joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801df5c0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov r8, qword [rsp + 0xa8]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x68]
call fcn.1801e4160
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.180074060
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x68]
call fcn.180073fc0
cmp dword [rsp + 0x50], 0
jne 0x1801df698
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x98
ret

Function at 0x1801df6b0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov r8, qword [rsp + 0x98]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x60]
call fcn.1801e4160
lea rcx, [rsp + 0x60]
call fcn.180074060
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf023f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1801df779
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
call fcn.180073fc0
add rsp, 0x88
ret

Function at 0x1801df7a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x1801df80e
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 4
je 0x1801df806
jmp 0x1801df80e
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add rsp, 0x58
ret
Function at 0x1801df820
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x118
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov r8, qword [rsp + 0x128]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xd0]
call fcn.1801e4160
nop
lea rcx, [rsp + 0xd0]
call fcn.180074060
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf023f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x54], eax
mov byte [rsp + 0x50], 0
cmp dword [rsp + 0x54], 0
jne 0x1801dfab1
lea rcx, [rsp + 0x88]
call fcn.180073cf0
nop
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x138]
call fcn.1800b6bf8
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x138]
call fcn.1800b6c28
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1800755a0
movzx eax, al
test eax, eax
je 0x1801df9f6
jmp 0x1801df92d
xor r8d, r8d
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x58]
call fcn.180075fe0
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsp + 0x138]
call fcn.1800b6c28
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1800755a0
movzx eax, al
test eax, eax
je 0x1801df9f4
lea rcx, [rsp + 0x58]
call fcn.1800760f0
mov rcx, rax
call fcn.180003ba0
shl rax, 1
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x58]
call fcn.1800760f0
mov rcx, rax
call fcn.180074060
mov r9, qword [0x18039a670]
mov rcx, qword [rsp + 0x78]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.1801de3b0
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x88]
call fcn.180073fe0
nop
lea rcx, [rsp + 0xf0]
call fcn.180073fc0
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x88]
call fcn.1800be5c8
jmp 0x1801df918
jmp 0x1801dfa0b
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x88]
call fcn.1800be5c8
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x88]
call fcn.1800be5c8
lea rcx, [rsp + 0x88]
call fcn.180003ba0
shl rax, 1
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x88]
call fcn.180074060
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jne 0x1801dfa87
mov dword [rsp + 0x60], 1
jmp 0x1801dfa8f
mov dword [rsp + 0x60], 0
movzx eax, byte [rsp + 0x60]
mov byte [rsp + 0x50], al
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x88]
call fcn.180073fc0
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x51], al
lea rcx, [rsp + 0xd0]
call fcn.180073fc0
movzx eax, byte [rsp + 0x51]
add rsp, 0x118
ret
Function at 0x1801e0150
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov r8, qword [rsp + 0xa8]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x68]
call fcn.1801e4160
lea rcx, [rsp + 0x68]
call fcn.180074060
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jne 0x1801e022b
mov rcx, qword [rsp + 0xb8]
call fcn.18017ce5c
lea rax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x54], eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x54], 0
jne 0x1801e023c
mov dword [rsp + 0x58], 1
jmp 0x1801e0244
mov dword [rsp + 0x58], 0
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x50], al
lea rcx, [rsp + 0x68]
call fcn.180073fc0
movzx eax, byte [rsp + 0x50]
add rsp, 0x98
ret

Function at 0x1801e02c0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov rcx, rax
call fcn.180003ba0
test rax, rax
je 0x1801e02e2
mov byte [rsp + 0x20], 1
jmp 0x1801e02e7
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1801e0306
mov rax, qword [rsp + 0x40]
mov rcx, rax
call fcn.180074060
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [rsp + 0x40]
mov rcx, rax
call fcn.180073fc0
mov rcx, qword [rsp + 0x40]
call fcn.1800014a0
add rsp, 0x38
ret
Function at 0x1801e0380
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x2048
call fcn.1801907a0
sub rsp, rax
cmp qword [rsp + 0x2050], 0
je 0x1801e03ad
cmp qword [rsp + 0x2050], 0xffffffffffffffff
jne 0x1801e03b4
xor al, al
jmp 0x1801e048f
cmp qword [rsp + 0x2058], 0
je 0x1801e03ca
cmp qword [rsp + 0x2058], 0xffffffffffffffff
jne 0x1801e03d1
xor al, al
jmp 0x1801e048f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x2050]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x2058]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov byte [rsp + 0x30], 0
xor eax, eax
cmp eax, 1
je 0x1801e047c
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, 0x2000
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2050]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1801e043e
jmp 0x1801e047c
cmp dword [rsp + 0x34], 0
jbe 0x1801e0473
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x34]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2058]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1801e0471
jmp 0x1801e047c
jmp 0x1801e047a
mov byte [rsp + 0x30], 1
jmp 0x1801e047c
jmp 0x1801e0402
mov rcx, qword [rsp + 0x2058]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
movzx eax, byte [rsp + 0x30]
add rsp, 0x2048
ret
Function at 0x1801e04a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x2068
call fcn.1801907a0
sub rsp, rax
cmp qword [rsp + 0x2078], 0
je 0x1801e0629
cmp qword [rsp + 0x2078], 0xffffffffffffffff
je 0x1801e0629
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x2078]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp qword [0x1803cb4d0], 0
je 0x1801e0531
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x2070]
call qword [0x1803cb4d0]
mov qword [rsp + 0x50], rax
jmp 0x1801e056b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x2070]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1801e0629
cmp qword [rsp + 0x48], 0xffffffffffffffff
je 0x1801e0629
mov byte [rsp + 0x40], 0
xor eax, eax
cmp eax, 1
je 0x1801e0609
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, 0x2000
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1801e05cb
jmp 0x1801e0609
cmp dword [rsp + 0x44], 0
jbe 0x1801e0600
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x2078]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1801e05fe
jmp 0x1801e0609
jmp 0x1801e0607
mov byte [rsp + 0x40], 1
jmp 0x1801e0609
jmp 0x1801e0592
mov rcx, qword [rsp + 0x2078]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x40]
jmp 0x1801e062b
xor al, al
add rsp, 0x2068
ret
Function at 0x1801e0d80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x50], 0
jne 0x1801e0da2
cmp qword [rsp + 0x50], 0xffffffffffffffff
jne 0x1801e0da2
xor al, al
jmp 0x1801e0e11
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x58]
call fcn.18017cd00
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1801e0df6
xor al, al
jmp 0x1801e0e11
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x34], eax
je 0x1801e0e04
xor al, al
jmp 0x1801e0e11
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov al, 1
add rsp, 0x48
ret
Function at 0x1801e0e20
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x4b8
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov dword [rsp + 0x4c], 0
lea rcx, [rsp + 0x68]
call fcn.180073cf0
nop
cmp qword [rsp + 0x4c8], 0
je 0x1801e0e74
mov rdx, qword [rsp + 0x4c8]
lea rcx, [rsp + 0x68]
call fcn.1800aac90
jmp 0x1801e0ed2
lea rdx, [rsp + 0x90]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x1801e0ed2
cmp dword [rsp + 0x48], 0xf4
ja 0x1801e0ed2
lea r9, [rsp + 0x2a0]
xor r8d, r8d
lea rdx, [0x180326948]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1801e0ed2
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x68]
call fcn.1800aac90
lea rcx, [rsp + 0x68]
call fcn.1800738f0
movzx eax, al
test eax, eax
jne 0x1801e1022
cmp qword [0x1803cb4d0], 0
je 0x1801e0f32
lea rcx, [rsp + 0x68]
call fcn.180074060
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
mov rcx, rax
call qword [0x1803cb4d0]
mov qword [rsp + 0x60], rax
jmp 0x1801e0f71
lea rcx, [rsp + 0x68]
call fcn.180074060
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x1801e1022
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x1801e1022
mov dword [rsp + 0x54], 0
mov rcx, qword [rsp + 0x4d0]
call fcn.18017cd00
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x54]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x4d0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1801e0fe2
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.18007c0b0
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x54], eax
je 0x1801e0ff8
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.18007c0b0
cmp qword [0x1803cb4d8], 0
je 0x1801e1013
mov rcx, qword [rsp + 0x40]
call qword [0x1803cb4d8]
mov dword [rsp + 0x58], eax
jmp 0x1801e1022
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x58], eax
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x4c0]
call fcn.180073d90
mov eax, dword [rsp + 0x4c]
or eax, 1
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x68]
call fcn.180073fc0
mov rax, qword [rsp + 0x4c0]
add rsp, 0x4b8
ret
Function at 0x1801e11d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x1148
call fcn.1801907a0
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov dword [rsp + 0x34], 0
mov r8d, 1
mov edx, 2
lea rcx, [rsp + 0x50]
call fcn.1800cb330
nop
xor edx, edx
mov rcx, qword [rsp + 0x1158]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x38], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1158]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [rsp + 0x38], 0x1800000
ja 0x1801e129e
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, 0x1000
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0x1158]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1801e127a
jmp 0x1801e129e
cmp dword [rsp + 0x30], 0
jne 0x1801e1283
jmp 0x1801e129e
mov eax, dword [rsp + 0x30]
mov r8d, eax
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x50]
call fcn.1800ed170
jmp 0x1801e124a
mov rdx, qword [rsp + 0x1150]
lea rcx, [rsp + 0x50]
call fcn.1800cb4a0
mov eax, dword [rsp + 0x34]
or eax, 1
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x50]
call fcn.1800c8000
mov rax, qword [rsp + 0x1150]
add rsp, 0x1148
ret
Function at 0x1801e1fd0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rcx, qword [rsp + 0x90]
call fcn.180074060
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xffffffff
jne 0x1801e2109
mov rax, qword [0x180323d38]
mov qword [rsp + 0x48], rax
lea rcx, [0x1803dbbb8]
call fcn.180003ba0
mov qword [rsp + 0x38], rax
lea rcx, [0x1803dbbb8]
call fcn.180079500
mov rcx, qword [rsp + 0x38]
mov r9, rcx
mov r8, qword [rsp + 0x48]
mov rdx, rax
mov rcx, qword [rsp + 0x90]
call fcn.1800ee240
mov qword [rsp + 0x30], rax
mov rax, qword [0x180323d38]
cmp qword [rsp + 0x30], rax
je 0x1801e20dc
mov r9, qword [rsp + 0x30]
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x90]
call fcn.1800aacc0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x40]
call fcn.1801e1fd0
movzx eax, al
test eax, eax
jne 0x1801e20b4
mov dword [rsp + 0x24], 1
jmp 0x1801e20bc
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x60]
call fcn.180073fc0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1801e20dc
xor al, al
jmp 0x1801e2127
mov rcx, qword [rsp + 0x90]
call fcn.180074060
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1801e20fc
xor al, al
jmp 0x1801e2127
mov rax, qword [rsp + 0x98]
mov byte [rax], 0
jmp 0x1801e2125
mov eax, dword [rsp + 0x28]
and eax, 0x410
test eax, eax
jne 0x1801e211a
xor al, al
jmp 0x1801e2127
mov rax, qword [rsp + 0x98]
mov byte [rax], 1
mov al, 1
add rsp, 0x88
ret
Function at 0x1801e5610
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x2b8
mov qword [rsp + 0x58], 0xfffffffffffffffe
cmp qword [0x1803dc768], 0
jne 0x1801e5792
lea rdx, [0x1803b928c]
mov ecx, 0x20
call fcn.1801809c0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1801e565d
mov rcx, qword [rsp + 0x20]
call fcn.180073cf0
mov qword [rsp + 0x28], rax
jmp 0x1801e5666
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [0x1803dc768], rax
cmp qword [0x1803dc768], 0
je 0x1801e5792
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
mov rcx, qword [0x1803dc768]
call fcn.1800aac90
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0x104
lea rdx, [rsp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1801e5792
lea rcx, [rsp + 0xa0]
call fcn.18017ce5c
mov qword [rsp + 0x50], rax
mov rcx, qword [0x1803dc768]
call fcn.180074060
mov rcx, qword [rsp + 0x50]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.18017f8b0
test eax, eax
jne 0x1801e5792
lea rcx, [rsp + 0xa0]
call fcn.18017ce5c
mov r9, qword [0x180323d38]
mov r8, rax
lea rdx, [rsp + 0x60]
mov rcx, qword [0x1803dc768]
call fcn.1800aacc0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.180074060
mov r9, rax
lea r8, [rsp + 0xa0]
lea rdx, str.__s__s
lea rcx, [rsp + 0x80]
call fcn.1801e9260
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [0x1803dc768]
call fcn.180073f10
lea rcx, [rsp + 0x80]
call fcn.180073fc0
nop
lea rcx, [rsp + 0x60]
call fcn.180073fc0
cmp qword [0x1803dc768], 0
je 0x1801e57aa
mov rcx, qword [0x1803dc768]
call fcn.180074060
jmp 0x1801e57b0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
add rsp, 0x2b8
ret
Function at 0x1801e5cc0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2f8
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov dword [rsp + 0x48], 0
mov r8, qword [rsp + 0x310]
lea rdx, [rsp + 0x308]
lea rcx, [rsp + 0x98]
call fcn.1801e4160
nop
lea rcx, [rsp + 0x98]
call fcn.180074060
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x78]
call fcn.1800740e0
nop
cmp dword [rsp + 0x50], 0
jne 0x1801e5e19
mov dword [rsp + 0x4c], 0x104
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0xe0]
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x58], 0
jne 0x1801e5e0e
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0xb8]
call fcn.1800aac40
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.180074770
nop
lea rcx, [rsp + 0xb8]
call fcn.180073fc0
mov dword [rsp + 0x4c], 0x208
jmp 0x1801e5d63
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.180078dc0
mov rdx, rax
mov rcx, qword [rsp + 0x300]
call fcn.180079a40
lea rcx, [rsp + 0x78]
call fcn.1800032b0
mov rdx, rax
mov rcx, qword [rsp + 0x300]
call fcn.1800ab5f0
mov eax, dword [rsp + 0x48]
or eax, 1
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x78]
call fcn.1800748f0
nop
lea rcx, [rsp + 0x98]
call fcn.180073fc0
mov rax, qword [rsp + 0x300]
add rsp, 0x2f8
ret
Function at 0x1801e5e90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov r8, qword [rsp + 0x98]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x58]
call fcn.1801e4160
lea rcx, [rsp + 0x58]
call fcn.180074060
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0
cmp dword [rsp + 0x30], 0
jne 0x1801e5f67
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x1801e5f5c
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 4
je 0x1801e5f54
jmp 0x1801e5f5c
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x58]
call fcn.180073fc0
mov eax, dword [rsp + 0x40]
add rsp, 0x88
ret

Function at 0x1801e5f90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov r8, qword [rsp + 0x98]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x58]
call fcn.1801e4160
lea rcx, [rsp + 0x58]
call fcn.180074060
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20219
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0
cmp dword [rsp + 0x30], 0
jne 0x1801e6067
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x1801e605c
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 4
je 0x1801e6054
jmp 0x1801e605c
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x58]
call fcn.180073fc0
mov eax, dword [rsp + 0x40]
add rsp, 0x88
ret