joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402c2814
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov r12, r8
mov r13, rdx
xor esi, esi
lea ecx, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
test ebx, ebx
je 0x1402c291c
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x30], rbx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x20], 3
lea r9d, [rsi + 1]
mov r8d, 0x80000000
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.140021fb8
test eax, eax
je 0x1402c28e2
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.1400450d4
test eax, eax
je 0x1402c28e2
lea rcx, [rsp + 0x78]
call fcn.1402c2514
test al, al
je 0x1402c28db
mov rdx, r12
lea rcx, [rsp + 0x78]
call fcn.1402c2654
jmp 0x1402c28ea
mov esi, 0x309
jmp 0x1402c28ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x1402c290b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x30]
cmp rcx, rbx
je 0x1402c291c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1402c2922
mov eax, esi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret

Function at 0x1402c2c08
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rdx]
mov rdi, qword [rdx + 8]
xor esi, esi
cmp rbx, rdi
je 0x1402c2c75
mov rax, qword [rbx]
xor ecx, ecx
mov rdx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rbp, rax
test rax, rax
je 0x1402c2c63
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
test eax, eax
jne 0x1402c2c58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x1402c2c6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x1402c2c75
add rbx, 0x10
jmp 0x1402c2c25
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov eax, esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1402c33ec
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
jne 0x1402c3446
mov r8, qword [rcx + 0x70]
mov rdx, qword [rcx + 0x78]
mov r9d, 0x2001f
add rcx, 0x10
call fcn.1400114d4
test eax, eax
je 0x1402c3446
mov r8, qword [rdi + 0x70]
mov rdx, qword [rdi + 0x78]
lea rcx, [rdi + 0x10]
mov r9d, 0x2001f
call fcn.140010dd0
test eax, eax
jne 0x1402c347c
test rbx, rbx
jne 0x1402c3450
lea eax, [rbx + 0xd]
jmp 0x1402c347c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rdi + 0x10]
mov r9d, 1
lea eax, [rax + rax + 2]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1402c7118
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [rcx]
xor bl, bl
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x1402c7133
cmp eax, 3
jne 0x1402c7135
mov bl, 1
mov al, bl
add rsp, 0x20
pop rbx
ret

Function at 0x1402c7148
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [rcx]
mov bl, 1
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x1402c7163
cmp eax, 6
jne 0x1402c7165
xor bl, bl
mov al, bl
add rsp, 0x20
pop rbx
ret

Function at 0x1402c7178
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [rcx]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x1402c71ea
cmp eax, 4
je 0x1402c71ea
mov rcx, qword [rdi]
lea rdx, [0x14035d268]
call fcn.1400bedf4
test eax, eax
je 0x1402c71ec
mov rcx, qword [rdi]
mov dword [rsp + 0x38], ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x50], ebx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1402c71ec
mov ebx, dword [rsp + 0x50]
shr ebx, 0x13
and bl, 1
jmp 0x1402c71ec
mov bl, 1
mov al, bl
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1402c9e3c
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r13
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov rbp, rdx
mov rsi, rcx
xor r13d, r13d
mov dword [rax + 0x18], r13d
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
lea ebx, [r13 + 1]
mov dword [rsp + 0x70], ebx
mov edx, 0x494
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
mov r9d, ebx
mov r8d, eax
mov rdx, rbp
lea rcx, [rsp + 0x28]
call fcn.14000bd14
mov rbx, qword [rax + 8]
mov edx, 0x494
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r8d, [rdi + 1]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
cmp eax, 0xffffffff
jne 0x1402c9efe
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1402c9ef5
mov eax, r13d
jmp 0x1402c9f02
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x1402c9f1d
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1402c9f1d
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], r13w
mov rax, rbp
jmp 0x1402c9f28
mov ecx, 0x80070057
call fcn.14000cbb8
nop
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop rdi
pop rsi
ret
Function at 0x1402ca13c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rdi, rdx
mov rbx, rcx
and dword [rsp + 0x50], 0
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov dword [rsp + 0x50], 1
mov ecx, 1
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1402ca1cd
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1402ca1cd
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rax
mov rcx, rdi
call fcn.14001c5ec
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1402cb090
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
lea r8, str.Piriform_CCleaner_SystemTrayIconActive
xor ecx, ecx
lea esi, [rbp + 1]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, bpl
cmp eax, 0xb7
cmove edi, esi
test rbx, rbx
je 0x1402cb0dd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov al, dil
add rsp, 0x20
pop rdi
ret

Function at 0x1402cb7c8
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
mov ebx, 1
cmp qword [rcx + 0x28], rsi
jne 0x1402cb80d
lea r8, str.Piriform_CCleaner_Monitoring
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, bl
cmp eax, 0xb7
cmove ebx, esi
mov rsi, qword [rsp + 0x38]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1402cb878
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
lea r8, str.Piriform_CCleaner_Monitoring
xor ecx, ecx
lea esi, [rbp + 1]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, bpl
cmp eax, 0xb7
cmove edi, esi
test rbx, rbx
je 0x1402cb8c5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov al, dil
add rsp, 0x20
pop rdi
ret
Function at 0x1402d03f8
Capabilities:
Check if file exists

Disassembly:
add rcx, 0xffffffffffffffe8
xor r9d, r9d
jmp 0x1402d0078
Function at 0x1402d1128
Capabilities:
Check if file exists
Delete file

Disassembly:
add rcx, 0xffffffffffffffe8
xor r9d, r9d
mov r8b, 1
jmp 0x1402d06c8

Function at 0x1402d11b8
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
lea rsi, [rcx + 8]
mov r9d, 0x2001f
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, 0xffffffff80000001
mov rcx, rsi
call fcn.1400114d4
mov edi, eax
lea rcx, section..data
mov rdx, qword [section..data]
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
xor ebp, ebp
test edi, edi
jne 0x1402d1322
lea edx, [rbp + 0x64]
mov dword [rsp + 0x60], edx
lea ecx, [rbp + 1]
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x1402d1239
lea rcx, [rsp + 0x68]
call fcn.14000c998
mov rbx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140366660]
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, ebp
jmp 0x1402d12d8
cmp edi, 5
jge 0x1402d12f7
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400beaac
test eax, eax
js 0x1402d12ec
cmp eax, dword [rbx - 0xc]
jg 0x1402d12ec
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], bp
mov edx, dword [rsp + 0x60]
test edx, edx
js 0x1402d12e1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x1402d12b1
lea rcx, [rsp + 0x68]
call fcn.14000c998
mov rbx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140366660]
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc edi
cmp eax, 0xea
je 0x1402d1262
jmp 0x1402d12f7
mov ecx, 0x80070057
call fcn.14000cbb8
int3
mov ecx, 0x80070057
call fcn.14000cbb8
int3
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400beaac
test eax, eax
js 0x1402d1317
cmp eax, dword [rbx - 0xc]
jg 0x1402d1317
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], bp
jmp 0x1402d1322
mov ecx, 0x80070057
call fcn.14000cbb8
int3
mov edi, ebp
cmp dword [rbx - 0x10], ebp
setg dil
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1402d1347
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402d1758
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov sil, dl
mov rbx, rcx
xor r12d, r12d
mov dword [rbp + 0x40], r12d
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea r9d, [r12 + 1]
mov dword [rbp + 0x40], r9d
mov r8d, 0x106
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.14000bd14
mov r8d, 0x104
mov rdx, qword [rax + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [rbp - 0x10]
mov rdi, qword [rbp - 0x20]
cmp eax, 0xffffffff
jne 0x1402d17e6
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1402d17dd
mov eax, r12d
jmp 0x1402d17ee
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x1402d18ba
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x1402d18ba
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rdi]
mov word [rax + rcx*2], r12w
test sil, sil
je 0x1402d18b5
lea rdx, [0x14034e5f0]
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x1402d18b5
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.14000c4d8
nop
lea r8, [0x14034e600]
lea rdx, [0x14034e608]
lea rcx, [rbp - 0x30]
call fcn.14000b658
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp + 0x48]
call fcn.14000cb18
nop
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1402d1876
lea rdx, [rbp + 0x48]
mov rcx, rbx
call fcn.14000c244
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402d1896
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402d18b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rbx
jmp 0x1402d18c5
mov ecx, 0x80070057
call fcn.14000cbb8
nop
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1402d23d8
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
mov ecx, edx
lea r8, str._AUTO
lea rdx, [0x14034ee68]
jmp fcn.1402e52dc

Function at 0x1402d7120
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rdi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov r12, r8
mov rbx, rdx
mov r13, rcx
xor r14d, r14d
mov dword [rbp - 0xc], r14d
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea edi, [r14 + 1]
mov dword [rbp - 0xc], edi
mov edx, 0x400
mov dword [rbp + 0x48], edx
mov dword [rbp - 0x10], edi
mov ecx, edi
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or eax, ecx
jge 0x1402d7196
mov rcx, rbx
call fcn.14000c998
mov rax, qword [rbx]
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [r13]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1402d71ca
mov eax, r14d
jmp 0x1402d71db
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x1402d72cd
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1402d72cd
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], r14w
cmp esi, 2
jne 0x1402d720f
mov dword [rbp - 0x10], edi
xor r8d, r8d
lea rdx, [0x140330de8]
mov rcx, rbx
call fcn.14000c9f8
mov edi, r14d
jmp 0x1402d72a4
cmp edi, 5
jge 0x1402d72c8
mov edx, dword [rbp + 0x48]
add edx, 2
mov dword [rbp + 0x48], edx
js 0x1402d72bd
mov rax, qword [rbx]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or eax, ecx
jge 0x1402d724b
mov rcx, rbx
call fcn.14000c998
mov rax, qword [rbx]
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [r13]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1402d727f
mov eax, r14d
jmp 0x1402d728c
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x1402d72b2
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1402d72b2
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], r14w
inc edi
cmp esi, 0xea
je 0x1402d7217
jmp 0x1402d72c8
mov ecx, 0x80070057
call fcn.14000cbb8
int3
mov ecx, 0x80070057
call fcn.14000cbb8
int3
mov rax, rbx
jmp 0x1402d72d8
mov ecx, 0x80070057
call fcn.14000cbb8
nop
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x1402d77e4
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, rdx
mov r14, rcx
mov byte [rsp + 0x30], 0
mov dword [rsp + 0x3c], 0x40
xor r13d, r13d
mov qword [rbp - 0x69], 0xf
and qword [rbp - 0x71], r13
mov byte [rsp + 0x48], r13b
and qword [rsp + 0x20], r13
lea r9, [rsp + 0x3c]
lea r8, [rbp - 0x29]
lea edx, [r13 + 5]
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
mov sil, 1
test eax, eax
je 0x1402d78af
mov byte [rsp + 0x30], sil
xor edx, edx
lea r8d, [r13 + 0xa]
lea rcx, [rbp - 0x29]
call fcn.1400c3a9c
mov r13d, eax
mov edx, eax
mov rbx, qword [rbp - 0x71]
cmp rbx, r13
ja 0x1402d78af
cmp qword [rbp - 0x69], rdx
je 0x1402d78af
mov r8b, sil
lea rcx, [rsp + 0x48]
call fcn.140003520
test al, al
je 0x1402d78af
mov qword [rbp - 0x71], rbx
lea rax, [rsp + 0x48]
cmp qword [rbp - 0x69], 0x10
cmovae rax, qword [rsp + 0x48]
mov byte [rax + rbx], 0
xor r12d, r12d
jmp 0x1402d7924
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x1402d7951
mov edx, eax
and qword [rbp - 0x59], 0
and qword [rbp - 0x51], 0
and qword [rbp - 0x49], 0
lea rcx, [rbp - 0x59]
call fcn.1400a2c74
nop
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x34]
mov rbx, qword [rbp - 0x59]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
mov edi, eax
test eax, eax
je 0x1402d7944
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x1402d7944
add r12d, eax
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400032b8
nop
test rbx, rbx
je 0x1402d7924
mov rcx, rbx
call fcn.1400be0f4
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x34]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
mov edi, eax
jne 0x1402d78b4
jmp 0x1402d7993
test rbx, rbx
je 0x1402d7951
mov rcx, rbx
call fcn.1400be0f4
test edi, edi
je 0x1402d7993
cmp byte [rsp + 0x30], 0
je 0x1402d7961
cmp r12d, r13d
jne 0x1402d7993
test r15, r15
je 0x1402d7996
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x59]
call fcn.1402d7524
nop
mov rdx, rax
mov rcx, r15
call fcn.1400fe820
nop
cmp qword [rbp - 0x41], 8
jb 0x1402d7996
mov rcx, qword [rbp - 0x59]
call fcn.1400be0f4
jmp 0x1402d7996
xor sil, sil
cmp qword [rbp - 0x69], 0x10
jb 0x1402d79a7
mov rcx, qword [rsp + 0x48]
call fcn.1400be0f4
mov al, sil
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400be110
mov rbx, qword [rsp + 0x140]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402e0f64
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push r12
push r14
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rbx, r9
mov rdi, r8
mov r12, rdx
mov rsi, rcx
lea rcx, [rbp - 0x30]
call fcn.14000cb18
nop
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or r14d, 0xffffffff
test eax, eax
je 0x1402e10a9
mov qword [rsi + 0x28], rdi
mov qword [rsi + 0x30], rbx
lea ecx, [r14 + 0x31]
call fcn.1400be454
mov rbx, rax
test rax, rax
je 0x1402e0fef
and qword [rax], 0
and qword [rax + 8], 0
and qword [rax + 0x10], 0
and dword [rax + 0x20], 0
and dword [rax + 0x24], 0
and dword [rax + 0x28], 0
mov dword [rax + 0x2c], 0x5201707
jmp 0x1402e0ff1
xor ebx, ebx
mov qword [rbp - 0x18], rbx
and qword [rbp - 0x10], 0
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.140082ac0
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rax]
mov qword [rbp - 0x10], rcx
mov qword [rax], rdx
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x1402e1049
mov eax, r14d
lock xadd dword [rdi + 8], eax
add eax, r14d
jne 0x1402e1049
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rdi + 0xc], eax
add eax, r14d
jne 0x1402e1049
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov r8, rbx
mov rdx, rbx
lea rcx, [rbp - 0x18]
call fcn.1400020a0
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1402e1073
lea r9, [rsi + 8]
lea r8, [rsi + 0x10]
mov rdx, r12
call fcn.1401b44bc
nop
mov rbx, qword [rbp - 0x10]
test rbx, rbx
je 0x1402e10a9
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x1402e10a9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1402e10a9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402e10c9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rbp
ret

Function at 0x1402e10f4
Capabilities:
Check if file exists

Disassembly:
mov r9, r8
xor r8d, r8d
jmp fcn.1402e0f64
Function at 0x1402e1634
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rbx, r8
xor r9d, r9d
xor r8d, r8d
mov esi, edx
mov ebp, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r12d, r12d
mov edi, eax
test eax, eax
jle 0x1402e16cb
mov r9, qword [rbx]
lea edx, [r12 + 1]
mov ecx, dword [r9 - 0xc]
sub edx, dword [r9 - 8]
sub ecx, eax
or edx, ecx
jge 0x1402e1689
mov edx, eax
mov rcx, rbx
call fcn.14000c998
mov r8, qword [rbx]
mov r9d, edi
mov edx, esi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rcx, qword [rbx]
mov edi, eax
test rcx, rcx
jne 0x1402e16a8
mov eax, r12d
jmp 0x1402e16b5
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x1402e16e8
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1402e16e8
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], r12w
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov ecx, 0x80070057
call fcn.14000cbb8
int3