joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140063b10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rax, qword [0x1403bf028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rcx + 0x10]
mov rax, rcx
cmp qword [rcx + 0x18], 8
jb 0x140063b44
mov rax, qword [rcx]
lea r8, [rax + rdi*2]
jb 0x140063b4d
mov rcx, qword [rcx]
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.14002a4e8
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140063b67
mov rcx, qword [rax]
movabs rbx, 0xcbf29ce484222325
movabs r9, 0x100000001b3
xor r8d, r8d
test rcx, rcx
je 0x140063bae
mov rdx, rcx
lea rax, [rdi + rcx]
cmp rcx, rax
cmova rdi, r8
test rdi, rdi
je 0x140063bae
movzx eax, byte [rdx]
xor rbx, rax
imul rbx, r9
inc rdx
mov rax, rdx
sub rax, rcx
cmp rax, rdi
jb 0x140063b96
lea r8, [0x1402cbb60]
mov rdx, r8
lea rax, str.LastError
cmp rax, r8
sbb rcx, rcx
not rcx
and ecx, 0x10
jbe 0x140063be5
movzx eax, byte [rdx]
xor rbx, rax
imul rbx, r9
inc rdx
mov rax, rdx
sub rax, r8
cmp rax, rcx
jb 0x140063bcd
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x140063c1a
mov rcx, qword [rsp + 0x28]
mov rdx, rcx
inc rax
cmp rax, 0x1000
jb 0x140063c14
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140063c35
call fcn.140261814
nop
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1402361b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
call fcn.140261a5c
nop
jmp 0x140063c40
nop
nop
nop
nop

Function at 0x1400680b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rbx, qword [r9 + 0x10]
jb 0x1400680d2
mov r9, qword [r9]
xor ecx, ecx
movabs r11, 0xcbf29ce484222325
add rbx, rbx
je 0x140068101
movzx eax, byte [rcx + r9]
movabs rdx, 0x100000001b3
xor r11, rax
inc rcx
imul r11, rdx
cmp rcx, rbx
jb 0x1400680e3
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, r11
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140068139
cmp qword [rcx + rdx*8], r8
jne 0x14006812e
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x140068132
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140068146
cmp qword [rcx + rdx*8], r8
jne 0x140068146
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rdx, r8
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
call fcn.140044e3c
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140074fc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rcx, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x140074ff9
movzx eax, byte [rdx + r9]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, r8
jb 0x140074fdb
mov eax, ecx
ret
Function at 0x14007f098
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x3e0
mov rax, qword [0x1403bf028]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x14007f16c
cmp qword [rdx + 0x18], 8
mov dword [rsp + 0x30], 0xb
mov dword [rsp + 0x34], 8
jb 0x14007f0e4
mov rdx, qword [rdx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14007f134
cmp eax, 2
je 0x14007f111
cmp eax, 0xea
jne 0x14007f13f
xor al, al
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.1402361b0
mov rbx, qword [rsp + 0x408]
add rsp, 0x3e0
pop rdi
ret
cmp dword [rsp + 0x30], 0xb
jne 0x14007f111
mov al, 1
jmp 0x14007f113
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140080858
lea rdx, [0x14033b8e8]
lea rcx, [rsp + 0x40]
call fcn.1402395b8
int3
lea r8, str.ORegistryKey.GetValue_failure:_Cannot_get_QWORD_value._The_registry_key_is_closed_or_not_set
lea rcx, [rsp + 0x40]
call fcn.140080790
lea rdx, [0x14033b8e8]
lea rcx, [rsp + 0x40]
call fcn.1402395b8
int3
Function at 0x14007f190
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x1403bf028]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov r14, rcx
xor r15d, r15d
mov rcx, qword [rcx + 0x30]
mov rbx, r8
mov rdi, rdx
test rcx, rcx
je 0x14007f354
cmp qword [rdx + 0x18], 8
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x30], r15d
jb 0x14007f1ec
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r8d, eax
cmp eax, 2
je 0x14007f2ff
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x14007f2ff
test r8d, r8d
jne 0x14007f373
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14007f23a
mov rcx, qword [rbx]
lea rsi, [rbx + 0x10]
mov qword [rsi], r15
mov word [rcx], r15w
cmp dword [rsp + 0x30], 2
ja 0x14007f253
mov al, 1
jmp 0x14007f301
mov edx, dword [rsp + 0x30]
shr rdx, 1
dec rdx
cmp rdx, qword [rsi]
ja 0x14007f279
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14007f26f
mov rax, qword [rbx]
mov qword [rsi], rdx
mov word [rax + rdx*2], r15w
jmp 0x14007f287
sub rdx, qword [rsi]
xor r8d, r8d
mov rcx, rbx
call fcn.14000b13c
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14007f294
mov rax, qword [rbx]
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x14007f2a1
mov rdx, qword [rdi]
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x34]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007f327
mov edx, dword [rsp + 0x30]
shr rdx, 1
dec rdx
cmp rdx, qword [rsi]
ja 0x14007f2ec
cmp qword [rbx + 0x18], 8
jb 0x14007f2df
mov rbx, qword [rbx]
mov qword [rsi], rdx
mov word [rbx + rdx*2], r15w
jmp 0x14007f24c
sub rdx, qword [rsi]
xor r8d, r8d
mov rcx, rbx
call fcn.14000b13c
jmp 0x14007f24c
xor al, al
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.1402361b0
mov rbx, qword [rsp + 0x428]
add rsp, 0x3e0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rcx, [r14 + 0x10]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140080858
lea rdx, [0x14033b8e8]
lea rcx, [rsp + 0x40]
call fcn.1402395b8
int3
mov r9, rdi
lea rcx, [rsp + 0x40]
call fcn.140080968
lea rdx, [0x14033b8e8]
lea rcx, [rsp + 0x40]
call fcn.1402395b8
int3
lea rax, [r14 + 0x10]
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.140080858
lea rdx, [0x14033b8e8]
lea rcx, [rsp + 0x40]
call fcn.1402395b8
int3
Function at 0x1400824a4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x3e0
mov rax, qword [0x1403bf028]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x140082578
cmp qword [rdx + 0x18], 8
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], 4
jb 0x1400824f0
mov rdx, qword [rdx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140082540
cmp eax, 2
je 0x14008251d
cmp eax, 0xea
jne 0x14008254b
xor al, al
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.1402361b0
mov rbx, qword [rsp + 0x408]
add rsp, 0x3e0
pop rdi
ret
cmp dword [rsp + 0x30], 4
jne 0x14008251d
mov al, 1
jmp 0x14008251f
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140080858
lea rdx, [0x14033b8e8]
lea rcx, [rsp + 0x40]
call fcn.1402395b8
int3
lea r8, str.ORegistryKey.GetValue_failure:_Cannot_get_DWORD_value._The_registry_key_is_closed_or_not_set
lea rcx, [rsp + 0x40]
call fcn.140080790
lea rdx, [0x14033b8e8]
lea rcx, [rsp + 0x40]
call fcn.1402395b8
int3
Function at 0x140085208
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov r11, r8
mov rbx, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 8
jb 0x140085220
mov r8, qword [rbx + 0x30]
mov r10, qword [rbx + 0x18]
and r8, r9
add r8, r8
mov r9, qword [r10 + r8*8]
mov rcx, r9
cmp r9, qword [rbx + 8]
jne 0x140085260
mov rax, qword [rbx + 8]
jmp 0x140085268
mov rax, qword [r10 + r8*8 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x14008527b
mov rax, qword [r11]
cmp qword [rcx + 0x10], rax
je 0x14008527f
mov rcx, qword [rcx]
jmp 0x140085254
mov rcx, qword [rbx + 8]
mov qword [rdx], rcx
mov rax, rdx
mov rbx, qword [rsp + 8]
ret

Function at 0x14008528c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x30
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r9, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + r9]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r8
cmp r8, 8
jb 0x1400852bb
mov r8, qword [rsi + 0x30]
and r8, rcx
add r8, r8
mov r11, qword [rsi + 0x18]
mov rbx, qword [r11 + r8*8]
mov rdx, qword [rsi + 8]
mov r10, rbx
cmp qword [r11 + r8*8], rdx
jne 0x1400852fe
mov rax, rdx
jmp 0x140085306
mov rax, qword [r11 + r8*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140085344
mov rcx, qword [r9]
cmp qword [rbx + 0x10], rcx
je 0x140085319
mov rbx, qword [rbx]
jmp 0x1400852f0
mov rdi, rbx
cmp qword [r11 + r8*8], rdx
jne 0x140085327
mov rax, rdx
jmp 0x14008532f
mov rax, qword [r11 + r8*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14008533f
cmp rcx, qword [rbx + 0x10]
jne 0x14008533f
mov rbx, qword [rbx]
jmp 0x14008531c
cmp r10, rbx
jne 0x14008534a
mov rdi, rdx
mov rbx, rdx
mov rax, rdi
xor ebp, ebp
cmp rdi, rbx
je 0x140085362
inc rbp
mov rcx, qword [rax]
mov rax, rcx
cmp rcx, rbx
jne 0x140085354
mov rcx, qword [rdx]
cmp rdi, rcx
jne 0x1400853b8
cmp rbx, rdx
jne 0x1400853b8
mov qword [rdx], rdx
mov rax, qword [rsi + 8]
mov qword [rax + 8], rax
and qword [rsi + 0x10], 0
cmp rcx, qword [rsi + 8]
je 0x140085396
mov rbx, qword [rcx]
call fcn.140261814
mov rcx, rbx
cmp rbx, qword [rsi + 8]
jne 0x140085385
mov edx, 8
mov rcx, rsi
call fcn.140035658
jmp 0x1400853bd
mov r8, rdi
mov rdi, qword [rdi]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400853d8
cmp rdi, rbx
jne 0x1400853a5
mov rax, rbp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400853d8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 8
jb 0x1400853f5
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14008544d
cmp qword [rcx + rdx*8], r8
jne 0x140085442
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x140085446
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14008545a
cmp qword [rcx + rdx*8], r8
jne 0x14008545a
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.140261814
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140085720
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r9, r8
mov r14, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r9]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x140085758
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rax, r8
add rax, rax
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov r10, qword [rcx + rax*8]
cmp r10, rdi
je 0x14008579d
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
mov rdx, rdi
cmp rdx, r10
je 0x1400857e6
mov rdi, qword [rdi + 8]
mov rdx, rdi
mov rax, qword [rdi + 0x10]
cmp qword [r9], rax
jne 0x1400857a0
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, rbx
call fcn.140261814
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14008590b
mov qword [rsp + 0x20], rbx
mov r9, qword [rbx]
cmp rdx, r9
je 0x140085820
mov rax, qword [rbx + 8]
mov qword [rax], r9
mov rax, qword [r9 + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rcx, qword [rdx + 8]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 8]
mov qword [r9 + 8], rax
mov qword [rbx + 8], rcx
add r8, r8
mov r9, qword [rsi + 0x18]
mov rax, qword [r9 + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140085840
mov qword [r9 + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14008586f
cmp rax, rdx
jne 0x14008584b
mov qword [r9 + r8*8], rbx
jmp 0x14008586f
mov rax, qword [r9 + r8*8 + 8]
mov rcx, qword [rax]
mov qword [r9 + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14008586f
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140333fc4]
test rax, rax
jns 0x140085890
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400858a1
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140085900
cmp rdx, 0x200
jae 0x1400858b9
shl rdx, 3
jmp 0x1400858cb
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400858cb
add rdx, rdx
mov rcx, rsi
call fcn.140035658
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140085900
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140085720
cmp rdi, r15
jne 0x1400858e0
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14008a4cc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
test rcx, rcx
jne 0x14008a4ed
xor eax, eax
jmp 0x14008a6ed
and dword [rbp + 0x50], 0
lea rdi, [0x1402cfb10]
xor r9d, r9d
lea r10, [0x1403ce9a8]
mov dword [rbp + 0x48], r9d
lea r13d, [r9 + 2]
mov cl, byte [rdi]
mov rdx, rbx
or dword [rbp + 0x40], 0xffffffff
call fcn.14008a468
mov r15d, eax
cmp eax, 0xffffffff
je 0x14008a692
and dword [rbp - 0x18], 0
mov rcx, r10
and dword [rbp - 0x14], 0
mov qword [rbp - 0x20], r10
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 1
lock xadd dword [rbp - 0x18], eax
test eax, eax
jne 0x14008a558
cmp dword [rbp - 0x14], eax
jne 0x14008a6fc
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rbp - 0x14], eax
mov ecx, dword [rbp + 0x40]
xor esi, esi
cmp esi, 4
jge 0x14008a67a
mov eax, dword [rbx + 0x1c]
lea rcx, [rbp - 0x10]
mov rdx, qword [rbx + 0x10]
mov r9d, r15d
and qword [rbp + 0x58], 0
xor r14b, r14b
mov dword [rsp + 0x20], eax
call fcn.1400896c4
mov rcx, rax
mov eax, dword [rax]
mov dword [rbp + 0x40], eax
mov rax, qword [rcx + 8]
and qword [rcx + 8], 0
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x58], rax
test rcx, rcx
je 0x14008a5b0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14008a5cb
and qword [rbp - 8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov ecx, dword [rbp + 0x40]
test ecx, ecx
jne 0x14008a64e
mov rax, qword [rbp + 0x58]
lea rcx, [rbp + 0x48]
mov rdx, qword [rbx]
lea r9, [rbp + 0x50]
mov qword [rsp + 0x28], rcx
xor r8d, r8d
and qword [rsp + 0x20], 0
mov rcx, qword [rax + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov dword [rbp + 0x40], eax
cmp dword [rbp + 0x48], r13d
jae 0x14008a613
mov eax, dword [rbp + 0x50]
dec eax
cmp eax, 1
cmovbe ecx, r13d
mov dword [rbp + 0x40], ecx
cmp ecx, 0x3f2
je 0x14008a628
cmp ecx, 0x3fa
je 0x14008a628
cmp ecx, 6
jne 0x14008a64e
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1403c35d0]
movzx eax, word [rcx + 0xa]
and eax, 0x1f
shl rax, 5
and qword [rax + rdx], 0
call fcn.140084fdc
mov ecx, dword [rbp + 0x40]
mov r14b, 1
mov rdx, qword [rbp + 0x58]
test rdx, rdx
je 0x14008a66f
and qword [rbp + 0x58], 0
mov rcx, rdx
mov rax, qword [rdx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov ecx, dword [rbp + 0x40]
inc esi
test r14b, r14b
jne 0x14008a55d
test ecx, ecx
lea rcx, [rbp - 0x20]
je 0x14008a6a6
call fcn.1400261e0
mov r9d, dword [rbp + 0x48]
lea r10, [0x1403ce9a8]
inc rdi
lea rax, [0x1402cfb13]
cmp rdi, rax
je 0x14008a6af
jmp 0x14008a50a
call fcn.1400261e0
mov r9d, dword [rbp + 0x48]
cmp dword [rbp + 0x40], 0
jne 0x14008a6df
cmp dword [rbp + 0x50], r13d
je 0x14008a6c5
mov al, byte [rbx + 0x18]
and al, 0xf
cmp al, r13b
jne 0x14008a6ea
cmp r9d, 0x82
jae 0x14008a6d6
mov r9d, 0x208
jmp 0x14008a6ea
add r9d, 0x104
jmp 0x14008a6ea
mov rcx, rbx
call fcn.14008d17c
mov r9d, eax
mov eax, r9d
add rsp, 0x50
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140025d34
int3
Function at 0x14008bedc
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [rcx + 0x10]
mov rbx, rcx
and dword [rbp + 0x20], 0
test byte [rax + 0xa], 0x1f
je 0x14008bf06
mov eax, 0xa0
jmp 0x14008c04a
and dword [rbp - 0x18], 0
lea rcx, [0x1403ce9a8]
and dword [rbp - 0x14], 0
mov qword [rbp - 0x20], rcx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 1
lock xadd dword [rbp - 0x18], eax
test eax, eax
jne 0x14008bf3e
cmp dword [rbp - 0x14], eax
jne 0x14008c05a
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rbp - 0x14], eax
xor edi, edi
cmp edi, 4
jge 0x14008c03c
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp - 0x10]
and qword [rbp + 0x28], 0
xor r9d, r9d
mov eax, dword [rbx + 0x1c]
xor sil, sil
mov dword [rsp + 0x20], eax
mov rdx, qword [rdx + 0x10]
call fcn.1400896c4
mov ecx, dword [rax]
mov dword [rbp + 0x20], ecx
mov rcx, qword [rax + 8]
and qword [rax + 8], 0
mov rdx, qword [rbp + 0x28]
mov qword [rbp + 0x28], rcx
test rdx, rdx
je 0x14008bf9b
mov rax, qword [rdx]
mov rcx, rdx
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x14008bfbd
and qword [rbp - 8], 0
mov rcx, rdx
mov rax, qword [rdx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov rcx, qword [rbp + 0x28]
cmp dword [rbp + 0x20], 0
jne 0x14008c01a
mov rax, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x10]
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rbp + 0x20], eax
cmp eax, 0x3f2
je 0x14008bfea
cmp eax, 0x3fa
je 0x14008bfea
cmp eax, 6
jne 0x14008c00d
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1403c35d0]
movzx eax, word [rcx + 0xa]
and eax, 0x1f
shl rax, 5
and qword [rax + rdx], 0
call fcn.140084fdc
mov sil, 1
mov rcx, qword [rbx + 0x10]
call fcn.140084fdc
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14008c031
and qword [rbp + 0x28], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
inc edi
test sil, sil
jne 0x14008bf40
mov ebx, dword [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.1400261e0
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140025d34
int3
Function at 0x14008c068
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
test rcx, rcx
je 0x14008c17e
and dword [rbp - 0x18], 0
lea rcx, [0x1403ce9a8]
and dword [rbp - 0x14], 0
mov qword [rbp - 0x20], rcx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 1
lock xadd dword [rbp - 0x18], eax
test eax, eax
jne 0x14008c0b9
cmp dword [rbp - 0x14], eax
jne 0x14008c171
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rbp - 0x14], eax
and qword [rbp + 0x18], 0
lea rcx, [rbp - 0x10]
and dword [rbp + 0x10], 0
mov rdx, rbx
call fcn.14008b9b0
mov ecx, dword [rax]
mov dword [rbp + 0x10], ecx
mov r8, qword [rax + 8]
and qword [rax + 8], 0
mov rcx, qword [rbp + 0x18]
mov qword [rbp + 0x18], r8
test rcx, rcx
je 0x14008c0fa
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov r8, qword [rbp + 0x18]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14008c119
and qword [rbp - 8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov r8, qword [rbp + 0x18]
mov ebx, dword [rbp + 0x10]
test ebx, ebx
je 0x14008c132
test r8, r8
je 0x14008c15b
and qword [rbp + 0x18], 0
mov rcx, r8
mov rdx, qword [r8]
jmp 0x14008c151
mov rcx, qword [r8 + 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rbp + 0x18]
mov ebx, eax
test rcx, rcx
je 0x14008c15b
and qword [rbp + 0x18], 0
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
call qword [case.0x140118f85.0]
lea rcx, [rbp - 0x20]
call fcn.1400261e0
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140025d34
int3
xor edx, edx
mov ecx, 0x230239f
call fcn.140025d34
int3