joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c4580
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1401617b0
mov rcx, rbx
call fcn.140158ab0
test eax, eax
je 0x1400c4633
lea rcx, [rsp + 0x20]
mov r8d, eax
mov rdx, rbx
call fcn.140168320
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400c45d8
test al, 0x10
jne 0x1400c4633
mov rbx, qword [rsp + 0x28]
cmp word [rbx], 0
je 0x1400c4628
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x1400c45fc
cmp ax, 0x2f
je 0x1400c45fc
add rbx, 2
cmp word [rbx], 0
jne 0x1400c45e3
cmp word [rbx], 0
je 0x1400c4623
mov word [rbx], 0
mov rcx, qword [rsp + 0x28]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [rbx], 0x5c
add rbx, 2
cmp word [rbx], 0
jne 0x1400c45e3
mov rbx, qword [rsp + 0x28]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x20]
call fcn.140001150
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x250
pop rbx
ret

Function at 0x1400c5c60
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call fcn.140162780
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x1400c5ca6
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140162580
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x50
pop rbx
ret

Function at 0x1400c5cc0
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x101
call fcn.140162780
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400c5d0c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140162580
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x250
pop rbx
ret
Function at 0x1400c5d30
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x690
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov rdi, qword [rsp + 0x6f0]
mov r12, qword [rsp + 0x6f8]
mov rbx, rcx
lea rcx, [rsp + 0x40]
mov rbp, r9
mov rsi, r8
mov r13, rdx
call fcn.1401617b0
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.1401686f0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, r12
lea r10, [rsp + 0x260]
neg rcx
mov r14d, eax
mov rcx, r13
sbb r11d, r11d
xor eax, eax
lea rdx, [rsp + 0x470]
and r11d, 0x104
test r12, r12
mov r9, rsi
cmove r10, rax
neg rcx
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x38], r11d
sbb r8d, r8d
mov qword [rsp + 0x30], r10
and r8d, 0x104
test r13, r13
mov qword [rsp + 0x28], rdi
cmove rdx, rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
mov ebx, eax
jne 0x1400c5e0d
mov word [rsp + 0x470], ax
mov word [rsp + 0x260], ax
lea rcx, [rsp + 0x40]
call fcn.140001150
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
test r13, r13
je 0x1400c5e35
lea rdx, [rsp + 0x470]
mov rcx, r13
call fcn.140162580
test r12, r12
je 0x1400c5e4a
lea rdx, [rsp + 0x260]
mov rcx, r12
call fcn.140162580
mov eax, ebx
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x690
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400c6610
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
add rdx, 4
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [rbx], eax
jne 0x1400c663c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400c663c
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1400c6800
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1401617b0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140168520
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov ebx, eax
je 0x1400c685d
mov r8, qword [rsp + 0x28]
xor r9d, r9d
mov edx, 0x1005
lea ecx, [r9 + 4]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rcx, [rsp + 0x20]
call fcn.140001150
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x250
pop rbx
ret

Function at 0x1400c6890
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1401617b0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140168520
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
mov ebx, eax
je 0x1400c68ed
mov r8, qword [rsp + 0x28]
xor r9d, r9d
mov edx, 0x1005
lea ecx, [r9 + 4]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rcx, [rsp + 0x20]
call fcn.140001150
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x250
pop rbx
ret
Function at 0x1400c6eb0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1401617b0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1401686f0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140001150
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x250
pop rbx
ret

Function at 0x1400c7100
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1401617b0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140168520
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140001150
cmp ebx, 0xffffffff
je 0x1400c715d
test bl, 0x10
jne 0x1400c715d
mov eax, 1
jmp 0x1400c715f
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x250
pop rbx
ret

Function at 0x1400c7180
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.1401617b0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140168520
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140001150
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x250
pop rbx
ret

Function at 0x1400c71f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp byte [rcx], 0
mov rbx, rcx
je 0x1400c7252
lea rcx, [rsp + 0x20]
call fcn.1401617b0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140168810
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140001150
cmp ebx, 0xffffffff
je 0x1400c7252
test bl, 0x10
je 0x1400c7252
mov eax, 1
jmp 0x1400c7254
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x250
pop rbx
ret

Function at 0x1400c7580
Capabilities:
Delete file

Disassembly:
mov r11, rsp
sub rsp, 0x68
xor eax, eax
neg r8d
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x48], rcx
mov dword [rsp + 0x28], 3
mov qword [r11 - 0x30], rax
sbb ax, ax
mov qword [r11 - 0x38], rdx
and ax, 0x40
lea rcx, str.Enter_SHFileOperation_n
or ax, 0x4000
mov word [rsp + 0x40], ax
call fcn.1400b1c70
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
lea rcx, str.Leave_SHFileOperation_n
call fcn.1400b1c70
add rsp, 0x68
ret
Function at 0x1400c77e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rdi
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rdx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400c78f1
mov qword [rsp + 0x270], rbx
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea rcx, [rsp + 0x20]
call fcn.1401617b0
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140167a80
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.140001000
mov ecx, 2
add eax, 1
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x1400c788a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call fcn.1400010c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rcx, [rsp + 0x20]
call fcn.140001150
mov rcx, rdi
call fcn.140167260
mov ecx, 2
add eax, 1
movsxd rdx, eax
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x1400c78e3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rdi
mov rcx, rax
call fcn.140166ea0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, recv
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x250
pop rdi
ret
Function at 0x1400c7ed0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x690
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
mov rbp, rdx
call fcn.1401617b0
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.1401686f0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, rbx
lea rdx, [rsp + 0x260]
neg rcx
mov rcx, qword [rsp + 0x48]
mov esi, eax
sbb r8d, r8d
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
and r8d, 0x104
mov qword [rsp + 0x28], rax
test rbx, rbx
mov qword [rsp + 0x20], rax
cmove rdx, rax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
mov edi, eax
jne 0x1400c7f73
mov word [rsp + 0x260], ax
mov word [rsp + 0x470], ax
lea rcx, [rsp + 0x40]
call fcn.140001150
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
test rbx, rbx
je 0x1400c7f9a
lea rdx, [rsp + 0x260]
mov rcx, rbx
call fcn.140162580
test edi, edi
je 0x1400c7fa7
mov rax, qword [rbx + 8]
cmp byte [rax], 0
jne 0x1400c8012
lea rcx, [rsp + 0x40]
call fcn.1401617b0
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.1401686f0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea rcx, [rsp + 0x40]
mov edi, eax
call fcn.140001150
cmp edi, 3
je 0x1400c7ffc
cmp edi, 6
je 0x1400c7ffc
test edi, edi
mov rax, qword [0x1401e5d78]
jne 0x1400c7ff3
mov rdx, qword [rax + 0x32e0]
jmp 0x1400c800a
mov rdx, qword [rax + 0x378]
jmp 0x1400c800a
mov rax, qword [0x1401e5d78]
mov rdx, qword [rax + 0x370]
mov rcx, rbx
call fcn.1401624e0
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1401931f0
mov rbx, qword [rsp + 0x6c0]
add rsp, 0x690
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400c83e0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov rbx, rdx
call fcn.1401617b0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r8d, dword [rsp + 0x24]
add eax, 1
cmp eax, r8d
jle 0x1400c8436
lea rcx, [rsp + 0x20]
mov edx, eax
call fcn.1401677d0
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbx
test eax, eax
je 0x1400c8457
mov rdx, qword [rsp + 0x28]
call fcn.140162580
jmp 0x1400c845c
call fcn.140162780
lea rcx, [rsp + 0x20]
call fcn.140001150
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x1400c8490
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, r8
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rcx, [rsp + 0x20]
mov rdi, rax
call fcn.1401617b0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r8d, dword [rsp + 0x24]
add eax, 1
cmp eax, r8d
jle 0x1400c84ec
lea rcx, [rsp + 0x20]
mov edx, eax
call fcn.1401677d0
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbx
test eax, eax
je 0x1400c850d
mov rdx, qword [rsp + 0x28]
call fcn.140162580
jmp 0x1400c8512
call fcn.140162780
lea rcx, [rsp + 0x20]
call fcn.140001150
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
mov rbx, qword [rsp + 0x278]
add rsp, 0x250
pop rdi
ret

Function at 0x1400c86b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
lea r8, [rsp + 0x20]
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x1400c8716
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1400c870b
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140162580
mov ebx, 1
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret

Function at 0x1400c9260
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
sets cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1400c93c0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, r8
mov rbp, rcx
mov r9d, edx
lea rcx, [rsp + 0x30]
mov edi, edx
xor esi, esi
mov qword [rsp + 0x20], rcx
or r9d, 8
xor r8d, r8d
mov rdx, rax
mov rcx, rbp
mov qword [rsp + 0x38], rax
mov ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c94c6
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x100
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [rsi + 1]
test eax, eax
jne 0x1400c9476
nop
nop
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov edx, edi
call fcn.1400c93c0
test eax, eax
je 0x1400c9478
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x100
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1400c9440
mov ecx, 1
mov ebx, ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1400c94c6
mov r10, qword [0x1401f38e8]
mov rdx, qword [rsp + 0x38]
mov rcx, rbp
test r10, r10
je 0x1400c94b2
or edi, 2
xor r9d, r9d
mov r8d, edi
call r10
test eax, eax
jne 0x1400c94c2
mov eax, 1
jmp 0x1400c94c8
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
mov eax, 1
cmove esi, eax
mov eax, esi
jmp 0x1400c94c8
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
mov rbx, qword [rsp + 0x288]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400c94f0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
mov ebp, r9d
mov r12d, r8d
mov rbx, rdx
call fcn.1401617b0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140167a80
xor edi, edi
lea rbx, [0x1401b7348]
test ebp, ebp
mov rcx, rsi
je 0x1400c9558
mov r8, qword [rsp + 0x28]
mov edx, dword [rbx]
call fcn.1400c93c0
jmp 0x1400c957d
mov rax, qword [0x1401f38e8]
mov rdx, qword [rsp + 0x28]
test rax, rax
je 0x1400c9577
mov r8d, dword [rbx]
xor r9d, r9d
or r8d, 2
call rax
jmp 0x1400c957d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test r12d, r12d
je 0x1400c958e
add edi, 1
add rbx, 4
cmp edi, 3
jb 0x1400c9543
lea rcx, [rsp + 0x20]
call fcn.140001150
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401931f0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400c9670
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x490
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rdi, rcx
lea rcx, [rsp + 0x260]
mov r12, r9
mov rbp, r8
mov rbx, rdx
xor esi, esi
call fcn.1401617b0
lea rcx, [rsp + 0x260]
mov rdx, rbx
call fcn.140167a80
mov rdx, qword [rsp + 0x268]
lea r11, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rcx, [rsp + 0x260]
test eax, eax
mov ebx, esi
mov edi, 1
cmove ebx, edi
call fcn.140001150
test ebx, ebx
je 0x1400c97e8
lea rcx, [rsp + 0x40]
call fcn.1401617b0
lea rcx, [rsp + 0x260]
call fcn.1401617b0
test rbp, rbp
lea rcx, [rsp + 0x260]
je 0x1400c972e
mov rdx, rbp
call fcn.140167a80
jmp 0x1400c9733
call fcn.140161fc0
mov r8d, dword [rsp + 0x44]
nop
nop
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x38]
lea eax, [r8 + r8]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd r8, dword [rsp + 0x44]
cmp eax, 0xea
mov edx, dword [rsp + 0x30]
je 0x1400c9794
test eax, eax
jne 0x1400c97c6
mov rcx, r8
add rcx, rcx
cmp rdx, rcx
jb 0x1400c97ab
add edx, edi
shr edx, 1
add edx, edi
cmp edx, r8d
jle 0x1400c9740
lea rcx, [rsp + 0x40]
call fcn.1401677d0
jmp 0x1400c9733
mov rax, qword [rsp + 0x48]
shr rdx, 1
mov rcx, r12
mov word [rax + rdx*2], si
mov rdx, qword [rsp + 0x48]
call fcn.140162580
mov esi, edi
lea rcx, [rsp + 0x40]
call fcn.140001150
lea rcx, [rsp + 0x260]
call fcn.140001150
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x490
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400c9810
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x6b0
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rbx, rcx
lea rcx, [rsp + 0x270]
mov r12d, r9d
mov rsi, r8
mov rdi, rdx
xor ebp, ebp
call fcn.1401617b0
lea rcx, [rsp + 0x50]
call fcn.1401617b0
lea rcx, [rsp + 0x270]
mov rdx, rbx
call fcn.140167a80
test rdi, rdi
lea rcx, [rsp + 0x50]
je 0x1400c9879
mov rdx, rdi
call fcn.140167a80
jmp 0x1400c987e
call fcn.140161fc0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x278]
mov dword [rsp + 0x38], ebp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x490]
lea r8, [rsp + 0x44]
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
lea rcx, [rsp + 0x50]
test eax, eax
mov ebx, 1
cmove ebp, ebx
call fcn.140001150
lea rcx, [rsp + 0x270]
call fcn.140001150
test ebp, ebp
je 0x1400c9901
lea rdx, [rsp + 0x490]
mov rcx, rsi
mov word [rsp + 0x696], 0
call fcn.140162580
mov eax, ebx
jmp 0x1400c9903
xor eax, eax
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x6b0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c9930
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x4a0
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rbx, rcx
lea rcx, [rsp + 0x270]
mov r12d, r9d
mov rbp, r8
mov rsi, rdx
xor edi, edi
call fcn.1401617b0
lea rcx, [rsp + 0x50]
call fcn.1401617b0
lea rcx, [rsp + 0x270]
mov rdx, rbx
call fcn.140167a80
test rsi, rsi
lea rcx, [rsp + 0x50]
je 0x1400c9999
mov rdx, rsi
call fcn.140167a80
jmp 0x1400c999e
call fcn.140161fc0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x278]
mov dword [rsp + 0x38], edi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x44]
mov r9, rbp
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
mov ecx, 1
test eax, eax
cmove edi, ecx
lea rcx, [rsp + 0x50]
call fcn.140001150
lea rcx, [rsp + 0x270]
call fcn.140001150
mov eax, edi
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x4a0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400c9e20
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
sub rsp, 0x40
mov esi, r9d
mov r12, r8
mov r13d, edx
mov rdi, rcx
xor ebx, ebx
cmp byte [0x1401f33db], bl
je 0x1400c9e5c
call fcn.140167020
cmp eax, 0x104
jge 0x1400c9e7e
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9d, esi
mov r8, r12
mov edx, r13d
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rbx, rax
mov qword [rsp + 0x30], rax
jmp 0x1400c9e95
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
add rsp, 0x40
pop r13
ret