joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b96c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x340], rax
mov edi, 0x104
lea rcx, [rbp + 0x130]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edx, 0xf467ce1f
mov r8d, 0x61585691
mov ecx, 0xdc335740
call fcn.140001390
lea r9, [0x140129d88]
lea r8, [rbp + 0x130]
lea rcx, [rsp + 0x20]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x20]
call fcn.140022910
test al, al
jne 0x14000ba46
mov rcx, qword [0x140175a98]
lea r8, [rsp + 0x20]
mov r9d, edi
mov edx, InitCommonControls
call fcn.140023b00
test eax, eax
jne 0x14000ba28
movzx edx, word [0x140169e4c]
lea r8, [rsp + 0x20]
lea rcx, [0x140169e4e]
xor edx, 0xbfbf
mov r9d, edi
call fcn.140012e14
lea r8, [0x140129d88]
lea rdx, [rsp + 0x20]
mov r9d, InitCommonControls
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x14000babe
call fcn.140008990
mov ebx, eax
call fcn.140008ac8
test ebx, ebx
je 0x14000bae2
test eax, eax
je 0x14000bae2
lea rdx, [rsp + 0x20]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x20]
mov edx, 0x5c
call fcn.1400e9f08
test rax, rax
je 0x14000bab9
mov edx, 0x1d4c8e7
mov r8d, 0x6b24194b
mov ecx, 0x8cb09a1f
call fcn.140001438
lea rcx, [rsp + 0x20]
mov r9d, 1
mov rdx, rax
xor r8d, r8d
call fcn.1400225b8
test eax, eax
jne 0x14000bb87
mov eax, 1
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov rcx, qword [0x140175a98]
lea r8, [rsp + 0x20]
mov r9d, edi
mov edx, InitCommonControls
call fcn.140023b00
test eax, eax
jne 0x14000bb20
movzx edx, word [0x140169ed4]
lea r8, [rsp + 0x20]
lea rcx, [0x140169ed6]
xor edx, 0xbfbf
mov r9d, edi
call fcn.140012e14
lea r8, [0x140129d88]
lea rdx, [rsp + 0x20]
mov r9d, 0x14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x14000bab9
lea rdx, [rsp + 0x20]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x654a6bc
mov r8d, 0x6ca47710
mov ecx, 0x8b30f432
call fcn.140001438
lea rcx, [rsp + 0x20]
mov r9d, 1
mov rdx, rax
xor r8d, r8d
call fcn.1400225b8
cmp eax, 0x64
jne 0x14000bab9
call fcn.14000b8d0
jmp 0x14000ba42
Function at 0x14000c178
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x340]
sub rsp, 0x440
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x330], rax
mov edx, 0x162adaeb
mov ecx, 0x9b4e8b1f
mov r8d, 0x7cda0b4c
call fcn.140001438
mov edx, 0x193fc0a6
mov ecx, 0x945b912c
mov r8d, 0x73cf1102
mov rbx, rax
call fcn.140001438
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
test rax, rax
je 0x14000c28c
mov rcx, qword [0x140175a98]
lea r8, [rsp + 0x30]
mov r9d, 0x100
mov edx, 0x12
call fcn.140023b00
test eax, eax
jne 0x14000c227
movzx edx, word [0x140169ffc]
lea r8, [rsp + 0x30]
lea rcx, [0x140169ffe]
xor edx, 0xbfbf
mov r9d, 0x100
call fcn.140012e14
mov edx, 0x65eddee
mov ecx, 0x8b3a8c3a
mov r8d, 0x6cae0c49
call fcn.140001438
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x130]
mov r8, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [0x140129d88]
lea rdx, [rbp + 0x130]
mov r9d, 0x40034
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
Function at 0x14000d170
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdx, qword [0x140175b50]
mov rbx, rcx
lea r8, [rbp - 0x18]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000d277
mov rdx, qword [0x140175b58]
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
lea r9, [rbp - 0x20]
xor r8d, r8d
mov dword [rbp - 0x20], 3
mov dword [rbp - 0x1c], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000d1f6
mov eax, dword [rbp - 0x10]
mov dword [rbx + 0x24], eax
mov eax, dword [rbp - 0xc]
mov dword [rbx + 0x28], eax
mov rdx, qword [0x140175b60]
lea rcx, [rbp - 0x1c]
lea rax, [rbx + 0x20]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 0x18]
lea r9, [rbp - 0x20]
xor r8d, r8d
mov dword [rbp - 0x20], 4
mov dword [rbp - 0x1c], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, 0x83156b25
mov r8d, 0x2da90421
mov ecx, 0xf58cb10c
mov dword [rbp - 0x20], 4
mov dword [rbp - 0x1c], 4
add rbx, 0x34
call fcn.1400014e0
mov rcx, qword [rbp - 0x18]
mov rdx, rax
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x14000d59c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, rdx
xor edi, edi
mov word [rdx + 8], di
lea edx, [rdi + 4]
mov rcx, rbx
call fcn.14000d298
test al, al
je 0x14000d62d
mov edx, 0xb7e2cad8
mov ecx, 0xc17b110b
mov r8d, 0x195ea5d1
call fcn.1400014e0
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
movzx r8d, word [rcx + rax]
sub edx, r8d
jne 0x14000d5f4
add rcx, 2
test r8d, r8d
jne 0x14000d5de
test edx, edx
je 0x14000d62d
mov edx, 0xe9f08721
mov ecx, 0x9f695ce6
mov r8d, 0x474ce828
call fcn.1400014e0
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
movzx r8d, word [rcx + rax]
sub edx, r8d
jne 0x14000d629
add rcx, 2
test r8d, r8d
jne 0x14000d613
test edx, edx
jne 0x14000d658
mov edx, 0xd4fcf7d1
mov ecx, 0xa2652c2a
mov r8d, 0x7a4098d8
call fcn.1400014e0
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000d648
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14000d8c0
test eax, eax
je 0x14000d6ac
mov edx, 0x1c3cc9d9
mov ecx, 0x6aa51236
mov r8d, 0xb280a6de
call fcn.1400014e0
mov rcx, qword [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000d6bc
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, rdx
xor edi, edi
mov word [rdx + 0xa], di
lea edx, [rdi + 5]
mov rcx, rbx
call fcn.14000d298
test al, al
je 0x14000d718
mov edx, 0x3bb84964
mov ecx, 0x4d219273
mov r8d, 0x9504266e
call fcn.1400014e0
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
movzx r8d, word [rcx + rax]
sub edx, r8d
jne 0x14000d714
add rcx, 2
test r8d, r8d
jne 0x14000d6fe
test edx, edx
jne 0x14000d743
mov edx, 0xe4e6d76e
mov ecx, 0x927f0c67
mov r8d, 0x4a5ab864
call fcn.1400014e0
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000d733
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14000d8c0
test eax, eax
je 0x14000d797
mov edx, 0x48863de5
mov ecx, 0x3e1fe6de
mov r8d, 0xe63a52e5
call fcn.1400014e0
mov rcx, qword [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x28], InitCommonControls
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14000d7a4
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, qword [0x140175b50]
mov rbx, rcx
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000d847
mov eax, dword [rbx + 0x24]
mov rdx, qword [0x140175b58]
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 0x28]
mov r9d, 3
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x38]
xor r8d, r8d
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000d81e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [0x140175b60]
mov rcx, qword [rsp + 0x30]
lea rax, [rbx + 0x20]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x50
pop rbx
ret
Function at 0x14000d96c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor esi, esi
xor edx, edx
mov word [rcx], si
lea rcx, [rsp + 0x30]
call fcn.14000d8c0
test eax, eax
je 0x14000d9c9
mov edx, 0x4f46cfc0
mov ecx, 0x39df14b3
mov r8d, 0xe1faa0c6
call fcn.1400014e0
mov rcx, qword [rsp + 0x30]
mov r9d, 0x104
mov rdx, rax
mov r8, rdi
call fcn.14000d124
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rdi], si
jne 0x14000da05
mov rcx, rdi
call fcn.14000dfa8
mov edx, 0xf19dc162
mov ecx, 0x870418f5
mov r8d, 0x5f21ae6a
mov rbx, rax
call fcn.1400014e0
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], si
jne 0x14000da09
lea rbx, [rdi + rax*2]
mov eax, 0x5c
cmp word [rbx - 2], ax
je 0x14000da2b
mov word [rbx], ax
add rbx, 2
mov word [rbx], si
mov rcx, rdi
call fcn.140022910
test al, al
jne 0x14000da45
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000da58
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rcx, [rsp + 0x58]
xor edx, edx
mov bl, r8b
call fcn.14000d8c0
xor esi, esi
test eax, eax
je 0x14000dad8
test bl, bl
je 0x14000da95
mov edx, 0x84adead
mov ecx, 0x7ed30630
mov r8d, 0xa6f6b1ad
jmp 0x14000daa5
mov edx, 0xf2d270f2
mov ecx, 0x844ba871
mov r8d, 0x5c6e1ff8
call fcn.1400014e0
mov rcx, qword [rsp + 0x58]
mov r9d, 0x104
mov rdx, rax
mov r8, rdi
call fcn.14000d124
mov rcx, qword [rsp + 0x58]
mov bl, al
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x14000dad8
mov al, 1
jmp 0x14000db9f
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x1a]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14000db37
mov edx, 0xa2d0eede
mov ecx, 0xd449366b
mov r8d, 0xc6c81c2
call fcn.1400014e0
lea rcx, [rdi - 2]
mov r8, rax
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x14000db0f
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x14000db1a
mov rcx, rdi
call fcn.140022910
cmp al, 1
je 0x14000dad1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x23]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14000db9a
mov edx, 0xd12fa677
mov ecx, 0xa7b67ea4
mov r8d, 0x7f93c96b
call fcn.1400014e0
lea rcx, [rdi - 2]
mov r8, rax
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x14000db6e
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x14000db79
mov rcx, rdi
call fcn.140022910
cmp al, 1
je 0x14000dad1
mov word [rdi], si
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000dbb0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rcx
test dl, dl
je 0x14000dbdb
mov edx, 0xca23cf9d
mov ecx, 0xbcba176c
mov r8d, 0x649fa09d
jmp 0x14000dbeb
mov edx, 0x483d207e
mov ecx, 0x3ea4f869
mov r8d, 0xe6814f74
call fcn.1400014e0
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rdi]
lea eax, [rax*2 + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rdi]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegCloseKey]

Function at 0x14000dc3c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov ecx, 0x5a0ce0c0
mov r8d, 0x822957c1
mov edx, 0x2c9538c9
call fcn.1400014e0
lea rcx, [rsp + 0x40]
xor edx, edx
mov rdi, rax
call fcn.14000d8c0
xor ebp, ebp
test eax, eax
je 0x14000dcd2
mov rcx, qword [rsp + 0x40]
mov r9d, 0x104
mov r8, rsi
mov rdx, rdi
call fcn.14000d124
mov rcx, qword [rsp + 0x40]
mov bl, al
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x14000dcd2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rbx, [rsi + rcx*2]
cmp rbx, rsi
je 0x14000dd0b
cmp word [rbx - 2], 0x2f
je 0x14000dd0b
lea eax, [rbp + 0x5c]
cmp word [rbx - 2], ax
je 0x14000dd0b
mov word [rbx], ax
add rbx, 2
jmp 0x14000dd08
mov rcx, rsi
call fcn.14000dfa8
mov rbx, rax
sub rax, rdi
movzx ecx, word [rdi]
mov word [rax + rdi], cx
lea rdi, [rdi + 2]
test cx, cx
jne 0x14000dce0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, 0x5c
add rbx, 8
mov word [rbx - 2], ax
mov word [rbx], bp
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000dd24
Capabilities:
Create directory
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x518]
sub rsp, 0x600
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
movzx edi, dx
movzx eax, dil
sub eax, 0x41
cdqe
lea r14, [0x140175bc0]
mov r14, qword [r14 + rax*8]
test r14, r14
je 0x14000df7e
lea rcx, [rbp + 0xc0]
call fcn.14000d96c
xor edx, edx
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rsi, [rbp + 0xc0]
lea rsi, [rsi + rcx*2]
mov eax, 0x5c
mov word [rsi], ax
lea rcx, [rsp + 0x50]
call fcn.1400204c0
nop
movzx ebx, di
mov edx, 0x49079f08
mov ecx, 0x3f9e473d
mov r8d, 0xe7bbf003
call fcn.1400014e0
mov rdx, rax
mov r8d, ebx
lea rcx, [rsi + 2]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0xc0]
call fcn.140022910
test al, al
je 0x14000df74
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xc0]
call fcn.140022ddc
mov rbx, rax
test rax, rax
je 0x14000df74
mov edx, 0xc7cdd42d
mov r8d, 8
lea rcx, [0x1401689ca]
call fcn.140001468
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x40]
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14002080c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rbx, [r14 + 0xb0]
movsx edi, dil
mov edx, 0x3d5d9752
mov ecx, 0x4bc44f09
mov r8d, 0x93e1f84e
call fcn.1400014e0
mov rdx, rax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edi
lea r9, [0x140129d48]
lea r8, [0x140129d88]
lea rcx, [rsi + 2]
call qword [sym.imp.USER32.dll_wsprintfW]
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [rbp + 0xc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x50]
call fcn.1400216c0
mov edx, 0x5a224f20
mov r8d, InitCommonControls
lea rcx, [0x1401689f6]
call fcn.140001468
lea r8, [rbp + 0x2d0]
mov rdx, rax
lea rcx, [rbp + 0x3e0]
call fcn.1400e9c20
mov edx, 0xf888dc49
mov r8d, 9
lea rcx, [0x140168a0c]
call fcn.140001468
mov rbx, rax
mov edx, 0xdf8d1804
mov r8d, 5
lea rcx, [0x140168a04]
call fcn.140001468
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x3e0]
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rsp + 0x50]
call fcn.14002057c
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000e69c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov r8d, 0x38c83018
mov edx, 0x96745f1c
mov ecx, 0xe0ed8661
mov dword [rsp + 0x58], 3
mov dword [rsp + 0x50], InitCommonControls
call fcn.1400014e0
mov rcx, qword [rdi]
mov rdx, rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rdi]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x50]
xor ecx, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x40]
cmovne eax, ecx
shr rax, 2
add rsp, 0x30
pop rdi
ret

Function at 0x14000e71c
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rcx, [rax + 8]
xor edx, edx
call fcn.14000d8c0
xor esi, esi
test eax, eax
je 0x14000e780
mov edx, 0x42e3b1fb
mov ecx, 0x347a6f16
mov r8d, 0xec5fdef0
call fcn.1400014e0
mov rcx, qword [rsp + 0x40]
mov r9d, 0x104
mov rdx, rax
mov r8, rdi
call fcn.14000d124
mov rcx, qword [rsp + 0x40]
mov bl, al
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x14000e797
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 5]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], si
jne 0x14000e79b
lea rax, [rdi + rax*2]
mov ecx, 0x5c
cmp word [rax - 2], cx
je 0x14000e7bd
mov word [rax], cx
add rax, 2
mov word [rax], si
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000e7d0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rcx, rdx
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea rcx, [rsp + 0x40]
mov edx, 0x5c
call fcn.1400e9f08
xor ebx, ebx
test rax, rax
je 0x14000e81c
mov word [rax], bx
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.14000d8c0
test eax, eax
je 0x14000e887
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x14000e87c
mov edx, 0x6725e97d
mov ecx, 0x11bc3760
mov r8d, 0xc9998676
lea ebx, [rax*2 + 2]
call fcn.1400014e0
mov rcx, qword [rsp + 0x30]
mov rdx, rax
lea rax, [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x260
pop rbx
ret
Function at 0x14000fce0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov qword [rsp + 0x20], rdx
mov edx, ecx
xor esi, esi
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov ebx, esi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14000fd36
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
test eax, eax
jle 0x14000fd36
lea ecx, [rsi + 0x5c]
cmp word [rdi + rbx*2 - 2], cx
je 0x14000fd36
mov word [rdi + rbx*2], cx
inc ebx
movsxd rcx, ebx
mov word [rdi + rcx*2], si
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000fd48
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x30
mov rbx, r8
mov rdx, rcx
lea rax, [rsp + 0x48]
mov rcx, qword [rbx]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x140010544
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov r8d, 0x2d1b4e74
mov ecx, 0x7bbf8522
mov edx, 0xafe3fff9
call fcn.1400015fc
mov r9d, 0x20219
xor r8d, r8d
mov rdx, rax
lea rax, [rbp - 0x28]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140010605
mov byte [rbp - 0x20], al
xor eax, eax
mov edx, 0xbe1a0177
mov r8d, 0x3ce2b0e5
mov ecx, 0x6a467bd2
mov dword [rbp - 0x30], 3
mov qword [rbp - 0x1f], rax
mov dword [rbp - 0x17], eax
mov word [rbp - 0x13], ax
mov byte [rbp - 0x11], al
mov dword [rbp - 0x2c], InitCommonControls
call fcn.1400015fc
mov rcx, qword [rbp - 0x28]
mov rdx, rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
lea r9, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140010605
movups xmm0, xmmword [rbp - 0x20]
movdqu xmmword [rbx], xmm0
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140011078
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x160], rax
movsxd rdi, edx
call fcn.140011250
lea rdx, [rsp + 0x50]
mov ecx, 0x23
call fcn.14000fce0
mov edx, 0xe3a614b2
mov ecx, 0x37fa6d1b
mov r8d, 0x615ea53d
movsxd rbx, eax
call fcn.1400015fc
lea rcx, [rsp + 0x50]
lea rcx, [rcx + rbx*2]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 2]
lea rcx, [rsp + 0x50]
mov edx, 0x40000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001119e
xor eax, eax
lea ecx, [rdi - 1]
mov word [rsp + 0x40], 0x8b88
mov word [rsp + 0x45], ax
mov byte [rsp + 0x47], al
mov byte [rsp + 0x42], 0x8d
cmp ecx, 2
ja 0x140011143
mov al, byte [rsp + rdi + 0x3f]
jmp 0x140011145
mov al, 1
and qword [rsp + 0x20], 0
mov edi, 4
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x44]
mov r8d, edi
mov rcx, rbx
mov byte [rsp + 0x44], al
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
and qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov r8d, edi
mov rcx, rbx
mov word [rsp + 0x41], ax
mov byte [rsp + 0x43], al
mov byte [rsp + 0x40], 0x8c
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140011250
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
lea rdx, [rsp + 0x30]
lea rcx, [0x1400111c4]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400112a0
lea edx, [rbx + 2]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [rbx + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x30]
test rax, rax
setne al
add rsp, 0x20
pop rbx
ret