joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c57a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rdi, rcx
lea rcx, str.shell32.dll
mov qword [rsp + 0x118], rbp
call fcn.14000afd0
mov edx, 0x294
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Control_PanelDesktopWindowMetrics
mov r9d, 0x2001f
mov rbp, rax
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
test eax, eax
jne 0x1400c5946
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, [0x14010bcf8]
xor r8d, r8d
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x30]
test r11d, r11d
je 0x1400c5882
cmp dword [rsp + 0x40], 1
jne 0x1400c5882
lea eax, [r11 - 1]
cmp word [rsp + rax*2 + 0x70], si
je 0x1400c5887
mov eax, 0x20
cmp r11d, eax
cmovb eax, r11d
mov word [rsp + rax*2 + 0x70], si
jmp 0x1400c5887
mov word [rsp + 0x70], si
lea rcx, [rsp + 0x70]
call fcn.14004ba9c
lea r8, [0x14010bd18]
lea rcx, [rsp + 0xb0]
lea r9d, [rax + 1]
mov edx, 0x20
call section..text
mov rbx, qword [rsp + 0x38]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [0x14010bd20]
mov r9d, 1
add eax, eax
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbp, rbp
je 0x1400c58f9
mov ecx, 1
call rbp
mov rbx, qword [rsp + 0x38]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str.Shell_Icon_Size
mov r9d, 1
add eax, eax
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbp, rbp
je 0x1400c593b
xor ecx, ecx
call rbp
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rdi + 0x88]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1304
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbp, qword [rsp + 0x118]
test eax, eax
jle 0x1400c59b0
mov ebx, eax
nop dword [rax]
mov rcx, qword [rdi + 0x88]
lea r9, [rsp + 0x48]
mov r8, rsi
mov edx, 0x133c
mov dword [rsp + 0x48], 8
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r11, dword [rsp + 0x68]
mov rcx, qword [rdi + r11*8 + 0x728]
mov rax, qword [rcx]
call qword [rax + 0x298]
inc rsi
dec rbx
jne 0x1400c5970
mov rcx, qword [rdi + 0xa60]
call fcn.140022440
mov rcx, rdi
call fcn.1400d8ec0
mov rcx, rdi
call fcn.1400e42f0
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400c7600
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
lea rbp, [rsp - 0x2420]
mov eax, 0x2520
call fcn.140057430
sub rsp, rax
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rbp + 0x2410], rax
mov rbx, rcx
lea rcx, [rbp - 0xe]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rbp - 0x10], si
call fcn.140051eb0
mov rax, qword [rbx + 0x68]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea rax, str.Text_Document__.txt_
mov dword [rsp + 0x50], reloc.SHELL32.dll_ILGetSize
mov qword [rsp + 0x68], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x70], rsi
mov qword [rbp - 0x80], rax
lea rax, [rbx + 0x1338]
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x60], rax
lea rax, [0x140104528]
mov dword [rbp - 0x78], 0x104
mov qword [rbp - 0x70], rsi
mov dword [rbp - 0x68], esi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x50], 0x880002
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rsi
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x1400c7785
mov rcx, qword [rbx + 0x12c0]
lea r9d, [rsi + 1]
or r8, 0xffffffffffffffff
mov edx, 0x100c
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x1400c7785
mov rcx, qword [rbx + 0xa50]
lea r8, [rbp + 0x200]
mov edx, eax
mov r9, qword [rcx]
mov qword [rsp + 0x2538], rdi
call qword [r9 + 0x60]
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x200]
call fcn.140097a20
mov edi, eax
cmp eax, 0xffffffff
je 0x1400c777d
mov qword [rsp + 0x30], rsi
lea rcx, [rbp - 0x10]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400c777d
lea r9, [rsp + 0x40]
lea rdx, [rbp + 0x410]
mov r8d, edi
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x2538]
mov rcx, qword [rbp + 0x2410]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0x2520]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400c7c20
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rdi, rcx
mov rcx, qword [rcx + 0xa50]
mov esi, edx
mov rax, qword [rcx]
lea r8, [rdi + 0x1338]
mov edx, 0x104
call qword [rax + 0x68]
lea rcx, [rdi + 0x1338]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edx, esi
mov rcx, rdi
call fcn.1400c4710
mov rcx, rdi
call fcn.1400e0bc0
mov rcx, qword [rdi + 0x12c0]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x102b
mov dword [rdi + 0xf3d0], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x2c], 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.1400e58c0
cmp qword [rdi + 0xee30], 0
je 0x1400c7cdc
mov rax, qword [rdi + 0xee48]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400c7cdc
cmp dword [rbx + 0x20], esi
jne 0x1400c7cd0
mov rcx, qword [rbx + 0x18]
call qword [rdi + 0xee30]
mov rbx, qword [rbx]
cmp rbx, qword [rdi + 0xee48]
jne 0x1400c7cc1
mov rcx, qword [rdi + 0xa50]
mov rax, qword [rcx]
call qword [rax + 0x70]
mov r8d, dword [rdi + 0x1b88]
mov edx, dword [rdi + 0x1b94]
mov r9, rax
mov rcx, rdi
mov rbx, rax
call fcn.1400e5460
mov rcx, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
jmp qword [sym.imp.ole32.dll_CoTaskMemFree]
jns 0x15213a9f7
xor ebx, dword [rdi + 0x45cdb863]
ror dword [rbx], 0x74
mov al, bh
pop rbp
out dx, eax
xchg edx, eax
mov ah, 0x36
mov edx, 0x293098a2
cmp bl, byte [rdi + 0x610abefe]
invalid
Function at 0x1400c7f20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x8e0
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x8d0], rax
cmp dword [rsp + 0x918], 0
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x30], 0xffffffff
je 0x1400c8025
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400c7f9b
lea r8, [rsp + 0x2c0]
mov r9d, 0x104
xor edx, edx
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0xb0]
mov r8d, 0x8000
mov rcx, rdi
call fcn.140092ff0
lea r9, [rsp + 0xb0]
lea r8, [0x14010bc70]
lea rcx, [rsp + 0x4d0]
mov edx, 0x200
call section..text
lea rcx, [0x14010bc80]
xor edx, edx
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x2c0]
mov qword [rsp + 0x40], 0x70
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x4d0]
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x70], 5
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, 0x80004005
jmp 0x1400c80d4
test r9d, r9d
jne 0x1400c8079
movsxd rax, dword [rcx + 0x1b50]
imul rax, rax, 0x214
cmp dword [rax + rcx + 0x1b9c], r9d
jne 0x1400c8079
mov rcx, qword [rcx + 0xa18]
mov rax, qword [rcx]
call qword [rax + ILCombine]
mov edi, eax
test eax, eax
js 0x1400c8071
cmp dword [rbx + 0xedb8], 0
je 0x1400c8071
xor edx, edx
mov ecx, 0xeb
mov r8d, 0x40005
call qword [sym.imp.WINMM.dll_PlaySoundW]
mov edx, dword [rbx + 0x1b50]
jmp 0x1400c80c5
movsxd rax, dword [rcx + 0x1b50]
xor r8d, r8d
xor r9d, r9d
imul rax, rax, 0x214
cmp dword [rax + rcx + 0x1b9c], r8d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
je 0x1400c80ab
mov dword [rsp + 0x20], 1
jmp 0x1400c80b6
mov eax, dword [rsp + 0x910]
mov dword [rsp + 0x20], eax
add rcx, 0xffffffffffffffc8
call fcn.1400aaf90
mov edx, dword [rsp + 0x30]
mov edi, eax
test edi, edi
js 0x1400c80d2
lea rcx, [rbx - 0x38]
call fcn.1400c7c20
mov eax, edi
mov rcx, qword [rsp + 0x8d0]
xor rcx, rsp
call fcn.14004ae00
mov rbx, qword [rsp + 0x908]
add rsp, 0x8e0
pop rdi
ret
Function at 0x1400c8750
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x1400c879a
mov rdx, qword [rsp + 0x50]
lea r8d, [rax + 1]
mov rcx, rbx
call fcn.1400c8100
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
add rsp, 0x30
pop rbx
ret
Function at 0x1400c9130
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x260
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r13, rcx
mov qword [rsp + 0x38], rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400c92f1
lea r8, [rsp + 0x40]
mov r9d, 0x104
xor edx, edx
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400c92f1
xor ebx, ebx
mov qword [rsp + 0x298], r14
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x2a0], r15
mov qword [rsp + 0x28], rbx
mov r14d, ebx
mov esi, ebx
mov r12d, ebx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebp, eax
test eax, eax
je 0x1400c9237
mov ecx, ebp
call fcn.14004af90
mov rdi, rax
test rax, rax
je 0x1400c9237
lea rcx, [rsp + 0x40]
mov r9, rax
mov r8d, ebp
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x140102dd4]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
cmp dword [rsp + 0x20], ebx
jbe 0x1400c922f
mov rax, qword [rsp + 0x28]
lea r14d, [rbx + 1]
mov esi, dword [rax + 0x14]
mov r12d, dword [rax + 0x10]
mov rcx, rdi
call fcn.14004b048
lea rdx, [rsp + 0x30]
mov rcx, r13
mov qword [rsp + 0x28], rbx
mov edi, ebx
mov ebp, ebx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r15d, eax
test eax, eax
je 0x1400c92b0
mov ecx, r15d
call fcn.14004af90
mov r13, rax
test rax, rax
je 0x1400c92b0
mov rcx, qword [rsp + 0x38]
mov r9, rax
mov r8d, r15d
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x140102dd4]
mov rcx, r13
call qword [sym.imp.VERSION.dll_VerQueryValueW]
cmp dword [rsp + 0x20], ebx
jbe 0x1400c92a8
mov rax, qword [rsp + 0x28]
mov ebx, 1
mov edi, dword [rax + 0x14]
mov ebp, dword [rax + 0x10]
mov rcx, r13
call fcn.14004b048
mov r15, qword [rsp + 0x2a0]
test r14d, r14d
mov r14, qword [rsp + 0x298]
je 0x1400c92f1
test ebx, ebx
je 0x1400c92f1
mov edx, ebp
mov ecx, r12d
shr edx, 0x10
shr ecx, 0x10
cmp dx, cx
jne 0x1400c92f1
cmp bp, r12w
jne 0x1400c92f1
shr edi, 0x10
shr esi, 0x10
cmp di, si
jne 0x1400c92f1
mov eax, 1
jmp 0x1400c92f3
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14004ae00
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x260
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c99b0
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x340
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rax, rdx
mov rbx, r8
mov rdi, rcx
lea r8, [rsp + 0x70]
xor r9d, r9d
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x4008
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x14b
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsp + 0x78]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x40c
mov rcx, rdi
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x30], reloc.SHELL32.dll_ILIsParent
mov qword [rsp + 0x38], 0xffffffffffffffff
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x54], 1
mov qword [rsp + 0x40], rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.14004ae00
mov rbx, qword [rsp + 0x368]
add rsp, 0x340
pop rdi
ret

Function at 0x1400c9d20
Capabilities:
Get file system object information

Disassembly:
push rbp
push rsi
push r13
push r14
sub rsp, 0xa38
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0xa20], rax
mov rsi, rdx
xor r14d, r14d
mov r13, rcx
lea r9d, [r14 + 2]
or r8, 0xffffffffffffffff
mov edx, 0x100c
mov rcx, rsi
mov ebp, r14d
call qword [sym.imp.USER32.dll_SendMessageW]
mov r11, rax
cmp eax, 0xffffffff
jne 0x1400c9d71
or eax, eax
jmp 0x1400c9eaa
mov rcx, qword [r13 + 0xa50]
lea r8, [rsp + 0x600]
mov edx, r11d
mov rax, qword [rcx]
call qword [rax + 0x60]
test eax, eax
js 0x1400c9ea8
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, rsi
mov qword [rsp + 0xa78], rdi
mov qword [rsp + 0xa30], r12
call qword [sym.imp.USER32.dll_SendMessageW]
mov edi, r14d
mov r12, rax
test eax, eax
jle 0x1400c9e98
mov qword [rsp + 0xa70], rbx
mov rbx, r14
nop
mov rcx, qword [r13 + 0xa50]
lea r8, [rsp + 0x810]
mov edx, edi
mov rax, qword [rcx]
call qword [rax + 0x60]
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x810]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea r8, [rsp + 0x340]
lea rcx, [rsp + 0x600]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rdx, [rsp + 0x558]
lea rcx, [rsp + 0x298]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
mov dword [rsp + 0x40], 2
lea r9, [rsp + 0x30]
mov r8, rbx
mov edx, 0x102b
mov rcx, rsi
test eax, eax
jne 0x1400c9e77
mov dword [rsp + 0x3c], 2
call qword [sym.imp.USER32.dll_SendMessageW]
inc ebp
jmp 0x1400c9e82
mov dword [rsp + 0x3c], r14d
call qword [sym.imp.USER32.dll_SendMessageW]
inc edi
inc rbx
cmp edi, r12d
jl 0x1400c9dd0
mov rbx, qword [rsp + 0xa70]
mov rdi, qword [rsp + 0xa78]
mov r12, qword [rsp + 0xa30]
mov eax, ebp
mov rcx, qword [rsp + 0xa20]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0xa38
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x1400ca110
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x440], rax
cmp dword [rcx + 0xede4], 0
mov rbx, rcx
je 0x1400ca21f
mov rcx, qword [rcx + 0xa50]
mov qword [rsp + 0x468], rsi
mov rax, qword [rcx]
call qword [rax + 0x70]
lea rdx, [rsp + 0x20]
mov r8d, 0x8000
mov rcx, rax
mov rsi, rax
call fcn.140092ff0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
jne 0x1400ca20e
lea rcx, [rsp + 0x230]
call qword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 4
sete cl
test ecx, ecx
jne 0x1400ca20e
mov rcx, qword [rbx + 0xa60]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x470], rdi
call fcn.1400213f0
mov rdi, rax
test rax, rax
je 0x1400ca206
mov rcx, qword [rbx + 0x98]
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, rdi
je 0x1400ca1eb
mov dword [rbx + 0x1b6c], 1
mov rcx, qword [rbx + 0x98]
mov r9, rdi
mov edx, 0x110b
mov r8d, 9
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rsp + 0x470]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rsi, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x450
pop rbx
ret
Function at 0x1400cd3d0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbp, rcx
mov esi, 1
mov r15d, esi
xor r12b, r12b
add rcx, 0x18
cmp qword [rcx + 0x18], 8
jb 0x1400cd426
mov rcx, qword [rcx]
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
xor r9d, r9d
mov rcx, qword [rbp + 0x10]
cmp rax, 0xffffffffffffffff
jne 0x1400cd46d
xor r8d, r8d
mov edx, 0x8004
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400cd60d
mov r8, qword [rbp + 0x48]
mov edx, 0x8001
call qword [sym.imp.USER32.dll_PostMessageW]
mov r13, qword [rbp + 0x40]
mov rbx, qword [r13]
cmp rbx, r13
je 0x1400cd5ef
nop dword [rax]
lea rdx, [rbx + 0x10]
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rdi
mov word [rsp + 0x60], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.140009660
nop
test r12b, r12b
jne 0x1400cd5dd
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400cd5b8
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov r11, qword [rsp + 0x48]
test r11, r11
je 0x1400cd56b
mov ecx, r11d
call fcn.14002cff8
mov rdi, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x48]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x40]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call fcn.14004b410
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd r8, r15d
xor r9d, r9d
mov edx, 0x8002
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
inc r15d
lea rcx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx r12d, r12b
cmp byte [rbp + 0x80], 0
mov esi, 1
cmovne r12d, esi
lea rcx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
jmp 0x1400cd5bd
mov esi, 1
cmp qword [rsp + 0x78], 8
jb 0x1400cd5cf
mov rcx, qword [rsp + 0x60]
call fcn.14004b088
mov rbx, qword [rbx]
cmp rbx, r13
jne 0x1400cd490
jmp 0x1400cd5ef
cmp qword [rsp + 0x78], 8
jb 0x1400cd5ef
mov rcx, qword [rsp + 0x60]
call fcn.14004b088
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400cdb30
Capabilities:
Create thread
Get graphical window text

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x3b0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov rsi, rcx
cmp byte [rcx + 0xa0], 0
jne 0x1400cdd26
mov edx, 0x47f
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jne 0x1400cdbcf
lea r9d, [rax + 0x40]
lea r8, [rsp + 0x110]
mov edx, 0x1f46
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x30
lea r8, [0x14010c1a0]
lea rdx, [rsp + 0x110]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400cdd54
mov r8d, 0x104
lea rdx, [rsp + 0x190]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, 0x88
call fcn.14004b164
mov r12, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400cdc6e
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rdx, [rsi + 0x78]
lea rcx, [rsp + 0x70]
call fcn.14000b220
mov rbx, rax
mov qword [rsp + 0x58], 7
xor ebp, ebp
mov qword [rsp + 0x50], rbp
mov word [rsp + 0x40], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x190]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x40]
call fcn.140009a30
nop
mov r9, rbx
lea r8, [rsp + 0x40]
mov rdx, qword [rsi + 8]
mov rcx, r12
call fcn.1400cd670
jmp 0x1400cdc72
xor ebp, ebp
mov eax, ebp
mov qword [rsi + 0x98], rax
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov edx, 0x480
lea r8d, [rdx - 0x7e]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
lea r8, [rsi + 0xa2]
mov edx, 1
lea r9d, [rdx + 0x1f]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
mov r9d, 0x40
lea r8, [rsp + 0x90]
mov edx, 0x1f47
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.USER32.dll_LoadStringW]
lea r8, [rsp + 0x90]
mov edx, 1
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov byte [rsi + 0xa0], 1
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
mov r9, qword [rsi + 0x98]
lea r8, [0x1400cd650]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
mov edx, 0xfffffffe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400cdd54
mov byte [rcx + 0xa1], 1
mov rbx, qword [rcx + 0x98]
test rbx, rbx
je 0x1400cdd54
lea rcx, [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rbx + 0x80], 1
lea rcx, [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400ce9b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
lea rax, [rcx + 0x220]
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x40]
lea rdx, [0x14010c430]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x224]
lea rdx, [0x14010c450]
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400cea40
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x220]
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
lea rdx, [0x14010c3f0]
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r11d, dword [rbx + 0x224]
lea rax, [rsp + 0x40]
lea rdx, [0x14010c410]
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x40], r11d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret