joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012a48
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov byte [rsp + 0x18], r8b
push rdi
sub rsp, 0x60
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
cmp dword [0x14002e20c], ebx
je 0x140012a94
mov al, byte [0x14002e210]
cmp al, 4
jae 0x140012a7a
cmp al, bl
jne 0x140012a94
mov rcx, qword [0x14002e1e0]
lea r8, [0x1400028a0]
lea rdx, [0x140002900]
call fcn.1400125b8
mov rax, qword [rsi]
mov rcx, rsi
mov qword [rsi + 0x90], rdi
mov byte [rsi + 0x34], 1
call qword [rax + 0x50]
mov r11, qword [rsi]
mov rcx, rsi
call qword [r11 + 8]
mov rcx, rsi
mov byte [rsi + 0x48], al
mov rax, qword [rsi]
call qword [rax]
mov rcx, rsi
mov byte [rsi + 0x49], al
mov rax, qword [rsi]
call qword [rax + 0x30]
mov rcx, rsi
mov byte [rsi + 0x4a], al
mov rax, qword [rsi]
call qword [rax + 0x48]
mov rcx, rsi
mov dword [rsi + 0x4c], eax
mov rax, qword [rsi]
call qword [rax + 0x70]
lea r8, [0x140012624]
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov byte [rsi + 0x35], bl
mov qword [rsi + 0x38], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_CreateThread]
mov qword [rsi + 0x40], rax
cmp rax, rbx
jne 0x140012b48
cmp dword [0x14002e20c], ebx
je 0x140012b3e
mov al, byte [0x14002e210]
cmp al, 4
jae 0x140012b24
cmp al, bl
jne 0x140012b3e
mov rcx, qword [0x14002e1e0]
lea r8, [0x1400028a0]
lea rdx, [0x140002910]
call fcn.1400125b8
mov eax, 0x80004005
jmp 0x140012c16
mov rax, qword [0x14002d810]
lea r9, [rsi + 0x130]
lea r8, [0x14002d7c0]
mov qword [0x14002d810], rax
mov al, byte [rsp + 0x80]
lea rdx, [0x14002da60]
lea rcx, [0x14002da00]
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x54], ebx
mov byte [rsp + 0x20], al
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x5c], ebx
call fcn.14000c328
mov qword [rsp + 0x40], rbx
lea r9, [0x1400033d8]
mov word [rsp + 0x38], ax
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x50]
lea rcx, [rsi + 0xf0]
xor edx, edx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.14000c7b8
lea rcx, [rsi + 0xb0]
mov edx, 0xfa0
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_InitializeCriticalSectionAndSpinCount]
cmp eax, ebx
je 0x140012b3e
mov byte [rsi + 0xd8], 1
cmp dword [0x14002e20c], ebx
je 0x140012c14
mov al, byte [0x14002e210]
cmp al, 4
jae 0x140012bfa
cmp al, bl
jne 0x140012c14
mov rcx, qword [0x14002e1e0]
lea r8, [0x1400028a0]
lea rdx, [0x140002910]
call fcn.1400125b8
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400134a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0xa0
mov rax, qword [0x14002d148]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor esi, esi
mov rdi, r8
mov rbp, rdx
xor r12d, r12d
inc r12d
lea r8, [0x140003530]
lea rcx, [rsp + 0x50]
mov r9d, r12d
mov edx, 0x20
call fcn.140013248
lea r11, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], r11
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea rdx, [0x140001d40]
mov r9d, 2
mov rcx, 0xffffffff80000001
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x14001359f
mov edx, dword [rsp + 0x40]
xor ecx, ecx
shr edx, 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rbx, rax
test rax, rax
je 0x14001359f
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rdx, [0x140001d40]
mov qword [rsp + 0x30], rax
mov r9d, 2
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x28], rbx
and qword [rsp + 0x20], 0
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x140013596
cmp qword [rdi], rbx
je 0x14001358e
mov rcx, qword [rdi]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rbx
inc esi
add rdi, 8
jmp 0x14001359f
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp r12d, 5
jb 0x1400134da
mov dword [rbp], esi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140022620
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x1400138fc
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x60
and qword [r11 - 0x28], 0
lea rax, [r11 - 0x18]
mov rbx, r9
mov qword [r11 - 0x30], rax
and qword [r11 - 0x38], 0
mov rdi, r8
lea rdx, [0x140001d40]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20106
and dword [rsp + 0x20], 0
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0x140013985
mov rcx, qword [rsp + 0x50]
lea r9d, [rax + 4]
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
test eax, eax
je 0x14001397f
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x140013985
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140013998
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x40
and qword [rax - 0x10], 0
mov dword [rax - 0x18], 4
lea rax, [rax - 0x10]
mov rbx, r9
mov rdi, r8
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140013a1e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140013a11
cmp dword [rsp + 0x34], 4
jne 0x140013a11
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x140013a1e
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140013a30
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x40
mov rbx, qword [rsp + 0x70]
mov rsi, r8
lea rax, [r11 - 0x18]
mov r12, rcx
mov rcx, qword [rbx]
mov qword [r11 - 0x20], rax
mov rdi, r9
mov qword [r11 - 0x28], r9
mov rbp, rdx
lea r9, [r11 - 0x14]
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x30], 4
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140013a8c
cmp dword [rsp + 0x34], 4
je 0x140013adc
mov rcx, qword [rbx]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x140013ab9
and qword [rbx], 0
jmp 0x140013adc
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x140014dc8
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov r13, r8
mov r14, rdx
mov qword [rdx], rbx
mov rbp, rcx
or r15, 0xffffffffffffffff
mov dword [r8], ebx
mov r12d, ebx
cmp qword [rbp + 0xe8], rbx
je 0x140014e18
mov rcx, qword [rbp + 0xe8]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax]
jmp 0x140014e22
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
movsxd rcx, eax
mov edi, eax
mov eax, 8
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.140021d38
mov rsi, rax
cmp rax, rbx
je 0x140014e7e
cmp edi, ebx
je 0x140014e73
cmp qword [rbp + 0xe8], rbx
je 0x140014e64
mov rcx, qword [rbp + 0xe8]
mov r8, rax
mov edx, edi
mov r9, qword [rcx]
call qword [r9]
jmp 0x140014e6f
mov rdx, rax
mov ecx, edi
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
cmp edi, eax
je 0x140014e96
mov rcx, rsi
call fcn.140021d44
mov rsi, rbx
mov ecx, 1
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
inc r12d
cmp r12d, 5
jl 0x140014dfc
cmp edi, ebx
jle 0x140014ed4
movsxd rbp, edi
mov eax, 2
mul rbp
cmovo rax, r15
mov rcx, rax
call fcn.140021d38
cmp rax, rbx
je 0x140014ed4
cmp rbp, rbx
jle 0x140014ecb
movzx ecx, word [rsi + rbx*8]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, rbp
jl 0x140014ebb
mov qword [r14], rax
mov bl, 1
mov dword [r13], edi
mov rcx, rsi
call fcn.140021d44
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140015f90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x140015fbc
mov rcx, rdx
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x1400160c1
test rdi, rdi
je 0x1400160c1
lea rdx, [0x140003730]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wfopen]
mov rsi, rax
test rax, rax
jne 0x140015ff8
mov eax, 0x80004005
jmp 0x1400160c6
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x38]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wstat64]
mov r12, qword [rsp + 0x38]
mov r11d, 0xffffffff
cmp r12, r11
ja 0x140015fee
mov ecx, 0x11
mov r8d, r12d
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
xor ebx, ebx
mov r13d, 0x8007000e
test rax, rax
mov rbp, rax
cmove ebx, r13d
and qword [rsp + 0x88], 0
test ebx, ebx
js 0x1400160a5
lea rdx, [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov ebx, eax
test eax, eax
js 0x1400160a5
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1400160a5
mov r8d, r12d
mov r9, rsi
mov edx, 1
call qword [sym.imp.msvcrt.dll_fread]
mov r11d, 0x2011
mov rcx, rbp
mov word [rdi], r11w
mov qword [rdi + 8], rbp
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
jmp 0x1400160b4
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
test ebx, ebx
cmovns ebx, r13d
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_fclose]
mov eax, ebx
jmp 0x1400160c6
mov eax, 0x80070057
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140016358
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
test rcx, rcx
je 0x14001646f
and dword [rcx], 0
and qword [rax - 0x28], 0
and qword [rax - 0x20], 0
and qword [rax - 0x18], 0
xor ebx, ebx
lea r8, [0x1400024f0]
and qword [rax - 0x30], rbx
and qword [rax - 0x38], rbx
and dword [rax + 8], ebx
mov dword [rax - 0x40], 0x2011f
and dword [rax - 0x48], ebx
lea rcx, [rax - 0x28]
xor r9d, r9d
mov rdx, 0xffffffff80000001
call fcn.140005838
test eax, eax
jne 0x14001644b
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, [0x1400024d8]
xor r8d, r8d
mov dword [rsp + 0x78], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140016402
cmp dword [rsp + 0x80], 4
jne 0x140016410
cmp eax, 2
je 0x140016410
cmp eax, 0xd
je 0x140016410
test eax, eax
jne 0x14001644b
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x1400024d8]
inc eax
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
test eax, eax
je 0x140016452
mov ebx, 0x80004005
jmp 0x140016458
mov edx, dword [rsp + 0x70]
mov dword [rdi], edx
cmp qword [rsp + 0x40], 0
je 0x14001646b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
jmp 0x140016474
mov eax, 0x80070057
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x140016a0c
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Query environment variable

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x14002d148]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r14, r8
mov r13, rdx
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov bpl, r15b
mov r8d, 0x20119
lea rdx, [rsp + 0x40]
call fcn.14001affc
cmp eax, r15d
jl 0x140016bfc
mov rax, qword [r13 + 8]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140016bfc
mov edi, dword [rbx + 0x28]
mov word [rsp + 0x70], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x72]
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x70]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.API_MS_Win_Core_ProcessEnvironment_L1_1_0.dll_ExpandEnvironmentStringsW]
cmp eax, r15d
je 0x140016b6c
lea rcx, [rsp + 0x70]
call qword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140016b6c
mov word [rsp + 0x60], r15w
xor eax, eax
mov dword [rsp + 0x62], eax
lea r9d, [rax + 0xa]
lea r8d, [rax + 3]
lea rdx, [rsp + 0x60]
mov ecx, edi
call sub.msvcrt.dll__itow_s
cmp eax, r15d
jne 0x140016b6c
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, r15d
jne 0x140016b6c
mov rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 0x18]
call qword [sym.imp.ole32.dll_StringFromCLSID]
cmp eax, r15d
jne 0x140016b5e
mov rdx, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueW]
movzx ebp, bpl
mov ecx, 1
cmp eax, r15d
cmove ebp, ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rdi, r15
je 0x140016b6c
mov rcx, rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp byte [rbx + 0x39], r15b
je 0x140016b88
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140022708
jmp 0x140016bcc
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x39], r15b
jne 0x140016bac
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x39], r15b
jne 0x140016bcc
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x39], r15b
je 0x140016b9e
jmp 0x140016bcc
mov rax, qword [rbx + 8]
cmp byte [rax + 0x39], r15b
jne 0x140016bc9
cmp rbx, qword [rax + 0x10]
jne 0x140016bc9
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x39], r15b
je 0x140016bb6
mov rbx, rax
cmp rbx, qword [r13 + 8]
jne 0x140016a7e
cmp bpl, r15b
je 0x140016bfc
mov rax, qword [r14]
mov qword [rsp + 0x20], r15
lea r9, [0x140002fec]
mov edx, 0x8000006d
mov r8d, 4
mov rcx, r14
call qword [rax + 0x18]
nop
cmp qword [rsp + 0x40], r15
je 0x140016c0e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140022620
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400170ac
Capabilities:
Delete registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x4c0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x14002d148]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov ebx, r9d
mov rsi, r8
mov r14, rdx
mov edi, ecx
mov r13, qword [rsp + 0x520]
xor eax, eax
mov r12, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov rbp, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov word [rsp + 0x2a0], ax
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2a2]
call sub.msvcrt.dll_memset
xor eax, eax
mov word [rsp + 0x90], ax
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x92]
call sub.msvcrt.dll_memset
lea r8d, [rbp + 0x10]
lea rdx, [rsp + 0x2a0]
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__itow]
lea r8d, [rbp + 0x10]
lea rdx, [rsp + 0x90]
mov ecx, edi
call qword [sym.imp.msvcrt.dll__itow]
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x78], rdi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140015164
mov ebx, eax
cmp eax, edi
jl 0x140017297
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.1400166e0
mov ebx, eax
cmp eax, edi
jl 0x140017297
mov r8d, 0x20106
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.14001affc
mov ebx, eax
cmp eax, edi
jl 0x140017292
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [rsp + 0x2a0]
mov r12, qword [rsp + 0x60]
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.140005838
mov esi, 0x80004005
cmp eax, edi
cmovne ebx, esi
cmp ebx, edi
jl 0x14001728b
mov rcx, r13
call fcn.1400150fc
cmp rax, rdi
jbe 0x14001726b
mov eax, edi
cmp r13, rdi
setne al
cmp eax, edi
jne 0x140017237
mov ecx, esi
call fcn.1400057b8
int3
mov rcx, r13
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rcx, rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
jmp 0x140017284
mov rdx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rcx, rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueW]
cmp eax, 2
cmove eax, edi
cmp eax, edi
cmovne ebx, esi
jmp 0x140017297
mov rbp, qword [rsp + 0x48]
jmp 0x140017297
mov r12, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
cmp rbp, rdi
je 0x1400172bb
mov rcx, rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
nop
cmp r12, rdi
je 0x1400172c9
mov rcx, r12
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.140022620
add rsp, 0x4c0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001964c
Capabilities:
Delete file
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14002d148]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rax, [0x140003960]
mov rbx, rcx
mov dword [rcx + 8], 0xc0000001
mov qword [rcx], rax
call fcn.14001b478
mov rcx, qword [rbx + 0x38]
call fcn.1400150fc
xor esi, esi
cmp rax, rsi
jbe 0x140019738
mov r8d, dword [rbx + 0x30]
lea rdx, [rbx + 0x20]
lea rcx, [rbx + 0x10]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], rsi
call fcn.14001b15c
cmp eax, esi
mov edi, eax
jl 0x14001971f
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rsp + 0x20]
xor r9d, r9d
mov r8d, 0x400
call sub.OLEAUT32.dll_VarR8Pow
cmp eax, 1
je 0x14001971f
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], si
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x38]
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.API_MS_Win_Core_ProcessEnvironment_L1_1_0.dll_ExpandEnvironmentStringsW]
mov ecx, 0x80004005
cmp eax, esi
cmove edi, ecx
cmp edi, esi
jl 0x14001971f
lea rcx, [rsp + 0x30]
call qword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_DeleteFileW]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x20]
mov qword [rbx + 0x38], rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [0x14002e1b8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140022620
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001b15c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x4c0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x14002d148]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov rbp, r9
mov r13d, r8d
mov rbx, rdx
mov r12, rcx
xor r15d, r15d
cmp r9, r15
je 0x14001b1a3
mov qword [r9], r15
mov rdi, r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov rsi, r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov word [rsp + 0x2a0], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2a2]
call sub.msvcrt.dll_memset
mov word [rsp + 0x90], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x92]
call sub.msvcrt.dll_memset
mov r8d, 0x10
lea rdx, [rsp + 0x2a0]
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__itow]
mov qword [rsp + 0x48], r15
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140015164
mov ebx, eax
cmp eax, r15d
jl 0x14001b34c
mov r8d, 0x20106
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.14001affc
mov ebx, eax
cmp eax, r15d
jl 0x14001b347
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20119
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [rsp + 0x2a0]
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140005838
mov r12d, 0x80004005
cmp eax, r15d
cmovne ebx, r12d
cmp ebx, r15d
jl 0x14001b340
mov dword [rsp + 0x44], 0x208
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r15d
jne 0x14001b315
cmp dword [rsp + 0x40], 1
je 0x14001b2ec
cmp dword [rsp + 0x40], 2
jne 0x14001b31f
mov eax, dword [rsp + 0x44]
cmp eax, r15d
je 0x14001b309
test al, 1
jne 0x14001b31f
shr rax, 1
cmp word [rsp + rax*2 + 0x8e], r15w
je 0x14001b312
jmp 0x14001b31f
mov word [rsp + 0x90], r15w
mov eax, r15d
cmp eax, 2
je 0x14001b322
cmp eax, r15d
je 0x14001b322
mov ebx, r12d
cmp ebx, r15d
jl 0x14001b34c
cmp rbp, r15
je 0x14001b34c
lea rcx, [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp], rax
jmp 0x14001b34c
mov rsi, qword [rsp + 0x68]
jmp 0x14001b34c
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
cmp rsi, r15
je 0x14001b367
mov rcx, rsi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
nop
cmp rdi, r15
je 0x14001b375
mov rcx, rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.140022620
add rsp, 0x4c0
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret