joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e1310
Capabilities:
Get file system object information

Disassembly:
push rbx
push rsi
sub rsp, 0x528
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov rbx, qword [rcx + 0xf298]
mov rsi, rcx
test rbx, rbx
je 0x1400e14ba
movsxd rcx, dword [rcx + 0xf2a8]
mov qword [rsp + 0x558], r12
shl rcx, 5
call fcn.14004af90
mov r12, rax
test rax, rax
je 0x1400e14b2
mov qword [rsp + 0x548], rbp
mov qword [rsp + 0x550], rdi
mov qword [rsp + 0x520], r13
xor r13d, r13d
lea rdi, [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x400
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x1400e13eb
lea r8, [rsp + 0x30]
mov edx, ILFindLastID
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400e13e2
mov rcx, qword [rsp + 0x30]
lea rdx, [rbx + 0x400]
lea r8, [rsp + 0x300]
mov r9d, 0x104
call qword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x300]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x4000
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [rsp + 0x48]
test rax, rax
cmove ecx, r13d
mov dword [rsp + 0x48], ecx
mov dword [rdi - 8], ecx
mov eax, dword [rsi + 0xf2ac]
add eax, 0xbf68
mov word [rdi], 0x1004
mov qword [rdi + 8], rbx
mov dword [rdi - 4], eax
mov qword [rdi + 0x10], r13
cmp dword [rbx + 0x800], r13d
je 0x1400e144c
mov byte [rdi + 1], 0x50
mov qword [rdi + 0x10], rbx
inc dword [rsi + 0xf2ac]
mov rbx, qword [rbx + 0x808]
add rdi, 0x20
test rbx, rbx
jne 0x1400e1382
movsxd r8, dword [rsi + 0xf2a8]
mov rcx, qword [rsi + 0x400]
mov r9, r12
mov edx, 0x444
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rsi + 0x400]
mov rcx, qword [rsi + 0x78]
call fcn.140094e10
mov rcx, r12
call fcn.14004b048
mov r13, qword [rsp + 0x520]
mov rdi, qword [rsp + 0x550]
mov rbp, qword [rsp + 0x548]
mov r12, qword [rsp + 0x558]
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x528
pop rsi
pop rbx
ret

Function at 0x1400e1640
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rdx
mov rsi, rcx
mov edx, 0x4b0
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 0x4af
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, qword [rsi + 0xf2a0]
mov r8d, 0x200
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rdx, qword [rsi + 0xf2a0]
mov r8d, 0x200
add rdx, 0x400
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, 0x4c6
mov rcx, rbp
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor ecx, ecx
cmp eax, 1
mov rax, qword [rsi + 0xf2a0]
sete cl
mov dword [rax + 0x800], ecx
mov edx, dword [rsi + 0xf270]
mov rcx, rsi
call fcn.1400e1040
mov edx, 1
mov rcx, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_EndDialog]
Function at 0x1400e1a30
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x840
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rbp, rdx
mov rsi, rcx
mov edx, 0x4b0
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 0x4af
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
lea rdx, [rsp + 0x430]
mov r8d, 0x200
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x30]
mov r8d, 0x200
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, 0x4c6
mov rcx, rbp
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor ebx, ebx
mov ecx, 0x820
cmp eax, 1
mov edi, ebx
sete dil
call fcn.14004af90
test rax, rax
je 0x1400e1aec
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x430]
mov r9d, edi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.1400e1910
mov rbx, rax
mov rdx, rbx
mov rcx, rsi
call fcn.1400e11b0
mov edx, 1
mov rcx, rbp
call qword [sym.imp.USER32.dll_EndDialog]
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.14004ae00
mov rbx, qword [rsp + 0x870]
add rsp, 0x840
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e36d0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rdx + 0x10]
mov rbx, rdx
cmp eax, 0xfffffffc
je 0x1400e36e6
cmp eax, 0xfffffffe
jne 0x1400e3724
mov rcx, qword [rcx + 8]
mov edx, 0x4f5
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp qword [rbx], rax
jne 0x1400e3724
lea r8, [rbx + 0x88]
lea rdx, [0x14010cd18]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1400e5460
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x350
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x340], rax
movsxd rbx, r8d
mov r10, r9
movsxd rsi, edx
mov rax, rbx
mov rdi, rcx
imul rax, rax, 0x214
cmp dword [rax + rcx + 0x1bd4], 0
jne 0x1400e554b
cmp dword [rax + rcx + 0x1bd0], 0
jne 0x1400e554b
lea r8, [rsp + 0x80]
mov r9d, 0x2b8
xor edx, edx
mov rcx, r10
mov dword [rsp + 0x20], 0x109
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r8, qword [rsp + 0x80]
mov edx, ebx
mov rcx, rdi
call fcn.1400a87a0
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetIconInfo]
mov rcx, qword [rdi + 0x88]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1302
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.1400012c0
mov rcx, qword [rsp + 0x48]
mov ebp, eax
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x1400e554d
xor ebp, ebp
mov rcx, qword [rdi + 0x88]
lea r9, [rsp + 0x50]
mov r8, rsi
mov edx, 0x133c
mov dword [rsp + 0x50], 2
mov rbx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rsi, dword [rsp + 0x6c]
mov rcx, qword [rdi + 0x88]
lea r9, [rsp + 0x50]
mov r8, rbx
mov edx, 0x133d
mov dword [rsp + 0x50], 2
mov dword [rsp + 0x6c], ebp
call qword [sym.imp.USER32.dll_SendMessageW]
test esi, esi
je 0x1400e55b9
mov rcx, qword [rdi + 0x88]
mov r8, rsi
xor r9d, r9d
mov edx, 0x132a
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.14004ae00
mov rbx, qword [rsp + 0x380]
add rsp, 0x350
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e5660
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x370
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x360], rax
movsxd r12, edx
mov rdi, rcx
mov rcx, qword [rcx + r12*8 + 0x728]
mov rbp, r12
mov rax, qword [rcx]
call qword [rax + 0x70]
mov rcx, qword [rdi + 0x88]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1304
mov r13, rax
call qword [sym.imp.USER32.dll_SendMessageW]
xor r14d, r14d
mov rsi, rax
mov ebx, r14d
test eax, eax
jle 0x1400e582f
nop
mov rcx, qword [rdi + 0x88]
lea r9, [rsp + 0x78]
movsxd r8, ebx
mov edx, 0x133c
mov dword [rsp + 0x78], 8
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rsp + 0x98], r12d
je 0x1400e5707
inc ebx
cmp ebx, esi
jl 0x1400e56d0
jmp 0x1400e582f
imul rbp, rbp, 0x214
cmp dword [rdi + rbp + 0x1bd4], r14d
jne 0x1400e57c2
cmp dword [rdi + rbp + 0x1bd0], r14d
jne 0x1400e57c2
lea r8, [rsp + 0xa0]
mov r9d, 0x2b8
xor edx, edx
mov rcx, r13
mov dword [rsp + 0x20], 0x109
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r8, qword [rsp + 0xa0]
mov edx, r12d
mov rcx, rdi
call fcn.1400a87a0
mov rcx, qword [rsp + 0xa0]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetIconInfo]
mov rcx, qword [rdi + 0x88]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1302
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.1400012c0
mov rcx, qword [rsp + 0x48]
mov r14d, eax
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rcx, qword [rdi + 0x88]
movsxd rbx, ebx
lea r9, [rsp + 0x50]
mov r8, rbx
mov edx, 0x133c
mov dword [rsp + 0x50], 2
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rsi, dword [rsp + 0x6c]
mov rcx, qword [rdi + 0x88]
lea r9, [rsp + 0x50]
mov r8, rbx
mov edx, 0x133d
mov dword [rsp + 0x50], 2
mov dword [rsp + 0x6c], r14d
call qword [sym.imp.USER32.dll_SendMessageW]
test esi, esi
je 0x1400e582f
mov rcx, qword [rdi + 0x88]
mov r8, rsi
xor r9d, r9d
mov edx, 0x132a
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.14004ae00
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x1400e5b00
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, qword [rbx + 0x12c0]
jne 0x1400e5b32
mov edx, edi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400d4300
cmp rax, qword [rbx + 0x98]
jne 0x1400e5b45
mov edx, edi
mov rcx, rbx
call fcn.1400a6810
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e5cd0
Capabilities:
Check os version
Delete registry key
Set registry value

Disassembly:
push rbx
push r12
sub rsp, 0x578
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x560], rax
mov ebx, ecx
lea rcx, [rsp + 0x40]
mov r12, rdx
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x44], 5
jne 0x1400e5d18
cmp ebx, 3
jne 0x1400e5d18
xor eax, eax
jmp 0x1400e5e1b
sub ebx, 2
mov qword [rsp + 0x590], rbp
mov qword [rsp + 0x5a0], rsi
mov qword [rsp + 0x570], rdi
je 0x1400e5d49
dec ebx
jne 0x1400e5d49
lea rbx, str.Folder_shell
lea rdi, [0x1401023ec]
jmp 0x1400e5d57
lea rdi, [0x140103790]
lea rbx, str.Directory_shell
lea rax, [rsp + 0x30]
mov esi, 1
mov r9d, 0x20006
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
mov ebp, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400e5dff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x30]
mov r9d, esi
lea eax, [rax + rax + 2]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
jne 0x1400e5dec
lea r8, [0x1401037b0]
lea rcx, [rsp + 0x160]
mov r9, rbx
mov edx, 0x200
mov qword [rsp + 0x20], r12
call section..text
lea rdx, [rsp + 0x160]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ebp, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1400e5dff
test ebp, ebp
je 0x1400e5e01
xor esi, esi
mov rdi, qword [rsp + 0x570]
mov rbp, qword [rsp + 0x590]
mov eax, esi
mov rsi, qword [rsp + 0x5a0]
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x578
pop r12
pop rbx
ret
Function at 0x1400e5e40
Capabilities:
Check os version
Delete registry key
Set registry value

Disassembly:
push rdi
sub rsp, 0x570
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x560], rax
mov rdi, rcx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x44], 5
jne 0x1400e5e7f
xor eax, eax
jmp 0x1400e5f5f
lea rax, [rsp + 0x30]
lea rdx, str.Folder_shell
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x588], rbx
mov qword [rsp + 0x20], rax
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400e5f55
mov qword [rsp + 0x590], rsi
lea rsi, [0x1401023ec]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x30]
mov r9d, ebx
lea eax, [rax + rax + 2]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test eax, eax
jne 0x1400e5f35
lea r9, str.Folder_shell
lea r8, [0x1401037b0]
lea rcx, [rsp + 0x160]
mov edx, 0x200
mov qword [rsp + 0x20], rdi
call section..text
lea rdx, [rsp + 0x160]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
mov rsi, qword [rsp + 0x590]
jne 0x1400e5f55
test ebx, ebx
jne 0x1400e5f55
lea eax, [rbx + 1]
jmp 0x1400e5f57
xor eax, eax
mov rbx, qword [rsp + 0x588]
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x570
pop rdi
ret
Function at 0x1400e5fa0
Capabilities:
Check os version
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x7b0
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x7a0], rax
mov ebx, ecx
lea rcx, [rsp + 0x70]
mov rdi, r8
mov rsi, rdx
mov dword [rsp + 0x70], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x74], 5
jne 0x1400e5feb
cmp ebx, 3
jne 0x1400e5feb
xor eax, eax
jmp 0x1400e61dc
sub ebx, 2
je 0x1400e5ffb
dec ebx
lea rdx, str.Folder_shell
je 0x1400e6002
lea rdx, str.Directory_shell
lea rax, [rsp + 0x60]
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000000
xor ebx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400e61da
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov rdx, rsi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400e61cf
mov rcx, rdi
mov qword [rsp + 0x7d0], rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
mov ebp, 1
lea eax, [rax + rax + 2]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea r11, [rsp + 0x58]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0x68]
lea rdx, [0x1401037a0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400e61bc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400e6128
lea r8, [rsp + 0x190]
mov r9d, 0x104
xor edx, edx
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x190]
lea r8, str.__s_____1_
lea rcx, [rsp + 0x3a0]
mov edx, 0x200
call section..text
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x68]
mov r9d, ebp
lea eax, [rax + rax + 2]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400e61b1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x60]
mov r9d, ebp
lea eax, [rax + rax + 2]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
cmove ebx, ebp
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x7d0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x7a0]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x7b0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400e6200
Capabilities:
Check os version
Set registry value

Disassembly:
push rbx
sub rsp, 0x7b0
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x7a0], rax
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
cmp dword [rsp + 0x74], 5
je 0x1400e6446
lea rax, [rsp + 0x60]
lea rdx, str.Folder_shell
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400e6446
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x7c8], rsi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
lea rsi, str.openinexplorer
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400e6433
mov qword [rsp + 0x7c0], rbp
mov qword [rsp + 0x7d0], rdi
lea rdi, str.Open_In_Explorer
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
mov ebp, 1
lea eax, [rax + rax + 2]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea r11, [rsp + 0x58]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0x68]
lea rdx, [0x1401037a0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400e6418
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400e6384
lea r8, [rsp + 0x190]
mov r9d, 0x104
xor edx, edx
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x190]
lea r8, str.__s_____1_
lea rcx, [rsp + 0x3a0]
mov edx, 0x200
call section..text
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x68]
mov r9d, ebp
lea eax, [rax + rax + 2]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400e640d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x60]
mov r9d, ebp
lea eax, [rax + rax + 2]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
cmove ebx, ebp
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x7d0]
mov rbp, qword [rsp + 0x7c0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x7c8]
mov eax, ebx
mov rcx, qword [rsp + 0x7a0]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x7b0
pop rbx
ret
Function at 0x1400e6fe0
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x20290
call fcn.140057430
sub rsp, rax
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x20280], rax
mov rdi, rdx
mov rsi, rcx
mov ebp, 2
test rcx, rcx
jne 0x1400e701d
mov eax, 0x80070057
jmp 0x1400e7179
mov qword [rsp + 0x202c0], rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 0x8000
movsxd rcx, eax
mov r9, rsi
mov edx, ebx
cmp word [rsi + rcx*2 - 2], 0x5c
lea rcx, [rsp + 0x280]
lea r8, [0x140103ae8]
je 0x1400e7056
lea r8, str._sNew_Folder
call section..text
lea r9, [rsp + 0x280]
lea r8, [0x140103b08]
lea rcx, [rsp + 0x10280]
mov rdx, rbx
call section..text
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x10280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1400e710f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0x20], ebp
mov r9, rsi
movsxd rcx, eax
mov rdx, rbx
lea r8, [0x140103b18]
cmp word [rsi + rcx*2 - 2], 0x5c
lea rcx, [rsp + 0x280]
je 0x1400e70d0
lea r8, str._sNew_Folder___d_
call section..text
lea r9, [rsp + 0x280]
lea r8, str.__s
lea rcx, [rsp + 0x10280]
mov rdx, rbx
call section..text
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x10280]
inc ebp
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400e7093
lea rcx, [rsp + 0x10280]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400e712a
mov eax, 0x80004005
jmp 0x1400e7171
lea rcx, [rsp + 0x280]
sub rcx, rdi
nop word [rax + rax]
lea rax, [rbx + 0x7fff7ffe]
test rax, rax
je 0x1400e7163
movzx eax, word [rcx + rdi]
test ax, ax
je 0x1400e7163
mov word [rdi], ax
add rdi, 2
dec rbx
jne 0x1400e7140
jmp 0x1400e7168
test rbx, rbx
jne 0x1400e716c
sub rdi, 2
xor eax, eax
mov word [rdi], ax
mov rbx, qword [rsp + 0x202c0]
mov rcx, qword [rsp + 0x20280]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x20290
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e71a0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov r8, qword [rcx + 0x10]
lea r12, [rcx + 0x10]
mov rdi, rdx
add r8, 2
mov rbx, rcx
mov eax, 2
mov rbp, 0xffffffffffffffff
mul r8
cmovo rax, rbp
mov rcx, rax
call fcn.14002cff8
mov rcx, qword [rdi + 0x10]
lea r13, [rdi + 0x10]
mov rsi, rax
add rcx, 2
mov eax, 2
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.14002cff8
cmp qword [rbx + 0x18], 8
mov rbp, rax
jb 0x1400e7215
mov rbx, qword [rbx]
mov rdx, qword [r12]
mov r8, rbx
mov rcx, rsi
add rdx, 2
call fcn.140001240
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor ebx, ebx
movsxd rcx, eax
mov word [rsi + rcx*2 + 2], bx
cmp qword [rdi + 0x18], 8
jb 0x1400e7245
mov rdi, qword [rdi]
mov rdx, qword [r13]
mov r8, rdi
mov rcx, rbp
add rdx, 2
call fcn.140001240
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov eax, 0x40
mov word [rbp + rcx*2 + 2], bx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x1400e72a2
cmp dword [rsp + 0x44], ebx
jne 0x1400e72a2
lea ebx, [rax + 1]
mov rcx, rsi
call fcn.14004b410
mov rcx, rbp
call fcn.14004b410
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1400e76c0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rbp, rcx
mov rcx, rdx
mov ebx, r8d
call fcn.1400e7580
xor edi, edi
mov rsi, rax
movzx eax, di
test ebx, ebx
jne 0x1400e76f1
lea eax, [rdi + 0x40]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x1400e7733
cmp dword [rsp + 0x44], edi
jne 0x1400e7733
lea edi, [rax + 1]
mov rcx, rsi
call fcn.14004b048
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov eax, edi
add rsp, 0x60
pop rdi
ret