joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001dc70
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [rcx]
mov rdi, rcx
lea rcx, [rbp - 0x20]
call fcn.14000c6b4
mov rcx, rax
call fcn.14001a798
test al, al
jne 0x14001dcd3
mov rdx, qword [rdi]
lea rcx, [rbp - 0x20]
call fcn.14000c6b4
mov rcx, rax
call fcn.14001a980
mov ebx, eax
test eax, eax
jns 0x14001dcd3
mov edx, 0x36
mov rcx, qword [rbp + 0x18]
lea r8, str.onecoreenduserupgradeenablersdssdsslibrarypollingscheduler.cpp
mov r9d, ebx
call fcn.1400054ac
mov eax, ebx
jmp 0x14001de21
lea rcx, [rbp + 0x28]
call fcn.140030250
mov ebx, eax
test eax, eax
jns 0x14001dce9
mov edx, 0x39
jmp 0x14001dcb9
mov eax, dword [rbp + 0x2c]
mov rsi, qword [rdi + 8]
mov rdi, qword [rdi]
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0x20], eax
xor ecx, ecx
call fcn.14000c400
mov rax, qword [rbp + 0x20]
xor ebx, ebx
and qword [rbp + 0x20], rbx
xor r8d, r8d
mov qword [rbp + 0x30], rax
mov rdx, rdi
lea rax, [rbp + 0x20]
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 2]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001dd48
mov rbx, qword [rbp + 0x20]
and qword [rbp + 0x20], 0
xor edi, edi
jmp 0x14001dd5d
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14000c4dc
mov ecx, edi
call fcn.14000c400
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14001dd7e
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rbp + 0x20], 0
test edi, edi
js 0x14001ddcb
xor ecx, ecx
call fcn.14000c400
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001ddbd
xor edi, edi
jmp 0x14001ddd2
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14000c4dc
mov ecx, edi
call fcn.14000c400
test rbx, rbx
je 0x14001dded
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jns 0x14001ddf8
mov ecx, edi
call fcn.14000c4dc
mov ecx, edi
call fcn.14000c400
test edi, edi
jns 0x14001de1f
mov rcx, qword [rbp + 0x18]
lea r8, str.onecoreenduserupgradeenablersdssdsslibrarypollingscheduler.cpp
mov r9d, edi
mov edx, 0x3e
call fcn.1400054ac
mov eax, edi
jmp 0x14001de21
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001edc4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [rcx]
mov rdi, rcx
lea rcx, [rbp - 0x20]
call fcn.14000c6b4
mov rcx, rax
call fcn.14001a798
test al, al
jne 0x14001ee27
mov rdx, qword [rdi]
lea rcx, [rbp - 0x20]
call fcn.14000c6b4
mov rcx, rax
call fcn.14001a980
mov ebx, eax
test eax, eax
jns 0x14001ee27
mov edx, 0x1b3
mov rcx, qword [rbp + 0x18]
lea r8, str.onecoreenduserupgradeenablersdssdsslibrarypollingscheduler.cpp
mov r9d, ebx
call fcn.1400054ac
mov eax, ebx
jmp 0x14001ef75
lea rcx, [rbp + 0x28]
call fcn.140030250
mov ebx, eax
test eax, eax
jns 0x14001ee3d
mov edx, 0x1b6
jmp 0x14001ee0d
mov eax, dword [rbp + 0x2c]
mov rsi, qword [rdi + 0x48]
mov rdi, qword [rdi]
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0x20], eax
xor ecx, ecx
call fcn.14000c400
mov rax, qword [rbp + 0x20]
xor ebx, ebx
and qword [rbp + 0x20], rbx
xor r8d, r8d
mov qword [rbp + 0x30], rax
mov rdx, rdi
lea rax, [rbp + 0x20]
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 2]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001ee9c
mov rbx, qword [rbp + 0x20]
and qword [rbp + 0x20], 0
xor edi, edi
jmp 0x14001eeb1
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14000c4dc
mov ecx, edi
call fcn.14000c400
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14001eed2
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rbp + 0x20], 0
test edi, edi
js 0x14001ef1f
xor ecx, ecx
call fcn.14000c400
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001ef11
xor edi, edi
jmp 0x14001ef26
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14000c4dc
mov ecx, edi
call fcn.14000c400
test rbx, rbx
je 0x14001ef41
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jns 0x14001ef4c
mov ecx, edi
call fcn.14000c4dc
mov ecx, edi
call fcn.14000c400
test edi, edi
jns 0x14001ef73
mov rcx, qword [rbp + 0x18]
lea r8, str.onecoreenduserupgradeenablersdssdsslibrarypollingscheduler.cpp
mov r9d, edi
mov edx, 0x1bb
call fcn.1400054ac
mov eax, edi
jmp 0x14001ef75
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001f534
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
xor ebx, ebx
lea rax, [r11 - 0x20]
and qword [r11 - 0x20], rbx
mov r14, r9
mov rbp, r8
mov qword [r11 - 0x38], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea esi, [rbx + 1]
mov r9d, esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001f58e
mov rbx, qword [rsp + 0x38]
and qword [rsp + 0x38], 0
xor edi, edi
jmp 0x14001f5a3
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14000c4dc
mov ecx, edi
call fcn.14000c400
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001f5c6
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rsp + 0x38], 0
test edi, edi
jns 0x14001f5d3
mov ecx, edi
call fcn.14000c4dc
jmp 0x14001f61b
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14001f618
cmp eax, 2
je 0x14001f616
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14001f5ca
xor esi, esi
mov dword [r14], esi
mov ecx, edi
call fcn.14000c400
test rbx, rbx
je 0x14001f636
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x68]
mov eax, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140020520
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, r8
lea rcx, [rsp + 0x60]
mov rbp, rdx
call fcn.140030250
mov eax, dword [rsp + 0x64]
mov rsi, qword [rbx + 0x18]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x50], eax
xor ecx, ecx
call fcn.14000c400
xor ebx, ebx
xor r8d, r8d
imul rax, rdi, 0x23c34600
lea r9d, [rbx + 2]
mov rdx, rsi
add rax, qword [rsp + 0x50]
mov rcx, 0xffffffff80000002
and qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov esi, 0x80070000
test eax, eax
jne 0x1400205b1
mov rbx, qword [rsp + 0x50]
and qword [rsp + 0x50], 0
xor edi, edi
jmp 0x1400205c2
movzx edi, ax
or edi, esi
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14000c4dc
mov ecx, edi
call fcn.14000c400
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400205e5
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rsp + 0x50], 0
test edi, edi
js 0x14002062f
xor ecx, ecx
call fcn.14000c400
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140020625
xor edi, edi
jmp 0x140020636
movzx edi, ax
or edi, esi
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14000c4dc
mov ecx, edi
call fcn.14000c400
test rbx, rbx
je 0x140020651
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jns 0x14002065c
mov ecx, edi
call fcn.14000c4dc
mov ecx, edi
call fcn.14000c400
test edi, edi
jns 0x140020684
mov rcx, qword [rsp + 0x48]
lea r8, str.onecoreenduserupgradeenablersdssdsslibrary_remoteactionscheduler.cpp
mov r9d, edi
mov edx, 0xef
call fcn.1400054ac
mov eax, edi
jmp 0x140020686
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140025264
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov r8, qword [r8 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x1400252a2
mov rdx, qword [r14]
movabs rbp, 0xcbf29ce484222325
xor r13d, r13d
mov ecx, r13d
add r8, r8
je 0x1400252d4
movzx eax, byte [rcx + rdx]
xor rbp, rax
movabs r9, 0x100000001b3
imul rbp, r9
inc rcx
cmp rcx, r8
jb 0x1400252b7
mov r9, rbp
mov r8, r14
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400182b4
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400252fd
mov qword [rdi], rax
mov byte [rdi + 8], r13b
jmp 0x14002544e
movabs rax, 0x333333333333333
cmp qword [rsi + 0x10], rax
je 0x140025470
lea r12, [rsi + 8]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r13
mov ecx, 0x50
call fcn.140034de4
mov rbx, rax
mov qword [rsp + 0x40], rax
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], r13
