joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052570
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
and qword [rsp + 0x40], 0
mov rsi, rcx
mov rax, rdx
lea rcx, [rsp + 0x40]
mov rdi, r8
lea rdx, str.9375CFF0413111d3B88A00104B2A6676
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140052698
lea rcx, [rsp + 0x52]
xor ebx, ebx
xor edx, edx
and word [rsp + 0x50], bx
mov r8d, 0x1fe
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
xor edx, edx
jmp 0x140052662
and qword [rsp + 0x278], 0
lea rax, [rsp + 0x278]
lea rdx, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140052641
mov rdx, qword [rsp + 0x278]
mov r8, rdi
mov rcx, rsi
call fcn.140052280
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, ebx
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x278]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x278], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x1400525f2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400526c0
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x250
and qword [rax + 0x20], 0
lea rax, [rax + 0x20]
mov rdi, rcx
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400527e2
lea rcx, [rsp + 0x52]
xor ebx, ebx
xor edx, edx
and word [rsp + 0x50], bx
mov r8d, 0x1fe
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
xor edx, edx
jmp 0x1400527a6
and qword [rsp + 0x270], 0
lea rax, [rsp + 0x270]
lea rdx, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140052785
mov rdx, qword [rsp + 0x270]
lea r8, [rsp + 0x50]
mov rcx, rdi
call fcn.140052570
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, ebx
mov rcx, qword [rsp + 0x278]
lea r9, [rsp + 0x270]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x270], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rcx, qword [rsp + 0x278]
test eax, eax
je 0x140052734
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret
Function at 0x140052800
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_Messaging_SubsystemProfiles
mov rbx, rcx
mov dword [rcx + 8], 0x7d2
call fcn.1400526c0
lea rdx, str.SoftwareMicrosoftOffice15.0OutlookProfiles
mov rcx, rbx
mov dword [rbx + 8], 0x7dd
call fcn.1400526c0
lea rdx, str.SoftwareMicrosoftOffice16.0OutlookProfiles
mov rcx, rbx
mov dword [rbx + 8], 0x7e0
add rsp, 0x20
pop rbx
jmp fcn.1400526c0

Function at 0x140052a00
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r9
mov rdi, rcx
xor ebx, ebx
call fcn.1400528a0
cmp eax, ebx
je 0x140052a45
mov rcx, qword [rdi]
lea rdx, str.LookupPrivilegeValueW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
je 0x140052a45
lea rdx, str.SeDebugPrivilege
mov r8, rsi
xor ecx, ecx
call rax
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140052bc0
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x70]
mov r8d, 0x28
mov rcx, rbx
mov rdx, rax
call fcn.140052b40
test eax, eax
jne 0x140052bf1
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140052c52
lea r9, [rsp + 0x44]
lea r8, str.SeDebugPrivilege
xor edx, edx
mov rcx, rbx
call fcn.140052a00
and qword [rsp + 0x30], 0
mov rdx, qword [rsp + 0x70]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
call fcn.140052980
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x140052ce8
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp qword [0x14008eaa0], 0
jne 0x140052de2
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
mov qword [0x14008eaa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008eaa0]
lea rdx, str.NtLoadDriver
mov qword [0x14008ea60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008eaa0]
lea rdx, str.NtUnloadDriver
mov qword [0x14008ea68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008eaa0]
lea rdx, str.NtOpenSymbolicLinkObject
mov qword [0x14008ea70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008eaa0]
lea rdx, str.NtQuerySymbolicLinkObject
mov qword [0x14008ea78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008eaa0]
lea rdx, str.NtQueryObject
mov qword [0x14008ea80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008eaa0]
lea rdx, str.NtSuspendProcess
mov qword [0x14008ea88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008eaa0]
lea rdx, str.NtResumeProcess
mov qword [0x14008ea90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14008ea98], rax
add rsp, 0x28
ret
Function at 0x1400535c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
mov eax, 0x1690
call fcn.1400751b0
sub rsp, rax
and word [rsp + 0x90], 0
mov rsi, rcx
mov r12d, r8d
mov r13, rdx
lea rcx, [rsp + 0x92]
mov r8d, 0x1fe
xor edx, edx
mov rdi, r9
call sub.msvcrt.dll_memset
xor ebp, ebp
xor edx, edx
jmp 0x14005379a
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x90]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140053795
lea rcx, [0x14008ad40]
mov edx, 0xb7
mov dword [rsp + 0x40], 0x1000
call fcn.140066f78
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x690]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x48]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005378a
mov eax, dword [rsp + 0x40]
lea rcx, [rsi + 0x10]
lea r9, [rsp + 0x68]
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x690]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov dword [rsp + 0x68], r12d
mov qword [rsp + 0x70], r13
call fcn.14006d694
test eax, eax
je 0x14005378a
and word [rsp + 0x290], 0
and word [rsp + 0x490], 0
lea rcx, [rsp + 0x290]
xor edx, edx
mov r8d, 0x200
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x490]
xor edx, edx
mov r8d, 0x200
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x290]
mov r8d, 0xff
call fcn.140062b74
cmp dword [rsp + 0x50], 0x1fe
jae 0x14005376f
mov ebx, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x490]
mov r8, rbx
call sub.msvcrt.dll_memcpy
shr rbx, 1
and word [rsp + rbx*2 + 0x490], 0
mov rax, qword [rsi]
lea rdx, [rsp + 0x290]
mov rcx, rsi
call qword [rax]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebp, 1
mov edx, ebp
mov rcx, qword [rdi]
lea r8, [rsp + 0x90]
mov r9d, 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov rcx, qword [rdi]
test eax, eax
je 0x140053614
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x1690]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140053980
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x580
mov rsi, rcx
mov rbp, rdx
lea rcx, [0x14008ad40]
mov edx, 0xab
xor ebx, ebx
mov dword [rax + 0x18], 0x400
call fcn.140066f78
lea rcx, [rsp + 0x5b0]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x180]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x140053b71
cmp dword [rsp + 0x5b0], 1
jbe 0x140053b71
cmp byte [rsp + 0x180], 0x20
mov edi, ebx
jae 0x140053aab
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x58], ebx
call fcn.14006d614
cmp eax, ebx
je 0x140053a9f
mov eax, dword [rsp + 0x5b0]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
add eax, 0xfffffffe
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x182]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.14006d694
cmp eax, ebx
je 0x140053a9f
cmp dword [rsp + 0x40], 0x400
jae 0x140053a94
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x180]
call sub.msvcrt.dll_memcpy
lea edi, [rbx + 1]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rsp + 0x50]
call fcn.14006d5b4
jmp 0x140053ab0
mov edi, 1
cmp edi, ebx
je 0x140053b71
mov edi, 0xff
lea rcx, [rsp + 0x81]
xor edx, edx
mov r8, rdi
mov byte [rsp + 0x57f], bl
mov byte [rsp + 0x80], bl
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x180]
mov r8d, edi
call fcn.140071108
lea rdx, [rsi + 0x200]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x80]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [rdi - 0x53]
lea rcx, [0x14008ad40]
mov dword [rsp + 0x5b8], 0x1fe
call fcn.140066f78
lea rcx, [rsp + 0x5b8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x140053b71
mov word [rsi + 0x1fc], bx
mov word [rsi + 0x3fc], bx
mov ebx, 1
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x5a0]
add rsp, 0x580
pop rdi
pop rsi
pop rbp
ret
Function at 0x140053ba0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x990
lea rcx, [rsp + 0x48]
mov rsi, r9
mov rdx, r8
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x140053da7
mov rdx, qword [rsp + 0x9c0]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x190]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x140053d9c
cmp dword [rsp + 0x40], 1
jbe 0x140053d9c
cmp byte [rsp + 0x190], 0x20
mov edi, ebx
jae 0x140053d9c
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x68], ebx
call fcn.14006d614
cmp eax, ebx
je 0x140053cd8
mov eax, dword [rsp + 0x40]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
add eax, 0xfffffffe
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x192]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.14006d694
cmp eax, ebx
je 0x140053cd8
cmp dword [rsp + 0x50], 0x800
jae 0x140053ccd
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x190]
call sub.msvcrt.dll_memcpy
lea edi, [rbx + 1]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rsp + 0x60]
call fcn.14006d5b4
cmp edi, ebx
je 0x140053d9c
lea rcx, [rsp + 0x91]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x98f], bl
mov byte [rsp + 0x90], bl
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x190]
mov r8d, 0xff
call fcn.140071108
mov rdi, qword [rsp + 0x9c8]
lea r8, [rsp + 0x90]
lea rax, [rdi + 0x200]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0xff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x44], 0x1fe
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x140053d9c
mov word [rdi + 0x1fc], bx
mov word [rdi + 0x3fc], bx
mov ebx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x990]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140053dd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
push r12
mov eax, 0x1080
call fcn.1400751b0
sub rsp, rax
mov rdi, rcx
lea rcx, [0x14008ad40]
mov edx, 0xba
call fcn.140066f78
lea rdx, [rsp + 0x10b8]
mov r9d, 0x20019
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140053fcb
lea rcx, [0x14008ad40]
mov edx, 0xbb
call fcn.140066f78
lea rcx, [rsp + 0x40]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x10b8]
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140053fbd
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x10a8]
lea r9, [rsp + 0x10b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rdx, str.Value
xor r8d, r8d
mov dword [rsp + 0x10a8], 0x1000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140053fb2
cmp qword [rdi + 0x10], 0
jne 0x140053ec3
lea rcx, [rdi + 0x10]
call fcn.14006d614
test eax, eax
je 0x140053fb2
mov eax, dword [rsp + 0x10a8]
lea r12, str._GKP__LL___OTR__GV6_lxzd
lea r9, [rsp + 0x60]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x80]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x48]
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r8d, r8d
mov dword [rsp + 0x60], 0x40
mov qword [rsp + 0x68], r12
call fcn.14006d694
test eax, eax
je 0x140053fb2
mov ebx, dword [rsp + 0x48]
cmp ebx, 0x400
jae 0x140053fa7
lea rcx, [rsp + 0x80]
mov rdx, r12
mov r8d, 0x40
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0xc0]
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x10b8]
lea rax, [rsp + 0x58]
lea rdx, str.Creds
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140053fa7
lea r9, [rsp + 0x58]
lea r8d, [rbx + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.1400535c0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x10b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x1080
pop r12
pop rdi
pop rbx
ret
Function at 0x1400541c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xc90
mov rbp, r8
mov rbx, rdx
mov r13d, 0x208
lea rcx, [rax - 0xa76]
xor r12d, r12d
xor edx, edx
mov r8, r13
mov word [rax - 0xa78], r12w
call sub.msvcrt.dll_memset
or r14, 0xffffffffffffffff
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
add rcx, 0xc
cmp rcx, 0x1ff
jae 0x140054242
lea r8, [rsp + 0x240]
lea rdx, str.profiles.ini
mov rcx, rbx
call fcn.1400639e4
jmp 0x14005424b
mov word [rsp + 0x240], r12w
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140054432
lea rax, [0x1400790f0]
lea r8, [rsp + 0x240]
lea rcx, [rsp + 0x860]
xor r9d, r9d
xor edx, edx
mov esi, r12d
mov qword [rsp + 0x860], rax
mov word [rsp + 0x870], r12w
mov word [rsp + 0xa7a], r12w
call fcn.14004f79c
lea rcx, [rsp + 0x662]
xor edx, edx
mov r8d, 0x1fe
mov word [rsp + 0x660], r12w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x32]
mov r8, r13
xor edx, edx
mov word [rsp + 0x30], r12w
call sub.msvcrt.dll_memset
lea r8, str.Profile_d
lea rcx, [rsp + 0x660]
mov r9d, esi
mov edx, 0xff
mov dword [rsp + 0xcd8], r12d
call sub.msvcrt.dll__snwprintf
mov rdx, r12
movzx eax, word [rsp + rdx + 0x660]
add rdx, 2
cmp ax, r12w
mov word [rsp + rdx + 0xa78], ax
jne 0x1400542fa
lea r9, [0x140076a00]
lea r8, [rsp + 0x30]
lea rdx, str.Path
lea rcx, [rsp + 0x860]
mov dword [rsp + 0x20], 0x104
call fcn.14004fe1c
mov rax, qword [rsp + 0x860]
lea r8, [rsp + 0xcd8]
lea rdx, str.IsRelative
lea rcx, [rsp + 0x860]
xor r9d, r9d
call qword [rax + InitCommonControls]
cmp word [rsp + 0x30], r12w
je 0x140054432
lea rax, [rsp + 0x30]
cmp word [rax], 0x2f
jne 0x14005437d
mov word [rax], 0x5c
add rax, 2
cmp word [rax], r12w
jne 0x140054372
lea rcx, [rsp + 0x452]
mov r8, r13
xor edx, edx
mov word [rsp + 0x450], r12w
call sub.msvcrt.dll_memset
cmp dword [rsp + 0xcd8], r12d
je 0x1400543fa
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x30]
not rcx
lea rdx, [rcx - 1]
mov rcx, r14
repne scasw ax, word [rdi]
not rcx
lea rax, [rdx + rcx]
cmp rax, 0x1ff
jae 0x1400543ef
lea r8, [rsp + 0x450]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400639e4
jmp 0x140054414
mov word [rsp + 0x450], r12w
jmp 0x140054414
mov rcx, r12
movzx eax, word [rsp + rcx + 0x30]
add rcx, 2
cmp ax, r12w
mov word [rsp + rcx + 0x44e], ax
jne 0x1400543fd
lea rdx, [rsp + 0x450]
mov r8d, 1
mov rcx, rbp
call fcn.140061748
add esi, 1
jmp 0x1400542a0
lea r11, [rsp + 0xc90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400553f4
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x6d8]
mov rbx, rcx
mov rcx, qword [rcx + 0xf18]
mov edx, dword [rax + 0x14]
neg edx
sbb edx, edx
and edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call fcn.1400551f4
mov r11, qword [rbx + 0x6d8]
cmp dword [r11 + 0x14], 0
je 0x14005543d
lea rcx, [rbx + 0xf00]
call fcn.140069188
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x6d8]
mov rbx, rcx
xor dword [rax + 0x14], 1
call fcn.140056394
xor edx, edx
mov rcx, rbx
call fcn.140055904
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400553f4
Function at 0x1400582d4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x2040
call fcn.1400751b0
sub rsp, rax
mov rbx, rcx
mov rdi, rdx
lea r8d, [rax - 0x41]
lea rcx, [rsp + 0x41]
xor edx, edx
mov byte [rsp + 0x40], 0
call sub.msvcrt.dll_memset
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x1fff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
lea r9, [rsp + 0x2060]
and qword [rsp + 0x20], rax
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x40]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x2050]
add rsp, 0x2040
pop rdi
ret

Function at 0x140058384
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x8040
call fcn.1400751b0
sub rsp, rax
mov rbx, rcx
mov rdi, rdx
lea r8d, [rax - 0x41]
lea rcx, [rsp + 0x41]
xor edx, edx
mov byte [rsp + 0x40], 0
call sub.msvcrt.dll_memset
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0x7fff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
lea r9, [rsp + 0x8060]
and qword [rsp + 0x20], rax
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x40]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x8050]
add rsp, 0x8040
pop rdi
ret
Function at 0x14005bb24
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r12d, r8d
mov rbp, rdx
mov r13, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [r13 + 0x328]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov r14d, eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
test eax, eax
mov rsi, rax
jle 0x14005bbe4
test r12d, r12d
je 0x14005bb9a
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
cmp edi, edx
jne 0x14005bb9a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r14d
cmp eax, 0x1f4
ja 0x14005bbe4
mov eax, dword [rbp + 0x18]
lea ebx, [rdi + rax]
cmp ebx, esi
jl 0x14005bbac
test byte [rbp + 0x20], 0x20
je 0x14005bbe4
sub ebx, esi
and qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
mov r8d, ebx
mov rcx, r13
call fcn.14005a2b4
test eax, eax
je 0x14005bbdd
mov rdx, qword [rsp + 0x50]
mov r9d, r12d
mov r8, rbp
mov rcx, r13
call fcn.140058d94
test eax, eax
jne 0x14005bbfe
add edi, 1
cmp edi, esi
jl 0x14005bb6d
or eax, 0xffffffff
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, ebx
jmp 0x14005bbe7