joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e3d0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rdi, rcx
call fcn.140052aa0
mov edx, eax
mov rcx, rdi
call qword [rbx + 0x28]
call fcn.140055620
call fcn.140052aa0
mov ecx, eax
call fcn.140052c10
call fcn.14001f500
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, 0xf003f
lea rcx, str.SoftwareNVIDIA_CorporationGlobal_nView
call fcn.14005a730
test eax, eax
jne 0x14001e474
mov rcx, qword [rsp + 0x30]
lea rdx, str.wininet.dll
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rax, qword [0x1400d68b8]
mov rcx, qword [rax + 0x18]
add rcx, qword [0x1400d68b0]
call fcn.140053ba0
mov rcx, qword [0x1400d68b8]
mov rdx, qword [rsp + 0x30]
add rcx, 8
call fcn.140052f80
mov rcx, qword [0x1400d68b8]
mov rdx, qword [rsp + 0x30]
add rcx, 0x10
call fcn.140052850
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14004aae0
Function at 0x1400327f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x1400ce568]
xor rax, rsp
mov qword [rbp + 0x400], rax
lea r9, str.nView_WOW_Process_Shutdown_Event
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xorps xmm0, xmm0
mov qword [0x1400d68c8], rax
xor eax, eax
lea rcx, [rbp + 0x1f0]
movups xmmword [rsp + 0x70], xmm0
xor ebx, ebx
xor edx, edx
movups xmmword [rbp - 0x60], xmm0
mov r8d, 0x208
mov qword [rbp - 0x30], rax
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x70], 0x68
movups xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x54], 1
movups xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x50], bx
movups xmmword [rbp - 0x40], xmm0
call fcn.1400725e0
mov edx, 0x208
lea rcx, [rbp + 0x1f0]
call fcn.14005d280
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0x208
call fcn.1400725e0
lea rax, [0x1400a1a10]
mov edx, 0x208
lea r9, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r8, str._s_s__runWow
lea rcx, [rbp - 0x20]
call fcn.1400070a0
xor eax, eax
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140032975
mov rcx, qword [rsp + 0x50]
mov edx, 0x1388
call qword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
je 0x14003295b
call fcn.1400597f0
mov rcx, rax
lea r9, str.D:uworkspace_nViewBranchBuilder_3S_sw_nview_v200_nView_nViewMain_nViewMain.cpp
lea rax, str.timeout_while_waiting_for_WOW_process_to_idle.
mov qword [rsp + 0x28], rax
lea r8, str.forkWowProcess
lea edx, [rbx + 2]
mov dword [rsp + 0x20], 0xb0
call fcn.140059d70
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1400329b4
call fcn.1400597f0
mov rcx, rax
lea r9, str.D:uworkspace_nViewBranchBuilder_3S_sw_nview_v200_nView_nViewMain_nViewMain.cpp
lea rax, [rbp - 0x20]
mov edx, 1
mov qword [rsp + 0x30], rax
lea r8, str.forkWowProcess
lea rax, str.failed_to_launch_32_bit_Wow__s
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xb5
call fcn.140059d70
xor al, al
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.14006fd90
mov rbx, qword [rsp + 0x520]
add rsp, 0x510
pop rbp
ret
Function at 0x14004c930
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov edx, 1
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 8]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_UpdateWindow]
push rbx
sub rsp, 0x30
cmp qword [0x1400d07e0], 0
jne 0x14004c9b9
lea rax, [0x1400d07e8]
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [fcn.14004ca00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400d07e0], rax
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x1400d0298]
test rax, rax
jne 0x14004c9ac
mov ecx, 0x80
call fcn.14006fc3c
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14004c9a2
mov rcx, rax
call fcn.14002fad0
jmp 0x14004c9a5
mov rax, rbx
mov qword [0x1400d0298], rax
mov rcx, rax
add rsp, 0x30
pop rbx
jmp 0x140030670
mov rbx, qword [0x1400d0298]
test rbx, rbx
jne 0x14004c9ef
mov ecx, 0x80
call fcn.14006fc3c
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14004c9e6
mov rcx, rax
call fcn.14002fad0
mov rbx, rax
jmp 0x14004c9e8
xor ebx, ebx
mov qword [0x1400d0298], rbx
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp 0x140030670

Function at 0x14004cc90
Capabilities:
Create process on windows
Create thread

Disassembly:
push rbx
sub rsp, 0x510
mov rax, qword [0x1400ce568]
xor rax, rsp
mov qword [rsp + 0x500], rax
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0x208
call fcn.1400725e0
mov edx, 0x208
lea rcx, [rsp + 0xe0]
call fcn.14005d280
xor edx, edx
lea rcx, [rsp + 0x2f0]
mov r8d, 0x208
call fcn.1400725e0
lea rax, str._Watchdog
mov edx, 0x208
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0xe0]
lea rax, str.nViewMain64.exe
lea r8, str._s_s__s
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x2f0]
call fcn.1400070a0
xorps xmm1, xmm1
mov dword [rsp + 0x70], 0x68
xor eax, eax
lea rdx, [rsp + 0x2f0]
mov qword [rsp + 0x60], rax
xor ebx, ebx
mov dword [rsp + 0xd4], eax
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x74], xmm1
movups xmmword [rsp + 0x84], xmm1
movups xmmword [rsp + 0x94], xmm1
movups xmmword [rsp + 0xa4], xmm1
movups xmmword [rsp + 0xb4], xmm1
movups xmmword [rsp + 0xc4], xmm1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14004cde2
mov r9, qword [rsp + 0x50]
lea r8, [0x14004cff0]
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14004cde4
xor al, al
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.14006fd90
add rsp, 0x510
pop rbx
ret
Function at 0x14004e7c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, rdx
test rdx, rdx
je 0x14004e951
sub ecx, 1
je 0x14004e8ce
cmp ecx, 1
jne 0x14004e944
mov rax, qword [0x1400d68b8]
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x58], ebx
test byte [rax + 0x60], 4
jne 0x14004e85a
xor r9d, r9d
lea rdx, [rsp + 0x68]
mov r8d, 0xf003f
lea rcx, str.SoftwareNVIDIA_CorporationGlobal_nView
call fcn.14005a730
test eax, eax
jne 0x14004e85a
mov eax, dword [rdi]
lea r9d, [rbx + 4]
mov rcx, qword [rsp + 0x68]
lea rdx, str.Desktray
mov dword [rsp + 0x58], eax
xor r8d, r8d
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsxd rdi, dword [rdi]
test edi, edi
je 0x14004e87b
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], ebx
xor ecx, ecx
call fcn.14004e4c0
cmp dword [rsp + 0x60], ebx
je 0x14004e951
mov rcx, qword [0x1400d68b8]
mov r8, rdi
xor r9d, r9d
mov edx, 0x492
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14004e944
mov rax, qword [0x1400d68b8]
mov ebx, 1
test byte [rax + 0x60], 4
jne 0x14004e8b5
or dword [rax + 0x50], 0x20
xor edx, edx
mov ecx, 0x109
call fcn.140007030
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov dword [rdx], ebx
lea rcx, str.SoftwareNVIDIA_CorporationGlobal_nView
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
mov r8d, 0xf003f
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x60], 4
call fcn.14005a9b0
test eax, eax
jne 0x14004e944
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Desktray
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov dword [rdi], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x14004f890
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12d, r8d
movsxd rbx, edx
mov rdi, rcx
xor r8d, r8d
mov rcx, qword [rcx + 0x10]
xor edx, edx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r13d, eax
xor esi, esi
lea rax, str.aProfileFlags
mov rcx, qword [rax + rbx*8]
lea r15, [rax + rbx*8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebp, [rax + rax]
lea ecx, [rbp + 2]
call fcn.14007f534
mov r14, rax
test rax, rax
je 0x14004f9ba
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [rsi + 1]
mov rcx, rdi
call fcn.14004f780
mov ebx, eax
test eax, eax
je 0x14004f9b2
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x68]
mov r8d, ebp
mov dword [rsp + 0x68], esi
mov rdx, r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov word [r14 + rcx*2], si
mov rcx, r14
mov rdx, qword [r15]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14004f99b
test ebx, ebx
je 0x14004f986
mov rcx, qword [rdi + 0x10]
lea edx, [rbx + 4]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, 1
mov rcx, rdi
call fcn.14004f780
mov ebx, eax
test eax, eax
jne 0x14004f930
jmp 0x14004f9b2
mov rcx, qword [rdi + 0x10]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
mov rcx, r14
call fcn.140076e88
test r12d, r12d
jne 0x14004f9d2
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140050420
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x18]
lea r9, [rsp + 0x40]
mov rdi, rdx
mov dword [rsp + 0x40], 0
add rax, rax
mov qword [rsp + 0x20], 0
mov rbx, rcx
mov qword [rsp + 0x50], rax
mov r8d, 2
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x40]
mov rdx, qword [rbx]
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x48]
cmp eax, 1
sete al
add rsp, 0x30
pop rdi
ret

Function at 0x1400504a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400ce568]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
lea r8, [0x1400baf20]
mov r9d, edx
lea rcx, [rsp + 0x40]
mov edx, 0x40
call fcn.1400070a0
mov edx, 0x20
lea rax, [rsp + 0x40]
mov ecx, edx
cmp word [rax], 0
je 0x1400504f3
add rax, 2
sub rcx, 1
jne 0x1400504e3
xor eax, eax
test rcx, rcx
je 0x140050509
sub rdx, rcx
add rdx, rdx
test rcx, rcx
cmove rdx, rax
jmp 0x14005050c
mov rdx, rax
mov rcx, qword [rbx]
lea r9, [rsp + 0x30]
mov r8d, edx
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006fd90
add rsp, 0x90
pop rbx
ret

Function at 0x140050550
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rcx
call fcn.1400508a0
xor eax, eax
mov rdx, rbx
cmp qword [rbx + 0x18], 8
mov dword [rsp + 0x40], eax
jb 0x140050578
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov rcx, qword [rdi]
add r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140050660
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400ce568]
xor rax, rsp
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
lea rax, [0x1400a4020]
test dl, dl
lea r9, [0x1400a43e8]
movzx ebx, r8b
mov rdi, rcx
cmovne r9, rax
lea r8, [0x14009f600]
mov edx, 0x20
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call fcn.140004d10
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test bl, bl
je 0x14005072c
lea r9, str.L5
mov edx, 0x20
lea r8, [0x14009f600]
lea rcx, [rsp + 0x40]
call fcn.140004d10
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006fd90
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret
Function at 0x140050750
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, r8
lea rax, [rsp + 0x60]
mov r14, rdx
mov qword [rsp + 0x28], rax
xor r15d, r15d
lea r9, [rsp + 0x78]
mov rdi, rcx
mov qword [rsp + 0x20], r15
mov rdx, rbp
mov dword [rsp + 0x60], r15d
mov rcx, r14
mov dword [rsp + 0x78], r15d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, qword [rdi + 0x18]
mov r8, qword [rdi]
mov eax, dword [rsp + 0x78]
lea rbx, [r8 + rdx*2]
cmp eax, 4
jne 0x1400507e3
mov rdx, rbp
mov rcx, r14
call fcn.14005aa50
mov ecx, 4
mov word [rbx], cx
mov ecx, eax
shr ecx, 0x10
mov word [rbx + 4], ax
mov al, 1
mov word [rbx + 2], cx
mov dword [rbx + 6], 0xa
add qword [rdi + 0x18], 4
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
cmp eax, 0xb
jne 0x140050814
mov rdx, rbp
mov word [rbx], ax
mov rcx, r14
call fcn.14005aad0
mov qword [rbx + 2], rax
mov al, 1
mov dword [rbx + 0xa], 0xa
add qword [rdi + 0x18], 6
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
cmp eax, 1
jne 0x14005088e
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x68], rsi
sub rcx, r8
mov esi, dword [rsp + 0x60]
shr esi, 1
add esi, 2
sar rcx, 1
mov eax, esi
sub rcx, rdx
cmp rcx, rax
jbe 0x14005087b
mov eax, 1
lea r9, [rsp + 0x78]
mov word [rbx], ax
xor r8d, r8d
lea rax, [rsp + 0x60]
add rbx, 2
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [rsi - 1]
add qword [rdi + 0x18], rcx
lea ecx, [rsi - 2]
mov dword [rbx + rcx*2], 0xa
mov rsi, qword [rsp + 0x68]
mov al, 1
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
xor al, al
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret

Function at 0x1400508a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor esi, esi
movsxd rbx, edx
mov rdi, rcx
mov dword [rsp + 0x48], esi
mov rcx, qword [rcx]
lea r9, [rsp + 0x48]
lea rdx, [0x1400a4018]
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r10, str.aProfileFlags
mov r10, qword [r10 + rbx*8]
test r10, r10
je 0x140050916
mov edx, 0x82
mov rax, r10
mov ecx, edx
cmp word [rax], si
je 0x140050902
add rax, 2
sub rcx, 1
jne 0x1400508f3
test rcx, rcx
je 0x140050916
sub rdx, rcx
add rdx, rdx
test rcx, rcx
cmove rdx, rsi
jmp 0x140050919
mov rdx, rsi
mov rcx, qword [rdi]
lea r9, [rsp + 0x48]
mov r8d, edx
mov qword [rsp + 0x20], rsi
mov rdx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14005c380
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1400ce568]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov edx, dword [0x1400d0ca8]
mov rbx, rcx
test edx, edx
je 0x14005c3b7
mov eax, dword [0x1400cd49c]
cmp eax, 0xffffffff
jne 0x14005c4bb
lea rcx, [0x1400a6898]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400a6888]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x14005c3ea
call rax
jmp 0x14005c3f0
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x14005c4ab
mov ecx, dword [rsp + 0x24]
cmp ecx, 5
jne 0x14005c41a
xor edx, edx
cmp dword [rsp + 0x28], edx
seta dl
inc edx
mov dword [0x1400d0ca8], edx
jmp 0x14005c4b1
cmp ecx, 6
jne 0x14005c479
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x14005c434
mov edx, 3
mov dword [0x1400d0ca8], edx
jmp 0x14005c4b1
cmp eax, 1
jne 0x14005c446
mov edx, 4
mov dword [0x1400d0ca8], edx
jmp 0x14005c4b1
cmp eax, 2
jne 0x14005c458
mov edx, 5
mov dword [0x1400d0ca8], edx
jmp 0x14005c4b1
cmp eax, 3
jne 0x14005c46a
mov edx, 6
mov dword [0x1400d0ca8], edx
jmp 0x14005c4b1
jbe 0x14005c4ab
mov edx, 8
mov dword [0x1400d0ca8], edx
jmp 0x14005c4b1
cmp ecx, 0xa
jne 0x14005c493
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x14005c46c
mov edx, 7
mov dword [0x1400d0ca8], edx
jmp 0x14005c4b1
mov eax, dword [0x1400d0ca8]
mov edx, 8
cmova eax, edx
mov edx, eax
mov dword [0x1400d0ca8], eax
jmp 0x14005c4b1
mov edx, dword [0x1400d0ca8]
mov eax, dword [rsp + 0x2c]
mov dword [0x1400cd49c], eax
test rbx, rbx
je 0x14005c4c2
mov dword [rbx], eax
mov eax, edx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14006fd90
add rsp, 0x150
pop rbx
ret

Function at 0x14005c4e0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 2
test eax, eax
jne 0x14005c4fd
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
Function at 0x14005c510
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1400ce568]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov ecx, dword [0x1400d0ca8]
test ecx, ecx
je 0x14005c540
cmp dword [0x1400cd49c], 0xffffffff
jne 0x14005c644
lea rcx, [0x1400a6898]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400a6888]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x14005c573
call rax
jmp 0x14005c579
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x14005c634
mov edx, dword [rsp + 0x24]
cmp edx, 5
jne 0x14005c5a3
xor ecx, ecx
cmp dword [rsp + 0x28], ecx
seta cl
inc ecx
mov dword [0x1400d0ca8], ecx
jmp 0x14005c63a
cmp edx, 6
jne 0x14005c602
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x14005c5bd
mov ecx, 3
mov dword [0x1400d0ca8], ecx
jmp 0x14005c63a
cmp eax, 1
jne 0x14005c5cf
mov ecx, 4
mov dword [0x1400d0ca8], ecx
jmp 0x14005c63a
cmp eax, 2
jne 0x14005c5e1
mov ecx, 5
mov dword [0x1400d0ca8], ecx
jmp 0x14005c63a
cmp eax, 3
jne 0x14005c5f3
mov ecx, 6
mov dword [0x1400d0ca8], ecx
jmp 0x14005c63a
jbe 0x14005c634
mov ecx, 8
mov dword [0x1400d0ca8], ecx
jmp 0x14005c63a
cmp edx, 0xa
jne 0x14005c61c
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x14005c5f5
mov ecx, 7
mov dword [0x1400d0ca8], ecx
jmp 0x14005c63a
mov eax, dword [0x1400d0ca8]
mov ecx, 8
cmova eax, ecx
mov ecx, eax
mov dword [0x1400d0ca8], eax
jmp 0x14005c63a
mov ecx, dword [0x1400d0ca8]
mov eax, dword [rsp + 0x2c]
mov dword [0x1400cd49c], eax
cmp ecx, 7
setge al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14006fd90
add rsp, 0x158
ret
Function at 0x14005d060
Capabilities:
Get file version info

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov dword [rsp + 0x60], 0
mov rbp, rcx
lea rdx, [rsp + 0x60]
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test eax, eax
je 0x14005d0f6
mov ecx, edi
mov qword [rsp + 0x50], rbx
call fcn.140070308
mov rbx, rax
test rax, rax
je 0x14005d0f1
mov r9, rax
mov qword [rsp + 0x20], 0
mov r8d, edi
mov dword [rsp + 0x68], 0
xor edx, edx
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoW
lea r9, [rsp + 0x68]
mov rcx, rbx
lea r8, [rsp + 0x20]
lea rdx, [0x1400b9f10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14005d0e9
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 8]
mov dword [rbp + 0x230], ecx
mov rcx, rbx
call fcn.14006fc78
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x14005d130
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 4]
mov rbx, rcx
lea rdx, [0x1400a68a0]
mov rcx, rdi
mov r9d, 0x208
call fcn.14005acc0
lea r8, [rbx + 0x210]
mov rcx, rdi
lea rdx, [0x1400a68a8]
call fcn.14005ab60
lea r8, [rbx + 0x20c]
mov rcx, rdi
lea rdx, [0x1400a68c0]
call fcn.14005aa90
lea r8, [rbx + 0x230]
mov rcx, rdi
lea rdx, [0x1400a68d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14005aa90

Function at 0x14005d1b0
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1400ce568]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.1400725e0
xor r9d, r9d
lea r8d, [rdi + 0x23]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], di
jne 0x14005d220
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000d6c0
mov dword [rsp + 0x20], 1
mov r8d, 0x19
lea rdx, [0x1400a4608]
mov rcx, rbx
call fcn.14000edd0
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14006fd90
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret