joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004fe20
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400a3310]
xor rax, rsp
mov qword [rsp + 0x58], rax
neg byte [rsp + 0xa8]
mov rsi, r9
mov rbx, r8
sbb eax, eax
and eax, 0xfffe00fc
add eax, 0x20006
cmp qword [rdx + 0x18], 8
jb 0x14004fe5a
mov rdx, qword [rdx]
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], r8
xor r9d, r9d
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], eax
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test eax, eax
jne 0x14004fed4
cmp qword [rbx + 0x10], 0
jne 0x14004fe96
xor ebx, ebx
jmp 0x14004fea0
cmp qword [rbx + 0x18], 8
jb 0x14004fea0
mov rbx, qword [rbx]
mov eax, dword [rsp + 0xa0]
mov r9d, 3
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400652d0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x140050050
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a3310]
xor rax, rsp
mov qword [rsp + 0x38], rax
neg byte [rsp + 0x80]
mov rsi, r9
mov rbx, r8
sbb r9d, r9d
and r9d, 0xfffe00fc
add r9d, 0x20006
cmp qword [rdx + 0x18], 8
jb 0x14005008f
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400500eb
cmp qword [rbx + 0x10], 0
jne 0x1400500b3
xor ebx, ebx
jmp 0x1400500bd
cmp qword [rbx + 0x18], 8
jb 0x1400500bd
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x30]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400652d0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
push rbx
mov al, byte [rsp + 0x38]
mov r10, r9
mov r9, qword [rsp + 0x30]
mov r11, r8
mov rcx, rdx
mov byte [rsp + 0x30], al
mov r8, r10
mov rdx, r11
pop rbx
jmp 0x140050050
Function at 0x140050110
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400a3310]
xor rax, rsp
mov qword [rsp + 0x58], rax
neg byte [rsp + 0xa0]
mov rsi, r9
mov rbx, r8
sbb eax, eax
and eax, 0xfffe00fc
add eax, 0x20006
cmp qword [rdx + 0x18], 8
jb 0x14005014a
mov rdx, qword [rdx]
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], r8
xor r9d, r9d
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], eax
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test eax, eax
jne 0x1400501c1
cmp qword [rbx + 0x10], 0
jne 0x140050186
xor ebx, ebx
jmp 0x140050190
cmp qword [rbx + 0x18], 8
jb 0x140050190
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x50]
mov r9d, 0xb
mov dword [rsp + 0x28], 8
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400652d0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x140050340
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a3310]
xor rax, rsp
mov qword [rsp + 0x38], rax
neg byte [rsp + 0x80]
mov rdi, r9
mov rbx, r8
sbb r9d, r9d
and r9d, 0xfffe00fc
add r9d, 0x20006
cmp qword [rdx + 0x18], 8
jb 0x14005037f
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x1400503f4
cmp qword [rdi + 0x18], 8
mov eax, dword [rdi + 0x10]
lea eax, [rax*2 + 2]
jb 0x1400503ac
mov rdi, qword [rdi]
movzx r9d, byte [rsp + 0x88]
inc r9d
cmp qword [rbx + 0x10], 0
jne 0x1400503c3
xor ebx, ebx
jmp 0x1400503cd
cmp qword [rbx + 0x18], 8
jb 0x1400503cd
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovle eax, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400652d0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140050418
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
cmp qword [rdx + 0x18], 8
mov r10, r8
mov eax, dword [rdx + 0x10]
lea eax, [rax*2 + 2]
jb 0x140050433
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x14005043d
mov rcx, qword [rcx]
mov dword [rsp + 0x28], eax
mov r8, rcx
mov qword [rsp + 0x20], rdx
mov r9d, 2
lea rdx, str.Environment
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
shr eax, 0x1f
xor al, 1
add rsp, 0x38
ret
mov rax, r8
mov rcx, rdx
mov rdx, rax
mov r8, r9
jmp 0x140050418
Function at 0x140050484
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov ecx, eax
mov eax, 0x8f
cmp ecx, eax
jg 0x1400504f1
je 0x1400504c7
cmp ecx, 0x54
jg 0x1400504ce
je 0x1400504c7
add ecx, 0xfffffff2
cmp ecx, 0x3f
ja 0x14005055e
movabs rax, 0xa140a00000200081
bt rax, rcx
jae 0x14005055e
mov al, 1
add rsp, 0x28
ret
sub ecx, 0x5e
je 0x1400504c7
sub ecx, 4
je 0x1400504c7
sub ecx, 0xa
je 0x1400504c7
sub ecx, 1
je 0x1400504c7
sub ecx, 1
je 0x1400504c7
sub ecx, 8
je 0x1400504c7
sub ecx, 0x16
jmp 0x14005054f
mov eax, 0xc8
cmp ecx, eax
jg 0x140050527
je 0x1400504c7
sub ecx, 0x91
je 0x1400504c7
sub ecx, 2
je 0x1400504c7
sub ecx, 0x10
je 0x1400504c7
sub ecx, 0xd
je 0x1400504c7
sub ecx, 1
je 0x1400504c7
sub ecx, 0xe
je 0x1400504c7
sub ecx, 2
je 0x1400504c7
cmp ecx, 5
jmp 0x140050558
sub ecx, 0xd4
je 0x1400504c7
sub ecx, 5
je 0x1400504c7
sub ecx, 4
je 0x1400504c7
sub ecx, 2
je 0x1400504c7
sub ecx, 0x5e
je 0x1400504c7
sub ecx, 4
je 0x1400504c7
sub ecx, 9
je 0x1400504c7
cmp ecx, 1
je 0x1400504c7
xor al, al
jmp 0x1400504c9
jmp 0x140050484

Function at 0x140050568
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400a3310]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [str.EnableUpgradeOnBlue]
xor ebx, ebx
lea rax, [r11 - 0x48]
movups xmm1, xmmword [0x140074730]
mov qword [r11 - 0x58], rax
lea r8, [r11 - 0x40]
mov qword [r11 - 0x60], rcx
lea rax, [r11 - 0x44]
movups xmmword [rsp + 0x48], xmm0
lea r9d, [rbx + 0x10]
mov rdi, rcx
movsd xmm0, qword [0x140074740]
lea rdx, str.SoftwareMicrosoftOneDriveUpgrade
mov dword [rcx], ebx
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], 4
movups xmmword [rsp + 0x58], xmm1
mov qword [r11 - 0x68], rax
movsd qword [rsp + 0x68], xmm0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400505fd
mov eax, dword [rdi]
dec eax
cmp eax, 1
setbe bl
mov al, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400652d0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x140050f64
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [0x1400a3310]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r14, rdx
mov rsi, rcx
lea rdx, [0x14008306c]
mov rcx, r9
mov rdi, r9
mov r15, r8
call fcn.14000c69c
and dword [r15], 0
lea rcx, [rsp + 0x54]
and dword [r14], 0
xor edx, edx
and dword [rsi], 0
mov r8d, 0x118
xor bl, bl
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140051046
mov eax, dword [rsp + 0x54]
lea r8, str.BuildLab
mov dword [rsi], eax
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov eax, dword [rsp + 0x58]
mov r9d, 2
mov dword [r14], eax
mov bl, 1
mov eax, dword [rsp + 0x5c]
mov dword [r15], eax
lea rax, [rsp + 0x40]
mov rcx, qword [0x1400a3050]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0x118
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
js 0x140051046
mov rdx, rdi
lea rcx, [rsp + 0x170]
call fcn.140050c40
mov al, bl
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400652d0
add rsp, 0x2a0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rax, r9
mov r10, r8
mov r9, qword [rsp + 0x28]
mov rcx, rdx
mov r8, rax
mov rdx, r10
jmp 0x140050f64

Function at 0x1400542a0
Capabilities:
Modify service

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [rdx + 0x48]
mov rcx, qword [rdx]
mov r9d, dword [rdx + 0x10]
mov r8d, dword [rdx + 0xc]
mov qword [r11 - 0x18], rax
mov rax, qword [rdx + 0x40]
mov qword [r11 - 0x20], rax
mov rax, qword [rdx + 0x38]
mov qword [r11 - 0x28], rax
mov rax, qword [rdx + 0x30]
mov qword [r11 - 0x30], rax
mov rax, qword [rdx + 0x28]
mov qword [r11 - 0x38], rax
mov rax, qword [rdx + 0x20]
mov qword [r11 - 0x40], rax
mov rax, qword [rdx + 0x18]
mov edx, dword [rdx + 8]
mov qword [r11 - 0x48], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
add rsp, 0x68
ret

Function at 0x140054480
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, [rsp + 0x20]
mov rbx, r8
call fcn.140040894
cmp qword [rax + 0x18], 8
jb 0x14005449d
mov rax, qword [rax]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140004738
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x1400545c0
Capabilities:
Create service

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [rdx + 0x50]
mov rcx, qword [rdx]
mov r9d, dword [rdx + 0x18]
mov r8, qword [rdx + 0x10]
mov qword [r11 - 0x18], rax
mov rax, qword [rdx + 0x48]
mov qword [r11 - 0x20], rax
mov rax, qword [rdx + 0x40]
mov qword [r11 - 0x28], rax
mov rax, qword [rdx + 0x38]
mov qword [r11 - 0x30], rax
mov rax, qword [rdx + 0x30]
mov qword [r11 - 0x38], rax
mov rax, qword [rdx + 0x28]
mov qword [r11 - 0x40], rax
mov eax, dword [rdx + 0x24]
mov dword [rsp + 0x30], eax
mov eax, dword [rdx + 0x20]
mov dword [rsp + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov rdx, qword [rdx + 8]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
add rsp, 0x78
ret

Function at 0x1400546f0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, [rsp + 0x20]
call fcn.140040894
cmp qword [rax + 0x18], 8
jb 0x14005470a
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140004738
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x140054a00
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, [rsp + 0x20]
call fcn.140040894
cmp qword [rax + 0x18], 8
jb 0x140054a1a
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140004738
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x140055240
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov r10, r9
mov r9, qword [rsp + 0x70]
mov r11d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdx
mov rax, qword [rsp + 0x88]
mov r8, r10
mov qword [rsp + 0x30], rax
mov edx, r11d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add rsp, 0x40
pop rbx
ret

Function at 0x1400552c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov r10, r9
mov r9, qword [rsp + 0x70]
mov r11d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdx
mov rax, qword [rsp + 0x88]
mov r8, r10
mov qword [rsp + 0x30], rax
mov edx, r11d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add rsp, 0x40
pop rbx
ret

Function at 0x140055320
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x88]
mov r10, r9
mov r9d, dword [rsp + 0x70]
mov r11, r8
mov qword [rsp + 0x30], rax
mov rcx, rdx
mov rax, qword [rsp + 0x80]
mov r8, r10
mov qword [rsp + 0x28], rax
mov rdx, r11
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
add rsp, 0x40
pop rbx
ret
Function at 0x140055420
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add rsp, 0x30
pop rbx
ret

Function at 0x140055460
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov r10, r9
mov r9d, dword [rsp + 0x60]
mov r11, r8
mov dword [rsp + 0x28], eax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
add rsp, 0x30
pop rbx
ret

Function at 0x1400554a0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov r10d, r9d
mov r9d, dword [rsp + 0x60]
mov r11, r8
mov dword [rsp + 0x28], eax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8d, r10d
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
pop rbx
ret

Function at 0x140055540
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, [rsp + 0x20]
call fcn.140040894
cmp qword [rax + 0x18], 8
jb 0x14005555a
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140004738
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x1400558a0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9d, dword [rsp + 0x60]
mov r11d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8, r10
mov edx, r11d
mov qword [rsp + 0x20], rax
call sub.SHELL32.dll_SHGetFolderPathAndSubDirW
add rsp, 0x30
pop rbx
ret

Function at 0x140055aa0
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x40
lea rcx, [rsp + 0x20]
mov ebx, r8d
call fcn.140040894
cmp qword [rax + 0x18], 8
jb 0x140055abd
mov rax, qword [rax]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140004738
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x140056018
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400a3310]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r14b, r8b
mov esi, edx
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov qword [rcx], r15
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 7
mov word [rcx], r15w
mov dword [rsp + 0x30], 1
call fcn.1400429b0
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x388]
call qword [case.0x140023da2.8]
mov dil, al
test al, al
jne 0x14005614a
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14005614a
lea rdx, [0x1400776f0]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
je 0x14005614a
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x1400560f3
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140004600
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], 9
lea r9, str._allusers
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
call fcn.1400044a8
cmp rax, 0xffffffffffffffff
setne dil
lea rcx, [rsp + 0x40]
call fcn.140004738
mov rdx, rbx
mov cl, dil
call fcn.140048c88
mov r8d, 1
lea rdx, [0x140085e8c]
mov rcx, rbx
call fcn.140010230
mov dl, r14b
mov ecx, esi
call fcn.14005638c
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1400149d4
mov dword [rsp + 0x30], 3
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, rbx
call fcn.140010230
nop
lea rcx, [rsp + 0x40]
call fcn.140004738
mov rax, rbx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400652d0
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x280
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140057c30
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x1400a3310]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
mov dword [rbp - 0x39], 1
cmp qword [rdx + 0x18], 8
jb 0x140057c6f
mov rdx, qword [rdx]
xor r12d, r12d
mov qword [rbp - 0x31], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
or rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp word [rdx + r8*2], r12w
jne 0x140057c85
lea rcx, [rbp - 0x31]
call fcn.140004600
nop
mov r9, r15
mov r8, rsi
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x31]
call fcn.140057e1c
mov r14d, eax
lea rcx, [rbp - 0x31]
call fcn.140004738
mov dword [rbp - 0x39], 2
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140057ccc
mov rdx, qword [rbx]
mov qword [rbp - 0x31], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
mov r8, rdi
inc r8
cmp word [rdx + r8*2], r12w
jne 0x140057cdb
lea rcx, [rbp - 0x31]
call fcn.140004600
nop
mov r9, r15
mov r8, rsi
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x31]
call fcn.140057e1c
nop
lea rcx, [rbp - 0x31]
call fcn.140004738
mov rdx, qword [str._s_a_]
mov qword [rbp - 9], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
inc rdi
cmp word [rdx + rdi*2], r12w
jne 0x140057d1f
mov r8, rdi
lea rcx, [rbp - 9]
call fcn.140004600
nop
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140057d43
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rbp - 9]
call fcn.140010230
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rdx, qword [rbp - 9]
xor r9d, r9d
mov edi, 0x1010b
mov r8d, edi
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rdx, qword [str.0t_a_]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x140057de0
cmp qword [rbx + 0x18], 8
jb 0x140057dbb
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140057ed8
test esi, esi
cmovne edi, esi
test r14d, r14d
cmovne edi, r14d
lea rcx, [rbp - 9]
call fcn.140004738
mov eax, edi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400652d0
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14005c888
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x1400a3310]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov r14, r8
mov esi, edx
mov rbx, rcx
lea rdx, [0x14008306c]
mov rcx, r8
call fcn.14000c69c
mov edi, 0x80004004
mov rcx, qword [rbx]
mov rax, qword [rcx + 8]
mov rbx, rcx
jmp 0x14005c8ef
cmp dword [rax + 0x20], esi
jge 0x14005c8e9
mov rax, qword [rax + 0x10]
jmp 0x14005c8ef
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14005c8de
cmp byte [rbx + 0x19], 0
jne 0x14005ca0c
cmp esi, dword [rbx + 0x20]
jl 0x14005ca0c
cmp rbx, rcx
je 0x14005ca0c
and dword [rsp + 0x44], 0
mov esi, 0x400
mov r8d, esi
xor edx, edx
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], esi
xor eax, eax
mov qword [rsp + 0x58], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
and qword [rsp + 0x58], rax
lea r8, [rbx + 0x28]
lea r9, [r8 + 8]
mov rcx, qword [r9]
sub rcx, qword [r8]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14005b9d0
nop
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
cmp rbx, rsi
je 0x14005ca02
add rbx, 0x28
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x14005c997
mov r8, qword [rbx]
lea rdx, [rbx - 0x20]
cmp qword [rbx - 8], 8
jb 0x14005c9a5
mov rdx, qword [rdx]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001b
mov rcx, qword [rbx - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x14005c9f4
add rbx, 0x50
lea rax, [rbx - 0x28]
cmp rax, rsi
jne 0x14005c98a
jmp 0x14005ca02
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.14000c69c
nop
lea rcx, [rsp + 0x48]
call fcn.140027758
mov eax, edi
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.1400652d0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14005fae0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x1400a3310]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edi, edi
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x140044fc2
mov rcx, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140045007
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp qword [rbx + 0x18], 8
jb 0x140044fe6
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140045007
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400652d0
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret
mov rcx, rdx
jmp 0x140044f94