movups xmm0, xmmword [r14]
movups xmmword [rax + 0x10], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rax + 0x20], xmm1
mov qword [r14 + 0x10], r13
mov eax, 7
mov qword [r14 + 0x18], rax
mov word [r14], r13w
mov qword [rbx + 0x40], r13
mov qword [rbx + 0x48], rax
mov word [rbx + 0x30], r13w
mov r9, qword [rsi + 0x10]
lea rcx, [r9 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x14002537f
cvtsi2ss xmm0, rcx
jmp 0x140025394
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400253a7
cvtsi2ss xmm1, rcx
jmp 0x1400253bc
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x1400253f3
mov rcx, rsi
call fcn.140017c4c
mov r9, rbp
lea r8, [rbx + 0x10]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1400182b4
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x28], xmm0
mov r9, qword [rsi + 0x10]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rdx + 8]
lea rax, [r9 + 1]
mov qword [rsi + 0x10], rax
mov qword [rbx], rdx
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rdx + 8], rbx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, rbp
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x140025430
mov qword [rcx + rax*8], rbx
jmp 0x140025442
cmp r9, rdx
jne 0x14002543b
mov qword [rcx + rax*8], rbx
jmp 0x140025447
cmp qword [rcx + rax*8 + 8], r8
jne 0x140025447
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rax, rdi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call fcn.140010a34
int3
Function at 0x140029f30
Capabilities:
Read http header
Receive http response

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov rsi, rdx
mov dword [rax + 8], 4
xor ebx, ebx
xor edx, edx
mov dword [r8], ebx
mov rdi, r8
mov rcx, qword [rsi]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
nop dword [rax + rax]
test eax, eax
jne 0x140029f91
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
jmp 0x140029fe4
mov rcx, qword [rsi]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov r9, rdi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x20000013
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
nop dword [rax + rax]
test eax, eax
jne 0x140029fe2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov ebx, 0x80004005
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovs ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14002a804
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x60
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rbx, rdx
xor edi, edi
mov dword [rax - 0x48], edi
lea rdx, [0x14003af84]
mov rcx, rbx
call fcn.14000c6b4
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_0.dll_GetNativeSystemInfo]
nop dword [rax + rax]
movzx eax, word [rsp + 0x30]
test ax, ax
jne 0x14002a871
lea rdx, [0x140048328]
jmp 0x14002a87e
cmp ax, 9
jne 0x14002a886
lea rdx, str.amd64
mov rcx, rbx
call fcn.14000e838
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x14002a893
mov r8, qword [rbx]
lea rdx, str.Found_OS_architecture:__s
xor ecx, ecx
call fcn.14000bb5c
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14002f1e8
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x218]
sub rsp, 0x300
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14005b8e0]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov rdi, rdx
xor esi, esi
mov dword [rsp + 0x6c], esi
mov qword [rbp - 0x48], rsi
lea r14d, [rsi + 7]
mov qword [rbp - 0x40], r14
mov word [rbp - 0x58], si
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], r14
mov word [rbp - 0x78], si
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov dword [rsp + 0x20], esi
mov edx, 0x104
lea rcx, [rbp - 0x20]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14002f2be
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmove ebx, eax
mov r8d, ebx
lea rdx, str.Error_retrieving_Windows_system_directoryhr__0x_08x.
mov ecx, ebx
call fcn.14000bb5c
test ebx, ebx
jns 0x14002f2be
mov rcx, qword [rbp + 0x218]
mov r9d, ebx
lea r8, str.onecoreenduserupgradeenablersdssdsslibraryunenrollmentexecutor.cpp
lea edx, [rsi + 0x73]
call fcn.1400054ac
jmp 0x14002f3c7
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x58]
call fcn.14000c5d0
lea rdx, [0x14003af78]
lea rcx, [rbp - 0x58]
call fcn.14000c5d0
lea rdx, str.msiexec.exe
lea rcx, [rbp - 0x58]
call fcn.14000c5d0
lea rdx, str.__x
lea rcx, [rbp - 0x78]
call fcn.14000c5d0
cmp qword [rdi + 0x18], 8
jb 0x14002f305
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.14000c5d0
lea rdx, str.__qn
lea rcx, [rbp - 0x78]
call fcn.14000c5d0
lea rax, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rax, qword [rbp - 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rax, qword [rbp - 0x78]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x68], esi
lea rax, str.Uninstall_dss_client
mov qword [rsp + 0x58], rax
lea rax, str.MicrosoftWindows
mov qword [rsp + 0x50], rax
lea rax, [0x140049ed0]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov byte [rsp + 0x38], sil
lea rdx, [rbp - 0x38]
call fcn.14001bcac
movups xmm0, xmmword [rbp - 0x38]
movdqu xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.1400342e0
mov ebx, eax
test eax, eax
je 0x14002f3bc
mov r8d, eax
lea rdx, str.Error_creating_removal_task__0x_08x.
mov ecx, eax
call fcn.14000bb5c
nop
lea rcx, [rsp + 0x28]
call fcn.140032a4c
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14002f3e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
call fcn.14000f8e8
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], r14
mov word [rbp - 0x78], si
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14002f409
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
call fcn.14000f8e8
mov eax, ebx
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.140034af0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14002ffa0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x40
and qword [rsp + 0x30], 0
mov rbx, r9
mov dword [rsp + 0x58], 4
mov rax, r8
mov rdi, rcx
test rcx, rcx
jne 0x14002ffd7
mov ecx, 0x80070057
mov edx, ecx
jmp 0x140030058
test rax, rax
je 0x14002ffcb
test rbx, rbx
je 0x14002ffcb
lea rcx, [rsp + 0x30]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140030048
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140030048
xor edx, edx
cmp dword [rsp + 0x50], 4
je 0x14003005d
jmp 0x14002ffcb
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
mov ecx, edx
call fcn.14000c4dc
mov rcx, qword [rsp + 0x30]
xor ebx, ebx
cmp edx, 0x80070002
cmovne ebx, edx
test rcx, rcx
je 0x14003007e
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000c400
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14003009c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor r12d, r12d
mov dword [rbp + 0x30], 2
cmp qword [rcx + 0x18], 8
mov rbx, r9
mov r10, r8
mov qword [rbp - 8], r12
mov rsi, rcx
mov rax, rcx
jb 0x1400300de
mov rax, qword [rcx]
lea r15, [rcx + 0x10]
mov r9d, 0x20019
mov qword [r15], r12
xor r8d, r8d
mov word [rax], r12w
mov rdx, r10
lea rax, [rbp - 8]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140030212
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea rax, [rbp + 0x38]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
cmp eax, 0xea
jne 0x140030209
mov eax, dword [rbp - 0x10]
dec eax
cmp eax, 1
jbe 0x140030166
mov ecx, 0x80070057
mov edi, ecx
jmp 0x140030222
mov ecx, dword [rbp + 0x30]
mov eax, 2
shr rcx, 1
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140035c70
mov rcx, qword [rbp - 8]
lea r9, [rbp - 0x10]
mov r14, rax
xor r8d, r8d
lea rax, [rbp + 0x30]
mov rdx, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140030212
cmp dword [rbp + 0x30], 2
mov edi, r12d
jbe 0x14003015a
mov edx, dword [rbp + 0x30]
shr rdx, 1
dec rdx
cmp rdx, qword [rsi + 0x18]
ja 0x1400301f4
cmp qword [rsi + 0x18], 8
jb 0x1400301d8
mov rsi, qword [rsi]
lea rbx, [rdx + rdx]
mov qword [r15], rdx
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov word [rbx + rsi], r12w
jmp 0x1400301ff
mov r9, r14
mov rcx, rsi
call fcn.14000f590
mov rcx, r14
call fcn.140034b18
jmp 0x140030227
test eax, eax
jne 0x140030212
mov edi, r12d
jmp 0x140030227
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14000c4dc
mov ecx, edi
call fcn.14000c400
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400305c8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, r8
mov rdi, rdx
movabs rbp, 0xcbf29ce484222325
xor ecx, ecx
movzx eax, byte [rcx + r8]
xor rbp, rax
movabs rdx, 0x100000001b3
imul rbp, rdx
inc rcx
cmp rcx, 4
jb 0x1400305fb
mov rcx, qword [0x14005c710]
and rcx, rbp
add rcx, rcx
mov rdx, qword [0x14005c6f8]
mov rax, qword [rdx + rcx*8 + 8]
mov rsi, qword [0x14005c6e8]
cmp rax, rsi
je 0x140030671
mov r8, qword [rdx + rcx*8]
mov ecx, dword [r14]
jmp 0x140030651
cmp rax, r8
je 0x14003066a
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140030648
mov rsi, qword [rax]
test rax, rax
je 0x140030671
mov qword [rdi], rax
mov byte [rdi + 8], 0
jmp 0x1400307fe
mov rsi, rax
xor eax, eax
jmp 0x140030659
movabs rax, 0x7ffffffffffffff
cmp qword [0x14005c6f0], rax
je 0x14003081d
lea rax, [0x14005c6e8]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x38], 0
mov ecx, 0x20
call fcn.14000f92c
mov rbx, rax
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [r14]
movdqu xmmword [rax + 0x10], xmm0
mov r8, qword [0x14005c6f0]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1400306cf
cvtsi2ss xmm0, rcx
jmp 0x1400306e4
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x14005c718]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400306fa
cvtsi2ss xmm1, rcx
jmp 0x14003070f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x14005c6e0]
seta al
test al, al
je 0x140030793
call fcn.140030854
mov rax, qword [0x14005c710]
and rax, rbp
add rax, rax
mov r8, qword [0x14005c6f8]
mov rcx, qword [r8 + rax*8 + 8]
mov rdx, qword [0x14005c6e8]
cmp rcx, rdx
jne 0x140030758
mov qword [rsp + 0x30], rdx
and qword [rsp + 0x38], 0
jmp 0x14003077c
mov rdx, qword [r8 + rax*8]
mov eax, dword [rbx + 0x10]
jmp 0x14003076a
cmp rcx, rdx
je 0x1400307d6
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x140030761
mov rax, qword [rcx]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rsi, qword [rsp + 0x30]
mov r8, qword [0x14005c6f0]
mov rdx, qword [rsi + 8]
inc r8
mov qword [0x14005c6f0], r8
mov qword [rbx], rsi
mov qword [rbx + 8], rdx
mov qword [rdx], rbx
mov qword [rsi + 8], rbx
mov rax, qword [0x14005c710]
and rax, rbp
add rax, rax
mov rcx, qword [0x14005c6f8]
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x14005c6e8]
jne 0x1400307e0
mov qword [rcx + rax*8], rbx
jmp 0x1400307f2
mov qword [rsp + 0x30], rcx
jmp 0x140030750
cmp r8, rsi
jne 0x1400307eb
mov qword [rcx + rax*8], rbx
jmp 0x1400307f7
cmp qword [rcx + rax*8 + 8], rdx
jne 0x1400307f7
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
lea rcx, str.unordered_map_set_too_long
call fcn.140010a34
int3