joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001dccf
Capabilities:
Identify system language via api

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
call qword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
mov esi, eax
test rbx, rbx
je 0x14001de7f
movzx edx, byte [rbx + 1]
xor eax, eax
movzx r9d, si
cmp edx, eax
jle 0x14001dd5e
mov rcx, qword [rbx + 0x10]
mov ecx, dword [rcx + rax*4]
inc rax
cmp ecx, r9d
jne 0x14001dcf7
mov rdi, qword [0x1400b1d20]
mov rbx, qword [0x1400b1d10]
mov edx, 0xffc
lea r8, str.Will_use_default_UI_locale_0x_04X
mov rcx, qword [rdi]
sub rdx, rcx
add rcx, rbx
call qword [sym.imp.msvcrt.dll__snprintf]
mov rcx, rbx
mov byte [rbx + 0xffb], 0
call sub.msvcrt.dll_strlen
lea rdx, [rax + 2]
mov byte [rbx + rax], 0xd
mov byte [rbx + rax + 1], 0xa
mov byte [rbx + rax + 2], 0
mov eax, esi
mov qword [rdi], rdx
jmp 0x14001de29
xor eax, eax
xor esi, esi
lea r12, [0x14001ceec]
mov dword [0x14010b9a8], eax
movzx eax, byte [rbx + 1]
cmp eax, esi
jle 0x14001de2e
mov rax, qword [rbx + 0x10]
lea rbp, [rsp + 0x36]
lea r8, str._04X
mov edx, 5
mov rcx, rbp
lea rdi, [rsi*4]
mov r9d, dword [rax + rsi*4]
inc rsi
call qword [sym.imp.msvcrt.dll__snwprintf]
mov r8, rbp
mov edx, 4
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_EnumUILanguagesW]
cmp dword [0x14010b9a8], 0
je 0x14001dd6f
mov rax, qword [rbx + 0x10]
mov rbp, qword [0x1400b1d20]
mov edx, 0xffc
lea r8, str.Detected_installed_Windows_Language_Pack_for_0x_04X___s_
mov rsi, qword [0x1400b1d10]
mov rcx, qword [rbp]
mov r9d, dword [rax + rdi]
mov rax, qword [rbx + 0x20]
sub rdx, rcx
add rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snprintf]
mov rcx, rsi
mov byte [rsi + 0xffb], 0
call sub.msvcrt.dll_strlen
mov byte [rsi + rax], 0xd
lea rdx, [rax + 2]
mov byte [rsi + rax + 1], 0xa
mov byte [rsi + rax + 2], 0
mov rax, qword [rbx + 0x10]
mov qword [rbp], rdx
mov eax, dword [rax + rdi]
or ah, 4
jmp 0x14001de84
mov rdi, qword [0x1400b1d20]
mov rsi, qword [0x1400b1d10]
mov edx, 0xffc
lea r8, str.NOTE:_No_Windows_Language_Pack_is_installed_for__s_on_this_system._r_nThis_means_that_some_controls_may_still_be_displayed_using_the_system_locale.
mov r9, qword [rbx + 0x20]
mov rcx, qword [rdi]
sub rdx, rcx
add rcx, rsi
call qword [sym.imp.msvcrt.dll__snprintf]
mov rcx, rsi
mov byte [rsi + 0xffb], 0
call sub.msvcrt.dll_strlen
lea rdx, [rax + 2]
mov byte [rsi + rax], 0xd
mov qword [rdi], rdx
mov byte [rsi + rax + 1], 0xa
mov byte [rsi + rax + 2], 0
mov eax, 0x400
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14001e4dc
Capabilities:
Query or enumerate registry value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x188
xor eax, eax
xor r10d, r10d
mov rbx, rcx
lea rdi, [rsp + 0x7c]
mov ecx, 0x41
mov rbp, r8
rep stosd dword [rdi], eax
mov ecx, r9d
mov rdi, r8
mov qword [rsp + 0x68], r10
rep stosb byte [rdi], al
mov rcx, rbx
mov qword [rsp + 0x70], r10
lea r13, [rsp + 0x7c]
mov dword [rsp + 0x60], 0xffffffff
mov dword [rsp + 0x64], r9d
call sub.msvcrt.dll_strlen
mov rcx, rax
mov r12, rax
test r12, r12
je 0x14001e5d1
cmp byte [rbx + r12], 0x5c
je 0x14001e549
dec r12
jmp 0x14001e534
cmp r12, 0x103
ja 0x14001e695
mov eax, 0x104
inc rcx
mov rdi, r13
mov rsi, rbx
cmp rcx, rax
cmova rcx, rax
mov ecx, ecx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov r9d, 0x20019
mov rcx, 0xffffffff80000001
lea rdx, [rax + 1]
cmp rdx, 0x104
mov edx, 0x103
cmovae rax, rdx
xor r8d, r8d
mov rdx, r13
mov byte [rsp + rax + 0x7c], 0
lea rax, [rsp + 0x70]
mov byte [rsp + r12 + 0x7c], 0
inc r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14001e64e
xor r8d, r8d
mov qword [rsp + 0x70], r8
jmp 0x14001e674
lea rax, [rsp + 0x68]
xor r8d, r8d
mov r9d, 0x2001d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
lea rdx, [0x14008cee5]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14001e605
xor ecx, ecx
mov qword [rsp + 0x68], rcx
jmp 0x14001e674
lea rax, [rsp + 0x5c]
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
xor eax, eax
mov dword [rsp + 0x20], edx
lea rdx, [0x14008ceee]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001e5c4
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rbp
lea rdx, [rbx + r12]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001e684
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14001e695
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rsp, 0x188
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14001e6a5
Capabilities:
Set registry value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov esi, edx
mov ebp, r9d
mov edx, 0x5c
xor r9d, r9d
mov qword [rsp + 0x60], r9
mov rbx, rcx
mov rdi, r8
mov qword [rsp + 0x68], r9
call sub.msvcrt.dll_strchr
test rax, rax
je 0x14001e6ee
mov r8d, 0x91
lea rdx, [0x14008cf04]
lea rcx, [0x14008cf1a]
call qword [sym.imp.msvcrt.dll__wassert]
lea rax, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov r9d, 0x2001d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14001e71e
xor r8d, r8d
mov qword [rsp + 0x60], r8
jmp 0x14001e789
lea rax, [rsp + 0x5c]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x30], rdx
lea rdx, [0x14008cf58]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14001e76c
xor eax, eax
mov qword [rsp + 0x68], rax
jmp 0x14001e789
mov dword [rsp + 0x28], ebp
mov rcx, qword [rsp + 0x68]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001e799
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001e7aa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14001e7b3
Capabilities:
Delete file

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.14001e00a
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14001e7df
mov rcx, rbx
call sub.msvcrt.dll_free
mov ecx, esi
add rsp, 0x28
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.DLL_SetLastError]
Function at 0x1400211ec
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov qword [0x14010ba88], rdx
xor edx, edx
mov dword [rsp + 0x20], edx
xor edx, edx
mov qword [0x14010ba80], rcx
xor ecx, ecx
mov qword [0x14010ba90], r8
lea r8, [0x1400211cb]
mov dword [0x14010ba98], r9d
lea r9, [0x14010ba80]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x38
ret

Function at 0x140021236
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp qword [0x14010ba00], 0
mov dword [0x14010bc88], ecx
jne 0x140021288
xor eax, eax
xor edx, edx
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x20], edx
lea r8, [0x14001f4ba]
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov edx, 1
mov qword [0x14010ba00], rax
test rax, rax
jne 0x14002128a
lea rcx, str.Unable_to_start_update_check_thread
call fcn.140036717
xor edx, edx
mov eax, edx
add rsp, 0x38
ret

Function at 0x140021291
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
xor edx, edx
xor r9d, r9d
lea r8, [0x1400202e6]
xor ecx, ecx
mov dword [rsp + 0x20], edx
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rdx, rax
mov eax, 1
test rdx, rdx
jne 0x1400212f9
lea rcx, str.Unable_to_start_Windows_ISO_download_thread
call fcn.140036717
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8007
mov rax, qword [0x1400b1100]
mov dword [rax], 0xe0031205
mov rax, qword [0x1400b19c0]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
add rsp, 0x38
ret
Function at 0x1400250d6
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt
Reference public rsa key

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
lea rsi, [0x14007ce00]
mov r12, rcx
lea rdi, [rsp + 0x4c]
mov ecx, 0x45
mov rbp, r8
rep movsd dword [rdi], dword [rsi]
xor r8d, r8d
lea rcx, [rsp + 0x30]
mov ebx, edx
mov qword [rsp + 0x30], r8
xor edx, edx
mov r13d, r9d
mov r9d, 0x18
mov qword [rsp + 0x38], r8
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000008
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea rdx, [rsp + 0x60]
lea r8, [0x140090800]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x140025153
call fcn.140023fbd
lea rcx, str.PKI:_Could_not_create_the_default_key_container:__s
mov rdx, rax
jmp 0x1400251a7
mov rcx, rax
neg rcx
mov cl, byte [r8 + rcx]
mov byte [rdx + rax], cl
inc rax
cmp rax, 0x100
jne 0x140025153
xor ecx, ecx
lea rax, [rsp + 0x40]
xor r9d, r9d
mov r8d, 0x114
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x4c]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x1400251b3
call fcn.140023fbd
lea rcx, str.PKI:_Could_not_import_public_key:__s
mov rdx, rax
call fcn.140036717
xor ebp, ebp
jmp 0x14002527d
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400251e8
call fcn.140023fbd
lea rcx, str.PKI:_Could_not_create_empty_hash:__s
mov rdx, rax
jmp 0x1400251a7
xor r9d, r9d
mov rcx, qword [rsp + 0x38]
mov r8d, ebx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x140025211
call fcn.140023fbd
lea rcx, str.PKI:_Could_not_hash_data:__s
mov rdx, rax
jmp 0x1400251a7
lea eax, [r13 - 1]
xor edx, edx
cdqe
cmp edx, eax
jge 0x140025237
mov cl, byte [rbp + rdx]
mov r8b, byte [rbp + rax]
mov byte [rbp + rdx], r8b
inc rdx
mov byte [rbp + rax], cl
dec rax
jmp 0x140025219
xor eax, eax
xor edx, edx
mov r9, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rdx
mov r8d, r13d
mov rdx, rbp
mov dword [rsp + 0x28], eax
call qword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
mov ebp, eax
test eax, eax
jne 0x14002527d
xor eax, eax
mov ecx, ebx
mov rdi, r12
rep stosb byte [rdi], al
call fcn.140023fbd
lea rcx, str.Signature_validation_failed:__s
mov rdx, rax
call fcn.140036717
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14002528d
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14002529f
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebp
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1400263f7
Capabilities:
Create thread
Terminate thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rcx
mov r12d, edx
mov r14d, r8d
mov r13d, r9d
test rcx, rcx
je 0x1400264a0
cmp byte [rcx], 0
jne 0x140026435
mov edx, 2
mov ecx, 1
call sub.msvcrt.dll_calloc
mov rbx, rax
jmp 0x1400264a2
xor ecx, ecx
xor r8d, r8d
mov r15, qword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
or r9d, 0xffffffff
mov dword [rsp + 0x28], ecx
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r8
mov r8, rbp
call r15
mov edi, eax
cmp eax, 1
jle 0x1400264a0
movsxd rcx, eax
mov edx, 2
call sub.msvcrt.dll_calloc
mov rsi, rax
mov rbx, rax
test rax, rax
je 0x1400264a0
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], edi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call r15
cmp edi, eax
je 0x1400264a2
mov rcx, rsi
call sub.msvcrt.dll_free
xor ebx, ebx
mov eax, dword [rsp + 0xb0]
mov qword [0x14010bdb0], rbx
mov dword [0x14010bdac], r14d
mov dword [0x14010bda8], r13d
mov dword [0x14010bda4], eax
mov byte [0x14010bda0], 0
test rbx, rbx
jne 0x1400264ea
mov r8d, 0x2a6
lea rdx, str.process.c
lea rcx, str._wHandleName___NULL
call qword [sym.imp.msvcrt.dll__wassert]
xor eax, eax
xor edx, edx
xor ecx, ecx
xor r9d, r9d
mov dword [rsp + 0x20], edx
lea r8, [0x14002585b]
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rcx, rax
test rax, rax
jne 0x14002651c
lea rcx, str.Warning:_Unable_to_create_conflicting_process_search_thread
jmp 0x140026544
mov edx, r12d
mov qword [rsp + 0x38], rax
call fcn.1400382c0
mov rcx, qword [rsp + 0x38]
cmp eax, 0x102
jne 0x14002654b
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
lea rcx, str.Search_for_conflicting_processes_was_interrupted_due_to_timeout
call fcn.140036717
jmp 0x14002656b
test eax, eax
je 0x14002656b
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
call fcn.140036bd7
lea rcx, str.Warning:_Failed_to_wait_for_conflicting_process_search_thread__s
mov rdx, rax
call fcn.140036717
mov rcx, qword [0x14010bdb0]
call sub.msvcrt.dll_free
mov al, byte [0x14010bda0]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140026c7c
Capabilities:
Parse credit card information

Disassembly:
push rbp
push rdi
push rsi
push rbx
lea rax, [0x14010be80]
xor r9d, r9d
xor edx, edx
mov r10d, 1
mov rbx, rax
mov r8, rcx
movsxd r11, edx
mov cl, byte [r8 + r11]
test cl, cl
je 0x140026e4b
cmp r9d, 0x1d
je 0x140026e4b
cmp cl, 0x3f
je 0x140026d16
jg 0x140026ce6
cmp cl, 0x2b
je 0x140026d0e
jg 0x140026cd5
cmp cl, 0x24
je 0x140026d06
cmp cl, 0x2a
jne 0x140026e2d
mov byte [rax], 5
jmp 0x140026e33
cmp cl, 0x2e
jne 0x140026e2d
mov byte [rax], 1
jmp 0x140026e33
cmp cl, 0x5c
je 0x140026d1e
cmp cl, 0x5e
je 0x140026cfe
cmp cl, 0x5b
je 0x140026d8b
jmp 0x140026e2d
mov byte [rax], 2
jmp 0x140026e33
mov byte [rax], 3
jmp 0x140026e33
mov byte [rax], 6
jmp 0x140026e33
mov byte [rax], 4
jmp 0x140026e33
lea r11, [r8 + r11 + 1]
mov cl, byte [r11]
test cl, cl
je 0x140026e33
inc edx
cmp cl, 0x64
je 0x140026d60
jg 0x140026d4e
cmp cl, 0x53
je 0x140026d78
cmp cl, 0x57
je 0x140026d68
cmp cl, 0x44
jne 0x140026d80
mov byte [rax], 0xb
jmp 0x140026e33
cmp cl, 0x73
je 0x140026d70
cmp cl, 0x77
jne 0x140026d80
mov byte [rax], 0xc
jmp 0x140026e33
mov byte [rax], 0xa
jmp 0x140026e33
mov byte [rax], 0xd
jmp 0x140026e33
mov byte [rax], 0xe
jmp 0x140026e33
mov byte [rax], 0xf
jmp 0x140026e33
mov byte [rax], 7
mov cl, byte [r11]
jmp 0x140026e30
cmp byte [r8 + r11 + 1], 0x5e
jne 0x140026da2
mov byte [rax], 9
cmp byte [r8 + r11 + 2], 0
je 0x140026dd0
inc edx
jmp 0x140026da5
mov byte [rax], 8
mov edi, edx
mov ecx, r10d
lea rbp, [0x14010be40]
inc edx
movsxd rsi, edx
mov r11b, byte [r8 + rsi]
cmp r11b, 0x5d
je 0x140026e09
test r11b, r11b
je 0x140026e09
cmp r11b, 0x5c
jne 0x140026def
cmp ecx, 0x26
jle 0x140026dd7
xor eax, eax
jmp 0x140026e5e
cmp byte [r8 + rsi + 1], 0
je 0x140026dd0
movsxd r11, ecx
lea edx, [rdi + 2]
inc ecx
mov byte [rbp + r11], 0x5c
jmp 0x140026df4
cmp ecx, 0x27
jg 0x140026dd0
movsxd rsi, edx
movsxd r11, ecx
mov edi, edx
inc ecx
mov sil, byte [r8 + rsi]
mov byte [rbp + r11], sil
jmp 0x140026db1
cmp ecx, 0x27
jg 0x140026dd0
lea r11, [0x14010be40]
movsxd r10, r10d
movsxd rsi, ecx
add r10, r11
mov byte [r11 + rsi], 0
mov qword [rax + 8], r10
lea r10d, [rcx + 1]
jmp 0x140026e33
mov byte [rax], 7
mov byte [rax + 8], cl
movsxd rcx, edx
add rax, 0x10
cmp byte [r8 + rcx], 0
je 0x140026dd0
inc edx
inc r9d
jmp 0x140026c98
movsxd r9, r9d
lea rax, [0x14010be80]
shl r9, 4
mov byte [rbx + r9], 0
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140027859
Capabilities:
Get graphical window text

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov rbp, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
call rbp
mov ebx, eax
test esi, esi
je 0x1400278f6
movsxd rcx, esi
mov edx, 2
call sub.msvcrt.dll_calloc
mov rdi, rax
call rbp
test rdi, rdi
je 0x1400278f1
mov r8d, esi
mov rcx, r12
mov rdx, rdi
xor r12d, r12d
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, eax
call rbp
mov ebx, eax
test esi, esi
je 0x1400278da
mov rcx, rdi
call fcn.14002779b
mov r12, rax
call rbp
test r12, r12
je 0x1400278d3
mov rcx, r12
call sub.msvcrt.dll_strlen
lea esi, [rax + 2]
call rbp
mov ebx, eax
jmp 0x1400278da
mov ebx, 0xe
xor esi, esi
mov rcx, rdi
call sub.msvcrt.dll_free
test r12, r12
je 0x1400278f8
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x1400278f8
mov ebx, 0xe
xor esi, esi
mov ecx, ebx
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140028596
Capabilities:
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
call fcn.14002790d
mov rsi, qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp word [rax], 0x22
mov rbx, rax
jne 0x1400285d7
mov rcx, rax
call sub.msvcrt.dll_wcslen
cmp word [rbx + rax*2 - 2], 0x22
jne 0x1400285d7
mov rcx, rbx
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + 2]
mov word [rbx + rax*2 - 2], 0
jmp 0x1400285da
mov rcx, rbx
call rsi
mov esi, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, rbx
mov edi, eax
call sub.msvcrt.dll_free
mov ecx, edi
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140029024
Capabilities:
Delete registry key

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
xor eax, eax
lea rdx, [0x14009112d]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x38]
mov rsi, rcx
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, eax
xor eax, eax
test edx, edx
jne 0x1400290b8
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
mov ebx, eax
and edi, 0xfffffffd
je 0x1400290a6
mov ecx, eax
call qword [sym.imp.KERNEL32.DLL_SetLastError]
lea r8, str.Key_is_not_empty
cmp ebx, 5
je 0x140029097
call fcn.140036bd7
mov r8, rax
mov rdx, rsi
lea rcx, str.Failed_to_delete_registry_key_HKCUSoftware_s:__s
call fcn.140036717
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x14002911a
Capabilities:
Get common file path

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r13, rcx
lea rcx, [0x14010db80]
call fcn.14002790d
lea rcx, [0x140091169]
mov rbp, rax
call fcn.14002790d
mov edx, 2
mov ecx, 0x104
mov r12, rax
call sub.msvcrt.dll_calloc
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
mov r9, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
mov r14, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
call r14
mov esi, eax
test ebx, ebx
je 0x1400291b7
xor eax, eax
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x38], rax
mov r8, rdi
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov ebx, eax
test eax, eax
jne 0x1400291b7
call r14
mov esi, eax
test rdi, rdi
je 0x1400291c4
mov rcx, rdi
call sub.msvcrt.dll_free
test r12, r12
je 0x1400291d1
mov rcx, r12
call sub.msvcrt.dll_free
test rbp, rbp
je 0x1400291de
mov rcx, rbp
call sub.msvcrt.dll_free
mov ecx, esi
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x1400291f7
Capabilities:
Get common file path

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
xor eax, eax
xor r9d, r9d
mov rbp, rcx
lea rdi, [rsp + 0x48]
mov ecx, 0x82
mov r8d, edx
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x48]
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
mov esi, eax
xor eax, eax
mov qword [rsp + 0x20], rbp
mov ecx, 0xfde9
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x104
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov ecx, esi
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140029274
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x30
call fcn.14002790d
mov rbx, rax
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test rbx, rbx
je 0x14002929f
mov rcx, rbx
mov dword [rsp + 0x2c], eax
call sub.msvcrt.dll_free
mov eax, dword [rsp + 0x2c]
add rsp, 0x30
pop rbx
ret
Function at 0x140029bb6
Capabilities:
Set registry value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov esi, edx
mov ebp, r9d
mov edx, 0x5c
xor r9d, r9d
mov qword [rsp + 0x60], r9
mov rbx, rcx
mov rdi, r8
mov qword [rsp + 0x68], r9
call sub.msvcrt.dll_strchr
test rax, rax
je 0x140029bff
mov r8d, 0x91
lea rdx, [0x140091194]
lea rcx, [0x1400911aa]
call qword [sym.imp.msvcrt.dll__wassert]
lea rax, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov r9d, 0x2001d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140029c2f
xor r8d, r8d
mov qword [rsp + 0x60], r8
jmp 0x140029c9a
lea rax, [rsp + 0x5c]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x30], rdx
lea rdx, [0x1400911e8]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140029c7d
xor eax, eax
mov qword [rsp + 0x68], rax
jmp 0x140029c9a
mov dword [rsp + 0x28], ebp
mov rcx, qword [rsp + 0x68]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140029caa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140029cbb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret