joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1600bdd44
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
mov r10, rdx
mov r11, rcx
test r8, r8
jne 0x1600bdd62
mov ecx, 0x80004005
call fcn.1600b8734
int3
mov r9d, ebx
mov rdx, r8
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rdx + rcx*2], bx
jne 0x1600bdd6c
inc ecx
lea rdx, [rdx + rcx*2]
lea r9d, [r9 + rcx*2]
cmp ecx, 1
jne 0x1600bdd68
mov dword [rsp + 0x28], r9d
mov rdx, r10
mov qword [rsp + 0x20], r8
lea r9d, [rcx + 6]
mov rcx, qword [r11]
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
add rsp, 0x30
pop rbx
ret

Function at 0x1600c00d0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 0x18], 0x1bf9282
jmp 0x160003a13

Function at 0x1600c08d0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 0x18], 0x1bf9282
jmp 0x1600077b3

Function at 0x1600c0e40
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp - 0x18], 0x1bf9282
jmp 0x160005b81

Function at 0x1600c1fbc
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x9c0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x9b0], rax
xor ebx, ebx
test rcx, rcx
je 0x1600c2076
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.1600c0044
nop
mov rax, qword [rsp + 0x48]
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [0x1601d4934]
lea rcx, [rsp + 0x48]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rax, qword [rsp + 0xe8]
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [0x1601d4934]
lea rcx, [rsp + 0xe8]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov edx, 0xc0041801
lea rcx, [rsp + 0x40]
call fcn.1600cd1d8
xor r9d, r9d
lea r8, str.The_catalog_is_corrupt
mov edx, 0x40001b82
lea rcx, [rsp + 0x40]
call fcn.1600c1b70
nop
lea rcx, [rsp + 0x40]
call fcn.1600c0898
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x160153430]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x1600c20a8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x1600c20bf
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jg 0x1600c20b6
mov ebx, eax
jmp 0x1600c20bf
movzx ebx, ax
or ebx, 0x80070000
mov eax, ebx
mov rcx, qword [rsp + 0x9b0]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x9c0
pop rbx
ret
Function at 0x1600c3094
Capabilities:
Get process image filename

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x218]
sub rsp, 0x300
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov rbx, rdx
xor esi, esi
mov dword [rdx], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x41
mov word [rsp + 0x58], si
lea rax, fcn.160040970
mov qword [rsp + 0x40], rax
mov r8d, 0x104
lea rdx, [rbp - 0x20]
call qword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_K32GetProcessImageFileNameW]
mov edi, eax
test eax, eax
je 0x1600c3172
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + 0x20]
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call qword [case.0x16003fc5a.0]
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.160034aac
mov r9d, dword [rsp + 0x54]
mov dword [rsp + 0x28], r9d
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0x20], r8
mov edx, 0x100
mov ecx, 0x800
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_LCMapStringW]
lea rdx, str.searchindexer.exe
lea rcx, [rsp + 0x40]
call fcn.160034afc
cmp eax, 0xffffffff
je 0x1600c3172
mov dword [rbx], 1
lea rcx, [rsp + 0x40]
call fcn.160040b2c
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x330]
add rsp, 0x300
pop rdi
pop rsi
pop rbp
ret
Function at 0x1600c33c8
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x60
lea r9, [rax + 0x18]
mov r8d, 0x10000
mov rbp, rdx
call fcn.1600c4308
mov esi, eax
test eax, eax
jne 0x1600c3480
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
test eax, eax
je 0x1600c3470
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rsp + 0x68]
lea rdx, str.MSS:__DeleteKey_call_failed_to_delete_reg_key__ls___error_0x_X.
mov r9d, esi
mov r8, rbp
mov ecx, 0x2000000
mov ebx, eax
call fcn.1600f0a4c
and dword [rsp + 0x50], 0
mov rcx, rax
and qword [rsp + 0x48], 0
lea rax, str._DeleteKey
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
mov edx, 0xf0000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x6d
call fcn.1600ecb60
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x1600c34e8
add eax, 0xfffffffe
cmp eax, 1
jbe 0x1600c34e6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rsp + 0x68]
lea rdx, str.MSS:__DeleteKey_call_failed_to_open_reg_key__ls___error_0x_X.
mov r9d, esi
mov r8, rbp
mov ecx, 0x2000000
mov ebx, eax
call fcn.1600f0a4c
and dword [rsp + 0x50], 0
mov rcx, rax
and qword [rsp + 0x48], 0
lea rax, str._DeleteKey
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
mov edx, 0xf0000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x72
call fcn.1600ecb60
jmp 0x1600c34e8
xor esi, esi
lea r11, [rsp + 0x60]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1600c37a0
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
sub rsp, 0x60
lea r9, [rax + 0x18]
mov r8d, 2
lea rdx, str.SOFTWAREMicrosoftWindows_Search
mov rcx, 0xffffffff80000002
call fcn.1600c4308
xor ebp, ebp
mov esi, eax
test eax, eax
jne 0x1600c387f
mov rcx, qword [rsp + 0x80]
lea rdx, str.SystemIndexNormalization
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x80]
mov esi, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [rsi - 2]
cmp eax, 1
cmovbe esi, ebp
test esi, esi
je 0x1600c38dc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rsp + 0x68]
lea r9, str.SOFTWAREMicrosoftWindows_Search
lea r8, str.SystemIndexNormalization
mov dword [rsp + 0x20], esi
lea rdx, str.MSS:__DeleteValue_call_failed_to_delete_reg_value__ls_under_reg_key__ls__error_0x_X.
mov ecx, 0x2000000
mov ebx, eax
call fcn.1600f0a4c
mov dword [rsp + 0x50], ebp
mov rcx, rax
mov qword [rsp + 0x48], rbp
lea rax, str._DeleteValue
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x8b
xor r9d, r9d
mov edx, 0xf0000
call fcn.1600ecb60
jmp 0x1600c38dc
add eax, 0xfffffffe
cmp eax, 1
jbe 0x1600c38da
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rsp + 0x68]
lea r8, str.SOFTWAREMicrosoftWindows_Search
mov r9d, esi
lea rdx, str.MSS:__DeleteValue_call_failed_to_open_reg_key__ls___error_0x_X.
mov ecx, 0x2000000
mov ebx, eax
call fcn.1600f0a4c
mov dword [rsp + 0x50], ebp
mov rcx, rax
mov qword [rsp + 0x48], rbp
lea rax, str._DeleteValue
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x93
jmp 0x1600c3870
mov esi, ebp
lea r11, [rsp + 0x60]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1600c3d14
Capabilities:
Create directory
Query environment variable

Disassembly:
sub rsp, 0x248
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, str._windir__system32_sysprepPanther
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1600c3d51
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x1600c3d5d
cmp eax, 0x104
jbe 0x1600c3d61
mov eax, 0x7a
test eax, eax
jne 0x1600c3da1
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x1600c3d8a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x50
je 0x1600c3d84
cmp eax, 0xb7
jne 0x1600c3d86
xor eax, eax
test eax, eax
jne 0x1600c3da1
lea rcx, [0x160274148]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
lea r8, [rsp + 0x20]
call fcn.1600ec170
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x248
ret
Function at 0x1600c6178
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
and qword [rsp + 0x38], 0
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
mov r9d, 1
mov edi, dword [rsp + 0x108]
mov r8d, 0x40000000
mov dword [rsp + 0x30], 0x80
mov rbp, rdx
mov dword [rsp + 0x28], edi
mov rax, qword [rcx]
and qword [rsp + 0x20], 0
mov rax, qword [rax + 0x70]
call qword [case.0x16003fc5a.0]
test eax, eax
js 0x1600c62c3
mov rcx, qword [rsi + 0x18]
mov eax, 0xfeff
mov ebx, 2
mov word [rsp + 0x50], ax
mov rax, qword [rcx]
cmp edi, ebx
je 0x1600c6288
mov rax, qword [rax + 0x60]
lea r8d, [rbx - 1]
lea rdx, [rsp + 0x60]
call qword [case.0x16003fc5a.0]
mov edi, eax
test eax, eax
js 0x1600c6273
cmp qword [rsp + 0x70], rbx
jae 0x1600c6228
mov edi, 0x80042105
jmp 0x1600c6273
mov rcx, qword [rsi + 0x18]
lea r9, [rsp + 0x58]
xor edx, edx
mov rax, qword [rcx]
lea r8d, [rdx + 1]
mov rax, qword [rax + 0x28]
call qword [case.0x16003fc5a.0]
mov edi, eax
test eax, eax
js 0x1600c6273
cmp qword [rsp + 0x58], rbx
jae 0x1600c626f
mov rcx, qword [rsi + 0x18]
lea r9, [rsp + 0x58]
xor r8d, r8d
mov rdx, rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x16003fc5a.0]
mov edi, eax
test edi, edi
jns 0x1600c62c1
mov rcx, qword [rsi + 0x18]
or rdx, 0xffffffffffffffff
add rcx, 0x18
call fcn.160057738
mov eax, edi
jmp 0x1600c62c3
mov rax, qword [rax + 0x20]
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov r8d, ebx
call qword [case.0x16003fc5a.0]
mov ebx, eax
test eax, eax
jns 0x1600c62c1
mov rcx, qword [rsi + 0x18]
or rdx, 0xffffffffffffffff
add rcx, 0x18
call fcn.160057738
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov eax, ebx
jmp 0x1600c62c3
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1600c8468
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rdx, r14
lea rcx, [rbp]
call fcn.160040ae8
nop
lea rcx, [rbp]
call fcn.16005a594
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
lea rdx, [rbp + 0xa0]
mov rcx, r14
call fcn.1600c885c
nop
mov r9d, dword [rax + 0x14]
mov rdx, qword [rax + 8]
mov rax, qword [rbp]
mov r8d, dword [rbp + 0x14]
lea rcx, [rbp]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
nop
lea rcx, [rbp + 0xa0]
call fcn.160040b2c
lea rdx, str.SoftwareMicrosoftWindows_Search
lea rcx, [rbp + 0xa0]
call fcn.16003df84
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x60]
call fcn.160040ae8
nop
lea rcx, [rbp + 0xa0]
call fcn.16003dfc4
lea rcx, [rsp + 0x60]
call fcn.16005a594
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
lea rdx, [rbp + 0x140]
mov rcx, r14
call fcn.1600c885c
nop
mov r9d, dword [rax + 0x14]
mov rdx, qword [rax + 8]
mov rax, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x74]
lea rcx, [rsp + 0x60]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
nop
lea rcx, [rbp + 0x140]
call fcn.160040b2c
cmp byte [r14 + 0x200], 0
je 0x1600c85a0
mov r8, qword [r14 + 0x168]
jmp 0x1600c85a3
xor r8d, r8d
mov rdx, qword [rbp + 8]
lea rcx, [rsp + 0x40]
call fcn.1600c7e60
nop
cmp byte [r14 + 0x200], 0
je 0x1600c85c5
mov r8, qword [r14 + 0x168]
jmp 0x1600c85c8
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.1600c7e60
nop
xor ebx, ebx
mov rdx, qword [r14 + 0xa8]
lea rcx, [rsp + 0x40]
call fcn.1600c8720
test eax, eax
jne 0x1600c860d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
cmp eax, 2
je 0x1600c860b
test eax, eax
jle 0x1600c860d
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1600c860d
xor ebx, ebx
mov esi, ebx
mov edi, ebx
mov rdx, qword [r14 + 0xa8]
lea rcx, [rsp + 0x30]
call fcn.1600c8720
test eax, eax
jne 0x1600c8644
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
cmp eax, 2
je 0x1600c8642
test eax, eax
jle 0x1600c8644
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1600c8644
xor ebx, ebx
test edi, edi
cmovs ebx, esi
mov eax, dword [rsp + 0x38]
neg eax
sbb rcx, rcx
mov edi, 1
and rcx, qword [rsp + 0x30]
mov qword [rsp + 0x30], rcx
je 0x1600c8672
mov rax, qword [rcx]
mov edx, edi
mov rax, qword [rax]
call qword [case.0x16003fc5a.0]
nop
mov eax, dword [rsp + 0x48]
neg eax
sbb rcx, rcx
and rcx, qword [rsp + 0x40]
mov qword [rsp + 0x40], rcx
je 0x1600c8696
mov rax, qword [rcx]
mov edx, edi
mov rax, qword [rax]
call qword [case.0x16003fc5a.0]
nop
lea rcx, [rsp + 0x60]
call fcn.160040b2c
nop
lea rcx, [rbp]
call fcn.160040b2c
mov eax, ebx
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.16006e590
add rsp, 0x2f0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1600c93d4
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, rcx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
mov esi, eax
test eax, eax
jne 0x1600c9425
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
mov rcx, qword [rsp + 0x48]
lea r8, str.onecoreuap_base_appmodel_search_searchcommonpkmutildlmstr.cxx
mov edx, 0x174
call fcn.160108adc
int3
mov eax, 2
mul rsi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
mov rax, qword [0x1601c0fd8]
call qword [case.0x16003fc5a.0]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov r8d, esi
mov rdx, rax
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
mov rax, qword [rdi]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
nop
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp fcn.160031c48

Function at 0x1600c9888
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0xb0]
test rcx, rcx
jne 0x1600c98a7
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x1600c98c8
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
test eax, eax
je 0x1600c98bb
mov ecx, eax
jmp 0x1600c989d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 1
add rsp, 0x28
ret

Function at 0x1600c9ae0
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0xb0]
test rcx, rcx
jne 0x1600c9aff
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x1600c9b1a
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
test eax, eax
je 0x1600c9b0d
mov ecx, eax
jmp 0x1600c9af5
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 1
add rsp, 0x28
ret
Function at 0x1600c9b20
Capabilities:
Query or enumerate registry key

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rbx, r8
mov esi, edx
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
cmp qword [rdi + 0xb0], 0
jne 0x1600c9b62
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x1600c9bd8
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8, qword [rbx + 8]
mov edx, esi
mov rcx, qword [rdi + 0xb0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
cmp eax, 0xea
jne 0x1600c9bbf
mov eax, dword [rsp + 0x60]
add eax, eax
mov dword [rsp + 0x60], eax
mov edx, dword [rsp + 0x60]
mov rcx, rbx
call fcn.160034ad4
nop
jmp 0x1600c9b69
test eax, eax
je 0x1600c9bc7
mov ecx, eax
jmp 0x1600c9b58
mov edx, dword [rsp + 0x60]
mov rcx, rbx
call fcn.160034aac
mov eax, 1
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1600c9c10
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rbx, r8
mov esi, edx
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
cmp qword [rdi + 0xb0], 0
jne 0x1600c9c52
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x1600c9cc4
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x60], eax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8, qword [rbx + 8]
mov edx, esi
mov rcx, qword [rdi + 0xb0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
cmp eax, 0xea
jne 0x1600c9cab
mov eax, dword [rsp + 0x60]
add eax, eax
mov dword [rsp + 0x60], eax
mov edx, dword [rsp + 0x60]
mov rcx, rbx
call fcn.160034ad4
nop
jmp 0x1600c9c59
test eax, eax
je 0x1600c9cb3
mov ecx, eax
jmp 0x1600c9c48
mov edx, dword [rsp + 0x60]
mov rcx, rbx
call fcn.160034aac
mov eax, 1
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1600c9dc4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, r9
xor ecx, ecx
mov rsi, r8
mov rbp, rdx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
jne 0x1600c9e07
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x1600c9e3b
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x1600c9e2e
lea ecx, [rax - 0x70]
jmp 0x1600c9dfd
test eax, eax
je 0x1600c9e36
mov ecx, eax
jmp 0x1600c9dfd
mov eax, 1
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1600c9e50
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 0xb0]
xor ebx, ebx
test rcx, rcx
jne 0x1600c9e71
lea ecx, [rbx + 6]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x1600c9eb3
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], bx
jne 0x1600c9e75
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x1600c9ea6
mov ecx, eax
jmp 0x1600c9e67
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x1600ca160
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor edx, edx
mov rsi, rcx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x1600ca284
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 3
jne 0x1600ca25e
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1600cac98
test al, al
je 0x1600ca237
mov rdi, qword [rsp + 0x38]
mov rcx, 0xffffffffffffffff
mov eax, 2
lea rbp, [rdi + 1]
mul rbp
lea rdx, [0x1601d7c98]
cmovo rax, rcx
mov rcx, rax
call fcn.16006eafc
mov rbx, rax
test rax, rax
jne 0x1600ca1eb
mov edi, 0x8007000e
lea edx, [rax + 0x7d]
mov r9d, edi
jmp 0x1600ca20a
mov r9, rdi
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.16006722c
mov edi, eax
test eax, eax
jns 0x1600ca227
mov r9d, eax
mov edx, 0x7e
mov rcx, qword [rsp + 0x28]
lea r8, str.internal_sdkincwil_filesystem.h
call fcn.1600b29f8
mov rcx, rbx
call fcn.160031c48
mov eax, edi
jmp 0x1600ca286
mov rcx, rbx
call fcn.1600ca160
mov rcx, rbx
call fcn.160031c48
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x1600ca284
mov rcx, qword [rsp + 0x28]
lea r8, str.internal_sdkincwil_filesystem.h
mov edx, 0x81
call fcn.1600b29e0
jmp 0x1600ca286
cmp eax, 0xb7
je 0x1600ca284
test eax, eax
je 0x1600ca284
mov rcx, qword [rsp + 0x28]
lea r8, str.internal_sdkincwil_filesystem.h
mov r9d, eax
mov edx, 0x85
call fcn.1600ca9a8
jmp 0x1600ca286
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret