joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003b234
Capabilities:
Delete registry value
Set registry value

Disassembly:
test rcx, rcx
je 0x10003b2fa
push rbx
sub rsp, 0x30
and qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov ebx, edx
mov rdx, rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003b2f5
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
lea rdx, [0x100020f00]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003b2ea
mov rcx, qword [rsp + 0x40]
lea rdx, [0x100020a20]
test ebx, ebx
je 0x10003b2d9
lea rax, [0x100001db4]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10003b2df
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x10003b304
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x300
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
xor esi, esi
lea rax, [rsp + 0x58]
mov ebx, ecx
lea rdx, [0x10001edf0]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x40], esi
mov edi, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10003b4cc
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea rdx, [0x10001eab8]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10003b4c1
xor edx, edx
jmp 0x10003b47a
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0xe0]
mov r9d, 0x2001f
xor r8d, r8d
inc edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10003b478
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
lea rdx, [0x10001ead0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x44], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x10003b461
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
lea rdx, [0x10001eae8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x44], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x10003b461
lea r9, [rsp + 0xe0]
lea r8, [0x10001eb10]
lea rcx, [rsp + 0x60]
mov edx, 0x3f
call fcn.10002e570
lea rcx, [rsp + 0x60]
mov edx, ebx
call fcn.10003b234
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, edi
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xe0]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rcx, qword [rsp + 0x48]
cmp eax, esi
je 0x10003b3a8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x100020f20]
mov edx, ebx
call fcn.10003b234
lea rcx, [0x100020f38]
mov edx, ebx
call fcn.10003b234
lea rcx, [0x100020f50]
mov edx, ebx
call fcn.10003b234
lea rcx, [0x100020f68]
mov edx, ebx
call fcn.10003b234
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x10003c0f4
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub rsp, 0x58
and qword [rsp + 0x60], 0
call fcn.100037518
xor r8d, r8d
test eax, eax
lea rdx, [0x100021b40]
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x60]
je 0x10003c177
and qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], r8
xor r9d, r9d
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10003c1a9
mov rcx, qword [rsp + 0x60]
lea rax, [0x100001db4]
lea rdx, [0x100021c10]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10003c19e
mov r9d, 3
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003c1a9
mov rcx, qword [rsp + 0x60]
lea rdx, [0x100021c10]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x58
ret
Function at 0x10003ee7c
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x470
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rsi, r9
mov qword [rsp + 0x20], rcx
mov rbp, rdx
lea r9, [0x10001edf0]
lea rcx, [rsp + 0x40]
lea r8, [0x100023060]
xor ebx, ebx
mov edx, 0x103
mov qword [rsp + 0x38], rbx
call fcn.10002e570
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10003f0d2
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100022e48]
mov r13d, 0x208
xor r8d, r8d
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003f007
mov edx, dword [rsp + 0x30]
cmp edx, 1
je 0x10003ef53
cmp edx, 2
jne 0x10003f007
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 5
jbe 0x10003f007
cmp edx, 2
jne 0x10003efb4
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x40]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
je 0x10003f0c7
lea r8, [rsp + 0x250]
lea rcx, [rsp + 0x40]
mov rdx, r13
call fcn.10002e35c
cmp eax, ebx
jl 0x10003f0c7
lea rax, [rsp + 0x40]
cmp rax, rbx
je 0x10003efd8
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x40]
mov r8d, 1
call fcn.100045e8c
jmp 0x10003efdd
mov eax, 0x80004003
cmp eax, ebx
jl 0x10003f007
lea rax, [rsp + 0x250]
cmp rax, rbx
je 0x10003effd
lea rcx, [rsp + 0x250]
call fcn.1000400f0
jmp 0x10003efff
mov eax, ebx
cmp eax, ebx
je 0x10003f0c7
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x1000207e0]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x34], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x10003f042
lea r8, [0x10002307c]
jmp 0x10003f057
cmp dword [rsp + 0x30], 2
je 0x10003f062
cmp dword [rsp + 0x30], 1
je 0x10003f062
lea r8, [0x100023080]
mov rdx, r13
mov rcx, rbp
call fcn.10002e35c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x34], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003f0ae
cmp dword [rsp + 0x30], 1
jne 0x10003f0ae
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jae 0x10003f0c2
lea r8, [0x100001db4]
mov edx, 0x103
mov rcx, rsi
call fcn.10002e2e8
mov ebx, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1000475f0
add rsp, 0x470
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10003fbdc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rsi, rcx
xor ebx, ebx
call fcn.10004048c
mov edx, edi
mov rcx, rsi
cmp eax, 6
jne 0x10003fc28
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
je 0x10003fc4e
lea r8, [0x1000230b8]
mov rdx, rdi
mov rcx, rsi
call fcn.10002e3d4
cmp eax, ebx
jl 0x10003fc4e
mov ebx, 1
jmp 0x10003fc4e
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
cmp eax, ebx
je 0x10003fc4e
lea r8, [0x1000230d8]
mov rdx, rdi
mov rcx, rsi
call fcn.10002e3d4
mov ecx, 1
cmp eax, ebx
cmovge ebx, ecx
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x10003fef4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r8, rcx
xor ebx, ebx
lea rax, [rsp + 0x20]
mov ecx, 0x104
lea rdx, [rsp + 0x20]
sub r8, rax
mov edi, ebx
lea rax, [rcx + 0x7ffffefa]
cmp rax, rbx
je 0x10003ff4b
mov al, byte [r8 + rdx]
cmp al, bl
je 0x10003ff4b
mov byte [rdx], al
inc rdx
sub rcx, 1
jne 0x10003ff2c
cmp rcx, rbx
jne 0x10003ff58
dec rdx
mov edi, 0x8007007a
cmp edi, ebx
mov byte [rdx], bl
jl 0x10003ffc6
or r8, 0xffffffffffffffff
lea rax, [rsp + 0x20]
cmp rax, rbx
je 0x10003ffad
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, r8
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
je 0x10003ffad
lea rdx, [rsp + 0x20]
cmp byte [rdx + rcx - 1], 0x5c
sete al
cmp eax, ebx
je 0x10003ffad
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, r8
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
je 0x10003ffad
mov byte [rdx + rcx - 1], bl
jmp 0x10003ff62
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10003ffc6
test al, 0x10
je 0x10003ffc6
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret
Function at 0x10003fff0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r8, rcx
xor ebx, ebx
lea rax, [rsp + 0x20]
mov ecx, 0x104
lea rdx, [rsp + 0x20]
sub r8, rax
mov edi, ebx
lea rax, [rcx + 0x7ffffefa]
cmp rax, rbx
je 0x10004004b
movzx eax, word [r8 + rdx]
cmp ax, bx
je 0x10004004b
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x100040028
cmp rcx, rbx
jne 0x100040059
sub rdx, 2
mov edi, 0x8007007a
cmp edi, ebx
mov word [rdx], bx
jl 0x1000400c7
or rdx, 0xffffffffffffffff
lea rax, [rsp + 0x20]
cmp rax, rbx
je 0x1000400ae
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
je 0x1000400ae
cmp word [rsp + rcx*2 + 0x1e], 0x5c
sete al
cmp eax, ebx
je 0x1000400ae
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
je 0x1000400ae
mov word [rsp + rcx*2 + 0x1e], bx
jmp 0x100040064
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000400c7
test al, 0x10
je 0x1000400c7
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret

Function at 0x1000400f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10004010a
test al, 0x10
jne 0x10004010a
mov eax, 1
jmp 0x10004010c
xor eax, eax
add rsp, 0x28
ret
Function at 0x100040118
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rbp, rcx
or r8, 0xffffffffffffffff
xor eax, eax
mov rcx, r8
mov rdi, rbp
repne scasw ax, word [rdi]
lea eax, [r8 + 3]
not rcx
lea r13, [rcx + 0x13]
mul r13
cmovo rax, r8
mov rcx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
xor edi, edi
mov rbx, rax
cmp rax, rdi
je 0x100040253
mov r8, rbp
mov rdx, r13
mov rcx, rax
call fcn.10002e2e8
lea rdx, [0x100023178]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
mov rsi, rax
cmp rax, rdi
je 0x10004024b
add rsi, 4
mov r12d, edi
lea rdx, [0x10001f980]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rdi
je 0x100040240
mov rcx, rbx
mov word [rax], di
lea rsi, [rax + 2]
call fcn.10003fff0
cmp eax, edi
jne 0x100040210
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
cmp eax, edi
cmove eax, ecx
mov rcx, rbx
movzx r14d, ax
or r14d, 0x80070000
cmp eax, edi
cmovle r14d, eax
call fcn.10003fff0
mov r8, rbx
cmp eax, edi
je 0x10004022c
xor r9d, r9d
lea edx, [r9 + 5]
lea ecx, [rdx + 3]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov r8, rbp
mov rdx, r13
mov rcx, rbx
call fcn.10002e2e8
inc r12d
cmp r12d, 0xa
jge 0x100040240
jmp 0x100040199
lea rdx, [0x100023180]
mov r9d, r14d
mov ecx, 2
call fcn.10004575c
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
cmp rbp, rdi
je 0x100040262
mov rcx, rbp
call fcn.10003fff0
mov edi, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x100040284
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x1f0
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], 0x80
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1000402d3
xor eax, eax
jmp 0x100040401
mov eax, dword [rsp + 0x48]
mov ebx, dword [rsp + 0x44]
xor r8d, r8d
shl rbx, 0x10
mov r9d, 1
mov rcx, 0xffffffff80000002
or rbx, rax
lea rax, [rsp + 0x38]
shl rbx, 0x20
cmp dword [rsp + 0x50], 2
mov qword [rsp + 0x20], rax
jne 0x10004037d
lea rdx, [0x1000231c0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000403fe
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x160]
lea rdx, [0x100023220]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000403f3
cmp dword [rsp + 0x34], 1
jne 0x1000403f3
lea rcx, [rsp + 0x160]
call qword [sym.imp.msvcrt.dll__wtol]
mov ecx, eax
mov dword [rsp + 0x30], eax
shl rcx, 0x10
add rbx, rcx
jmp 0x1000403f3
lea rdx, [0x100023250]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000403fe
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x160]
lea rdx, [0x1000232a8]
xor r8d, r8d
mov dword [rsp + 0x30], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000403f3
cmp dword [rsp + 0x34], 1
jne 0x1000403f3
lea rax, [rsp + 0x160]
test rax, rax
je 0x1000403f1
lea rcx, [rsp + 0x160]
call fcn.10003fd14
mov rbx, rax
jmp 0x1000403f3
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1000475f0
add rsp, 0x1f0
pop rbx
ret
Function at 0x1000404f0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x380
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov ebp, ecx
lea rcx, [rsp + 0x40]
mov r12d, r9d
mov edi, r8d
mov esi, edx
xor ebx, ebx
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100040557
cmp dword [rsp + 0x50], 2
jne 0x100040555
cmp dword [rsp + 0x44], ebp
je 0x100040585
jbe 0x100040555
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
cmp dword [rsp + 0x48], esi
jne 0x10004054e
test edi, edi
je 0x100040550
and qword [rsp + 0x38], rbx
lea rax, [rsp + 0x38]
mov ebx, 1
lea rdx, [0x1000231c0]
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x34], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004063e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x160]
lea rdx, [0x100023220]
xor r8d, r8d
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100040621
cmp dword [rsp + 0x30], ebx
jne 0x100040621
lea rcx, [rsp + 0x160]
call qword [sym.imp.msvcrt.dll__wtol]
xor ebx, ebx
cmp eax, edi
mov dword [rsp + 0x34], eax
setae bl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x34], edi
ja 0x100040555
test ebx, ebx
je 0x100040555
test r12d, r12d
je 0x100040555
mov edi, 0x104
lea rcx, [rsp + 0x160]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100040555
lea r8, [0x1000232c8]
lea rcx, [rsp + 0x160]
mov rdx, rdi
call fcn.10002e3d4
test eax, eax
js 0x100040555
xor eax, eax
lea rcx, [rsp + 0x160]
mov dword [rsp + 0x30], eax
test rcx, rcx
je 0x1000406b6
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x160]
call fcn.100040be4
mov r11d, eax
mov eax, dword [rsp + 0x30]
jmp 0x1000406bc
mov r11d, 0x80004005
test r11d, r11d
js 0x100040555
xor ebx, ebx
movzx eax, ax
cmp eax, r12d
setae bl
jmp 0x100040555

Function at 0x1000406dc
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
and dword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
lea rdx, [0x1000232e8]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100040749
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, [0x100023320]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x100040a80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, rcx
mov rdi, rdx
mov ebp, 0x104
lea rcx, [rsp + 0x20]
mov edx, ebp
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100040af1
lea r8, [0x100023430]
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.10002e3d4
test eax, eax
js 0x100040af1
lea rax, [rsp + 0x20]
test rax, rax
je 0x100040aed
lea rcx, [rsp + 0x20]
call fcn.1000400f0
mov ebx, eax
test ebx, ebx
jne 0x100040b38
lea rcx, [rsp + 0x20]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100040b52
lea r8, [0x100023448]
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.10002e3d4
test eax, eax
js 0x100040b52
lea rax, [rsp + 0x20]
test rax, rax
je 0x100040b32
lea rcx, [rsp + 0x20]
call fcn.1000400f0
mov ebx, eax
jmp 0x100040b34
xor ebx, ebx
test ebx, ebx
je 0x100040b52
shr rdi, 1
lea r8, [rsp + 0x20]
mov rcx, rsi
mov rdx, rdi
call fcn.10002e2e8
xor ebx, ebx
test eax, eax
setns bl
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret
Function at 0x100040f08
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ebx, 1
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov dword [rsp + 0x34], 0x28
mov dword [rsp + 0x30], ebx
test rdx, rdx
jne 0x100040f4c
mov eax, 0x80070057
jmp 0x100040fe8
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100040fe6
cmp dword [rsp + 0x30], ebx
jne 0x100040f95
lea rdx, [rsp + 0x40]
lea rcx, [0x10001c8c0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor ecx, ecx
test eax, eax
sete cl
mov dword [rdi], ecx
jmp 0x100040fe4
cmp dword [rsp + 0x30], 4
jne 0x100040fe6
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100040fe6
cmp dword [rsp + 0x30], 4
jne 0x100040fe6
cmp dword [rsp + 0x38], ebx
sete al
mov dword [rdi], eax
xor ebx, ebx
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000416a0
Capabilities:
Copy file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xe
jae 0x100041710
and qword [rsp + 0x20], 0
and qword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call fcn.10003fb74
test eax, eax
je 0x100041700
xor edx, edx
mov rcx, rdi
call qword [rsp + 0x20]
test eax, eax
jne 0x100041700
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100023740]
mov r8, rbx
mov r9d, eax
mov ecx, 2
call fcn.10004575c
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x100041710
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xe
jae 0x100041784
and qword [rsp + 0x20], 0
and qword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call fcn.10003fb74
test eax, eax
je 0x100041774
xor edx, edx
mov rcx, rbx
call qword [rsp + 0x20]
test eax, eax
jne 0x100041774
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100023740]
mov r8, rbx
mov r9d, eax
mov ecx, 2
call fcn.10004575c
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x100041784
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret