joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403750
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov rbx, rdx
mov edx, 0x104
mov rcx, rbx
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.System32_]
mov qword [rdi - 1], rax
movzx eax, word [0x0041b670]
mov word [rdi + 7], ax
movzx eax, byte [0x0041b672]
mov byte [rdi + 9], al
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret

Function at 0x4037b0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov ecx, 0x104
mov qword [rsp + 0x48], rdi
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor eax, eax
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x0041b544]
mov word [rdi - 1], ax
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret

Function at 0x4039f0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x320
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x004232f8]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov dword [rsp + 0x40], 0x104
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0xf0]
call fcn.0040a660
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPInstall
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.00407ce0
nop
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xf0]
lea rdx, [0x0041b4b8]
lea rcx, [rsp + 0x50]
call fcn.00407ee0
test eax, eax
jne 0x403a8a
lea rcx, [rsp + 0x48]
call fcn.00407d40
jmp 0x403bb3
lea rax, str.oemsetup.bat
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xf0]
lea r8, str._s_s
mov edx, 0x104
lea rcx, [rsp + 0x200]
call fcn.004098d0
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
lea rcx, [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x403af6
lea rcx, [rsp + 0x48]
call fcn.00407d40
jmp 0x403bb3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x80]
call fcn.0040a660
mov dword [rsp + 0x80], 0x70
mov dword [rsp + 0x84], 0x40
mov qword [rsp + 0x88], rbx
lea rax, str.open
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x200]
mov qword [rsp + 0x98], rax
lea rax, str._uninstall
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xb0], ebx
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x403ba9
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x48]
call fcn.00407d40
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.004095f0
add rsp, 0x320
pop rbx
ret
Function at 0x403bf0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xe0
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.0040a660
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor eax, eax
mov rdx, rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov ebx, eax
jne 0x403c5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, ebx
add rsp, 0xe0
pop rbx
ret

Function at 0x403c70
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x250
mov rax, qword [0x004232f8]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x130]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
xor edx, edx
movzx eax, byte [rsp + rdx + 0x130]
add rdx, 1
test al, al
mov byte [rsp + rdx + 0x1f], al
jne 0x403ca0
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str._regsvr32.exe__s_u]
mov rcx, 0xffffffffffffffff
mov qword [rdi - 1], rax
mov rax, qword [0x0041b718]
lea r8, [rsp + 0x130]
mov qword [rdi + 7], rax
mov eax, dword [0x0041b720]
mov dword [rdi + 0xf], eax
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
xor edx, edx
nop
movzx eax, byte [r8 + rdx]
add rdx, 1
test al, al
mov byte [rdi + rdx - 2], al
jne 0x403d00
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [0x0041b700]
lea rcx, [rsp + 0x20]
mov qword [rdi - 1], rax
mov rax, qword [0x0041b708]
mov qword [rdi + 7], rax
call fcn.00403bf0
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.004095f0
add rsp, 0x250
pop rdi
ret
Function at 0x403d60
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x328
mov rax, qword [0x004232f8]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov qword [r11 + 0x20], rbx
mov rbx, rdx
mov qword [r11 - 8], rsi
lea rdx, [r11 - 0x248]
mov esi, r8d
call fcn.00403690
xor ecx, ecx
nop
nop
movzx eax, byte [rsp + rcx + 0xe0]
add rcx, 1
test al, al
mov byte [rsp + rcx + 0x1ef], al
jne 0x403da0
mov qword [rsp + 0x318], rdi
xor eax, eax
lea rdi, [rsp + 0x1f0]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rbx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x403de0
