joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021ee0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x960
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x950], rax
mov rbx, rcx
lea rcx, [rsp + 0x550]
xor edx, edx
mov r8d, 0x400
call fcn.140080d50
lea rcx, [rsp + 0x150]
xor edx, edx
mov r8d, 0x400
call fcn.140080d50
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x104
call fcn.140080d50
lea rdx, [0x1400a4510]
lea rcx, [rsp + 0x550]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x1400a4510]
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x550]
mov r8d, 1
mov dword [rsp + 0x20], 0x104
mov dword [rsp + 0x30], 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryW
mov rcx, rbx
cmp eax, 1
jne 0x140021fb3
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140021fbe
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rcx, qword [rsp + 0x950]
xor rcx, rsp
call fcn.140081050
add rsp, 0x960
pop rbx
ret

Function at 0x1400222b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x480
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x470], rax
lea rax, [rsp + 0x40]
xor ebp, ebp
mov r9d, 0xf013f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edi, ebp
lea esi, [rbp + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400223b5
mov qword [rsp + 0x4b0], rbx
nop
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x410
mov dword [rsp + 0x48], 0x208
call fcn.140080d50
mov rcx, qword [rsp + 0x40]
lea r11, [rsp + 0x50]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rbp
mov edx, edi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add edi, esi
test eax, eax
je 0x14002235b
cmp eax, 0x103
je 0x14002239c
mov ebx, ebp
jmp 0x140022392
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
call fcn.1400222b0
cmp eax, esi
mov ebx, eax
jne 0x14002239e
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x140022390
cmp eax, 2
je 0x140022390
mov ebx, ebp
mov eax, 0x103
mov edi, ebp
test eax, eax
je 0x140022300
jmp 0x14002239e
mov ebx, esi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x4b0]
jmp 0x1400223bd
cmp eax, 2
cmovne esi, ebp
mov eax, esi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140081050
add rsp, 0x480
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400223e0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x480
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x470], rax
lea rax, [rsp + 0x48]
mov r9d, 0xf013f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edi, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140022488
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x410
mov dword [rsp + 0x40], 0x208
call fcn.140080d50
mov rcx, qword [rsp + 0x48]
xor ebx, ebx
lea r11, [rsp + 0x50]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140022479
cmp eax, 0x103
sete bl
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140022492
xor ebx, ebx
cmp eax, 2
cmovne edi, ebx
mov eax, edi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140081050
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x480
pop rdi
ret
Function at 0x140022c30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x8d0
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x8c0], rax
xor ebx, ebx
mov rbp, rcx
mov edi, ebx
mov esi, ebx
call fcn.140015a10
cmp eax, 4
jl 0x140022d78
cmp eax, 6
jle 0x140022c7e
cmp eax, 0xa
jne 0x140022d78
lea rax, [rsp + 0x48]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionDevices
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140022e38
nop
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x410
mov dword [rsp + 0x40], 0x208
call fcn.140080d50
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
mov edx, edi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add edi, 1
test eax, eax
jne 0x140022d0f
lea rdx, [rsp + 0x60]
mov rcx, rbp
lea esi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140022cb0
cmp esi, 1
jne 0x140022d68
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x470]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x50], 0x450
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, [0x1400a7ca0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x470]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140022e38
mov edx, 0x100
mov dword [rsp + 0x40], edx
mov eax, edx
add eax, 2
cmp eax, edx
jb 0x140022dea
add edx, 0x100
test rbx, rbx
mov dword [rsp + 0x40], edx
je 0x140022da6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [rsp + 0x40]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x140022de6
mov eax, dword [rsp + 0x40]
lea r8, [0x1400a4510]
lea rcx, str.Devices
shr eax, 1
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
test eax, eax
je 0x140022dea
mov edx, dword [rsp + 0x40]
jmp 0x140022d83
xor eax, eax
jmp 0x140022e3a
mov rcx, rbx
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x140022e2a
mov esi, 1
nop
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, esi
cdqe
lea rdi, [rdi + rax*2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x140022e00
test rbx, rbx
je 0x140022e38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
mov rcx, qword [rsp + 0x8c0]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0x8d0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140023990
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x20]
cmp eax, 6
je 0x1400239c2
add eax, 0xfffffff7
cmp eax, 1
ja 0x1400239bb
mov eax, 2
add rsp, 0x58
ret
xor eax, eax
add rsp, 0x58
ret
mov eax, 1
add rsp, 0x58
ret
Function at 0x1400240b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x30]
mov rbx, r9
mov rdi, r8
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002411d
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140024250
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
lea rbx, [0x1400e8f20]
xor edx, edx
mov r8d, 0x20a
mov rcx, rbx
mov dword [rsp + 0x40], 0x20a
call fcn.140080d50
lea rdx, [rsp + 0x40]
lea r8, str.Common_Startup
mov qword [rsp + 0x28], rdx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
xor r9d, r9d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rbx
call fcn.1400240b0
test eax, eax
je 0x1400242bb
xor edx, edx
mov r8d, 0x20a
mov rcx, rbx
call fcn.140080d50
jmp 0x1400242d0
lea rcx, [0x1400e8b10]
mov rdx, rbx
mov r8d, 0x105
call fcn.1400846a0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
cmovne rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140024300
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x8b0
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x8a0], rax
mov rsi, rcx
lea rcx, [rsp + 0x692]
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x690], bx
call fcn.140080d50
lea rcx, [rsp + 0x482]
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x480], bx
call fcn.140080d50
lea rcx, [rsp + 0x272]
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x270], bx
call fcn.140080d50
test rsi, rsi
je 0x140024519
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x8d0], rdi
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x1400244f0
mov qword [rsp + 0x8c8], rbp
call fcn.140024250
test rax, rax
mov rbp, rax
je 0x1400244e6
lea rdx, [rsp + 0x690]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1400244e6
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1400244e6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rdx, [rsp + 0x20]
lea rcx, str..lnk
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x1400244d2
nop
nop
nop
nop
lea rcx, [rsp + 0x270]
mov r8, rbp
mov edx, 0x105
call fcn.140081cd0
lea r8, [0x1400a3ff4]
lea rcx, [rsp + 0x270]
mov edx, 0x105
call fcn.140082370
lea r8, [rsp + 0x4c]
lea rcx, [rsp + 0x270]
mov edx, 0x105
call fcn.140082370
lea r8, [rsp + 0x480]
lea rdx, [rsp + 0x270]
xor ecx, ecx
call fcn.140024130
test eax, eax
js 0x1400244a7
lea rcx, [rsp + 0x480]
mov rdx, rsi
call fcn.1400807e0
test eax, eax
jne 0x1400244a7
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x1400244bf
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140024420
jmp 0x1400244c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
neg ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rsp + 0x690]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rbp, qword [rsp + 0x8c8]
mov eax, ebx
mov rdi, qword [rsp + 0x8d0]
mov rcx, qword [rsp + 0x8a0]
xor rcx, rsp
call fcn.140081050
mov rbx, qword [rsp + 0x8d8]
add rsp, 0x8b0
pop rsi
ret
mov eax, ebx
jmp 0x1400244f8
Function at 0x140024f00
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb00
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0xaf0], rax
mov r14, rdx
mov r13, rcx
call fcn.140069504
mov rcx, qword [rax + 8]
call fcn.14007442c
nop
xor edi, edi
call fcn.140069504
mov r12, qword [rax + 8]
test r13, r13
jne 0x140024f6b
lea rcx, [rsp + 0x50]
call fcn.140018910
xor eax, eax
jmp 0x1400251bb
mov word [rsp + 0x4c0], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x4c2]
call fcn.140080d50
mov word [rsp + 0x2b0], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2b2]
call fcn.140080d50
mov word [rsp + 0x8e0], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x8e2]
call fcn.140080d50
mov ebx, 1
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0x104
lea r9, [rsp + 0x2b0]
mov r8d, 0x104
lea rdx, [rsp + 0x4c0]
mov rcx, r13
call fcn.140082440
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r11, [rsp + 0x2b0]
mov qword [rsp + 0x28], r11
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x20], rax
lea r9, str._s_s
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rsp + 0x8e0]
call fcn.140083fd0
mov word [rsp + 0x6d0], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x6d2]
call fcn.140080d50
mov ebp, edi
mov eax, dword [r12 + 0x760]
add eax, ebx
je 0x140025196
nop
nop
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x8e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14002517b
mov ebx, 1
nop
nop
nop
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400a3e50]
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rsp + 0x6d0]
call fcn.140083fd0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
lea rcx, [rsp + 0x6d0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140025139
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
cmove ebx, edi
jmp 0x140025142
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400250c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp ebx, 1
je 0x140025196
cmp ebp, dword [r12 + 0x760]
jae 0x14002517b
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebp, 1
mov eax, dword [r12 + 0x760]
add eax, 1
cmp ebp, eax
jb 0x140025090
cmp ebx, 1
jne 0x1400251af
lea rcx, [r12 + 0xb90]
mov r8, r14
mov rdx, r13
call fcn.140060a30
test eax, eax
sete dil
lea rcx, [rsp + 0x50]
call fcn.140018910
mov eax, edi
mov rcx, qword [rsp + 0xaf0]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0xb00]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400344b0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x680
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rdi, rcx
call fcn.140015a10
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x208
mov ebx, eax
call fcn.140080d50
lea rcx, [rsp + 0x250]
xor edx, edx
mov r8d, 0x208
call fcn.140080d50
lea rcx, [rsp + 0x460]
xor edx, edx
mov r8d, 0x208
call fcn.140080d50
test rdi, rdi
jne 0x140034521
xor eax, eax
jmp 0x1400346da
cmp ebx, 6
je 0x14003454d
cmp ebx, 0xa
je 0x14003454d
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionICMmntr
lea rcx, [rsp + 0x250]
mov edx, 0x104
call fcn.140081cd0
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionICMprtr
jmp 0x14003456d
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionICMmntr
lea rcx, [rsp + 0x250]
mov edx, 0x104
call fcn.140081cd0
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionICMprtr
lea rcx, [rsp + 0x460]
mov edx, 0x104
call fcn.140081cd0
cmp ebx, 3
je 0x1400345b3
cmp ebx, 6
je 0x1400345b3
cmp ebx, 0xa
je 0x1400345b3
lea rdx, [rsp + 0x250]
mov rcx, rdi
call fcn.1400323c0
lea rdx, [rsp + 0x460]
mov rcx, rdi
call fcn.1400323c0
jmp 0x1400346d5
lea rcx, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x40]
mov dx, 0x5c
call fcn.140080890
test rax, rax
je 0x1400345e3
lea rdx, [rax + 2]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp ebx, 6
je 0x1400345f3
cmp ebx, 0xa
je 0x1400345f3
mov eax, dword [rsp + 0x30]
jmp 0x14003461b
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x250]
mov r9d, 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
test eax, eax
jne 0x140034655
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140034655
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp ebx, 6
je 0x14003465f
cmp ebx, 0xa
jne 0x140034687
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x460]
mov r9d, 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400346bf
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400346bf
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.140081050
mov rbx, qword [rsp + 0x698]
add rsp, 0x680
pop rdi
ret
Function at 0x140034700
Capabilities:
Delete file
Get common file path

Disassembly:
push rbx
push rbp
push rsi
mov eax, 0x1490
call fcn.1400a28a0
sub rsp, rax
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov rsi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x230]
xor edx, edx
mov r8d, 0x208
call fcn.140080d50
lea rcx, [rsp + 0x230]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str.SpoolDriversCOLOR
lea rcx, [rsp + 0x230]
mov edx, 0x104
call fcn.140082370
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x208
call fcn.140080d50
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str.SpoolDriversW32X86
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.140082370
lea rcx, str.MSCMS.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rbp, rax
je 0x1400348b0
lea rdx, str.UninstallColorProfileW
mov rcx, rax
mov qword [rsp + 0x14c0], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rdi, rax
je 0x14003489f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x14003489f
lea r8, [rsp + 0x230]
lea rdx, [0x1400a3e08]
lea rcx, [rsp + 0x440]
mov r9, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x20]
lea rdx, [0x1400a3e08]
lea rcx, [rsp + 0xc60]
mov r9, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, rbx
mov rcx, rsi
call fcn.140022e70
test eax, eax
je 0x14003487b
lea rcx, [rsp + 0x440]
call fcn.1400344b0
lea rdx, [rsp + 0x440]
mov r8d, 1
xor ecx, ecx
call rdi
test eax, eax
jne 0x14003487b
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0xc60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1400347f0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x14c0]
mov eax, 1
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140081050
add rsp, 0x1490
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400415b0
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x140041621
mov r8, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
mov rbx, rax
je 0x1400415e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400415f8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp eax, 5
jne 0x140041615
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x20]
mov eax, 2
add rsp, 0x28
ret
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140041790
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test rdx, rdx
mov rdi, rdx
mov rbx, rcx
jne 0x1400417e4
mov rdi, qword [rcx + 0xbd8]
test rdi, rdi
je 0x1400417d7
call fcn.140069504
mov qword [rax + 0x18], rdi
mov rcx, qword [rbx + 0xbe0]
test rcx, rcx
je 0x1400417d7
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0xbe0], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + 0xbe0]
test rcx, rcx
je 0x140041801
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0xbe0], 0
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140041861
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rbx + 0xbe0], rax
je 0x140041851
call fcn.140069504
mov rcx, qword [rax + 0x10]
mov qword [rbx + 0xbd8], rcx
mov rbx, qword [rbx + 0xbe0]
call fcn.140069504
mov qword [rax + 0x18], rbx
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0x21
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0x20
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140041aa0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x670
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x660], rax
test r8, r8
mov r12d, r9d
mov rbp, r8
mov rdi, rdx
mov esi, 1
je 0x140041b8e
test rdx, rdx
je 0x140041b8e
xor ebx, ebx
lea rdx, [rsp + 0x30]
cmp dword [rcx + 0xb78], ebx
je 0x140041afc
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x140041b55
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8, [rsp + 0x240]
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
call fcn.140085910
lea r9, [rsp + 0x240]
lea r8, [rsp + 0x450]
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.140084320
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rax, [rsp + 0x30]
lea r9, [0x1400a3e50]
mov rdx, r12
or r8, 0xffffffffffffffff
mov rcx, rbp
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140083fd0
test eax, eax
cmovs esi, ebx
mov eax, esi
jmp 0x140041b92
xor ebx, ebx
mov eax, ebx
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.140081050
add rsp, 0x670
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004b590
Capabilities:
Check if file exists
Delete directory

Disassembly:
sub rsp, 0x28
call fcn.140069504
mov rcx, qword [rax + 8]
cmp dword [rcx + 0xbd4], 0
je 0x14004b5af
add rsp, 0x28
jmp fcn.140018450
mov eax, 1
add rsp, 0x28
ret

Function at 0x14004bdf0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x480
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rsi, rcx
mov r10, r8
mov rax, rdx
lea rcx, [rsp + 0x40]
xor ebp, ebp
mov r9d, 0xf003f
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, r10
mov rcx, rax
mov edi, ebp
lea ebx, [rbp + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004bf1a
nop
nop
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x410
mov dword [rsp + 0x48], 0x208
call fcn.140080d50
mov rcx, qword [rsp + 0x40]
lea r11, [rsp + 0x50]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rbp
mov edx, edi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add edi, 1
test eax, eax
je 0x14004beac
cmp eax, 0x103
je 0x14004bf08
mov ebx, ebp
jmp 0x14004bef3
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.14004b410
test eax, eax
jne 0x14004be50
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
call fcn.1400222b0
cmp eax, 1
jne 0x14004bf0d
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14004bef1
cmp eax, 2
je 0x14004bef1
mov ebx, ebp
mov eax, 0x103
mov edi, ebp
test eax, eax
je 0x14004be50
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004bf20
mov ebx, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004bf20
cmp eax, 2
cmovne ebx, ebp
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140081050
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x480
pop rdi
pop rsi
pop rbp
ret