joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100059e3c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
xor ebx, ebx
mov rdi, rcx
mov esi, ebx
cmp qword [rcx + 0x18], rbx
jne 0x100059f9e
mov ecx, 0x80
mov esi, 0x80004005
call fcn.10007fa96
mov qword [rdi + 0x18], rax
cmp rax, rbx
jne 0x100059e82
xor eax, eax
jmp 0x100059fa5
cmp dword [rdi + 4], ebx
jl 0x100059e9f
cmp dword [rdi + 4], 1
jle 0x100059e93
cmp dword [rdi + 4], 3
jne 0x100059e9f
lea rdx, [0x10002b1e0]
jmp 0x100059f93
mov r14d, ebx
cmp qword [rdi + 0x10], rbx
je 0x100059f8c
mov ecx, 0x208
call fcn.10007fa96
mov r13, rax
cmp rax, rbx
je 0x100059f8c
mov rdx, rax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, ebx
je 0x100059f7f
mov rcx, qword [rdi + 0x10]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov r12, rax
cmp rax, rbx
je 0x100059ef5
add r12, 2
jmp 0x100059ef9
mov r12, qword [rdi + 0x10]
mov rcx, r13
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov r8, r12
mov edx, 0x104
mov rcx, r13
call fcn.100039ee4
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x44]
mov rcx, r13
call fcn.100054598
cmp eax, ebx
jl 0x100059f7f
mov r8d, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x44]
mov edx, 0x104
movzx ecx, r8w
shr r8d, 0x10
movzx eax, r9w
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r8d
lea r8, [0x1000296c8]
shr r9d, 0x10
mov rcx, r13
mov dword [rsp + 0x20], eax
call fcn.10003a080
lea rcx, [rdi + 0x18]
mov rdx, r13
call fcn.100052cbc
mov r14d, 1
mov esi, eax
mov rcx, r13
call fcn.10007faa2
cmp r14d, ebx
jne 0x100059f9e
lea rdx, [0x10002b1f0]
lea rcx, [rdi + 0x18]
call fcn.100052cbc
mov esi, eax
cmp esi, ebx
setge bl
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x10005b218
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor ebp, ebp
mov esi, edx
mov rbx, rcx
cmp dword [rcx + 0x7c], ebp
je 0x10005b373
mov r8, qword [rcx + 0x30]
cmp r8, rbp
je 0x10005b373
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 6
jbe 0x10005b373
lea edx, [rbp + 0x5c]
mov rcx, r8
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov r8, qword [rbx + 0x30]
lea rdx, [0x10002b610]
lea ecx, [rbp + 4]
mov rdi, rax
mov dword [rsp + 0x20], 1
call fcn.1000527f4
cmp rdi, rbp
je 0x10005b2ac
mov word [rdi], bp
mov edi, 0x104
lea rdx, [rsp + 0x240]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebp
je 0x10005b373
lea rax, [rsp + 0x240]
cmp rax, rbp
je 0x10005b2e4
lea rcx, [rsp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov r8, qword [rbx + 0x30]
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x30]
sub r8, rax
lea rax, [rdi + 0x7ffffefa]
cmp rax, rbp
je 0x10005b318
movzx eax, word [r8 + rcx]
cmp ax, bp
je 0x10005b318
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x10005b2f5
cmp rdi, rbp
jne 0x10005b321
sub rcx, 2
mov word [rcx], bp
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, rbp
je 0x10005b33d
mov word [rax + 2], bp
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebp
jne 0x10005b368
mov rcx, qword [rbx + 0x30]
lea rdx, [rsp + 0x20]
call fcn.10005516c
mov rcx, qword [rbx + 0x30]
jmp 0x10005b36d
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp dword [rbx + 0x80], ebp
je 0x10005b38e
cmp esi, ebp
je 0x10005b38e
mov rcx, qword [rbx + 0x38]
cmp rcx, rbp
je 0x10005b38e
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [rbx + 0x84], ebp
je 0x10005b3b2
mov rcx, qword [rbx + 0x50]
cmp rcx, rbp
je 0x10005b3b2
call fcn.100053354
cmp eax, ebp
je 0x10005b3b2
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x10005b964
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xa0], 0
mov esi, edx
mov rbx, rcx
jne 0x10005ba4d
mov eax, dword [rcx + 0x58]
cmp eax, 1
je 0x10005b9d6
jle 0x10005ba4d
cmp eax, 4
jle 0x10005b9a2
cmp eax, 6
jne 0x10005ba4d
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x10005b9c3
mov rdx, qword [rbx + 0x28]
xor r8d, r8d
call fcn.10006f928
mov qword [rbx + 0xa0], rax
jmp 0x10005ba4d
lea rdx, [0x10002b6b0]
mov ecx, 2
call fcn.1000527a0
jmp 0x10005ba4d
mov rcx, qword [rcx + 0x30]
and dword [rsp + 0x58], 0
call fcn.100053454
test eax, eax
je 0x10005ba4d
and qword [rsp + 0x30], 0
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x10005ba4d
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x10005ba44
mov edx, dword [rsp + 0x58]
mov ecx, eax
shl rdx, 0x20
or rdx, rcx
mov qword [rbx + 0xa0], rdx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbx + 0x88], 0
jne 0x10005ba84
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x10005ba84
call fcn.100053454
test eax, eax
jne 0x10005ba84
mov rcx, qword [rbx + 0x38]
call fcn.100053454
test eax, eax
jne 0x10005ba84
lea rdx, [0x10002b6f0]
lea ecx, [rax + 4]
call fcn.1000527a0
test esi, esi
je 0x10005ba91
mov rax, qword [rbx + 0xa0]
jmp 0x10005ba9f
mov rax, qword [rbx + 0xb0]
add rax, qword [rbx + 0xa0]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x10005d488
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rax, [0x10002cb68]
mov rbx, rcx
xor ebp, ebp
mov qword [rcx], rax
mov rcx, qword [rcx + 0x30]
cmp rcx, rbp
je 0x10005d4bd
call fcn.10007faa2
mov qword [rbx + 0x30], rbp
mov rcx, qword [rbx + 0x38]
cmp rcx, rbp
je 0x10005d4cf
call fcn.10007faa2
mov qword [rbx + 0x38], rbp
mov rcx, qword [rbx + 0x40]
cmp rcx, rbp
je 0x10005d4e1
call fcn.10007faa2
mov qword [rbx + 0x40], rbp
mov rcx, qword [rbx + 0x48]
cmp rcx, rbp
je 0x10005d4f3
call fcn.10007faa2
mov qword [rbx + 0x48], rbp
mov rcx, qword [rbx + 0x50]
cmp rcx, rbp
je 0x10005d505
call fcn.10007faa2
mov qword [rbx + 0x50], rbp
mov rcx, qword [rbx + 0x260]
cmp rcx, rbp
je 0x10005d517
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rbx + 0x260]
cmp rcx, rbp
je 0x10005d52f
call fcn.10007faa2
mov qword [rbx + 0x260], rbp
mov rcx, qword [rbx + 0x2a0]
cmp rcx, rbp
je 0x10005d548
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x2a0], rbp
cmp qword [rbx + 8], rbp
je 0x10005d595
mov rax, qword [rbx + 8]
mov rsi, qword [rax + 8]
cmp qword [rax], rbp
je 0x10005d57a
mov rdi, qword [rax]
cmp rdi, rbp
je 0x10005d573
mov rcx, rdi
call fcn.100060d20
mov rcx, rdi
call fcn.10007faae
mov rax, qword [rbx + 8]
mov qword [rax], rbp
mov rcx, qword [rbx + 8]
cmp rcx, rbp
je 0x10005d58c
call fcn.10007faae
mov qword [rbx + 8], rbp
mov qword [rbx + 8], rsi
cmp rsi, rbp
jne 0x10005d54e
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x10005d5b0
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp qword [rcx + 0x260], 0
mov rdi, rcx
jne 0x10005d685
mov ecx, 0x208
call fcn.10007fa96
mov rbx, rax
test rax, rax
jne 0x10005d5fc
mov eax, 0x80004005
jmp 0x10005d687
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x10005d66e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r9, [rsp + 0x30]
lea r8, [0x10002be50]
mov r11d, eax
mov eax, 0x4f8b588f
mov ecx, r11d
mul r11d
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, 0x104
shr ecx, 0x10
imul ecx, ecx, 0x186a0
sub r11d, ecx
mov rcx, rbx
mov dword [rsp + 0x20], r11d
call fcn.10003a0f0
test eax, eax
js 0x10005d66e
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10005d66e
mov qword [rdi + 0x260], rbx
cmp qword [rdi + 0x260], 0
jne 0x10005d685
mov rcx, rbx
call fcn.10007faa2
jmp 0x10005d5f2
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.10007fa70
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x10005f8cc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x300
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rbp, qword [rcx + 0x38]
xor ebx, ebx
mov rsi, rcx
mov qword [rsp + 0x50], rbx
cmp rbp, rbx
jne 0x10005f914
mov eax, 0x80004005
jmp 0x10005faa7
mov r14d, 1
cmp dword [rcx + 0x28], ebx
je 0x10005f933
cmp dword [rcx + 0x28], r14d
je 0x10005f933
cmp dword [rcx + 0x28], 2
je 0x10005f933
mov ebx, r14d
jmp 0x10005faa5
lea r8, [0x100024bd0]
lea rcx, [rsp + 0xe0]
mov r9d, 0xc
mov edx, 0x208
mov qword [rsp + 0x20], rbx
call fcn.10003a0f0
cmp eax, ebx
jl 0x10005faa0
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x10005faa0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, [0x10002c498]
xor r8d, r8d
mov dword [rsp + 0x5c], 0x80
mov r12, rbx
mov qword [rsp + 0x20], rax
mov r13, rbx
mov dword [rsp + 0x58], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10005fa10
cmp dword [rsp + 0x58], r14d
jne 0x10005fa10
lea rcx, [rsp + 0x60]
call fcn.100052d68
mov rcx, rbp
mov r13, rax
call fcn.100052d68
mov ecx, ebx
cmp rax, r13
mov r12, rax
seta cl
jmp 0x10005fa13
mov ecx, r14d
cmp ecx, ebx
je 0x10005fa4e
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasw ax, word [rdi]
lea rdx, [0x10002c498]
mov r9d, r14d
not rcx
xor r8d, r8d
sub rcx, r14
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp r12, r13
jb 0x10005fa93
mov rdx, qword [rsi + 0x40]
cmp rdx, rbx
je 0x10005fa93
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
mov r9d, r14d
xor r8d, r8d
not rcx
sub rcx, r14
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x10002c4b0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10005faa5
mov ebx, 0x80004005
mov eax, ebx
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1000605ac
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x380
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x370], rax
xor edi, edi
mov rsi, r8
mov rbx, rdx
test rdx, rdx
je 0x1000606f1
test r8, r8
je 0x1000606f1
mov dword [rsp + 0x40], 0x80
xor r12d, r12d
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1000606f1
and qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x80
inc r12d
xor ebp, ebp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000606f1
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x160]
lea rdx, [0x100024ee0]
xor r8d, r8d
mov dword [rsp + 0x44], 1
mov dword [rsp + 0x48], 0x20a
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000606d0
cmp dword [rsp + 0x44], 1
jne 0x1000606d0
lea rcx, [rsp + 0x160]
mov rdx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1000606d0
lea ebp, [rax + 1]
mov edi, ebp
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x1000605f8
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, edi
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x100063254
Capabilities:
Create service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x70
mov r13, r9
mov rbp, r8
mov r12, rdx
mov rsi, rcx
mov ebx, 1
test rdx, rdx
je 0x100063382
test r8, r8
je 0x100063382
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x10006335b
and qword [rsp + 0x60], 0
lea rax, [0x10002ce00]
mov r9d, 0xf003f
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0xb8]
mov qword [rsp + 0x50], r13
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xb0]
mov r8, r12
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
je 0x10006332b
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r9, [0x10002cc68]
lea rdx, [0x10002ce38]
lea ecx, [rbx + 3]
mov r8, rsi
call fcn.1000527f4
jmp 0x100063350
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rbx + 0x57]
test eax, eax
lea rdx, [0x10002ce58]
mov r8, rsi
cmove eax, ecx
lea ecx, [rbx + 2]
mov r9d, eax
call fcn.1000527f4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x100063384
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rbx + 0x57]
test eax, eax
lea rdx, [0x10002ccd0]
mov r8, rsi
cmove eax, ecx
lea ecx, [rbx + 2]
mov r9d, eax
call fcn.1000527f4
jmp 0x100063384
xor ebx, ebx
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x100064090
Capabilities:
Delete file

Disassembly:
test rcx, rcx
je 0x1000640cd
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1000640c8
call fcn.100053454
test eax, eax
je 0x1000640b7
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1000640c8
call fcn.10007faa2
and qword [rbx], 0
add rsp, 0x20
pop rbx
ret

Function at 0x1000640d4
Capabilities:
Create directory
Get common file path

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x460], rax
lea rdx, [rsp + 0x250]
xor ebx, ebx
mov ecx, 0x104
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
je 0x10006418b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r9, [rsp + 0x250]
lea r8, [0x10002d0c0]
mov r11d, eax
mov eax, 0x4f8b588f
mov ecx, r11d
mul r11d
sub ecx, edx
lea rax, [0x100024718]
shr ecx, 1
mov qword [rsp + 0x28], rax
add ecx, edx
mov edx, 0x208
shr ecx, 0x10
imul ecx, ecx, 0x186a0
sub r11d, ecx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], r11d
call fcn.10003a0f0
cmp eax, ebx
jl 0x10006418b
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, ebx
je 0x10006418b
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.100052cbc
mov rbx, qword [rsp + 0x30]
mov rax, rbx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.10007fa70
add rsp, 0x470
pop rbx
ret
Function at 0x1000642a4
Capabilities:
Set registry value

Disassembly:
test r8, r8
je 0x1000642e3
push rdi
sub rsp, 0x30
mov r10, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
mov r9d, 1
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov rcx, r10
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
pop rdi
ret
Function at 0x1000646dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor esi, esi
mov rdi, rcx
mov ebx, esi
cmp qword [rcx], rsi
je 0x10006482c
lea rax, [rsp + 0x30]
mov ebp, 0x20019
lea rdx, [0x10002d0e0]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, ebp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x10006477d
lea rax, [rsp + 0x30]
lea rdx, [0x10002d0e0]
mov r9d, ebp
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
cmp eax, esi
cmovne rcx, rsi
mov qword [rsp + 0x30], rcx
jmp 0x100064782
mov rcx, qword [rsp + 0x30]
cmp rcx, rsi
je 0x100064818
mov rdx, qword [rdi]
lea rax, [rsp + 0x40]
mov ebp, 1
mov r9d, ebp
xor r8d, r8d
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100064802
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [0x10002d140]
xor r8d, r8d
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x48], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x1000647f7
cmp dword [rsp + 0x38], ebp
cmove ebx, ebp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x10002d170]
cmp ebx, esi
jne 0x10006481f
lea rdx, [0x10002d1a0]
mov r8, qword [rdi]
mov ecx, 4
call fcn.1000527f4
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x100064a48
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9, qword [rcx]
xor esi, esi
mov rdi, rcx
mov ebx, 0x80004005
cmp r9, rsi
je 0x100064ca6
lea r8, [0x10002d350]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.10003a080
cmp eax, esi
jl 0x100064ca6
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x100064b2b
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x50]
cmp eax, esi
cmovne rcx, rsi
mov qword [rsp + 0x50], rcx
jmp 0x100064b30
mov rcx, qword [rsp + 0x50]
cmp rcx, rsi
je 0x100064ca6
mov r8, qword [rdi + 0x18]
lea rdx, [0x10002d3a8]
call fcn.1000642a4
mov r8, qword [rdi + 0xc8]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002d3c8]
call fcn.1000642a4
mov r8, qword [rdi + 0xd0]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002d3e0]
call fcn.1000642a4
mov r8, qword [rdi + 0xb8]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002d400]
call fcn.1000642a4
mov r8, qword [rdi + 0xa8]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002d420]
call fcn.1000642a4
mov r8, qword [rdi + 0xa0]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002d440]
call fcn.1000642a4
mov r8, qword [rdi + 0xb0]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002d460]
call fcn.1000642a4
mov r8, qword [rdi + 0xd8]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002d480]
call fcn.1000642a4
mov r8, qword [rdi + 0xe0]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002d480]
call fcn.1000642a4
mov r8, qword [rdi + 0xe8]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002d4a0]
call fcn.1000642a4
mov r8, qword [rdi + 0xf0]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002d4c0]
call fcn.1000642a4
mov r8, qword [rdi + 0xf8]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002d4c0]
call fcn.1000642a4
mov r8, qword [rdi + 0x100]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x10002d4e0]
call fcn.1000642a4
add rdi, 0x98
cmp dword [rdi], esi
je 0x100064c99
mov rcx, qword [rsp + 0x50]
mov r9d, 4
lea rdx, [0x10002d500]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10006557c
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x1000655e0
mov rax, qword [rbx + 0x10]
cmp qword [rax], 0
mov rsi, qword [rax + 8]
je 0x1000655c3
mov rdi, qword [rax]
test rdi, rdi
je 0x1000655bb
mov rcx, rdi
call fcn.100064400
mov rcx, rdi
call fcn.10007faae
mov rax, qword [rbx + 0x10]
and qword [rax], 0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1000655d6
call fcn.10007faae
and qword [rbx + 0x10], 0
mov qword [rbx + 0x10], rsi
cmp rsi, 0
jne 0x100065595
lea rcx, [rbx + 0x30]
call fcn.100064090
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x10006560b
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x10006560b
call fcn.10007faa2
and qword [rbx + 0x38], 0
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x10006561e
call fcn.10007faa2
and qword [rbx + 0x40], 0
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x100065631
call fcn.10007faa2
and qword [rbx + 0x28], 0
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x100065644
call fcn.10007faa2
and qword [rbx + 0x20], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x100065653
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret