joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a48c0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x14013e690], 0
jne 0x1400a4ab7
lea rcx, str.advapi32.dll
mov byte [0x14013e690], 1
call fcn.1400a4240
mov qword [0x14013e698], rax
test rax, rax
je 0x1400a4aaa
lea rdx, str.GetSecurityInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ed68], rax
test rax, rax
je 0x1400a4aaa
mov rcx, qword [0x14013e698]
test rcx, rcx
je 0x1400a4a9f
lea rdx, str.SetSecurityInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ed60], rax
test rax, rax
je 0x1400a4aaa
mov rcx, qword [0x14013e698]
test rcx, rcx
je 0x1400a4a87
lea rdx, str.OpenProcessToken
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ed88], rax
test rax, rax
je 0x1400a4aaa
mov rcx, qword [0x14013e698]
test rcx, rcx
je 0x1400a4a6f
lea rdx, str.GetTokenInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ed80], rax
test rax, rax
je 0x1400a4aaa
mov rcx, qword [0x14013e698]
test rcx, rcx
je 0x1400a4a57
lea rdx, [0x1400df240]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ed78], rax
test rax, rax
je 0x1400a4aaa
mov rcx, qword [0x14013e698]
test rcx, rcx
je 0x1400a4a3f
lea rdx, [0x1400df260]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ed70], rax
test rax, rax
je 0x1400a4aaa
mov rcx, qword [0x14013e698]
test rcx, rcx
je 0x1400a4a27
lea rdx, str.SetEntriesInAclA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013ed58], rax
test rax, rax
je 0x1400a4aaa
mov al, 1
mov byte [0x14013e691], al
add rsp, 0x28
ret
xor al, al
mov qword [0x14013ed58], 0
mov byte [0x14013e691], al
add rsp, 0x28
ret
xor al, al
mov qword [0x14013ed70], 0
mov byte [0x14013e691], al
add rsp, 0x28
ret
xor al, al
mov qword [0x14013ed78], 0
mov byte [0x14013e691], al
add rsp, 0x28
ret
xor al, al
mov qword [0x14013ed80], 0
mov byte [0x14013e691], al
add rsp, 0x28
ret
xor al, al
mov qword [0x14013ed88], 0
mov byte [0x14013e691], al
add rsp, 0x28
ret
mov qword [0x14013ed60], 0
xor al, al
mov byte [0x14013e691], al
add rsp, 0x28
ret
movzx eax, byte [0x14013e691]
add rsp, 0x28
ret
Function at 0x1400a9c20
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor r8d, r8d
mov qword [rsp + 0x50], 0x105
mov edi, edx
mov rsi, rcx
mov ecx, 0x105
lea edx, [r8 + 1]
call fcn.1400a64d0
mov r9d, dword [rsp + 0x50]
mov r8, rax
mov edx, edi
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x1400a9cb7
nop dword [rax + rax]
mov rcx, rbx
cmp eax, 0xea
jne 0x1400a9cca
mov r9, qword [rsp + 0x50]
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x28], 0
mov r8d, 1
mov qword [rsp + 0x20], 1
call fcn.1400a62f0
mov r9d, dword [rsp + 0x50]
mov r8, rax
mov edx, edi
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1400a9c70
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call fcn.1400a62e0
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400a9cf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400a9d32
cmp dword [rsp + 0x68], 4
jne 0x1400a9d32
cmp dword [rsp + 0x30], 4
jne 0x1400a9d32
mov al, 1
add rsp, 0x48
ret
xor al, al
add rsp, 0x48
ret

Function at 0x1400a9d40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400a9e26
cmp dword [rsp + 0x50], 7
jne 0x1400a9e26
mov qword [rsp + 0x40], rbx
call fcn.1400a6c40
mov edx, dword [rsp + 0x58]
mov rcx, rax
add rdx, 2
mov rbx, rax
call fcn.1400a6a80
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x50]
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400a9e0c
cmp dword [rsp + 0x50], 7
jne 0x1400a9e0c
mov edx, dword [rsp + 0x58]
mov rcx, rbx
call fcn.1400a6da0
nop dword [rax + rax]
xor edx, edx
mov rcx, rbx
call fcn.1400a6af0
test al, al
jne 0x1400a9de0
lea rcx, [rbx + 0x18]
xor edx, edx
call fcn.1400a2270
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call fcn.1400a6c00
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1400a9e40
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
sub rsp, 0x38
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], 0
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400a9f2c
cmp dword [rsp + 0x68], 1
jne 0x1400a9f2c
mov eax, dword [rsp + 0x60]
xor r8d, r8d
inc eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rdi
mov ecx, eax
lea edx, [r8 + 1]
mov edi, eax
call fcn.1400a64d0
mov rbx, rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400a9f11
cmp dword [rsp + 0x68], 1
jne 0x1400a9f11
mov ecx, dword [rsp + 0x60]
cmp rcx, rdi
jb 0x1400a9ef7
lea r8d, [rax + 0x6c]
lea rdx, str.C:Usersyangjun04Downloadsputty_srcwindowsutils_registry.c
lea rcx, str.size___allocsize
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ecx, dword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
mov eax, ecx
mov byte [rax + rbx], 0
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
pop rsi
pop rbp
ret
mov rcx, rbx
call fcn.1400a62e0
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
pop rsi
pop rbp
ret
xor eax, eax
add rsp, 0x38
pop rsi
pop rbp
ret

Function at 0x1400a9f40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, r8
mov qword [rsp + 0x20], 0
mov r8, rcx
mov r9, rdx
xor ecx, ecx
xor edx, edx
call fcn.1400aa060
mov rdi, rax
test rax, rax
jne 0x1400a9f78
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], 0
mov rdx, rsi
mov qword [rsp + 0x58], rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400aa034
cmp dword [rsp + 0x30], 1
jne 0x1400aa034
mov eax, dword [rsp + 0x68]
xor r8d, r8d
inc eax
mov ecx, eax
mov ebp, eax
lea edx, [r8 + 1]
call fcn.1400a64d0
mov rbx, rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400aa02c
cmp dword [rsp + 0x30], 1
jne 0x1400aa02c
mov ecx, dword [rsp + 0x68]
cmp rcx, rbp
jb 0x1400aa024
lea r8d, [rax + 0x6c]
lea rdx, str.C:Usersyangjun04Downloadsputty_srcwindowsutils_registry.c
lea rcx, str.size___allocsize
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ecx, dword [rsp + 0x68]
mov eax, ecx
mov byte [rax + rbx], 0
jmp 0x1400aa036
mov rcx, rbx
call fcn.1400a62e0
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400aa160
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
add rsp, 0x38
ret

Function at 0x1400aa1a0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov eax, dword [r8 + 0x10]
mov r9d, 7
inc eax
mov dword [rsp + 0x28], eax
mov rax, qword [r8]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
add rsp, 0x38
ret

Function at 0x1400aa1d0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [r8 + rax], 0
jne 0x1400aa1e0
inc eax
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
add rsp, 0x38
ret

Function at 0x1400ab390
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x140
mov rax, qword [0x14013b4f8]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor ebp, ebp
movzx esi, r8b
movzx r14d, r9b
mov rdi, rdx
mov rbx, rcx
test r8b, r8b
je 0x1400ab3e6
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
dec eax
cmp eax, 0x102
cmova esi, ebp
mov dword [rdi], 0x88
test rbx, rbx
je 0x1400ab3f9
cmp byte [rbx], bpl
je 0x1400ab3f9
mov rbp, rbx
mov qword [rdi + 0x50], rbp
mov rcx, rdi
test r14b, r14b
je 0x1400ab40d
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
jmp 0x1400ab413
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
test eax, eax
setne dil
test rbx, rbx
je 0x1400ab438
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
dec eax
cmp eax, 0x102
jbe 0x1400ab438
mov byte [rbx], 0
test sil, sil
je 0x1400ab448
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
movzx eax, dil
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400b0530
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400abb70
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
cmp byte [0x14013e700], bl
jne 0x1400abbdc
lea rcx, str.secur32.dll
call fcn.1400a4240
lea rcx, str.sspicli.dll
mov rdi, rax
call fcn.1400a4240
test rdi, rdi
je 0x1400abbc9
lea rdx, str.GetUserNameExA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013e6f8], rax
mov byte [0x14013e700], 1
jmp 0x1400abbe3
mov rax, rbx
mov qword [0x14013e6f8], rbx
mov byte [0x14013e700], 1
jmp 0x1400abbe3
mov rax, qword [0x14013e6f8]
test rax, rax
je 0x1400abc48
xor edx, edx
mov dword [rsp + 0x30], ebx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 8]
call rax
mov ecx, dword [rsp + 0x30]
xor r8d, r8d
lea edx, [r8 + 1]
call fcn.1400a64d0
lea r8, [rsp + 0x30]
mov rdx, rax
mov ecx, 8
mov rdi, rax
call qword [0x14013e6f8]
test al, al
mov rcx, rdi
setne sil
test al, al
je 0x1400abc3e
mov edx, 0x40
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x1400abc43
mov byte [rax], bl
jmp 0x1400abc43
call fcn.1400a62e0
test sil, sil
jne 0x1400abc9f
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ecx, dword [rsp + 0x30]
mov r8d, 0x100
test eax, eax
cmove ecx, r8d
xor r8d, r8d
mov dword [rsp + 0x30], ecx
lea edx, [r8 + 1]
call fcn.1400a64d0
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
setne sil
test eax, eax
jne 0x1400abc9c
mov rcx, rdi
call fcn.1400a62e0
test sil, sil
mov rsi, qword [rsp + 0x40]
cmovne rbx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400adb50
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14013b4f8]
xor rax, rsp
mov qword [rsp + 0x10], rax
xor r10d, r10d
mov r11, rdx
mov r9d, r10d
nop dword [rax]
movsx r8d, byte [r9 + rcx]
lea eax, [r8 - 0x41]
cmp al, 0x19
ja 0x1400adb83
lea eax, [r8 - 0x41]
jmp 0x1400adbc8
lea eax, [r8 - 0x61]
cmp al, 0x19
ja 0x1400adb91
lea eax, [r8 - 0x47]
jmp 0x1400adbc8
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x1400adb9f
lea eax, [r8 + 4]
jmp 0x1400adbc8
cmp r8b, 0x2b
jne 0x1400adbac
mov eax, 0x3e
jmp 0x1400adbc8
cmp r8b, 0x2f
jne 0x1400adbb9
mov eax, 0x3f
jmp 0x1400adbc8
cmp r8b, 0x3d
jne 0x1400adc56
mov eax, 0xffffffff
mov dword [rsp + r9*4], eax
inc r9
cmp r9, 4
jl 0x1400adb70
mov edx, dword [rsp]
cmp edx, 0xffffffff
je 0x1400adc56
mov r8d, dword [rsp + 4]
cmp r8d, 0xffffffff
je 0x1400adc56
mov ecx, dword [rsp + 8]
mov eax, dword [rsp + 0xc]
cmp ecx, 0xffffffff
jne 0x1400adbff
cmp eax, ecx
jne 0x1400adc56
lea r10d, [rcx + 2]
jmp 0x1400adc0a
cmp eax, 0xffffffff
setne r10b
add r10d, 2
shl edx, 6
and eax, 0x3f
or edx, r8d
and ecx, 0x3f
shl edx, 6
or edx, ecx
shl edx, 6
or edx, eax
mov eax, edx
shr eax, 0x10
mov byte [r11], al
cmp r10d, 1
jbe 0x1400adc37
mov ecx, edx
shr ecx, 8
mov byte [r11 + 1], cl
cmp r10d, 2
jbe 0x1400adc41
mov byte [r11 + 2], dl
mov eax, r10d
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.1400b0530
add rsp, 0x28
ret
xor eax, eax
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.1400b0530
add rsp, 0x28
ret
Function at 0x1400ae7d0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rsi, rdx
mov qword [rsp + 0x60], rbx
mov rdi, rcx
mov qword [rsp + 0x68], rbx
call fcn.140003140
test al, al
je 0x1400ae815
mov r9, rsi
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
mov ecx, 0x1f0001
call fcn.1400a4ad0
test al, al
je 0x1400ae877
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x20]
mov r8, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], 0x18
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
jne 0x1400ae869
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400a42b0
mov r8, rax
lea rcx, str.CreateMutex___s___failed:__s
mov rdx, rdi
call fcn.1400a6690
mov qword [rsi], rax
jmp 0x1400ae877
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400ae887
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400ae897
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400af140
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.DISPLAY
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, rax
add rsp, 0x28
jmp fcn.1400aa5f0
Function at 0x1400af9c0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rdx
test r8, r8
je 0x1400af9e7
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor edx, eax
or r9d, edx
sub r8, 1
jne 0x1400af9d0
mov eax, 0x100
sub eax, r9d
shr eax, 8
ret

Function at 0x1400b00a0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14013e718]
test rax, rax
jne 0x1400b0122
mov edx, dword [0x14013e720]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, eax
cmp rax, qword [0x14013e720]
jb 0x1400b011b
nop dword [rax]
mov rcx, qword [0x14013e718]
lea rdx, [0x14013e720]
mov byte [rsp + 0x28], 0
mov r9, rax
mov r8d, 1
mov qword [rsp + 0x20], 1
call fcn.1400a62f0
mov edx, dword [0x14013e720]
mov rcx, rax
mov qword [0x14013e718], rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, eax
cmp rax, qword [0x14013e720]
jae 0x1400b00d0
mov rax, qword [0x14013e718]
add rsp, 0x38
ret
Function at 0x14079d058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14079d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14079d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14079d06f
add dl, dl
jne 0x14079d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14079d0f6
xor eax, eax
add dl, dl
jne 0x14079d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14079d1ad
add dl, dl
jne 0x14079d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14079d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14079d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14079d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14079d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14079d07e
mov eax, 1
add dl, dl
jne 0x14079d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14079d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14079d0fb
sub eax, ebx
mov ebx, 1
jne 0x14079d14c
mov ecx, 1
add dl, dl
jne 0x14079d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14079d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14079d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14079d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14079d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14079d15d
cmp eax, 0x7d00
jae 0x14079d19b
cmp eax, 0x500
jb 0x14079d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079d07e
cmp eax, 0x7f
ja 0x14079d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14079d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14079d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000501c
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x14001a170]
xor rax, rsp
mov qword [rbp + 0x140], rax
and qword [rdx], 0
mov r15, rdx
mov r8, rcx
mov edi, 0x104
mov edx, edi
lea rcx, [rsp + 0x30]
xor r14d, r14d
call fcn.1400021ec
lea r8, [0x140011cb0]
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140002278
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x1400050cb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x1400051da
mov rcx, qword [rbp + 0x168]
lea edx, [rdi - 0x3b]
call fcn.140003d40
mov esi, eax
jmp 0x1400051b7
and dword [rsp + 0x24], r14d
lea rdx, [rsp + 0x24]
and dword [rsp + 0x20], r14d
mov rcx, rbx
call fcn.140003e68
mov esi, eax
test eax, eax
jns 0x140005110
mov rcx, qword [rbp + 0x168]
lea r8, [0x140011c4c]
mov r9d, eax
mov edx, 0xcf
call fcn.140003d08
mov rcx, rbx
call fcn.140003de0
jmp 0x1400051b7
lea r8, [0x140011cb8]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140002278
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140005159
mov rcx, qword [rbp + 0x168]
mov edx, 0xd5
call fcn.140003d40
mov esi, eax
jmp 0x140005103
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140003e68
mov esi, eax
test eax, eax
jns 0x140005194
mov rcx, qword [rbp + 0x168]
lea r8, [0x140011c4c]
mov r9d, eax
mov edx, 0xd7
call fcn.140003d08
mov rcx, rdi
call fcn.140003de0
jmp 0x140005103
mov rcx, rdi
call fcn.140003de0
movsxd rax, dword [rsp + 0x20]
mov rcx, rbx
movsxd r14, dword [rsp + 0x24]
shl rax, 0x1f
or r14, rax
call fcn.140003de0
xor esi, esi
test esi, esi
jns 0x1400051da
mov rcx, qword [rbp + 0x168]
lea r8, [0x140011c4c]
mov r9d, esi
mov edx, 0x62
call fcn.140003d08
mov eax, esi
jmp 0x1400051df
mov qword [r15], r14
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14000f210
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000737c
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, str._Driver__DeleteDTUCabETag_Method_Called
xor ecx, ecx
call fcn.140007efc
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionWindowsUpdateDTUEtag
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteTreeW]
nop dword [rax + rax]
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x1400073e4
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
test ebx, ebx
jns 0x1400073d4
lea rdx, str._Driver__DeleteDTUCabETag_Method:_Unable_to_delete_the_DTU_cabs_e_tag_reg_key
call fcn.140007db4
jmp 0x1400073e0
lea rdx, str._Handler__DeleteDTUCabETag_Method:_Succesfully_deleted_cabs_e_tag_reg_key
call fcn.140007efc
mov eax, ebx
jmp 0x1400073f4
lea rdx, str._Driver__DeleteDTUCabETag_Method:_No_e_tag_reg_key_found
xor ecx, ecx
call fcn.140007efc
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400080ec
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
xor edi, edi
mov qword [rax - 0x40], rbx
mov r15, r9
mov r12, r8
mov r13, rdx
mov rbp, rcx
test rcx, rcx
jne 0x140008132
mov ecx, 0x80070057
mov edi, ecx
call fcn.14000b708
jmp 0x140008232
test r13, r13
je 0x140008121
test r12, r12
je 0x140008121
test r15, r15
je 0x140008121
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x140008121
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoSizeW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x14000818b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
je 0x14000818b
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x14000818b
mov ecx, edi
jmp 0x140008128
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.14000862c
mov rbx, qword [rsp + 0x28]
test rbx, rbx
jne 0x1400081a9
mov edi, 0x8007000e
jmp 0x140008187
mov r9, rbx
mov r8d, esi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW]
nop dword [rax + rax]
test eax, eax
jne 0x1400081eb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x1400081db
mov edi, 0x80004005
jmp 0x140008187
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x140008187
lea r9, [rsp + 0x20]
mov rcx, rbx
lea r8, [rsp + 0x30]
lea rdx, [0x140011aa0]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
je 0x1400081c4
mov rdx, qword [rsp + 0x30]
movzx ecx, word [rdx + 0xa]
mov dword [r13], ecx
movzx ecx, word [rdx + 8]
mov dword [r12], ecx
movzx ecx, word [rdx + 0xe]
mov dword [r15], ecx
movzx ecx, word [rdx + 0xc]
mov dword [r14], ecx
mov ecx, edi
call fcn.14000b77c
mov rcx, rbx
call fcn.14000f7e0
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret