joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006d980
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbp, rdx
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
mov dword [rsp + 0x20], 0x238
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
xor sil, sil
mov rcx, rax
mov rdi, rax
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x14006da21
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x14006da21
cmp qword [rbx + 0x20], 8
jb 0x14006d9f0
mov rdx, qword [rbx + 8]
jmp 0x14006d9f4
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.MSVCR90.dll__wcsicmp]
test eax, eax
je 0x14006da17
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x14006d9e3
jmp 0x14006da21
mov eax, dword [rsp + 0x28]
mov sil, 1
mov dword [rbp], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov al, sil
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140155650
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret
Function at 0x140071930
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2e0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rdi, rcx
mov ebx, 0x270f
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140071983
mov eax, 0x1f40
jmp 0x140071aa5
mov dword [rsp + 0x90], 0x238
lea rdx, [rsp + 0x90]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140071aa3
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x60], rax
nop word [rax + rax]
lea rcx, [rsp + 0x68]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
lea rdx, str.963c9a77fb72e44820b8161a49038365
lea rcx, [rsp + 0x68]
call qword [reloc.MSVCP90.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_PEB_W_Z]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
lea rdx, [rsp + 0xbc]
lea rcx, [rsp + 0x20]
call qword [reloc.MSVCP90.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_PEB_W_Z]
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140072440
test eax, eax
jne 0x140071a9c
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
lea rdx, [rsp + 0xbc]
lea rcx, [rsp + 0x20]
call qword [reloc.MSVCP90.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_PEB_W_Z]
nop
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140071c60
cmp eax, 0x270f
je 0x140071a79
cmp ebx, 0x270f
jne 0x140071a79
mov ebx, eax
lea rcx, [rdi + 0x850]
lea rdx, [rsp + 0xbc]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const____ptr64____ptr64]
lea rdx, [rsp + 0x90]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400719c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140071aa3
mov eax, 0x15b3
jmp 0x140071aa5
mov eax, ebx
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140155650
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140071ad0
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x2a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x104
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x80]
call sub.MSVCR90.dll_memset
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140071b8b
lea rcx, [rsp + 0x58]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x58]
call qword [reloc.MSVCP90.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_PEB_W_Z]
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov r8d, 2
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140071c60
mov ebx, eax
lea rcx, [rsp + 0x58]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov eax, ebx
jmp 0x140071b90
mov eax, 0x270f
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140155650
add rsp, 0x2a0
pop rbx
ret
Function at 0x1400754f0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x200
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rsp + 0x238], rbx
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x1f8], rax
mov r12, r8
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], 0x78
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
lea rdx, str._Utils::MD5::Calculate_
lea rcx, [rsp + 0xc0]
call fcn.140001d10
nop
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x20], 0xf0000000
lea r9d, [rbx + 1]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400755b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
lea rax, str.CryptAcquireContext
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x70]
call sub.MSVCR90.dll__CxxThrowException
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140075610
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
lea rax, [0x1401d2a60]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0xb0], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0xb0]
call sub.MSVCR90.dll__CxxThrowException
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x140075660
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
lea rax, [0x1401d2a80]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0xa0], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0xa0]
call sub.MSVCR90.dll__CxxThrowException
mov dword [rsp + 0x60], 0x10
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x60]
mov r8, r12
mov edx, 2
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x1400756c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
lea rax, [0x1401d2aa0]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x80], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x80]
call sub.MSVCR90.dll__CxxThrowException
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x30], 1
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400756dc
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400756ee
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ebx, dword [rsp + 0x30]
lea rcx, [rsp + 0xc0]
call fcn.140001e50
nop
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rcx, qword [rsp + 0x1f8]
xor rcx, rsp
call fcn.140155650
mov rbx, qword [rsp + 0x238]
add rsp, 0x200
pop r12
pop rdi
pop rsi
ret
Function at 0x14007b770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov sil, byte [rdx + 0x100]
mov bpl, byte [rdx + 0x101]
xor r11d, r11d
mov rdi, r9
mov rbx, r8
mov r10, rdx
test r9, r9
je 0x14007b835
nop word [rax + rax]
movzx eax, sil
movzx ecx, bpl
inc eax
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx r8d, al
mov esi, eax
add r8, r10
movzx eax, byte [r8]
add eax, ecx
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx r9d, al
mov ebp, eax
add r9, r10
cmp r8, r9
je 0x14007b7fb
movzx ecx, byte [r9]
movzx edx, byte [r8]
mov byte [r8], cl
mov byte [r9], dl
movzx ecx, byte [r8]
movzx eax, byte [r9]
inc r11
add eax, ecx
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx ecx, al
movzx eax, byte [rcx + r10]
xor byte [r11 + rbx - 1], al
cmp r11, rdi
jne 0x14007b7b0
mov byte [r10 + 0x100], sil
mov byte [r10 + 0x101], bpl
jmp 0x14007b843
mov byte [rdx + 0x100], sil
mov byte [rdx + 0x101], bpl
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x14007bac0
Capabilities:
Impersonate user

Disassembly:
push rdi
sub rsp, 0x1c0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x1e0], rbx
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov rdi, rdx
mov dword [rsp + 0x20], 0x78
xor ebx, ebx
mov qword [rdx], rbx
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x48], 0x38
lea rax, str.Test
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
jne 0x14007bb7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, [0x1401d38a8]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x90], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x90]
call sub.MSVCR90.dll__CxxThrowException
mov rax, qword [rsp + 0x78]
mov qword [rdi], rax
mov dword [rsp + 0x20], ebx
mov edi, 1
jmp 0x14007bb9a
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.140155650
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1c0
pop rdi
ret
Function at 0x14007f070
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push rdi
sub rsp, 0x1b0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x1c0], rbx
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
mov rdi, rdx
mov dword [rsp + 0x30], 0x80004001
lea rdx, str._Utils::SystemSchedulerXP::OpenScheduler_
mov qword [rsp + 0x40], rdx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
cmp qword [0x140260548], 0
je 0x14007f0d5
lea rcx, [rsp + 0x40]
call fcn.14007ed30
nop
xor ebx, ebx
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [0x1401d3e08]
xor edx, edx
lea r8d, [rbx + 1]
lea rcx, [0x1401d3e28]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x14007f134
mov dword [rsp + 0x60], eax
lea rax, [0x1401b9e08]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [0x1402523a8]
lea rcx, [rsp + 0x70]
call sub.MSVCR90.dll__CxxThrowException
mov rax, qword [rsp + 0x38]
mov qword [rdi], rax
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rbx
jmp 0x14007f14b
lea rcx, [rsp + 0x40]
call fcn.14007ee60
mov eax, ebx
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140155650
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1b0
pop rdi
ret
Function at 0x1400837b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov r14, r8
mov r15, rdx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
lea rdx, str._SynchronousPipe::Write_
mov qword [rsp + 0x58], rdx
xor r12d, r12d
mov dword [rsp + 0x3c], r12d
mov dword [rsp + 0x30], 0x78
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x3c]
lea rcx, [rsp + 0x88]
call fcn.140001d10
nop
test r15, r15
jne 0x140083858
mov dword [rsp + 0x40], 0x57
lea rax, str.Checking_Parameters_
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x70]
call sub.MSVCR90.dll__CxxThrowException
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
mov r11d, 0xfa0
mov eax, dword [rsp + 0x34]
test eax, eax
cmovne r11d, eax
mov dword [rsp + 0x34], r11d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r13d, r12d
mov esi, r12d
mov edi, r14d
mov ecx, esi
cmp rcx, r14
jae 0x14008391d
mov dword [rsp + 0x38], r12d
mov r8d, edi
mov eax, dword [rsp + 0x34]
cmp eax, edi
cmovb r8d, eax
lea rdx, [rcx + r15]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x1400838f1
mov eax, dword [rsp + 0x38]
add esi, eax
sub edi, eax
inc r13d
mov rbx, qword [rsp + 0x40]
jmp 0x1400838a3
mov dword [rsp + 0x40], eax
lea rax, [0x1401cee28]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [0x140252200]
lea rcx, [rsp + 0x60]
call sub.MSVCR90.dll__CxxThrowException
mov dword [rsp + 0x30], r12d
mov ebx, 1
mov dword [rsp + 0x3c], ebx
jmp 0x140083931
lea rcx, [rsp + 0x88]
call fcn.140001e50
nop
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.140155650
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140085050
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov rdi, rdx
mov rsi, rcx
xor r12d, r12d
mov qword [r11 + 0x20], r12
lea rax, [r11 + 0x20]
mov qword [r11 - 0x58], rax
lea r9, [0x1401b6450]
xor edx, edx
lea r8d, [r12 + 1]
lea rcx, [0x1401b6520]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
jns 0x1400850bc
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x1400850b5
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, ebx
jmp 0x140085211
mov qword [rsp + 0x90], r12
mov rbp, qword [rsp + 0x98]
mov ecx, 0x18
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14008510f
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140085112
test rdi, rdi
je 0x140085112
mov ecx, 0x8007000e
call fcn.140155fb0
int3
mov rbx, r12
mov qword [rsp + 0x58], rbx
test rbx, rbx
jne 0x140085127
mov ecx, 0x8007000e
call fcn.140155fb0
nop
mov rcx, qword [rsi]
test rcx, rcx
je 0x140085135
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi], r12
mov rax, qword [rbp]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, rbp
call qword [rax + 0x18]
mov edi, eax
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
jne 0x140085197
mov rcx, qword [rbx]
test rcx, rcx
je 0x140085181
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14008518f
call sub.MSVCR90.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
test edi, edi
jns 0x1400851b2
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x1400851ae
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, edi
jmp 0x140085211
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rsi]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
jns 0x1400851fc
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x1400851f8
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, ebx
jmp 0x140085211
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14008520f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140085ac0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, r8
mov r10, rdx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x58]
mov rbx, r9
mov qword [rsp + 0x38], rcx
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
mov rcx, r10
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140085b14
xor al, al
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x90]
mov r9d, 4
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x60
pop rbx
ret

Function at 0x140085b60
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r9
mov r10, r8
mov rax, rdx
mov rdi, qword [rsp + 0xb0]
lea rcx, [r11 - 0x30]
mov qword [r11 - 0x48], rcx
lea rcx, [r11 - 0x38]
mov qword [r11 - 0x50], rcx
xor ecx, ecx
mov qword [r11 - 0x58], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rdx, r10
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140085bdd
mov rcx, rdi
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x140085c30
mov rax, qword [rdi + 0x18]
cmp qword [rdi + 0x20], 8
jb 0x140085bee
mov rcx, qword [rdi + 8]
jmp 0x140085bf2
lea rcx, [rdi + 8]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov al, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140155650
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140085c50
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rbp, r9
mov rdi, r8
mov rsi, rdx
mov dword [rsp + 0x30], 0x9c40
lea rax, [r11 - 0x48]
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x30]
add rcx, 2
call fcn.14015562c
mov rbx, rax
mov qword [rsp + 0x40], rax
mov r8d, dword [rsp + 0x30]
add r8, 2
xor edx, edx
mov rcx, rax
call sub.MSVCR90.dll_memset
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140085cf9
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
xor al, al
jmp 0x140085d54
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
test rbx, rbx
je 0x140085d19
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [reloc.MSVCP90.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_PEB_W_Z]
nop
lea rax, [rsp + 0x48]
cmp rbp, rax
je 0x140085d3e
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov al, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140085d70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov r10, rdx
mov rax, r8
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
mov rbx, r9
mov qword [rsp + 0x20], rcx
mov rcx, qword [r10]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140085dc1
xor al, al
add rsp, 0x40
pop rbx
ret
mov eax, dword [rsp + 0x30]
mov dword [rbx], eax
mov al, 1
add rsp, 0x40
pop rbx
ret
Function at 0x140085ed0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ecx, 0x13880
mov rdi, r9
mov rsi, r8
mov rbp, rdx
call fcn.14015562c
cmp qword [rdi], 0
mov rbx, rax
jne 0x140085f1f
mov rcx, qword [rbp]
mov r9d, 8
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140085f4f
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rdi]
mov r9d, 0x9c3f
mov edx, dword [rsi]
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x140085f60
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], 0
test rbx, rbx
je 0x140085f5c
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void____ptr64_
xor al, al
jmp 0x140085f83
test eax, eax
jne 0x140085f4f
mov rcx, qword [rsp + 0x68]
mov rdx, rbx
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const____ptr64____ptr64]
inc dword [rsi]
test rbx, rbx
je 0x140085f81
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void____ptr64_
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret