joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006500
Capabilities:
Get common file path
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov edi, 0x105
lea rcx, [rsp + 0x30]
mov edx, edi
mov ebx, 0xffff
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
xor r12d, r12d
test eax, eax
je 0x140006637
lea r8, [0x1400407d0]
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140010470
test eax, eax
js 0x140006637
lea rcx, [rsp + 0x30]
call fcn.140019eb0
test eax, eax
je 0x140006637
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], r12d
movzx esi, r12w
mov r14d, r12d
call fcn.140019eb0
test eax, eax
je 0x140006637
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
nop dword [rax + rax]
mov ecx, eax
mov r15d, eax
call fcn.14000130c
mov rdi, rax
test rax, rax
je 0x140006637
mov r9, rax
lea rcx, [rsp + 0x30]
mov r8d, r15d
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
nop dword [rax + rax]
test eax, eax
je 0x140006628
lea r9, [rsp + 0x24]
mov dword [rsp + 0x24], 4
lea r8, [rsp + 0x28]
mov rcx, rdi
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
je 0x140006628
mov rcx, qword [rsp + 0x28]
lea r14d, [r12 + 1]
movzx esi, word [rcx]
mov rcx, rdi
call fcn.1400012c0
test r14d, r14d
cmovne bx, si
movzx eax, bx
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140001660
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140006674
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor ebx, ebx
mov esi, edx
mov rdi, rcx
test rcx, rcx
jne 0x1400066ab
xor eax, eax
jmp 0x140006730
mov edx, 0x104
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14000672e
test esi, esi
lea rcx, [0x140042538]
lea rax, str._NTUninstallWMP11_
mov edx, 0x208
cmove rax, rcx
lea r8, str._s_swmploc.dll
lea rcx, str._s_swmvcore.dll
mov qword [rsp + 0x20], rax
cmove r8, rcx
lea r9, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call fcn.140010420
test eax, eax
js 0x14000672e
lea rcx, [rsp + 0x30]
call fcn.140019eb0
test eax, eax
je 0x14000672e
lea rcx, [rsp + 0x30]
mov ebx, 1
call fcn.14001a4bc
mov qword [rdi], rax
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140001660
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000675c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x1e8]
sub rsp, 0x2e0
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor ebx, ebx
mov esi, edx
mov qword [rsp + 0x38], rbx
mov rdi, rcx
test rcx, rcx
jne 0x1400067a3
xor eax, eax
jmp 0x140006860
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetup
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000685e
mov dword [rsp + 0x34], 1
mov edx, 0x208
lea rcx, [rbp - 0x40]
lea r8, str.WMP11RollbackTo
test esi, esi
jne 0x1400067fb
lea r8, str.WMFDist11RollbackTo
call fcn.1400103e4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0x80
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000684d
lea rcx, [rsp + 0x40]
lea ebx, [rax + 1]
call fcn.14001de88
mov qword [rdi], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140001660
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140007204
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x388]
sub rsp, 0x480
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x370], rax
xor edi, edi
mov esi, edx
test rcx, rcx
je 0x14000735a
mov qword [rsp + 0x20], rcx
lea r9, str.SoftwareMicrosoftUpdates
lea rcx, [rbp + 0x160]
mov edx, 0x104
lea r8, [0x140040ec0]
call fcn.1400104f4
test eax, eax
js 0x14000735a
and qword [rsp + 0x48], rdi
mov ebx, 0x20019
call fcn.140029380
test eax, eax
lea rdx, [rbp + 0x160]
mov ecx, 0x20119
lea rax, [rsp + 0x48]
cmovne ebx, ecx
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000735a
xor ebx, ebx
and qword [rsp + 0x38], rbx
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
xor edx, edx
jmp 0x140007322
lea rcx, [rsp + 0x50]
inc ebx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcslwr]
nop dword [rax + rax]
cmp word [rsp + 0x50], 0x6b
jne 0x140007308
cmp word [rsp + 0x52], 0x62
jne 0x140007308
mov r8d, esi
lea rcx, [rsp + 0x50]
mov edx, 1
call fcn.140002b0c
mov edi, eax
and qword [rsp + 0x38], 0
mov edx, ebx
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1400072d1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140001660
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140007520
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp qword [0x140053798], 0
mov rdi, rcx
mov ebx, 0x80004005
jne 0x1400075c2
mov ecx, 0x88
call fcn.1400012cc
test rax, rax
je 0x1400075b8
mov rcx, rax
call fcn.140016430
mov qword [0x140053798], rax
test rax, rax
je 0x1400075c7
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x1400075c7
mov rcx, qword [0x140053798]
lea r8, [rsp + 0x20]
mov eax, dword [0x140051d90]
mov rdx, rdi
mov dword [rcx + 0x74], eax
mov eax, dword [0x1400515c8]
mov dword [rcx + 0x6c], eax
call fcn.140016730
xor ebx, ebx
jmp 0x1400075c7
and qword [0x140053798], 0
jmp 0x1400075c7
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140001660
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x140007f68
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, 1
lea r8, str.GlobalServicePackOrHotfix
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
nop dword [rax + rax]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor edi, edi
cmp eax, 0xb7
cmove edi, esi
test rbx, rbx
je 0x140007fcf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140008148
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x168]
sub rsp, 0x260
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x150], rax
lea rax, [rsp + 0x40]
xor esi, esi
mov r9d, 0x20019
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionSetupWindowsFeaturesWindowsMediaVersion
mov rcx, 0xffffffff80000002
mov edi, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000826e
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140040c78]
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x3c], 8
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000825d
cmp dword [rsp + 0x38], 3
jne 0x14000825d
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x50]
call fcn.14001b5b4
test eax, eax
je 0x14000825d
movzx eax, word [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov ebx, dword [rsp + 0x30]
and rbx, 0xffffffffffff0000
or rbx, rax
mov eax, dword [rsp + 0x34]
shr rax, 0x10
shl rbx, 0x10
or rbx, rax
movzx eax, word [rsp + 0x34]
shl rbx, 0x10
or rbx, rax
call fcn.14001de88
cmp rax, rbx
cmovb edi, esi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140001660
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400082a0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
cmp dword [0x140051d90], ebx
je 0x1400082d0
lea eax, [rbx + 1]
jmp 0x14000833e
test rax, rax
je 0x14000833c
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x14000833c
mov edi, ebx
mov r14, rax
cmp edi, dword [rsp + 0x30]
jge 0x14000832d
mov rcx, qword [r14]
lea rdx, [0x140040d80]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140008322
inc edi
add r14, 8
jmp 0x1400082fa
mov ebx, 1
mov dword [0x140051d90], ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400084c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x38
xor ebx, ebx
lea rax, [rbp + 0x30]
xor r8d, r8d
mov qword [rbp + 0x30], rbx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSetupWindowsFeatures
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140008572
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x18]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x18], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Windows_Media_Player
mov dword [rbp + 0x20], ebx
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140008562
cmp dword [rbp + 0x18], 4
jne 0x140008562
cmp dword [rbp + 0x20], ebx
jne 0x140008562
lea rdx, str.This_is_an_N_system._r_n
lea ecx, [rbx + 4]
call fcn.140018e9c
mov ebx, 1
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
ret
Function at 0x140008604
Capabilities:
Find taskbar

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
nop dword [rax + rax]
xor ebx, ebx
test rax, rax
je 0x1400086a2
xor r9d, r9d
lea r8, str.RebarWindow32
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400086a2
xor r9d, r9d
lea r8, str.WMPDeskBand
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExW]
nop dword [rax + rax]
test rax, rax
jne 0x1400086dc
xor r9d, r9d
lea r8, str.WMP9DeskBand
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_FindWindowExW]
nop dword [rax + rax]
test rax, rax
jne 0x1400086dc
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14001a520
mov edi, 0x104
test eax, eax
je 0x1400086e3
lea r8, str.wmdband.dll
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.140010470
test eax, eax
js 0x1400086e3
lea rcx, [rsp + 0x20]
call fcn.140007fe8
test eax, eax
je 0x1400086e3
mov eax, 1
jmp 0x140008720
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14001a520
test eax, eax
je 0x14000871e
lea r8, str.wmpband.dll
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140010470
test eax, eax
js 0x14000871e
lea rcx, [rsp + 0x20]
call fcn.140007fe8
test eax, eax
setne bl
mov eax, ebx
jmp 0x140008720
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140001660
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret

Function at 0x140008780
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x38
and qword [rbp + 0x30], 0
lea rax, [rbp + 0x30]
mov r9d, 2
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftMediaPlayerSetup
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140008898
lea ebx, [rax + 4]
cmp dword [rbp + 0x18], eax
je 0x14000885e
and dword [rbp + 0x28], eax
lea rdx, str.Progress_MaxDialog
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
mov dword [rsp + 0x28], ebx
lea rdx, str.Progress_CurrentInstall
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
mov dword [rsp + 0x28], ebx
lea rdx, str.Progress_MaxInstall
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x28], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], ebx
lea rdx, str.Progress_CurrentDialog
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
add rsp, 0x38
pop rbx
pop rbp
ret
Function at 0x14000be3c
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rcx, qword [str.6ij]
lea rax, [0x1400510c0]
cmp rax, rcx
jne 0x14000bf2f
cmp dword [0x140051e5c], 0xd2af9
je 0x14000c04e
cmp qword [0x140053798], 0
je 0x14000bf1f
call fcn.14001670c
test rax, rax
je 0x14000bf1f
call fcn.14001670c
cmp dword [rax + 0x138], 0
jne 0x14000bf1f
call fcn.140008748
test eax, eax
je 0x14000bf1f
xor edx, edx
lea rcx, str.WMPlayerApp
call qword [sym.imp.USER32.dll_FindWindowW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14000c04e
lea rcx, str.WMPlayer_PluginAddRemove
call qword [sym.imp.USER32.dll_RegisterWindowMessageA]
nop dword [rax + rax]
test eax, eax
je 0x14000c04e
xor r9d, r9d
mov edx, eax
mov rcx, rdi
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostMessageW]
nop dword [rax + rax]
lea rdx, str.Alerted_WMP_to_the_updated_service._r_n
mov ecx, 4
call fcn.140018e9c
jmp 0x14000c04e
mov ebx, 1
mov dword [0x140051df0], ebx
jmp 0x14000c04e
lea rax, str.K
mov ebx, 1
cmp rax, rcx
jne 0x14000bf97
mov eax, dword [0x140051df0]
cmp dword [0x140051e5c], 0xd2af9
cmovne eax, ebx
mov dword [0x140051df0], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
mov rcx, rax
lea rdx, str._RunOnce
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x14000c04e
and dword [0x140051df0], 0
mov ecx, ebx
call fcn.140014498
jmp 0x14000c04e
mov eax, dword [0x140051e5c]
cmp eax, 0xd2af8
jne 0x14000bff9
mov edi, 0x104
lea rcx, [rsp + 0x20]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14000bfec
lea r8, str.unregmp2.exe
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.140010470
test eax, eax
js 0x14000bfec
mov r9d, 0xffff
lea rdx, [rsp + 0x20]
mov r8d, ebx
xor ecx, ecx
call fcn.140019884
mov eax, dword [0x140051e5c]
mov rcx, qword [str.6ij]
test eax, eax
js 0x14000c029
lea rdx, str.6ij
cmp rdx, rcx
jne 0x14000c029
cmp dword [0x140051e30], 0
jne 0x14000c01e
call fcn.140006fbc
call fcn.14000705c
jmp 0x14000c023
call fcn.140006fbc
mov eax, dword [0x140051e5c]
cmp eax, 0xd2af9
je 0x14000c049
cmp eax, 0xc00d2afb
je 0x14000c049
test eax, eax
js 0x14000c04e
cmp dword [0x140051d90], 0
jne 0x14000c04e
jmp 0x14000bf24
call fcn.1400050ac
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140001660
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x14000c680
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x38
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferences
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000c6fc
mov rcx, qword [rsp + 0x40]
lea rdx, str.MigrationSchema
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
lea rdx, str.MigrationPercentage
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
add rsp, 0x38
ret

Function at 0x14000c708
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x160], rax
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftMultimediaWMPlayerWMFDistQFEBackup
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000c7e3
xor ebx, ebx
and qword [rsp + 0x38], rbx
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
xor edx, edx
jmp 0x14000c7ab
xor edx, edx
lea rcx, [rsp + 0x50]
inc ebx
lea r8d, [rdx + 1]
call fcn.140002b0c
and qword [rsp + 0x38], 0
mov edx, ebx
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
nop dword [rax + rax]
test eax, eax
je 0x14000c77f
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rdx, str.SoftwareMicrosoftMultimediaWMPlayerWMFDistQFEBackup
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140001660
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rbp
ret
Function at 0x14000c824
Capabilities:
Get common file path
Persist via run registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x378]
sub rsp, 0x470
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov ebx, ecx
call fcn.14001bc64
xor esi, esi
test eax, eax
je 0x14000ca37
mov edi, 0x105
lea rcx, [rbp + 0x150]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14000ca37
lea r8, str.unregmp2.exe
mov edx, edi
lea rcx, [rbp + 0x150]
call fcn.140010470
test eax, eax
js 0x14000ca37
lea rcx, [rbp + 0x150]
call fcn.140019eb0
test eax, eax
je 0x14000ca37
lea r9, [rbp + 0x150]
mov edx, edi
lea r8, str._s__HideWMP__SetShowState
lea rcx, [rsp + 0x40]
call fcn.1400104f4
test eax, eax
js 0x14000ca37
test ebx, ebx
je 0x14000ca1f
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rsi
lea ebx, [rsi + 3]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x14000c94b
lea rax, [rsp + 0x30]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14000c9d3
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
call fcn.14001b2b8
mov rdi, rax
test rax, rax
je 0x14000c9b9
lea rax, [rsp + 0x40]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], si
jne 0x14000c96b
lea eax, [rcx*2 + 2]
mov r9d, 1
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
jmp 0x14000c9be
mov ebx, 0x80004005
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
je 0x14000c9fd
test ebx, ebx
jle 0x14000c9e0
movzx ebx, bx
or ebx, 0x80070000
mov r9d, ebx
lea r8, [0x1400423b0]
lea rdx, str.ERROR:_Could_not_store_delayed_action_for_component__S:_0x_x._r_n
mov ecx, 2
call fcn.140018ed8
jmp 0x14000ca37
lea rdx, str.__Delayed_action_until_reboot._r_n
mov ecx, 4
call fcn.140018e9c
lea r8, [rsp + 0x40]
mov edx, 1
call fcn.14001d60c
jmp 0x14000ca37
mov r9d, 0xffff
lea rdx, [rsp + 0x40]
mov r8d, 1
xor ecx, ecx
call fcn.140019884
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.140001660
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret