joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400079c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14003d040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140007a93
cmp byte [rcx + 0x71], 0
je 0x140007a93
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140007a8f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140007a54
sub eax, 1
je 0x140007a58
cmp eax, 2
jne 0x140007a8f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400155d0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140007a86
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140007a8f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140007a3c
xor al, al
jmp 0x140007a3c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400155d0
add rsp, 0x60
pop rbx
ret

Function at 0x140014c9c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140014cd6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140014cdb
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140014d24
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400175c0]
cmp byte [rcx + rax], 0
je 0x140014d24
dec r8
sub rdx, 1
jne 0x140014d0a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140016140
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001618a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001618a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001618a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001618a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001618a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001618c
xor al, al
add rsp, 0x28
ret
Function at 0x140024e08
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140036f70], eax
call fcn.140025410
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140036f70], 0
jne case.default.0x140024e5e
mov ecx, 1
call fcn.140025410
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
fmul dword [rbp - 0x64]
sub ebp, eax
jno 0x14005fa3b
outsd dx, dword [rsi]
sub al, 0xbd
invalid
xchg edi, eax
jne 0x14005fa33
loop 0x14005fa75
invalid
add byte [rax - 0x50], al
insd dword [rdi], dx
xchg ebp, esi
jo 0x14005faf1
movabs al, byte [0x4e3f07356346f7df]
sbb al, 0xf1
xchg esi, eax
mov fs, word [rdx - 0x89182e7]
invalid
sub edx, dword [rax + 0x6b]
invalid
Function at 0x1400013d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x48
mov rbx, rdx
mov rdi, rcx
mov r8, rdx
mov edx, 0x84
call fcn.14003f9d8
nop
lea rax, vtable.CAboutDlg.0
mov qword [rdi], rax
lea rcx, [rdi + 0x308]
call fcn.14003aa48
nop
lea rcx, [rdi + 0x630]
call fcn.14003aa48
nop
lea rcx, [rdi + 0x958]
call fcn.14003aa48
nop
lea rcx, [rdi + 0xc80]
call fcn.14003aa48
nop
lea rcx, [rdi + 0xfa8]
call fcn.14003aa48
nop
lea rcx, [rdi + 0x12d0]
call fcn.14003aa48
nop
lea rcx, [rdi - 0x76b7aa08]
push rbp
mov rbp, rsp
sub rsp, 0x20

Function at 0x140001450
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14001381c
Capabilities:
Parse credit card information

Disassembly:
mov eax, 0x178a
jmp 0x140013fe8
Function at 0x1400111e0
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140016ad0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x140025018]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x14002b0f5]
call fcn.1400116f4
xor edx, edx
mov ecx, 2
call fcn.140011352
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140016b34
xor al, al
jmp 0x140016ba2
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011460
test eax, eax
jne 0x140016b5a
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140016ba2
mov rcx, qword [rbp + 0x420]
call fcn.14001124e
mov rdx, rax
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140016b85
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140016ba2
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001162c
test eax, eax
jne 0x140016b5a
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140020f80]
call fcn.1400115d7
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.14001136b
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret

Function at 0x1400113fc
Capabilities:
Terminate process

Disassembly:
jmp 0x140018b90
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400114dd
Capabilities:
Execute command
Hide graphical window
Set console window title

Disassembly:
jmp 0x140017250
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140025018]
xor rax, rbp
mov qword [rbp + 0x198], rax
lea rcx, [0x14002b0f5]
call fcn.1400116f4
lea rcx, str.hook_made_this
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, [rbp + 8]
call fcn.1400116e5
nop
lea rdx, str.make_sure_this_file_is_in_the_same_directory_as_your_krampus__vbs__bat_files_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
lea rdx, str.put_your_.bat_file_name_here:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
lea rdx, [rbp + 8]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400113f7
lea rdx, str.RobloxPlayerBeta.exe
lea rcx, [rbp + 0x48]
call fcn.14001123f
nop
mov byte [rbp + 0x84], 0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp + 0xa8], rax
xor edx, edx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
cmp eax, 1
je 0x14001735f
lea rcx, [rbp + 0x48]
call fcn.1400111e0
movzx eax, al
test eax, eax
je 0x14001734b
movzx eax, byte [rbp + 0x84]
test eax, eax
jne 0x140017349
lea rcx, [rbp + 8]
call fcn.1400110a0
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov byte [rbp + 0x84], 1
jmp 0x140017352
mov byte [rbp + 0x84], 0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001730e
mov dword [rbp + 0x184], 0
lea rcx, [rbp + 0x48]
call fcn.140011627
nop
lea rcx, [rbp + 8]
call fcn.14001114f
mov eax, dword [rbp + 0x184]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140021050]
call fcn.1400115d7
mov eax, edi
mov rcx, qword [rbp + 0x198]
xor rcx, rbp
call fcn.14001136b
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret

Function at 0x1400114f1
Capabilities:
Parse pe header

Disassembly:
jmp 0x140019ee0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140019f00
xor al, al
jmp 0x140019f81
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140019f13
xor al, al
jmp 0x140019f81
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140019f3d
xor al, al
jmp 0x140019f81
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140019f51
xor al, al
jmp 0x140019f81
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140019f63
xor al, al
jmp 0x140019f81
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140019f7f
xor al, al
jmp 0x140019f81
mov al, 1
add rsp, 0x38
ret
Function at 0x10002f19c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor ebx, ebx
lea rax, [r11 - 0x48]
mov edi, ecx
and qword [r11 - 0x48], rbx
lea rdx, [0x10001c490]
lea r9d, [rbx + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x5c], 0x14
mov qword [r11 - 0x78], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10002f25b
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, [0x10001c8a0]
xor r8d, r8d
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10002f24c
cmp dword [rsp + 0x58], 1
jne 0x10002f24c
lea rdx, [rsp + 0x60]
lea rcx, [0x10001c8c0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x10002f2ab
test edi, edi
je 0x10002f2ab
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
lea rdx, [0x10001c8d0]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 3
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10002f2ab
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x10002f2d4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x270], rax
and qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
lea rdx, [0x10001cbf0]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10002f3fe
and qword [rsp + 0x48], 0
xor ebx, ebx
mov dword [rsp + 0x40], 0x104
and qword [rsp + 0x38], rbx
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
xor edx, edx
jmp 0x10002f3d6
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
inc ebx
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10002f3bc
mov rcx, qword [rsp + 0x48]
lea rdx, [0x10001cc78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x48]
lea rdx, [0x10001cc90]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x48]
lea rdx, [0x10001ccb0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, ebx
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x10002f34f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1000475f0
add rsp, 0x280
pop rbx
ret
Function at 0x10002fd88
Capabilities:
Delete file
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x6b0
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
lea rax, [rsp + 0x58]
xor esi, esi
mov rbx, 0xffffffff80000001
lea rdx, [0x10001d040]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdx, qword [rsp + 0x58]
cmp eax, esi
lea rax, [rsp + 0x50]
mov r9d, 0x2001f
cmovne rdx, rsi
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x58], rdx
lea rdx, [0x10001d0c0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10002ff26
mov ebx, esi
mov dword [rsp + 0x48], 0x104
mov dword [rsp + 0x44], 0x208
mov dword [rsp + 0x40], 1
xor edx, edx
jmp 0x10002fed8
inc ebx
cmp ebx, 0x3e8
jae 0x10002ff1b
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x48], 0x104
mov dword [rsp + 0x44], 0x208
cmp rcx, rsi
je 0x10002fe9a
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x280]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x490]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x10002fed6
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r11, [rsp + 0x70]
cmp r11, rsi
je 0x10002febb
lea rcx, [rsp + 0x70]
call fcn.1000400f0
jmp 0x10002febd
mov eax, esi
cmp eax, esi
jne 0x10002fed6
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
dec ebx
mov edx, ebx
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x280]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
je 0x10002fe39
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
cmp rcx, rsi
je 0x10002ff36
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0x6c0]
add rsp, 0x6b0
pop rsi
ret
Function at 0x10002ff60
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x30
and qword [rax + 0x20], 0
and dword [rax + 8], 0
mov dword [rax + 0x10], 0x104
mov dword [rax + 0x18], 1
lea rax, [rax + 0x20]
lea rdx, [0x10001c490]
mov r9d, 3
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 4
test eax, eax
jne 0x100030038
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x10001d138]
xor r8d, r8d
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10003002d
cmp dword [rsp + 0x50], ebx
jne 0x10003002d
cmp dword [rsp + 0x40], 0xd2af9
je 0x100030002
cmp dword [rsp + 0x40], 0xc00d2afb
jne 0x10003002d
mov rcx, qword [rsp + 0x58]
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
lea rdx, [0x10001d138]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x58]
lea rdx, [0x10001c490]
mov r9d, 3
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000300ed
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x10001d138]
xor r8d, r8d
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000300e2
cmp dword [rsp + 0x50], ebx
jne 0x1000300e2
cmp dword [rsp + 0x40], 0xd2af9
je 0x1000300b7
cmp dword [rsp + 0x40], 0xc00d2afb
jne 0x1000300e2
mov rcx, qword [rsp + 0x58]
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
lea rdx, [0x10001d138]
mov r9d, ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x100030370
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x38
lea rax, [rsp + 0x68]
mov ebx, 1
lea rdx, [0x10001d310]
xor edi, edi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x100030409
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, [0x10001d380]
xor r8d, r8d
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x1000303fe
cmp dword [rsp + 0x50], 4
jne 0x1000303fe
cmp dword [rsp + 0x58], ebx
sete dil
mov ebx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x100030a0c
Capabilities:
Get common file path
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
sub rsp, 0x6a0
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x690], rax
and qword [rsp + 0x40], 0
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, [0x10001d6a0]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100030c5d
and dword [rsp + 0x50], eax
and dword [rsp + 0x54], eax
mov ebp, 0x105
lea rcx, [rsp + 0x270]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, 0x80004005
test eax, eax
je 0x100030ba5
lea rsi, [0x10001d710]
lea r9, [rsp + 0x270]
lea r8, [0x10001d720]
lea rcx, [rsp + 0x60]
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call fcn.10002e570
test eax, eax
js 0x100030b20
lea rax, [rsp + 0x60]
test rax, rax
je 0x100030af1
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.100040be4
jmp 0x100030af3
mov eax, ebx
test eax, eax
js 0x100030b20
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov r9d, 3
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
and dword [rsp + 0x54], 0
and dword [rsp + 0x50], 0
lea rsi, [0x10001cc78]
lea r9, [rsp + 0x270]
lea r8, [0x10001d720]
lea rcx, [rsp + 0x60]
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call fcn.10002e570
test eax, eax
js 0x100030ba5
lea rax, [rsp + 0x60]
test rax, rax
je 0x100030b76
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.100040be4
jmp 0x100030b78
mov eax, ebx
test eax, eax
js 0x100030ba5
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov r9d, 3
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
and dword [rsp + 0x54], 0
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x480]
test rax, rax
je 0x100030c52
lea rcx, [rsp + 0x480]
mov r8, rbp
mov edx, 1
call fcn.100040758
test eax, eax
je 0x100030c52
lea rsi, [0x10001c3b0]
lea r9, [rsp + 0x480]
lea r8, [0x10001d720]
lea rcx, [rsp + 0x60]
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call fcn.10002e570
test eax, eax
js 0x100030c52
lea rax, [rsp + 0x60]
test rax, rax
je 0x100030c25
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.100040be4
mov ebx, eax
test ebx, ebx
js 0x100030c52
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov r9d, 3
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rsi
ret
Function at 0x100030c88
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebx, ebx
mov rdi, rcx
cmp rcx, rbx
jne 0x100030cb5
xor eax, eax
jmp 0x100030d0d
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r11, [rsp + 0x20]
cmp r11, rbx
je 0x100030cda
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, [0x10001d730]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.10002e3d4
cmp eax, ebx
jl 0x100030cb1
lea r8, [rsp + 0x20]
mov edx, 0x104
mov rcx, rdi
call fcn.10002e2e8
cmp eax, ebx
setge bl
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret