joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473620
Capabilities:
Set registry value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rbp, rsp
mov rbx, rdx
mov rsi, r8
mov rdi, r9
call fcn.0040c470
mov rcx, rdi
mov rdx, rax
xor r8, r8
lea r9, [0x004736f8]
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x30], 0
lea rax, [rbp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x54]
mov qword [rsp + 0x40], rax
call sub.advapi32.dll_RegCreateKeyExW
mov edi, eax
test edi, edi
jne 0x4736cc
xor rdi, rdi
test rsi, rsi
je 0x47368a
mov edi, dword [rsi - 4]
mov rcx, rbx
call fcn.0040c470
mov rbx, rax
mov rcx, rsi
call fcn.0040c470
mov rcx, qword [rbp + 0x58]
mov rdx, rbx
xor r8, r8
mov r9d, 1
mov qword [rsp + 0x20], rax
add edi, 1
add edi, edi
mov dword [rsp + 0x28], edi
call sub.advapi32.dll_RegSetValueExW
mov edi, eax
mov rcx, qword [rbp + 0x58]
call sub.advapi32.dll_RegCloseKey_1
test edi, edi
je 0x4736ed
mov rcx, qword [0x00470628]
mov dl, 1
mov r8, qword [0x00545a40]
call fcn.00430700
mov rcx, rax
call fcn.00409b10
lea rsp, [rbp + 0x68]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x473700
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.0040c470
mov rcx, rbx
mov rdx, rax
call sub.advapi32.dll_RegDeleteKeyW
add rsp, 0x20
pop rbx
ret

Function at 0x473720
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rdx
mov qword [rbp + 0x80], r8
mov qword [rbp + 0x88], r9
mov rcx, qword [rbp + 0x70]
call fcn.0040aa40
mov rcx, qword [rbp + 0x78]
call fcn.0040c470
mov rcx, qword [rbp + 0x88]
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x47380d
nop
mov dword [rbp + 0x44], pe_nt_image_headers64
mov rcx, qword [rbp + 0x70]
mov edx, dword [rbp + 0x44]
call fcn.0040c6e0
mov eax, dword [rbp + 0x44]
add eax, eax
mov dword [rbp + 0x44], eax
mov rcx, qword [rbp + 0x80]
call fcn.0040c470
mov rbx, rax
mov rax, qword [rbp + 0x70]
mov rcx, qword [rax]
call fcn.0040c470
mov rcx, qword [rbp + 0x48]
mov rdx, rbx
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x44]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4737fa
mov rcx, qword [rbp + 0x70]
mov r8d, 2
mov eax, dword [rbp + 0x44]
xor edx, edx
div r8d
mov rdx, rax
sub edx, 1
call fcn.0040c6e0
jmp 0x473803
mov rcx, qword [rbp + 0x70]
call fcn.0040aa40
nop
mov rcx, qword [rbp + 0x48]
call sub.advapi32.dll_RegCloseKey_1
mov rax, qword [rbp + 0x70]
lea rsp, [rbp + 0x58]
pop rbx
pop rbp
ret
Function at 0x47eb60
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
xor rbx, rbx
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x47eb7b
or ebx, 4
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x47eb8e
or ebx, 8
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x47eba1
or ebx, 0x20
mov ecx, 0x5b
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x47ebb4
or ebx, 0x40
mov ecx, 0x5c
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x47ebc7
or ebx, 0x40
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x486180
Capabilities:
Capture screenshot

Disassembly:
push rbp
sub rsp, 0xe0
mov rbp, rsp
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0xf0], rcx
mov qword [rbp + 0xf8], rdx
nop
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax + 0x61b]
lea rdx, [rbp + 0x60]
call sub.user32.dll_GetClientRect
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xd0], 0
mov rax, qword [rbp + 0xf8]
mov qword [rbp + 0xb8], rax
cmp qword [rbp + 0xb8], 0
jne 0x48620e
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax + 0x61b]
lea rdx, [rbp + 0x70]
call sub.user32.dll_BeginPaint
mov qword [rbp + 0xb8], rax
jmp 0x48622d
mov rcx, qword [rbp + 0xf8]
call sub.user32.dll_WindowFromDC
test rax, rax
jne 0x48622d
mov rax, qword [rbp + 0xf8]
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0
jne 0x4862ab
mov rax, qword [rbp + 0xf0]
cmp qword [rax + 0x189], 0
jne 0x4862ab
xor rcx, rcx
call sub.user32.dll_GetDC
mov qword [rbp + 0xc0], rax
mov rcx, qword [rbp + 0xc0]
mov edx, dword [rbp + 0x68]
mov r8d, dword [rbp + 0x6c]
call sub.gdi32.dll_CreateCompatibleBitmap
mov qword [rbp + 0xd8], rax
xor rcx, rcx
mov rdx, qword [rbp + 0xc0]
call sub.user32.dll_ReleaseDC
xor rcx, rcx
call sub.gdi32.dll_CreateCompatibleDC
mov qword [rbp + 0xd0], rax
mov rcx, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0xd8]
call sub.gdi32.dll_SelectObject
mov qword [rbp + 0xc8], rax
jmp 0x4862d1
mov rax, qword [rbp + 0xf0]
cmp qword [rax + 0x189], 0
je 0x4862d1
mov rax, qword [rbp + 0xf0]
mov rax, qword [rax + 0x189]
mov qword [rbp + 0xd0], rax
nop
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rbp + 0xd0]
mov qword [rax + 0x189], rcx
mov rcx, qword [rbp + 0xf0]
mov edx, 0x14
mov r8, qword [rbp + 0xd0]
mov r9, qword [rbp + 0xd0]
call fcn.0048a0a0
cmp qword [0x00550760], 0
je 0x486325
mov rcx, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0xf0]
call qword [0x00550760]
mov rcx, qword [rbp + 0xf0]
mov edx, 0xf
mov r8, qword [rbp + 0xd0]
xor r9, r9
call fcn.0048a0a0
mov rax, qword [rbp + 0xf0]
cmp qword [rax + 0x677], 0
je 0x486368
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax + 0x677]
xor rdx, rdx
call fcn.0047fc40
mov rcx, qword [rbp + 0xb8]
xor rdx, rdx
call sub.gdi32.dll_SelectClipRgn
mov rax, qword [rbp + 0xb8]
cmp rax, qword [rbp + 0xd0]
je 0x4863c8
mov rcx, qword [rbp + 0xb8]
xor rdx, rdx
xor r8, r8
mov r9d, dword [rbp + 0x68]
mov eax, dword [rbp + 0x6c]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0xd0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0xcc0020
call sub.gdi32.dll_BitBlt
cmp qword [rbp + 0xf8], 0
jne 0x4863e9
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax + 0x61b]
lea rdx, [rbp + 0x70]
call sub.user32.dll_EndPaint
nop
cmp qword [rbp + 0xd8], 0
je 0x486433
mov rcx, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0xc8]
call sub.gdi32.dll_SelectObject
mov rcx, qword [rbp + 0xd0]
call sub.gdi32.dll_DeleteDC
mov rcx, qword [rbp + 0xd8]
call sub.gdi32.dll_DeleteObject
mov rax, qword [rbp + 0xf0]
mov qword [rax + 0x189], 0
jmp 0x48645f
mov rax, qword [rbp + 0xd0]
cmp rax, qword [rbp + 0xf8]
jne 0x48645f
mov rax, qword [rbp + 0xf0]
mov qword [rax + 0x189], 0
jmp 0x48645f
lea rsp, [rbp + 0xe0]
pop rbp
ret
Function at 0x487430
Capabilities:
Get graphical window text

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
cmp qword [rbx + 0x61b], 0
je 0x4874a8
cmp byte [rbx + 0x661], 0
jne 0x4874a8
mov rcx, qword [rbx + 0x61b]
call sub.user32.dll_GetWindowTextLengthW
test eax, eax
jne 0x487467
xor rdi, rdi
jmp 0x48748e
mov r13d, eax
add r13d, 1
add r13d, r13d
movsxd rcx, r13d
call fcn.00405990
mov rdi, rax
mov rcx, qword [rbx + 0x61b]
mov rdx, rdi
mov r8d, r13d
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
mov rdx, rdi
call fcn.0040c4f0
test rdi, rdi
je 0x4874b7
mov rcx, rdi
call fcn.004059c0
jmp 0x4874b7
mov rcx, rsi
mov rdx, qword [rbx + 0x649]
call fcn.0040c4f0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x48e5e0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x148
mov dword [rsp + 0x24], 0x11c
lea rcx, [rsp + 0x24]
call sub.kernel32.dll_GetVersionExW
cmp dword [rsp + 0x34], 2
jne 0x48e621
mov al, 4
cmp dword [rsp + 0x28], 6
jne 0x48e60d
mov al, 7
jmp 0x48e65d
cmp dword [rsp + 0x28], 5
jb 0x48e65d
mov al, 5
cmp dword [rsp + 0x2c], 1
jb 0x48e65d
mov al, 6
jmp 0x48e65d
cmp dword [rsp + 0x34], 1
jne 0x48e65a
mov al, 1
cmp dword [rsp + 0x28], 4
ja 0x48e63f
cmp dword [rsp + 0x28], 4
jne 0x48e641
cmp dword [rsp + 0x2c], 0xa
jb 0x48e641
mov al, 2
cmp dword [rsp + 0x28], 4
ja 0x48e656
cmp dword [rsp + 0x28], 4
jne 0x48e65d
cmp dword [rsp + 0x2c], 0x5a
jb 0x48e65d
mov al, 3
jmp 0x48e65d
xor rax, rax
add rsp, 0x148
ret
Function at 0x497080
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x40], rcx
mov rax, qword [rbp + 0x40]
mov byte [rax + 0x10], 0
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 8]
call fcn.0040c470
mov rcx, rax
mov rdx, qword [rbp + 0x40]
add rdx, 0x20
call sub.version.dll_GetFileVersionInfoSizeW
mov rcx, qword [rbp + 0x40]
mov dword [rcx + 0x14], eax
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0x14], 0
jbe 0x49713c
nop
mov rax, qword [rbp + 0x40]
mov ecx, dword [rax + 0x14]
call fcn.00405990
mov rcx, qword [rbp + 0x40]
mov qword [rcx + 0x18], rax
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x18]
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 0x14]
xor r8, r8
call fcn.00406e20
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 8]
call fcn.0040c470
mov rcx, rax
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 0x20]
mov rax, qword [rbp + 0x40]
mov r8d, dword [rax + 0x14]
mov rax, qword [rbp + 0x40]
mov r9, qword [rax + 0x18]
call sub.version.dll_GetFileVersionInfoW
mov rcx, qword [rbp + 0x40]
test eax, eax
setne al
mov byte [rcx + 0x10], al
jmp 0x49713c
lea rsp, [rbp + 0x30]
pop rbp
ret
Function at 0x49fd70
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x58], rcx
mov dword [rbp + 0x50], r9d
mov qword [rbp + 0x98], rdx
mov qword [rbp + 0xa0], r8
mov rcx, qword [rbp + 0x98]
call fcn.0040abd0
mov rcx, qword [rbp + 0xa0]
call fcn.0040abd0
nop
xor rax, rax
mov byte [rbp + 0x57], al
xor rbx, rbx
mov rax, qword [0x00545838]
cmp byte [rax], 0
je 0x49fde7
call fcn.00410ec0
cmp byte [rax + 0x1b9], 0
je 0x49fdd3
mov ebx, pe_nt_image_headers64
jmp 0x49fde7
call fcn.00410ec0
cmp byte [rax + 0x1b8], 0
je 0x49fde7
mov ebx, 0x200
nop
mov rcx, qword [rbp + 0x98]
call fcn.0040c470
mov rcx, qword [rbp + 0x58]
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
or ebx, 0x20006
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x30], 0
lea rax, [rbp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x6c]
mov qword [rsp + 0x40], rax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
mov ecx, ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x49fed2
cmp qword [rbp + 0xa0], 0
jne 0x49fe83
mov rcx, qword [rbp + 0x60]
xor rdx, rdx
xor r8, r8
mov r9d, dword [rbp + 0x50]
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov eax, dword [rbp + 0xb8]
mov dword [rsp + 0x28], eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete al
mov byte [rbp + 0x57], al
jmp 0x49fec2
mov rcx, qword [rbp + 0xa0]
call fcn.0040c470
mov rcx, qword [rbp + 0x60]
mov rdx, rax
xor r8, r8
mov r9d, dword [rbp + 0x50]
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov eax, dword [rbp + 0xb8]
mov dword [rsp + 0x28], eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete al
mov byte [rbp + 0x57], al
mov ecx, ebx
call sub.kernel32.dll_SetLastError
mov rcx, qword [rbp + 0x60]
call sub.advapi32.dll_RegCloseKey_1
nop
lea rcx, [rbp + 0x98]
mov edx, 2
call fcn.0040ab20
movzx rax, byte [rbp + 0x57]
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x49ff30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x34], r9d
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.0040abd0
mov rcx, qword [rbp + 0x90]
call fcn.0040abd0
nop
xor rax, rax
mov byte [rbp + 0x33], al
mov rax, qword [rbp + 0xa0]
mov qword [rax], 0
mov rax, qword [rbp + 0xa8]
mov dword [rax], 0
xor rbx, rbx
mov rax, qword [0x00545838]
cmp byte [rax], 0
je 0x49ffc3
call fcn.00410ec0
cmp byte [rax + 0x1b9], 0
je 0x49ffaf
mov ebx, pe_nt_image_headers64
jmp 0x49ffc3
call fcn.00410ec0
cmp byte [rax + 0x1b8], 0
je 0x49ffc3
mov ebx, 0x200
nop
mov rcx, qword [rbp + 0x88]
call fcn.0040c470
mov rcx, qword [rbp + 0x38]
mov rdx, rax
xor r8, r8
mov r9d, ebx
or r9d, 0x20019
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a00b1
cmp qword [rbp + 0x90], 0
jne 0x4a0009
xor rsi, rsi
jmp 0x4a0018
mov rcx, qword [rbp + 0x90]
call fcn.0040c470
mov rsi, rax
mov rcx, qword [rbp + 0x50]
mov rdx, rsi
xor r8, r8
lea r9, [rbp + 0x5c]
mov qword [rsp + 0x20], 0
lea rax, [rbp + 0x4c]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4a00a8
mov ecx, dword [rbp + 0x4c]
call fcn.00405990
mov rbx, rax
mov rcx, qword [rbp + 0x50]
mov rdx, rsi
xor r8, r8
lea r9, [rbp + 0x5c]
mov qword [rsp + 0x20], rbx
lea rax, [rbp + 0x4c]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4a00a0
mov eax, dword [rbp + 0x34]
cmp eax, dword [rbp + 0x5c]
jne 0x4a0096
mov rax, qword [rbp + 0xa0]
mov qword [rax], rbx
mov rax, qword [rbp + 0xa8]
mov ecx, dword [rbp + 0x4c]
mov dword [rax], ecx
mov al, 1
mov byte [rbp + 0x33], al
jmp 0x4a00a8
mov rcx, rbx
call fcn.004059c0
jmp 0x4a00a8
mov rcx, rbx
call fcn.004059c0
mov rcx, qword [rbp + 0x50]
call sub.advapi32.dll_RegCloseKey_1
nop
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.0040ab20
movzx rax, byte [rbp + 0x33]
lea rsp, [rbp + 0x60]
pop rbx
pop rsi
pop rbp
ret

Function at 0x4a0590
Capabilities:
Delete registry value

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
xor rax, rax
mov byte [rbp + 0x3f], al
xor r13, r13
mov rax, qword [0x00545838]
cmp byte [rax], 0
je 0x4a05e7
call fcn.00410ec0
cmp byte [rax + 0x1b9], 0
je 0x4a05d2
mov r13d, pe_nt_image_headers64
jmp 0x4a05e7
call fcn.00410ec0
cmp byte [rax + 0x1b8], 0
je 0x4a05e7
mov r13d, 0x200
nop
mov rcx, rsi
call fcn.0040c470
mov rcx, rbx
mov rdx, rax
xor r8, r8
mov r9d, r13d
or r9d, 0x20006
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
mov ecx, ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x4a0643
mov rcx, rdi
call fcn.0040c470
mov rcx, qword [rbp + 0x48]
mov rdx, rax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete al
mov byte [rbp + 0x3f], al
mov rcx, qword [rbp + 0x48]
call sub.advapi32.dll_RegCloseKey_1
movzx rax, byte [rbp + 0x3f]
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x4a0660
Capabilities:
Delete registry key

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rdx
mov rax, qword [0x00545838]
cmp byte [rax], 0
jne 0x4a069d
mov rcx, qword [rbp + 0x58]
call fcn.0040c470
mov rcx, qword [rbp + 0x50]
mov rdx, rax
call sub.advapi32.dll_RegDeleteKeyW
mov dword [rbp + 0x3c], eax
jmp 0x4a071f
nop
mov dword [rbp + 0x38], 0
mov rax, qword [0x00545838]
cmp byte [rax], 0
je 0x4a06dd
call fcn.00410ec0
cmp byte [rax + 0x1b9], 0
je 0x4a06c8
mov dword [rbp + 0x38], pe_nt_image_headers64
jmp 0x4a06dd
call fcn.00410ec0
cmp byte [rax + 0x1b8], 0
je 0x4a06dd
mov dword [rbp + 0x38], 0x200
nop
mov rcx, qword [rbp + 0x58]
call fcn.0040c470
mov rcx, qword [rbp + 0x50]
mov rdx, rax
mov r8d, dword [rbp + 0x38]
xor r9, r9
call sub.advapi32.dll_RegDeleteKeyExW
mov dword [rbp + 0x3c], eax
jmp 0x4a071f
mov eax, dword [rbp + 0x3c]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x4a0890
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
sub rsp, 0xb0
mov rbp, rsp
mov qword [rbp + 0x60], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xc8], rdx
mov byte [rbp + 0xd0], r8b
nop
mov byte [rbp + 0x9f], 0
lea rcx, [0x004a0c3c]
mov rdx, qword [rbp + 0xc8]
call fcn.0040cd70
test eax, eax
je 0x4a0b43
cmp byte [rbp + 0xd0], 0
je 0x4a0b29
nop
mov dword [rbp + 0x7c], 0
mov rax, qword [0x00545838]
cmp byte [rax], 0
je 0x4a0942
call fcn.00410ec0
cmp byte [rax + 0x1b9], 0
je 0x4a092d
mov dword [rbp + 0x7c], pe_nt_image_headers64
jmp 0x4a0942
call fcn.00410ec0
cmp byte [rax + 0x1b8], 0
je 0x4a0942
mov dword [rbp + 0x7c], 0x200
nop
mov rcx, qword [rbp + 0xc8]
call fcn.0040c470
mov rcx, qword [rbp + 0xc0]
mov rdx, rax
xor r8, r8
mov r9d, dword [rbp + 0x7c]
or r9d, 0x2000f
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
mov dword [rbp + 0x98], eax
nop
cmp dword [rbp + 0x98], 0
jne 0x4a0b03
mov dword [rbp + 0x90], 0
mov rcx, qword [rbp + 0xa0]
xor rdx, rdx
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x4a0b03
mov eax, dword [rbp + 0x90]
sub eax, 1
mov dword [rbp + 0x8c], eax
cmp dword [rbp + 0x8c], 0
jl 0x4a0b02
mov eax, dword [0x00538760]
mov dword [rbp + 0x94], eax
lea rcx, [rbp + 0xa8]
mov edx, dword [rbp + 0x94]
call fcn.0040c6e0
lea rcx, [rbp + 0xa8]
call fcn.0040b380
mov rcx, qword [rbp + 0xa0]
mov edx, dword [rbp + 0x8c]
mov r8, rax
lea r9, [rbp + 0x94]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x4a0aee
lea rcx, [rbp + 0xa8]
mov edx, dword [rbp + 0x94]
call fcn.0040c6e0
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0xc8]
call fcn.00431fe0
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0xa8]
call fcn.0040c890
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x80]
movzx r8, byte [rbp + 0xd0]
call fcn.004a0890
test al, al
jne 0x4a0aee
xor rcx, rcx
mov rdx, qword [rbp + 0x68]
call fcn.004a0b80
jmp 0x4a0b43
sub dword [rbp + 0x8c], 1
cmp dword [rbp + 0x8c], 0xffffffff
jne 0x4a0a1a
nop
nop
lea rcx, [rbp + 0xa8]
xor rdx, rdx
call fcn.0040c6e0
mov rcx, qword [rbp + 0xa0]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4a0b29
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0xc8]
call fcn.004a0740
mov byte [rbp + 0x9f], al
nop
lea rcx, [rbp + 0x60]
call fcn.0040aa40
lea rcx, [rbp + 0x80]
call fcn.0040aa40
lea rcx, [rbp + 0xa8]
call fcn.0040aa40
movzx rax, byte [rbp + 0x9f]
lea rsp, [rbp + 0xb0]
pop rbp
ret
Function at 0x4a0c40
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x48], r8
mov byte [rbp + 0x57], r9b
mov qword [rbp + 0x78], 0
mov qword [rbp + 0xb8], rdx
mov rcx, qword [rbp + 0xb8]
call fcn.0040abd0
mov rcx, qword [rbp + 0xd0]
call fcn.0040abd0
nop
xor rax, rax
mov byte [rbp + 0x47], al
mov rcx, qword [rbp + 0x48]
call fcn.0040aa40
xor rbx, rbx
mov rax, qword [0x00545838]
cmp byte [rax], 0
je 0x4a0cca
call fcn.00410ec0
cmp byte [rax + 0x1b9], 0
je 0x4a0cb6
mov ebx, pe_nt_image_headers64
jmp 0x4a0cca
call fcn.00410ec0
cmp byte [rax + 0x1b8], 0
je 0x4a0cca
mov ebx, 0x200
nop
mov rcx, qword [rbp + 0xb8]
call fcn.0040c470
mov rcx, qword [rbp + 0x58]
mov rdx, rax
xor r8, r8
mov r9d, ebx
or r9d, 0x20019
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a0e27
mov al, 1
mov byte [rbp + 0x47], al
mov dword [rbp + 0x6c], 0x800
mov ecx, dword [rbp + 0x6c]
call fcn.00405990
mov rdi, rax
xor rbx, rbx
mov dword [rbp + 0x6c], 0x800
movzx rax, byte [rbp + 0x57]
test al, al
je 0x4a0d65
mov rcx, qword [rbp + 0x70]
mov edx, ebx
mov r8, rdi
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumKeyExW
mov esi, eax
jmp 0x4a0d9d
mov rcx, qword [rbp + 0x70]
mov edx, ebx
mov r8, rdi
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumValueW
mov esi, eax
test esi, esi
jne 0x4a0e0d
cmp dword [rbp + 0x6c], 0
jbe 0x4a0e0a
cmp qword [rbp + 0xd8], 0
je 0x4a0dbb
mov rax, qword [rbp + 0xd8]
add dword [rax], 1
lea rcx, [rbp + 0x78]
mov rdx, rdi
mov r8d, dword [rbp + 0x6c]
call fcn.0040ad20
mov rax, qword [rbp + 0x48]
cmp qword [rax], 0
jne 0x4a0de4
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x78]
call fcn.0040b090
jmp 0x4a0e0a
mov rcx, qword [rbp + 0x48]
mov edx, 3
mov rax, qword [rbp + 0x48]
mov r8, qword [rax]
mov r9, qword [rbp + 0xd0]
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x20], rax
call fcn.0040c9c0
add ebx, 1
test esi, esi
je 0x4a0d1b
nop
mov rcx, rdi
call fcn.004059c0
mov rcx, qword [rbp + 0x70]
call sub.advapi32.dll_RegCloseKey_1
nop
lea rcx, [rbp + 0x78]
call fcn.0040aa40
lea rcx, [rbp + 0xb8]
call fcn.0040aa40
lea rcx, [rbp + 0xd0]
call fcn.0040aa40
movzx rax, byte [rbp + 0x47]
lea rsp, [rbp + 0x88]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x4a1d80
Capabilities:
Check os version

Disassembly:
push rbp
sub rsp, 0x150
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov byte [rbp + 0x14f], 7
nop
mov dword [rbp + 0x30], 0x11c
lea rcx, [rbp + 0x30]
call sub.kernel32.dll_GetVersionExW
cmp dword [rbp + 0x40], 2
jne 0x4a1e74
mov byte [rbp + 0x14f], 5
cmp dword [rbp + 0x34], 6
jb 0x4a1e46
mov byte [rbp + 0x14f], 0xa
cmp byte [rbp + 0x14a], 1
jne 0x4a1e0c
cmp dword [rbp + 0x38], 3
jb 0x4a1de4
mov byte [rbp + 0x14f], 0x10
jmp 0x4a1eba
cmp dword [rbp + 0x38], 2
jb 0x4a1df6
mov byte [rbp + 0x14f], 0xe
jmp 0x4a1eba
cmp dword [rbp + 0x38], 1
jb 0x4a1eba
mov byte [rbp + 0x14f], 0xd
jmp 0x4a1eba
mov byte [rbp + 0x14f], 0xb
cmp dword [rbp + 0x38], 3
jb 0x4a1e25
mov byte [rbp + 0x14f], 0x11
jmp 0x4a1eba
cmp dword [rbp + 0x38], 2
jb 0x4a1e37
mov byte [rbp + 0x14f], 0xf
jmp 0x4a1eba
cmp dword [rbp + 0x38], 1
jb 0x4a1eba
mov byte [rbp + 0x14f], 0xc
jmp 0x4a1eba
cmp dword [rbp + 0x34], 5
jb 0x4a1eba
mov byte [rbp + 0x14f], 6
cmp dword [rbp + 0x38], 1
jb 0x4a1eba
cmp byte [rbp + 0x14a], 1
jne 0x4a1e6b
mov byte [rbp + 0x14f], 7
jmp 0x4a1eba
mov byte [rbp + 0x14f], 9
jmp 0x4a1eba
cmp dword [rbp + 0x40], 1
jne 0x4a1ea9
mov byte [rbp + 0x14f], 1
cmp dword [rbp + 0x34], 4
jne 0x4a1e94
cmp dword [rbp + 0x38], 0xa
jne 0x4a1e94
mov byte [rbp + 0x14f], 2
cmp dword [rbp + 0x34], 4
jne 0x4a1eba
cmp dword [rbp + 0x38], 0x5a
jne 0x4a1eba
mov byte [rbp + 0x14f], 3
jmp 0x4a1eba
mov byte [rbp + 0x14f], 1
jmp 0x4a1eba
movzx rax, byte [rbp + 0x14f]
lea rsp, [rbp + 0x150]
pop rbp
ret