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.0040a660
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x1f0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xe0]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rbx, qword [rsp + 0x348]
test eax, eax
mov edi, eax
je 0x403e75
mov rcx, qword [rsp + 0x50]
mov edx, esi
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, edi
mov rdi, qword [rsp + 0x318]
mov rsi, qword [rsp + 0x320]
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.004095f0
add rsp, 0x328
ret

Function at 0x4041d0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x004232f8]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
lea r9, [rsp + 0x34]
lea rdx, str.CoInstallers32
mov rbx, rax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x100
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40428e
mov edx, dword [rsp + 0x30]
lea r8, str.SynTPCo9.dll_PS2DeviceInstall
lea rcx, [rsp + 0x40]
call fcn.00403f90
lea rdx, str.CoInstallers32
test eax, eax
je 0x404285
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov r9d, 7
mov qword [rsp + 0x20], rcx
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x40428e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.004095f0
add rsp, 0x150
pop rbx
ret
Function at 0x405160
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov r11, rsp
sub rsp, 0x2a8
mov rax, qword [0x004232f8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov qword [r11 + 0x18], rbx
lea rbx, [r11 - 0x138]
mov qword [r11 + 0x20], rbp
mov rbp, rdx
mov qword [rsp + 0x28], rcx
sub rbx, rdx
nop
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rbx + rdx - 1], al
jne 0x4051a0
xor eax, eax
mov qword [rsp + 0x298], rdi
lea rdi, [rsp + 0x170]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x30]
repne scasb al, byte [rdi]
mov eax, dword [0x0041b9cc]
lea rcx, [rsp + 0x170]
mov dword [rdi - 1], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
je 0x405374
mov qword [rsp + 0x2a0], rsi
nop
lea rsi, [rsp + 0x5c]
lea rdi, [0x0041b9c8]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x40533f
lea rsi, [rsp + 0x5c]
lea rdi, [0x0041b9c4]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x40533f
test byte [rsp + 0x30], 0x10
je 0x4052d2
mov rcx, rbp
movzx eax, byte [rcx]
add rcx, 1
test al, al
mov byte [rbx + rcx - 1], al
jne 0x405240
xor eax, eax
lea rdi, [rsp + 0x170]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x5c]
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405270
xor eax, eax
lea rdi, [rsp + 0x170]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x0041b544]
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x170]
mov word [rdi - 1], ax
call fcn.00405160
lea rcx, [rsp + 0x170]
mov edx, 0x80
call fcn.0040b1d0
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x40533f
mov rcx, rbp
nop
nop
nop
movzx eax, byte [rcx]
add rcx, 1
test al, al
mov byte [rbx + rcx - 1], al
jne 0x4052e0
xor eax, eax
lea rdi, [rsp + 0x170]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x5c]
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x405310
lea rcx, [rsp + 0x170]
mov edx, 0x80
call fcn.0040b1d0
lea rcx, [rsp + 0x170]
call fcn.0040b1a0
mov rdi, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405200
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rsi, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x298]
mov rbp, qword [rsp + 0x2c8]
mov rbx, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.004095f0
add rsp, 0x2a8
ret
Function at 0x4053b0
Capabilities:
Check os version
Enumerate files on windows
Set file attributes

Disassembly:
mov r11, rsp
sub rsp, 0x968
mov rax, qword [0x004232f8]
xor rax, rsp
mov qword [rsp + 0x940], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 8], rdi
lea rdx, [r11 - 0x638]
mov rsi, rcx
mov qword [r11 - 0x10], r12
mov ebx, 1
call fcn.004036f0
xor eax, eax
lea rdi, [rsp + 0x330]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.oem.inf]
lea rdx, [rsp + 0xe0]
mov qword [rdi - 1], rax
movzx eax, byte [0x0041ba20]
lea rcx, [rsp + 0x330]
mov byte [rdi + 7], al
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x90
mov rbp, rax
call fcn.0040a660
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor r12d, r12d
test eax, eax
je 0x405486
cmp dword [rsp + 0x50], 2
jne 0x405489
mov eax, dword [rsp + 0x44]
cmp eax, 4
ja 0x405476
mov ebx, r12d
jmp 0x405489
cmp eax, 5
jne 0x405489
cmp dword [rsp + 0x48], ebx
jae 0x405489
mov ebx, r12d
jmp 0x405489
mov ebx, r12d
cmp rbp, 0xffffffffffffffff
movsxd rbx, ebx
je 0x4055f8
nop
nop
nop
lea rdx, [rsp + 0x220]
mov rcx, rsi
call fcn.004036f0
xor eax, eax
lea rdi, [rsp + 0x220]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x10c]
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4054d0
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x540]
lea rcx, [rsp + 0x220]
mov r9d, 0x400
mov edx, 2
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupGetInfInformationA]
test eax, eax
je 0x40564a
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x540]
lea r8, str.Provider
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x540]
xor edx, edx
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.SETUPAPI.dll_SetupQueryInfVersionInformationA]
test eax, eax
je 0x40564a
cmp dword [rsp + 0x30], 0x400
jae 0x40564a
lea rdx, str.Synaptics
lea rcx, [rsp + 0x540]
call fcn.0040a930
test eax, eax
jne 0x40564a
lea rcx, [rsp + 0x220]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test rbx, rbx
je 0x40563d
mov rax, qword [rsi + 0x230]
test rax, rax
je 0x4055bc
xor r8d, r8d
lea rcx, [rsp + 0x10c]
lea edx, [r8 + 1]
call rax
test eax, eax
jne 0x40564a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x0041ba04]
lea rcx, [rsp + 0x440]
mov r8d, eax
call fcn.00409820
lea r9, [rsp + 0x10c]
lea r8, [rsp + 0x440]
lea rdx, str.Deleting_inf_files._Error_code___s__file___s__n
mov rcx, rsi
call fcn.00403190
mov r12, qword [rsp + 0x958]
mov rdi, qword [rsp + 0x960]
mov rsi, qword [rsp + 0x988]
mov rbp, qword [rsp + 0x980]
mov rbx, qword [rsp + 0x978]
mov eax, 1
mov rcx, qword [rsp + 0x940]
xor rcx, rsp
call fcn.004095f0
add rsp, 0x968
ret
lea rcx, [rsp + 0x220]
call fcn.004050f0
lea rdx, [rsp + 0xe0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4054a0
jmp 0x4055f8
Function at 0x407ee0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov qword [r11 - 8], rbx
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
xor edi, edi
test rdx, rdx
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov rsi, r9
mov rbx, r8
mov r13d, edi
mov r12, rdx
je 0x4080ac
test r8, r8
je 0x4080ac
test r9, r9
je 0x4080ac
mov rcx, qword [rcx + 0x10]
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x38], r14
test rcx, rcx
lea r14, [rdi - 1]
je 0x408064
mov rbp, qword [rsp + 0xa8]
mov r13d, dword [r9]
mov qword [r11 - 0x48], rcx
test rbp, rbp
je 0x407f78
lea rax, [r11 - 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov qword [r11 - 0x58], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408064
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test rbp, rbp
mov r12d, eax
je 0x407fa9
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [rsp + 0x88]
cmp ecx, 2
jne 0x408021
mov eax, 2
mul r13
cmovo rax, r14
mov rcx, rax
call fcn.00408ee0
test rax, rax
mov rbp, rax
je 0x40801a
mov r8d, r13d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov rcx, rbx
mov rdx, rbp
sub rcx, rbp
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x407ff0
mov rcx, rbx
call fcn.0040ba20
mov rcx, rbp
mov dword [rsi], eax
call fcn.00409210
mov ecx, dword [rsp + 0x88]
jmp 0x408021
mov ecx, dword [rsp + 0x88]
test r12d, r12d
jne 0x408064
cmp ecx, 1
je 0x408035
cmp ecx, 7
je 0x408035
cmp ecx, 2
jne 0x40803a
mov edi, 1
mov eax, edi
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x4080a8
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
cmp ecx, r13d
ja 0x40803c
sub rbx, rdx
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rbx + rdx - 1], al
jne 0x408090
mov dword [rsi], ecx
mov eax, 1
jmp 0x40803c
xor eax, eax
jmp 0x40803c
xor eax, eax
jmp 0x408046
Function at 0x4080b0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rcx, qword [rcx + 0x10]
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
test rcx, rcx
mov qword [r11 - 0x20], r12
mov rsi, r9
mov r12d, r8d
mov rbp, rdx
je 0x40819f
test rdx, rdx
je 0x40819f
test r9, r9
je 0x40819f
mov qword [r11 - 8], rbx
xor ebx, ebx
mov qword [r11 - 0x38], rcx
cmp qword [rsp + 0xb8], rbx
je 0x408160
mov rdx, qword [rsp + 0xb8]
lea rax, [r11 + 8]
xor r9d, r9d
mov qword [r11 - 0x48], rax
lea rax, [r11 - 0x38]
xor r8d, r8d
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40815b
xor eax, eax
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x88
ret
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0xb0]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp qword [rsp + 0xb8], rbx
mov esi, eax
je 0x408196
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
mov eax, ebx
jmp 0x40813c
xor eax, eax
jmp 0x408144
Function at 0x40b1a0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40b1c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40b1c9
mov ecx, eax
call fcn.0040c6e0
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x40b1d0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
sub rsp, 0x38
test rcx, rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov edi, edx
mov rbx, rcx
jne 0x40b220
call fcn.0040c6b0
mov dword [rax], ebx
call fcn.0040c680
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
mov qword [rsp + 0x20], rbx
call fcn.0040bbe0
lea eax, [rbx - 1]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40b24c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0040c6e0
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
test dil, dil
jns 0x40b256
and eax, 0xfffffffe
jmp 0x40b259
or eax, 1
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x40b22b
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x38
ret

Function at 0x40d1a7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x004232f8]
jne 0x40960a
rol rcx, 0x10
test cx, 0xffff
jne 0x409606
repz ret
ror rcx, 0x10
jmp 0x40d100
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x00424a80]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x00424b78]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x40d185
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x00424a80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x40d1a7
mov rax, qword [rsp + 0x88]
mov qword [0x00424b78], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00424b18], rax
mov rax, qword [0x00424b78]
mov qword [0x004249f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00424b00], rax
mov dword [0x004249e0], 0xc0000409
mov dword [0x004249e4], 1
mov rax, qword [0x004232f8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x00423300]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x00424a78], eax
mov ecx, 1
call fcn.00413ec0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0041c148]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x00424a78], 0
jne 0x40d22e
mov ecx, 1
call fcn.00413ec0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x417730
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.0040eaa0
xor ebx, ebx
cmp qword [0x00425700], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x417861
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x417793
xor eax, eax
jmp 0x417941
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x41778c
mov rcx, rax
call fcn.0040ea30
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x00425700], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040ea30
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x00425708], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040ea30
lea rcx, [rsp + 0x30]
mov qword [0x00425710], rax
call fcn.004099e0
test eax, eax
je 0x417817
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0040bb40
cmp dword [rsp + 0x30], 2
jne 0x417861
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040ea30
test rax, rax
mov qword [0x00425720], rax
je 0x417861
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0040ea30
mov qword [0x00425718], rax
mov rcx, qword [0x00425718]
cmp rcx, rsi
je 0x4178f3
cmp qword [0x00425720], rsi
je 0x4178f3
call fcn.0040eb00
call rax
test rax, rax
mov rbp, rax
je 0x4178be
mov rcx, qword [0x00425720]
call fcn.0040eb00
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x4178be
test byte [rsp + 0x48], 1
jne 0x4178f3
lea rcx, [rsp + 0x34]
call fcn.00409a30
test eax, eax
je 0x4178e0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0040bb40
cmp dword [rsp + 0x34], 4
jb 0x4178ed
bts edi, 0x15
jmp 0x417927
bts edi, 0x12
jmp 0x417927
mov rcx, qword [0x00425708]
cmp rcx, rsi
je 0x417927
call fcn.0040eb00
call rax
test rax, rax
mov rbx, rax
je 0x417927
mov rcx, qword [0x00425710]
cmp rcx, rsi
je 0x417927
call fcn.0040eb00
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x00425700]
call fcn.0040eb00
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret