joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400187b0
Capabilities:
Get geographical location
Set registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rbp, rdx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x1400187db
mov rax, rdi
jmp 0x1400187ec
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x140018806
test rax, rax
jne 0x140018806
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServices
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServices
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x140018833
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400188b4
mov rsi, qword [rsp + 0x70]
mov eax, edi
test rbp, rbp
setne al
test eax, eax
je 0x1400188a4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
mov r9d, 1
xor r8d, r8d
lea rdx, str.CountryCode
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x1400188b9
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400188b9
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018b40
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, rdx
mov rbx, rcx
mov byte [rdx], 0
xor edi, edi
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x140018b6b
mov rax, rdi
jmp 0x140018b7d
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx + 8]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x70], rax
cmp qword [rbx + 8], rdi
je 0x140018b98
test rax, rax
jne 0x140018b98
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.CadManagerControlCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.CadManagerControlCommunicationCenter
lea rcx, [rsp + 0x70]
call fcn.14000c020
test eax, eax
jns 0x140018bc5
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x88], rdi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140018c68
mov rsi, qword [rsp + 0x88]
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x78], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, str.PreviewMode
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140018c58
cmp dword [rsp + 0x80], 4
jne 0x140018c58
cmp dword [rsp + 0x70], 1
sete al
mov byte [rbp], al
test rsi, rsi
je 0x140018c6d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140018c6d
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400190b0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rbp
mov rbp, rdx
mov rbx, rcx
test rdx, rdx
jne 0x1400190e1
mov eax, 0x80004003
jmp 0x14001928b
xor edi, edi
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x1400190f1
mov rax, rdi
jmp 0x140019103
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx + 8]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x68], rax
cmp qword [rbx + 8], rdi
je 0x14001911e
test rax, rax
jne 0x14001911e
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.CadManagerControlCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.CadManagerControlCommunicationCenter
lea rcx, [rsp + 0x68]
call fcn.14000c020
test eax, eax
jns 0x14001914b
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001927b
mov rsi, qword [rsp + 0x70]
mov eax, edi
cmp byte [rbp], al
setne al
mov r12d, edi
cmp byte [rbp + 0x10], r12b
setne r12b
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableCommunicationCenter
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsx r11d, word [rbp + 2]
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.MaintenancePatchNotificationOption
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbp, qword [rbp + 8]
mov eax, edi
test rbp, rbp
setne al
test eax, eax
je 0x14001923b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
mov r9d, 1
xor r8d, r8d
lea rdx, str.LocalPatchListLocation
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableNonPatchNotifications
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x140019280
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140019280
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x14001bf70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x50], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1400175a0
add rcx, 0xffffffffffffff90
call fcn.140015450
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x1400175bb
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14001bf70
mov eax, 0x80004005
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rbp, rdx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14001bf9b
mov rax, rdi
jmp 0x14001bfac
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x14001bfc6
test rax, rax
jne 0x14001bfc6
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x14001bff3
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c090
mov rsi, qword [rsp + 0x30]
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.OutOfBoxWizardCompletedStep
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c077
cmp dword [rsp + 0x78], 4
jne 0x14001c077
movzx eax, word [rsp + 0x60]
mov word [rbp], ax
jmp 0x14001c080
mov word [rbp], di
mov edi, 0x80004005
test rsi, rsi
je 0x14001c095
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c095
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001c0b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x50], 0
movzx edi, dx
mov rbx, rcx
jne 0x1400175f0
add rcx, 0xffffffffffffff90
call fcn.140015450
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x14001760b
movzx edx, di
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14001c0b0
mov eax, 0x80004005
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
movzx ebp, dx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14001c0db
mov rax, rdi
jmp 0x14001c0ec
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x14001c106
test rax, rax
jne 0x14001c106
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x14001c133
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c1ab
mov rsi, qword [rsp + 0x70]
movsx eax, bp
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.OutOfBoxWizardCompletedStep
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x14001c1b0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c1b0
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001c1d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x50], 0
mov rdi, rdx
mov rbx, rcx
jne 0x140017640
add rcx, 0xffffffffffffff90
call fcn.140015450
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x14001765b
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14001c1d0
mov eax, 0x80004005
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rbp, rdx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14001c1fb
mov rax, rdi
jmp 0x14001c20c
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x14001c226
test rax, rax
jne 0x14001c226
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x14001c253
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c2ed
mov rsi, qword [rsp + 0x30]
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.DataState
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c2d5
cmp dword [rsp + 0x78], 4
jne 0x14001c2d5
mov eax, dword [rsp + 0x60]
mov dword [rbp], eax
jmp 0x14001c2dd
mov dword [rbp], edi
mov edi, 0x80004005
test rsi, rsi
je 0x14001c2f2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c2f2
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001c310
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x50], 0
mov edi, edx
mov rbx, rcx
jne 0x14001768f
add rcx, 0xffffffffffffff90
call fcn.140015450
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x1400176a9
mov edx, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14001c310
mov eax, 0x80004005
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov ebp, edx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14001c33a
mov rax, rdi
jmp 0x14001c34b
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x14001c365
test rax, rax
jne 0x14001c365
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x14001c392
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c407
mov rsi, qword [rsp + 0x70]
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DataState
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x14001c40c
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c40c
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001c430
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, rdx
mov rbx, rcx
mov byte [rdx], 1
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14001c45a
mov rax, rdi
jmp 0x14001c46b
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x70], rax
cmp qword [rbx], rdi
je 0x14001c485
test rax, rax
jne 0x14001c485
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x70]
call fcn.14000c020
test eax, eax
jns 0x14001c4b2
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x88], rdi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c553
mov rsi, qword [rsp + 0x88]
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x78], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, str.EnableBubbleNotification
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c543
cmp dword [rsp + 0x80], 4
jne 0x14001c543
cmp dword [rsp + 0x70], eax
jne 0x14001c543
mov byte [rbp], al
test rsi, rsi
je 0x14001c558
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c558
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001c570
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x50], 0
movzx edi, dx
mov rbx, rcx
jne 0x1400179d0
add rcx, 0xffffffffffffff90
call fcn.140015450
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x1400179ef
cmp di, 0xffff
sete dl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14001c570
mov eax, 0x80004005
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
movzx ebp, dl
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14001c59b
mov rax, rdi
jmp 0x14001c5ac
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x14001c5c6
test rax, rax
jne 0x14001c5c6
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x14001c5f3
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c670
mov rsi, qword [rsp + 0x70]
mov eax, edi
test bpl, bpl
setne al
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableBubbleNotification
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x14001c675
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c675
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001e0e0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [0x140032658], 0
mov ebx, r9d
mov dword [0x140032648], 0x3e8
je 0x14001e105
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x20]
lea rcx, [0x1400325f0]
mov rdx, rax
call fcn.14001e5b0
cmp al, 1
jne 0x14001e13e
lea rcx, [0x1400325f0]
mov edx, ebx
add rsp, 0x30
pop rbx
jmp 0x14001e7f0
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.14001e870
test eax, eax
jne 0x14001e85d
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x14001e85f
nop dword [rax]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x14001e820
mov rcx, rbx
call fcn.14001e510
xor eax, eax
add rsp, 0x50
pop rbx
ret
js 0x14001e869
mov rcx, rbx
call fcn.14001e510
xor eax, eax
add rsp, 0x50
pop rbx
ret

Function at 0x14001e950
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x50], rax
test rax, rax
jne 0x14001e978
add rsp, 0x30
pop rdi
ret
lea rax, [rsp + 0x40]
lea r8, [0x14001e9d0]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x14001e9b5
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400201b7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140030020]
jne 0x14001fb1a
rol rcx, 0x10
test cx, 0xffff
jne 0x14001fb16
repz ret
ror rcx, 0x10
jmp 0x140020110
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400320c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1400321b8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140020195
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400320c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400201b7
mov rax, qword [rsp + 0x88]
mov qword [0x1400321b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140032158], rax
mov rax, qword [0x1400321b8]
mov qword [0x140032030], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140032140], rax
mov dword [0x140032020], 0xc0000409
mov dword [0x140032024], 1
mov rax, qword [0x140030020]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140030028]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400320b8], eax
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140023610]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400320b8], 0
jne 0x14002023e
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret