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.10003a080
test eax, eax
js 0x100064ef4
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100064ef4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, qword [rbx]
lea rdx, [0x10002d580]
mov ecx, 3
call fcn.1000527f4
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10006557c
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x1000655e0
mov rax, qword [rbx + 0x10]
cmp qword [rax], 0
mov rsi, qword [rax + 8]
je 0x1000655c3
mov rdi, qword [rax]
test rdi, rdi
je 0x1000655bb
mov rcx, rdi
call fcn.100064400
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rax, qword [rbx + 0x10]
and qword [rax], 0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1000655d6
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
and qword [rbx + 0x10], 0
mov qword [rbx + 0x10], rsi
cmp rsi, 0
jne 0x100065595
lea rcx, [rbx + 0x30]
call fcn.100064090
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x10006560b
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x10006560b
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
and qword [rbx + 0x38], 0
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x10006561e
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
and qword [rbx + 0x40], 0
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x100065631
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
and qword [rbx + 0x28], 0
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x100065644
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
and qword [rbx + 0x20], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x100065653
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret