joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009364
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edi, edi
mov ebx, ecx
test ecx, ecx
je 0x140009390
call fcn.140009214
mov ecx, ebx
call fcn.140008c64
mov ecx, ebx
call fcn.140008f94
test ebx, ebx
je 0x140009440
call fcn.14002ae54
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400093f6
xor eax, eax
lea rcx, [rsp + 0x20]
mov rdx, rbx
mov byte [rsp + 0x20], dil
mov qword [rsp + 0x21], rax
mov qword [rsp + 0x29], rax
mov word [rsp + 0x31], ax
mov byte [rsp + 0x33], al
call fcn.140031b00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x22], 1
jne 0x1400093f6
cmp byte [rsp + 0x23], 1
jne 0x1400093f6
xor eax, eax
jmp 0x14000945a
call fcn.140005bd0
mov ecx, 0x64
lea rdx, [rsp + 0x40]
test eax, eax
mov ebx, edi
cmovne ebx, ecx
call fcn.140009198
lea rcx, [rsp + 0x40]
mov edx, 0x2e
call fcn.1400e9f08
test rax, rax
je 0x140009458
mov dword [rax + 2], 0x6d0074
lea rcx, [rsp + 0x40]
mov dword [rax + 6], 0x70
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140009458
call fcn.140005bd0
mov ecx, 0x64
mov ebx, edi
test eax, eax
cmovne ebx, ecx
xor ecx, ecx
call fcn.140009214
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x14000a0d4
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ebx, ebx
test eax, eax
jne 0x14000a10c
xor eax, eax
jmp 0x14000a16b
lea r8, [rsp + 0x3c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000a108
lea ecx, [rax + 0x12]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x50
pop rbx
ret

Function at 0x14000a180
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x360
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rbx, rcx
lea rcx, [0x140165aca]
mov edx, 0x807a41bf
mov r8d, 0x18
call fcn.1400013c0
lea rdx, [rsp + 0x30]
sub rdx, rax
mov cl, byte [rax]
mov byte [rdx + rax], cl
inc rax
test cl, cl
jne 0x14000a1bd
or rdx, 0xffffffffffffffff
test rbx, rbx
je 0x14000a1fd
lea rcx, [rsp + 0x30]
mov rax, rdx
inc rax
cmp byte [rcx + rax], 0
jne 0x14000a1da
lea rcx, [rsp + 0x30]
add rcx, rax
mov byte [rcx], 0x2f
sub rcx, rbx
mov al, byte [rbx]
inc rbx
mov byte [rcx + rbx], al
test al, al
jne 0x14000a1f1
lea rax, [rsp + 0x140]
mov r9d, edx
lea r8, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rsp + 0x140]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x360
pop rbx
ret

Function at 0x14000a268
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0x10c
mov qword [rsp + 0x20], 0x114
xor edi, edi
call fcn.1400ebf40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jae 0x14000a2f9
mov rbx, qword [0x140175ac0]
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
sar rax, 3
test rax, rax
je 0x14000a2ed
mov rcx, qword [rbx]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, qword [rbx + 8]
inc rdi
sub rax, qword [rbx]
sar rax, 3
cmp rdi, rax
jb 0x14000a2cd
mov rax, qword [rbx]
mov qword [rbx + 8], rax
call fcn.14000c884
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x14000a374
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov qword [0x140175ab8], rcx
mov ecx, 0x30
call fcn.1400e92f4
test rax, rax
je 0x14000a3af
mov rdx, qword [0x140175aa0]
and qword [rax + 0x10], 0
and qword [rax + 0x20], 0
mov qword [rax], rdx
mov qword [rax + 8], rbx
mov byte [rax + 0x2a], 0
mov qword [0x140175a90], rax
mov rax, qword [0x140175aa8]
mov edx, dword [rax + 0x24]
shr edx, 6
and dl, 1
call fcn.14000cc78
mov rdx, rbx
call fcn.14000e5d0
lea rcx, [0x1401651aa]
mov edx, 0x8a84d46d
mov r8d, 0x14
call fcn.140001120
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x14000a425
lea rcx, [0x1401651c0]
mov edx, 0xcb90329c
mov r8d, 0x1a
call fcn.140001120
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140175bb8], rax
lea rcx, [fcn.1400074d4]
xor edx, edx
call fcn.140007680
lea rax, [rsp + 0x40]
lea r8, [0x140006e0c]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140175b70], rax
add rsp, 0x30
pop rbx
ret
Function at 0x14000b138
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x258
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x240], rax
add cl, 0x41
movzx eax, cl
lea rcx, [0x140175bc0]
mov rcx, qword [rcx + rax*8 - 0x208]
test rcx, rcx
je 0x14000b1c2
cmp byte [rcx + 0x9b], 0
je 0x14000b1c2
lea rdx, [rsp + 0x30]
call fcn.14002d124
lea rcx, [rsp + 0x30]
call fcn.140022910
test al, al
je 0x14000b1c2
mov edx, 0x564f281d
mov ecx, 0xaf330f3f
mov r8d, 0x9193da95
call fcn.140001438
lea r8, [rsp + 0x30]
xor r9d, r9d
xor ecx, ecx
mov rdx, rax
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x258
ret

Function at 0x14000b1dc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movzx eax, dl
xor edi, edi
mov rbx, rcx
lea ecx, [rax + 0x41]
and edx, 0xff00
mov dword [rbp + 0x49], 0x5c003a
mov word [rbp + 0x47], cx
mov word [rbp + 0x4d], di
cmp edx, 0x2000
je 0x14000b378
cmp edx, 0x2100
je 0x14000b342
cmp edx, 0x2200
je 0x14000b335
cmp edx, 0x2300
je 0x14000b328
cmp edx, 0x2400
je 0x14000b31e
cmp edx, 0x2500
je 0x14000b315
cmp edx, 0x2600
je 0x14000b30a
cmp edx, 0x2700
je 0x14000b306
cmp edx, 0x2800
jne 0x14000b389
lea r8d, [rdi + 0x6c]
lea rcx, [rbp - 0x25]
xor edx, edx
call fcn.1400ebf40
mov edx, 0x6dbedbdb
mov ecx, 0x94c2fce5
mov r8d, 0xaa62295d
mov dword [rbp - 0x29], 0x70
mov dword [rbp - 0x25], InitCommonControls
mov qword [rbp - 0x21], rbx
call fcn.140001438
mov edx, 0x5e421811
mov qword [rbp - 0x19], rax
lea rax, [rbp + 0x47]
mov ecx, 0xa73e3f37
mov r8d, 0x999eea9d
mov qword [rbp - 0x11], rax
call fcn.140001438
lea rcx, [rbp - 0x29]
mov qword [rbp - 1], rdi
mov dword [rbp + 7], 5
mov qword [rbp + 0xf], rdi
mov qword [rbp - 9], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x14000b389
xor edx, edx
jmp 0x14000b30c
mov dl, 1
mov ecx, eax
call fcn.14000b098
jmp 0x14000b389
mov ecx, eax
call fcn.14000b138
jmp 0x14000b389
movzx edx, cx
call fcn.14000dd24
jmp 0x14000b389
movzx edx, cx
mov rcx, rbx
call fcn.1400154fc
jmp 0x14000b389
movzx edx, cx
mov rcx, rbx
call fcn.140015458
jmp 0x14000b389
mov edx, 0xcfb12067
mov ecx, 0x36cd0771
mov r8d, 0x86dd2ef
call fcn.140001438
lea r8, [rbp + 0x47]
xor r9d, r9d
xor ecx, ecx
mov rdx, rax
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14000b389
lea r8d, [rax + 0x41]
mov edx, 7
mov rcx, rbx
call fcn.14001fb68
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000b96c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x340], rax
mov edi, 0x104
lea rcx, [rbp + 0x130]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edx, 0x64a24a42
mov r8d, 0xbafb2e41
mov ecx, 0x91e1912
call fcn.140001390
lea r9, [0x140129d88]
lea r8, [rbp + 0x130]
lea rcx, [rsp + 0x20]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x20]
call fcn.140022910
test al, al
jne 0x14000ba46
mov rcx, qword [0x140175a98]
lea r8, [rsp + 0x20]
mov r9d, edi
mov edx, InitCommonControls
call fcn.140023b00
test eax, eax
jne 0x14000ba28
movzx edx, word [0x140169e4c]
lea r8, [rsp + 0x20]
lea rcx, [0x140169e4e]
xor edx, 0xbfbf
mov r9d, edi
call fcn.140012e14
lea r8, [0x140129d88]
lea rdx, [rsp + 0x20]
mov r9d, InitCommonControls
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x14000babe
call fcn.140008990
mov ebx, eax
call fcn.140008ac8
test ebx, ebx
je 0x14000bae2
test eax, eax
je 0x14000bae2
lea rdx, [rsp + 0x20]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x20]
mov edx, 0x5c
call fcn.1400e9f08
test rax, rax
je 0x14000bab9
mov edx, 0x23bc0074
mov r8d, 0xe460f2fd
mov ecx, 0xdac02708
call fcn.140001438
lea rcx, [rsp + 0x20]
mov r9d, 1
mov rdx, rax
xor r8d, r8d
call fcn.1400225b8
test eax, eax
jne 0x14000bb87
mov eax, 1
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov rcx, qword [0x140175a98]
lea r8, [rsp + 0x20]
mov r9d, edi
mov edx, InitCommonControls
call fcn.140023b00
test eax, eax
jne 0x14000bb20
movzx edx, word [0x140169ed4]
lea r8, [rsp + 0x20]
lea rcx, [0x140169ed6]
xor edx, 0xbfbf
mov r9d, edi
call fcn.140012e14
lea r8, [0x140129d88]
lea rdx, [rsp + 0x20]
mov r9d, 0x14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x14000bab9
lea rdx, [rsp + 0x20]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x34f6279e
mov r8d, 0xf32ad517
mov ecx, 0xcd8a0094
call fcn.140001438
lea rcx, [rsp + 0x20]
mov r9d, 1
mov rdx, rax
xor r8d, r8d
call fcn.1400225b8
cmp eax, 0x64
jne 0x14000bab9
call fcn.14000b8d0
jmp 0x14000ba42
Function at 0x14000c178
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x340]
sub rsp, 0x440
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x330], rax
mov edx, 0x81d284cf
mov ecx, 0x78aea0bf
mov r8d, 0x460e764d
call fcn.140001438
mov edx, 0x1549f6c1
mov ecx, 0xec35d2cf
mov r8d, 0xd2950440
mov rbx, rax
call fcn.140001438
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
test rax, rax
je 0x14000c28c
mov rcx, qword [0x140175a98]
lea r8, [rsp + 0x30]
mov r9d, 0x100
mov edx, 0x12
call fcn.140023b00
test eax, eax
jne 0x14000c227
movzx edx, word [0x140169ffc]
lea r8, [rsp + 0x30]
lea rcx, [0x140169ffe]
xor edx, 0xbfbf
mov r9d, 0x100
call fcn.140012e14
mov edx, 0x9ea99592
mov ecx, 0x67d5b1c2
mov r8d, 0x59756710
call fcn.140001438
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x130]
mov r8, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [0x140129d88]
lea rdx, [rbp + 0x130]
mov r9d, 0x40034
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x14000c279
xor eax, eax
jmp 0x14000c38d
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
and qword [rsp + 0x20], 0
cmp dword [0x140175ca0], 0
jne 0x14000c2c3
mov edx, 0xf1f602e6
mov ecx, 0x88a26c0
mov r8d, 0x362af060
call fcn.140001438
mov rcx, rax
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x140175ca0], eax
test eax, eax
je 0x14000c2d5
lea rdx, [rsp + 0x20]
lea rcx, [0x14000c0bc]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x14000c388
mov rcx, qword [0x140175a98]
lea r8, [rsp + 0x30]
mov r9d, 0x100
mov edx, 0x12
call fcn.140023b00
test eax, eax
jne 0x14000c327
movzx edx, word [0x140169ffc]
lea r8, [rsp + 0x30]
lea rcx, [0x140169ffe]
xor edx, 0xbfbf
mov r9d, 0x100
call fcn.140012e14
mov edx, 0xab564d
mov ecx, 0xf9d773fd
mov r8d, 0xc777a4c7
call fcn.140001438
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x130]
mov r8, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [0x140129d88]
lea rdx, [rbp + 0x130]
mov r9d, 0x40034
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x14000c272
lea edx, [rax - 4]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
mov rcx, qword [rbp + 0x330]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x450]
add rsp, 0x440
pop rbp
ret
Function at 0x14000c884
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, qword [0x140175ac0]
and dword [rsp + 0x24], 0
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0x10c
mov dword [rsp + 0x20], 0x114
call fcn.1400ebf40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jb 0x14000c8e1
mov rcx, rbx
call fcn.14000c8fc
jmp 0x14000c8e3
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x150
pop rbx
ret

Function at 0x14000d020
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub rsp, 0x268
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdx, qword [0x140175b48]
test cl, cl
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000001
je 0x14000d091
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000d0b8
lea rcx, [rsp + 0x40]
call fcn.14000d868
mov rcx, qword [rsp + 0x30]
lea rdx, [0x140129d88]
add eax, eax
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x14000d0ad
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14000d0b8
mov rcx, qword [rsp + 0x30]
lea rdx, [0x140129d88]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x268
ret

Function at 0x14000d0d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
xor ebx, ebx
lea r9, [r11 - 0x18]
lea eax, [rbx + 4]
xor r8d, r8d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x68], eax
lea rax, [r11 + 0x20]
mov qword [r11 - 0x20], rax
lea rax, [r11 - 0x14]
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000d115
mov eax, dword [rsp + 0x34]
mov bl, 1
mov dword [rdi], eax
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14000d124
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x40
lea eax, [r9 + r9]
xor edi, edi
lea r9, [r11 - 0x18]
mov dword [rsp + 0x68], eax
lea rax, [r11 + 0x20]
lea ebx, [rdi + 1]
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], r8
xor r8d, r8d
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, dil
test eax, eax
cmove ecx, ebx
mov rbx, qword [rsp + 0x50]
mov al, cl
add rsp, 0x40
pop rdi
ret
Function at 0x14000d170
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdx, qword [0x140175b50]
mov rbx, rcx
lea r8, [rbp - 0x18]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000d277
mov rdx, qword [0x140175b58]
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
lea r9, [rbp - 0x20]
xor r8d, r8d
mov dword [rbp - 0x20], 3
mov dword [rbp - 0x1c], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000d1f6
mov eax, dword [rbp - 0x10]
mov dword [rbx + 0x24], eax
mov eax, dword [rbp - 0xc]
mov dword [rbx + 0x28], eax
mov rdx, qword [0x140175b60]
lea rcx, [rbp - 0x1c]
lea rax, [rbx + 0x20]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 0x18]
lea r9, [rbp - 0x20]
xor r8d, r8d
mov dword [rbp - 0x20], 4
mov dword [rbp - 0x1c], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, 0xf11612d5
mov r8d, 0x9f0ead5c
mov ecx, 0x20cd3671
mov dword [rbp - 0x20], 4
mov dword [rbp - 0x1c], 4
add rbx, 0x34
call fcn.1400014e0
mov rcx, qword [rbp - 0x18]
mov rdx, rax
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x14000d59c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, rdx
xor edi, edi
mov word [rdx + 8], di
lea edx, [rdi + 4]
mov rcx, rbx
call fcn.14000d298
test al, al
je 0x14000d62d
mov edx, 0xdc07cc55
mov ecx, 0xddce90b
mov r8d, 0xb21f73d1
call fcn.1400014e0
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
movzx r8d, word [rcx + rax]
sub edx, r8d
jne 0x14000d5f4
add rcx, 2
test r8d, r8d
jne 0x14000d5de
test edx, edx
je 0x14000d62d
mov edx, 0x83c1b4d5
mov ecx, 0x521a919f
mov r8d, 0xedd90b51
call fcn.1400014e0
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
movzx r8d, word [rcx + rax]
sub edx, r8d
jne 0x14000d629
add rcx, 2
test r8d, r8d
jne 0x14000d613
test edx, edx
jne 0x14000d658
mov edx, 0x5ad462b
mov ecx, 0xd476635d
mov r8d, 0x6bb5f9af
call fcn.1400014e0
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000d648
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14000d8c0
test eax, eax
je 0x14000d6ac
mov edx, 0xa47a0830
mov ecx, 0x75a12d52
mov r8d, 0xca62b7ba
call fcn.1400014e0
mov rcx, qword [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000d6bc
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, rdx
xor edi, edi
mov word [rdx + 0xa], di
lea edx, [rdi + 5]
mov rcx, rbx
call fcn.14000d298
test al, al
je 0x14000d718
mov edx, 0x47fc4bb0
mov ecx, 0x96276e2a
mov r8d, 0x29e4f437
call fcn.1400014e0
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
movzx r8d, word [rcx + rax]
sub edx, r8d
jne 0x14000d714
add rcx, 2
test r8d, r8d
jne 0x14000d6fe
test edx, edx
jne 0x14000d743
mov edx, 0x6b92c00c
mov ecx, 0xba49e588
mov r8d, 0x58a7f8b
call fcn.1400014e0
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000d733
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14000d8c0
test eax, eax
je 0x14000d797
mov edx, 0x22d0d24
mov ecx, 0xd3f62892
mov r8d, 0x6c35b2a9
call fcn.1400014e0
mov rcx, qword [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x28], InitCommonControls
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14000d7a4
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, qword [0x140175b50]
mov rbx, rcx
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000d847
mov eax, dword [rbx + 0x24]
mov rdx, qword [0x140175b58]
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 0x28]
mov r9d, 3
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x38]
xor r8d, r8d
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000d81e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [0x140175b60]
mov rcx, qword [rsp + 0x30]
lea rax, [rbx + 0x20]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x50
pop rbx
ret
Function at 0x14000d96c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor esi, esi
xor edx, edx
mov word [rcx], si
lea rcx, [rsp + 0x30]
call fcn.14000d8c0
test eax, eax
je 0x14000d9c9
mov edx, 0xf669b49c
mov ecx, 0x27b29162
mov r8d, 0x98710b17
call fcn.1400014e0
mov rcx, qword [rsp + 0x30]
mov r9d, 0x104
mov rdx, rax
mov r8, rdi
call fcn.14000d124
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rdi], si
jne 0x14000da05
mov rcx, rdi
call fcn.14000dfa8
mov edx, 0xf136f4ea
mov ecx, 0x20edd3f0
mov r8d, 0x9f2e4b6f
mov rbx, rax
call fcn.1400014e0
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], si
jne 0x14000da09
lea rbx, [rdi + rax*2]
mov eax, 0x5c
cmp word [rbx - 2], ax
je 0x14000da2b
mov word [rbx], ax
add rbx, 2
mov word [rbx], si
mov rcx, rdi
call fcn.140022910
test al, al
jne 0x14000da45
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000da58
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rcx, [rsp + 0x58]
xor edx, edx
mov bl, r8b
call fcn.14000d8c0
xor esi, esi
test eax, eax
je 0x14000dad8
test bl, bl
je 0x14000da95
mov edx, 0x30d46eb2
mov ecx, 0xe10f48a2
mov r8d, 0x5eccd13f
jmp 0x14000daa5
mov edx, 0x7ccc2d31
mov ecx, 0xad170b3f
mov r8d, 0x12d492b6
call fcn.1400014e0
mov rcx, qword [rsp + 0x58]
mov r9d, 0x104
mov rdx, rax
mov r8, rdi
call fcn.14000d124
mov rcx, qword [rsp + 0x58]
mov bl, al
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x14000dad8
mov al, 1
jmp 0x14000db9f
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x1a]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14000db37
mov edx, 0x43da73df
mov ecx, 0x920155e7
mov r8d, 0x2dc2cc4e
call fcn.1400014e0
lea rcx, [rdi - 2]
mov r8, rax
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x14000db0f
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x14000db1a
mov rcx, rdi
call fcn.140022910
cmp al, 1
je 0x14000dad1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x23]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14000db9a
mov edx, 0xc2a8557c
mov ecx, 0x13737322
mov r8d, 0xacb0eaed
call fcn.1400014e0
lea rcx, [rdi - 2]
mov r8, rax
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x14000db6e
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x14000db79
mov rcx, rdi
call fcn.140022910
cmp al, 1
je 0x14000dad1
mov word [rdi], si
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret