joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022e9c
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f68]
mov eax, 0x2068
call fcn.140009d70
sub rsp, rax
mov rax, qword [0x14026f700]
xor rax, rsp
mov qword [rbp + 0x1f50], rax
mov r12, r9
mov r10, r8
mov rdi, rdx
mov rsi, qword [rbp + 0x1fd0]
mov qword [rsp + 0x38], rdx
xor r13d, r13d
cmp qword [rcx + 0xb0], r13
je 0x14002303f
xor r8d, r8d
mov rdx, r10
call fcn.140023584
mov r14, rax
test rax, rax
jne 0x140022f0f
mov rdx, rsi
jmp 0x140023077
call fcn.140014d34
mov rcx, rax
test rax, rax
je 0x1400230b0
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14002edca.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x30], r13d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r12
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
test eax, eax
jne 0x140022fdb
mov edx, dword [rsp + 0x30]
shr edx, 1
lea ecx, [rax + 1]
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x140022f8e
lea rcx, [rsp + 0x38]
call fcn.140004742
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r12
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1401c1718
test eax, eax
js 0x1400230a5
cmp eax, dword [rbx - 0xc]
jg 0x1400230a5
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r13w
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15d, r15d
jne 0x140023010
lea rcx, [rbx - 0x18]
call fcn.14000fa9c
add rax, 0x18
mov qword [rdi], rax
or eax, 0xffffffff
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x14002307f
mov rcx, qword [rbx - 0x18]
lea rdx, [rbx - 0x18]
jmp 0x140023030
mov rdx, rsi
mov rcx, rdi
call fcn.14000bef0
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002307f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14002edca.0]
jmp 0x14002307f
lea r8, [0x14023d2ac]
test rsi, rsi
cmovne r8, rsi
mov rax, qword [rcx + 0xd8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x50]
mov rdx, r12
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14000bef0
mov rax, rdi
mov rcx, qword [rbp + 0x1f50]
xor rcx, rsp
call fcn.140009dd0
add rsp, 0x2068
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.14000151c
nop
mov ecx, 0x80004005
call fcn.14000151c
int3
Function at 0x1400231b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rdi, r9
mov rbx, r8
and qword [r9], 0
mov r14, qword [rbp + 0x40]
and dword [r14], 0
cmp qword [rcx + 0xb0], 0
je 0x140023290
xor r8d, r8d
call fcn.140023584
mov rsi, rax
test rax, rax
je 0x14002333c
mov qword [rbp - 0x20], rsi
and dword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
and dword [rbp + 0x20], 0
and dword [rbp + 0x40], 0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x40]
mov dword [r14], ecx
test eax, eax
jne 0x140023274
call fcn.140009c68
mov qword [rdi], rax
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140023274
lea ebx, [rax + 1]
jmp 0x140023282
mov rcx, qword [rdi]
call fcn.140009c34
and qword [rdi], 0
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002333a
mov rax, qword [rcx]
and qword [rsp + 0x20], 0
mov r9, rbx
mov r8, rdx
lea rdx, [rbp + 0x40]
mov rax, qword [rax + 0x108]
call qword [case.0x14002edca.0]
nop
mov rax, qword [rbp + 0x40]
mov ecx, dword [rax - 0x10]
test ecx, ecx
jne 0x1400232c0
xor ebx, ebx
jmp 0x140023319
shr ecx, 1
mov dword [r14], ecx
call fcn.140009c68
mov qword [rdi], rax
xor r8d, r8d
lea ebx, [r8 + 1]
cmp dword [r14], r8d
jbe 0x140023315
lea ecx, [r8 + r8]
lea edx, [rcx + 1]
test edx, edx
js 0x140023351
mov rax, qword [rbp + 0x40]
cmp edx, dword [rax - 0x10]
jg 0x140023351
test ecx, ecx
js 0x140023351
cmp ecx, dword [rax - 0x10]
jg 0x140023351
movsxd rcx, ecx
mov dl, byte [rax + rcx*2 + 2]
shl dl, 4
sub dl, 0x51
add dl, byte [rax + rcx*2]
mov rax, qword [rdi]
mov byte [r8 + rax], dl
add r8d, ebx
cmp r8d, dword [r14]
jb 0x1400232d9
mov rax, qword [rbp + 0x40]
lea rdx, [rax - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14002333a
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14002edca.0]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80070057
call fcn.14000151c
int3
Function at 0x140023aa4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140023b0b
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140023b1f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023b1f
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call qword [case.0x14002edca.0]
jmp 0x140023b24
cmp dword [rcx + 8], 0
je 0x140023b1f
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140023b24
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140023b34
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x14026f700]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r14, r8
mov rsi, rcx
mov rcx, qword [rdx]
sub rcx, 0x18
call fcn.14000fa9c
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
cmp rsi, 0xffffffff80000000
jne 0x140023bdb
call fcn.140014c9c
cmp eax, 1
jne 0x140023bdb
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x30]
call fcn.1400239d4
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000f904
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140023bcf
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14002edca.0]
mov rsi, 0xffffffff80000001
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
test r14, r14
je 0x140023c05
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2001f
xor r9d, r9d
mov r8, rbx
mov rdx, rsi
mov rcx, r14
call fcn.140022bfc
jmp 0x140023c1f
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140023ced
mov r9d, 0x104
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, eax
test eax, eax
jne 0x140023cae
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14000bef0
nop
mov r8, r14
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call fcn.140023b34
mov edi, eax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140023c91
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14002edca.0]
test edi, edi
je 0x140023c9c
mov rbx, qword [rsp + 0x38]
jmp 0x140023cae
mov rbx, qword [rsp + 0x38]
jmp 0x140023c29
cmp edi, 0x103
je 0x140023cbe
cmp edi, 0x3f2
jne 0x140023ce1
test r14, r14
je 0x140023cd3
mov r8, rbx
mov rdx, rsi
mov rcx, r14
call fcn.140023aa4
jmp 0x140023cdf
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140023d0e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14002edca.0]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140009dd0
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x270
pop r14
pop rdi
pop rsi
ret
Function at 0x140024264
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movsxd rsi, r8d
mov rbx, rdx
mov rdi, rcx
xor ebp, ebp
cmp qword [rcx + 0xd0], rbp
jne 0x14002429e
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x140024342
call fcn.140014d34
mov rcx, rax
test rax, rax
je 0x14002435d
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14002edca.0]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rcx, qword [rdi + 0xd0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
mov rax, qword [rax + 0x118]
call qword [case.0x14002edca.0]
mov rdx, rsi
or rdi, 0xffffffffffffffff
mov r9, rdi
mov r8, qword [rsp + 0x30]
mov rcx, rbx
call fcn.1401c191c
test eax, eax
je 0x140024306
cmp eax, 0xc
je 0x140024357
cmp eax, 0x50
jne 0x140024368
test rbx, rbx
jne 0x14002430f
mov ebx, ebp
jmp 0x14002431a
mov rcx, rbx
call fcn.1401c15ec
mov rbx, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x140024340
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14002edca.0]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
call fcn.1400156b0
nop
mov ecx, 0x80004005
call fcn.14000151c
nop
call fcn.1400156f8
int3

Function at 0x140036ab4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140036ae2
xor eax, eax
jmp 0x140036bc8
cmp qword [rcx + 0x68], 0
je 0x140036af3
call fcn.140036234
jmp 0x140036bc8
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140036b0a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140036b0c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140036b3e
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1401d61e0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140036bc2
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140036b75
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140036b9e
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1401befc0
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140036bc2
cmp rsi, rbx
ja 0x140036b7c
test rsi, rsi
je 0x140036bc2
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1401befc0
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140037dfc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140037e46
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140037e46
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140037e46
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140037e46
cmp dword [rcx + 0x84], 0xe
jbe 0x140037e46
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140037e48
xor al, al
add rsp, 0x28
ret

Function at 0x140038d14
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x14026f700]
xor rax, rsp
mov qword [rsp + 0x220], rax
xor ebp, ebp
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x140038dcf
test rdx, rdx
je 0x140038dcf
mov rcx, rdx
call fcn.1401c15ec
xor edx, edx
mov word [rsp + 0x20], bp
mov r8d, 0x1fe
lea rcx, [rsp + 0x22]
mov rsi, rax
call fcn.1401d6880
mov r8d, 0x100
cmp rsi, r8
ja 0x140038da0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, esi
jne 0x140038da0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140038dac
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140009dd0
mov rbx, qword [rsp + 0x260]
add rsp, 0x230
pop rdi
pop rsi
pop rbp
ret
call fcn.1400156f8
int3
Function at 0x140039ec4
Capabilities:
Get file attributes
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14026f700]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov rdi, rcx
mov rcx, rbx
xor edx, edx
mov r8d, 0x230
call fcn.1401d6880
mov r8, qword [rdi + 0x18]
lea rcx, [rbx + 0x24]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.1401c191c
xor esi, esi
test eax, eax
je 0x140039f2a
cmp eax, 0xc
je 0x14003a0b5
cmp eax, 0x50
jne 0x14003a0bb
mov rcx, qword [rdi + 8]
cmp rcx, qword [0x1401e2320]
je 0x14003a08d
lea r9, [rbp - 0x11]
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x14003a0b1
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003a0b1
mov rax, qword [rbp - 9]
mov qword [rbx + 0x18], rax
mov rcx, qword [rdi + 0x18]
cmp dword [rcx - 0x10], esi
je 0x140039fa9
cmp qword [rdi + 0x20], rsi
je 0x140039f9e
mov rdx, rcx
lea r9, [rbp + 0xf]
mov rcx, qword [rdi + 0x20]
xor r8d, r8d
call fcn.140039e30
neg eax
sbb eax, eax
and eax, dword [rbp + 0xf]
jmp 0x140039fa4
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140039fab
mov eax, esi
mov rcx, rbx
mov dword [rbx + 0x20], eax
lea rcx, [rbp - 0x21]
lea rdx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x140039fee
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x140039fee
or r8d, 0xffffffff
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x29]
call fcn.14003a5a8
mov rcx, qword [rax]
mov qword [rbx], rcx
jmp 0x140039ff1
mov qword [rbx], rsi
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x14003a015
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x14003a021
lea rax, [rbx + 0x10]
mov rdi, rax
mov qword [rax], rsi
jmp 0x14003a03c
or r8d, 0xffffffff
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x29]
lea rdi, [rbx + 0x10]
call fcn.14003a5a8
mov rcx, qword [rax]
mov qword [rdi], rcx
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x14003a060
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x14003a065
mov rax, rsi
jmp 0x14003a079
or r8d, 0xffffffff
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x29]
call fcn.14003a5a8
mov rax, qword [rax]
mov qword [rbx + 8], rax
cmp qword [rbx], rsi
jne 0x14003a085
mov qword [rbx], rax
cmp qword [rdi], rsi
jne 0x14003a08d
mov qword [rdi], rax
mov eax, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140009dd0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x14003a092
call fcn.1400156b0
int3
call fcn.1400156f8
int3
Function at 0x14003b2f4
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov r13, r8
mov edx, 1
mov r15, rcx
mov r12d, edx
mov r14d, edx
lea rdi, [rsi + 0x18]
cmp dword [rsi + 0x10], edx
jle 0x14003b38d
lea ebx, [rdx + 7]
lea ebp, [rdx + 0xf]
test r13, r13
je 0x14003b352
mov rax, qword [r15 + 0x10]
cmp qword [rax + rbp + 8], r13
je 0x14003b352
mov rax, qword [rdi]
cmp qword [rbx + rax], 0
je 0x14003b377
xor r12d, r12d
jmp 0x14003b377
mov rax, qword [rdi]
mov rcx, qword [rbx + rax]
test rcx, rcx
je 0x14003b36f
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x14002edca.0]
mov edx, 1
mov rax, qword [rdi]
and qword [rbx + rax], 0
add r14d, edx
add rbp, 0x10
add rbx, 8
cmp r14d, dword [rsi + 0x10]
jl 0x14003b333
test r12d, r12d
je 0x14003b3d5
lea rcx, [r15 + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [r15 + 0x18]
mov rdx, rsi
call fcn.14003ad6c
lea rcx, [r15 + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
mov rax, qword [rax]
call qword [case.0x14002edca.0]
mov ecx, dword [r15]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14003c0dc
Capabilities:
Identify system language via api

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14026f700]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edi, ecx
xor esi, esi
mov rcx, qword [0x14027b9e8]
mov r12, r9
mov r15, r8
mov r14, rdx
test rcx, rcx
jne 0x14003c14c
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003c173
lea rdx, str.GetThreadPreferredUILanguages
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14027b9e8], rax
jmp 0x14003c155
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rbx, rax
test rbx, rbx
je 0x14003c173
mov r9, r12
mov r8, r15
mov rdx, r14
mov ecx, edi
mov rax, rbx
call qword [case.0x14002edca.0]
jmp 0x14003c2b5
mov dword [r14], esi
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
mov r8d, 7
mov ecx, esi
lea rdx, [rbp - 0x20]
call fcn.14003bf30
lea rcx, [rbp - 0x20]
call fcn.1401c15ec
mov edx, dword [r12]
lea r8, [rbp - 0x20]
mov rcx, r15
lea rdi, [rax + 1]
call fcn.1401c1544
inc dword [r14]
lea rdx, [rbp - 0x20]
and esi, 0x3ff
mov r8d, 7
mov ecx, esi
call fcn.14003bf30
lea rcx, [rbp - 0x20]
call fcn.1401c15ec
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
lea rbx, [rax + 1]
call fcn.1401c1544
inc dword [r14]
add rdi, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx esi, ax
mov r8d, 7
mov ecx, esi
lea rdx, [rbp - 0x20]
call fcn.14003bf30
lea rcx, [rbp - 0x20]
call fcn.1401c15ec
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
lea rbx, [rax + 1]
call fcn.1401c1544
inc dword [r14]
lea rdx, [rbp - 0x20]
and esi, 0x3ff
mov r8d, 7
mov ecx, esi
add rdi, rbx
call fcn.14003bf30
lea rcx, [rbp - 0x20]
call fcn.1401c15ec
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
lea rbx, [rax + 1]
call fcn.1401c1544
inc dword [r14]
lea rdx, [rbp - 0x20]
mov r8d, 7
mov ecx, 0x800
add rdi, rbx
call fcn.14003bf30
lea rcx, [rbp - 0x20]
call fcn.1401c15ec
mov edx, dword [r12]
lea rcx, [r15 + rdi*2]
sub rdx, rdi
lea r8, [rbp - 0x20]
mov rbx, rax
call fcn.1401c1544
inc dword [r14]
lea rcx, [rdi + rbx]
xor eax, eax
mov word [r15 + rcx*2 + 2], ax
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140009dd0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14003d380
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14003d3a6
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140023aa4
jmp 0x14003d412
cmp byte [0x14027baa0], 0
jne 0x14003d3ea
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003d3da
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14027ba98], rax
jmp 0x14003d3e1
mov rax, qword [0x14027ba98]
mov byte [0x14027baa0], 1
jmp 0x14003d3f1
mov rax, qword [0x14027ba98]
mov rdx, rdi
mov rcx, qword [rbx]
test rax, rax
je 0x14003d40b
xor r9d, r9d
mov r8d, dword [rbx + 8]
call qword [case.0x14002edca.0]
jmp 0x14003d412
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14003daa8
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x78
mov rdi, rcx
mov esi, 1
mov rax, qword [rcx + 0x20]
neg rax
sbb rdx, rdx
mov qword [rbp + 0x30], rdx
cmp qword [rcx + 0x20], 0
je 0x14003db96
xor esi, esi
and qword [rbp - 0x28], rsi
and dword [rbp - 0x20], esi
and qword [rbp - 0x18], rsi
mov rax, qword [rcx]
lea rdx, [rbp + 0x40]
mov rax, qword [rax + 0x40]
call qword [case.0x14002edca.0]
nop
mov rbx, qword [rax]
call fcn.140014b70
xor edx, edx
mov rcx, qword [rax + 8]
call fcn.140023650
nop
and qword [rbp + 0x38], rsi
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x38], rcx
and qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, eax
test eax, eax
jne 0x14003db52
mov rax, qword [rbp + 0x38]
mov qword [rbp - 0x28], rax
and dword [rbp - 0x20], ecx
mov eax, ecx
neg eax
sbb ebx, ebx
and ebx, ecx
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003db7f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14002edca.0]
test ebx, ebx
je 0x14003dc82
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14003db96
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
add rsp, 0x78
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140014d34
mov rcx, rax
test rax, rax
je 0x14003dcb1
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14002edca.0]
add rax, 0x18
mov qword [rbp + 0x28], rax
call fcn.140014d34
mov rcx, rax
test rax, rax
je 0x14003dca6
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14002edca.0]
add rax, 0x18
mov qword [rbp + 0x38], rax
lea rcx, [rdi + 8]
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x30]
call fcn.140040044
mov rbx, qword [rbp + 0x38]
test rbx, rbx
je 0x14003dc3b
mov rcx, rbx
call fcn.1401c15ec
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003dc5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14002edca.0]
nop
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003dc82
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14002edca.0]
cmp qword [rbp + 0x30], 0
jne 0x14003dba1
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14003dc9c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x14003db98
mov ecx, 0x80004005
call fcn.14000151c
nop
mov ecx, 0x80004005
call fcn.14000151c
int3