joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453528
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8a8
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x890], rax
mov r12, r9
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor r15d, r15d
or r14, 0xffffffffffffffff
mov r11d, eax
cmp eax, r15d
je 0x453587
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
jne 0x45378e
mov r13d, 0x208
lea rcx, [rsp + 0x262]
xor edx, edx
mov r8, r13
mov word [rsp + 0x260], r15w
call fcn.00449860
lea rcx, [rsp + 0x472]
mov r8, r13
xor edx, edx
mov word [rsp + 0x470], r15w
call fcn.00449860
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov r15d, 0x105
lea r9, [rsp + 0x470]
lea rdx, [rsp + 0x260]
mov rcx, r12
mov r8, r15
mov qword [rsp + 0x20], r15
call fcn.0044504c
lea r8, [rsp + 0x470]
lea rcx, [rsp + 0x260]
mov rdx, r15
call fcn.00444f54
lea r8, str..LocData
lea rcx, [rsp + 0x260]
mov rdx, r15
call fcn.00444f54
call fcn.00475244
lea rcx, [rsp + 0x52]
xor r12d, r12d
mov r8, r13
xor edx, edx
movzx edi, ax
mov word [rsp + 0x50], r12w
call fcn.00449860
lea rcx, [rsp + 0x682]
mov r8, r13
xor edx, edx
mov word [rsp + 0x680], r12w
call fcn.00449860
lea r9d, [r12 + 0xa]
lea rdx, [rsp + 0x680]
mov ecx, edi
mov r8, r15
call fcn.00445bf0
lea r8, [rsp + 0x260]
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.004444bc
lea r8, [0x0049e5ac]
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.00444f54
lea r8, [rsp + 0x680]
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.00444f54
lea r8, str..ini
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.00444f54
lea r9, [rsp + 0x50]
mov r8d, ebp
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov r11d, eax
cmp eax, r12d
je 0x453704
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
jne 0x45378e
lea r8, [rsp + 0x260]
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.004444bc
lea r8, str..1033.ini
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.00444f54
lea r9, [rsp + 0x50]
mov r8d, ebp
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov r11d, eax
cmp eax, r12d
je 0x45375d
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
jne 0x45378e
lea r8, str..ini
lea rcx, [rsp + 0x260]
mov rdx, r15
call fcn.00444f54
lea r9, [rsp + 0x260]
mov r8d, ebp
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov r11d, eax
mov eax, r11d
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.00443d60
add rsp, 0x8a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x459b98
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x60]
lea rdx, str.SystemCurrentControlSetControlWindows
mov r8d, 0x52
call fcn.00449960
mov rax, qword [str.CSDVersion]
lea r11, [rsp + 0x48]
mov qword [r11], rax
mov rax, qword [0x004a1188]
lea rdx, [rsp + 0x60]
mov qword [r11 + 8], rax
mov eax, dword [0x004a1190]
mov r9d, 0x20019
mov dword [r11 + 0x10], eax
movzx eax, word [0x004a1194]
xor r8d, r8d
mov word [r11 + 0x14], ax
lea rax, [rsp + 0x38]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x459c27
xor eax, eax
jmp 0x459c71
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x459c23
movzx eax, word [rsp + 0x30]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.00443d60
add rsp, 0xd0
pop rbx
ret

Function at 0x459c90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp dword [rcx + 4], 2
mov rbx, rcx
jne 0x459d51
cmp dword [rcx + 8], 5
jb 0x459d51
xor edx, edx
lea rcx, [rsp + 0x41]
mov byte [rsp + 0x40], 0xff
lea r8d, [rdx + 0x3f]
call fcn.00449860
lea r8, [rsp + 0x38]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerExecutive
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x459d51
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.PriorityQuantumMatrix
xor r8d, r8d
mov dword [rsp + 0x30], 0x40
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x459d46
cmp dword [rsp + 0x34], 3
jne 0x459d46
cmp dword [rsp + 0x30], 8
jb 0x459d46
cmp dword [rsp + 0x44], eax
je 0x459d46
mov byte [rbx + 0x41], 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.00443d60
add rsp, 0x90
pop rbx
ret
Function at 0x45a1e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x4c0
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
xor esi, esi
mov rbx, rcx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov byte [rcx + 0x17], sil
mov byte [rcx + 0x40], sil
mov byte [rcx + 0x41], sil
lea rcx, [rsp + 0x60]
lea r8d, [rsi + 0x54]
call fcn.00449960
mov rax, qword [str.ProductId]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov rax, qword [0x00493310]
lea r8, [rsp + 0x38]
mov qword [rdx + 8], rax
mov eax, dword [0x00493318]
mov rcx, 0xffffffff80000002
mov dword [rdx + 0x10], eax
lea rdx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, esi
jne 0x45a3b7
lea rcx, [rsp + 0xc2]
xor edx, edx
mov r8d, 0x3e6
mov word [rsp + 0xc0], si
call fcn.00449860
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
xor r8d, r8d
mov dword [rsp + 0x30], 0x3e8
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x45a3ac
lea rcx, [rsp + 0xc0]
mov edx, 0x1f4
call fcn.004702e0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xc0]
lea rdx, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbx + 0x18]
call fcn.00404e54
lea rdx, [0x00493300]
lea rcx, [rsp + 0xc0]
call fcn.00445330
cmp rax, rsi
setne al
cmp dword [rbx + 4], 2
mov byte [rbx + 0x17], al
jne 0x45a3ac
lea edi, [rsi + 5]
cmp dword [rbx + 8], edi
jb 0x45a3ac
lea rdx, str.51883
lea rcx, [rsp + 0xc0]
mov r8, rdi
call fcn.00444650
cmp eax, esi
je 0x45a3a8
lea rdx, str.51882
lea rcx, [rsp + 0xc0]
mov r8, rdi
call fcn.00444650
cmp eax, esi
je 0x45a3a8
lea rdx, str.51222
lea rcx, [rsp + 0xc0]
mov r8, rdi
call fcn.00444650
cmp eax, esi
je 0x45a3a8
lea rdx, str.82503
lea rcx, [rsp + 0xc0]
mov r8, rdi
call fcn.00444650
cmp eax, esi
jne 0x45a3ac
mov byte [rbx + 0x41], 1
jmp 0x45a3ac
mov byte [rbx + 0x40], 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.00443d60
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x45a710
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x280
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov qword [rcx + 0x38], 7
xor eax, eax
mov qword [rcx + 0x30], rax
mov word [rcx + 0x20], ax
mov dword [rsp + 0x30], VarUI4FromDisp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [rsp + 0x40]
mov dword [rbx + 4], ecx
mov eax, dword [rsp + 0x34]
mov dword [rbx + 8], eax
mov eax, dword [rsp + 0x38]
mov dword [rbx + 0xc], eax
movzx eax, word [rsp + 0x3c]
cmp ecx, 2
cmove eax, dword [rsp + 0x3c]
mov dword [rbx + 0x10], eax
mov rcx, rbx
call fcn.00459b98
mov dword [rbx], eax
cmp dword [rbx + 4], 2
jne 0x45a7cd
cmp dword [rbx + 8], 5
jb 0x45a7cd
mov dword [rsp + 0x150], 0x11c
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx r11d, word [rsp + 0x268]
mov word [rbx + 0x14], r11w
mov cl, byte [rsp + 0x26a]
mov byte [rbx + 0x16], cl
mov rcx, rbx
call fcn.0045a1e0
mov rcx, rbx
call fcn.00459c90
nop
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.00443d60
add rsp, 0x280
pop rbx
ret

Function at 0x45a800
Capabilities:
Get hostname

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor edi, edi
mov word [rsp + 0x80], di
xor edx, edx
mov r8d, 0x206
lea rcx, [r11 - 0x226]
call fcn.00449860
mov dword [rsp + 0x20], 0x104
mov ebx, edi
lea rcx, [rsp + 0x30]
call fcn.0045a710
nop
cmp dword [rsp + 0x34], 2
jne 0x45a8e2
cmp dword [rsp + 0x38], 5
jb 0x45a8e2
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x80]
lea ecx, [rdi + 7]
call sub.Secur32.dll_GetComputerObjectNameW
cmp al, dil
je 0x45a8c9
lea edx, [rdi + 0x2f]
lea rcx, [rsp + 0x80]
call fcn.00445930
cmp rax, rdi
je 0x45a8c9
mov word [rax], di
mov edx, 0x104
lea rcx, [rsp + 0x80]
call fcn.00444b84
lea rdx, str.microsoft.com
lea rcx, [rsp + 0x80]
call fcn.00445330
cmp rax, rdi
setne bl
cmp ebx, edi
setne bl
cmp qword [rsp + 0x68], 8
jb 0x45a8f7
mov rcx, qword [rsp + 0x50]
call fcn.00443d3c
jmp 0x45a8f7
cmp qword [rsp + 0x68], 8
jb 0x45a8f4
mov rcx, qword [rsp + 0x50]
call fcn.00443d3c
mov bl, dil
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
mov al, bl
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.00443d60
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x2a0
pop rdi
ret
Function at 0x45f938
Capabilities:
Copy file
Get common file path
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rdi, rcx
mov rsi, rdx
mov ebx, 0x206
lea rcx, [rsp + 0x252]
xor ebp, ebp
xor edx, edx
mov r8, rbx
mov word [rsp + 0x250], bp
call fcn.00449860
lea rcx, [rsp + 0x42]
mov r8, rbx
xor edx, edx
mov word [rsp + 0x40], bp
call fcn.00449860
lea rdx, [rsp + 0x250]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rsp + 0x40]
lea rdx, [0x00494b30]
lea rcx, [rsp + 0x250]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rbx, [rdi + 8]
cmp qword [rbx + 0x20], 8
jb 0x45f9d5
mov rcx, qword [rbx + 8]
jmp 0x45f9d9
lea rcx, [rbx + 8]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x40]
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x45fa80
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rbp
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str._Watson_UX_Log_file_size___d_.
mov r8d, edi
mov rcx, rsi
call fcn.0045fe58
cmp edi, 2
ja 0x45fa5a
lea rdx, str._WARNING:_No_need_to_send_empty_UX_log.
mov rcx, rsi
call fcn.0045fe58
jmp 0x45fa9d
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x40]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.00404e54
mov al, 1
jmp 0x45fa9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsp + 0x40]
lea rdx, str._WARNING:_CreateFile_on___s__failed_with____d_
mov r9d, eax
mov rcx, rsi
call fcn.0045fe58
xor al, al
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.00443d60
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x470
pop rdi
pop rsi
pop rbp
ret
Function at 0x45fbc8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rbp, rdx
cmp byte [rcx + 0x58], bl
jne 0x45fbed
xor al, al
jmp 0x45fcaf
cmp qword [rcx + 0x50], 8
mov dword [rsp + 0x50], ebx
jb 0x45fbfe
mov rcx, qword [rcx + 0x38]
jmp 0x45fc02
add rcx, 0x38
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0xc0000000
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x45fbe6
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x45fc56
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45fbe6
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasw ax, word [rdi]
lea r9, [rsp + 0x50]
mov rdx, rbp
not rcx
mov qword [rsp + 0x20], rbx
lea r8d, [rcx + rcx - 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
je 0x45fc4b
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasw ax, word [rdi]
mov eax, dword [rsp + 0x50]
not rcx
dec rcx
add rcx, rcx
cmp rax, rcx
jne 0x45fca4
mov bl, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x460054
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rdx + 0x18], 0
mov rbx, rdx
mov rsi, rcx
jne 0x46007f
xor al, al
jmp 0x46012c
neg r8b
sbb eax, eax
and eax, 2
add eax, 2
cmp qword [rdx + 0x20], 8
jb 0x460097
mov rcx, qword [rdx + 8]
jmp 0x46009b
lea rcx, [rdx + 8]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x460078
and dword [rsp + 0x40], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x44]
mov r8d, 6
mov rcx, rax
mov byte [rsp + 0x44], 0xff
mov byte [rsp + 0x45], 0xfe
mov byte [rsp + 0x46], 0xd
mov byte [rsp + 0x47], 0
mov byte [rsp + 0x48], 0xa
mov byte [rsp + 0x49], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsi + 0x30]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
call fcn.004020b0
mov byte [rsi + 0x58], 1
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.00443d60
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x460148
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x58], 0
mov rdi, rcx
je 0x460189
cmp qword [rcx + 0x50], 8
jb 0x460168
mov rcx, qword [rcx + 0x38]
jmp 0x46016c
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x004998e4]
lea rcx, [rdi + 0x30]
xor r8d, r8d
mov byte [rdi + 0x58], 0
call fcn.00404e54
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x46019c
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
cmp qword [rdx + 0x18], r12
jne 0x460214
lea esi, [r12 + 7]
mov qword [rcx + 0x20], rsi
mov qword [rcx + 0x18], r12
mov word [rcx + 8], r12w
xor r8d, r8d
lea rdx, [0x004998e4]
call fcn.00404e54
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
jmp 0x46037e
mov word [rsp + 0x270], r12w
mov esi, 0x208
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x272]
call fcn.00449860
lea rdx, [rsp + 0x270]
mov ecx, 0x104
call fcn.0040ddbc
cmp eax, r12d
jne 0x460280
mov esi, 7
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x18], r12
mov word [rbx + 8], r12w
xor r8d, r8d
lea rdx, [0x004998e4]
mov rcx, rbx
call fcn.00404e54
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
jmp 0x46037e
mov word [rsp + 0x60], r12w
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x62]
call fcn.00449860
cmp qword [rdi + 0x20], 8
jb 0x4602a2
mov rdx, qword [rdi + 8]
jmp 0x4602a6
lea rdx, [rdi + 8]
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, r12d
jne 0x4602f6
mov esi, 7
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x18], r12
mov word [rbx + 8], r12w
xor r8d, r8d
lea rdx, [0x004998e4]
mov rcx, rbx
call fcn.00404e54
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
jmp 0x46037e
mov esi, 7
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], r12
mov word [rsp + 0x40], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.00404e54
nop
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x18], r12
mov word [rbx + 8], r12w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.004020b0
mov dword [rsp + 0x20], 1
cmp qword [rsp + 0x58], 8
jb 0x46036b
mov rcx, qword [rsp + 0x40]
call fcn.00443d3c
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], r12
mov word [rsp + 0x40], r12w
mov rax, rbx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.00443d60
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x461de4
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x170
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdi, rdx
mov rbx, rcx
call fcn.004551b8
mov rsi, qword [rax + 0x70]
mov r12d, 7
mov qword [rsp + 0x130], r12
xor ebp, ebp
mov qword [rsp + 0x128], rbp
mov word [rsp + 0x118], bp
or r13, 0xffffffffffffffff
mov r9, r13
xor r8d, r8d
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x110]
call fcn.004020b0
nop
lea r8, str.__d
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x68]
call fcn.0040c560
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x138]
call fcn.0040c644
nop
cmp qword [rsp + 0x88], 8
jb 0x461ea1
mov rcx, qword [rsp + 0x70]
call fcn.00443d3c
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x80], rbp
mov word [rsp + 0x70], bp
mov rdi, qword [rsp + 0x150]
inc rdi
mov eax, 2
mul rdi
cmovo rax, r13
mov rcx, rax
call fcn.004444b0
mov rbx, rax
cmp rax, rbp
jne 0x461f2d
cmp qword [rsp + 0x158], 8
jb 0x461ef5
mov rcx, qword [rsp + 0x140]
call fcn.00443d3c
mov qword [rsp + 0x158], r12
mov qword [rsp + 0x150], rbp
mov word [rsp + 0x140], bp
cmp qword [rsp + 0x130], 8
jb 0x461f25
mov rcx, qword [rsp + 0x118]
call fcn.00443d3c
mov bl, bpl
jmp 0x462087
lea r8, [rdi + rdi]
xor edx, edx
mov rcx, rax
call fcn.00449860
lea r8, [rsp + 0x140]
cmp qword [rsp + 0x158], 8
cmovae r8, qword [rsp + 0x140]
mov rdx, rdi
mov rcx, rbx
call fcn.004444bc
mov edi, 0x68
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.00449860
mov dword [rsp + 0xa0], edi
cmp rsi, rbp
je 0x461faf
lea r8, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae r8, qword [rsp + 0x118]
mov r9, rbx
lea rdx, str.STATUS:_Launching_watson_with_command_lines:_r_n_tCMD:___s_r_n_tARGS:__s
mov rcx, rsi
call fcn.0045fe58
lea rcx, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae rcx, qword [rsp + 0x118]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebp
je 0x462030
or edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
jmp 0x462032
mov edi, ebp
mov rcx, rbx
call fcn.00444544
cmp edi, ebp
setne bl
cmp qword [rsp + 0x158], 8
jb 0x462057
mov rcx, qword [rsp + 0x140]
call fcn.00443d3c
mov qword [rsp + 0x158], r12
mov qword [rsp + 0x150], rbp
mov word [rsp + 0x140], bp
cmp qword [rsp + 0x130], 8
jb 0x462087
mov rcx, qword [rsp + 0x118]
call fcn.00443d3c
mov qword [rsp + 0x130], r12
mov qword [rsp + 0x128], rbp
mov word [rsp + 0x118], bp
mov al, bl
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.00443d60
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x475244
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x3c0
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
cmp eax, ebx
jne 0x475282
mov eax, 0xffff
jmp 0x4754e4
xor edx, edx
cmp dword [rsp + 0x50], 2
je 0x47533f
lea r8d, [rdx + 0x3e]
lea rcx, [rsp + 0x162]
mov word [rsp + 0x160], bx
call fcn.00449860
lea rax, [rsp + 0x30]
lea rdx, str..DefaultControl_PaneldesktopResourceLocale
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000003
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x40
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x475278
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea rdx, [0x004998e4]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x160]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
cmp eax, ebx
je 0x47531e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x475278
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, [rsp + 0x160]
lea r8d, [rdx + 0x10]
call fcn.00444de4
mov r11d, eax
jmp 0x4754e0
mov eax, dword [rsp + 0x44]
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
comisd xmm0, xmmword [0x00498ab0]
jb 0x47540e
lea rcx, [rsp + 0x1a2]
mov r8d, 0x208
mov word [rsp + 0x1a0], bx
call fcn.00449860
lea rcx, [rsp + 0x1a0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str.kernel32.dll
lea rcx, [rsp + 0x1a0]
mov edx, 0x20a
call fcn.00418be4
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, rbx
je 0x475278
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
je 0x475278
call rax
mov ecx, 0x3ff
mov r11w, ax
and ax, cx
cmp ax, 4
jne 0x4754e0
mov ecx, 0xfc00
movzx eax, r11w
and ax, cx
mov ecx, 0xc00
cmp ax, cx
jne 0x4754e0
mov r11d, 0x404
jmp 0x4754e0
lea rcx, [rsp + 0x162]
mov r8d, 0x3e
mov word [rsp + 0x160], bx
call fcn.00449860
lea rax, [rsp + 0x30]
lea rdx, str..DefaultControl_PanelInternational
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000003
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x40
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x475278
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea rdx, str.Locale
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x160]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
cmp eax, ebx
jne 0x475313
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, [rsp + 0x160]
lea r8d, [rdx + 0x10]
call fcn.00444de4
mov r11w, ax
mov eax, 0x401
cmp ax, r11w
je 0x4754da
mov eax, 0x40d
cmp ax, r11w
je 0x4754da
mov eax, 0x41e
cmp ax, r11w
jne 0x4754e0
mov r11d, 0x409
mov ax, r11w
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.00443d60
add rsp, 0x3c0
pop rbx
ret