joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474200
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47443b
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x47429a
mov qword [rsp + 0x88], rax
lea rbx, [0x004da000]
mov rcx, rax
lea rax, [0x00591a20]
call fcn.004659e0
test cl, cl
jne 0x474283
mov rax, qword [rsp + 0x88]
call fcn.00473a80
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x00502178]
call fcn.0044a340
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
call fcn.00474480
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x4742b7
lea rdx, [0x004d8540]
cmp rax, rdx
jne 0x4742a5
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
call fcn.0045aa20
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x004c8340]
call fcn.0040a3a0
inc rdx
cmp rbx, rdx
jle 0x474301
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x4742b4
lea rax, [0x00591a20]
lea rbx, [0x004da000]
lea rdi, [0x004d8540]
nop dword [rax + rax]
call fcn.00465ba0
lea rdx, [0x004d8540]
cmp rax, rdx
jne 0x47442b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
nop
ret
lea rcx, [0x004c23c0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x004cc400]
call fcn.0040cf40
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x005e4a10], 0
nop
je 0x47435b
mov rbx, rax
lea rax, [0x004cc400]
call fcn.00411d20
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x50]
call fcn.004014a0
call fcn.0045aae0
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x4743c2
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x4743b4
mov dword [rsi + 0x10], edx
cmp dword [0x005e4a10], 0
je 0x4743e3
call fcn.0045ebe0
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x00591a20]
lea rbx, [0x004da000]
lea rdi, [0x004d8540]
nop dword [rax]
call fcn.00465ba0
lea rdx, [0x004d8540]
cmp rax, rdx
jne 0x47441c
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x004c8340]
call fcn.0040a3a0
mov rbx, rdx
lea rcx, [0x004c8340]
call fcn.0040a3a0
nop
mov qword [rsp + 8], rax
call fcn.0045ccc0
mov rax, qword [rsp + 8]
jmp fcn.00474200
Function at 0x47c6e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47c8eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x47c804
cmp rdx, 0x40
ja 0x47c8dd
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x47c774
mov rax, rdx
mov rcx, rsi
call fcn.0045f8e0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x47c7e0
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0047cc20
xorps xmm15, xmm15
mov r14, qword [0x005e49d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x47c8d5
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x47c807
mov r8, rcx
cmp r8, 0x40
jl 0x47c885
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.0047cc20
xorps xmm15, xmm15
mov r14, qword [0x005e49d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x47c8c8
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x47c8c4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.0045f8e0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.0045f000
mov rax, rdx
mov ecx, 0x40
call fcn.0045f000
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.0045ccc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0047c6e0
Function at 0x481080
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4812bb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
nop
call fcn.00480e80
xorps xmm15, xmm15
mov r14, qword [0x005e49d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x4811ca
nop dword [rax]
cmp rdx, 0x40
ja 0x4812ad
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x481139
mov rax, rdx
mov rcx, rsi
nop
call fcn.0045f8e0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x4811a1
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00481820
xorps xmm15, xmm15
mov r14, qword [0x005e49d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x4812a2
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x4811d7
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x481255
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.00481820
xorps xmm15, xmm15
mov r14, qword [0x005e49d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x481298
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x481294
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call fcn.0045f8e0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call fcn.0045f000
mov rax, rdx
mov ecx, 0x40
call fcn.0045f000
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045ccc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00481080
Function at 0x4855a0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x485625
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x485786
cmp rcx, 0xe
jne 0x4856a0
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x485786
cmp rcx, 0xf
jne 0x485717
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x485786
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x4915c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49168a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403940
xorps xmm15, xmm15
mov r14, qword [0x005e49d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49166f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004c5200]
xor ebx, ebx
mov rcx, rdx
call fcn.00446580
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00491f60
inc rbx
cmp rcx, rbx
jae 0x49165e
mov edi, 1
lea rsi, [0x004c5200]
call fcn.00446660
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005038c0]
lea rsi, [0x00502e88]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ccc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004915c0
Function at 0x14001fdf4
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400da318]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [0x1400b13b0]
mov rbx, rcx
mov dword [rsp + 0x5c], eax
xor edi, edi
movzx eax, word [0x1400b13b4]
xor r9d, r9d
mov word [rsp + 0x60], ax
xor r8d, r8d
mov rax, qword [rcx]
mov word [rsp + 0x5c], dx
lea rdx, [r11 - 0x1c]
mov qword [r11 - 0x28], rdi
mov rcx, qword [rax]
mov rax, qword [rbx + 8]
mov qword [r11 - 0x38], rax
lea rax, [r11 - 0x28]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001ff09
mov rcx, qword [rsp + 0x50]
lea r9d, [rdi + 4]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DriveType
mov dword [rsp + 0x58], 3
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1400a5860]
mov rcx, qword [rcx]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x14001ff09
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x14001fecf
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, str.VolumeLabel
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14001ff1f
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140029fb0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140029d48
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.14002a964
add rsp, 0x28
jmp 0x140029d48
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x1400dad08], rbx
je 0x140029d92
cmp rax, rbx
jne 0x140029da7
mov edi, 1
mov eax, dword [0x1400dad10]
cmp eax, 1
jne 0x140029db4
lea ecx, [rax + 0x1e]
call fcn.140177000
jmp 0x140029e21
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140029d7b
mov eax, dword [0x1400dad10]
test eax, eax
jne 0x140029e17
mov dword [0x1400dad10], 1
lea r14, [0x1400a2ce8]
lea rbx, [0x1400a2cd0]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x140029e09
test eax, eax
jne 0x140029e0d
cmp qword [rbx], 0
je 0x140029dfe
mov rax, qword [rbx]
mov rcx, qword [case.0x140024095.0]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x140029ddf
test eax, eax
je 0x140029e21
mov eax, 0xff
jmp 0x140029f74
mov dword [0x1400da400], 1
mov eax, dword [0x1400dad10]
cmp eax, 1
jne 0x140029e49
lea rdx, [0x1400a2cc8]
lea rcx, [0x1400a2ae8]
call sub.msvcrt.dll__initterm
mov dword [0x1400dad10], 2
test edi, edi
jne 0x140029e56
xor eax, eax
xchg qword [0x1400dad08], rax
cmp qword [0x1400dad28], 0
je 0x140029e8a
lea rcx, [0x1400dad28]
call fcn.14002a8d0
test eax, eax
je 0x140029e8a
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400dad28]
mov r9, qword [case.0x140024095.0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x140029f16
test cl, cl
je 0x140029ead
test edi, edi
jne 0x140029f16
dec cl
cmp cl, 0x1f
ja 0x140029ec0
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x140029ead
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140006050
mov dword [0x1400da3fc], eax
cmp dword [0x1400da420], 0
jne 0x140029eff
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400da400], 0
jne 0x140029f14
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400da3fc]
jmp 0x140029f74
cmp cl, 0x22
jne 0x140029f28
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x140029f3a
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x140029e9d
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x140049fb0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1400da318]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140049fec
xor eax, eax
jmp 0x140049ff5
call fcn.14000b0c0
test eax, eax
js 0x140049ffd
movzx ecx, word [rsp + 0x20]
mov word [rbx], cx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140029fb0
add rsp, 0x240
pop rbx
ret

Function at 0x14004a020
Capabilities:
Check for time delay via gettickcount
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x40
cmp dword [0x1400dca04], 0
je 0x14004a04c
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
sub eax, dword [0x1400dca00]
cmp eax, 0x4e20
jbe 0x14004a0fa
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea r8, str.SystemIndexNormalization
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindows_Search
and qword [rsp + 0x20], 0
mov r9d, SafeArrayPutElement
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x14004a0de
mov edi, 1
mov dword [rsp + 0x50], edi
call fcn.14004a110
xor edx, edx
xor r8d, r8d
cmp r8d, 0x44
jae 0x14004a0cd
lea r9, [0x1400b4300]
cmp ax, word [r9 + r8*2]
cmove edx, edi
add r8d, edi
test edx, edx
je 0x14004a0b1
test edx, edx
je 0x14004a0de
mov eax, dword [rsp + 0x50]
or eax, 2
mov dword [rsp + 0x50], eax
jmp 0x14004a0e2
mov eax, dword [rsp + 0x50]
mov dword [0x1400dca04], eax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov dword [0x1400dca00], eax
mov eax, dword [0x1400dca04]
add rsp, 0x40
pop rdi
ret
Function at 0x14004a3a4
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
test byte [0x1400dc881], 8
je 0x14004a3d6
mov r8d, ecx
lea rdx, [0x1400b4718]
lea rcx, [0x1400d9440]
call fcn.14004c718
lea rax, [rbp + 0x28]
xor esi, esi
mov qword [rsp + 0x28], rax
lea r8, str.SOFTWAREMicrosoftWindows_Search
mov rdx, 0xffffffff80000002
mov dword [rsp + 0x20], 0xf003f
mov qword [rbp + 0x28], rsi
call fcn.14000a6d8
mov ebx, eax
mov edi, 0x80070000
test eax, eax
jle 0x14004a410
movzx ebx, ax
or ebx, edi
test ebx, ebx
jns 0x14004a421
mov r9d, ebx
mov edx, 0x701
jmp 0x14004a51f
cmp dword [rbp + 0x20], 1
jne 0x14004a486
call fcn.14004c56c
mov ebx, eax
test eax, eax
jns 0x14004a43f
mov r9d, eax
mov edx, 0x70a
jmp 0x14004a51f
mov rcx, qword [rbp + 0x28]
lea rdx, str.RebuildIndex
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov ebx, eax
add eax, 0xfffffffe
cmp eax, 1
cmovbe ebx, esi
test ebx, ebx
jle 0x14004a46c
movzx ebx, bx
or ebx, edi
test ebx, ebx
jns 0x14004a48e
mov rcx, qword [rbp + 0x18]
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov r9d, ebx
mov edx, 0x715
call fcn.140042700
test ebx, ebx
js 0x14004a52f
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov r9d, 4
lea r8, str.SetupCompletedSuccessfully
mov dword [rsp + 0x28], r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHSetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14004a4c6
movzx ebx, ax
or ebx, edi
test ebx, ebx
jns 0x14004a4d4
mov r9d, ebx
mov edx, 0x71d
jmp 0x14004a51f
lea rcx, [rbp - 0x10]
call fcn.1400275d0
cmp byte [rbp - 8], sil
je 0x14004a511
xor edx, edx
mov dword [rbp - 0x10], esi
lea rcx, [rbp - 0x10]
call fcn.14004c514
mov edi, eax
test eax, eax
jns 0x14004a511
mov rcx, qword [rbp + 0x18]
lea r8, str.onecoreuap_base_appmodel_search_search_search_serviceSetupErrorThresholdHelper.h
mov r9d, eax
mov edx, 0x25
call fcn.1400417d4
jmp 0x14004a513
mov edi, esi
test edi, edi
jns 0x14004a52f
mov r9d, edi
mov edx, 0x721
mov rcx, qword [rbp + 0x18]
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
call fcn.140042700
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14004a544
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004b124
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x188]
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400da318]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rdi, rdx
mov dword [rsp + 0x30], ecx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xf003f
lea r8, str.SOFTWAREMicrosoftWindows_Search
mov rdx, 0xffffffff80000002
call fcn.14000a6d8
mov ebx, eax
test eax, eax
jle 0x14004b193
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [rbp + 0x188]
test ebx, ebx
jns 0x14004b1b4
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x2e3
call fcn.140042700
jmp 0x14004b22b
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SystemIndexNormalization
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14004b1f3
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [rbp + 0x188]
test ebx, ebx
jns 0x14004b212
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x2e8
call fcn.140042700
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jns 0x14004b2b5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.14004a20c
nop
mov r9d, dword [rdi + 0x10]
mov r8, qword [rdi + 8]
mov edx, 0x7d0
lea rcx, [rsp + 0x40]
call fcn.14004a260
mov dword [rdi + 0x14], eax
mov rdx, qword [rdi]
mov r10, qword [rdx + 0x20]
or r9d, 0xffffffff
mov r8d, eax
lea rdx, [0x1400b3808]
mov rcx, rdi
mov rax, r10
call qword [case.0x140024095.0]
nop
lea rcx, [rsp + 0x40]
call fcn.1400290d4
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140029fb0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret