joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140083890
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rbx, rcx
nop word [rax + rax]
mov edx, 1
lea rcx, [rbp + 0x18]
mov r9, rbx
mov r8d, edx
mov byte [rbp + 0x18], 0
call fcn.1400fabdc
movzx edi, byte [rbp + 0x18]
cmp dil, 0x23
jne 0x140083950
nop dword [rax]
nop word [rax + rax]
mov edx, 1
lea rcx, [rbp + 0x18]
mov r9, rbx
mov r8d, edx
mov byte [rbp + 0x18], 0
call fcn.1400fabdc
cmp byte [rbp + 0x18], 0xa
je 0x140083929
nop
mov rcx, rbx
call fcn.1400fa96c
test eax, eax
jne 0x14008394d
mov edx, 1
lea rcx, [rbp + 0x18]
mov r9, rbx
mov r8d, edx
mov byte [rbp + 0x18], al
call fcn.1400fabdc
cmp byte [rbp + 0x18], 0xa
jne 0x140083900
mov edx, 1
lea rcx, [rbp + 0x18]
mov r9, rbx
mov r8d, edx
mov byte [rbp + 0x18], 0
call fcn.1400fabdc
movzx edi, byte [rbp + 0x18]
cmp dil, 0x23
je 0x1400838e0
jmp 0x140083950
xor dil, dil
movsx ecx, dil
call fcn.1400f9198
test eax, eax
jne 0x1400838b0
movsx esi, dil
sub esi, 0x30
nop dword [rax + rax]
mov edx, 1
lea rcx, [rbp + 0x18]
mov r9, rbx
mov r8d, edx
mov byte [rbp + 0x18], 0
call fcn.1400fabdc
movzx eax, byte [rbp + 0x18]
cmp al, 0x23
jne 0x1400839fd
mov edx, 1
lea rcx, [rbp + 0x18]
mov r9, rbx
mov r8d, edx
mov byte [rbp + 0x18], 0
call fcn.1400fabdc
cmp byte [rbp + 0x18], 0xa
je 0x1400839d9
nop
mov rcx, rbx
call fcn.1400fa96c
test eax, eax
jne 0x1400839fb
mov edx, 1
lea rcx, [rbp + 0x18]
mov r9, rbx
mov r8d, edx
mov byte [rbp + 0x18], al
call fcn.1400fabdc
cmp byte [rbp + 0x18], 0xa
jne 0x1400839b0
mov edx, 1
lea rcx, [rbp + 0x18]
mov r9, rbx
mov r8d, edx
mov byte [rbp + 0x18], 0
call fcn.1400fabdc
movzx eax, byte [rbp + 0x18]
cmp al, 0x23
je 0x140083990
jmp 0x1400839fd
xor al, al
movsx edi, al
mov ecx, edi
call fcn.1400f909c
test eax, eax
je 0x140083a19
lea eax, [rsi + rsi*4]
lea esi, [rax - 0x18]
lea esi, [rdi + rsi*2]
jmp 0x140083970
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret

Function at 0x140083a30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
xor r8d, r8d
xor edx, edx
mov rsi, r9
mov rbp, rcx
call fcn.1400fad50
mov edx, 1
lea rcx, [rsp + 0x38]
mov r8d, edx
mov r9, rbp
mov byte [rsp + 0x38], 0
call fcn.1400fabdc
movzx eax, byte [rsp + 0x38]
mov edx, 1
lea rcx, [rsp + 0x38]
mov r9, rbp
mov r8d, edx
mov dword [rbx], eax
mov byte [rsp + 0x38], 0
call fcn.1400fabdc
movzx eax, byte [rsp + 0x38]
mov rcx, rbp
mov dword [rdi], eax
call fcn.140083890
mov rcx, rbp
mov dword [rsi], eax
call fcn.140083890
cmp dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x50]
mov dword [rcx], eax
jne 0x140083acb
mov rcx, rbp
call fcn.140083890
mov rcx, qword [rsp + 0x58]
mov dword [rcx], eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140085ce0
Capabilities:
Read .ini file

Disassembly:
test rcx, rcx
je 0x140085de6
push rbx
sub rsp, 0x30
mov qword [rsp + 0x40], rsi
mov rbx, rcx
mov qword [rsp + 0x48], rdi
lea rdi, [0x140208860]
mov esi, 1
lea rdx, [0x14018a548]
lea rcx, [0x14018a2f0]
mov r9, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r8d, [rsi + 8]
lea rdx, str.Size
lea rcx, [0x14018a2f0]
mov r9, rdi
mov word [rbx + 0x4c], ax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r8d, [rsi + 6]
lea rdx, [0x14018a558]
lea rcx, [0x14018a2f0]
mov r9, rdi
mov word [rbx + 0x4e], ax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r8d, [rsi + 1]
lea rdx, [0x1401869b0]
lea rcx, [0x14018a2f0]
mov r9, rdi
mov word [rbx + 0x58], ax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea rdx, [0x14018a560]
lea rcx, [0x14018a2f0]
mov r9, rdi
mov r8d, esi
mov word [rbx + 0x5c], ax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r9, [rbx + 0x66]
lea r8, [0x14018a398]
lea rdx, [0x14018a570]
lea rcx, [0x14018a2f0]
mov qword [rsp + 0x28], rdi
mov word [rbx + 0x5e], ax
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rdi, qword [rsp + 0x48]
mov word [rbx + 0x56], si
mov rsi, qword [rsp + 0x40]
mov dword [rbx + 0x48], 0x13b03
add rsp, 0x30
pop rbx
ret
Function at 0x140086910
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x2c8
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x20]
or rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140086942
cmp word [rsp + rax*2 + 0x1e], 0x5c
je 0x140086973
lea rcx, [rsp + 0x20]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140086960
mov eax, dword [0x140181e84]
mov dword [rcx], eax
lea rax, [rsp + 0x20]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140086980
movzx ecx, word [0x14018a668]
movups xmm0, xmmword [0x14018a650]
movsd xmm1, qword [0x14018a660]
movups xmmword [rax], xmm0
movsd qword [rax + 0x10], xmm1
mov word [rax + 0x18], cx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x2c8
ret
Function at 0x14008b490
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rdi, rdx
mov rbx, rcx
lea rdx, [0x14018b240]
lea rcx, [rsp + 0x40]
call fcn.1400f98c8
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008b578
lea rdx, [0x140185df8]
lea rcx, [rsp + 0x250]
mov r8, rbx
call fcn.1400f98c8
lea r8, [0x140209d60]
lea rdx, str._s._s
lea rcx, [rsp + 0x40]
mov r9, rdi
call fcn.1400f98c8
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
nop
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14008b530
lea ecx, [rax*2 + 2]
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x250]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0x490]
add rsp, 0x470
pop rdi
ret
Function at 0x14008c930
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.1400ec530
cmp eax, 6
jl 0x14008c984
lea r9, str._name_Microsoft.DefaultPrograms__page_pageDefaultProgram
lea r8, str.control.exe
lea rdx, str.open
mov rcx, rbx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x140190170]
lea rcx, [0x1401901a0]
lea r8d, [rdx + 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14008c9d2
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14008c9d2
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14008cbb0
Capabilities:
Move file
Read file on windows
Write file on windows

Disassembly:
push rbx
push rdi
push r14
mov eax, 0x1af0
call fcn.1400f9a20
sub rsp, rax
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x1ad0], rax
lea rdx, [0x140183378]
mov r14, rcx
mov ebx, 1
call fcn.1400fafe4
mov rdi, rax
test rax, rax
je 0x14008cdfe
mov qword [rsp + 0x1b18], rbp
mov qword [rsp + 0x1ae8], r12
lea edx, [rbx + 1]
lea rcx, [rsp + 0x30]
xor r12d, r12d
mov r9, rax
mov r8d, ebx
mov qword [rsp + 0x1ae0], r15
mov ebp, r12d
call fcn.1400fabdc
mov r15d, 0xfeff
cmp word [rsp + 0x30], r15w
je 0x14008cda5
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x1b20], rsi
call fcn.1400fad50
lea r8d, [rbx + 2]
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1400ed200
lea rax, [rsp + 0x40]
sub rax, 2
cmp word [rax + 2], bp
lea rax, [rax + 2]
jne 0x14008cc66
mov ecx, dword [0x14018cd00]
movups xmm0, xmmword [str.i_view64.ini_temp]
movups xmm1, xmmword [0x14018ccf0]
lea rdx, [0x140183390]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov dword [rax + 0x20], ecx
lea rcx, [rsp + 0x40]
call fcn.1400fafe4
mov rsi, rax
test rax, rax
je 0x14008cd9d
lea rcx, [rsp + 0x30]
mov r9, rax
mov r8, rbx
mov edx, 2
mov word [rsp + 0x30], r15w
call fcn.1400faf54
lea rcx, str.__UNICODE_FILE___edit_with_care_____r_n_r_n
mov rdx, rsi
call fcn.1400ff480
lea rcx, [rsp + 0x2d0]
xor edx, edx
mov r8d, 0x800
call fcn.1400f9ab0
lea rcx, [rsp + 0x2d0]
mov r8, rdi
mov edx, 0x800
call fcn.1400fe554
test rax, rax
je 0x14008cd95
nop dword [rax + rax]
lea rcx, [rsp + 0xad0]
xor edx, edx
mov r8d, 0x1000
call fcn.1400f9ab0
lea rax, [rsp + 0xad0]
lea r8, [rsp + 0x2d0]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rsp + 0xad0]
mov rdx, rsi
call fcn.1400ff480
lea rcx, [rsp + 0x2d0]
xor edx, edx
mov r8d, 0x800
inc ebp
call fcn.1400f9ab0
lea rcx, [rsp + 0x2d0]
mov r8, rdi
mov edx, 0x800
call fcn.1400fe554
test rax, rax
jne 0x14008cd10
mov rcx, rsi
call fcn.1400fa904
mov rsi, qword [rsp + 0x1b20]
mov rcx, rdi
call fcn.1400fa904
mov r15, qword [rsp + 0x1ae0]
test ebp, ebp
mov rbp, qword [rsp + 0x1b18]
jle 0x14008cdd8
lea rcx, [rsp + 0x40]
mov r8d, ebx
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
cmove ebx, r12d
mov r12, qword [rsp + 0x1ae8]
mov eax, ebx
mov rcx, qword [rsp + 0x1ad0]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x1af0
pop r14
pop rdi
pop rbx
ret
mov eax, ebx
jmp 0x14008cde2
Function at 0x14008d990
Capabilities:
Hide graphical window

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x190
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x1e8]
mov r14, qword [rsp + 0x1f8]
mov ebp, r9d
mov esi, r8d
movsxd rdi, edx
mov rbx, rcx
test rax, rax
je 0x14008d9f3
lea rdx, [rsp + 0x40]
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
lea rax, [rax + 2]
mov word [rdx + rax - 2], cx
test cx, cx
jne 0x14008d9e0
jmp 0x14008da12
mov edx, dword [rsp + 0x1e0]
mov rcx, qword [0x1401fbba0]
lea r8, [rsp + 0x40]
mov r9d, 0x80
call qword [sym.imp.USER32.dll_LoadStringW]
mov edx, 0xc89
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rcx, rax
mov edx, 0x180
call qword [sym.imp.USER32.dll_SendMessageW]
movzx edx, word [rsp + 0x1f0]
mov rcx, qword [0x1401fbba0]
mov r9, r14
mov r8, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_CreateDialogParamW]
lea rbx, [rdi*8]
lea rdi, [0x140000000]
mov rcx, rax
xor edx, edx
mov qword [rbx + rdi + 0x207d80], rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + rdi + 0x207d80]
mov dword [rsp + 0x30], 5
mov r9d, ebp
mov r8d, esi
mov rdx, 0xfffffffffffffffe
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [rbx + rdi + 0x207d80]
mov edx, 5
call qword [sym.imp.USER32.dll_GetWindow]
lea rbx, [rbx + 0x1fc160]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rax
mov qword [rbx + rdi], rax
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 8
jae 0x14008db1e
nop dword [rax + rax]
mov rcx, qword [rbx + rdi]
mov edx, 2
call qword [sym.imp.USER32.dll_GetWindow]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x87
mov qword [rbx + rdi], rax
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 8
jb 0x14008daf0
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x190
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140090900
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x450], rax
test r8d, r8d
mov esi, r9d
mov rbx, rdx
mov r8, rcx
mov rdi, rcx
je 0x1400909fe
lea rdx, [0x14018aff0]
lea rcx, [rsp + 0x240]
call fcn.1400f98c8
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x240]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140090996
mov rcx, qword [rsp + 0x30]
lea rdx, [0x14018b070]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x490], 0
je 0x140090a6e
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140092f90
test eax, eax
je 0x140090a6e
lea rdx, [0x14018b148]
lea rcx, [rsp + 0x40]
mov r8, rdi
call fcn.1400f98c8
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400909d1
add eax, eax
lea rdx, [rsp + 0x40]
mov r9, rbx
mov r8d, 1
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
jmp 0x140090a6e
lea rdx, [0x14018b148]
lea rcx, [rsp + 0x40]
call fcn.1400f98c8
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x140090a13
add eax, eax
lea rdx, [rsp + 0x40]
mov r9, rbx
mov r8d, 1
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
test esi, esi
je 0x140090a6e
lea rdx, [0x14018b080]
lea rcx, [rsp + 0x240]
mov r8, rdi
call fcn.1400f98c8
lea rdx, [rsp + 0x240]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, [0x140209d60]
lea rdx, [0x14018b1f0]
lea rcx, [rsp + 0x40]
mov r9, rdi
call fcn.1400f98c8
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, [0x140209d60]
lea rdx, [0x14018b2b0]
lea rcx, [rsp + 0x40]
mov r9, rdi
call fcn.1400f98c8
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, [0x140209d60]
lea rdx, [0x14018b310]
lea rcx, [rsp + 0x40]
mov r9, rdi
call fcn.1400f98c8
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, [0x140209d60]
lea rdx, [0x14018b358]
lea rcx, [rsp + 0x40]
mov r9, rdi
call fcn.1400f98c8
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, [0x140209d60]
lea rdx, [0x14018b178]
lea rcx, [rsp + 0x40]
mov r9, rdi
call fcn.1400f98c8
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400f9a80
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140092470
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rdx
mov edx, 0x5e4
mov rdi, r9
mov rsi, r8
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x1400925fe
mov r8d, 0x104
mov rdx, rbp
xor ecx, ecx
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x14018ae40]
mov r8, rbp
mov rcx, rsi
call fcn.1400f98c8
mov rcx, qword [0x1401fbba0]
mov r9d, 0x40
mov r8, rdi
mov edx, 0x509
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [0x14018abe0]
mov r8, rdi
mov rcx, rbp
call fcn.1400f98c8
or rbx, 0xffffffffffffffff
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140092500
add eax, eax
mov r9, rdi
mov r8d, 1
mov rdx, rbp
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
lea rdx, [0x14018ae70]
mov r8, rdi
mov rcx, rbp
call fcn.1400f98c8
mov rax, rbx
nop
inc rax
cmp word [rsi + rax*2], 0
jne 0x140092540
add eax, eax
mov r9, rsi
mov r8d, 1
mov rdx, rbp
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
lea rdx, [0x14018aed0]
mov r8, rdi
mov rcx, rbp
call fcn.1400f98c8
mov rax, rbx
nop
inc rax
cmp word [rdi + rax*2], 0
jne 0x140092580
add eax, eax
mov r9, rdi
mov r8d, 1
mov rdx, rbp
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
lea rdx, [0x14018af10]
mov r8, rdi
mov rcx, rbp
call fcn.1400f98c8
nop dword [rax + rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400925c0
add ebx, ebx
mov r9, rsi
mov r8d, 1
mov rdx, rbp
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [0x1401fbba0]
mov r9d, 0x40
mov r8, rdi
mov edx, 0x509
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [0x14018ae70]
mov r8, rdi
mov rcx, rsi
call fcn.1400f98c8
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [0x14018abe0]
mov r8, rdi
mov rcx, rsi
call fcn.1400f98c8
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [0x14018af10]
mov r8, rdi
mov rcx, rsi
call fcn.1400f98c8
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [0x14018aed0]
mov r8, rdi
mov rcx, rsi
call fcn.1400f98c8
mov rdx, rsi
mov rcx, 0xffffffff80000002
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
Function at 0x1400926c0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.1400e97f0
test ebx, ebx
je 0x14009272e
lea rax, [0x140208860]
lea r9, [rsp + 0x240]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.TTF_text
lea rcx, str.Plugins
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x140092746
xor eax, eax
movzx edx, word [rsp + rax + 0x30]
lea rax, [rax + 2]
mov word [rsp + rax + 0x23e], dx
test dx, dx
jne 0x140092730
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
mov r9d, 0xffa7
mov r8d, 0x104
call fcn.1400ef1d0
lea r8, [rsp + 0x30]
mov edx, 0x7b4
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0x478]
add rsp, 0x460
pop rdi
ret

Function at 0x1400927a0
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rdx
mov edx, 0x5e5
mov rdi, r9
mov rsi, r8
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x1400928ae
mov r8d, 0x104
mov rdx, rbp
xor ecx, ecx
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, str.__s_____1_
mov r8, rbp
mov rcx, rsi
call fcn.1400f98c8
mov rcx, qword [0x1401fbba0]
mov r9d, 0x40
mov r8, rdi
mov edx, 0x508
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [0x14018af60]
mov r8, rdi
mov rcx, rbp
call fcn.1400f98c8
or rbx, 0xffffffffffffffff
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140092830
add eax, eax
mov r9, rdi
mov r8d, 1
mov rdx, rbp
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
lea rdx, [0x14018afa0]
mov r8, rdi
mov rcx, rbp
call fcn.1400f98c8
nop dword [rax + rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140092870
add ebx, ebx
mov r9, rsi
mov r8d, 1
mov rdx, rbp
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [0x1401fbba0]
mov r9d, 0x40
mov r8, rdi
mov edx, 0x508
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [0x14018afa0]
mov r8, rdi
mov rcx, rsi
call fcn.1400f98c8
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [0x14018ac28]
mov r8, rdi
mov rcx, rsi
call fcn.1400f98c8
mov rdx, rsi
mov rcx, 0xffffffff80000002
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
Function at 0x140092920
Capabilities:
Read .ini file

Disassembly:
push rsi
push r12
push r14
sub rsp, 0x4a0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r14d, r9d
mov qword [rsp + 0x40], r8
mov r12d, edx
test edx, edx
je 0x140092969
lea r8, [rsp + 0x260]
mov r9d, 0x103
mov edx, 0x681
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
jmp 0x1400929a0
lea rax, [0x140208860]
lea r9, [rsp + 0x260]
lea r8, [0x14018b880]
mov qword [rsp + 0x28], rax
lea rdx, [0x14018b898]
lea rcx, [0x14018ade0]
mov dword [rsp + 0x20], 0x103
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x260]
call fcn.1400e4830
xor edx, edx
lea rcx, [rsp + 0x260]
mov esi, edx
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], dx
jne 0x1400929c0
test eax, eax
jle 0x140092bcc
mov qword [rsp + 0x4c8], rbx
mov qword [rsp + 0x498], rbp
mov ebp, dword [rsp + 0x4e0]
mov qword [rsp + 0x490], rdi
mov qword [rsp + 0x488], r13
mov r13d, dword [rsp + 0x4f0]
mov qword [rsp + 0x480], r15
mov r15d, dword [rsp + 0x4e8]
mov rbx, rdx
lea rdi, [rsp + 0x260]
nop dword [rax + rax]
movzx eax, word [rdi]
cmp ax, 0x7c
je 0x140092a36
mov word [rsp + rbx*2 + 0x50], ax
inc rbx
jmp 0x140092b80
lea rax, [rbx + rbx]
cmp rax, 0x208
jae 0x140092be9
lea rcx, [rsp + 0x50]
mov word [rsp + rax + 0x50], dx
mov rbx, rdx
call fcn.1400e8f30
lea rcx, [rsp + 0x50]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140092a61
test rax, rax
je 0x140092b7e
lea rdx, [0x14018b850]
lea rcx, [rsp + 0x50]
call fcn.1400f92fc
test eax, eax
je 0x140092b7e
lea rdx, [0x140187b10]
lea rcx, [rsp + 0x50]
call fcn.1400f92fc
test eax, eax
je 0x140092b7e
lea rdx, [0x14018b858]
lea rcx, [rsp + 0x50]
call fcn.1400f92fc
test eax, eax
je 0x140092b7e
lea rdx, [0x14018b860]
lea rcx, [rsp + 0x50]
call fcn.1400f92fc
test eax, eax
je 0x140092b7e
lea rdx, [0x14018b868]
lea rcx, [rsp + 0x50]
call fcn.1400f92fc
test eax, eax
je 0x140092b7e
lea rdx, [0x14018b870]
lea rcx, [rsp + 0x50]
call fcn.1400f92fc
test eax, eax
je 0x140092b7e
lea rdx, [0x14018b878]
lea rcx, [rsp + 0x50]
call fcn.1400f92fc
test eax, eax
je 0x140092b7e
lea rcx, [rsp + 0x50]
test r12d, r12d
je 0x140092b53
mov r8, qword [rsp + 0x40]
mov dword [rsp + 0x38], r15d
lea rax, [0x140181e34]
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x50]
mov r9d, r13d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call fcn.14008b6c0
jmp 0x140092b7e
mov r8d, ebp
mov edx, r14d
call fcn.140092f90
test eax, eax
je 0x140092b7e
lea rdx, [0x140181e34]
lea rcx, [rsp + 0x50]
mov r9d, ebp
mov r8d, r14d
mov dword [rsp + 0x20], r15d
call fcn.140090900
xor edx, edx
inc esi
add rdi, 2
lea rcx, [rsp + 0x260]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140092b92
cmp esi, eax
jl 0x140092a20
mov r13, qword [rsp + 0x488]
mov rdi, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x498]
mov rbx, qword [rsp + 0x4c8]
mov r15, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x4a0
pop r14
pop r12
pop rsi
ret
call fcn.1400f8f44
int3