joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141577300
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop qword [rsp]
mov rbp, qword [rsp + 9]
sub rsp, 0x1f
stc
push bp
jmp 0x141577379
mov rbp, qword [rsp + 5]
setge bpl
lea r11, [r13 + r13]
pop word [rsp + 2]
jmp 0x1415772e9
pop word [rsp + 0xd]
pop rbp
lea rsp, [rsp]
rdtsc
jmp 0x141577358
not r11b
neg r11
pop r11w
bsf bp, sp
lea rax, [rsi + rsi]
mov r11b, r10b
jmp 0x141577315
pop r11
bswap rax
mov r11b, byte [rsp + 3]
not rax
jmp 0x141577398
mov byte [rsp + 0x14], bpl
push qword [rsp + 0x19]
mov dword [rsp + 0xc], edi
bswap rax
lea rax, [rcx + r11]
rdtsc
jmp 0x141577342
lea rbp, [rbp*4]
pop qword [rsp + 0x1b]
xchg qword [rsp + 0x1b], rax
bswap r11d
mov rbp, rsi
mov bpl, byte [rsp + 2]
jmp 0x14157732b
mov ebp, 0x671e3c00
xchg byte [rsp + 0xe], dl
mov edx, ecx
sub dl, 0x64
jmp 0x141577476
cmc
pop qword [rsp + 7]
mov byte [rsp + 0xa], r11b
xchg dl, r11b
jmp 0x141577447
mov dl, r13b
mov al, bl
lea r11, [rdx + rdx]
bswap edx
rol ax, 7
mov r11d, r13d
jmp 0x1415773c7
xchg bpl, al
btc rbp, rbp
mov dword [rsp + 0x13], edi
dec ebp
not al
jmp 0x141577423
xchg r11, rax
mov rbp, 0xfffffffff835329b
mov r11d, dword [rsp + 8]
xchg qword [rsp + 2], r11
rcl ax, cl
sub rsp, 5
jmp 0x1415773f1
mov rbp, 0xcd6560e
mov qword [rsp + 0xd], rdx
xchg word [rsp + 0x16], bp
stc
mov byte [rsp + 0x15], r9b
setge al
jmp 0x1415774db
mov ax, si
lea rax, [rax + rbp]
push word [rsp + 0xc]
xchg r11d, eax
mov qword [rsp + 5], r10
xchg r11w, bp
jmp 0x141577407
bts bp, di
mov byte [rsp + 0x18], r8b
mov dword [rsp], ecx
xchg bpl, r11b
mov eax, dword [rsp + 9]
mov rax, 0xffffffffb5f55b42
jmp 0x1415773dd
mov edx, r11d
inc al
xchg byte [rsp + 0xc], r11b
push qword [rsp + 0x12]
jmp 0x141578446
lea r11, [rax*4]
rdtsc
lea rbp, [0x2b068d40]
mov rdx, r11
pushfq
add rsp, 9
jmp 0x141577495
lea rbp, [rsp + r9]
pop word [rsp + 0xd]
mov dl, 0xb2
mov rbp, r14
mov qword [rsp + 0xa], rbx
lea rax, [rsi + r13]
jmp 0x1415774ab
mov bpl, byte [rsp + 5]
bsf r11d, esp
mov ax, word [rsp]
mov rdx, 0x2c344a09
shl edx, cl
mov rdx, qword [rsp]
jmp 0x141577515
lea rsp, [rsp + 0x17]
lea rsp, [rsp]
sub rsp, 1
lea r11, [r11 + riz + 0xa258]
lea rdx, [r9*8]
setle al
jmp 0x141577532
or r11b, r13b
xchg bpl, al
mov r11w, word [rsp + 1]
xchg byte [rsp + 4], al
dec bpl
xchg qword [rsp + 7], r11
jmp 0x1415775c4
setl al
lea r11, [r8 + riz]
xchg word [rsp + 7], dx
bswap edx
mov bp, word [rsp + 0x1b]
clc
jmp 0x1415777eb
mov dl, byte [rsp + 3]
mov r11, r9
rdtsc
lea rax, [r10 + r13]
pop word [rsp + 0xc]
cmp rax, 0x1dd73ab4
jmp 0x141577868

Function at 0x141578848
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
call fcn.14157701e
push word [rsp + 7]
pushfq
push word [rsp + 0xc]
jmp 0x141578886
lea rsp, [rsp + 3]
lea rsp, [rsp + 0x10]
jmp 0x1415788d7
mov byte [rsp + 0x12], dil
push r14w
mov dword [rsp + 0xe], esi
mov dword [rsp + 0x15], edx
pop qword [rsp + 7]
jmp 0x141578870
mov rax, qword [rax + riz]
jmp 0x1415788ec
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
jmp 0x1415788c1
mov rax, qword [rax + riz + 0x10]
jmp 0x141578923
push rax
jmp 0x141577019
Function at 0x140001000
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Value:
call fcn.140001190
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rsp + 0x34]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
lea rdx, str.Wuthering_Waves
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140001088
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Cannot_find_the_game.
call fcn.140001190
lea rdx, [0x140001370]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x50], rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp dword [rsp + 0x30], 0
mov rbx, rax
jne 0x1400010f6
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Process_cant_be_found.
mov rbx, qword [rsp + 0x50]
call fcn.140001190
lea rdx, [0x140001370]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edi, edi
nop dword [rax + rax]
mov r9d, 4
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x34]
mov edx, 0x433fdb68
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 4
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x34]
mov edx, 0x433fda69
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 4
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x34]
mov edx, 0x433fd96a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 4
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x34]
mov edx, 0x433fd86b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001100
Function at 0x100001a90
Capabilities:
Compare security identifiers

Disassembly:
sub rsp, 0x98
mov rax, qword [0x100011410]
mov qword [rsp + 0x80], rax
mov eax, dword [0x100011324]
mov qword [rsp + 0xa8], rbx
xor ebx, ebx
cmp eax, 2
mov byte [rsp + 0x78], 0
mov byte [rsp + 0x79], 0
mov byte [rsp + 0x7a], 0
mov byte [rsp + 0x7b], 0
mov byte [rsp + 0x7c], 0
mov byte [rsp + 0x7d], 5
mov dword [rsp + 0x60], ebx
jne 0x100001c63
lea rcx, [rsp + 0x60]
call fcn.100001960
test eax, eax
jne 0x100001c44
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
lea edx, [rbx + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100001c63
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
lea rax, [rsp + 0x64]
lea edx, [r9 + 2]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x100001c32
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100001c32
mov edx, dword [rsp + 0x64]
xor ecx, ecx
mov qword [rsp + 0xb0], rsi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rsi, rax
je 0x100001c2a
mov r9d, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x64]
mov r8, rsi
mov edx, 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x100001c21
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov r8d, 0x20
mov dl, 2
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x100001c21
cmp dword [rsi], ebx
jbe 0x100001c16
mov qword [rsp + 0xb8], rdi
lea rdi, [rsi + 8]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x100001bff
inc ebx
add rdi, 0x10
cmp ebx, dword [rsi]
jb 0x100001be1
jmp 0x100001c0e
mov eax, 1
mov dword [0x100011324], eax
mov dword [rsp + 0x60], eax
mov rdi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11d, dword [rsp + 0x60]
jmp 0x100001c60
mov ecx, dword [0x100011324]
mov r11d, dword [rsp + 0x60]
mov eax, 1
test r11d, r11d
cmovne ecx, eax
mov dword [0x100011324], ecx
mov eax, r11d
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x80]
call fcn.10000ea20
add rsp, 0x98
ret
Function at 0x100001db0
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ecx, ecx
test eax, eax
jne 0x100001dfb
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4f5
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x10
call fcn.100005260
xor eax, eax
add rsp, 0x40
pop rbx
ret
lea r8, [rsp + 0x34]
lea rdx, [0x100001558]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x50]
xor ebx, ebx
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x100001e68
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4f6
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x10
call fcn.100005260
xor eax, eax
add rsp, 0x40
pop rbx
ret
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x100001e9d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4f7
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x10
call fcn.100005260
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov eax, 1
add rsp, 0x40
pop rbx
ret

Function at 0x100001eb0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
sub rsp, 0x38
cmp byte [0x100011440], 0
je 0x100001f05
lea rax, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100001f05
mov rcx, qword [rsp + 0x40]
lea rdx, [0x100011440]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret
Function at 0x1000021f0
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub rsp, 0x3a8
mov rax, qword [0x100011410]
mov qword [rsp + 0x390], rax
cmp byte [0x100011440], 0
je 0x100002329
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100002329
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea rdx, [0x100011440]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x150]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x38], 0x238
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10000231e
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], al
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000022c1
lea r8, [0x100001555]
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.100009a40
lea r9, [0x100012350]
lea r8, [rsp + 0x40]
lea rdx, str.rundll32.exe__sadvpack.dll_DelNodeRunDLL32___s_
lea rcx, [rsp + 0x150]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x100011440]
inc eax
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x390]
call fcn.10000ea20
add rsp, 0x3a8
ret
Function at 0x100002350
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x148
mov rax, qword [0x100011410]
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x100002410
lea r8, [0x100001590]
lea rcx, [rsp + 0x20]
mov edx, 0x104
mov qword [rsp + 0x168], rdi
call fcn.100009a40
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea rcx, [rsp + 0x20]
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
mov edi, eax
je 0x10000240c
xor edx, edx
mov ecx, eax
mov qword [rsp + 0x160], rbx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll__llseek]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll__lclose]
mov eax, ebx
mov rbx, qword [rsp + 0x160]
mov rdi, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x130]
call fcn.10000ea20
add rsp, 0x148
ret
xor eax, eax
jmp 0x1000023ef
xor eax, eax
mov rcx, qword [rsp + 0x130]
call fcn.10000ea20
add rsp, 0x148
ret
push rbx
sub rsp, 0x60
movzx eax, cx
xor ebx, ebx
test eax, eax
je 0x100002541
cmp eax, 1
je 0x1000024b0
add eax, 0xfffffffe
cmp eax, 1
ja 0x10000254b
lea rax, [rsp + 0x78]
lea rdx, str.SystemCurrentControlSetControlSession_Manager
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100002537
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
lea rdx, str.PendingFileRenameOperations
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x10000251f
lea rax, [rsp + 0x78]
lea rdx, str.SystemCurrentControlSetControlSession_ManagerFileRenameOperations
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100002537
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [rsp + 0x70]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x70], ecx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret
add rsp, 0x60
pop rbx
jmp 0x100002350
mov eax, ebx
add rsp, 0x60
pop rbx
ret
Function at 0x100002430
Capabilities:
Get common file path
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub rsp, 0x148
mov rax, qword [0x100011410]
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x100002410
lea r8, [0x100001590]
lea rcx, [rsp + 0x20]
mov edx, 0x104
mov qword [rsp + 0x168], rdi
call fcn.100009a40
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea rcx, [rsp + 0x20]
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
mov edi, eax
je 0x10000240c
xor edx, edx
mov ecx, eax
mov qword [rsp + 0x160], rbx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll__llseek]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll__lclose]
mov eax, ebx
mov rbx, qword [rsp + 0x160]
mov rdi, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x130]
call fcn.10000ea20
add rsp, 0x148
ret
xor eax, eax
jmp 0x1000023ef
xor eax, eax
mov rcx, qword [rsp + 0x130]
call fcn.10000ea20
add rsp, 0x148
ret
push rbx
sub rsp, 0x60
movzx eax, cx
xor ebx, ebx
test eax, eax
je 0x100002541
cmp eax, 1
je 0x1000024b0
add eax, 0xfffffffe
cmp eax, 1
ja 0x10000254b
lea rax, [rsp + 0x78]
lea rdx, str.SystemCurrentControlSetControlSession_Manager
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100002537
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
lea rdx, str.PendingFileRenameOperations
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x10000251f
lea rax, [rsp + 0x78]
lea rdx, str.SystemCurrentControlSetControlSession_ManagerFileRenameOperations
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100002537
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [rsp + 0x70]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x70], ecx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret
add rsp, 0x60
pop rbx
jmp 0x100002350
mov eax, ebx
add rsp, 0x60
pop rbx
ret

Function at 0x100002560
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100002585
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
and eax, 0x10
add rsp, 0x20
pop rbx
ret
Function at 0x1000025a0
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
sub rsp, 0x158
mov rax, qword [0x100011410]
mov qword [rsp + 0x140], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov rdi, rcx
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor ebx, ebx
test eax, eax
jne 0x1000025f8
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4f0
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x10
call fcn.100005260
movzx ecx, byte [rsp + 0x30]
cmp byte [rdi], cl
mov rdi, qword [rsp + 0x178]
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x140]
call fcn.10000ea20
add rsp, 0x158
ret

Function at 0x100002860
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x38
test cl, 2
mov qword [rsp + 0x58], rdi
mov edi, ecx
jne 0x100002899
cmp dword [0x100012174], 0
jne 0x100002899
movzx ecx, word [0x100012178]
mov qword [rsp + 0x50], rbx
mov ebx, dword [0x100012284]
call fcn.100002430
cmp ebx, eax
mov rbx, qword [rsp + 0x50]
je 0x1000028ee
test dil, 4
jne 0x1000028ca
lea r8, [0x100001555]
xor r9d, r9d
mov edx, 0x522
xor ecx, ecx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x40
call fcn.100005260
cmp eax, 6
jne 0x1000028ee
cmp word [0x100012178], 0
jne 0x1000028e9
xor edx, edx
lea ecx, [rdx + 2]
mov rdi, qword [rsp + 0x58]
add rsp, 0x38
jmp qword [sym.imp.USER32.dll_ExitWindowsEx]
call fcn.100001db0
mov rdi, qword [rsp + 0x58]
add rsp, 0x38
ret
Function at 0x100002900
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x188
mov rax, qword [0x100011410]
mov qword [rsp + 0x150], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
xor edi, edi
mov qword [r11 - 0x20], r12
mov byte [rcx], dil
cmp byte [r8], 0x23
mov qword [r11 - 0x28], r13
mov rbp, r8
movsxd rsi, edx
mov rbx, rcx
lea r13d, [rdi + 1]
jne 0x100002afe
movsx rcx, byte [r8 + 1]
call qword [sym.imp.USER32.dll_CharUpperA]
lea rcx, [rbp + 1]
mov r12, rax
call qword [sym.imp.USER32.dll_CharNextA]
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextA]
cmp r12b, 0x53
mov rbp, rax
je 0x100002af1
cmp r12b, 0x57
je 0x100002ae4
lea rdx, [0x1000015a0]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x34], 0x104
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x40]
mov r8, rbp
mov edx, 0x104
call fcn.100009a40
lea r11, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100002a8f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x100001555]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100002a80
mov eax, dword [rsp + 0x30]
cmp eax, 2
jne 0x100002a79
lea rdx, [rsp + 0x40]
mov r8d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x100002a75
cmp rsi, 0x7fffffff
mov rcx, rsi
ja 0x100002a70
test esi, esi
mov rax, rbx
je 0x100002a70
lea r8, [rsp + 0x40]
sub r8, rbx
movzx edx, byte [r8 + rax]
test dl, dl
je 0x100002a65
mov byte [rax], dl
inc rax
dec rcx
jne 0x100002a47
dec rax
mov byte [rax], dil
mov edi, r13d
jmp 0x100002a80
test rcx, rcx
jne 0x100002a6d
dec rax
mov byte [rax], dil
mov edi, r13d
jmp 0x100002a80
mov eax, dword [rsp + 0x30]
cmp eax, r13d
cmove edi, r13d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x100002a9c
mov r8, rbp
mov edx, esi
mov rcx, rbx
call fcn.100009a40
mov r12, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x170]
mov rsi, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x1a8]
mov eax, r13d
mov r13, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
call fcn.10000ea20
add rsp, 0x188
ret
mov edx, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x100002a8f
mov edx, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x100002a8f
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x100002a8f