joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004b534
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x130
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov esi, r8d
mov r12, rdx
mov rbp, rcx
lea rcx, [rsp + 0x40]
call fcn.140037788
lea rcx, [rsp + 0x80]
call fcn.140047834
nop
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.USER32.dll_GetTopWindow]
mov rdi, rax
test rax, rax
je 0x14004b67a
mov qword [rsp + 0xc0], rdi
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
movzx ecx, ax
mov dword [rsp + 0x48], ecx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x60], rax
mov rcx, rdi
call fcn.140049f90
test rax, rax
je 0x14004b5e1
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
xor edx, edx
mov r8d, 0xbd11ffff
mov rcx, rax
call fcn.14003754c
test eax, eax
jne 0x14004b660
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
or r8d, 0xffffffff
mov edx, dword [rsp + 0x48]
mov rcx, rbp
call fcn.14003754c
test eax, eax
jne 0x14004b660
mov ebx, esi
test esi, esi
je 0x14004b650
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14004b62a
xor ebx, ebx
jmp 0x14004b650
lea rcx, [rsp + 0x80]
call fcn.14004f4bc
and eax, 0xf
cmp eax, 3
je 0x14004b64e
cmp eax, 6
je 0x14004b64e
cmp eax, 7
je 0x14004b64e
cmp eax, 9
jne 0x14004b650
xor ebx, ebx
mov r8d, ebx
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.1400377b8
mov edx, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
mov rdi, rax
test rax, rax
jne 0x14004b590
and qword [rsp + 0xc0], 0
lea rcx, [rsp + 0x80]
call fcn.14004ae8c
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x14004bf20
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0xa0], 0
mov rbx, rdx
mov rsi, rcx
jne 0x14004bfd8
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r8, qword [rbx]
mov edx, 1
mov ecx, dword [r8 - 0xc]
sub edx, dword [r8 - 8]
movsxd rdi, eax
sub ecx, edi
or edx, ecx
jge 0x14004bf70
mov edx, edi
mov rcx, rbx
call fcn.140004670
test edi, edi
mov rdx, qword [rbx]
js 0x14004bfcd
cmp edi, dword [rdx - 0xc]
jg 0x14004bfcd
mov dword [rdx - 0x10], edi
mov rax, qword [rbx]
lea r8d, [rdi + 1]
and word [rax + rdi*2], 0
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14004bfa1
xor eax, eax
jmp 0x14004bfaa
call fcn.14009e2b0
test eax, eax
js 0x14004bfc2
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14004bfc2
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
and word [rax + rcx*2], 0
jmp 0x14004bfe8
mov ecx, 0x80070057
call fcn.140001610
int3
mov ecx, 0x80070057
call fcn.140001610
int3
mov rcx, qword [rcx + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14004f158
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x14004f1c0
call fcn.140045340
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14004f1c0
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x14004f1e2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14004ebb4
test rdi, rdi
mov esi, eax
je 0x14004f1e0
test rbx, rbx
je 0x14004f1e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x140050158
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x140050196
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x14005024a
call fcn.140055b68
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400501b5
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.14009cdc0
test eax, eax
je 0x14005021d
cmp eax, 0xc
je 0x140050217
cmp eax, 0x16
je 0x140050211
cmp eax, 0x22
je 0x140050211
cmp eax, 0x50
je 0x14005021d
call fcn.140041984
int3
call fcn.140041984
int3
call fcn.14004193c
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x140050248
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400519bc
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov ebx, edx
mov rdi, rcx
call fcn.1400507a8
mov rcx, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov edx, ebx
call fcn.14004f314
cmp dword [rdi], 0
mov rcx, qword [rsp + 0x30]
je 0x140051aaf
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edx, 1
test eax, eax
movsxd rbx, eax
jle 0x140051a45
mov rcx, qword [rsi]
sub edx, dword [rcx - 8]
mov ecx, dword [rcx - 0xc]
sub ecx, ebx
or edx, ecx
jge 0x140051a21
mov edx, ebx
mov rcx, rsi
call fcn.140004670
mov rdx, qword [rsi]
cmp ebx, dword [rdx - 0xc]
jg 0x140051a3a
mov dword [rdx - 0x10], ebx
mov rax, qword [rsi]
lea r8d, [rbx + 1]
and word [rax + rbx*2], 0
jmp 0x140051a6c
mov ecx, 0x80070057
call fcn.140001610
int3
mov rax, qword [rsi]
mov ecx, 0xff
sub edx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ecx
or edx, eax
jge 0x140051a63
mov edx, ecx
mov rcx, rsi
call fcn.140004670
mov rdx, qword [rsi]
mov r8d, 0x100
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rsi]
test rcx, rcx
jne 0x140051a83
xor eax, eax
jmp 0x140051a8c
call fcn.14009e2b0
test eax, eax
js 0x140051aa4
mov rcx, qword [rsi]
cmp eax, dword [rcx - 0xc]
jg 0x140051aa4
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rsi]
and word [rax + rcx*2], 0
jmp 0x140051ad4
mov ecx, 0x80070057
call fcn.140001610
int3
mov r9, qword [rsi]
or r8, 0xffffffffffffffff
mov edx, 0x14d
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 0xffffffffffffffff
jne 0x140051ad4
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x30]
call fcn.1400598f0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140057e24
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xa8], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x140057e9b
call fcn.140057db0
test rax, rax
mov rsi, rax
jne 0x140057e57
mov eax, edi
jmp 0x140057eb1
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x140057e53
mov r9, qword [rcx + 0xd0]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140057f84
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor ebx, ebx
mov rdi, r9
mov rbp, r8
cmp qword [rcx + 0xa8], rbx
mov rsi, rdx
je 0x14005804b
cmp r8, rbx
jne 0x140057fdf
call fcn.140057cac
cmp rax, rbx
mov rdi, rax
jne 0x140057fce
xor eax, eax
jmp 0x140058061
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, rdi
jmp 0x14005803a
cmp r9, rbx
jne 0x140057fff
call fcn.140057db0
cmp rax, rbx
mov rdi, rax
je 0x140057fc7
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140057fda
call fcn.140057db0
cmp rax, rbx
mov r12, rax
je 0x140057fc7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 1
xor r8d, r8d
lea eax, [rax + rax + 2]
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, r12
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
sete bl
mov eax, ebx
jmp 0x140058061
mov r9, qword [rcx + 0xd0]
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x1400598f0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x14012e6d8]
xor rax, rsp
mov qword [rsp + 0x220], rax
test rcx, rcx
mov rbx, rdx
mov rdi, rcx
jne 0x140059925
call fcn.140041984
int3
test rdx, rdx
jne 0x140059930
call fcn.140041984
int3
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
and word [rsp + 0x20], 0
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x1fe
mov esi, eax
call fcn.14009c4e0
mov r8d, 0x100
cmp esi, r8d
ja 0x140059982
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, esi
jne 0x140059982
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14005998e
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.14009af10
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14005a5a0
Capabilities:
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov esi, 1
mov r14, r8
mov rdi, rdx
cmp dword [rdx + 0x10], esi
mov r12, rcx
mov ebp, esi
jle 0x14005a62d
lea ebx, [rsi + 7]
lea r13d, [rsi + 0xf]
test r14, r14
je 0x14005a5f9
mov rax, qword [r12 + 0x10]
cmp qword [rax + r13 + 8], r14
je 0x14005a5f9
mov rax, qword [rdi + 0x18]
cmp qword [rbx + rax], 0
je 0x14005a619
xor esi, esi
jmp 0x14005a619
mov rax, qword [rdi + 0x18]
mov rcx, qword [rbx + rax]
test rcx, rcx
je 0x14005a610
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rax, qword [rdi + 0x18]
and qword [rbx + rax], 0
add ebp, 1
add r13, 0x10
add rbx, 8
cmp ebp, dword [rdi + 0x10]
jl 0x14005a5d9
test esi, esi
je 0x14005a674
lea rcx, [r12 + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [r12 + 0x18]
mov rdx, rdi
call fcn.14005a03c
lea rcx, [r12 + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r11, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r11]
mov ecx, dword [r12]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret

Function at 0x14005bdc0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, r8
mov rbp, rdx
cmp r8, rbx
mov rdi, rcx
jne 0x14005be13
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8d, [rbx + 1]
mov r9, rbp
add eax, eax
mov rdx, rdi
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
cmp eax, ebx
sete bl
mov eax, ebx
jmp 0x14005be77
mov rdx, rcx
lea r8, [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp eax, ebx
jne 0x14005be75
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
jne 0x14005be75
cmp edi, ebx
jne 0x14005be75
mov eax, 1
jmp 0x14005be77
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14005bf98
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x250
mov rax, qword [0x14012e6d8]
xor rax, rsp
mov qword [rsp + 0x240], rax
call fcn.14009e960
test rax, rax
mov rdi, rax
je 0x14005c05a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, 1
movsxd rcx, eax
lea rax, [rdi + rcx*2]
jmp 0x14005c04b
and word [rax], 0
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14005c050
mov rcx, qword [rsp + 0x20]
lea r8, [rsp + 0x30]
mov r9d, 0x105
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov rcx, qword [rsp + 0x20]
xor ebx, ebx
test eax, eax
cmove ebx, ebp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14005c050
mov rdx, rdi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dx, VarDateFromDisp
mov rcx, rdi
call fcn.14009b1d0
test rax, rax
jne 0x14005bfe4
mov rcx, rdi
call fcn.14009db00
mov eax, ebp
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14009af10
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400602bc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [rdx]
and qword [rsp + 0x38], 0
xor esi, esi
lea r8d, [rsi + 1]
mov rbx, rdx
mov edx, 0x104
sub r8d, dword [rax - 8]
mov eax, dword [rax - 0xc]
mov rdi, rcx
sub eax, edx
or r8d, eax
jge 0x1400602f8
mov rcx, rbx
call fcn.140004670
mov rbp, qword [rbx]
and dword [rsp + 0x70], esi
lea r8, [rsp + 0x38]
lea rdx, str.CLSID
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x68], 0x208
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400603b4
mov rcx, qword [rsp + 0x38]
and qword [rsp + 0x30], rsi
lea r8, [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400603a9
mov rcx, qword [rsp + 0x30]
and qword [rsp + 0x78], rsi
lea r8, [rsp + 0x78]
lea rdx, str.InProcServer32
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14006039e
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [0x1400e9c18]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x78]
test eax, eax
sete sil
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1400603c0
xor eax, eax
jmp 0x1400603c9
call fcn.14009e2b0
test eax, eax
js 0x1400603ee
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1400603ee
mov dword [rcx - 0x10], eax
mov rcx, qword [rbx]
mov rbx, qword [rsp + 0x60]
movsxd rdx, eax
mov eax, esi
and word [rcx + rdx*2], 0
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140001610
int3
Function at 0x140061378
Capabilities:
Get file system object information

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x338
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x14012e6d8]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov ebp, r9d
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
and qword [rsp + 0x38], 0
and word [r8], 0
test rcx, rcx
jne 0x1400613c2
xor eax, eax
jmp 0x140061538
mov dword [rsp + 0x20], 0x800
mov r9d, 0x2b8
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x140061536
bt dword [rsp + 0x6c], 0x10
jae 0x140061536
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [0x1400f4a68]
xor r8d, r8d
lea rdx, [0x1400f4a58]
lea rcx, [rsp + 0x30]
call fcn.1400612f4
test eax, eax
js 0x140061532
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140061532
and qword [rsp + 0x40], 0
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
lea rdx, [0x140102750]
call qword [rax]
test eax, eax
js 0x140061523
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140013b00
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140061502
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayAllocDescriptorEx]
test eax, eax
js 0x1400614f1
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov r8d, 2
mov rdx, qword [rdi + 0x40]
call qword [rax + 0x98]
test eax, eax
js 0x1400614f1
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
and dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400614ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x140061538
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140061502
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140061523
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
xor eax, eax
jmp 0x140061538
xor eax, eax
jmp 0x140061538
xor eax, eax
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.14009af10
add rsp, 0x338
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140083bf8
Capabilities:
Get file attributes
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
mov rbx, rdx
mov rdi, rcx
mov r8d, 0x230
mov rcx, rbx
xor edx, edx
call fcn.14009c4e0
mov r8, qword [rdi + 0x18]
lea rcx, [rbx + 0x22]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.14009cdc0
xor esi, esi
cmp eax, esi
je 0x140083c59
cmp eax, 0xc
je 0x140083c53
cmp eax, 0x16
je 0x140083c4d
cmp eax, 0x22
je 0x140083c4d
cmp eax, 0x50
je 0x140083c59
call fcn.140041984
int3
call fcn.140041984
int3
call fcn.14004193c
int3
mov rcx, qword [rdi + 8]
cmp rcx, qword [0x1400f4a78]
je 0x140083db7
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
cmp eax, esi
jne 0x140083c8a
xor eax, eax
jmp 0x140083dbc
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, 0xffffffff
mov r11d, eax
cmp r11, rbp
mov qword [rbx + 0x18], r11
je 0x140083c83
mov rcx, qword [rdi + 0x18]
cmp dword [rcx - 0x10], esi
jne 0x140083cb6
mov byte [rbx + 0x20], sil
jmp 0x140083cc7
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
movzx ecx, al
cmp eax, ebp
cmove ecx, esi
mov byte [rbx + 0x20], cl
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
cmp eax, esi
je 0x140083d0a
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp eax, esi
je 0x140083d0a
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x78]
or r8d, 0xffffffff
call fcn.140057168
mov rcx, qword [rax]
mov qword [rbx], rcx
jmp 0x140083d0d
mov qword [rbx], rsi
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
cmp eax, esi
je 0x140083d51
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp eax, esi
je 0x140083d51
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
or r8d, 0xffffffff
call fcn.140057168
mov rax, qword [rax]
mov qword [rbx + 0x10], rax
jmp 0x140083d55
mov qword [rbx + 0x10], rsi
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
cmp eax, esi
je 0x140083d99
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp eax, esi
je 0x140083d99
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
or r8d, 0xffffffff
call fcn.140057168
mov rax, qword [rax]
mov qword [rbx + 8], rax
jmp 0x140083d9d
mov qword [rbx + 8], rsi
cmp qword [rbx], rsi
jne 0x140083da9
mov rax, qword [rbx + 8]
mov qword [rbx], rax
cmp qword [rbx + 0x10], rsi
jne 0x140083db7
mov rax, qword [rbx + 8]
mov qword [rbx + 0x10], rax
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14009ec20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
sub rsp, 0x30
xor ebx, ebx
test r8, r8
mov rbp, r9
mov rsi, r8
mov r12d, edx
mov r13, rcx
jne 0x14009ec6c
call fcn.14009e320
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
call fcn.1400a5fc0
xor eax, eax
jmp 0x14009ed12
mov qword [rsp + 0x50], rdi
call fcn.1400a2a10
mov edx, 0x2d8
mov ecx, 1
call fcn.1400a5c60
test rax, rax
mov rdi, rax
je 0x14009ecf8
call fcn.1400a2ca0
mov rcx, rdi
mov rdx, qword [rax + 0xc0]
call fcn.1400a2a80
mov rcx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x70]
test rcx, rcx
lea r8, [rsp + 0x60]
mov rdx, r12
cmovne r8, rcx
mov r9, rdi
mov rcx, r13
mov qword [rsp + 0x28], r8
lea r8, [0x14009eb80]
mov qword [rdi + 0x90], rsi
mov qword [rdi + 0x98], rbp
mov qword [rdi + 8], 0xffffffffffffffff
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14009ed0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.14009db00
test ebx, ebx
je 0x14009ed0b
mov ecx, ebx
call fcn.14009e380
xor eax, eax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rsi
ret