joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019df8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebx, ebx
test rcx, rcx
je 0x140019e8e
mov r8, rcx
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.1400104bc
test eax, eax
js 0x140019e8e
or rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x20]
mov rax, rcx
inc rax
cmp word [rdx + rax*2], bx
jne 0x140019e3c
test rax, rax
je 0x140019e6f
cmp word [rsp + rax*2 + 0x1e], 0x5c
jne 0x140019e6f
lea rdx, [rsp + 0x20]
mov rax, rcx
inc rax
cmp word [rdx + rax*2], bx
jne 0x140019e5a
test rax, rax
je 0x140019e6f
mov word [rsp + rax*2 + 0x1e], bx
jmp 0x140019e34
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140019e8e
test al, 0x10
je 0x140019e8e
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140001660
add rsp, 0x240
pop rbx
ret

Function at 0x140019eb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140019ed4
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140019ed4
shr eax, 4
not eax
and eax, 1
jmp 0x140019ed6
xor eax, eax
add rsp, 0x28
ret

Function at 0x140019ff8
Capabilities:
Get common file path
Get disk size

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x378]
sub rsp, 0x470
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov edx, 0x104
lea rcx, [rbp + 0x150]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14001a106
lea r8, [rbp + 0x150]
mov edx, 0x103
lea rcx, [rsp + 0x40]
call fcn.1400104bc
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x14001a106
lea r9, [rsp + 0x28]
mov word [rax + 2], bx
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001a0ce
call fcn.140015998
test eax, eax
jle 0x14001a0b8
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rdx, str.GetDiskFreeSpaceEx_failed.__Error:__x_r_n
mov ecx, 2
call fcn.140018ed8
jmp 0x14001a106
mov rdi, qword [rsp + 0x20]
test rdi, rdi
jne 0x14001a103
lea r9, [rsp + 0x28]
mov word [rsi], bx
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
nop dword [rax + rax]
test eax, eax
cmovne rdi, qword [rsp + 0x20]
mov rbx, rdi
mov rax, rbx
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.140001660
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001a994
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
xor edx, edx
add rcx, 4
mov r8d, 0x154
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor r15d, r15d
lea rsi, [rdi + 0xf0]
mov ebp, 0x400
mov dword [rdi], r15d
mov r8, rsi
mov edx, 0x1010
mov ecx, ebp
lea r14d, [r15 + 0x32]
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtoi]
nop dword [rax + rax]
mov dword [rdi + 0x20], eax
mov r9d, r14d
lea edx, [r15 + 0x12]
mov word [rsi], r15w
mov r8, rsi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtoi]
nop dword [rax + rax]
lea rbx, [rdi + 0x28]
mov r9d, r14d
lea edx, [r15 + 0xe]
mov dword [rdi + 4], eax
mov r8, rbx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax + rax]
mov qword [rdi + 0x10], rbx
lea edx, [r15 + 0xf]
lea rbx, [rdi + 0x8c]
mov r9d, r14d
mov r8, rbx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax + rax]
mov r9d, r14d
mov qword [rdi + 0x18], rbx
mov r8, rsi
mov word [rsi], r15w
lea edx, [r15 + 0x10]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
nop dword [rax + rax]
movzx eax, word [rsi]
jmp 0x14001aade
mov ecx, 0x30
cmp cx, ax
je 0x14001aae4
mov eax, dword [rdi + 8]
mov rcx, rsi
lea edx, [rax + rax*4]
add edx, edx
mov dword [rdi + 8], edx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtoi]
nop dword [rax + rax]
add dword [rdi + 8], eax
mov rcx, rsi
call qword [sym.imp.USER32.dll_CharNextW]
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
nop dword [rax + rax]
mov rsi, rax
movzx eax, word [rax]
cmp r15w, ax
jne 0x14001aa93
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14001ab04
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0xe0], rax
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x34], 0x80
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001ab64
xor eax, eax
jmp 0x14001ac91
mov eax, dword [rsp + 0x48]
xor r8d, r8d
mov ebx, dword [rsp + 0x44]
mov r9d, 1
shl rbx, 0x10
mov rcx, 0xffffffff80000002
or rbx, rax
lea rax, [rsp + 0x38]
shl rbx, 0x20
cmp dword [rsp + 0x50], 2
mov qword [rsp + 0x20], rax
jne 0x14001ac1c
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001ac8e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rbp + 0x60]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001ac7d
cmp dword [rsp + 0x30], 1
jne 0x14001ac7d
lea rcx, [rbp + 0x60]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtol]
nop dword [rax + rax]
mov ecx, eax
shl rcx, 0x10
add rbx, rcx
mov dword [rsp + 0x34], eax
jmp 0x14001ac7d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001ac8e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rbp + 0x60]
xor r8d, r8d
lea rdx, str.VersionNumber
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001ac7d
cmp dword [rsp + 0x30], 1
jne 0x14001ac7d
lea rcx, [rbp + 0x60]
call fcn.14001de88
mov rbx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rax, rbx
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.140001660
mov rbx, qword [rsp + 0x200]
add rsp, 0x1f0
pop rbp
ret
Function at 0x14001acb8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rcx, rcx
jne 0x14001aced
xor eax, eax
jmp 0x14001ad8b
mov ebp, 0x104
lea rcx, [rsp + 0x20]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14001ad30
lea r8, [0x1400407d0]
mov edx, ebp
lea rcx, [rsp + 0x20]
call fcn.140010470
test eax, eax
js 0x14001ad30
lea rcx, [rsp + 0x20]
call fcn.140019eb0
mov ebx, eax
test eax, eax
jne 0x14001ad6f
mov edx, ebp
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14001ad89
lea r8, str.msdxm.ocx
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.140010470
test eax, eax
js 0x14001ad89
lea rcx, [rsp + 0x20]
call fcn.140019eb0
mov ebx, eax
test eax, eax
je 0x14001ad89
shr rdi, 1
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rsi
call fcn.1400104bc
xor ebx, ebx
test eax, eax
setns bl
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140001660
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001ae6c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r13d, r13d
lea rax, [rbp - 0x20]
mov qword [r11 - 0x50], r13
mov r15, r8
mov qword [r11 - 0x58], r13
mov r12, rdx
mov qword [r11 - 0x60], r13
xor r9d, r9d
mov qword [r11 - 0x68], r13
xor r8d, r8d
mov qword [r11 - 0x70], r13
xor edx, edx
mov qword [r11 - 0x78], r13
mov r14, rcx
mov qword [r11 - 0x80], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x48], r13d
mov dword [rbp - 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
test eax, eax
je 0x14001aeea
xor eax, eax
jmp 0x14001b091
or r8, 0xffffffffffffffff
mov rcx, r8
inc rcx
cmp word [r12 + rcx*2], r13w
jne 0x14001aef1
mov eax, dword [rbp - 0x20]
cmp ecx, eax
mov dword [rbp - 0x1c], ecx
cmova eax, ecx
inc dword [rbp + 0x48]
add eax, 5
mov ecx, eax
mov dword [rbp - 0x20], eax
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.14000130c
mov rsi, rax
test rax, rax
jne 0x14001af3e
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
jmp 0x14001aee3
mov edi, r13d
mov qword [rbp - 0x10], r13
cmp edi, dword [rbp + 0x48]
ja 0x14001b085
mov edx, dword [rbp - 0x20]
lea r8, str._s_lu
mov r9, r12
mov dword [rsp + 0x20], edi
mov rcx, rsi
call fcn.1400104f4
lea rax, [rbp - 0x10]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b03f
test r15, r15
je 0x14001b01e
mov ecx, 0x208
call fcn.14000130c
mov rbx, rax
test rax, rax
je 0x14001b01e
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov dword [rbp - 0x18], 1
mov dword [rbp - 0x1c], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b016
cmp dword [rbp - 0x18], 1
jne 0x14001b016
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r13w
jne 0x14001aff1
test rax, rax
je 0x14001b016
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14001b035
mov rcx, rbx
call fcn.1400012c0
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
inc edi
jmp 0x14001af41
mov rcx, rbx
call fcn.1400012c0
jmp 0x14001b085
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov rdx, rsi
mov rcx, r14
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x10]
test eax, eax
cmovne rcx, r13
mov qword [rbp - 0x10], rcx
mov rcx, rsi
call fcn.1400012c0
mov rax, qword [rbp - 0x10]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14001b0bc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r12d, r12d
lea rax, [rbp + 0x48]
mov qword [r11 - 0x50], r12
mov r15, r8
mov qword [r11 - 0x58], r12
xor r9d, r9d
mov qword [r11 - 0x60], r12
xor r8d, r8d
mov qword [r11 - 0x68], r12
xor edx, edx
mov qword [r11 - 0x70], r12
mov r14, rcx
mov qword [r11 - 0x78], r12
mov qword [r11 - 0x80], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x58], r12d
mov dword [rbp + 0x48], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b295
or r13, 0xffffffffffffffff
lea rbx, str.FilesFile
mov rcx, r13
inc rcx
cmp word [rbx + rcx*2], r12w
jne 0x14001b13d
mov eax, dword [rbp + 0x48]
cmp ecx, eax
mov dword [rbp - 0x10], ecx
cmova eax, ecx
add eax, 5
mov ecx, eax
mov dword [rbp + 0x48], eax
mov eax, 2
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.14000130c
mov rdi, rax
test rax, rax
je 0x14001b295
mov qword [rbp - 8], r12
mov esi, r12d
mov rcx, rdi
cmp esi, dword [rbp + 0x58]
jae 0x14001b288
mov edx, dword [rbp + 0x48]
lea r8, str._s_lu
mov r9, rbx
mov dword [rsp + 0x20], esi
call fcn.1400104f4
lea rax, [rbp - 8]
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b267
mov ecx, 0x208
call fcn.14000130c
mov rbx, rax
test rax, rax
je 0x14001b250
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0xc]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov dword [rbp - 0xc], 1
mov dword [rbp - 0x10], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b248
cmp dword [rbp - 0xc], 1
jne 0x14001b248
mov rax, r13
inc rax
cmp word [rbx + rax*2], r12w
jne 0x14001b223
test rax, rax
je 0x14001b248
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14001b26e
mov rcx, rbx
call fcn.1400012c0
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rbx, str.FilesFile
inc esi
jmp 0x14001b181
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, rbx
call fcn.1400012c0
jmp 0x14001b290
call fcn.1400012c0
mov rdi, r12
mov rax, rdi
jmp 0x14001b297
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001b6f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x48]
and qword [rsp + 0x48], 0
lea rdx, [0x1400438b8]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [rax + rax]
test eax, eax
jne 0x14001b76f
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.PendingFileRenameOperations
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x14001b968
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov esi, edx
mov rdi, rcx
test rcx, rcx
je 0x14001b9ae
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14001b9ae
mov edx, esi
lea r8, str.unregmp2.exe
mov rcx, rdi
call fcn.140010470
test eax, eax
lea ecx, [rbx + 1]
cmovns ebx, ecx
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001b9c8
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor ebx, ebx
lea rcx, [0x1400449b8]
movzx esi, bx
mov dword [rsp + 0x50], ebx
mov ebp, ebx
call fcn.140019eb0
test eax, eax
je 0x14001baa3
lea rdx, [rsp + 0x50]
lea rcx, [0x1400449b8]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
nop dword [rax + rax]
mov ecx, eax
mov r14d, eax
call fcn.14000130c
mov rdi, rax
test rax, rax
je 0x14001baa3
mov r9, rax
lea rcx, [0x1400449b8]
mov r8d, r14d
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
nop dword [rax + rax]
lea r14d, [rbx + 1]
test eax, eax
je 0x14001ba7a
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], 4
lea r8, [rsp + 0x60]
mov rcx, rdi
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
je 0x14001ba7a
mov rax, qword [rsp + 0x60]
mov ebp, r14d
movzx esi, word [rax]
mov rcx, rdi
call fcn.1400012c0
test ebp, ebp
je 0x14001baa3
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
nop dword [rax + rax]
mov ecx, 0x409
cmp cx, si
je 0x14001baa3
cmp cx, ax
cmove ebx, r14d
mov eax, ebx
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001bab8
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x47], rax
or qword [rbp + 0x2f], 0xffffffffffffffff
xor r14d, r14d
mov esi, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop dword [rax + rax]
lea r8, [rbp + 0x2f]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop dword [rax + rax]
test eax, eax
je 0x14001bc2f
mov rcx, qword [rbp + 0x2f]
lea rax, [rbp + 0x27]
lea ebx, [r14 + 2]
mov dword [rbp + 0x27], r14d
mov edx, ebx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
nop dword [rax + rax]
mov ecx, dword [rbp + 0x27]
call fcn.14000130c
mov rdi, rax
test rax, rax
je 0x14001bc1a
mov r9d, dword [rbp + 0x27]
lea rax, [rbp + 0x27]
mov rcx, qword [rbp + 0x2f]
mov r8, rdi
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x14001bc12
lea rax, [rbp + 0x37]
mov dword [rbp + 0x3f], r14d
mov qword [rsp + 0x50], rax
lea r8d, [r14 + 0x20]
mov dword [rsp + 0x48], r14d
lea rcx, [rbp + 0x3f]
mov dword [rsp + 0x40], r14d
mov r9d, 0x220
mov dword [rsp + 0x38], r14d
mov dl, bl
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov word [rbp + 0x43], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
je 0x14001bc12
mov ebx, r14d
cmp ebx, dword [rdi]
jae 0x14001bc02
mov rcx, qword [rbp + 0x37]
mov edx, ebx
add rdx, rdx
mov rdx, qword [rdi + rdx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
jne 0x14001bbfd
inc ebx
jmp 0x14001bbd7
mov esi, 1
mov rcx, qword [rbp + 0x37]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
nop dword [rax + rax]
mov rcx, rdi
call fcn.1400012c0
mov rcx, qword [rbp + 0x2f]
test rcx, rcx
je 0x14001bc2f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, esi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140001660
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14001bc64
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x38
xor ebx, ebx
lea rax, [rbp + 0x30]
xor r8d, r8d
mov qword [rbp + 0x30], rbx
lea rdx, str.SoftwareClientsMediaWindows_Media_PlayerInstallInfo
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001bd09
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x18]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.IconsVisible
mov dword [rbp + 0x18], 3
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001bcf9
mov ecx, dword [rbp + 0x18]
add ecx, 0xfffffffd
cmp ecx, 1
ja 0x14001bcf9
cmp dword [rbp + 0x20], 1
setne bl
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
ret

Function at 0x14001bd98
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
test eax, eax
je 0x14001be77
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001be77
and qword [rsp + 0x38], 0
lea r9, [rsp + 0x48]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
and qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rsp + 0x40]
and qword [rsp + 0x20], 0
mov dword [rsp + 0x48], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001be54
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
call fcn.14001bd98
test eax, eax
je 0x14001be00
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140001660
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x14001bea0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x30
and dword [rsp + 0x58], 0
mov rbx, r8
mov rdi, rdx
test rdx, rdx
jne 0x14001bec4
lea eax, [rdx + 6]
jmp 0x14001bf34
test ecx, ecx
jne 0x14001bf07
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
and qword [rsp + 0x20], 0
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001bf07
test rbx, rbx
jne 0x14001bf00
cmp dword [rsp + 0x58], 2
jbe 0x14001bf07
mov eax, UnRegisterTypeLib
jmp 0x14001bf34
mov eax, dword [rsp + 0x70]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rax, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14001c58c
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14001c605
call fcn.140015998
mov ebx, eax
cmp eax, 5
jne 0x14001c605
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14001c605
test al, 1
je 0x14001c605
and eax, 0xfffffffe
mov rcx, rdi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop dword [rax + rax]
test eax, eax
je 0x14001c605
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14001c5fe
xor ebx, ebx
jmp 0x14001c605
call fcn.140015998
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret