joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f0380
Capabilities:
Query or enumerate registry key

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rbx, r9
mov edi, r8d
mov rsi, rdx
xor r8d, r8d
lea rdx, str.CBaseUtyMgr::EnumRegKey
lea rcx, [rsp + 0x48]
call fcn.1400075a0
nop
mov dword [rsp + 0x20], edi
mov r9, rsi
lea r8, str.hKey___08x__dwIndex___d
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.140007780
mov r11, qword [rsp + 0x98]
mov qword [rsp + 0x38], r11
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x90]
mov r8, rbx
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
mov r9d, eax
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x48]
call fcn.140007780
nop
lea rcx, [rsp + 0x48]
call fcn.140007730
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1400f0440
Capabilities:
Delete registry value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rbx, r8
mov rdi, rdx
xor r8d, r8d
lea rdx, str.CBaseUtyMgr::DeleteRegValue
lea rcx, [rsp + 0x38]
call fcn.1400075a0
nop
mov qword [rsp + 0x20], rbx
mov r9, rdi
lea r8, str.hKey___08x__name___d
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.140007780
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
mov r9d, eax
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x38]
call fcn.140007780
nop
lea rcx, [rsp + 0x38]
call fcn.140007730
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400f1570
Capabilities:
Check if file exists
Get file size

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rsi
mov rsi, rdx
xor r8d, r8d
lea rdx, str.CBaseUtyMgr::GetFileSize
lea rcx, [rsp + 0x48]
call fcn.1400075a0
nop
mov r9, rsi
lea r8, str.lpcFile___p
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.140007780
xor ebx, ebx
test rsi, rsi
jne 0x1400f15ed
xor r9d, r9d
lea r8, str.return___d
lea edx, [rbx + 2]
lea rcx, [rsp + 0x48]
call fcn.140007780
nop
lea rcx, [rsp + 0x48]
call fcn.140007730
xor eax, eax
jmp 0x1400f1722
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400f1623
xor r9d, r9d
lea r8, str.return___d
lea edx, [rax + 2]
lea rcx, [rsp + 0x48]
call fcn.140007780
nop
lea rcx, [rsp + 0x48]
call fcn.140007730
xor eax, eax
jmp 0x1400f1722
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400f1683
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400f1678
lea rdx, str._t_t_tGetFileSize
lea rcx, [rsp + 0x48]
call fcn.140029dc0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400f16f8
mov qword [rsp + 0x78], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x409
mov r8d, edi
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x1400f16e8
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
lea r9, str._t_t_tCreateFile
lea r8, str.ApiName:__s__ErrorCode:__d_:__s
mov edx, 6
lea rcx, [rsp + 0x48]
call fcn.140007780
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400f16f8
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [rsp + 0x20], ebx
mov r9, rsi
lea r8, str._s___d
mov edx, 2
lea rcx, [rsp + 0x48]
call fcn.140007780
nop
lea rcx, [rsp + 0x48]
call fcn.140007730
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1400f1f80
Capabilities:
Check if file exists
Create directory

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
lea rbp, [rax - 0x9e8]
sub rsp, 0xad0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rbp + 0x9c0], rax
mov rdi, rdx
xor r8d, r8d
lea rdx, str.CBaseUtyMgr::MakeSureDirectoryPathExistsOrg
lea rcx, [rsp + 0x20]
call fcn.1400075a0
nop
xor r13d, r13d
mov r12d, r13d
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r13
mov word [rsp + 0x38], r13w
xor r8d, r8d
lea rdx, [0x1402dc4e0]
lea rcx, [rsp + 0x38]
call fcn.140001f40
nop
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r13
mov word [rsp + 0x60], r13w
xor r8d, r8d
lea rdx, [0x1402dc4e0]
lea rcx, [rsp + 0x60]
call fcn.140001f40
nop
test rdi, rdi
jne 0x1400f2046
mov r12d, 0x80010001
mov dword [0x1403b95bc], 1
jmp 0x1400f2196
mov r9, rdi
lea r8, str._t_t_tpath___s.
mov edx, 7
lea rcx, [rsp + 0x20]
call fcn.140007780
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x1a0]
call fcn.14024b970
mov r8, rdi
mov edx, 0x208
lea rcx, [rbp + 0x1a0]
call fcn.140246628
mov esi, r13d
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1400f2196
lea rbx, [rbp + 0x1a0]
cmp word [rbx], 0x5c
jne 0x1400f217b
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x5b0]
call fcn.14024b970
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call fcn.14024b970
lea edx, [rsi + 1]
movsxd r9, edx
lea r8, [rbp + 0x1a0]
mov edx, 0x208
lea rcx, [rbp + 0x5b0]
call fcn.140247ee8
lea r8, [rbp + 0x5b0]
mov edx, 0x104
lea rcx, [rbp - 0x70]
call fcn.140246628
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x70]
repne scasw ax, word [rdi]
not rcx
dec rcx
test ecx, ecx
jle 0x1400f214c
lea rcx, [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400f217b
xor edx, edx
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400f217b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str._t_t_tCreateDirectory_error___x.
jmp 0x1400f2159
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str._t_t_tWideCharToMultiByte_error___x.
mov r9d, eax
mov edx, 7
lea rcx, [rsp + 0x20]
call fcn.140007780
mov dword [0x1403b95bc], 9
mov r12d, 0x80010009
inc esi
add rbx, 2
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, eax
jne 0x1400f20a6
mov r9d, r12d
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.140007780
mov edi, r13d
test r12d, r12d
sete dil
cmp qword [rsp + 0x78], 8
jb 0x1400f21cb
mov rcx, qword [rsp + 0x60]
call fcn.1401026ec
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r13
mov word [rsp + 0x60], r13w
cmp qword [rsp + 0x50], 8
jb 0x1400f21f1
mov rcx, qword [rsp + 0x38]
call fcn.1401026ec
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r13
mov word [rsp + 0x38], r13w
lea rcx, [rsp + 0x20]
call fcn.140007730
mov eax, edi
mov rcx, qword [rbp + 0x9c0]
xor rcx, rsp
call fcn.140245660
lea r11, [rsp + 0xad0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
Function at 0x1400f2240
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x6a0
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x690], rax
xor ebx, ebx
mov rdi, rdx
test rdx, rdx
jne 0x1400f227b
mov dword [0x1403b95bc], 1
or eax, 0xffffffff
jmp 0x1400f234b
lea rcx, [rsp + 0x480]
xor edx, edx
mov r8d, 0x208
call fcn.14024b970
lea rcx, [rsp + 0x270]
xor edx, edx
mov r8d, 0x208
call fcn.14024b970
lea rcx, [rsp + 0x270]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x270]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, [rsp + 0x270]
lea rdx, [0x1402e3988]
lea rcx, [rsp + 0x480]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400f2349
nop dword [rax]
lea rdx, [0x1402e3994]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400f232e
lea rdx, [0x1402e3998]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400f232e
inc ebx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400f2300
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0x6b0]
add rsp, 0x6a0
pop rdi
ret
Function at 0x1400f3280
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0x10080
call fcn.14024c240
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x10070], rax
mov rbp, r9
mov rsi, r8
mov rdi, rdx
xor r8d, r8d
lea rdx, str.CBaseUtyMgr::GetSectionList
lea rcx, [rsp + 0x20]
call fcn.1400075a0
nop
test rdi, rdi
je 0x1400f33c6
test rsi, rsi
je 0x1400f33c6
xor r12d, r12d
mov word [rsp + 0x70], r12w
xor edx, edx
mov r8d, 0xfffc
lea rcx, [rsp + 0x72]
call fcn.14024b970
mov r8, rdi
mov edx, 0x7fff
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea rbx, [rsp + 0x70]
cmp word [rsp + 0x70], r12w
je 0x1400f33db
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
mov rdx, rsi
mov rcx, rbx
call fcn.140249654
test eax, eax
jne 0x1400f33a9
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r12
mov word [rsp + 0x40], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140001f40
nop
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.140040160
nop
cmp qword [rsp + 0x58], 8
jb 0x1400f3390
mov rcx, qword [rsp + 0x40]
call fcn.1401026ec
mov r9, rbx
lea r8, str._t_t_tAdd_:___s_.
mov edx, 7
lea rcx, [rsp + 0x20]
call fcn.140007780
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rbx, [rbx + rcx*2 + 2]
cmp word [rbx], 0
jne 0x1400f3320
jmp 0x1400f33db
mov r9, qword [rbp + 8]
mov r8, qword [rbp]
lea rdx, [rsp + 0x38]
mov rcx, rbp
call fcn.140035f90
lea r8, [0x1402dc4e0]
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.140007780
nop
lea rcx, [rsp + 0x20]
call fcn.140007730
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.140245660
add rsp, 0x10080
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400f3980
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x680
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
xor r8d, r8d
lea rdx, str.CBaseUtyMgr::DeleteRegKeyOfRecursive
lea rcx, [rsp + 0x38]
call fcn.1400075a0
nop
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea r8, str.hKey___08x__lpcKey___s
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.140007780
xor r12d, r12d
mov esi, r12d
mov qword [rsp + 0x30], r12
mov rax, qword [rbp]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
mov r8, rdi
mov rdx, rbx
mov rcx, rbp
call qword [rax + 0xf0]
test eax, eax
jne 0x1400f3aaa
nop dword [rax + rax]
mov r9d, 0x30c
lea r8, [rsp + 0x50]
mov edx, esi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc esi
test eax, eax
je 0x1400f3a4a
cmp eax, 0x103
je 0x1400f3a91
mov ebx, r12d
jmp 0x1400f3a8b
mov rax, qword [rbp]
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov rcx, rbp
call qword [rax + 0x1b8]
mov ebx, eax
test eax, eax
je 0x1400f3a96
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x1400f3a88
cmp eax, 2
je 0x1400f3a88
mov ebx, r12d
mov eax, 0x103
mov esi, r12d
test eax, eax
jne 0x1400f3a96
jmp 0x1400f3a20
mov ebx, 1
mov rax, qword [rbp]
mov rdx, qword [rsp + 0x30]
mov rcx, rbp
call qword [rax + pe_nt_image_headers64]
jmp 0x1400f3ab6
mov ebx, 1
cmp eax, 2
cmovne ebx, r12d
mov r9d, ebx
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x38]
call fcn.140007780
nop
lea rcx, [rsp + 0x38]
call fcn.140007730
mov eax, ebx
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.140245660
add rsp, 0x680
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400f3dd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov r9, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r9
xor r8d, r8d
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
je 0x1400f3e3b
lea r10, [0x140000000]
nop dword [rax]
movzx eax, byte [r9]
mov ecx, r8d
add r9, 2
xor al, r8b
shr ecx, 8
movzx edx, al
mov eax, edx
and edx, 0xf
shr rax, 4
mov eax, dword [r10 + rax*4 + 0x2dc5b0]
xor eax, dword [r10 + rdx*4 + 0x2dc570]
mov r8d, eax
xor r8d, ecx
dec rdi
jne 0x1400f3e00
mov eax, r8d
mov rdi, qword [rsp + 8]
ret

Function at 0x1400fb7e0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x118]
mov rbx, rcx
mov rcx, rdi
mov edx, 2
call fcn.14011b8d0
lea r8, [rbx + 0x1f0]
mov edx, 0x3e8
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14011b9d0
Function at 0x1401022a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov rsi, r9
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
xor r8d, r8d
lea rdx, str.CBaseRegData::QueryValue
lea rcx, [rsp + 0x38]
call fcn.1400075a0
nop
mov r9, rdi
lea r8, str.name___s
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.140007780
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0
mov r9, rbp
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov qword [rbx + 0x10], 0
test eax, eax
jne 0x14010239e
mov edx, dword [rsi]
add edx, 4
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x140102385
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov r9, rbp
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14010239e
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test rax, rax
jne 0x140102372
mov qword [rbx + 0x10], rax
jmp 0x14010239e
lea rdx, str._t_t_tGlobalFree
lea rcx, [rsp + 0x38]
call fcn.140029dc0
jmp 0x14010239e
mov r9, rdi
lea r8, str._t_t_tCannot_Get_Area_for___s_
mov edx, 7
lea rcx, [rsp + 0x38]
call fcn.140007780
mov r9, qword [rbx + 0x10]
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x38]
call fcn.140007780
mov rbx, qword [rbx + 0x10]
lea rcx, [rsp + 0x38]
call fcn.140007730
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1401023e0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov edi, r9d
mov ebx, r8d
mov rsi, rdx
mov r12, rcx
xor r8d, r8d
lea rdx, str.CBaseRegData::SetValue
lea rcx, [rax - 0x20]
call fcn.1400075a0
nop
mov rbp, qword [rsp + 0x90]
mov r9, rsi
mov edx, 1
lea rcx, [rsp + 0x48]
test rbp, rbp
je 0x14010247d
cmp ebx, edx
jne 0x14010245b
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edx
lea r8, str.name___s__dwType___X__dwSize___d__value___s
call fcn.140007780
jmp 0x140102491
cmp ebx, 4
jne 0x14010247d
mov eax, dword [rbp]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
lea r8, str.name___s__dwType___X__dwSize___d__value___X
call fcn.140007780
jmp 0x140102491
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
lea r8, str.name___s__dwType___X__dwSize___d
call fcn.140007780
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbp
mov r9d, ebx
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov r9d, eax
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x48]
call fcn.140007780
nop
lea rcx, [rsp + 0x48]
call fcn.140007730
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x1401082c4
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb0], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14010833e
xor r8d, r8d
call fcn.1401081f8
mov rsi, rax
test rax, rax
jne 0x1401082fa
mov eax, edi
jmp 0x140108354
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x1401082f6
mov r9, qword [rcx + 0xd8]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140109210
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140109273
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140109287
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140109287
mov rcx, qword [rbx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x14010928c
cmp dword [rcx + 8], 0
je 0x140109287
mov rdx, r8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14010928c
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14010e0cc
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.14011f274
mov rsi, rax
test rax, rax
je 0x14010e148
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x14010e143
cmp dword [rbx], 0x40
jb 0x14010e143
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14010e143
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x14010e14c
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140115ef0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140115f58
call fcn.14010b1bc
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140115f58
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140115f7a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.1401158dc
mov esi, eax
test rdi, rdi
je 0x140115f78
test rbx, rbx
je 0x140115f78
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x1401164c0
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xc8], 0
jne 0x1401164fe
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1401165b2
call fcn.140102a14
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14011651d
mov ecx, 0x80004005
call fcn.140005210
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx + 0xc8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140247ee8
test eax, eax
je 0x140116585
cmp eax, 0xc
je 0x14011657f
cmp eax, 0x16
je 0x140116579
cmp eax, 0x22
je 0x140116579
cmp eax, 0x50
je 0x140116585
call fcn.140102ffc
int3
call fcn.140102ffc
int3
call fcn.140102fb4
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x1401165b0
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14011742c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, r8
mov rbx, rdx
mov r13, rcx
xor edi, edi
call fcn.14010b1bc
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x140117488
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r12
mov rdx, rdi
mov rcx, r13
call fcn.140116ebc
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x14011751c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xe0], rdx
test rdx, 0xffffffffffff0000
jne 0x14011755b
cmp dword [rcx + 0xd8], 0
jne 0x14011755b
movzx eax, dx
mov dword [rcx + 0xd8], eax
call fcn.14010b1bc
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1401174c0
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14011f9f8
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14011fa2e
xor eax, eax
jmp 0x14011fa7a
lea rcx, [rsp + 0x20]
call fcn.14024af50
cmp word [rsp + rax*2 + 0x1e], 0x5c
je 0x14011fa5a
lea r8, [0x1402e5094]
lea rcx, [rsp + 0x20]
mov edx, 0x105
call fcn.140246470
test eax, eax
jne 0x14011fa2a
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x105
call fcn.140246470
test eax, eax
jne 0x14011fa2a
lea rcx, [rsp + 0x20]
call fcn.140106fd8
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140245660
add rsp, 0x240
pop rbx
ret