joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401dc2e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401dc308
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1401dc308
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140e9a7b0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140e9a7ba
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140e9a7e3
pop rbp
sub rbp, 0x33
sub rbp, 0xe9a7b0
sub rsp, 0x20
and byte [rax], al
add byte [rax], al
jmp 0x140e9a802
mov rax, 0xe9a7b0
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffad93c4b8
xor byte [rax], dl
inc rax
dec rcx
jne 0x140e9a821
jmp 0x140e9a838
lock xor dword [rcx + 0x33], edx
xor dword [rax + rdi*4 + 0x39f0b8b8], eax
jns 0x140e9a7f5
mov ecx, 0xb9f0b8b8
push rcx
invalid
Function at 0x180007d50
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor sil, sil
mov rdi, rdx
cmp byte [rdx], sil
je 0x180007e45
mov qword [rsp + 0x30], rbx
mov rbx, 0xffffffffffffffff
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], sil
jne 0x180007d80
cmp rax, 0x10
jbe 0x180007e31
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180007e31
mov qword [rsp + 0x38], rbp
call qword [sym.imp.USER32.dll_EmptyClipboard]
nop dword [rax]
cmp byte [rdi + rbx + 1], sil
lea rbx, [rbx + 1]
jne 0x180007db0
lea rdx, [rbx + 1]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
je 0x180007e12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x180007e00
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, rax
call fcn.1800459b0
mov rdx, rbp
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov sil, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x38]
movzx eax, sil
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
movzx eax, sil
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx eax, sil
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180007f90
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1800653c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
jne 0x180007fb3
call sym.SpoutDX.dll_void___cdecl_spoututils::OpenSpoutConsole_void_
lea rcx, [rsp + 0x30]
call sym.SpoutDX.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_spoututils::GetExeName_void_
nop
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x180007ffa
lea rax, [rcx + 4]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x30]
mov dword [rax + rcx], 0x676f6c2e
mov byte [rax + rcx + 4], 0
jmp 0x18000801b
mov qword [rsp + 0x20], 4
lea r9, str..log
xor r8d, r8d
lea edx, [r8 + 4]
lea rcx, [rsp + 0x30]
call fcn.180001460
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov byte [0x180066692], 1
mov byte [0x180066690], 1
mov byte [0x1800666a0], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x180008080
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000807b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008092
call fcn.18001c6c8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18001cb50
add rsp, 0x68
ret
call fcn.18002387c
int3
Function at 0x1800085b0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, rdx
mov r14, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r12b
mov dword [rsp + 0x20], 1
xor edx, edx
mov rcx, r15
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebp, eax
test eax, eax
je 0x180008717
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov edi, r12d
mov qword [rsp + 0x38], r12
mov ebx, r12d
cmp rbp, 0x1000
jb 0x180008648
lea rcx, [rbp + 0x27]
cmp rcx, rbp
jbe 0x180008729
call fcn.18001c68c
test rax, rax
je 0x18000872f
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180008653
mov rcx, rbp
call fcn.18001c68c
mov rbx, rax
mov qword [rsp + 0x28], rbx
lea rdi, [rbx + rbp]
mov qword [rsp + 0x38], rdi
mov r8, rbp
xor edx, edx
mov rcx, rbx
call fcn.180046050
mov qword [rsp + 0x30], rdi
mov r9, rbx
mov r8d, ebp
xor edx, edx
mov rcx, r15
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1800086e3
mov qword [rsp + 0x98], r12
mov dword [rsp + 0x90], r12d
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x98]
lea rdx, str.StringFileInfo080904E4ProductVersion
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1800086e3
mov rdx, qword [rsp + 0x98]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1800086d0
mov rcx, r14
call fcn.180005050
nop
test rbx, rbx
je 0x180008717
sub rdi, rbx
cmp rdi, 0x1000
jb 0x18000870c
add rdi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x18000872f
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.18001c6c8
mov rax, r14
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.180005010
int3
call fcn.18002387c
int3
Function at 0x180009880
Capabilities:
Set console window title

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1800653c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
jne 0x180009a14
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0x180009a02
mov ecx, 1
call fcn.18002c274
mov r9, rax
lea r8, [0x18004a504]
lea rdx, [0x18004a508]
lea rcx, [0x180066698]
call fcn.18002c43c
test eax, eax
jne 0x1800099e0
lea rcx, [rsp + 0x40]
call sym.SpoutDX.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_spoututils::GetExeName_void_
nop
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x180009931
lea rax, [rcx + 4]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x40]
mov dword [rax + rcx], 0x676f6c2e
mov byte [rax + rcx + 4], 0
jmp 0x180009952
mov qword [rsp + 0x20], 4
lea r9, str..log
xor r8d, r8d
lea edx, [r8 + 4]
lea rcx, [rsp + 0x40]
call fcn.180001460
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov byte [0x180066692], 1
mov dword [rsp + 0x30], 3
xor eax, eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x180009a14
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800099c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009a27
call fcn.18001c6c8
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18001cb50
add rsp, 0x70
pop rbx
ret
xor eax, eax
mov qword [0x180066698], rax
mov byte [0x180066692], al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18001cb50
add rsp, 0x70
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x180009a14
mov byte [0x180066692], 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18001cb50
add rsp, 0x70
pop rbx
ret
call fcn.18002387c
int3
Function at 0x180009a30
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1800653c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edi, edi
mov qword [rsp + 0x30], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], dil
lea r8, str.APPDATA
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18002c12c
test eax, eax
jne 0x180009b88
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180009b88
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x180009aa0
lea rcx, [rsp + 0x38]
call fcn.180005050
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x180009b00
lea rax, [rcx + 6]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x38]
add rbx, rcx
mov r8d, 6
lea rdx, str.Spout
mov rcx, rbx
call fcn.1800459b0
mov byte [rbx + 6], 0
jmp 0x180009b21
mov qword [rsp + 0x20], 6
lea r9, str.Spout
xor r8d, r8d
lea edx, [r8 + 6]
lea rcx, [rsp + 0x38]
call fcn.180001460
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.180027c6c
cmp eax, 0xffffffff
je 0x180009b84
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea rdx, [0x18004a798]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
xor edx, edx
lea rcx, str.CabinetWClass
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x180009b70
mov bl, 1
jmp 0x180009ba9
mov dword [rsp + 0x20], edi
mov r9d, 0x40030
lea r8, str.OpenSpoutLogs
lea rdx, str.Could_not_create_AppData_path
xor ecx, ecx
call fcn.180008c50
xor bl, bl
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x180009be2
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009bdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009bfd
call fcn.18001c6c8
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18001cb50
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
call fcn.18002387c
int3
Function at 0x180009e80
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, r8
test rdx, rdx
je 0x180009eeb
cmp byte [rdx], 0
je 0x180009eeb
test rbx, rbx
je 0x180009eeb
cmp byte [r8], 0
je 0x180009eeb
test r9, r9
je 0x180009eeb
lea rax, [rsp + 0x68]
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], r9
mov r9d, 0x10
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x180009ef3
mov rdx, rbx
lea rcx, str.ReadDwordFromRegistry___could_not_read___s__from_registry
call sym.SpoutDX.dll_void___cdecl_spoututils::SpoutLogWarning_char_const____ptr64_
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x180009f00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, r9
mov rbx, r8
test rdx, rdx
je 0x180009ffb
cmp byte [rdx], 0
je 0x180009ffb
test rbx, rbx
je 0x180009ffb
cmp byte [r8], 0
je 0x180009ffb
test r9, r9
je 0x180009ffb
mov esi, dword [rsp + 0x70]
xor eax, eax
mov qword [rsp + 0x38], rax
mov r9d, 0x20019
mov dword [rsp + 0x30], eax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180009ffb
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x180009fbf
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
cmp edi, 0xea
jne 0x180009fec
mov r8d, dword [rsp + 0x58]
lea rcx, str.ReadPathFromRegistry____buffer_size___d__not_large_enough___d_
mov edx, esi
call sym.SpoutDX.dll_void___cdecl_spoututils::SpoutLogWarning_char_const____ptr64_
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rdx, rbx
lea rcx, str.ReadPathFromRegistry___could_not_read___s__from_registry
call sym.SpoutDX.dll_void___cdecl_spoututils::SpoutLogWarning_char_const____ptr64_
mov rbx, qword [rsp + 0x50]
xor al, al
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18000a2c0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
test rdx, rdx
je 0x18000a34d
cmp byte [rdx], 0
je 0x18000a34d
test rbx, rbx
je 0x18000a34d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18000a331
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x18000a331
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, rdi
lea rcx, str.RemovePathFromRegistry___could_not_open_key___s_
call sym.SpoutDX.dll_void___cdecl_spoututils::SpoutLogWarning_char_const____ptr64_
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rcx, str.RemovePathFromRegistry___no_subkey_specified
call sym.SpoutDX.dll_void___cdecl_spoututils::SpoutLogWarning_char_const____ptr64_
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret

Function at 0x18000a470
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x18000a49d
cmp byte [rdx], 0
je 0x18000a49d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x18000a48f
mov al, 1
add rsp, 0x28
ret
mov edx, eax
lea rcx, str.RemoveSubkey___error__ld
call sym.SpoutDX.dll_void___cdecl_spoututils::SpoutLogWarning_char_const____ptr64_
xor al, al
add rsp, 0x28
ret
Function at 0x18000c210
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
test rdx, rdx
je 0x18000c31b
cmp byte [rdx], 0
je 0x18000c31b
test r8, r8
je 0x18000c31b
cmp byte [r8], 0
je 0x18000c31b
test r9, r9
je 0x18000c31b
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], r14
xor r14d, r14d
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
mov qword [rsp + 0x78], r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18000c2b7
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, rbx
mov rcx, rbp
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x18000c2f4
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18000c317
mov eax, dword [rsp + 0x90]
mov r9d, 3
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x18000c317
lea rcx, str.WriteBinaryToRegistry___could_not_write_to_registry
call sym.SpoutDX.dll_void___cdecl_spoututils::SpoutLogWarning_char_const____ptr64_
xor al, al
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov al, 1
jmp 0x18000c302
mov rbx, qword [rsp + 0x80]
xor al, al
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000c330
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x18000c443
cmp byte [rdx], 0
je 0x18000c443
test r8, r8
je 0x18000c443
cmp byte [r8], 0
je 0x18000c443
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rbp
xor ebp, ebp
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
mov qword [rsp + 0x78], rbp
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18000c3c9
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x18000c416
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18000c434
lea rax, [rsp + 0x88]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x18000c434
mov rdx, rdi
lea rcx, str.WriteDwordToRegistry___could_not_write___s__to_registry
call sym.SpoutDX.dll_void___cdecl_spoututils::SpoutLogWarning_char_const____ptr64_
mov rbp, qword [rsp + 0x70]
xor al, al
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
mov rbp, qword [rsp + 0x70]
mov al, 1
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
xor al, al
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x18000c450
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov r14, rcx
test rdx, rdx
je 0x18000c578
cmp byte [rdx], 0
je 0x18000c578
test r8, r8
je 0x18000c578
cmp byte [r8], 0
je 0x18000c578
test r9, r9
je 0x18000c578
mov qword [rax + 8], rbx
mov rbx, 0xffffffffffffffff
mov qword [rax + 0x18], r15
xor r15d, r15d
mov qword [rax + 0x10], r15
nop
inc rbx
cmp byte [r9 + rbx], r15b
jne 0x18000c4b0
lea rax, [rsp + 0x78]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
inc ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18000c50f
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, rbp
mov rcx, r14
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x18000c545
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18000c574
mov dword [rsp + 0x28], ebx
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x18000c574
mov rdx, rsi
lea rcx, str.WritePathToRegistry___could_not_write___s__to_registry
call sym.SpoutDX.dll_void___cdecl_spoututils::SpoutLogWarning_char_const____ptr64_
xor al, al
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
mov al, 1
jmp 0x18000c556
mov rbp, qword [rsp + 0x88]
xor al, al
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x18000cd80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x48
mov rbx, rcx
lea rdi, [rsp + 0x68]
call fcn.1800051d0
mov qword [rsp + 0x28], rdi
mov r9, rbx
lea rdi, [0x1800666a0]
mov qword [rsp + 0x20], 0
mov r8d, 0x400
mov rdx, rdi
mov rcx, qword [rax]
call fcn.180027940
mov dword [rsp + 0x30], 0
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rdi + rbx], 0
jne 0x18000cde0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x30]
mov byte [0x1800666a0], 0
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x18000dc80
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x1800653c0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
xor edi, edi
call fcn.180046050
lea r8, str.APPDATA
mov byte [rsp + 0x50], dil
xor edx, edx
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0x20]
call fcn.18002c12c
test eax, eax
jne 0x18000dd2d
mov r8, qword [rsp + 0x20]
test r8, r8
je 0x18000dd2d
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1800238f4
lea r8, str.Spout
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.180023954
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180027c6c
cmp eax, 0xffffffff
jne 0x18000dd8c
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x18000dd8c
lea rcx, [rsp + 0x30]
call sym.SpoutDX.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_spoututils::GetExePath_void_
cmp qword [rax + 0x18], 0xf
jbe 0x18000dd41
mov rax, qword [rax]
mov r8, rax
lea rcx, [rsp + 0x50]
mov edx, 0x104
call fcn.1800051e0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x18000dd8c
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000dd87
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000dde0
call fcn.18001c6c8
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rdi
inc r8
cmp byte [rax + r8], dil
jne 0x18000dda6
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180001350
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18001cb50
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rdi
ret
call fcn.18002387c
int3
Function at 0x18000f920
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x18000f951
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x18000f9cb
mov rdi, r14
mov rcx, rbx
call fcn.18000c9f0
test rax, rax
jle 0x18000f9a3
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1800459b0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18000f9bb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18000f9c3
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x18000f965
sub r14, rdi
jmp 0x18000faaf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x18000f9e2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000f9e4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18000fa16
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1800459b0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18000faac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18000fa51
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x18000fa8d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.18002d0b4
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18000faac
cmp rbp, rax
ja 0x18000fa60
test rbp, rbp
je 0x18000faac
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.18002d0b4
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret