joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006bc0
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x20738
call fcn.14001a1c0
sub rsp, rax
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x20720], rax
cmp qword [rsp + 0x20750], 0
je 0x140006e11
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x20750]
movzx eax, word [rcx + rax]
test eax, eax
je 0x140006e11
mov dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20750]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140006e0f
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x60]
call fcn.140006a40
lea rcx, [rsp + 0x60]
call fcn.140008190
movzx eax, al
test eax, eax
je 0x140006dfa
mov dword [rsp + 0x20], 0
jmp 0x140006c90
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x20], eax
jge 0x140006d9d
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140006d98
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + rax*8]
lea rcx, [rsp + 0x60]
call fcn.140008280
movzx eax, al
test eax, eax
je 0x140006d98
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + rax*8]
lea rcx, [rsp + 0x106f0]
call fcn.140004360
lea rcx, [rsp + 0x48]
call fcn.1400055a0
lea rcx, [rsp + 0x60]
call fcn.140006a90
movzx eax, al
test eax, eax
jne 0x140006d57
lea rdx, [rsp + 0x6e0]
lea rcx, [rsp + 0x106f0]
call fcn.140004550
movzx eax, al
test eax, eax
je 0x140006d57
lea rdx, [rsp + 0x6e0]
lea rcx, [rsp + 0x48]
call fcn.140006ac0
jmp 0x140006d16
lea rcx, [rsp + 0x48]
call fcn.140006aa0
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x48]
call fcn.140006ab0
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x106f0]
call fcn.140004520
jmp 0x140006c86
lea rcx, [rsp + 0x60]
call fcn.1400081f0
cmp qword [rsp + 0x38], 0
jbe 0x140006dfa
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
lea rdx, str.Suceeded_:__d_r_nFailed_:__d
lea rcx, [rsp + 0xa0]
call fcn.1400059b0
mov rcx, rax
call fcn.140006e90
mov r9d, 0x30
lea r8, [0x1400233e8]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0xa0]
call fcn.140005a60
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rsp + 0x60]
call fcn.140006e60
jmp 0x140006e38
lea rcx, [rsp + 0xc0]
call fcn.140007030
lea rcx, [rsp + 0xc0]
call fcn.1400071e0
lea rcx, [rsp + 0xc0]
call fcn.1400071c0
xor eax, eax
mov rcx, qword [rsp + 0x20720]
xor rcx, rsp
call fcn.140009590
add rsp, 0x20738
ret
Function at 0x140007030
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x460
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rax, qword [rsp + 0x470]
mov rdi, qword [rsp + 0x470]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x470]
add rax, 0x208
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x470]
add rax, 0x410
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rax, [rsp + 0x240]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor r9d, r9d
mov r8d, 0x1a
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rax, qword [rsp + 0x470]
add rax, 0x410
lea r8, str.MicrosoftWindowsSendTo
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov rax, qword [rsp + 0x470]
add rax, 0x410
mov rcx, qword [rsp + 0x470]
add rcx, 0x410
lea r8, str.JustDelete.lnk
mov rdx, rax
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov rax, qword [rsp + 0x470]
lea r8, [0x140023798]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov rax, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x470]
add rcx, 0x208
mov r8, qword [rsp + 0x20]
mov rdx, rax
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov rax, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140009590
add rsp, 0x460
pop rdi
ret

Function at 0x140007610
Capabilities:
Copy file
Create directory

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x250
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsp + 0x260]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140007677
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400076a4
mov rax, qword [rsp + 0x260]
add rax, 0x208
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400076a4
mov dword [rsp + 0x20], 1
jmp 0x1400076ac
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140009590
add rsp, 0x250
pop rdi
ret
Function at 0x1400076d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x12
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x50], rax
mov r8d, 0x10
mov edx, 1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140007838
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x3c], eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x60], rax
cmp dword [rsp + 0x3c], 0
jbe 0x140007838
cmp qword [rsp + 0x60], 0
je 0x140007838
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x58]
lea rdx, [0x1400233e4]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140007838
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 8]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and rax, 0xffff
movzx eax, ax
mov ecx, dword [rsp + 0x30]
shr rcx, 0x10
and rcx, 0xffff
movzx ecx, cx
mov edx, dword [rsp + 0x34]
and rdx, 0xffff
movzx edx, dx
mov edi, dword [rsp + 0x34]
shr rdi, 0x10
and rdi, 0xffff
movzx edi, di
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r9d, edx
mov r8d, edi
lea rdx, str._u._u._u._u
lea rcx, [rsp + 0x70]
call fcn.140007d70
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xa8]
call fcn.140007b50
mov eax, dword [rsp + 0x38]
or eax, 1
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140009590
add rsp, 0x90
pop rdi
ret

Function at 0x140007a90
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x250
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov byte [rsp + 0x20], 0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x260]
call fcn.140007db0
movzx eax, al
test eax, eax
je 0x140007b2d
mov r8d, 4
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140007b1c
mov rax, qword [rsp + 0x260]
mov r8d, 4
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140007b1c
mov dword [rsp + 0x24], 1
jmp 0x140007b24
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140009590
add rsp, 0x250
pop rdi
ret
Function at 0x140007db0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x90]
add rax, 0x208
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call fcn.140008030
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x12
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0
jmp 0x140007e14
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x7fffffff
jge 0x140007e69
mov r8d, 0x10
lea rdx, [rsp + 0x60]
mov ecx, dword [rsp + 0x20]
call fcn.140008060
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140007e67
jmp 0x140007e69
jmp 0x140007e0a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 4
mov rax, qword [rsp + 0x90]
add rax, 0x208
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov eax, 0x414
mov word [rsp + 0x48], ax
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x28]
call qword [0x14001b310]
test eax, eax
jne 0x140007ed7
mov dword [rsp + 0x24], 1
jmp 0x140007edf
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140009590
add rsp, 0x80
pop rdi
ret

Function at 0x1400087b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov byte [rsp + 0x30], 0
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x18], 0
jne 0x14000885f
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x28], rcx
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x50]
add rax, 0x20
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x31]
call fcn.140008900
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x18], 0
je 0x14000884e
mov dword [rsp + 0x34], 1
jmp 0x140008856
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x1400089d0
Capabilities:
Check if file exists

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x290
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov byte [rsp + 0x20], 0
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140008bf0
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x140008bf0
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140008bf0
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x140008bf0
lea rcx, [rsp + 0x28]
call fcn.1400086d0
nop
mov r9d, 0x17
xor r8d, r8d
lea rdx, [0x14001b4c0]
lea rcx, [rsp + 0x28]
call fcn.140008d10
test eax, eax
jl 0x140008be6
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x2a8]
lea rcx, [rsp + 0x70]
call fcn.140008030
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x28]
call fcn.140006aa0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0xa0]
test eax, eax
jl 0x140008be6
lea rcx, [rsp + 0x28]
call fcn.140006aa0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov r8d, dword [rsp + 0x2b8]
mov rdx, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x48]
call qword [rax + 0x88]
test eax, eax
jl 0x140008be6
lea rcx, [rsp + 0x28]
call fcn.140006aa0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x48]
test eax, eax
jl 0x140008be6
lea rcx, [rsp + 0x28]
call fcn.140006aa0
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140008cb0
nop
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140008660
movzx eax, al
test eax, eax
je 0x140008bdb
lea rcx, [rsp + 0x38]
call fcn.140006aa0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov qword [rsp + 0x60], rcx
mov r8d, 1
mov rdx, rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x60]
call qword [rax + 0x30]
test eax, eax
jl 0x140008bca
mov dword [rsp + 0x30], 1
jmp 0x140008bd2
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x38]
call fcn.140008c10
nop
lea rcx, [rsp + 0x28]
call fcn.140008640
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140009590
add rsp, 0x290
pop rdi
ret

Function at 0x140008c30
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140008c55
mov dword [rsp + 0x20], 1
jmp 0x140008c5d
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140008c70
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140008c95
mov dword [rsp + 0x20], 1
jmp 0x140008c9d
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140008f30
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x50]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008fb2
cmp qword [rsp + 0x38], 0
je 0x140008fb2
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
jne 0x140008f96
mov dword [rsp + 0x34], 1
jmp 0x140008f9e
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x30], al
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x140009030
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x270
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov byte [rsp + 0x30], 0
cmp qword [rsp + 0x288], 0
je 0x14000913f
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x280]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000913f
cmp qword [rsp + 0x38], 0
je 0x14000913f
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0x208
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.UninstallString
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140009134
mov rdx, qword [rsp + 0x288]
lea rcx, [rsp + 0x50]
call fcn.14000ef90
test eax, eax
jne 0x140009123
mov dword [rsp + 0x34], 1
jmp 0x14000912b
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x30], al
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140009590
add rsp, 0x270
pop rdi
ret
Function at 0x140009160
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
cmp word [rax + rcx*2], 0
jne 0x14000918b
mov rax, qword [rsp + 0x38]
lea rax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400091e0
mov dword [rsp + 0x30], 1
jmp 0x1400091e8
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
add rsp, 0x58
ret

Function at 0x140009200
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140009251
mov dword [rsp + 0x30], 1
jmp 0x140009259
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x14000fda0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000fb04
Function at 0x14012fef8
Capabilities:
Execute anti-debugging instructions

Disassembly:
jp 0x14016e6bc
not bl
ror di, 0xb
dec bl
sub edi, edi
jbe 0x140148757
pop rcx
lea r14, [r13 + r9*8 - 0x5756847f]
jmp 0x140135226
not r9w
pop r9
lea rdi, [r8 + r13*8 - 0x6570f745]
push rdi
movzx eax, word [rsp + r8*2 - 0x16e]
mov r14, qword [rsp + r8 - 0xaf]
push r13
jmp 0x14014bed4
not bl
or dil, 0x3b
sbb dil, dil
call fcn.1401606d5
mov ecx, 0xdb11f8a7
shl cx, cl
and cx, cx
mov rcx, qword [rsi]
mov eax, 0xa59d8687
lea rax, [rax*2 - 0x63503a4c]
shl rax, 0xb6
add ax, word ss:[rcx + riz]
add rsi, 6
call fcn.140144d71
mov rsi, qword [rsp + r8 - 0x9f]
push r8
xchg r8b, al
mov r13, qword [rsp + r8*2 - 0x16c]
mov rdi, qword [rsp + r8 - 0x9a]
call fcn.140159acd
xor bl, r10b
rol bl, 1
call fcn.14016c2d9
jmp 0x140162b8b

Function at 0x1401343bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0xe3b92c26
inc rax
rdtsc
jge 0x140165387
push 0xffffffffebb28d25
lea rsp, [rsp + 0x18]
jmp fcn.1401368e9
mov dword [r10], edx
lea rsp, [rsp + 0x10]
jmp fcn.14015e774
sub r10, 8
push 0xffffffffa9aa2598
mov dword [r10 + 4], eax
jmp 0x140142686

Function at 0x1401545b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.140155ffc
mov qword [rsp], 0x20918f25
mov rax, qword [rbp + rbx*8]
cmp ebx, 1
lea rsp, [rsp + 8]
jne 0x14014c517
call fcn.140160f1e
movzx ecx, word [r9]
mov edx, 0x4f31ee18
sub edx, 0x4a958dad
lea r9, [r9 + rdx - 0x49c6069]
adc dl, dl
shl edx, 0xcc
sar dl, 0x81
xor cx, bp
sar edx, 0x29
inc rdx
call fcn.14014074a
mov edx, 0x6927c8ac
movsx eax, dx
rdtsc
jmp 0x14013ba3a

Function at 0x14015e95c
Capabilities:
Encode data using xor

Disassembly:
mov r11, qword [rsp + 0x10]
lea rsp, [rsp + 0x18]
not esi
mov dword [r11], esi
jmp fcn.14014b233
adc r11, 0xc
xor esi, esi
test rdx, rdx
lea rsp, [rsp + 8]
je 0x14013680f
push r11
mov r11d, 0xef3f361c
shr r11, 0xd
jnp 0x14013a8e0
push r9
lea r11, [0x140165d18]
push 0x320d1a14
movzx r9d, byte [rax]
not dword [rsp + 2]
xor r9d, esi
sar qword [rsp], 0xc9
and r9d, 0xff
mov r9d, dword [r11 + r9*4]
shr esi, 8
shr word [rsp + 6], 0x69
xor esi, r9d
inc rax
xor esi, 0xc1970409
dec rdx
lea rsp, [rsp + 8]
jne 0x14015e98e
push 0x4a177422
mov r9, qword [rsp + 8]
jmp 0x140136805

Function at 0x140162975
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + r8 - 0x63080686], r8
mov qword [rsp + r8 - 0x63080686], r9
movzx r9d, r8b
inc r8w
lea r9, [0x14014e560]
mov r8d, 0x8b0f762f
lea r8, [r8 + r8*8 - 0x79542bf7]
movzx r8d, byte [rcx]
push 0xffffffffa1a4081e
xor r8d, eax
and r8d, 0xff
mov r8d, dword [r9 + r8*4]
shr eax, 8
xor eax, r8d
inc rcx
xor eax, 0x8014d525
dec rbx
lea rsp, [rsp + 8]
jne 0x140162994
mov r9d, 0x4685d883
pop r9
call fcn.14013addc
Function at 0x180004500
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push r13
push r14
mov eax, 0x1078
call fcn.18000dda0
sub rsp, rax
mov rax, qword [0x18001f040]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rbp, rdx
mov qword [rsp + 0x38], r9
mov rdx, qword [rsp + 0x10c0]
xor r14d, r14d
mov qword [rsp + 0x30], rdx
mov r13, r8
mov qword [rsp + 0x40], rcx
test r8, r8
je 0x180004582
mov r9d, 0x1000
lea rdx, [rsp + 0x50]
call fcn.1800028b0
test al, al
jne 0x18000458a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_read_module_headers
call fcn.180006480
lea rdx, [0x180006660]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r14
jmp 0x180004672
mov qword [rsp + 0x10a8], rsi
mov qword [rsp + 0x1070], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1068], r12
mov qword [rsp + 0x1060], r15
inc rdi
cmp byte [rdi + rbp], r14b
jne 0x1800045b1
movsxd rax, dword [rsp + 0x8c]
lea rcx, [rsp + 0x50]
add rcx, rax
mov esi, r14d
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r15d, word [rcx + 6]
add r12, rax
test r15d, r15d
je 0x18000462c
nop dword [rax]
nop word [rax + rax]
mov eax, esi
mov r8, rdi
mov rdx, rbp
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180004625
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r14b
jne 0x180004613
cmp rdi, rax
je 0x1800046ac
inc esi
cmp esi, r15d
jb 0x1800045f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_find_section
call fcn.180006480
lea rdx, [0x180006660]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r14
mov r12, qword [rsp + 0x1068]
mov rdi, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x10a8]
mov r15, qword [rsp + 0x1060]
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, r14d
mov qword [rsp + 0x20], rax
call fcn.180004380
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.18000cbf0
add rsp, 0x1078
pop r14
pop r13
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x18000462c
mov ecx, dword [rbx + 8]
lea rdx, [rsp + 0x50]
add rdx, rax
je 0x18000462c
test ecx, ecx
je 0x18000462c
lea rax, [rsp + 0x50]
mov r14d, ecx
sub rdx, rax
add rdx, r13
jmp 0x180004652