joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012d90
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edi, edx
mov rbx, rcx
and edi, 0xffffb1af
cmp qword [rcx + 0x18], 8
jb 0x140012dcd
mov rcx, qword [rcx]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140012de0
mov al, 1
jmp 0x140012e87
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400134c0
test al, al
je 0x140012e31
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140012e31
mov bl, 1
jmp 0x140012e33
xor bl, bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140012e71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012e6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012ea4
call fcn.14001881c
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140018000
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call fcn.14001bf2c
int3

Function at 0x140012eb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x140012ee5
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140012f8f
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140035a60]
movdqu xmmword [rsp + 0x38], xmm1
xor esi, esi
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400134c0
test al, al
je 0x140012f3e
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140012f7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012f77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012fae
call fcn.14001881c
movdqa xmm0, xmmword [0x140035a60]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], si
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140018000
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.14001bf2c
int3
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
call 0xcfaf2e69
and edx, dword [rdi + 0x785e2a73]
invalid
Function at 0x1400054f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x1d0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x140066550]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
mov rbx, rdx
mov qword [r11 - 0x18], rdx
xor dil, dil
xor edx, edx
mov r8d, 0x178
lea rcx, [rsp + 0x40]
call fcn.1400205b0
mov r11d, dword [rbx + 0x1c0]
mov dword [rsp + 0x58], r11d
movzx eax, word [rbx + 4]
mov word [rsp + 0x7c], ax
movzx eax, word [rbx + 8]
mov word [rsp + 0x7e], ax
movzx eax, word [rbx + 0x10]
mov word [rsp + 0x82], ax
movzx eax, word [rbx + 0xc]
mov word [rsp + 0x80], ax
movzx eax, word [rbx + 0x34]
mov word [rsp + 0x8c], ax
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x5c], eax
mov eax, dword [rbx]
mov dword [rsp + 0x60], eax
mov eax, dword [rbx + 0x1c]
mov dword [rsp + 0x64], eax
mov eax, dword [rbx + 0x24]
mov dword [rsp + 0x90], eax
mov eax, dword [rbx + 0x20]
mov dword [rsp + 0x98], eax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x16c], eax
mov eax, dword [rbx + 0x14]
mov dword [rsp + 0x17c], eax
mov eax, dword [rbx + 0x38]
mov dword [rsp + 0x18c], eax
mov eax, dword [rbx + 0x3c]
mov dword [rsp + 0x19c], eax
movzx eax, word [rbx + 0x74]
mov word [rsp + 0xc0], ax
movzx eax, word [rbx + 0x78]
mov word [rsp + 0xc2], ax
movzx eax, word [rbx + 0x80]
mov word [rsp + 0xc6], ax
movzx eax, word [rbx + 0x7c]
mov word [rsp + 0xc4], ax
movzx eax, word [rbx + 0xa4]
mov word [rsp + 0xd0], ax
mov eax, dword [rbx + 0xa0]
mov dword [rsp + 0xa0], eax
mov eax, dword [rbx + 0x70]
mov dword [rsp + 0xa4], eax
mov eax, dword [rbx + 0x8c]
mov dword [rsp + 0xa8], eax
mov eax, dword [rbx + 0x94]
mov dword [rsp + 0xd4], eax
mov eax, dword [rbx + 0x90]
mov dword [rsp + 0xdc], eax
mov eax, dword [rbx + 0x88]
mov dword [rsp + 0x170], eax
mov eax, dword [rbx + 0x84]
mov dword [rsp + 0x180], eax
mov eax, dword [rbx + 0xa8]
mov dword [rsp + 0x190], eax
mov eax, dword [rbx + 0xac]
mov dword [rsp + 0x1a0], eax
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x140051770]
xor edx, edx
lea r8d, [rdx + 0x15]
lea rcx, [0x1400517d0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400056d5
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400056eb
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov edx, 0x178
call qword [rax + 0x190]
movzx edi, dil
mov ecx, 1
test eax, eax
cmovns edi, ecx
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400056eb
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [rsp + 0x30], 0
lea rcx, [rbx + 0x190]
call fcn.140004f10
nop
lea rcx, [rbx + 0x120]
call fcn.140004f10
nop
lea rcx, [rbx + 0xb0]
call fcn.140004f10
nop
lea rcx, [rbx + 0x40]
call fcn.140004f10
mov al, dil
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.1400206b0
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1d0
pop rdi
ret
Function at 0x1400061fc
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x1c0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x140066550]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rsi, rdx
xor ebx, ebx
mov dword [rsp + 0x40], 0x104
xor edx, edx
mov r8d, 0x104
lea rcx, [r11 - 0x128]
call fcn.1400205b0
mov dil, 1
and qword [rsp + 0x70], rbx
mov qword [rsp + 0x98], 0xf
and qword [rsp + 0x90], rbx
mov byte [rsp + 0x80], bl
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xa0]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140006362
test dil, dil
je 0x1400062db
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0xa0]
call fcn.14001f5c0
mov r8, rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.140005324
xor dil, dil
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x14000631c
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0xa0]
call fcn.14001f5c0
mov r8, rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.140005324
inc ebx
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xa0]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400062a7
lea rax, str..ConfigPersist.cpp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0xe09
mov r8d, ebx
lea rdx, str.Total_available_cofigurations_as_of_now_are___d__n
lea rcx, [rsp + 0x58]
call fcn.140002484
cmp dword [0x140067e2c], ebx
jne 0x1400063b6
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
lea rcx, [rsp + 0x70]
call fcn.140004f10
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400206b0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000b3a0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14000b3e1
xor r9d, r9d
lea rax, str.m_hKey___0
lea rdx, [0x140053e10]
lea ecx, [r9 + 2]
mov r8d, 0x1476
mov qword [rsp + 0x20], rax
call fcn.140021c80
cmp eax, 1
jne 0x14000b3e1
int3
cmp byte [0x140068098], 0
jne 0x14000b425
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14000b415
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140068090], rax
jmp 0x14000b41c
mov rax, qword [0x140068090]
mov byte [0x140068098], 1
jmp 0x14000b42c
mov rax, qword [0x140068090]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000b442
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x14000b448
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000b638
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14000b67e
xor r9d, r9d
lea rax, str.m_hKey___0
lea rdx, [0x140053e10]
lea ecx, [r9 + 2]
mov r8d, 0x1615
mov qword [rsp + 0x20], rax
call fcn.140021c80
cmp eax, 1
jne 0x14000b67e
int3
mov rcx, qword [rbx]
lea rax, [rsp + 0x50]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000b6b0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov ebx, r9d
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
jne 0x14000b700
xor r9d, r9d
lea rax, str.m_hKey___0
lea rdx, [0x140053e10]
lea ecx, [r9 + 2]
mov r8d, 0x1621
mov qword [r11 - 0x18], rax
call fcn.140021c80
cmp eax, 1
jne 0x14000b700
int3
xor eax, eax
test rdi, rdi
setne al
test eax, eax
jne 0x14000b73e
xor r9d, r9d
lea rax, str.__atl_condVal
lea rdx, [0x140053e10]
lea ecx, [r9 + 2]
mov r8d, 0x1622
mov qword [rsp + 0x20], rax
call fcn.140021c80
cmp eax, 1
jne 0x14000b737
int3
mov eax, 0xd
jmp 0x14000b799
cmp ebx, 1
je 0x14000b773
cmp ebx, 2
je 0x14000b773
xor r9d, r9d
lea rax, str._dwType____1______dwType____2___
lea rdx, [0x140053e10]
lea ecx, [r9 + 2]
mov r8d, 0x1623
mov qword [rsp + 0x20], rax
call fcn.140021c80
cmp eax, 1
jne 0x14000b773
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsi]
mov r9d, ebx
inc eax
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000b7b0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x30
xor ebx, ebx
mov rsi, r8
mov r12, rdx
mov rbp, rcx
mov edi, 2
cmp qword [rcx], rbx
jne 0x14000b806
lea rax, str.m_hKey___0
lea rdx, [0x140053e10]
xor r9d, r9d
mov r8d, 0x162e
mov ecx, edi
mov qword [r11 - 0x18], rax
call fcn.140021c80
cmp eax, 1
jne 0x14000b806
int3
cmp rsi, rbx
mov eax, ebx
setne al
cmp eax, ebx
jne 0x14000b842
lea rax, str.__atl_condVal
lea rdx, [0x140053e10]
xor r9d, r9d
mov r8d, 0x162f
mov ecx, edi
mov qword [rsp + 0x20], rax
call fcn.140021c80
cmp eax, 1
jne 0x14000b83b
int3
mov eax, 0xd
jmp 0x14000b879
mov rdi, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ecx, eax
add ebx, eax
add rdi, rcx
cmp eax, 1
jne 0x14000b845
mov rcx, qword [rbp]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x14000bd4c
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x70
xor ebx, ebx
lea rcx, [r11 + 0x18]
mov rax, rdx
mov qword [r11 - 0x20], rbx
mov qword [r11 - 0x28], rbx
mov qword [r11 - 0x30], rbx
mov qword [r11 - 0x38], rbx
mov qword [r11 - 0x40], rbx
mov qword [r11 - 0x48], rbx
mov qword [r11 - 0x50], rbx
mov qword [r11 - 0x58], rcx
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
xor edx, edx
mov dword [r11 + 0x18], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, ebx
je 0x14000bdf3
mov rdx, qword [0x1400681d0]
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
lea r9, str.Should_not_be_here___n
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3f3
call fcn.14000b174
lea r11, [0x140053c20]
lea rdx, [0x140053fa0]
lea ecx, [rbx + 2]
xor r9d, r9d
mov r8d, 0x3f4
mov qword [rsp + 0x20], r11
call fcn.140021c80
cmp eax, 1
jne 0x14000bdef
int3
xor eax, eax
jmp 0x14000bdff
cmp dword [rsp + 0x90], ebx
seta bl
mov eax, ebx
add rsp, 0x70
pop rbx
ret
Function at 0x14000c138
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x140066550]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor edi, edi
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x104
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x5c], edi
mov dword [rsp + 0x58], edi
call fcn.1400205b0
lea r11, [rsp + 0x5c]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareinteldisplayigfxcuiprofilesCurrent
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
jne 0x14000c25c
cmp qword [rsp + 0x50], rdi
je 0x14000c25c
lea rdx, str.Select_Profile
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x58], 3
call fcn.140020ad0
mov rcx, qword [rsp + 0x50]
lea r9d, [rdi + 4]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], r9d
lea rdx, str.CurrentPresetProfileType
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x50]
lea esi, [rdi + 1]
lea rdx, str.CurrentPresetProfileName
xor r8d, r8d
add eax, esi
mov r9d, esi
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp ebx, edi
jne 0x14000c251
cmp eax, edi
cmove edi, esi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400206b0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000e4b8
Capabilities:
Create directory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x370
mov rax, qword [0x140066550]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov rbp, rcx
xor ecx, ecx
mov r12, r8
mov rdi, rdx
call qword [sym.imp.ole32.dll_CoInitialize]
mov edx, 0x5c
mov rcx, rdi
call fcn.140021af0
mov rsi, rax
test rax, rax
je 0x14000e65a
mov rcx, rdi
call fcn.14001f5c0
mov rcx, rsi
mov rbx, rax
call fcn.14001f5c0
lea rcx, [rsp + 0x40]
sub rbx, rax
mov rdx, rdi
mov r8, rbx
call fcn.140024480
mov rcx, rsi
call fcn.14001f5c0
lea rbx, [rsp + 0x40]
mov rcx, rdi
sub rbx, rax
call fcn.14001f5c0
lea rdx, [0x140054808]
lea rcx, [rsp + 0x40]
mov byte [rax + rbx], 0
call fcn.140020a30
lea rdx, [rsp + 0x40]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x14000e57a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000e65a
lea rax, [rsp + 0x30]
mov esi, 1
lea r9, [0x140057708]
lea rcx, [0x140057728]
xor edx, edx
mov r8d, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x14000e5cf
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
mov rax, qword [rcx]
call qword [rax + QueryPathOfRegTypeLib]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
test eax, eax
je 0x14000e5d6
test rcx, rcx
je 0x14000e5cf
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, ebx
jmp 0x14000e65f
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x38]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
test eax, eax
jne 0x14000e5c4
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
lea rdx, [0x140057718]
call qword [rax]
mov ebx, eax
test eax, eax
js 0x14000e64a
lea rax, [rsp + 0x150]
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea rdx, [rsp + 0x150]
mov r8d, esi
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000e5cf
mov eax, 0x80070057
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.1400206b0
add rsp, 0x370
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000eb58
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x140066550]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r9d, dword [rcx + 8]
and qword [rsp + 0x48], 0
and dword [rsp + 0x50], 0
mov rdi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rsi, rcx
lea rcx, [rsp + 0x48]
or r9d, 0x2001f
call fcn.14000b550
mov ebx, eax
test eax, eax
je 0x14000ec0f
cmp eax, 2
je 0x14000ec76
cmp eax, 3
je 0x14000ec76
mov rdx, qword [0x1400681c0]
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlbase.h
lea r9, str.CRegKey::RecurseDeleteKey_:_Failed_to_Open_Key__s_Error___d__n
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x166a
mov qword [rsp + 0x20], rdi
call fcn.14000b174
jmp 0x14000ec76
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000eb58
mov ebx, eax
test eax, eax
jne 0x14000ec76
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x70]
xor edx, edx
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000ebfa
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000ec64
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
and dword [rsp + 0x50], 0
mov rdx, rdi
mov rcx, rsi
call fcn.14000b3a0
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000ec86
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400206b0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14000f7cc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x48
lea rdi, [0x140054ae8]
lea rdx, str.Inside_IsModifyRotCapsForDC
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x38], 0xc05
call fcn.140002484
xor ebx, ebx
lea rax, [rsp + 0x78]
lea rdx, str.SoftwareIntelDisplayigfxcuiigfxcfg
lea r9d, [rbx + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x14000f893
lea rdx, str.IsModifyRotCapsForDC_returned_SUCCESS
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x38], 0xc0b
call fcn.140002484
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
lea rdx, str.DCRotationCaps
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x68], 1
sete bl
mov eax, ebx
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x14000ffb4
Capabilities:
Get geographical location
Identify system language via api
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x60
and qword [rax + 0x10], 0
and dword [rax + 8], 0
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor r9d, r9d
movzx ebx, ax
xor r8d, r8d
lea edx, [r9 + 3]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, eax
lea r8d, [rax + 1]
movsxd rcx, r8d
call fcn.14001e940
mov r9d, esi
mov edx, 3
mov r8, rax
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea r11, [rsp + 0x70]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, str.SoftwareIntelDisplayigfxcuihkcmd_resources
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400100a9
mov rcx, qword [rsp + 0x78]
lea r9d, [rax + 1]
lea rdx, str.UserLangID
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14001009c
lea rax, [0x140054ae8]
lea rdx, str.ERROR:_Couldnt_set_the_registry_value_for_registry_User_Language_in_File:_persistence.cpp_r_n
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x1258
call fcn.140002484
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400100ce
lea rax, [0x140054ae8]
lea rdx, str.ERROR:_Couldnt_Open_regsitry_szMUIRegPath_in_File:_persistence.cpp_r_n
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x125f
call fcn.140002484
test rdi, rdi
je 0x1400100db
mov rcx, rdi
call fcn.14001f0a0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret