joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003fe98
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x480
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r8, qword [0x100088820]
xor r14d, r14d
mov rbp, rcx
mov ebx, 1
cmp r8, r14
je 0x10003feee
mov edx, ebx
mov rcx, r8
call fcn.10003f344
mov r8, r14
mov qword [0x100088820], r14
mov rdx, qword [0x100088818]
cmp rdx, r14
je 0x1000400cd
mov rcx, rdx
call fcn.10004fe1c
cmp rax, r14
je 0x1000400cd
mov rcx, rdx
call fcn.10004fe1c
lea rdi, [0x1000062c0]
mov esi, 0x104
cmp qword [rax + 0x60], r14
lea rcx, [rsp + 0x50]
mov edx, esi
cmovne rdi, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
cmp eax, r14d
je 0x1000400c6
lea r8, [0x100027128]
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.100039ee4
cmp eax, r14d
jl 0x10003ff90
lea rcx, [rsp + 0x50]
call fcn.100053454
cmp eax, r14d
jne 0x10003ff90
lea rcx, [rsp + 0x50]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, r14d
je 0x10003ff90
lea r8, [0x100027128]
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.100039ee4
lea rcx, [rsp + 0x50]
call fcn.100053454
cmp eax, r14d
je 0x1000400c6
cmp rdi, r14
je 0x1000400c6
lea rdx, [0x1000062c0]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r14d
je 0x1000400c6
mov rcx, rdi
call fcn.100053454
cmp eax, r14d
je 0x1000400c6
mov rcx, qword [0x100088070]
mov r9d, 0xff
lea r8, [rsp + 0x260]
lea edx, [r9 - 0x55]
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r14d
je 0x1000400c6
movsxd rax, dword [0x100088814]
lea rcx, [rax + rax*2]
mov rax, qword [str.6ij]
add rcx, rcx
mov r12d, dword [rax + rcx*8 + 0x2c]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetParent]
mov edx, r12d
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 0x402
mov rcx, rbp
mov r13, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
cmp rax, r14
jne 0x100040060
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetParent]
mov edx, 0x402
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
mov ecx, 0x48
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, r14
je 0x1000400ba
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r12d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rdi
mov r9, rsi
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x260]
mov r8d, 0x402
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdx, rbp
call fcn.10004f2d8
mov r8, rax
mov qword [0x100088820], rax
jmp 0x1000400cd
mov r8, r14
mov qword [0x100088820], r14
jmp 0x1000400cd
mov r8, qword [0x100088820]
cmp r8, r14
cmove ebx, r14d
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x100040518
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x690
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x680], rax
xor r13d, r13d
mov rdi, rcx
mov ebx, 1
cmp qword [0x100088820], r13
jne 0x100040756
mov esi, 0x104
lea rcx, [r11 - 0x448]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
cmp eax, r13d
je 0x100040748
lea r8, [0x100027128]
lea rcx, [rsp + 0x260]
mov rdx, rsi
call fcn.100039ee4
cmp eax, r13d
jl 0x1000405d4
lea rcx, [rsp + 0x260]
call fcn.100053454
cmp eax, r13d
jne 0x1000405d4
lea rcx, [rsp + 0x260]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, r13d
je 0x1000405d4
lea r8, [0x100027128]
lea rcx, [rsp + 0x260]
mov rdx, rsi
call fcn.100039ee4
lea rcx, [rsp + 0x260]
call fcn.100053454
cmp eax, r13d
je 0x100040748
lea rdx, [rsp + 0x50]
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, r13d
je 0x100040748
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x50]
mov r8d, 0x103
call fcn.100052a30
lea r11, [rsp + 0x50]
cmp r11, r13
je 0x10004062d
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, [0x100025ea8]
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.100039ee4
cmp eax, r13d
jl 0x100040748
lea rcx, [rsp + 0x50]
call fcn.100053454
cmp eax, r13d
je 0x100040748
mov rcx, qword [0x100088070]
mov r9d, 0xff
lea r8, [rsp + 0x470]
lea edx, [r9 - 0x55]
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r13d
je 0x100040748
movsxd rax, dword [0x100088814]
lea rcx, [rax + rax*2]
mov rax, qword [str.6ij]
add rcx, rcx
mov ebp, dword [rax + rcx*8 + 0x2c]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetParent]
mov edx, ebp
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 0x402
mov rcx, rdi
mov r12, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
cmp rax, r13
jne 0x1000406e5
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetParent]
mov edx, 0x402
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rsi, rax
mov ecx, 0x48
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
cmp rax, r13
je 0x100040743
mov dword [rsp + 0x48], r13d
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], ebp
lea rcx, [rsp + 0x50]
mov r9, rsi
mov r8d, 0x402
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x260]
mov rdx, rdi
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x470]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.10004f2d8
mov qword [0x100088820], rax
jmp 0x10004074f
mov rax, r13
jmp 0x10004073a
mov rax, qword [0x100088820]
cmp rax, r13
cmove ebx, r13d
mov eax, ebx
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x100040918
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
lea rax, [rsp + 0x58]
lea rdx, [0x100027150]
and qword [rsp + 0x58], rbx
lea r9d, [rbx + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000409c0
mov rcx, qword [rsp + 0x58]
and dword [rsp + 0x48], ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x40]
lea rdx, [0x100006270]
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000409b5
cmp dword [rsp + 0x40], 4
jne 0x1000409b5
cmp dword [rsp + 0x48], ebx
sete bl
test ebx, ebx
je 0x1000409b5
lea rdx, [0x1000271d0]
lea ecx, [rax + 4]
call fcn.1000527a0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x100043a20
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x140], rax
call fcn.1000537e4
cmp eax, 6
jne 0x100043a4c
mov eax, 1
jmp 0x100043ab2
xor ebx, ebx
call fcn.100053848
movsd xmm1, qword [0x100039d90]
ucomisd xmm1, xmm0
jp 0x100043a73
jne 0x100043a73
call fcn.10004ac94
cmp eax, ebx
jne 0x100043a73
mov ebx, 1
jmp 0x100043ab0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, ebx
je 0x100043ab0
mov ecx, 2
cmp dword [rsp + 0x30], ecx
jne 0x100043ab0
cmp dword [rsp + 0x24], 5
jne 0x100043ab0
lea eax, [rcx - 1]
cmp dword [rsp + 0x28], eax
jne 0x100043ab0
cmp word [rsp + 0x134], cx
cmovae ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10007fa70
add rsp, 0x150
pop rbx
ret
Function at 0x100043ad4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100027440]
xor esi, esi
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov edi, 1
mov qword [rsp + 0x40], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100043bf3
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, [0x100025bc0]
xor r8d, r8d
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x34], esi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x48], 8
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x100043be8
cmp dword [rsp + 0x38], 3
jne 0x100043be8
lea rax, [rsp + 0x50]
cmp rax, rsi
je 0x100043b9f
lea rcx, [rsp + 0x50]
mov edx, 0x100
call fcn.100058170
jmp 0x100043ba1
mov eax, esi
cmp eax, esi
je 0x100043be8
mov eax, dword [rsp + 0x30]
shr eax, 0x10
movzx ebx, ax
movzx eax, word [rsp + 0x30]
shl rbx, 0x10
or rbx, rax
mov eax, dword [rsp + 0x34]
shr eax, 0x10
shl rbx, 0x10
movzx ecx, ax
movzx eax, word [rsp + 0x34]
or rbx, rcx
lea rcx, [rsp + 0x50]
shl rbx, 0x10
or rbx, rax
call fcn.100052d68
cmp rax, rbx
cmovb edi, esi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x100043c20
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x250
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x230], rax
xorpd xmm6, xmm6
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor ebx, ebx
cmp eax, ebx
je 0x100043d1a
lea r8, [0x1000274e8]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.100039ee4
cmp eax, ebx
jl 0x100043d1a
lea rcx, [rsp + 0x20]
call fcn.100053454
cmp eax, ebx
je 0x100043d1a
lea rax, [rsp + 0x20]
cmp rax, rbx
je 0x100043ca6
lea rcx, [rsp + 0x20]
call fcn.100054858
mov rbx, rax
lea rcx, [0x100027510]
call fcn.100052d68
cmp rbx, rax
jb 0x100043cc1
movsd xmm6, qword [0x100039d88]
jmp 0x100043d1a
lea rcx, [0x100027530]
call fcn.100052d68
cmp rbx, rax
jb 0x100043cdc
movsd xmm6, qword [0x100039d80]
jmp 0x100043d1a
lea rcx, [0x100027550]
call fcn.100052d68
cmp rbx, rax
jb 0x100043cf7
movsd xmm6, qword [0x100039d78]
jmp 0x100043d1a
lea rcx, [0x100027570]
call fcn.100052d68
cmp rbx, rax
jb 0x100043d12
movsd xmm6, qword [0x100039d70]
jmp 0x100043d1a
movsd xmm6, qword [0x100039d68]
movapd xmm0, xmm6
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.10007fa70
movaps xmm6, xmmword [rsp + 0x240]
add rsp, 0x250
pop rbx
ret
Function at 0x100049368
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rcx, qword [str.6ij]
lea rax, str.8
cmp rax, rcx
jne 0x100049449
cmp dword [0x100088810], 0xd2af9
je 0x10004955e
mov rcx, qword [0x100088818]
test rcx, rcx
je 0x100049439
call fcn.10004fe1c
test rax, rax
je 0x100049439
cmp dword [rax + 0x138], 0
jne 0x100049439
lea rcx, [0x100025de0]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x100049439
lea rcx, [0x100025de0]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
je 0x10004955e
lea rcx, [0x100027d48]
call qword [sym.imp.USER32.dll_RegisterWindowMessageA]
test eax, eax
je 0x10004955e
xor r9d, r9d
mov edx, eax
mov rcx, rdi
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, [0x100027d68]
mov ecx, 4
call fcn.1000527a0
jmp 0x10004955e
mov ebx, 1
mov dword [0x1000887f4], ebx
jmp 0x10004955e
lea rax, str.K
mov ebx, 1
cmp rax, rcx
jne 0x1000494a7
mov eax, dword [0x1000887f4]
cmp dword [0x100088810], 0xd2af9
cmovne eax, ebx
mov dword [0x1000887f4], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [0x100025df8]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x10004955e
and dword [0x1000887f4], 0
xor edx, edx
mov ecx, ebx
call fcn.10004c4ec
jmp 0x10004955e
mov eax, dword [0x100088810]
cmp eax, 0xd2af8
jne 0x100049509
lea rdx, [rsp + 0x20]
test rdx, rdx
je 0x1000494df
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.1000529a4
mov rcx, qword [str.6ij]
mov r11d, eax
mov eax, dword [0x100088810]
jmp 0x1000494e2
xor r11d, r11d
test r11d, r11d
je 0x100049509
lea rdx, [rsp + 0x20]
mov r9d, 0xffff
mov r8d, ebx
xor ecx, ecx
call fcn.100056190
mov rcx, qword [str.6ij]
mov eax, dword [0x100088810]
test eax, eax
js 0x100049539
lea rdx, str.6ij
cmp rdx, rcx
jne 0x100049539
cmp dword [0x10008889c], 0
jne 0x10004952e
call fcn.10003cdf0
call fcn.10003cce0
jmp 0x100049533
call fcn.10003cdf0
mov eax, dword [0x100088810]
cmp eax, 0xd2af9
je 0x100049559
cmp eax, 0xc00d2afb
je 0x100049559
test eax, eax
js 0x10004955e
cmp dword [0x1000887ec], 0
jne 0x10004955e
jmp 0x10004943e
call fcn.10004ab34
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.10007fa70
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x10004a83c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x480
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor ebx, ebx
lea rax, [rsp + 0x40]
mov edi, ecx
and qword [rsp + 0x40], rbx
lea rdx, [0x10002aa60]
lea r9d, [rbx + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004a97a
mov rcx, qword [rsp + 0x40]
and dword [rsp + 0x34], ebx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
lea rdx, [0x10002aad0]
xor r8d, r8d
mov dword [rsp + 0x30], 3
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004a8ed
cmp dword [rsp + 0x30], 4
je 0x10004a8e5
cmp dword [rsp + 0x30], 3
jne 0x10004a8ed
cmp dword [rsp + 0x34], 1
setne bl
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x10004a97a
lea rax, [rsp + 0x50]
mov ebx, 0x105
test rax, rax
je 0x10004a919
lea rcx, [rsp + 0x50]
mov edx, ebx
call fcn.1000529a4
jmp 0x10004a91b
xor eax, eax
test eax, eax
je 0x10004a97a
lea rcx, [rsp + 0x50]
call fcn.100053454
test eax, eax
je 0x10004a97a
lea r9, [rsp + 0x50]
lea r8, [0x100027f50]
lea rcx, [rsp + 0x260]
mov rdx, rbx
call fcn.10003a080
test eax, eax
js 0x10004a97a
lea rdx, [rsp + 0x260]
test edi, edi
je 0x10004a967
lea rcx, [0x100027f88]
call fcn.100056038
jmp 0x10004a97a
mov r9d, 0xffff
mov r8d, 1
xor ecx, ecx
call fcn.100056190
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.10007fa70
mov rbx, qword [rsp + 0x490]
add rsp, 0x480
pop rdi
ret
Function at 0x10004ab34
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push rdi
sub rsp, 0x280
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edi, edi
lea rax, [rsp + 0x58]
lea rdx, [0x100027f90]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x10004ac5c
lea rax, [rsp + 0x50]
lea r9d, [rdi + 3]
lea rdx, [0x100027ff0]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x10004ac51
lea rax, [rsp + 0x60]
cmp rax, rdi
je 0x10004abe9
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.1000529a4
jmp 0x10004abeb
mov eax, edi
cmp eax, edi
je 0x10004ac46
lea r8, [0x100028050]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.100039ee4
cmp eax, edi
jl 0x10004ac46
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
lea rdx, [0x100028080]
mov r9d, 1
not rcx
xor r8d, r8d
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10007fa70
add rsp, 0x280
pop rdi
ret

Function at 0x10004ac94
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rbx + 4]
xor edx, edx
mov qword [rsp + 0x38], rbx
call fcn.100053900
cmp eax, ebx
jne 0x10004acd5
xor eax, eax
jmp 0x10004ad6a
lea rax, [rsp + 0x38]
mov edi, 1
lea rdx, [0x1000283d0]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10004ad68
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100028430]
xor r8d, r8d
mov dword [rsp + 0x34], 0x200
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10004ad5d
cmp dword [rsp + 0x30], edi
jne 0x10004ad5d
lea rdx, [0x100028448]
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
cmovne ebx, edi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.10007fa70
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret
Function at 0x10004b054
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edi, edi
mov ebx, 0x80004005
cmp rcx, 0x424
je 0x10004b0c6
cmp rcx, 0x466
je 0x10004b0c6
cmp rcx, 0x427
je 0x10004b0a4
lea rdx, [0x100028510]
lea ecx, [rdi + 2]
call fcn.1000527a0
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.100053900
neg eax
sbb edx, edx
and edx, 0x87
add edx, 0xc1
jmp 0x10004b100
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea ecx, [rdx + 5]
call fcn.100053900
cmp eax, edi
je 0x10004b0e3
mov edx, 0xe2
jmp 0x10004b100
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.100053900
neg eax
sbb edx, edx
and edx, 0x1f
add edx, 0xc0
mov rcx, qword [0x100088070]
lea r8, [rsp + 0x30]
mov r9d, 0x100
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, edi
je 0x10004b15e
lea rdx, [0x100028258]
lea rcx, [rsp + 0x30]
mov r8d, 7
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, edi
jne 0x10004b15e
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
cmova ebx, edi
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.10007fa70
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x10004ba04
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x80
and qword [rsp + 0x48], 0
lea rdx, [0x1000286b0]
or r8d, 0xffffffff
mov rbp, rcx
call fcn.10007d57c
mov ebx, eax
test eax, eax
js 0x10004bc3e
lea rcx, [rsp + 0x60]
call fcn.10007d40c
lea rcx, [rsp + 0x50]
mov dword [rsp + 0xb0], 0x7fff
call fcn.10007d40c
mov edx, dword [rsp + 0xb0]
lea rcx, [rsp + 0x50]
call fcn.10007d51c
mov ebx, eax
test eax, eax
jns 0x10004ba81
lea rcx, [rsp + 0x50]
call fcn.10007d970
lea rcx, [rsp + 0x60]
call fcn.10007d970
jmp 0x10004bc3e
mov rdx, qword [rsp + 0x50]
lea r8, [rsp + 0xb0]
mov ecx, 2
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x10004babc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
test eax, eax
cmove eax, ecx
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10004ba68
mov ebx, 0x44
mov rdx, rbx
lea ecx, [rbx - 4]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x10004badf
mov ebx, 0x8007000e
jmp 0x10004bc1c
mov rdx, qword [rsp + 0x50]
and dword [rsp + 0xa8], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa8]
lea r9, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r8, rdi
xor ecx, ecx
mov dword [rsp + 0xb8], ebx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x10004bb47
cmp eax, 0x7a
je 0x10004bb47
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10004bc1c
lea rcx, [rsp + 0x70]
call fcn.10007d40c
mov edx, dword [rsp + 0xa8]
lea rcx, [rsp + 0x70]
inc edx
call fcn.10007d51c
mov ebx, eax
test eax, eax
js 0x10004bc12
mov rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa8]
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x10004bbc3
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10004bc12
lea rdx, [rsp + 0x48]
mov rcx, rdi
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
jne 0x10004bbe6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
test eax, eax
cmove eax, ecx
jmp 0x10004bbb3
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
or r8d, 0xffffffff
call fcn.10007d57c
mov ebx, eax
test eax, eax
js 0x10004bc12
mov rdx, qword [rsp + 0x60]
or r8d, 0xffffffff
mov rcx, rbp
call fcn.10007d7d4
mov ebx, eax
lea rcx, [rsp + 0x70]
call fcn.10007d970
lea rcx, [rsp + 0x50]
call fcn.10007d970
lea rcx, [rsp + 0x60]
call fcn.10007d970
test rdi, rdi
je 0x10004bc3e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x10004bc4e
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
add rsp, 0x80
pop rdi
pop rbp
pop rbx
ret
Function at 0x10004c0a4
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
and qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
lea rdx, [0x100028710]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004c178
and dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100028770]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004c127
cmp dword [rsp + 0x40], 1
jne 0x10004c127
and dword [0x1000888a8], 0xfffffffe
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea rdx, [0x1000287b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004c16d
cmp dword [rsp + 0x40], 1
jne 0x10004c16d
and dword [0x1000888a8], 0xfffffffd
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret