joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483190
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x2048
call fcn.004ccbf0
sub rsp, rax
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov qword [rsp + 0x2040], rbp
mov qword [rsp + 0x2038], rsi
mov qword [rsp + 0x2030], rdi
xor edi, edi
mov qword [rsp + 0x2068], rbx
mov rbp, r8
mov rsi, rdx
nop
nop
nop
lea rdx, [0x004da57c]
mov rcx, rbp
call fcn.00495ef0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x483215
test rbx, rbx
jne 0x48324f
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 1
cmp edi, 0x3c
jl 0x4831e0
xor eax, eax
mov rdi, qword [rsp + 0x2030]
mov rsi, qword [rsp + 0x2038]
mov rbp, qword [rsp + 0x2040]
mov rbx, qword [rsp + 0x2068]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x2048
ret
mov rcx, rbx
call fcn.00496690
test eax, eax
jne 0x48329c
nop
nop
mov rcx, rbx
call fcn.004966d0
test eax, eax
jne 0x48329c
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x1000
call fcn.00496710
test rax, rax
je 0x48329c
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.00495c80
mov rcx, rbx
call fcn.00496690
test eax, eax
je 0x483260
lea rdx, str.End_KTL_Section_n
mov rcx, rsi
call fcn.004954f0
mov rcx, rsi
call fcn.004975e0
mov rcx, rbx
call fcn.00495be0
mov eax, 1
jmp 0x483217

Function at 0x483880
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x2048
call fcn.004ccbf0
sub rsp, rax
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov qword [rsp + 0x2040], rbp
mov qword [rsp + 0x2038], rsi
mov qword [rsp + 0x2030], rdi
xor edi, edi
mov qword [rsp + 0x2068], rbx
mov rbp, r8
mov rsi, rdx
nop
nop
nop
lea rdx, [0x004da57c]
mov rcx, rbp
call fcn.00495ef0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x483905
test rbx, rbx
jne 0x48393f
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 1
cmp edi, 0x3c
jl 0x4838d0
xor eax, eax
mov rdi, qword [rsp + 0x2030]
mov rsi, qword [rsp + 0x2038]
mov rbp, qword [rsp + 0x2040]
mov rbx, qword [rsp + 0x2068]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x2048
ret
mov rcx, rbx
call fcn.00496690
test eax, eax
jne 0x48398c
nop
nop
mov rcx, rbx
call fcn.004966d0
test eax, eax
jne 0x48398c
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x1000
call fcn.00496710
test rax, rax
je 0x48398c
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.00495c80
mov rcx, rbx
call fcn.00496690
test eax, eax
je 0x483950
mov rcx, rsi
call fcn.004975e0
mov rcx, rbx
call fcn.00495be0
mov eax, 1
jmp 0x483907
Function at 0x483ca0
Capabilities:
Delete file

Disassembly:
mov eax, 0x2078
call fcn.004ccbf0
sub rsp, rax
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x2030], rax
mov qword [rsp + 0x2070], rbx
mov qword [rsp + 0x2068], rbp
mov qword [rsp + 0x2060], rsi
mov qword [rsp + 0x2058], rdi
mov qword [rsp + 0x2050], r12
mov r12, qword [rsp + 0x20a8]
mov qword [rsp + 0x2048], r13
mov r13, rdx
mov edx, dword [rsp + 0x20a0]
sub edx, 2
mov qword [rsp + 0x2040], r14
mov r14, qword [rsp + 0x20b0]
mov rbx, r9
mov esi, r8d
mov rbp, rcx
je 0x483de2
cmp edx, 1
jne 0x483e4a
cmp r8d, 0xc
jne 0x483e4a
mov rcx, r13
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
test r12, r12
mov edi, eax
je 0x483e4a
test rbx, rbx
je 0x483e4a
test eax, eax
je 0x483e4a
mov ecx, dword [rbx]
xor r10d, r10d
xor eax, eax
xor edx, edx
test ecx, ecx
je 0x483d84
cmp ecx, edi
je 0x483d7d
mov ecx, dword [rbx + rdx*4 + 8]
add rdx, 2
add eax, 2
test ecx, ecx
jne 0x483d68
jmp 0x483d84
cdqe
mov r10d, dword [rbx + rax*4 + 4]
lea r8, [rsp + 0x30]
mov r9d, 0x1000
mov edx, r10d
mov rcx, r12
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x483dd8
lea r9, [0x00481200]
mov r8, r13
mov edx, 0xaa
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_CreateDialogParamW]
lea r8, [rsp + 0x30]
mov r9, r14
mov rcx, rax
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x483e4a
xor ecx, ecx
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x483e4a
xor eax, eax
lea rdi, [rbp + 0x418]
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x483e0b
lea rcx, [rbp + 0x418]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
lea rdi, [rbp + 0x620]
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x483e34
lea rcx, [rbp + 0x620]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.Mouse.hlp
mov r9, rbx
mov r8d, esi
mov rcx, r13
call qword [sym.imp.USER32.dll_WinHelpW]
mov r14, qword [rsp + 0x2040]
mov r13, qword [rsp + 0x2048]
mov r12, qword [rsp + 0x2050]
mov rdi, qword [rsp + 0x2058]
mov rsi, qword [rsp + 0x2060]
mov rbp, qword [rsp + 0x2068]
mov rbx, qword [rsp + 0x2070]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x2078
ret
Function at 0x485140
Capabilities:
Allocate thread local storage
Check if file exists
Get common file path
Get file attributes
Get thread local storage value
Set thread local storage value

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rdx
mov rdi, rcx
mov qword [r11 - 0x48], rcx
lea rbx, [rcx + 0x410]
xor r12d, r12d
mov qword [rbx], r12
mov eax, dword [0x0050b024]
test al, 1
jne 0x4851ab
or eax, 1
mov dword [0x0050b024], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x0050b020], eax
jmp 0x4851b1
mov eax, dword [0x0050b020]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x4851d7
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov edx, 1
mov ecx, dword [0x0050b020]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x40]
lea rcx, str.SynCom.PointingDevice
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
mov qword [rsp + 0x20], rbx
lea r9, [0x004d3a90]
xor edx, edx
lea r8d, [rdx + 0x15]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoCreateInstance]
lea r11, method.b.virtual_16
mov qword [rdi + 0x408], r11
mov dword [rdi + 0x418], 0xffffffff
lea rcx, [rdi + 0x438]
call fcn.0048c270
nop
mov qword [rdi], rsi
mov dword [rdi + 0x428], 0x800
mov qword [rdi + 0x420], r12
mov dword [rdi + 0x434], r12d
mov dword [rdi + 0x42c], r12d
mov dword [rdi + 0x430], r12d
lea rsi, [rdi + 0x458]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 0x26]
lea rcx, [rdi + 0x438]
call fcn.0048c310
test eax, eax
jns 0x4852e0
lea rcx, [0x004de078]
call fcn.00498c40
test rax, rax
je 0x4852b7
lea rcx, [0x004de078]
call fcn.00498c40
mov r11, rax
mov rcx, rsi
movzx eax, word [r11]
mov word [rcx], ax
add r11, 2
add rcx, 2
test ax, ax
jne 0x4852a1
jmp 0x4852e0
lea rcx, str.C:Program_Files
mov rdx, rsi
sub rdx, rcx
nop
nop
nop
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x4852d0
lea rbx, [rdi + 0x660]
mov r8, rsi
lea rdx, str._sSynapticsSynTP
mov rcx, rbx
call fcn.00493300
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x485315
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call fcn.00488f80
cmp eax, 9
jl 0x48534e
lea rdx, [rdi + 0x868]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 5]
lea rcx, [rdi + 0x438]
call fcn.0048c310
test eax, eax
js 0x48534e
mov rax, rdi
jmp 0x485373
lea rcx, [rdi + 0x868]
sub rcx, rbx
nop
nop
movzx eax, word [rbx]
mov word [rcx + rbx], ax
add rbx, 2
test ax, ax
jne 0x485360
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.004902e0
mov rbx, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x4883d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rsi
xor ebx, ebx
test r9, r9
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
mov r13, rdx
mov rdi, r9
mov rsi, r8
mov ebp, ebx
je 0x488402
mov ebp, dword [r9]
test rdx, rdx
je 0x4884d1
test r8, r8
je 0x4884d1
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x4884c3
cmp qword [rsp + 0x90], rbx
mov qword [rsp + 0x30], rcx
je 0x48845a
mov rdx, qword [rsp + 0x90]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4884c3
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r13
mov dword [rsp + 0x78], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp qword [rsp + 0x90], rbx
mov r13d, eax
je 0x48849d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r13d, r13d
jne 0x4884c3
mov eax, dword [rsp + 0x88]
cmp eax, 4
je 0x4884ba
cmp eax, 3
jne 0x4884bf
cmp dword [rsp + 0x78], 4
jne 0x4884bf
mov ebx, 1
mov eax, ebx
jmp 0x4884d3
test rdi, rdi
je 0x4884d1
mov dword [rsi], ebp
mov eax, 1
jmp 0x4884d3
xor eax, eax
mov r13, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x488500
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
xor esi, esi
test rdx, rdx
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov rbp, r9
mov rbx, r8
mov r13d, esi
mov r12, rdx
je 0x4886ef
test r8, r8
je 0x4886ef
test r9, r9
je 0x4886ef
mov rcx, qword [rcx + 0x10]
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x40], r15
test rcx, rcx
lea r15, [rsi - 1]
je 0x48869d
mov rdi, qword [rsp + 0xb8]
mov r13d, dword [r9]
mov qword [r11 - 0x58], rcx
test rdi, rdi
je 0x48859b
lea rax, [r11 - 0x58]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov qword [r11 - 0x68], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48869d
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x98]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test rdi, rdi
mov r14d, eax
je 0x4885d1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [rsp + 0x98]
cmp ecx, 2
jne 0x48864f
mov eax, 2
mul r13
cmovo rax, r15
mov rcx, rax
call fcn.0048efe0
test rax, rax
mov r12, rax
je 0x488648
mov r8d, r13d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbx
mov rdx, r12
sub rcx, r12
movzx eax, word [rdx]
add rdx, 2
test ax, ax
mov word [rcx + rdx - 2], ax
jne 0x488611
xor eax, eax
mov rcx, r15
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov dword [rbp], ecx
mov rcx, r12
call fcn.00490170
mov ecx, dword [rsp + 0x98]
jmp 0x48864f
mov ecx, dword [rsp + 0x98]
test r14d, r14d
mov r14, qword [rsp + 0x50]
jne 0x48869d
cmp ecx, 1
je 0x488668
cmp ecx, 7
je 0x488668
cmp ecx, 2
jne 0x48866d
mov esi, 1
mov eax, esi
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x48]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rdx, qword [rsp + 0xb0]
test rdx, rdx
je 0x4886eb
xor eax, eax
mov rcx, r15
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
add ecx, ecx
cmp ecx, r13d
ja 0x48866f
sub rbx, rdx
nop
nop
nop
nop
movzx eax, word [rdx]
add rdx, 2
test ax, ax
mov word [rbx + rdx - 2], ax
jne 0x4886d0
mov dword [rbp], ecx
mov eax, 1
jmp 0x48866f
xor eax, eax
jmp 0x48866f
xor eax, eax
jmp 0x488679
Function at 0x488700
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
xor ebx, ebx
test rdx, rdx
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov rdi, r9
mov rsi, r8
mov r13, rdx
mov r12d, ebx
je 0x4887e7
test r8, r8
je 0x4887e7
test r9, r9
je 0x4887e7
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x4887c8
cmp qword [rsp + 0x98], rbx
mov r12d, dword [r9]
mov qword [r11 - 0x38], rcx
je 0x488786
mov rdx, qword [rsp + 0x98]
lea rax, [r11 - 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [r11 - 0x48], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4887c8
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp qword [rsp + 0x98], rbx
mov edi, eax
je 0x4887b8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x4887c8
cmp dword [rsp + 0x78], 3
sete bl
mov eax, ebx
jmp 0x4887e9
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x4887e7
mov r8d, r12d
mov rcx, rsi
call fcn.00493e00
mov eax, 1
jmp 0x4887e9
xor eax, eax
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret

Function at 0x488810
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rcx, qword [rcx + 0x10]
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
test rcx, rcx
mov qword [r11 - 0x20], r12
mov rsi, r9
mov r12d, r8d
mov rbp, rdx
je 0x4888ff
test rdx, rdx
je 0x4888ff
test r9, r9
je 0x4888ff
mov qword [r11 - 8], rbx
xor ebx, ebx
mov qword [r11 - 0x38], rcx
cmp qword [rsp + 0xb8], rbx
je 0x4888c0
mov rdx, qword [rsp + 0xb8]
lea rax, [r11 + 8]
xor r9d, r9d
mov qword [r11 - 0x48], rax
lea rax, [r11 - 0x38]
xor r8d, r8d
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4888bb
xor eax, eax
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x88
ret
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0xb0]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rsp + 0xb8], rbx
mov esi, eax
je 0x4888f6
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
mov eax, ebx
jmp 0x48889c
xor eax, eax
jmp 0x4888a4
Function at 0x488910
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
sub rsp, 0x488
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rbp
xor ebx, ebx
test r8, r8
mov qword [r11 - 0x10], rsi
mov rbp, rdx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x50], rcx
mov qword [r11 - 0x18], rdi
mov rsi, r8
je 0x488a26
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x488a26
lea rax, [rsp + 0x48]
mov r9d, 0x10008
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x488a26
nop
nop
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x40], 0x200
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov edi, eax
je 0x488a04
test eax, eax
jne 0x488a12
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x60]
call fcn.00488910
mov edi, 0x3f2
test eax, eax
cmovne edi, ebx
test edi, edi
je 0x4889a0
jmp 0x488a12
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete bl
mov eax, ebx
jmp 0x488a28
xor eax, eax
mov rdi, qword [rsp + 0x470]
mov rsi, qword [rsp + 0x478]
mov rbp, qword [rsp + 0x480]
mov rbx, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x488
ret

Function at 0x488a70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov eax, dword [rsp + 0x80]
mov dword [r9], r8d
mov r8, qword [rsp + 0x88]
mov dword [r8], eax
mov qword [rsp + 0x38], r8
mov r10, rdx
mov edx, dword [rcx + 0x1c]
xor ebx, ebx
mov r8, r10
lea eax, [rdx + 1]
mov dword [rcx + 0x1c], eax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x488ae0
Capabilities:
Query or enumerate registry key

Disassembly:
sub rsp, 0x28
mov r10, rdx
mov edx, dword [rcx + 0x1c]
mov r9d, r8d
lea eax, [rdx + 1]
mov r8, r10
mov dword [rcx + 0x1c], eax
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x488d50
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov r11, rsp
sub rsp, 0x78
mov rcx, qword [rcx + 0x10]
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rsi
test rcx, rcx
mov qword [r11 - 0x18], rdi
mov rsi, rdx
mov rdi, r9
je 0x488e07
test rdx, rdx
je 0x488e07
xor ebx, ebx
test r9, r9
mov qword [r11 - 0x28], rcx
je 0x488dc7
lea rax, [r11 + 8]
xor r9d, r9d
xor r8d, r8d
mov qword [r11 - 0x38], rax
lea rax, [r11 - 0x28]
mov rdx, rdi
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x488e09
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x90]
mov r9d, 4
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
mov esi, eax
je 0x488e00
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
jmp 0x488e09
xor ebx, ebx
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret

Function at 0x488f80
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp dword [0x0050cd9c], 0
jne 0x4890e0
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
call fcn.00491ae0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4890e0
mov eax, dword [rsp + 0x30]
cmp eax, 1
jne 0x48902a
cmp dword [rsp + 0x24], 4
jne 0x4890d6
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x488ffe
mov dword [0x0050cd98], 2
jmp 0x4890d6
cmp eax, 0xa
jne 0x489012
mov dword [0x0050cd98], 3
jmp 0x4890d6
cmp eax, 0x5a
jne 0x4890d6
mov dword [0x0050cd98], 4
jmp 0x4890d6
cmp eax, 2
jne 0x4890d6
mov edx, dword [rsp + 0x24]
cmp edx, 4
jne 0x48904b
mov dword [0x0050cd98], 5
jmp 0x4890d6
cmp edx, 5
jne 0x489086
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x489064
mov dword [0x0050cd98], 6
jmp 0x4890d6
cmp eax, 1
jne 0x489075
mov dword [0x0050cd98], 7
jmp 0x4890d6
cmp eax, 2
jne 0x4890b0
mov dword [0x0050cd98], 8
jmp 0x4890d6
cmp edx, 6
jne 0x4890bf
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x48909f
mov dword [0x0050cd98], 9
jmp 0x4890d6
cmp eax, 1
jne 0x4890b0
mov dword [0x0050cd98], 0xa
jmp 0x4890d6
jbe 0x4890d6
mov ecx, 0xb
mov dword [0x0050cd98], ecx
jmp 0x4890d6
mov eax, dword [0x0050cd98]
mov ecx, 0xb
cmp edx, 6
cmova eax, ecx
mov dword [0x0050cd98], eax
mov dword [0x0050cd9c], 1
mov eax, dword [0x0050cd98]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x158
ret
Function at 0x4894a0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x308
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov qword [r11 + 0x20], rbx
lea r9, [r11 - 0x228]
mov qword [r11 - 8], rdi
mov rbx, r8
mov edi, edx
sub r9, rcx
nop
nop
nop
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
mov word [r9 + rcx - 2], ax
jne 0x4894e0
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.00491ae0
test rbx, rbx
lea rax, [rsp + 0x50]
cmovne rax, rbx
lea rdx, [rsp + 0xe0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x70], 0x68
mov word [rsp + 0xb0], di
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rdi, qword [rsp + 0x300]
mov rbx, qword [rsp + 0x328]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x308
ret
Function at 0x48bc70
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov rbx, rcx
xor edx, edx
add rcx, 0x38
mov r8d, 0x840
mov qword [rsp + 0x48], rdi
call fcn.00491ae0
xor edi, edi
lea rcx, str.DXVA2.DLL
mov dword [rbx + 0x878], edi
mov dword [rbx + 0x87c], edi
mov dword [rbx + 0x880], edi
mov dword [rbx + 0x884], edi
mov dword [rbx + 0x888], edi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [rbx + 8], rax
je 0x48bd97
lea rdx, str.GetNumberOfPhysicalMonitorsFromHMONITOR
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.GetPhysicalMonitorsFromHMONITOR
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.DestroyPhysicalMonitors
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.GetMonitorBrightness
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.SetMonitorBrightness
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
mov qword [rbx + 0x30], rax
je 0x48bd54
cmp qword [rbx + 0x18], rdi
je 0x48bd54
cmp qword [rbx + 0x20], rdi
je 0x48bd54
cmp qword [rbx + 0x28], rdi
je 0x48bd54
test rax, rax
jne 0x48bd97
test rcx, rcx
je 0x48bd5d
mov qword [rbx + 0x10], rdi
cmp qword [rbx + 0x18], rdi
je 0x48bd67
mov qword [rbx + 0x18], rdi
cmp qword [rbx + 0x20], rdi
je 0x48bd71
mov qword [rbx + 0x20], rdi
cmp qword [rbx + 0x28], rdi
je 0x48bd7b
mov qword [rbx + 0x28], rdi
test rax, rax
je 0x48bd84
mov qword [rbx + 0x30], rdi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x48bd97
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 8], rdi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret