joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001857c
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x50
mov ebx, dword [0x1400516cc]
lea rax, [r11 + 8]
xor edi, edi
lea rdx, str.SoftwareMicrosoftMediaPlayerSetupUserOptions
mov qword [r11 - 0x18], rdi
xor r9d, r9d
mov qword [r11 - 0x20], rax
xor r8d, r8d
mov qword [r11 - 0x28], rdi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], edi
mov qword [r11 + 8], rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140018629
test ebx, ebx
lea rax, [0x140040b28]
lea rcx, [0x140042554]
cmovne rcx, rax
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x1400185ea
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, str.DesktopShortcut
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14001863c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp - 8], rax
lea rax, [rbp - 0x3c]
mov dword [rbp - 0x3c], 0x28
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov rdi, rdx
mov ebx, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x40], ebx
lea rdx, str.DesktopShortcut
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140018706
cmp dword [rbp - 0x40], ebx
jne 0x1400186b9
lea rdx, [rbp - 0x30]
lea rcx, [0x140040b28]
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor ecx, ecx
test eax, eax
sete cl
mov dword [rdi], ecx
jmp 0x140018704
cmp dword [rbp - 0x40], 4
jne 0x140018706
lea rax, [rbp - 0x3c]
mov dword [rbp - 0x38], ebx
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x40]
lea rax, [rbp - 0x38]
mov dword [rbp - 0x3c], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DesktopShortcut
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140018706
cmp dword [rbp - 0x40], 4
jne 0x140018706
cmp dword [rbp - 0x38], ebx
sete al
mov dword [rdi], eax
xor ebx, ebx
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003c810
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018d18
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140018d8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
mov esi, 0x57
cmove ebx, esi
cmp ebx, 5
jne 0x140018d8f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140018d8f
test al, 1
je 0x140018d8f
and eax, 0xfffffffe
mov rcx, rdi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140018d8f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140018d82
xor ebx, ebx
jmp 0x140018d8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
cmove ebx, esi
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140018da8
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x390], rax
or rbx, 0xffffffffffffffff
mov dword [rdx], 1
xor r12d, r12d
mov r15, rdx
mov rdi, rcx
inc rbx
cmp word [rcx + rbx*2], r12w
jne 0x140018deb
lea rax, [rbx + 3]
mov r13d, 0x104
cmp rax, r13
jbe 0x140018e33
call fcn.140018d18
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.14003c810
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, rdi
lea rcx, [rbp + 0x180]
mov rdx, r13
call fcn.140001470
test rbx, rbx
je 0x140018e73
cmp word [rdi + rbx*2 - 2], 0x3a
je 0x140018e73
cmp word [rdi + rbx*2 - 2], 0x5c
je 0x140018e73
lea r8, [0x140042140]
mov rdx, r13
lea rcx, [rbp + 0x180]
call fcn.140001584
inc rbx
lea r8, [0x1400427dc]
mov rdx, r13
lea rcx, [rbp + 0x180]
call fcn.140001584
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140018eac
mov rcx, rdi
jmp 0x140018e04
lea rsi, [rbx + rbx]
cmp rsi, 0x208
jae 0x14001901c
mov word [rbp + rsi + 0x180], r12w
lea rcx, [rbp + 0x164]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140018ed1
test rax, rax
lea rcx, [rbp + 0x164]
lea r8, [rsp + 0x5c]
mov rdx, r13
cmovne r8, rcx
lea rcx, [rbp + 0x180]
call fcn.140001584
mov ebx, dword [rsp + 0x30]
test bl, 0x10
je 0x140018f68
movzx ecx, word [rsp + 0x5c]
cmp cx, word [0x1400427e0]
movzx eax, word [rsp + 0x5e]
jne 0x140018f26
cmp ax, word [0x1400427e2]
je 0x140018ff8
cmp cx, word [0x1400427e4]
jne 0x140018f4a
cmp ax, word [0x1400427e6]
jne 0x140018f4a
movzx eax, word [rsp + 0x60]
cmp ax, word [0x1400427e8]
je 0x140018ff8
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x180]
call fcn.140018da8
test eax, eax
je 0x140018ff8
jmp 0x140018ff5
test bl, 1
je 0x140018f7f
mov edx, ebx
lea rcx, [rbp + 0x180]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140018ff8
lea rcx, [rbp + 0x164]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140018f9b
test rax, rax
je 0x140018fe6
lea r8, [rsp + 0x5c]
mov word [rbp + rsi + 0x180], r12w
mov rdx, r13
lea rcx, [rbp + 0x180]
call fcn.140001584
lea r8, [rbp + 0x164]
mov word [rbp + rsi + 0x180], r12w
mov rdx, r13
lea rcx, [rbp + 0x180]
call fcn.140001584
mov edx, ebx
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [r15], r12d
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140018ebd
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140018ea4
call fcn.14003c9e8
int3
Function at 0x14001923c
Capabilities:
Copy file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xe
jae 0x1400192b3
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
and qword [rsp + 0x28], 0
call fcn.140016a3c
test eax, eax
je 0x1400192a3
mov rax, qword [rsp + 0x20]
xor edx, edx
mov rcx, rdi
call qword [0x14003f118]
test eax, eax
jne 0x1400192a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rbx
lea rdx, str.ERROR:_Decryption_failed_for_file__S.__Last_result:_0x_x._r_n
mov r9d, eax
mov ecx, 2
call fcn.1400168a8
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400192b3
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xe
jae 0x14001932e
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
and qword [rsp + 0x28], 0
call fcn.140016a3c
test eax, eax
je 0x14001931e
mov rax, qword [rsp + 0x20]
xor edx, edx
mov rcx, rbx
call qword [0x14003f118]
test eax, eax
jne 0x14001931e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rbx
lea rdx, str.ERROR:_Decryption_failed_for_file__S.__Last_result:_0x_x._r_n
mov r9d, eax
mov ecx, 2
call fcn.1400168a8
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14001932e
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140019344
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
mov edi, 0x104
mov edx, edi
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140019413
mov r8, rbx
lea rcx, [rsp + 0x240]
mov edx, edi
call fcn.140001470
lea r8, str.DllCache
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140001584
mov edx, 0x5c
lea rcx, [rsp + 0x240]
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
je 0x140019413
mov r8, rax
lea rcx, [rsp + 0x30]
mov edx, edi
call fcn.140001584
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140019413
test al, 0x10
jne 0x140019413
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call fcn.14001923c
test eax, eax
jne 0x140019413
and dword [rsp + 0x20], eax
lea r8d, [rax + 1]
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call fcn.140018858
mov r8, rbx
lea rdx, str._Copied_file__S_to_DllCache._r_n
mov ecx, 4
call fcn.1400168a8
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14003c810
mov rbx, qword [rsp + 0x478]
add rsp, 0x460
pop rdi
ret
Function at 0x140019450
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov r14, rcx
mov qword [rax + 0x10], r15
lea ecx, [r15 + 0x28]
call fcn.14003c460
mov rsi, rax
test rax, rax
jne 0x14001948d
mov eax, 0x8007000e
jmp 0x140019674
lea rax, [rsp + 0x78]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or rbp, 0xffffffffffffffff
test eax, eax
jne 0x140019541
mov ecx, 0x208
call fcn.14003c460
mov rbx, rax
test rax, rax
je 0x140019536
mov edi, 0x104
mov rcx, rax
mov edx, edi
call fcn.140016a9c
test eax, eax
je 0x14001952e
lea r8, [0x140042cc0]
mov edx, edi
mov rcx, rbx
call fcn.140001584
mov rax, rbp
inc rax
cmp word [rbx + rax*2], r15w
jne 0x1400194f9
mov rcx, qword [rsp + 0x78]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.MPlayer2_FixUp
mov r9d, 1
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call fcn.14003c408
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetupFileMoveCacheSource
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test eax, eax
jne 0x140019645
mov r9d, dword [0x1400516e8]
lea ebx, [rax + 0x14]
jmp 0x1400195ac
mov r9d, dword [0x1400516e8]
cmp r9d, 0x3e8
jge 0x1400195e0
inc r9d
mov dword [0x1400516e8], r9d
lea r8, [0x140042130]
mov rdx, rbx
mov rcx, rsi
call fcn.140001734
mov rcx, qword [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov rdx, rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140019592
inc rbp
cmp word [r14 + rbp*2], r15w
jne 0x1400195e0
mov rcx, qword [rsp + 0x78]
lea eax, [rbp*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
jne 0x14001961d
inc dword [0x1400516e8]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140019645
mov r8, r14
lea rdx, str.File_replacement_for__S_queued_in_non_admin_file_cache._r_n
lea ecx, [rdi + 4]
call fcn.1400168a8
mov ebx, 0xd2af9
jmp 0x14001966a
movzx ebx, di
lea rdx, str.ERROR:_Could_not_store_delayed_file_move_for__S:_0x_x._r_n
or ebx, 0x80070000
mov r8, r14
test edi, edi
mov ecx, 2
cmovle ebx, edi
mov r9d, ebx
call fcn.1400168a8
mov rcx, rsi
call fcn.14003c408
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14001a100
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r13d, r13d
lea rax, [rbp + 0x48]
mov qword [r11 - 0x50], r13
mov r15, r8
mov qword [r11 - 0x58], r13
mov r12, rdx
mov qword [r11 - 0x60], r13
xor r9d, r9d
mov qword [r11 - 0x68], r13
xor r8d, r8d
mov qword [r11 - 0x70], r13
xor edx, edx
mov qword [r11 - 0x78], r13
mov r14, rcx
mov qword [r11 - 0x80], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x20], r13d
mov dword [rbp + 0x48], r13d
mov dword [rbp - 0x1c], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14001a17c
xor eax, eax
jmp 0x14001a2fb
or r8, 0xffffffffffffffff
mov rcx, r8
inc rcx
cmp word [r12 + rcx*2], r13w
jne 0x14001a183
mov eax, dword [rbp + 0x48]
cmp ecx, eax
mov dword [rbp - 0x1c], ecx
cmova eax, ecx
inc dword [rbp - 0x20]
add eax, 5
mov ecx, eax
mov dword [rbp + 0x48], eax
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.14003c460
mov rsi, rax
test rax, rax
jne 0x14001a1ca
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14001a175
mov qword [rbp - 0x10], r13
mov edi, r13d
mov edx, dword [rbp + 0x48]
lea r8, str._s_lu
mov r9, r12
mov dword [rsp + 0x20], edi
mov rcx, rsi
call fcn.140001734
lea rax, [rbp - 0x10]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001a2af
test r15, r15
je 0x14001a28b
mov ecx, 0x208
call fcn.14003c460
mov rbx, rax
test rax, rax
je 0x14001a28b
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov dword [rbp - 0x18], 1
mov dword [rbp - 0x1c], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001a283
cmp dword [rbp - 0x18], 1
jne 0x14001a283
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r13w
jne 0x14001a264
test rax, rax
je 0x14001a283
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14001a2a5
mov rcx, rbx
call fcn.14003c408
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
mov qword [rbp - 0x10], r13
cmp edi, dword [rbp - 0x20]
ja 0x14001a2ef
jmp 0x14001a1d1
mov rcx, rbx
call fcn.14003c408
jmp 0x14001a2ef
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov rdx, rsi
mov rcx, r14
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp - 0x10]
test eax, eax
cmovne rcx, r13
mov qword [rbp - 0x10], rcx
mov rcx, rsi
call fcn.14003c408
mov rax, qword [rbp - 0x10]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14001a324
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r12d, r12d
lea rax, [rbp + 0x48]
mov qword [r11 - 0x50], r12
mov r15, r8
mov qword [r11 - 0x58], r12
xor r9d, r9d
mov qword [r11 - 0x60], r12
xor r8d, r8d
mov qword [r11 - 0x68], r12
xor edx, edx
mov qword [r11 - 0x70], r12
mov r14, rcx
mov qword [r11 - 0x78], r12
mov qword [r11 - 0x80], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x10], r12d
mov dword [rbp + 0x48], r12d
mov dword [rbp + 0x58], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14001a4e5
or r13, 0xffffffffffffffff
lea rbx, str.FilesFile
mov rcx, r13
inc rcx
cmp word [rbx + rcx*2], r12w
jne 0x14001a3a3
mov eax, dword [rbp + 0x48]
cmp ecx, eax
mov dword [rbp + 0x58], ecx
cmova eax, ecx
add eax, 5
mov ecx, eax
mov dword [rbp + 0x48], eax
mov eax, 2
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.14003c460
mov rdi, rax
test rax, rax
je 0x14001a4e5
mov esi, r12d
mov qword [rbp - 8], r12
cmp dword [rbp - 0x10], r12d
jbe 0x14001a4c1
mov edx, dword [rbp + 0x48]
lea r8, str._s_lu
mov r9, rbx
mov dword [rsp + 0x20], esi
mov rcx, rdi
call fcn.140001734
lea rax, [rbp - 8]
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001a4b6
mov ecx, 0x208
call fcn.14003c460
mov rbx, rax
test rax, rax
je 0x14001a4a5
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0xc]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov dword [rbp - 0xc], 1
mov dword [rbp + 0x58], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001a49d
cmp dword [rbp - 0xc], 1
jne 0x14001a49d
mov rax, r13
inc rax
cmp word [rbx + rax*2], r12w
jne 0x14001a47e
test rax, rax
je 0x14001a49d
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14001a4d1
mov rcx, rbx
call fcn.14003c408
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rbx, str.FilesFile
inc esi
cmp esi, dword [rbp - 0x10]
jb 0x14001a3f1
mov rcx, rdi
call fcn.14003c408
mov rdi, r12
mov rax, rdi
jmp 0x14001a4e7
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.14003c408
jmp 0x14001a4cc
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001a7c0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x160], rax
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001a898
jmp 0x14001a843
test eax, eax
jne 0x14001a881
mov rbx, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14001a843
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14001a7c0
test eax, eax
jne 0x14001a881
and qword [rsp + 0x38], 0
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
and qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rsp + 0x48]
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x14001a817
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14003c810
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001a8c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
and dword [rsp + 0x40], 0
mov rsi, r9
mov rbx, r8
mov rdi, rdx
test ecx, ecx
jne 0x14001a918
lea rax, [r11 + 8]
xor r9d, r9d
mov qword [r11 - 0x10], rax
xor r8d, r8d
and qword [r11 - 0x18], 0
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001a918
test rbx, rbx
jne 0x14001a911
cmp dword [rsp + 0x40], 2
jbe 0x14001a918
mov eax, UnRegisterTypeLib
jmp 0x14001a93a
mov eax, dword [rsp + 0x60]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14001a9e8
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov r14, rdx
mov dword [rsp + 0x60], ebx
mov rsi, rcx
call fcn.140017488
test eax, eax
je 0x14001aa82
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ecx, eax
mov ebp, eax
call fcn.14003c460
mov rdi, rax
test rax, rax
je 0x14001aa82
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, rsi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14001aa7a
lea r9, [rsp + 0x68]
mov dword [rsp + 0x68], 4
lea r8, [rsp + 0x20]
mov rcx, rdi
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14001aa7a
mov rcx, qword [rsp + 0x20]
mov ebx, 1
movzx edx, word [rcx]
mov word [r14], dx
mov rcx, rdi
call fcn.14003c408
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x14001aaa0
Capabilities:
Check if file exists
Delete file
Get file attributes
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x360], rax
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftMediaPlayerPreferences
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001abab
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rbp + 0x150]
mov dword [rsp + 0x30], 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ObfuscatedSamplePlaylistsPath
mov dword [rsp + 0x34], 0x105
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001aba0
cmp dword [rsp + 0x30], 1
jne 0x14001aba0
lea ebx, [rax + 1]
lea rax, str.Plylst
mov dword [rsp + 0x28], ebx
lea r9, [rbp + 0x150]
mov qword [rsp + 0x20], rax
lea r8, str._s_s_d.wpl
mov edx, 0x105
lea rcx, [rsp + 0x40]
call fcn.140001734
test eax, eax
js 0x14001ab99
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001ab99
test al, 0x10
jne 0x14001ab99
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
inc ebx
cmp ebx, 0x10
jl 0x14001ab49
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.14003c810
mov rbx, qword [rsp + 0x480]
add rsp, 0x470
pop rbp
ret

Function at 0x14001aec0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
test rax, rax
je 0x14001af12
lea rcx, str.wmp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x14001af12
mov edx, 0xbba
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001af09
mov rcx, rdi
call qword [0x14003f118]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret