joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008b530
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x660
mov rbx, rdx
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x400
call fcn.1400ba240
mov r8d, 0x400
lea rdx, [rsp + 0x260]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rsi, 0xffffffffffffffff
lea rcx, [rsp + 0x260]
mov rax, rsi
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14008b582
lea rax, [rsp + rax*2 + 0x25e]
lea rcx, [rsp + 0x260]
cmp rax, rcx
jb 0x14008b5c3
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14008b5c3
cmp cx, 0x2f
je 0x14008b5c3
sub rax, 2
lea rcx, [rsp + 0x260]
cmp rax, rcx
jae 0x14008b5a3
add rax, 2
mov rdx, rax
sub rdx, rbx
nop dword [rax]
movzx ecx, word [rbx]
mov word [rdx + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x14008b5d0
mov rcx, rsi
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14008b5e3
movsd xmm0, qword [0x14014c770]
xor r15d, r15d
movsxd rcx, ecx
lea rdx, [rax + rcx*2]
mov byte [rsp + 0x250], 1
movsd qword [rdx], xmm0
mov ecx, r15d
movzx eax, word [0x14014c778]
mov word [rdx + 8], ax
nop dword [rax]
movzx eax, word [rsp + rcx + 0x260]
mov word [rsp + rcx + 0x48], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14008b620
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rcx, [rsp + 0x260]
mov edx, 0x80000000
mov qword [rsp + 0x690], rbp
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, rsi
je 0x14008b732
lea rdx, [rsp + 0x698]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov rbx, r15
mov eax, 2
cmovne rbx, qword [rsp + 0x698]
shr rbx, 1
movsxd rbp, ebx
lea rcx, [rbp + 1]
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400b609c
add ebx, ebx
mov dword [rsp + 0x698], r15d
mov r8d, ebx
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x698]
mov rdx, rax
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14008b732
cmp dword [rsp + 0x698], ebx
jne 0x14008b732
mov word [rsi + rbp*2], r15w
cmp byte [rsp + 0x250], r15b
je 0x14008b704
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r14]
lea r8, [rsp + 0x6a0]
mov rdx, rsi
mov qword [rsp + 0x6a0], r15
mov rcx, r14
call qword [rax + 0x28]
mov rcx, rsi
call fcn.1400b60a4
mov rax, qword [rsp + 0x6a0]
jmp 0x14008b74e
cmp rdi, 0xffffffffffffffff
je 0x14008b74b
cmp byte [rsp + 0x250], r15b
je 0x14008b74b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, r15
mov rbp, qword [rsp + 0x690]
add rsp, 0x660
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14008d310
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov eax, dword [rsp + 0xb0]
mov rsi, rcx
mov dword [rsp + 0x20], eax
call fcn.140022440
mov rcx, qword [rsi + 0x70]
lea rax, vtable.wv_Reader.0
xor ebx, ebx
mov qword [rsi], rax
lea rdx, [rsp + 0x90]
mov dword [rsi + 0x2c8], 0x80040200
mov qword [rsi + 0x2d0], rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edx, ebx
lea rcx, [rsi + 0x70]
test eax, eax
mov r8, rsi
cmovne rdx, qword [rsp + 0x90]
call fcn.14004faf0
mov rcx, qword [rsi + 0x70]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
lea r8, str.WavpackOpenFileInputEx64
lea rdx, [0x1401a9140]
lea rcx, str.wavpackdll.dll
call fcn.140028a70
test al, al
jne 0x14008d3b9
mov dword [rsi + 0x2c8], 0x80040210
jmp 0x14008d411
xorps xmm0, xmm0
mov dword [rsp + 0x28], ebx
lea r9, [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
xor r8d, r8d
movaps xmmword [rsp + 0x40], xmm0
mov rdx, rsi
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [0x140191220]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x20], socket
call qword [0x1401a9140]
test rax, rax
mov qword [rsi + 0x2d0], rax
mov ecx, 0x80040208
cmove ebx, ecx
mov dword [rsi + 0x2c8], ebx
lea r11, [rsp + 0x80]
mov rax, rsi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14008df90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x2b0], 0
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
jne 0x14008dfed
mov rcx, qword [rcx + 0x38]
lea r8, [rsp + 0x40]
mov r9d, 1
mov qword [rsp + 0x40], 0
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, 0xffffffffffffffff
mov dword [rdi + 0x2b0], esi
test eax, eax
cmovne rcx, qword [rsp + 0x40]
mov qword [rdi + 0x2a8], rcx
mov rcx, qword [rdi + 0x38]
lea r9, [rsp + 0x40]
mov r8d, esi
mov dword [rsp + 0x40], 0
mov rdx, rbp
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14008e02f
cmp dword [rsp + 0x40], esi
jne 0x14008e02f
mov al, 1
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbp, qword [rsp + 0x48]
xor al, al
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14008e7f0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r9d, 0xffffffff
lea r8, [0x14014a4f8]
mov rdi, rcx
add rcx, 0x58
lea edx, [r9 + 3]
call fcn.140025fb0
mov rcx, qword [rdi + 0x70]
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rdi + 0x2ac], 4
mov qword [rdi + 0x290], rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov dword [rdi + 0x20], 1
mov dword [rdi + 0x28], 0x1f40
cmovne rbx, qword [rsp + 0x30]
add rbx, rbx
mov qword [rdi + 0x18], rbx
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14008e960
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x2c8
call fcn.140049960
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140024a80

Function at 0x1400929b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x630
cmp qword [rcx + 0x70], 0
mov rdi, rdx
mov rbx, rcx
je 0x140092a69
mov qword [rsp + 0x640], rsi
xor esi, esi
mov word [rsp + 0x230], si
mov word [rsp + 0x30], si
test rdx, rdx
je 0x140092a44
cmp word [rdx], si
je 0x140092a44
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140092a44
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 4
and ecx, 1
cmp eax, 0xffffffff
cmove ecx, esi
test cl, cl
jne 0x140092a44
mov rax, qword [rbx]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x28], 0x100
lea r8, [rsp + 0x230]
mov qword [rsp + 0x20], rcx
mov r9d, 0x200
mov rcx, rbx
mov rdx, rdi
call qword [rax + 0x38]
lea rdx, [rsp + 0x230]
mov rcx, rbx
call fcn.140092eb0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140092ed0
mov rsi, qword [rsp + 0x640]
mov rbx, qword [rsp + 0x648]
add rsp, 0x630
pop rdi
ret
Function at 0x140092fc0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x360
mov rsi, r8
mov rdi, rcx
mov r9, 0xffffffffffffffff
nop
inc r9
cmp word [rdx + r9*2], 0
jne 0x140092fe0
test r9d, r9d
je 0x14009302e
lea rcx, [rsp + 0x150]
sub rcx, rdx
nop dword [rax + rax]
movzx eax, word [rdx]
mov word [rcx + rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140093000
movsxd rax, r9d
cmp word [rsp + rax*2 + 0x14e], 0x5c
je 0x14009302e
mov ecx, 0x5c
inc r9d
mov word [rsp + rax*2 + 0x150], cx
movsxd rax, r9d
lea rcx, [rsp + 0x150]
lea rdx, str._s_log.txt
lea rcx, [rcx + rax*2]
call fcn.140010090
xor ebx, ebx
lea rcx, [rsp + 0x150]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0xc0000000
mov dword [rsp + 0x20], 4
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
je 0x140093197
lea rdx, [rsp + 0x370]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
cmovne ebx, dword [rsp + 0x370]
test ebx, ebx
jne 0x1400930f5
lea r9d, [rbx - 1]
mov r8d, 0x100
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.14008f180
lea rcx, [rsp + 0x50]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400930c5
movsd xmm0, qword [str._log_file]
lea rdx, [rsp + 0x50]
movzx eax, word [0x14014d588]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
mov rcx, qword [rdi]
call fcn.140097190
jmp 0x140093113
mov rcx, qword [rdi]
lea r8, [rsp + 0x370]
mov edx, ebx
xor r9d, r9d
mov qword [rsp + 0x370], rdx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rdi]
lea rdx, [0x14012cbe9]
call fcn.140097190
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r10d, word [rsp + 0x4a]
lea r11, [0x140191330]
movzx ecx, word [rsp + 0x40]
mov eax, 0xcccccccd
movzx r9d, word [rsp + 0x42]
movzx r8d, word [rsp + 0x46]
mul r10d
mov r9, qword [r11 + r9*8 - 8]
shr edx, 3
lea eax, [rdx + rdx*4]
add eax, eax
sub r10d, eax
movzx eax, word [rsp + 0x48]
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], edx
lea rdx, str.____d__s__d___d:_d_d___
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x50]
call fcn.1400100f0
mov rcx, qword [rdi]
lea rdx, [rsp + 0x50]
call fcn.140097190
lea r11, [rsp + 0x360]
mov rax, rdi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400931d0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x140093216
test rdx, rdx
je 0x140093216
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400931f0
test eax, eax
je 0x140093216
lea r9, [0x1401a9400]
mov qword [rsp + 0x20], 0
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x38
ret

Function at 0x140093220
Capabilities:
Write file on windows

Disassembly:
mov rcx, qword [rcx]
mov rax, rdx
cmp rcx, 0xffffffffffffffff
je 0x14009323f
test rax, rax
lea rdx, [0x14012cbe9]
cmovne rdx, rax
jmp fcn.140097190
ret
Function at 0x140093c70
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x30
mov r8, qword [rcx + 0x220]
mov rbx, rcx
mov edx, dword [rcx + 0x10]
mov r9d, 0x104
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
mov rax, qword [rbx + 0x220]
sub rax, 2
nop
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140093ca0
mov r8, qword [rbx + 0x230]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x140093cc0
lea rcx, [rbx + 0x14]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [rbx + 0x10]
xor r9d, r9d
mov rcx, qword [rbx + 8]
mov r8d, 0x147
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
test eax, eax
js 0x140093d1e
mov edx, dword [rbx + 0x10]
mov r8d, 0x144
mov rcx, qword [rbx + 8]
movsxd r9, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov edx, dword [rbx + 0x10]
lea r8, [0x14012c34c]
mov rcx, qword [rbx + 8]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.USER32.dll_SetDlgItemTextW]

Function at 0x140093d40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rdi, [rcx + 0x14]
mov qword [rcx + 8], rdx
mov rbx, rcx
mov dword [rcx + 0x10], r8d
mov rdx, rdi
mov ecx, 1
call fcn.1400979b0
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x220], rdi
mov rax, r8
nop dword [rax]
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140093d80
lea rax, [rdi + rax*2]
mov esi, 0x5c
mov qword [rbx + 0x220], rax
mov word [rax], si
add qword [rbx + 0x220], 2
mov rdx, qword [rbx + 0x220]
mov rcx, qword [rbx + 0x228]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140093dc0
mov rax, qword [rbx + 0x220]
nop word [rax + rax]
cmp word [rax + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x140093de0
lea rax, [rax + r8*2]
mov rcx, rdi
mov qword [rbx + 0x220], rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140093e11
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, qword [rbx + 0x220]
mov word [rax], si
add qword [rbx + 0x220], 2
mov rax, qword [rbx + 0x220]
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov word [rax], cx
add rsp, 0x20
pop rdi
ret
Function at 0x140094000
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x280
mov edx, dword [rcx + 0x10]
mov rbp, rcx
mov rcx, qword [rcx + 8]
xor r14d, r14d
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov r8d, 0x14b
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov rax, qword [rbp + 0x220]
mov ecx, 0x2a
mov word [rax], cx
mov rcx, qword [rbp + 0x220]
mov rdx, qword [rbp + 0x230]
add rcx, 2
nop word [rax + rax]
movzx eax, word [rdx]
lea rdx, [rdx + 2]
mov word [rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140094060
lea rcx, [rbp + 0x14]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14009412f
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], rdi
nop
lea rax, [rsp + 0x5c]
mov rcx, 0xffffffffffffffff
nop dword [rax]
cmp word [rax + rcx*2 + 2], r14w
lea rcx, [rcx + 1]
jne 0x1400940b0
mov rdi, qword [rbp + 8]
lea rax, [rsp + 0x5c]
mov ebx, dword [rbp + 0x10]
xor r9d, r9d
mov word [rsp + rcx*2 + 0x54], r14w
mov r8d, 0x143
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov edx, ebx
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
test eax, eax
js 0x140094104
movsxd r9, eax
mov r8d, 0x151
mov edx, ebx
mov qword [rsp + 0x20], r14
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400940a0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x290]
lea r11, [rsp + 0x280]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140095150
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x30
mov rdi, r8
mov ebx, r9d
mov r8, qword [rsp + 0x60]
mov rbp, rdx
mov rsi, rcx
test r8, r8
jne 0x14009518e
mov r8d, ebx
xor edx, edx
mov rcx, rdi
call fcn.1400ba240
jmp 0x1400951b3
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x60]
test eax, eax
cmove eax, ebx
cmp ebx, 4
cmova rdx, r8
cmp rdi, rdx
je 0x1400951b3
movsxd r8, eax
mov rcx, rdi
call fcn.1400b9e30
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400951e7
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
mov rdx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1400951e3
xor eax, eax
jmp 0x1400951e9
mov ebx, dword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140095200
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r15, rcx
mov r14d, r9d
mov rcx, 0xffffffffffffffff
mov rbp, r8
mov rax, rcx
mov rbx, rdx
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x140095230
inc eax
movsxd rsi, eax
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.1400b609c
mov rdi, rax
test rax, rax
je 0x1400952d3
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140101718
mov rdx, qword [rsp + 0x80]
lea rcx, [0x14012c34c]
test rdx, rdx
cmovne rcx, rdx
mov rdx, rbp
sub rdx, rcx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140095290
mov rcx, qword [r15]
lea eax, [r14 + r14]
mov dword [rsp + 0x30], eax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rdi
call fcn.1400b60a4
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x1400952f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
mov rbx, rdx
mov rcx, 0xffffffffffffffff
mov rax, rcx
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140095310
inc eax
movsxd rsi, eax
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.1400b609c
mov rdi, rax
test rax, rax
jne 0x140095348
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.140101718
mov rcx, qword [r14]
xor edx, edx
mov dword [rsp + 0x60], edx
test rcx, rcx
je 0x140095384
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rdi
call fcn.1400b60a4
mov eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
shr eax, 1
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400953a0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400953c5
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov r9d, r8d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x38
ret

Function at 0x1400953d0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
cmp qword [rcx], 0
mov rsi, r8
mov rdi, rdx
mov r14, rcx
je 0x140095488
mov qword [rsp + 0x50], rbx
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x58], rbp
mov rax, rbx
mov qword [rsp + 0x60], r15
inc rax
cmp byte [rdx + rax], 0
jne 0x140095405
inc eax
movsxd r15, eax
mov eax, 2
mul r15
cmovo rax, rbx
mov rcx, rax
call fcn.1400b609c
mov rbp, rax
test rax, rax
je 0x140095479
mov r8, r15
mov rdx, rdi
mov rcx, rax
call fcn.140101718
nop dword [rax]
cmp word [rsi + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x140095440
mov rcx, qword [r14]
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbp
call fcn.1400b60a4
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x140097190
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400971a0
lea r9, [0x1401a9400]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [0x1401a9400]
mov qword [rsp + 0x20], 0
mov r8d, 2
lea rdx, [0x14014d880]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140097490
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [0x1401a9418]
mov rdi, rcx
test r9, r9
je 0x1400974c8
test rcx, rcx
je 0x1400975ad
mov eax, dword [0x1401a9420]
mov dword [rcx], eax
mov rax, r9
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8, 0xffffffffffffffff
mov rbx, rax
mov rcx, r8
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400974e0
add rcx, 2
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400b609c
mov qword [0x1401a9418], rax
mov r9, rax
test rax, rax
jne 0x14009752e
test rdi, rdi
je 0x14009751c
xor r10d, r10d
mov dword [rdi], r10d
lea rax, [0x14014d8ac]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8d, dword [0x1401a9420]
xor dl, dl
xor r10d, r10d
nop word [rax + rax]
movzx ecx, word [rbx]
lea rbx, [rbx + 2]
test cx, cx
je 0x14009756d
cmp cx, 0x20
jne 0x14009755f
test dl, dl
je 0x14009756d
mov word [rax], cx
add rax, 2
jmp 0x140097540
cmp cx, 0x22
jne 0x140097556
test dl, dl
jne 0x14009756d
mov dl, 1
jmp 0x140097540
cmp rax, r9
jbe 0x140097584
cmp word [rax - 2], r10w
je 0x140097584
mov word [rax], r10w
add rax, 2
inc r8d
test cx, cx
je 0x14009758d
xor dl, dl
jmp 0x140097540
mov dword [0x1401a9420], r8d
cmp rax, r9
jne 0x1400975a1
mov word [rax], r10w
add rax, 2
mov word [rax], r10w
test rdi, rdi
je 0x1400975ad
mov dword [rdi], r8d
mov rbx, qword [rsp + 0x30]
mov rax, r9
add rsp, 0x20
pop rdi
ret

Function at 0x1400979b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, ecx
mov rdi, rdx
cmp ecx, 0xf
jae 0x140097a96
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
lea rcx, [0x14014d908]
mov qword [rsp + 0x20], rdx
mov edx, dword [rcx + rbx*4]
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jns 0x140097a41
sub ebx, 2
je 0x140097a23
cmp ebx, 1
jne 0x140097a96
mov edx, 0x100
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
setne al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov edx, 0x100
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
setne al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], 0
test eax, eax
setne bl
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x140097a88
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rcx]
call qword [r8 + 0x28]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
call qword [rdx + reloc.WSOCK32.dll_recv]
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret