joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140034ef0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x140034f44
mov rdi, qword [rcx + 0x848]
test rdi, rdi
je 0x140034f37
call fcn.140050920
mov qword [rax + 0x18], rdi
mov rcx, qword [rbx + 0x850]
test rcx, rcx
je 0x140034f37
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x850], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + 0x850]
test rcx, rcx
je 0x140034f61
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x850], 0
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140034fc1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x850], rax
test rax, rax
je 0x140034fb1
call fcn.140050920
mov rcx, qword [rax + 0x10]
mov qword [rbx + 0x848], rcx
mov rbx, qword [rbx + 0x850]
call fcn.140050920
mov qword [rax + 0x18], rbx
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0x21
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0x20
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140034fe0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x670
mov rax, qword [0x140260d50]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rsi, r8
mov rdi, rdx
mov ebp, 1
test r8, r8
je 0x1400350ce
test rdx, rdx
je 0x1400350ce
xor ebx, ebx
lea rdx, [rsp + 0x30]
cmp dword [rcx + 0x780], ebx
je 0x14003503a
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x140035093
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8, [rsp + 0x240]
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
call fcn.140192498
lea r9, [rsp + 0x240]
lea r8, [rsp + 0x450]
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.140191794
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rax, [rsp + 0x30]
lea r9, [0x140212328]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.14019119c
test eax, eax
cmovs ebp, ebx
mov eax, ebp
jmp 0x1400350d2
xor ebx, ebx
mov eax, ebx
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.14018e5d0
mov rbx, qword [rsp + 0x690]
add rsp, 0x670
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003b580
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x490
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140260d50]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rbx, rcx
xor r8d, r8d
lea rdx, str.CUNINSTALLERDlg::DeleteSurvivalPrinterRegKey
lea rcx, [rsp + 0x50]
call fcn.14000b870
nop
mov r9, rbx
lea r8, str.lpszPrinter___s
mov edx, 1
lea rcx, [rsp + 0x50]
call fcn.14000ba50
xor ebp, ebp
mov esi, ebp
lea edi, [rbp + 1]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003b6da
nop word [rax + rax]
mov dword [rsp + 0x48], 0x208
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x70]
call fcn.140193010
lea r11, [rsp + 0x68]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x70]
mov edx, esi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc esi
test eax, eax
je 0x14003b67b
cmp eax, 0x103
je 0x14003b6c8
mov edi, ebp
jmp 0x14003b6bf
lea rcx, [rsp + 0x70]
call fcn.14003b730
test eax, eax
jne 0x14003b620
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call fcn.1400184c0
cmp eax, 1
jne 0x14003b6cd
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14003b6bd
cmp eax, 2
je 0x14003b6bd
mov edi, ebp
mov eax, 0x103
mov esi, ebp
test eax, eax
jne 0x14003b6cd
jmp 0x14003b620
mov edi, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003b6e0
cmp eax, 2
cmovne edi, ebp
mov r9d, edi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x50]
call fcn.14000ba50
nop
lea rcx, [rsp + 0x50]
call fcn.14000ba00
mov eax, edi
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14018e5d0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400472a0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x140260d50]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
call fcn.140050920
lea rcx, [rsp + 0x22]
mov rbx, qword [rax + 8]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], si
call fcn.140193010
lea r8, [rsp + 0x20]
lea rdx, str.InsCmn.dll
mov rcx, rbx
call fcn.140034fe0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140047356
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rdi], rax
test rax, rax
je 0x140047356
lea rdx, str.PI_CMN_GetInterface
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 8], rax
test rax, rax
je 0x14004734e
mov ecx, 0x100
call rax
mov qword [rdi + 0x10], rax
test rax, rax
je 0x14004734e
call qword [rax]
mov eax, esi
jmp 0x14004735b
mov rcx, rdi
call fcn.140047380
mov eax, 0x22
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14018e5d0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140051b3c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.140068624
mov rsi, rax
test rax, rax
je 0x140051bb8
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x140051bb3
cmp dword [rbx], 0x40
jb 0x140051bb3
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x140051bb3
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x140051bbc
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140059970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1400599d8
call fcn.140050920
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400599d8
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1400599fa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14005935c
mov esi, eax
test rdi, rdi
je 0x1400599f8
test rbx, rbx
je 0x1400599f8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x14005c928
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, r8
mov rbx, rdx
mov r13, rcx
xor edi, edi
call fcn.140050920
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14005c984
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r12
mov rdx, rdi
mov rcx, r13
call fcn.14005c3b8
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x14005ca18
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_712
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14005ca57
cmp dword [rcx + 0xd8], 0
jne 0x14005ca57
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.140050920
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14005c9bc
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14005cfe4
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xc8], 0
jne 0x14005d022
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x14005d0d6
call fcn.14004cde4
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14005d041
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx + 0xc8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140191d34
test eax, eax
je 0x14005d0a9
cmp eax, 0xc
je 0x14005d0a3
cmp eax, 0x16
je 0x14005d09d
cmp eax, 0x22
je 0x14005d09d
cmp eax, 0x50
je 0x14005d0a9
call fcn.14004d690
int3
call fcn.14004d690
int3
call fcn.14004d648
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x14005d0d4
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140061198
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x140061212
xor r8d, r8d
call fcn.1400610cc
mov rsi, rax
test rax, rax
jne 0x1400611ce
mov eax, edi
jmp 0x140061228
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x1400611ca
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140061c2c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140061c8f
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140061ca3
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140061ca3
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x140061ca8
cmp dword [rcx + 8], 0
je 0x140061ca3
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140061ca8
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400695f8
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140260d50]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14006962e
xor eax, eax
jmp 0x14006967a
lea rcx, [rsp + 0x20]
call fcn.140192528
cmp word [rsp + rax*2 + 0x1e], 0x5c
je 0x14006965a
lea r8, [0x14021120c]
lea rcx, [rsp + 0x20]
mov edx, 0x105
call fcn.140191cac
test eax, eax
jne 0x14006962a
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x105
call fcn.140191cac
test eax, eax
jne 0x14006962a
lea rcx, [rsp + 0x20]
call fcn.140053490
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14018e5d0
add rsp, 0x240
pop rbx
ret
Function at 0x14006d00c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14006d032
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140061c2c
jmp 0x14006d099
cmp byte [0x140279998], 0
jne 0x14006d076
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006d066
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140279990], rax
jmp 0x14006d06d
mov rax, qword [0x140279990]
mov byte [0x140279998], 1
jmp 0x14006d07d
mov rax, qword [0x140279990]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14006d093
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x14006d099
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14006d3b0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rdx]
mov rbx, rdx
cmp dword [rcx - 0x10], 0
je 0x14006d3e2
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14006d3e2
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.1400b7764
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400f6fc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r13, rcx
test r8, r8
jne 0x1400f6ff1
call fcn.140050920
mov rdi, qword [rax + 0x18]
mov r8, qword [0x14027c930]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
jne 0x1400f7010
xor eax, eax
jmp 0x1400f705c
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400f700c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x1400f7051
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r12
mov rcx, r13
mov r8d, eax
call fcn.1400f6e84
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x140116304
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x140116315
xor eax, eax
jmp 0x140116343
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1401164d8
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1401164e9
xor eax, eax
jmp 0x14011650d
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140116514
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
lea r9, [r11 + 0x20]
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x140116556
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret

Function at 0x140116668
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x140116693
call fcn.14004d690
int3
test rbx, rbx
jne 0x14011669e
call fcn.14004d690
int3
test r9, r9
jne 0x1401166a9
call fcn.14004d690
int3
and qword [r8], 0
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], r9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14011672c
cmp dword [rsp + 0x48], 3
jne 0x14011672c
test eax, eax
jne 0x14011672c
cmp dword [rdi], eax
je 0x14011672c
mov ecx, dword [rdi]
call fcn.14004ca70
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rbx], rax
mov rcx, qword [rbp + 8]
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140116720
cmp dword [rsp + 0x48], 3
jne 0x140116720
test eax, eax
jne 0x140116720
mov eax, 1
jmp 0x14011672e
mov rcx, qword [rbx]
call fcn.14004cabc
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140116838
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x140164560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x140164589
mov rdi, qword [rdx + 0x10]
jmp 0x1401645da
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x1401645aa
call fcn.14005d50c
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x1401645c4
call fcn.14005d50c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x1401645da
call fcn.14005d50c
call fcn.140050920
cmp qword [rax + 0x68], 0
je 0x1401645f4
mov rdx, rdi
mov rcx, rbp
call fcn.140162ce8
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.1401643a0
mov rcx, qword [rbp + 0xe8]
mov rsi, rax
test rcx, rcx
je 0x14016461b
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xe8], 0
test rsi, rsi
je 0x14016462a
mov rdi, rsi
mov qword [rbp + 0xe8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140193900
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140193770

Function at 0x140197f7b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140260d50]
jne 0x14018e5ea
rol rcx, 0x10
test cx, 0xffff
jne 0x14018e5e6
repz ret
ror rcx, 0x10
jmp 0x140197ed4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140280150]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140280248]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140197f59
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140280150]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140197f7b
mov rax, qword [rsp + 0x88]
mov qword [0x140280248], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1402801e8], rax
mov rax, qword [0x140280248]
mov qword [0x1402800c0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1402801d0], rax
mov dword [0x1402800b0], 0xc0000409
mov dword [0x1402800b4], 1
mov rax, qword [0x140260d50]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140260d58]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140280148], eax
mov ecx, 1
call fcn.1401a3c08
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14020f070]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140280148], 0
jne 0x140198002
mov ecx, 1
call fcn.1401a3c08
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret