joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000dee0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rdx, rcx
lea rcx, str.GetDriverDest__S_n
mov rbx, r8
call fcn.1400154e0
test rdi, rdi
je 0x14000df28
test rbx, rbx
je 0x14000df28
mov edx, ebx
mov rcx, rdi
mov word [rdi], 0
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov word [rdi + rbx*2 - 2], 0
lea r8, [0x140063c50]
mov rdx, rbx
mov rcx, rdi
call fcn.140038380
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140038380

Function at 0x14000df60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rdx
movzx esi, cl
lea rdx, [0x140062e94]
test rbp, rbp
lea rcx, str.GetSystemDest__S_n
mov rdi, r9
cmovne rdx, rbp
mov rbx, r8
call fcn.1400154e0
test rbx, rbx
je 0x14000dfc8
test rdi, rdi
je 0x14000dfc8
test sil, sil
mov word [rbx], 0
mov edx, edi
mov rcx, rbx
je 0x14000dfbb
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x14000dfc1
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov word [rbx + rdi*2 - 2], 0
lea r8, [0x140063c7c]
mov rdx, rdi
mov rcx, rbx
call fcn.140038380
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140038380

Function at 0x14000e000
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, 0x2a
mov rbp, rdx
test cl, cl
mov rbx, r8
mov edx, 0x26
mov rdi, r9
cmovne edx, eax
movzx esi, cl
lea r9d, [rax - 0x29]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000e086
test sil, sil
je 0x14000e076
lea rcx, str.Failed_to_get_x86_program_files_location_n
call fcn.1400154e0
mov r9d, 1
xor r8d, r8d
lea edx, [r9 + 0x25]
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000e086
lea rcx, str.Failed_to_get_program_files_location_n
call fcn.1400154e0
xor al, al
jmp 0x14000e0a8
lea r8, [0x140063c7c]
mov rdx, rdi
mov rcx, rbx
call fcn.140038380
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.140038380
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000e0c0
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rdx
xor edx, edx
test cl, cl
setne dl
mov rbx, r8
mov rdi, r9
movzx esi, cl
add edx, 0x2b
mov r9d, 1
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000e143
test sil, sil
je 0x14000e133
lea rcx, str.Failed_to_get_x86_common_program_files_location_n
call fcn.1400154e0
mov r9d, 1
xor r8d, r8d
lea edx, [r9 + 0x2a]
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000e143
lea rcx, str.Failed_to_get_common_program_files_location_n
call fcn.1400154e0
xor al, al
jmp 0x14000e165
lea r8, [0x140063c7c]
mov rdx, rdi
mov rcx, rbx
call fcn.140038380
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.140038380
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000e180
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9d, 1
mov rbx, rdx
mov qword [rsp + 0x20], rdx
mov rdi, r8
mov rsi, rcx
lea edx, [r9 + 0x24]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000e1d4
lea rcx, str.Failed_to_get_common_program_files_location_n
call fcn.1400154e0
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea r8, [0x140063c7c]
mov rdx, rdi
mov rcx, rbx
call fcn.140038380
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.140038380
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x14000e4d0
Capabilities:
Delete registry key

Disassembly:
push rdi
sub rsp, 0x40
lea rcx, str.RemoveSystemCoreDest_here_n
call fcn.1400154e0
lea rdx, str.SoftwareMcAfee
mov rcx, 0xffffffff80000002
call fcn.140039400
test rax, rax
mov rdi, rax
je 0x14000e5eb
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
xor esi, esi
mov qword [rsp + 0x30], rsi
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14000e57e
mov qword [rsp + 0x30], rsi
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14000e57e
mov rbx, rsi
jmp 0x14000e5b5
test rbx, rbx
je 0x14000e5b5
cmp rbx, 0xffffffffffffffff
je 0x14000e5b5
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.SystemCore
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, rdi
call fcn.140039380
test rbx, rbx
mov rsi, qword [rsp + 0x60]
je 0x14000e5e6
cmp rbx, 0xffffffffffffffff
je 0x14000e5e6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400128c0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x2c0
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, rcx
mov rsi, rdx
mov r9, rdx
lea rcx, [rsp + 0x50]
lea r8, str.SYSTEMCurrentControlSetServicesEventLogSystem_s
mov edx, 0x12c
call fcn.140039220
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.140012360
lea rcx, [rsp + 0x50]
mov dl, 1
call fcn.14000e600
test eax, eax
jne 0x140012a50
lea rcx, str.RemoveServiceEventSource___removing_event_source_for__S_n
mov rdx, rsi
mov qword [rsp + 0x2e0], rdi
call fcn.1400154e0
xor edi, edi
lea rcx, str..WGUARDNT
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x1400129a9
mov qword [rsp + 0x30], rdi
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x1400129a9
mov rbx, rdi
jmp 0x1400129e0
test rbx, rbx
je 0x1400129e0
cmp rbx, 0xffffffffffffffff
je 0x1400129e0
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogSystem
mov rcx, 0xffffffff80000002
call fcn.1400393b0
test rax, rax
mov rdi, rax
je 0x140012a21
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x140012a17
lea rcx, str.RemoveServiceEventSource:_RegDeleteKey_failed_n
call fcn.1400154e0
mov rcx, rdi
call fcn.140039380
jmp 0x140012a34
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogSystem
lea rcx, str.Failed_to_open__S_n
call fcn.1400154e0
test rbx, rbx
mov rdi, qword [rsp + 0x2e0]
je 0x140012a50
cmp rbx, 0xffffffffffffffff
je 0x140012a50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14004c890
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x2c0
pop rsi
ret
Function at 0x1400251d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x30
mov rbp, rcx
xor ecx, ecx
mov rsi, rdx
test rbp, rbp
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x58], 7
je 0x1400251f5
mov qword [rbp], rcx
test rdx, rdx
je 0x1400251fc
mov dword [rdx], ecx
mov ecx, 0x20000
call fcn.14004c8b0
test rax, rax
mov rbx, rax
jne 0x14002522a
lea rcx, str.Failed_alloc_memory__size__Id__n
mov edx, 0x20000
call fcn.1400154e0
lea eax, [rbx + 8]
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
mov r8, qword [str.FilterClasses]
mov rdx, qword [str.SystemCurrentControlSetControlNetwork]
lea rcx, str.Reading_reg_val_HKLM_ls_ls_n
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x50], 0x20000
call fcn.1400154e0
mov r8, qword [str.FilterClasses]
mov rdx, qword [str.SystemCurrentControlSetControlNetwork]
lea r11, [rsp + 0x50]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x58]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
mov edi, eax
je 0x1400252ab
lea rcx, str.Failed_to_read_registry__err0x_x_n
mov edx, eax
call fcn.1400154e0
mov rcx, rbx
call fcn.14004ca6c
mov eax, edi
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
mov edx, dword [rsp + 0x58]
cmp edx, 7
je 0x1400252dc
lea rcx, str.Got_unexpected_value_type___d_n
call fcn.1400154e0
mov rcx, rbx
mov edi, 0x70c
call fcn.14004ca6c
mov eax, edi
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
test rbp, rbp
mov word [rbx + 0x1fffc], 0
mov word [rbx + 0x1fffe], 0
je 0x1400252f7
mov qword [rbp], rbx
test rsi, rsi
je 0x140025304
mov eax, dword [rsp + 0x50]
mov dword [rsi], eax
mov eax, edi
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
Function at 0x140026970
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1400269b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400269cc
movzx eax, ax
or eax, 0x80070000
jmp 0x1400269cc
lea rdx, [rsp + 0x20]
lea rcx, str._sinf
call fcn.140039300
mov qword [rbx], rax
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14004c890
add rsp, 0x240
pop rbx
ret
Function at 0x140027cf0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x3b0
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
call fcn.140036f30
xor ebx, ebx
lea rdx, str.mfehidin
lea rcx, [rsp + 0x92]
mov dword [rsp + 0x70], 0xfffffff
mov dword [rsp + 0x74], 0xdbba0
mov qword [0x14008cdb0], rax
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x7c], ebx
mov dword [rsp + 0x80], ebx
mov dword [rsp + 0x84], 1
mov dword [rsp + 0x88], ebx
mov word [rsp + 0x90], 0x3778
call fcn.140037340
mov rdx, qword [0x14008cdb0]
lea rcx, [rsp + 0x192]
call fcn.140037340
lea rdx, [rsp + 0x292]
mov ecx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rdx, [0x14006c404]
lea rcx, [rsp + 0x292]
call fcn.140037390
mov qword [rsp + 0x60], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea rax, [0x140027bf0]
lea r9, [fcn.1400480c0]
mov qword [rsp + 0x50], rax
lea rax, [0x1400279c0]
lea r8, [0x140027820]
mov qword [rsp + 0x48], rax
lea rax, [0x140027990]
lea rdx, [0x140027a70]
mov qword [rsp + 0x40], rax
lea rax, [0x140027920]
lea rcx, [0x14008cda0]
mov qword [rsp + 0x38], rax
lea rax, [0x1400278f0]
mov qword [rsp + 0x30], rax
lea rax, [0x1400278c0]
mov qword [rsp + 0x28], rax
lea rax, [0x140027830]
mov qword [rsp + 0x20], rax
call fcn.14002c810
test rax, rax
mov qword [0x14008cdc0], rax
je 0x140027e6a
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x140027e66
test byte [rcx + 0x3c], 2
je 0x140027e66
cmp byte [rcx + 0x39], 5
jb 0x140027e66
mov rcx, qword [rcx + 0x30]
lea r8, [0x14006c3f0]
mov dx, FDICreate
call fcn.1400249f0
mov al, 1
jmp 0x140027eb8
cmp dword [0x14008cda8], ebx
je 0x140027eb6
mov rcx, qword [0x140080018]
lea rax, [0x140080018]
cmp rcx, rax
je 0x140027eb6
test byte [rcx + 0x3c], 2
je 0x140027eb6
cmp byte [rcx + 0x39], 5
jb 0x140027eb6
mov eax, dword [0x14008cda4]
mov r9d, dword [0x14008cda0]
mov rcx, qword [rcx + 0x30]
lea r8, [0x14006c3f0]
mov dx, reloc.Cabinet.dll_FDICreate
mov dword [rsp + 0x20], eax
call fcn.1400275a0
xor al, al
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.14004c890
add rsp, 0x3b0
pop rbx
ret
Function at 0x140029f90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
sub rsp, 0x340
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rbx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
mov qword [r8], 0
mov rbp, r9
repne scasw ax, word [rdi]
mov r12, r8
mov r13, rdx
not rcx
sub rcx, 1
cmp rcx, 2
jbe 0x14002a098
cmp word [rbx], 0x5c
je 0x14002a098
cmp word [rbx + 2], 0x3a
je 0x14002a098
call fcn.140029e90
test rax, rax
mov rdi, rax
je 0x14002a093
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
lea rdx, str.szInstallDir64
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x338], rsi
mov dword [rsp + 0x30], 0xc8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov esi, eax
jne 0x14002a077
lea r8d, [rax + 0x64]
lea rdx, [0x140063c7c]
lea rcx, [rsp + 0x40]
mov word [rsp + 0x106], ax
call fcn.14004e938
lea r8d, [rsi + 0x64]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.14004e938
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
mov rsi, qword [rsp + 0x338]
jne 0x14002a093
lea rcx, [rsp + 0x40]
jmp 0x14002a09b
mov rcx, rbx
jmp 0x14002a09b
mov rcx, rbx
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov rdi, rax
jne 0x14002a13f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov rdi, rax
jne 0x14002a13f
test rbp, rbp
je 0x14002a137
lea rdx, [rsp + 0x110]
mov r8d, 0x104
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14002a137
lea rcx, [rsp + 0x110]
mov dx, 0x5c
call fcn.14004d9d0
test rax, rax
je 0x14002a121
lea rcx, [rax + 2]
sub rcx, rbx
nop
nop
nop
movzx eax, word [rbx]
add rbx, 2
test ax, ax
mov word [rcx + rbx - 2], ax
jne 0x14002a110
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rdi, rax
jne 0x14002a13f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14002a171
lea rdx, str.NotComDllGetInterface
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002a15e
mov rdx, r12
mov rcx, r13
call rax
jmp 0x14002a164
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.14004c890
add rsp, 0x340
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x14002ab10
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
lea r8, str.Globalmfehidin
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14002ab79
nop
nop
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.Globalmfehidin
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14002ab40
add rsp, 0x20
pop rbx
ret
Function at 0x14002fe20
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov ecx, edx
mov r10d, r8d
shr ecx, 2
test ecx, ecx
jle 0x14002fe62
nop
movzx eax, byte [r9 + 1]
movzx r8d, byte [r9]
dec ecx
shl eax, 8
add r9, 4
or r8d, eax
movzx eax, byte [r9 - 2]
shl eax, 0x10
or r8d, eax
movzx eax, byte [r9 - 1]
shl eax, 0x18
or r8d, eax
xor r10d, r8d
test ecx, ecx
jg 0x14002fe30
and edx, 3
xor eax, eax
dec edx
je 0x14002fe89
dec edx
je 0x14002fe7d
dec edx
jne 0x14002fe8f
movzx eax, byte [r9]
shl eax, 0x10
inc r9
movzx ecx, byte [r9]
shl ecx, 8
or eax, ecx
inc r9
movzx ecx, byte [r9]
or eax, ecx
xor eax, r10d
ret
Function at 0x140039400
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
mov rdi, rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x44], 5
jne 0x14003945c
cmp dword [rsp + 0x48], 0
jne 0x14003945c
mov rdx, rdi
mov rcx, rbx
call fcn.1400393b0
jmp 0x140039495
test rbx, rbx
je 0x140039490
lea rax, [rsp + 0x30]
mov r9d, 0x2021f
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140039490
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140039495
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14004c890
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rdi
ret

Function at 0x140039500
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
mov rdi, rdx
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x44], 5
jne 0x140039553
cmp dword [rsp + 0x48], 0
jne 0x140039553
mov rdx, rdi
mov rcx, rbx
call fcn.1400394c0
jmp 0x140039588
test rbx, rbx
je 0x140039583
lea rax, [rsp + 0x30]
mov r9d, 0x20219
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
test eax, eax
cmove rcx, qword [rsp + 0x30]
jmp 0x140039585
xor ecx, ecx
mov rax, rcx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14004c890
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rdi
ret

Function at 0x140039650
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, rcx
lea rcx, [rsp + 0x60]
mov rsi, rdx
mov dword [rsp + 0x60], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x64], 5
jne 0x1400396a3
cmp dword [rsp + 0x68], 0
jne 0x1400396a3
mov rdx, rsi
mov rcx, rdi
call fcn.1400395b0
jmp 0x1400396fb
test rdi, rdi
mov qword [rsp + 0x1b0], rbx
je 0x1400396ee
xor ebx, ebx
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x28], 0x2021f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
cmove rbx, qword [rsp + 0x50]
jmp 0x1400396f0
xor ebx, ebx
mov rax, rbx
mov rbx, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14004c890
mov rsi, qword [rsp + 0x1b8]
add rsp, 0x190
pop rdi
ret

Function at 0x140039720
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete al
add rsp, 0x28
ret
Function at 0x140039740
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x14003976d
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov r9d, r8d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14003976d
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret

Function at 0x140039780
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x40
xor bl, bl
test rcx, rcx
mov rsi, r8
je 0x1400397fe
mov eax, dword [rsp + 0x70]
mov qword [rsp + 0x58], rdi
xor edi, edi
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400397d4
mov edi, dword [rsp + 0x50]
mov eax, dword [rsp + 0x30]
mov bl, 1
jmp 0x1400397d6
mov eax, edi
test rsi, rsi
je 0x1400397dd
mov dword [rsi], eax
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x1400397ec
mov ecx, edi
mov qword [rax], rcx
mov al, bl
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
mov al, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret

Function at 0x140039810
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x14003982a
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x14003982a
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x140039840
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x50
test rcx, rcx
mov rbx, r9
mov rdi, r8
je 0x140039904
test edx, edx
js 0x140039904
cmp rbx, 0x7fffffff
jae 0x140039904
mov rax, qword [rsp + 0x90]
mov r8d, 0xffffffff
lea r9, [r11 - 0x18]
cmp rax, r8
mov dword [rsp + 0x40], ebx
cmova rax, r8
lea r8, [r11 - 0x14]
mov dword [rsp + 0x60], eax
lea rax, [r11 + 8]
mov qword [r11 - 0x20], rax
mov rax, qword [rsp + 0x88]
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], r8
mov r8, rdi
mov qword [r11 - 0x38], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1400398c9
cmp eax, 0xea
jne 0x140039904
mov rcx, qword [rsp + 0x80]
mov word [rdi + rbx*2 - 2], 0
test rcx, rcx
je 0x1400398e3
mov eax, dword [rsp + 0x44]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x1400398f7
mov eax, dword [rsp + 0x60]
mov qword [rcx], rax
mov al, 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140039cc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
xor edi, edi
lea r9, [rsp + 0x58]
xor bl, bl
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140039cf4
mov edi, dword [rsp + 0x58]
mov bl, 1
test rsi, rsi
mov al, bl
je 0x140039d00
mov ecx, edi
mov qword [rsi], rcx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret