joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a454
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x40
mov qword [r11 - 0x18], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rdi, r8
and qword [r8], 0
and qword [r11 + 8], 0
lea rax, [r11 + 8]
mov qword [r11 - 0x28], rax
mov r9d, 0x2000000
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWBEMPROVIDERSPerformance
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14000a54b
and dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Performance_Data
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x14000a540
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x14000a540
mov ecx, eax
call fcn.14001930c
mov qword [rdi], rax
test rax, rax
je 0x14000a535
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Performance_Data
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x14000a53a
mov rcx, qword [rdi]
call sub.msvcrt.dll_free
and qword [rdi], 0
jmp 0x14000a53a
mov ebx, 0xe
jmp 0x14000a540
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x14000a56c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov rbx, r8
mov rsi, rdx
lea eax, [rdi + 0x57]
test rcx, rcx
je 0x14000a612
test rdx, rdx
je 0x14000a612
test rbx, rbx
je 0x14000a60d
and dword [r8], edi
lea rax, [r11 - 0x18]
and qword [r11 - 0x18], rdi
mov rdx, rcx
xor r8d, r8d
mov qword [r11 - 0x28], rax
mov rcx, 0xffffffff80000002
mov r9d, 0xf003f
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000a612
mov rdi, qword [rsp + 0x30]
test eax, eax
jne 0x14000a612
and dword [rsp + 0x50], eax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp dword [rsp + 0x50], 4
mov ecx, 0xd
cmovne eax, ecx
jmp 0x14000a612
mov eax, 0x80004003
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test rdi, rdi
je 0x14000a62e
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14000a648
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x20
lea r8, [rcx + 8]
mov rbx, rcx
lea rdx, [0x14001f340]
call 0x14000a648
lea r8, [rbx + 0xc]
lea rdx, str.First_Help
call 0x14000a648
lea r8, [rbx + 0x10]
lea rdx, str.Last_Counter
call 0x14000a648
lea r8, [rbx + 0x14]
lea rdx, str.Last_Help
add rsp, 0x20
pop rbx
jmp 0x14000a648
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov eax, dword [0x1400306e8]
mov rbx, r8
mov rdi, rdx
test al, 1
jne 0x14000a694
and qword [0x1400306f0], 0
lea rcx, [0x14001d4d0]
and qword [0x1400306f8], 0
or eax, 1
and qword [0x140030700], 0
mov dword [0x1400306e8], eax
call fcn.140019894
test rbx, rbx
je 0x14000a748
and dword [rbx], 0
mov rax, qword [0x1400306f0]
test rax, rax
jne 0x14000a707
and qword [rsp + 0x40], rax
lea rdx, str.SYSTEMCurrentControlSetServicesWmiApRplPerformance
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
mov rax, qword [0x1400306f0]
jne 0x14000a703
xor ecx, ecx
test rax, rax
je 0x14000a6f7
mov rcx, rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, eax
mov rax, qword [rsp + 0x40]
mov qword [0x1400306f0], rax
test ecx, ecx
jne 0x14000a74d
and dword [rsp + 0x40], 0
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x50], 4
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 4
mov ecx, eax
mov eax, 0xd
cmovne ecx, eax
jmp 0x14000a74d
mov ecx, 0x80004003
mov rbx, qword [rsp + 0x48]
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
add rsp, 0x30
pop rdi
ret
Function at 0x14000ae48
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x14002f008]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
xor esi, esi
mov dword [rcx], esi
add rcx, 8
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CStaticCritSec::constructor_void____ptr64]
mov qword [rbx + 0x38], rsi
lea rcx, [rsp + 0x232]
xor edx, edx
mov qword [rbx + 0x40], rsi
mov r8d, 0x208
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x50], rsi
mov qword [rbx + 0x70], rsi
mov word [rsp + 0x230], si
call sub.msvcrt.dll_memset
mov ebp, 0x105
lea rcx, [rsp + 0x230]
mov edx, ebp
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_1.dll_GetSystemDirectoryW]
mov edi, eax
cmp eax, ebp
jae 0x14000af80
lea r8, [rsp + 0x230]
mov edx, ebp
lea rcx, [rsp + 0x20]
call fcn.14000393c
mov ecx, eax
test eax, eax
js 0x14000af80
cmp word [rsp + rdi*2 + 0x20], 0x5c
je 0x14000af0d
lea r8, [0x14001ed14]
mov edx, ebp
lea rcx, [rsp + 0x20]
call fcn.14000389c
mov ecx, eax
test ecx, ecx
js 0x14000af80
lea r8, str.PSAPI.DLL
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.14000389c
test eax, eax
js 0x14000af80
xor r8d, r8d
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov qword [rbx + 0x50], rax
test rax, rax
je 0x14000af80
lea rdx, str.EnumProcesses
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, qword [rbx + 0x50]
lea rdx, str.EnumProcessModules
mov qword [rbx + 0x58], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, qword [rbx + 0x50]
lea rdx, str.GetModuleBaseNameW
mov qword [rbx + 0x60], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov qword [rbx + 0x68], rax
mov rax, rbx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140019770
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000c930
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x40]
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], r14
mov rax, qword [0x14002f008]
xor rax, rbp
mov qword [rbp + 0x10], rax
mov rbx, rdx
mov r14, rcx
cmp qword [rcx + 0x78], 0
je 0x14000ca4b
cmp qword [rcx + 0x78], 0xffffffffffffffff
je 0x14000ca4b
test rdx, rdx
je 0x14000ca4b
and dword [rbp], 0
mov rcx, rdx
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
mov esi, eax
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcslen]
lea edx, [rax*2 + 2]
movsxd rcx, edx
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x14000c9bb
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14001a980
sub rsp, rax
lea rdi, [rsp + 0x40]
test rdi, rdi
je 0x14000ca04
mov byte [rdi], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
neg eax
sbb rdx, rdx
and rdx, rdi
jmp 0x14000ca06
xor edx, edx
and qword [rsp + 0x20], 0
lea r9, [rbp]
mov r8d, esi
mov rcx, qword [r14 + 0x78]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
test eax, eax
jne 0x14000ca37
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
jmp 0x14000ca44
xor ecx, ecx
mov eax, 0x80004005
cmp esi, dword [rbp]
cmovne ecx, eax
jmp 0x14000ca50
mov ecx, 0x80070057
mov eax, ecx
mov rcx, qword [rbp + 0x10]
xor rcx, rbp
call fcn.140019770
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
mov r14, qword [rbp + 0x48]
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x14000ca7c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x40
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx + 0x78], 0
je 0x14000cb09
cmp qword [rcx + 0x78], 0xffffffffffffffff
je 0x14000cb09
test rdx, rdx
je 0x14000cb09
and dword [rax + 8], 0
mov rcx, rdx
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
mov ebx, eax
add ebx, ebx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
test eax, eax
jne 0x14000caf3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
jmp 0x14000cb01
xor ecx, ecx
mov eax, 0x80004005
cmp ebx, dword [rsp + 0x50]
cmovne ecx, eax
jmp 0x14000cb0e
mov ecx, 0x80070057
mov eax, ecx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000cb28
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov r15, rdx
mov r13, rcx
mov ebx, 0x8007000e
and qword [rsp + 0xa0], 0
test rdx, rdx
je 0x14000ccd3
mov r14d, 1
mov ecx, r14d
call fcn.140009d80
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000ccd8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
mov edi, eax
mov dword [rsp + 0x98], eax
mov rcx, r15
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
lea ecx, [rdi + 1]
add ecx, eax
mov qword [rsp + 0xa8], rcx
lea eax, [r14 + 1]
mul rcx
mov r12, 0xffffffffffffffff
cmovo rax, r12
mov rcx, rax
call fcn.14001930c
mov rdi, rax
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x14000cc08
mov edx, dword [rsp + 0x98]
inc edx
mov r8, rsi
mov rcx, rax
call fcn.14000393c
mov ebx, eax
test eax, eax
js 0x14000cc08
mov r8, r15
mov rdx, qword [rsp + 0xa8]
mov rcx, rdi
call fcn.14000389c
mov ebx, eax
test eax, eax
cmovns ebx, r14d
jmp 0x14000cc30
test ebx, ebx
js 0x14000ccbc
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateDirectoryW]
test eax, eax
jne 0x14000cc6d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 0xb7
je 0x14000cc6a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14000cc6d
mov ebx, r14d
test ebx, ebx
js 0x14000ccbc
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, r14d
mov edx, 0x40000000
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateFileW]
mov qword [r13 + 0x78], rax
cmp rax, r12
jne 0x14000ccba
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14000ccbc
xor ebx, ebx
test rdi, rdi
je 0x14000ccc9
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x14000ccd8
mov ebx, 0x80070057
mov eax, ebx
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000ccf0
Capabilities:
Delete file

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r14, rdx
mov rdi, rcx
mov ebx, 0x8007000e
and qword [rsp + 0x78], 0
mov rcx, qword [rcx + 0x78]
test rcx, rcx
je 0x14000cd2e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
and qword [rdi + 0x78], 0
test r14, r14
je 0x14000ce1a
mov r13d, 1
mov ecx, r13d
call fcn.140009d80
mov rsi, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14000ce1f
mov rcx, rax
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
mov r15d, eax
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
lea r12d, [rax + 1]
add r12d, r15d
lea eax, [r13 + 1]
mul r12
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14001930c
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14000cdc7
lea edx, [r15 + 1]
mov r8, rsi
mov rcx, rax
call fcn.14000393c
mov ebx, eax
test eax, eax
js 0x14000cdc7
mov r8, r14
mov edx, r12d
mov rcx, rdi
call fcn.14000389c
mov ebx, eax
test eax, eax
cmovns ebx, r13d
jmp 0x14000cdda
test ebx, ebx
js 0x14000ce03
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_DeleteFileW]
test eax, eax
jne 0x14000ce01
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14000ce03
xor ebx, ebx
test rdi, rdi
je 0x14000ce10
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x14000ce1f
mov ebx, 0x80070057
mov eax, ebx
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000ce38
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov r12, r8
mov r13, rdx
mov rdi, rcx
mov ebx, 0x8007000e
and qword [rsp + 0x88], 0
and qword [rsp + 0x98], 0
mov rcx, qword [rcx + 0x78]
test rcx, rcx
je 0x14000ce89
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
and qword [rdi + 0x78], 0
test r13, r13
je 0x14000d05c
test r12, r12
je 0x14000d05c
mov r15d, 1
mov ecx, r15d
call fcn.140009d80
mov r14, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14000d061
mov rcx, rax
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
mov edi, eax
mov dword [rsp + 0x80], eax
mov rcx, r13
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
lea ecx, [rdi + 1]
add ecx, eax
mov qword [rsp + 0x28], rcx
lea eax, [r15 + 1]
mul rcx
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.14001930c
mov rsi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x14000cf3b
mov edx, dword [rsp + 0x80]
inc edx
mov r8, r14
mov rcx, rax
call fcn.14000393c
mov ebx, eax
test eax, eax
js 0x14000cf3b
mov r8, r13
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.14000389c
mov ebx, eax
test eax, eax
cmovns ebx, r15d
jmp 0x14000cf63
test ebx, ebx
js 0x14000d045
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
mov ebx, eax
mov rcx, r12
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
lea r13d, [rax + 1]
add r13d, ebx
mov eax, 2
mul r13
cmovo rax, rdi
mov rcx, rax
call fcn.14001930c
mov rdi, rax
mov qword [rsp + 0x98], rax
test rax, rax
je 0x14000cfd7
lea edx, [rbx + 1]
mov r8, r14
mov rcx, rax
call fcn.14000393c
mov ebx, eax
test eax, eax
js 0x14000cfdc
mov r8, r12
mov edx, r13d
mov rcx, rdi
call fcn.14000389c
mov ebx, eax
test eax, eax
js 0x14000cfdc
mov ebx, r15d
jmp 0x14000cfdc
mov ebx, 0x8007000e
jmp 0x14000d000
test ebx, ebx
js 0x14000d038
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_DeleteFileW]
mov r8d, r15d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l2_1_1.dll_MoveFileExW]
test eax, eax
jne 0x14000d036
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14000d038
xor ebx, ebx
test rdi, rdi
je 0x14000d045
mov rcx, rdi
call sub.msvcrt.dll_free
test rsi, rsi
je 0x14000d052
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, r14
call sub.msvcrt.dll_free
jmp 0x14000d061
mov ebx, 0x80070057
mov eax, ebx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000e318
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x250
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14002f008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov edi, edx
xor r14d, r14d
mov word [rsp + 0x40], r14w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x42]
call sub.msvcrt.dll_memset
mov r9d, 0x100
lea r8, [rsp + 0x40]
mov edx, 0x1001
mov ecx, edi
call qword [sym.imp.api_ms_win_core_localization_l1_2_1.dll_GetLocaleInfoW]
and edi, 0x3ff
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
lea esi, [rax + 7]
lea eax, [r14 + 2]
mul rsi
lea rcx, [r14 - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.14001930c
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000e3dc
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, str._03x_s_r_n
mov edx, esi
mov rcx, rbx
call fcn.140001bfc
nop
jmp 0x14000e3e3
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140019770
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140014bc0
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x18
test rdx, rdx
cmovne rcx, rdx
xor edx, edx
call sym.WmiApSrv.exe_public:_unsigned_short_int____ptr64___cdecl_CHString::GetBuffer_int____ptr64
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]

Function at 0x140014c90
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rax, qword [rsp + 0x68]
mov r10, r8
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov qword [rsp + 0x20], r9
xor r8d, r8d
mov r9, qword [rsp + 0x60]
mov rdx, r10
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
add rsp, 0x38
ret
Function at 0x140014ff0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r9, r8
mov r8, rdx
mov rdx, qword [rcx + 8]
jmp sym.WmiApSrv.exe_public:_unsigned_long_int___cdecl_CRegistry::GetCurrentKeyValue_struct_HKEY______ptr64__unsigned_short_int_const____ptr64__class_CHString____ptr64____ptr64

Function at 0x140015010
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push r15
sub rsp, 0x50
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov r14, r9
mov rdi, r8
mov rsi, rdx
xor r15d, r15d
mov dword [rax - 0x28], r15d
or r8d, 0xffffffff
xor edx, edx
mov rcx, r9
call sym.WmiApSrv.exe_public:_void___cdecl_CHStringArray::SetSize_int__int____ptr64
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140015150
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140015150
cmp dword [rsp + 0x34], 7
jne 0x140015150
add eax, 2
mov dword [rsp + 0x30], eax
mov ecx, eax
call fcn.14001930c
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140015150
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x1400150eb
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [rsp + 0x38], r15
mov eax, 0x80040153
jmp 0x140015155
cmp dword [rsp + 0x34], 7
je 0x140015106
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [rsp + 0x38], r15
mov eax, 0x80040153
jmp 0x140015155
mov rsi, rbx
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rbx + rdi*2], r15w
jne 0x14001510d
test edi, edi
je 0x140015144
mov r8, rsi
mov edx, dword [r14 + 8]
mov rcx, r14
call sym.WmiApSrv.exe_public:_void___cdecl_CHStringArray::SetAtGrow_int__unsigned_short_int_const____ptr64____ptr64
lea eax, [rdi + 1]
movsxd rcx, eax
lea rsi, [rsi + rcx*2]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rsi + rdi*2], r15w
jne 0x140015138
jmp 0x140015117
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x140015155
mov eax, 0x80040153
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop r15
ret

Function at 0x140015180
Capabilities:
Query or enumerate registry value

Disassembly:
mov r9, r8
mov r8, rdx
mov rdx, qword [rcx + 8]
jmp sym.WmiApSrv.exe_public:_unsigned_long_int___cdecl_CRegistry::GetCurrentKeyValue_struct_HKEY______ptr64__unsigned_short_int_const____ptr64__class_CHStringArray____ptr64____ptr64
Function at 0x1400151a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
mov ecx, 0x100
mov rdi, r9
mov dword [rax - 0x18], ecx
mov rsi, r8
mov rbp, rdx
call fcn.14001930c
mov rbx, rax
test rax, rax
je 0x140015240
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov rdx, rsi
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x140015221
mov ecx, dword [rsp + 0x34]
sub ecx, 1
je 0x140015216
cmp ecx, 3
je 0x140015212
and dword [rdi], eax
mov esi, 0x80040153
jmp 0x140015221
mov eax, dword [rbx]
jmp 0x14001521f
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_atol]
mov dword [rdi], eax
mov rcx, rbx
call sub.msvcrt.dll_free
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea rcx, [rsp + 0x3c]
call fcn.140013f60
lea rdx, [0x14002acb0]
mov ecx, dword [rax]
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0x38]
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x140015270
Capabilities:
Query or enumerate registry value

Disassembly:
mov r9, r8
mov r8, rdx
mov rdx, qword [rcx + 8]
jmp sym.WmiApSrv.exe_public:_unsigned_long_int___cdecl_CRegistry::GetCurrentKeyValue_struct_HKEY______ptr64__unsigned_short_int_const____ptr64__unsigned_long_int____ptr64____ptr64

Function at 0x140015290
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x580]
sub rsp, 0x680
mov rax, qword [0x14002f008]
xor rax, rsp
mov qword [rbp + 0x570], rax
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rbp + 0x360]
mov dword [rsp + 0x34], 3
mov rdi, r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x20c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
xor ebx, ebx
test eax, eax
jne 0x140015377
mov esi, 0x106
lea r8, [0x140020448]
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.14000393c
cmp dword [rsp + 0x30], ebx
jbe 0x140015354
movzx r9d, byte [rbp + rbx + 0x360]
lea r8, str._02x
mov edx, 0x104
lea rcx, [rbp + 0x150]
call fcn.140001bfc
lea r8, [rbp + 0x150]
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14000389c
inc ebx
cmp ebx, dword [rsp + 0x30]
jb 0x140015317
lea r8, [0x140020448]
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14000389c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140017650
xor eax, eax
mov rcx, qword [rbp + 0x570]
xor rcx, rsp
call fcn.140019770
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x680
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400153a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
sub rsp, 0x38
and dword [rax + 8], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
lea r9, [rax + 8]
mov qword [rax - 0x18], r8
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
add rsp, 0x38
ret