joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100057b40
Capabilities:
Delete service
Query service status

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r15, r8
mov esi, edx
mov rbp, rcx
mov edi, 1
mov dword [r8], 0
xor edx, edx
xor ecx, ecx
mov r8d, 0xe0000000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
je 0x100057d5c
mov r8d, 0x80010020
mov rdx, qword [rbp]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r13, rax
test rax, rax
je 0x100057d33
lea ebx, [rdi + 2]
cmp esi, 2
je 0x100057bc6
cmp esi, ebx
je 0x100057bc6
cmp esi, 4
je 0x100057bc6
cmp esi, edi
jne 0x100057c68
lea r8, [rsp + 0x28]
mov edx, edi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x100057bf5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, qword [rbp]
lea rdx, [0x1000109f0]
mov ecx, ebx
call fcn.10003c3c0
xor r12d, r12d
lea rdx, [rsp + 0x28]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100057c50
cmp dword [rsp + 0x2c], edi
je 0x100057c68
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x28]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100057c50
add r12d, 0x1f4
cmp r12d, 0x2710
ja 0x100057c45
cmp dword [rsp + 0x2c], edi
jne 0x100057c10
jmp 0x100057c68
mov ecx, 0x41d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, qword [rbp]
lea rdx, [0x100010a50]
mov ecx, 2
call fcn.10003c3c0
mov dword [r15], edi
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x100057d0b
mov r8, qword [rbp]
lea rdx, [0x100010a88]
mov ecx, edi
call fcn.10003c3c0
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r12d, r12d
cmp esi, 2
je 0x100057ca5
cmp esi, ebx
je 0x100057ca5
lea ebx, [r12 + 6]
mov r8d, 0x80000000
mov rdx, qword [rbp]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
add r12d, edi
test rax, rax
je 0x100057d51
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp r12d, ebx
jne 0x100057cf9
lea rdx, [0x100010ac0]
mov ecx, 2
call fcn.10003c3c0
mov dword [r15], edi
jmp 0x100057d04
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp r12d, ebx
jb 0x100057ca5
jmp 0x100057d51
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, qword [rbp]
lea rdx, [0x100010ba0]
mov ecx, ebx
call fcn.10003c3c0
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x100057d51
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, qword [rbp]
lea rdx, [0x100010c20]
lea ecx, [rdi + 3]
call fcn.10003c3c0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x100057d78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x100010cb0]
mov ecx, 3
call fcn.10003c3c0
xor edi, edi
mov rcx, rbp
call fcn.10001fba0
mov eax, edi
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100058174
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
mov rax, rsp
sub rsp, 0x78
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
lea rcx, [rax + 0x40]
call fcn.10001fee0
nop
lea rcx, [rsp + 0xa8]
call fcn.10001fee0
nop
xor ebx, ebx
mov qword [rsp + 0x50], rbx
cmp rdi, rbx
jne 0x1000581db
lea rcx, [rsp + 0xa8]
call fcn.10001fba0
nop
lea rcx, [rsp + 0xb8]
call fcn.10001fba0
nop
jmp 0x100058300
lea rdx, [0x100012840]
lea rcx, [rsp + 0x58]
call fcn.10001ff98
nop
lea r8, [rsp + 0xb8]
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.1000327cc
nop
lea rcx, [rsp + 0x58]
call fcn.10001fba0
lea rdx, [0x100012770]
lea rcx, [rsp + 0x58]
call fcn.10001ff98
nop
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xb8]
call fcn.1000327cc
nop
lea rcx, [rsp + 0x58]
call fcn.10001fba0
mov rdx, qword [rsp + 0xa8]
cmp dword [rdx - 8], 1
jle 0x10005826a
mov edx, dword [rdx - 0x10]
lea rcx, [rsp + 0xa8]
call fcn.10001fbd0
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
je 0x1000582a5
mov edi, ebx
jmp 0x1000582d1
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rdi
mov r9d, 7
xor r8d, r8d
lea rdx, [0x1000107a0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, ebx
cmp eax, ebx
sete dil
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x1000582e2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0xa8]
call fcn.10001fba0
nop
lea rcx, [rsp + 0xb8]
call fcn.10001fba0
nop
mov ebx, edi
mov rcx, rsi
call fcn.10001fba0
mov eax, ebx
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10005c744
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rdi, rcx
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x78]
call fcn.10001fee0
nop
lea rcx, [rsp + 0x68]
call fcn.10001fee0
nop
lea rdx, [0x100012840]
lea rcx, [rsp + 0x30]
call fcn.10001ff98
nop
lea r8, [rsp + 0x78]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1000327cc
nop
lea rcx, [rsp + 0x30]
call fcn.10001fba0
lea rdx, [0x100012770]
lea rcx, [rsp + 0x30]
call fcn.10001ff98
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.1000327cc
nop
lea rcx, [rsp + 0x30]
call fcn.10001fba0
lea r11, [rsp + 0x70]
mov qword [rsp + 0x20], r11
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x10005c824
cmp eax, 2
je 0x10005c820
mov r9, qword [rdi]
mov r8d, eax
lea rdx, [0x100011610]
mov ecx, 3
call fcn.10003c3c0
jmp 0x10005c898
xor ebx, ebx
jmp 0x10005c898
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1000107a0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebx, ebx
lea ebp, [rbx + 1]
cmp eax, 2
cmove ebx, ebp
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x10005c896
mov rdx, qword [rsp + 0x68]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
test eax, eax
je 0x10005c896
mov r9, qword [rdi]
mov r8d, eax
lea rdx, [0x1000118f0]
mov ecx, ebp
call fcn.10003c3c0
jmp 0x10005c898
xor ebx, ebx
lea rcx, [rsp + 0x68]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x78]
call fcn.10001fba0
mov eax, ebx
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
Function at 0x1000644a8
Capabilities:
Check mutex on windows
Create directory
Get common file path
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x2b0
mov rax, qword [0x100082138]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor ebx, ebx
mov edi, ebx
mov esi, ebx
mov dword [rsp + 0x48], ebx
lea rcx, [rsp + 0x60]
call fcn.100068598
cmp eax, ebx
jne 0x100064687
lea r8, [0x1000062a0]
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r12, rax
mov qword [rsp + 0x58], rax
cmp rax, rbx
jne 0x10006451f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.1000309dc
mov eax, ebx
jmp 0x100064687
lea rcx, [rsp + 0x60]
call fcn.1000309dc
nop
mov edx, 0xffffffff
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x100064554
cmp eax, 0x80
je 0x100064554
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x40], eax
jmp 0x100064663
mov esi, 1
mov dword [rsp + 0x48], esi
cmp dword [0x10008351c], ebx
je 0x100064570
mov edi, ebx
mov dword [rsp + 0x40], ebx
jmp 0x100064663
mov edx, 0x104
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
jne 0x100064590
mov qword [rsp + 0x50], rbx
mov eax, esi
jmp 0x10006459d
lea rcx, [rsp + 0x90]
call fcn.1000643c0
cmp eax, ebx
je 0x1000645af
mov edi, 0x6e
mov dword [rsp + 0x40], edi
jmp 0x100064663
xor edx, edx
lea r13, [0x1000830a0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, ebx
jne 0x1000645d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100064663
mov edi, ebx
mov dword [rsp + 0x40], ebx
mov dword [0x10008351c], esi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xb
jb 0x100064663
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, esi
mov edx, 0xc0000000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x100064663
mov word [rsp + 0x44], si
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, 2
lea r8, [rsp + 0x44]
mov edx, 0x9c040
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp esi, ebx
je 0x10006467c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp eax, ebx
jne 0x10006467c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.10006b1f0
add rsp, 0x2b0
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x100064990
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov rdx, rcx
lea rcx, [rsp + 0x70]
call fcn.10001ff98
nop
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000649c9
xor al, al
jmp 0x1000649ce
shr eax, 4
and al, 1
test al, al
sete bl
lea rcx, [rsp + 0x70]
call fcn.10001fba0
test bl, bl
je 0x1000649e8
mov eax, 2
jmp 0x100064a58
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100064a2a
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xb7
jmp 0x100064a58
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.10001ff98
nop
lea rcx, [rsp + 0x70]
call fcn.100032ffc
mov bl, al
lea rcx, [rsp + 0x70]
call fcn.10001fba0
neg bl
sbb eax, eax
and eax, 0xfffffff5
add eax, 0xd
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x100064aa0
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.10001ff98
nop
lea rcx, [rsp + 0x50]
call fcn.100032ae8
test al, al
sete bl
lea rcx, [rsp + 0x50]
call fcn.10001fba0
test bl, bl
je 0x100064aec
mov eax, 0x52
jmp 0x100064bcf
mov dword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x100064b7a
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.10001ff98
nop
lea rcx, [rsp + 0x50]
call fcn.100032ffc
nop
lea rcx, [rsp + 0x50]
call fcn.10001fba0
mov eax, 0x52
jmp 0x100064bcf
cmp dword [rsp + 0x90], 1
jne 0x100064bbf
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, [0x100006388]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x100064c20
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rdx
test rcx, rcx
je 0x100064c5a
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.10001ff98
nop
lea rcx, [rsp + 0x40]
call fcn.100032ffc
nop
lea rcx, [rsp + 0x40]
call fcn.10001fba0
test rbx, rbx
je 0x100064c6f
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rsp, 0x30
pop rbx
ret
Function at 0x100064e38
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov r12, r8
mov rbp, rdx
mov rdi, rcx
xor ebx, ebx
cmp qword [rcx + 0x20], rbx
jne 0x100064eac
add rcx, 0x10
mov edx, 0x20019
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov qword [rdi + 0x20], rax
cmp rax, 0xffffffffffffffff
jne 0x100064eac
mov qword [rdi + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, rbp
call fcn.10001fba0
xor eax, eax
jmp 0x100064fab
mov dword [rsp + 0x80], ebx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp]
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x100064efd
cmp eax, 2
je 0x100064ef3
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
jmp 0x100064fa1
mov ebx, 1
jmp 0x100064fa1
mov eax, dword [rsp + 0x80]
add eax, 4
mov r13d, eax
mov ecx, eax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rsi, rax
cmp rax, rbx
jne 0x100064f27
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
jmp 0x100064fa1
mov r8, r13
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp]
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x100064f74
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
jmp 0x100064fa1
mov rdx, rsi
mov rcx, r12
call fcn.100044e08
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
cmp qword [r12 + 0x10], rbx
jne 0x100064f9c
mov ecx, 0x65b
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
jmp 0x100064fa1
mov ebx, 1
mov rcx, rbp
call fcn.10001fba0
mov eax, ebx
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100064fdc
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov r12, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx + 0x20]
xor ebx, ebx
cmp rcx, rbx
je 0x100065012
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi + 0x20], rbx
cmp qword [rdi + 0x20], rbx
jne 0x100065046
lea rcx, [rdi + 0x10]
mov edx, 0x20006
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov qword [rdi + 0x20], rax
cmp rax, 0xffffffffffffffff
jne 0x100065046
mov qword [rdi + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
jmp 0x1000650c0
mov ebp, ebx
cmp qword [r12 + 0x10], rbx
jne 0x100065060
mov rdx, qword [rsi]
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebp, eax
jmp 0x1000650a8
mov dword [rsp + 0x70], ebx
lea rdx, [rsp + 0x70]
mov rcx, r12
call fcn.100034e1c
mov r12, rax
cmp rax, rbx
je 0x1000650a8
mov eax, dword [rsp + 0x70]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, eax
mov rcx, r12
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rdi + 0x20]
cmp rcx, rbx
je 0x1000650bb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi + 0x20], rbx
cmp ebp, ebx
sete bl
mov rcx, rsi
call fcn.10001fba0
mov eax, ebx
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x100065690
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov rdi, rcx
lea rcx, [0x100014f18]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rdi + 0x18], rax
jne 0x1000656d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100014f30]
mov ecx, 3
mov ebx, eax
call fcn.10003c3c0
jmp 0x100065777
lea rdx, [0x100014f68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rdi + 0x30], rax
je 0x10006576f
mov rcx, qword [rdi + 0x18]
lea rdx, [0x100014f80]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rdi + 0x20], rax
je 0x10006576f
mov rcx, qword [rdi + 0x18]
lea rdx, [0x100014f98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rdi + 0x28], rax
je 0x10006576f
mov rcx, qword [rdi + 0x18]
lea rdx, [0x100014fb0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rdi + 0x38], rax
je 0x10006576f
mov rcx, qword [rdi + 0x18]
lea rdx, [0x100014fc0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rdi + 0x40], rax
je 0x10006576f
mov rcx, qword [rdi + 0x18]
lea rdx, [0x100014fd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rdi + 0x48], rax
jne 0x10006578c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x10006578c
lea rdx, [0x100014fe0]
mov ecx, 3
call fcn.10003c3c0
mov eax, ebx
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x100068198
Capabilities:
Check mutex on windows
Create directory
Get common file path
Get program files directory

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x2c8
mov rax, qword [0x100082138]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
xor ebx, ebx
mov esi, ebx
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x60], ebx
xor edx, edx
lea r8d, [rbx + 0x28]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x38], ebx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
cmp dword [0x100083758], ebx
je 0x1000681f2
mov edi, ebx
jmp 0x10006839c
lea rcx, [rsp + 0x60]
call fcn.100068598
cmp eax, ebx
jne 0x10006839e
lea r8, [0x100006250]
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r12, rax
mov qword [rsp + 0x58], rax
cmp rax, rbx
jne 0x10006823e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.1000309dc
mov eax, ebx
jmp 0x10006839e
lea rcx, [rsp + 0x60]
call fcn.1000309dc
nop
mov edx, 0xffffffff
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x100068273
cmp eax, 0x80
je 0x100068273
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x30], eax
jmp 0x10006837a
mov esi, 1
mov dword [rsp + 0x34], esi
cmp dword [0x100083758], ebx
je 0x10006828f
mov edi, ebx
mov dword [rsp + 0x30], ebx
jmp 0x10006837a
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
lea edx, [r8 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
je 0x1000682be
mov qword [rsp + 0x90], rbx
mov eax, esi
jmp 0x1000682cb
lea rcx, [rsp + 0xa0]
call fcn.10006849c
cmp eax, ebx
je 0x1000682dd
mov edi, 0x6e
mov dword [rsp + 0x30], edi
jmp 0x10006837a
mov edi, ebx
mov qword [rsp + 0x50], rbx
xor r9d, r9d
lea r8, [rsp + 0x50]
mov edx, esi
lea rcx, [0x1000151f0]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
cmp eax, ebx
jne 0x100068308
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x10006831e
mov dword [rsp + 0x38], 0x18
mov dword [rsp + 0x48], ebx
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
cmp edi, ebx
je 0x100068328
mov dword [rsp + 0x30], edi
jmp 0x10006837a
lea rdx, [rsp + 0x38]
lea rcx, [0x1000832b0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x30], eax
cmp eax, ebx
je 0x100068351
cmp eax, 0xb7
jne 0x10006835d
mov edi, ebx
mov dword [rsp + 0x30], ebx
mov dword [0x100083758], esi
mov rcx, qword [rsp + 0x40]
cmp rcx, rbx
je 0x10006836d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x40], rbx
cmp esi, ebx
je 0x100068393
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp eax, ebx
jne 0x100068393
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.10006b1f0
add rsp, 0x2c8
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x100068c20
Capabilities:
Get file size

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], r8
mov rsi, r9
mov r9d, 3
mov rdi, r8
lea r8d, [r9 - 2]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x1388
mov dword [rsp + 0x20], 0
call fcn.100068b9c
test eax, eax
mov ebx, eax
jne 0x100068c6a
mov rcx, qword [rdi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsi], eax
mov eax, ebx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x100068c7c
Capabilities:
Read file via mapping

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov ebx, edx
mov rsi, r9
xor r9d, r9d
mov rdi, r8
lea r8d, [r9 + 2]
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
mov qword [rdi], rax
je 0x100068cee
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
mov qword [rsi], rax
je 0x100068cd4
xor eax, eax
jmp 0x100068cf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], 0
jmp 0x100068cf6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x100068e74
Capabilities:
Clear file content

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
test r8, r8
mov rsi, rdx
mov rdi, rcx
mov ebx, 1
je 0x100068e97
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, eax
test rsi, rsi
je 0x100068eb6
test ebx, ebx
je 0x100068eb4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100068eb4
mov ebx, 1
jmp 0x100068eb6
xor ebx, ebx
cmp rdi, 0xffffffffffffffff
je 0x100068ec5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, ebx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret