joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400300d4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
and dword [rbp + 0x10], 0
lea rax, [rbp + 0x28]
and qword [rbp + 0x28], 0
lea rdx, str.SoftwareMicrosoftMediaPlayerSetup
mov r9d, 0x101
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140030172
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x18]
lea rax, [rbp + 0x10]
mov dword [rbp + 0x18], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Migrated_NSS_Version
mov dword [rbp + 0x20], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14003015e
cmp dword [rbp + 0x18], 4
je 0x140030162
and dword [rbp + 0x10], 0
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, dword [rbp + 0x10]
add rsp, 0x30
pop rbp
ret
Function at 0x1400315cc
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x590], rax
xor r14d, r14d
mov rsi, rdx
mov qword [rsp + 0x50], r14
mov rdi, rcx
test rcx, rcx
je 0x1400317a0
test rdx, rdx
je 0x1400317a0
lea rdx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
nop dword [rax + rax]
test eax, eax
je 0x140031781
mov rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x44]
mov dword [rsp + 0x48], 0x104
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x60]
lea rax, [rbp + 0x170]
mov dword [rsp + 0x44], 0x104
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov ebx, r14d
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
nop dword [rax + rax]
test eax, eax
je 0x1400316d8
mov r15d, 0x208
cmp r14w, word [rsp + 0x60]
jne 0x1400316b4
mov eax, dword [rsp + 0x40]
cmp eax, 3
je 0x140031705
add eax, 0xfffffffa
cmp eax, 3
jbe 0x140031705
mov r8, rdi
lea rcx, [rsp + 0x60]
mov edx, r15d
call fcn.1400103e4
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x104
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
nop dword [rax + rax]
test eax, eax
jne 0x14003170c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1400316f3
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x140031786
mov ebx, 0x80004005
jmp 0x140031786
mov ebx, 0x80070523
jmp 0x140031786
cmp r14w, word [rbp + 0x170]
je 0x14003176f
or r9d, 0xffffffff
lea rax, [rbp + 0x380]
mov dword [rsp + 0x28], r9d
lea r8, [rbp + 0x170]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 2]
lea ecx, [rdx + 0x7e]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x14003176f
lea rax, [rsp + 0x60]
mov rdx, r15
lea r9, [rbp + 0x170]
mov qword [rsp + 0x20], rax
lea r8, [0x140040ec0]
mov rcx, rsi
call fcn.140010420
jmp 0x140031786
lea r8, [rsp + 0x60]
mov rdx, r15
mov rcx, rsi
call fcn.1400103e4
jmp 0x140031786
mov ebx, 0x80070057
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14003179c
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov eax, ebx
jmp 0x1400317a5
mov eax, 0x80070057
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.140001660
mov rbx, qword [rsp + 0x6e0]
add rsp, 0x6a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400319c4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
mov r14d, edx
mov rsi, rcx
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x20]
xor ecx, ecx
lea edx, [r15 + 0x23]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
nop dword [rax + rax]
lea r12d, [r15 + 1]
mov ebx, eax
test eax, eax
js 0x140031aa4
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], r15
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
nop dword [rax + rax]
mov edi, r15d
lea rcx, [rsp + 0x28]
test eax, eax
cmovne edi, r12d
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
nop dword [rax + rax]
test eax, eax
js 0x140031aa0
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140031aa0
mov rax, qword [rcx]
movabs r10, 0xcb3d1ea576d29870
mov rdx, qword [rsp + 0x20]
mov rax, qword [rax + 0x28]
call qword [0x1400401a8]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x1400401a8]
test edi, edi
jne 0x140031adf
mov edi, 0x104
lea rcx, [rsp + 0x30]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140031b4e
lea r8, str.All_UsersApplication_Data
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140010470
test eax, eax
js 0x140031b4e
test ebx, ebx
js 0x140031b15
lea rcx, [rsp + 0x30]
call fcn.140019df8
test eax, eax
je 0x140031af2
mov ebx, r15d
jmp 0x140031b17
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
call fcn.140019df8
test eax, eax
jne 0x140031aed
test ebx, ebx
jne 0x140031b53
mov rdx, r14
lea rcx, [rsp + 0x30]
shr rdx, 1
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140031b26
add rax, r12
cmp rdx, rax
jbe 0x140031b47
lea r8, [rsp + 0x30]
mov rcx, rsi
call fcn.1400104bc
jmp 0x140031b53
mov ebx, 0x8007007a
jmp 0x140031b53
mov ebx, 0x80070057
mov eax, ebx
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140001660
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140031b88
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor r14d, r14d
mov esi, edx
mov qword [rsp + 0x38], r14
mov rdi, rcx
mov ebx, 0x80004005
test rcx, rcx
jne 0x140031bd5
lea eax, [rbx - 2]
jmp 0x140031d00
lea rax, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140031cfe
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov ebx, 0x208
mov dword [rsp + 0x30], 1
mov eax, esi
lea rdx, str.CommonFilesDir
cmp esi, ebx
cmova eax, ebx
xor r8d, r8d
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140031c95
cmp dword [rsp + 0x30], 1
jne 0x140031c95
lea rcx, [rsp + 0x40]
call fcn.140019df8
test eax, eax
je 0x140031c74
mov ebx, r14d
jmp 0x140031ca7
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
call fcn.140019df8
test eax, eax
jne 0x140031c6f
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140031d30
mov ebx, eax
test eax, eax
jne 0x140031ced
mov rdx, rsi
lea rcx, [rsp + 0x40]
shr rdx, 1
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140031cb6
inc rax
cmp rdx, rax
jbe 0x140031cd7
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.1400104bc
jmp 0x140031ced
mov ecx, 0x8007007a
mov ebx, 0x8007007a
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140001660
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400332dc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor ebx, ebx
mov rsi, rdx
mov r14, rcx
test rcx, rcx
je 0x140033515
test rdx, rdx
je 0x140033515
mov word [rcx], bx
lea edx, [rbx + 0x5c]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140033344
mov rdi, rsi
jmp 0x140033348
add rdi, 2
mov r15d, 0x104
lea rcx, [rsp + 0x70]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x140033380
call fcn.140015998
test eax, eax
jle 0x14003351a
movzx eax, ax
or eax, 0x80070000
jmp 0x14003351a
lea r8, str.CatRootF750E6C3_38EE_11D1_85E5_00C04FC295EE_
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.140010470
mov r8, rdi
lea rcx, [rsp + 0x70]
mov rdx, r15
call fcn.140010470
lea rcx, [rsp + 0x70]
call fcn.140019eb0
mov r15d, 4
test eax, eax
je 0x1400334e3
mov r8, rsi
mov qword [rsp + 0x58], rbx
lea rdx, str.____Another_version_of_catalog_file__S_was_previously_installed._r_n
mov dword [rsp + 0x50], 1
mov ecx, r15d
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x60], r15d
call fcn.140018ed8
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetupCatalogIteration
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400334b0
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x54]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140033476
cmp dword [rsp + 0x54], r15d
jne 0x140033476
cmp dword [rsp + 0x50], 1
mov eax, ebx
setne al
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r15d
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
cmp dword [rsp + 0x50], ebx
je 0x1400334e3
test rdi, rdi
je 0x1400334fa
mov r11d, 0x103
lea r8, [0x140049350]
mov edx, r11d
mov rcx, r14
call fcn.1400104bc
mov r8, rdi
mov edx, r11d
mov rcx, r14
call fcn.140010470
jmp 0x1400334ff
test rdi, rdi
je 0x1400334fa
mov r8, rdi
mov edx, 0x103
mov rcx, r14
call fcn.1400104bc
jmp 0x1400334ff
mov ebx, 0x80004005
mov r8d, ebx
lea rdx, str.GetNameForCatalogOnSystem_returned_0x_x._r_n
mov ecx, r15d
call fcn.140018ed8
mov eax, ebx
jmp 0x14003351a
mov eax, 0x8007000e
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140001660
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003424c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rdi
mov dword [r11 + 0x20], r9d
mov qword [r11 + 0x10], rdx
push rbp
push r13
push r15
mov rbp, rsp
sub rsp, 0x70
xor r13d, r13d
lea rax, [rbp - 0x20]
mov qword [r11 - 0x48], r13
lea r9, [rbp + 0x28]
mov qword [r11 - 0x50], r13
mov r15, r8
mov qword [r11 - 0x58], r13
lea r8, [rbp - 8]
mov qword [r11 - 0x60], rax
mov ebx, r13d
lea rax, [rbp - 0x18]
mov qword [rbp - 8], r13
mov qword [r11 - 0x68], rax
mov qword [rbp + 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x20], r13
call fcn.140032ce8
mov rcx, qword [rbp - 8]
lea edi, [r13 + 1]
mov qword [rbp - 0x10], r13
test rcx, rcx
je 0x140034360
cmp qword [rbp + 0x28], r13
je 0x140034360
mov rdx, qword [rbp + 0x28]
lea rax, [rbp - 0x10]
lea r9d, [r13 + 3]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140034360
mov rdx, qword [rbp - 0x18]
lea rax, [rbp + 0x40]
mov rcx, qword [rbp - 0x10]
lea r9, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov dword [rbp + 0x38], edi
mov dword [rbp + 0x40], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14003432d
cmp dword [rbp + 0x38], edi
cmove ebx, edi
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
je 0x140034360
mov rcx, r15
call fcn.140019df8
test eax, eax
je 0x140034360
or rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], r13w
jne 0x140034351
test rax, rax
jne 0x140034379
cmp qword [rbp - 0x20], r13
je 0x140034379
mov r8, qword [rbp - 0x20]
mov edx, 0x104
mov rcx, r15
call fcn.1400104bc
mov ebx, edi
cmp qword [rbp + 0x28], r13
je 0x140034388
mov rcx, qword [rbp + 0x28]
call fcn.1400012c0
cmp qword [rbp - 0x18], r13
je 0x140034397
mov rcx, qword [rbp - 0x18]
call fcn.1400012c0
cmp qword [rbp - 0x20], r13
je 0x1400343a6
mov rcx, qword [rbp - 0x20]
call fcn.1400012c0
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r13
pop rbp
ret
Function at 0x140038af8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
mov qword [r11 + 0x18], r8
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
mov rsi, rdx
mov dword [rsp + 0x40], 4
lea rax, [r11 + 0x18]
mov rdi, r9
xor ebx, ebx
mov qword [r11 - 0x10], rax
and qword [r11 - 0x18], rbx
lea r9, [r11 + 8]
and dword [rsp + 0x50], ebx
mov rcx, rsi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
test eax, eax
jne 0x140038b85
mov ecx, dword [rsp + 0x50]
call fcn.14000130c
mov rbx, rax
test rax, rax
je 0x140038b85
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
test rdi, rdi
je 0x140038b90
mov eax, dword [rsp + 0x40]
mov dword [rdi], eax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140039914
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x38
xor ebx, ebx
lea rax, [rbp + 0x30]
xor r8d, r8d
mov qword [rbp + 0x30], rbx
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferences
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
lea r9d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400399b8
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x18]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ForceOnline
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x18], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400399a8
cmp dword [rbp + 0x18], 4
jne 0x1400399a8
cmp dword [rbp + 0x20], 1
sete bl
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
ret
Function at 0x1400399f4
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor esi, esi
xor ebp, ebp
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x140039b61
test rdx, rdx
je 0x140039b61
lea r8d, [rsi + 7]
lea rdx, str.file:__
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140039a41
add rbx, 0xe
and qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000080
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140039a97
call fcn.140015998
mov edi, eax
test eax, eax
jle 0x140039b8b
movzx edi, ax
or edi, 0x80070000
jmp 0x140039b8b
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140039acc
call fcn.140015998
mov edi, eax
test eax, eax
jle 0x140039b66
movzx edi, ax
or edi, 0x80070000
jmp 0x140039b66
mov rdx, rdi
mov ecx, 0x42
mov rbx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140039aaf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
nop dword [rax + rax]
test rax, rax
je 0x140039aaf
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x140039aaf
mov r8, r14
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x140039b66
mov rcx, qword [r14]
mov rax, qword [rcx]
movabs r10, 0x83a99e0f10de4270
mov rax, qword [rax + 0x30]
mov rdx, rbx
call qword [0x1400401a8]
mov edi, eax
jmp 0x140039b66
mov edi, 0x80004003
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rsi, rsi
je 0x140039b8b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop dword [rax + rax]
xor esi, esi
test edi, edi
jns 0x140039ba3
test rsi, rsi
je 0x140039ba3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14003a7b4
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
nop dword [rax + rax]
movzx ebx, ax
mov rax, qword [0x140053868]
test rax, rax
jne 0x14003a818
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop dword [rax + rax]
test rax, rax
je 0x14003a80c
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x140053868], rax
jmp 0x14003a813
mov rax, qword [0x140053868]
test rax, rax
je 0x14003a82b
movabs r10, 0xdec12e9650d89870
call qword [0x1400401a8]
movzx ebx, ax
movzx eax, bx
add rsp, 0x20
pop rbx
ret

Function at 0x14003ab64
Capabilities:
Delete registry value

Disassembly:
push rsi
sub rsp, 0x30
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov rsi, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rcx, rsi
lea rdx, str.SoftwareMicrosoftMultimediaWMPlayerDevicesDVD
mov r9d, 0x20006
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14003abcd
mov rcx, qword [rsp + 0x40]
lea rdx, str.RequiredFile
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rax, [rsp + 0x40]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftMultimediaWMPlayerGroupsVideoDVD
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14003ac23
mov rcx, qword [rsp + 0x40]
lea rdx, str.RequiredFile
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rax, [rsp + 0x40]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftMultimediaWMPlayerGroupsVideoDVR_MS
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14003ac79
mov rcx, qword [rsp + 0x40]
lea rdx, str.RequiredFile
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
add rsp, 0x30
pop rsi
ret

Function at 0x14003ac88
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
xor r9d, r9d
mov rdi, r8
mov ecx, esi
xor r8d, r8d
lea edx, [r9 + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax + rax]
mov edx, eax
mov rcx, rdi
mov ebp, eax
call fcn.14003c33c
mov ebx, eax
test eax, eax
js 0x14003ad03
mov r8, qword [rdi]
mov r9d, ebp
mov edx, 0x5c
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax + rax]
test eax, eax
jne 0x14003ad03
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14003ad03
movzx ebx, ax
or ebx, 0x80070000
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003bd0c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edi, edi
mov rbx, rcx
cmp dword [0x140053888], edi
mov qword [rcx], rdi
mov dword [rcx + 8], edi
mov word [rcx + 0xc], di
jne 0x14003bda9
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x110
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [rsp + 0x20]
mov dword [0x140053888], 1
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
je 0x14003bda9
cmp dword [rsp + 0x24], 5
jb 0x14003bd89
cmp dword [rsp + 0x28], 1
jae 0x14003bd90
cmp dword [rsp + 0x24], 6
jb 0x14003bda9
mov ecx, dword [0x140051624]
mov eax, 0x7f
cmp dword [rsp + 0x30], 2
cmove ecx, eax
mov dword [0x140051624], ecx
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140001660
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret

Function at 0x14003ca50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebx, edx
mov rsi, rcx
call fcn.14003bff8
test rdi, rdi
jne 0x14003ca90
mov rax, qword [0x140051e08]
mov rdi, qword [rax + 0x10]
test rdi, rdi
jne 0x14003ca90
mov eax, 0x80070057
jmp 0x14003cb2f
mov eax, ebx
mov ebp, 1
shr eax, 4
mov rcx, rdi
add ax, bp
movzx edx, ax
lea r8d, [rbp + 5]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
nop dword [rax + rax]
test rax, rax
je 0x14003cacf
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
test rax, rax
jne 0x14003caed
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x14003cae9
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x14003cb2f
jmp 0x14003cb04
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov rdx, rax
test rax, rax
jne 0x14003cb0b
mov eax, 0x8000ffff
jmp 0x14003cb2f
and ebx, 0xf
je 0x14003cb1f
movzx eax, word [rdx]
lea rdx, [rdx + rax*2]
lea rdx, [rdx + 2]
sub ebx, ebp
jne 0x14003cb10
movzx r8d, word [rdx]
mov rcx, rsi
add rdx, 2
call fcn.14003c4d0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003d008
Capabilities:
Get file version info

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x28
cmp byte [0x140053894], 0
jne 0x14003d0d2
and qword [rsp + 0x38], 0
lea r9, [0x140053ef0]
and dword [rsp + 0x30], 0
lea rcx, str.mfcore.dll
xor edx, edx
mov r8d, 0x200
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
nop dword [rax + rax]
test eax, eax
je 0x14003d0cb
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x140043760]
lea rcx, [0x140053ef0]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
je 0x14003d0cb
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx + 0xa]
mov word [0x140051630], ax
movzx r8d, word [rcx + 8]
mov word [0x140051632], r8w
movzx edx, word [rcx + 0xe]
mov word [0x140051634], dx
movzx eax, word [rcx + 0xc]
mov ecx, 0xc
mov word [0x140051628], cx
mov word [0x140051636], ax
mov word [0x14005162a], r8w
mov word [0x14005162c], dx
mov word [0x14005162e], ax
mov byte [0x140053894], 1
lea rax, [0x140051628]
add rsp, 0x28
ret

Function at 0x14003df00
Capabilities:
Hash data using fnv

Disassembly:
mov r9d, r8d
add r9, rdx
jmp 0x14003df22
movzx eax, byte [rdx]
movabs r8, 0x100000001b3
xor rax, qword [rcx]
imul rax, r8
inc rdx
mov qword [rcx], rax
cmp rdx, r9
jb 0x14003df08
mov rax, qword [rcx]
ret