joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140097440
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov qword [rsp + 0x30], 0xfffffffffffffffe
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
xor esi, esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], rsi
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
xor bpl, bpl
lea rdx, [rsp + 0x98]
lea ecx, [rsi + 3]
call fcn.140195770
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov r8, rax
mov rdx, 0xffffffff80000002
mov r9d, 0x20019
lea rcx, [rsp + 0x38]
call fcn.14008ff80
test eax, eax
jne 0x140097566
mov edx, Ordinal_261
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_4855]
mov rdi, rax
mov dword [rsp + 0x80], Ordinal_528
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str.UpdateDisabled
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140097539
mov eax, dword [rsp + 0x88]
dec eax
cmp eax, 1
ja 0x140097539
test rdi, rdi
je 0x140097539
cmp dword [rsp + 0x80], esi
jne 0x140097539
mov word [rdi], si
or edx, 0xffffffff
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_12110]
test rbx, rbx
je 0x140097560
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
jmp 0x14009756b
mov rbx, qword [rsp + 0x38]
lea rdx, [0x1402dfdfc]
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_2861]
movzx edi, bpl
mov ecx, 1
test eax, eax
cmove edi, ecx
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
test rbx, rbx
je 0x1400975ac
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
movzx eax, dil
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140097730
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov qword [rsp + 0x30], 0xfffffffffffffffe
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
xor esi, esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], rsi
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
xor bpl, bpl
lea rdx, [rsp + 0x98]
lea ecx, [rsi + 3]
call fcn.140195770
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x20019
lea rcx, [rsp + 0x38]
call fcn.14008ff80
test eax, eax
jne 0x140097856
mov edx, Ordinal_261
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_4855]
mov rdi, rax
mov dword [rsp + 0x80], Ordinal_528
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, [0x1402dfe00]
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140097829
mov eax, dword [rsp + 0x88]
dec eax
cmp eax, 1
ja 0x140097829
test rdi, rdi
je 0x140097829
cmp dword [rsp + 0x80], esi
jne 0x140097829
mov word [rdi], si
or edx, 0xffffffff
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_12110]
test rbx, rbx
je 0x140097850
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
jmp 0x14009785b
mov rbx, qword [rsp + 0x38]
lea rdx, [0x1402dfdfc]
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_2861]
movzx edi, bpl
mov ecx, 1
test eax, eax
cmove edi, ecx
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
test rbx, rbx
je 0x14009789c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
movzx eax, dil
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400978c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x58
mov qword [rbp - 0x28], 0xfffffffffffffffe
lea rcx, [rbp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
xor esi, esi
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x18], esi
mov qword [rbp - 0x10], rsi
lea rcx, [rbp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
lea rdx, [rbp + 0x40]
lea ecx, [rsi + 3]
call fcn.140195770
lea rcx, [rbp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x20019
lea rcx, [rbp - 0x20]
call fcn.14008ff80
test eax, eax
jne 0x1400979b2
mov edx, Ordinal_261
lea rcx, [rbp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_4855]
mov rdi, rax
mov dword [rbp + 0x28], Ordinal_521
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x30]
xor r8d, r8d
lea rdx, str.UpdateIsSilent
mov rbx, qword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14009798b
mov eax, dword [rbp + 0x30]
dec eax
cmp eax, 1
ja 0x14009798b
test rdi, rdi
je 0x14009798b
cmp dword [rbp + 0x28], esi
jne 0x14009798b
mov word [rdi], si
or edx, 0xffffffff
lea rcx, [rbp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_12110]
test rbx, rbx
je 0x1400979ad
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
mov qword [rbp - 0x20], rbx
mov dword [rbp - 0x18], esi
jmp 0x1400979b6
mov rbx, qword [rbp - 0x20]
lea rcx, [rbp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_7775]
test al, al
je 0x140097a7c
lea rcx, [rbp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov r8, rax
mov rdx, 0xffffffff80000002
mov r9d, 0x20019
lea rcx, [rbp - 0x20]
call fcn.14008ff80
test eax, eax
jne 0x140097a78
mov edx, Ordinal_261
lea rcx, [rbp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_4855]
mov rdi, rax
mov dword [rbp + 0x28], Ordinal_521
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x30]
xor r8d, r8d
lea rdx, str.UpdateIsSilent
mov rbx, qword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140097a51
mov eax, dword [rbp + 0x30]
dec eax
cmp eax, 1
ja 0x140097a51
test rdi, rdi
je 0x140097a51
cmp dword [rbp + 0x28], 0
jne 0x140097a51
mov word [rdi], si
or edx, 0xffffffff
lea rcx, [rbp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_12110]
test rbx, rbx
je 0x140097a73
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
mov qword [rbp - 0x20], rbx
mov dword [rbp - 0x18], esi
jmp 0x140097a7c
mov rbx, qword [rbp - 0x20]
lea rdx, [0x1402dfe60]
lea rcx, [rbp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_2861]
test eax, eax
jne 0x140097a96
xor dil, dil
jmp 0x140097aa1
call fcn.140097730
test al, al
sete dil
lea rcx, [rbp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
test rbx, rbx
je 0x140097abb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
movzx eax, dil
add rsp, 0x58
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140097ae0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x180
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movzx esi, dl
mov ebp, ecx
mov ebx, 2
xor r14d, r14d
mov edi, r14d
mov r8d, ecx
sub r8d, 0xd
je 0x140097b80
sub r8d, 3
je 0x140097b79
sub r8d, ebx
je 0x140097b6e
dec r8d
je 0x140097b67
dec r8d
jne 0x140097bdd
mov edi, 0x3b03
mov rax, qword [0x140467658]
cmp dword [rax + 0x4cc], 3
jge 0x140097b5e
test sil, sil
jne 0x140097b5e
call fcn.1400978c0
test al, al
je 0x140097b5e
xor al, al
jmp 0x140097b60
mov al, 1
mov ebx, reloc.mfc120u.dll_Ordinal_1496
jmp 0x140097b9e
mov edi, 0x3b02
jmp 0x140097ba2
mov edi, 0x32d
movzx eax, sil
jmp 0x140097b9e
mov edi, 0x3b05
jmp 0x140097b4c
mov edi, 0x3b04
test sil, sil
jne 0x140097b97
call fcn.1400978c0
test al, al
je 0x140097b97
xor al, al
jmp 0x140097b99
mov al, 1
mov ebx, reloc.mfc120u.dll_Ordinal_1499
test al, al
je 0x140097bdd
mov rax, qword [0x140467658]
mov edx, dword [rax + 0x4cc]
mov ecx, ebp
call fcn.1400c5580
mov edx, eax
mov r8d, ebp
lea rcx, [rsp + 0x40]
call fcn.1400c54d0
nop
lea rcx, [rsp + 0x40]
call sub.mfc120u.dll_Ordinal_3908
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.1400c5530
sub ebx, 0x5d6
je 0x140097ce1
dec ebx
je 0x140097cd2
dec ebx
je 0x140097cbd
sub ebx, 2
je 0x140097c36
dec ebx
jne 0x140097d07
mov cl, 1
call fcn.1400982b0
mov dl, 1
lea rcx, [0x140467440]
call fcn.140098960
lea rcx, [0x140467440]
call fcn.1400987d0
mov byte [rax + 0x4d1], sil
lea edx, [rbx + 4]
jmp 0x140097d13
mov rax, qword [0x140467658]
mov byte [rax + 0x4d1], 1
mov edx, 8
lea rcx, [0x140467440]
call fcn.140098840
nop word [rax + rax]
lea rcx, [0x140467440]
call fcn.1400987e0
cmp eax, 1
jne 0x140097c81
lea rcx, [0x140467440]
call fcn.1400987c0
test eax, eax
je 0x140097c8e
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140097c60
call sub.mfc120u.dll_Ordinal_2180
test rax, rax
je 0x140097ca7
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0xf8]
mov r14, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [r14 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140097d1f
mov rax, qword [0x140467658]
mov byte [rax + 0x4d1], 0
mov edx, 8
jmp 0x140097d13
cmp edi, 0x32d
jne 0x140097d1f
mov edx, 3
jmp 0x140097d13
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.http:__www.nitropdf.com_support_downloads
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp ebp, 0x13
jne 0x140097d11
lea edx, [rbp - 0xa]
jmp 0x140097d13
xor edx, edx
lea rcx, [0x140467440]
call fcn.140098840
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140097eb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x550
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x560], rbx
mov rax, qword [0x140462840]
xor rax, rsp
mov qword [rsp + 0x540], rax
movzx edi, cl
lea rcx, str.kPreferences
mov rax, qword [0x1404672c0]
call qword [rax + 0x1190]
mov r8b, 1
lea rdx, str.kPrefUpgradeNotification
mov rcx, rax
mov rax, qword [0x1404672d8]
call qword [rax + 0x188]
xor bl, bl
test al, al
je 0x140097fb5
lea rcx, [0x140467440]
call fcn.1400987d0
lea rdx, [rax + 0xbc]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_286]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140097faa
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400e88f0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc120u.dll_Ordinal_280]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400e9060
lea rcx, [rsp + 0x70]
call sub.mfc120u.dll_Ordinal_3908
cmp rax, 1
jne 0x140097f9d
xor r9d, r9d
xor r8d, r8d
mov edx, eax
lea rcx, [0x1404697f0]
call fcn.14015c270
mov bl, 1
lea rcx, [rsp + 0x70]
call fcn.1400e8990
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
test dil, dil
je 0x140098023
test bl, bl
jne 0x140098023
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
mov edx, VariantTimeToDosDateTime
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_8043]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140190f20
nop
mov rcx, rax
call fcn.140191980
mov rcx, rax
mov rax, qword [0x1404672c0]
call qword [rax + Ordinal_6578]
nop
lea rcx, [rsp + 0x50]
call fcn.1401918b0
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
mov edx, 7
lea rcx, [0x140467440]
call fcn.140098840
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.140289bf0
mov rbx, qword [rsp + 0x560]
add rsp, 0x550
pop rdi
ret
Function at 0x1400980f0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
lea rcx, [0x140467440]
call fcn.1400987d0
lea rdx, [rax + 0xbc]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_286]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140098199
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_4856]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
or edx, 0xffffffff
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_12110]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140098199
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
add rsp, 0x38
ret

Function at 0x1400982b0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
movzx ebx, cl
lea rdx, [0x1402d7e68]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc120u.dll_Ordinal_290]
nop
test bl, bl
je 0x1400982eb
lea rdx, [0x1402dfdfc]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc120u.dll_Ordinal_1498]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
lea rdx, [rsp + 0x68]
mov ecx, 3
call fcn.140195770
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x20006
lea rcx, [rsp + 0x38]
call fcn.14008ff80
test eax, eax
jne 0x1400983b6
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov r8, rax
xor ecx, ecx
test rax, rax
setne cl
mov rbx, qword [rsp + 0x38]
test ecx, ecx
je 0x1400983a4
or rdx, 0xffffffffffffffff
nop dword [rax]
lea rdx, [rdx + 1]
cmp word [rax + rdx*2], 0
jne 0x140098370
lea eax, [rdx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1402dfe00]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x1400983bb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
jmp 0x1400983bb
mov rbx, qword [rsp + 0x38]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
test rbx, rbx
je 0x1400983d6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
add rsp, 0x50
pop rbx
ret
Function at 0x1400983f0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
movzx ebx, cl
lea rdx, [0x1402d7e68]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc120u.dll_Ordinal_290]
nop
test bl, bl
je 0x14009842b
lea rdx, [0x1402dfdfc]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc120u.dll_Ordinal_1498]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
lea rdx, [rsp + 0x68]
mov ecx, 3
call fcn.140195770
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x20006
lea rcx, [rsp + 0x38]
call fcn.14008ff80
test eax, eax
jne 0x1400984f6
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov r8, rax
xor ecx, ecx
test rax, rax
setne cl
mov rbx, qword [rsp + 0x38]
test ecx, ecx
je 0x1400984e4
or rdx, 0xffffffffffffffff
nop dword [rax]
lea rdx, [rdx + 1]
cmp word [rax + rdx*2], 0
jne 0x1400984b0
lea eax, [rdx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
mov r9d, 1
xor r8d, r8d
lea rdx, str.UpdateIsSilent
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x1400984fb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
jmp 0x1400984fb
mov rbx, qword [rsp + 0x38]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
test rbx, rbx
je 0x140098516
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
add rsp, 0x50
pop rbx
ret

Function at 0x140098570
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140462840]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
lea rdx, str.GlobalNitroPDF_Shared_UpdateService_Data
mov rbx, rcx
mov qword [rcx + 0x218], rax
mov qword [rcx], rax
mov dword [rcx + reloc.mfc120u.dll_Ordinal_528], 0x4d4
call fcn.140098650
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, Ordinal_261
call sub.MSVCR120.dll_memset
lea rdx, [rsp + 0x20]
mov ecx, Ordinal_261
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rax, qword [rbx + 0x218]
test rax, rax
je 0x14009861a
lea r8, [rsp + 0x20]
or rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [r8 + rcx*2], 0
jne 0x1400985f0
cmp ecx, 0x104
jge 0x14009861a
lea rcx, [rax + 0x2c4]
lea r8, [rsp + 0x20]
mov edx, Ordinal_261
call qword [sym.imp.MSVCR120.dll_wcscpy_s]
cmp qword [0x140467430], 0
jne 0x140098629
call fcn.140098760
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140289bf0
add rsp, 0x240
pop rbx
ret
Function at 0x140098650
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov eax, dword [rcx + reloc.mfc120u.dll_Ordinal_528]
mov qword [rsp + 0x28], rdx
xor r9d, r9d
mov rdi, rdx
mov rbx, rcx
lea r8d, [r9 + 4]
xor edx, edx
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx], rax
test rax, rax
jne 0x1400986a3
lea rcx, str.CreateFileMapping
call fcn.140177710
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea rcx, str.CreateFileMapping_succeeded
mov qword [rsp + 0x50], rsi
call fcn.140177780
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
lea edx, [rsi + 6]
lea r8d, [rsi + 4]
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov r9d, Ordinal_261
lea rcx, [rbx + 8]
lea edx, [r9 + 1]
mov r8, rdi
call qword [sym.imp.MSVCR120.dll_wcsncpy_s]
mov rcx, qword [rbx]
lea edx, [rsi + 6]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, qword [rsp + 0x50]
mov qword [rbx + 0x218], rax
test rax, rax
jne 0x140098739
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1402d7670]
call fcn.140177710
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea rcx, str.MapViewOfFile_succeeded
call fcn.140177780
mov rbx, qword [rsp + 0x58]
mov eax, 1
add rsp, 0x40
pop rdi
ret
Function at 0x1400989d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov qword [rsp + 0x30], 0xfffffffffffffffe
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
xor esi, esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], rsi
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
xor bpl, bpl
lea rdx, [rsp + 0x98]
lea ecx, [rsi + 3]
call fcn.140195770
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov r8, rax
mov rdx, 0xffffffff80000002
mov r9d, 0x20019
lea rcx, [rsp + 0x38]
call fcn.14008ff80
test eax, eax
jne 0x140098aed
mov edx, Ordinal_261
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_4855]
mov rdi, rax
mov dword [rsp + 0x80], Ordinal_528
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str.installsource
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140098ac9
mov eax, dword [rsp + 0x88]
dec eax
cmp eax, 1
ja 0x140098ac9
test rdi, rdi
je 0x140098ac9
cmp dword [rsp + 0x80], esi
jne 0x140098ac9
mov word [rdi], si
or edx, 0xffffffff
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_12110]
test rbx, rbx
je 0x140098af2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
jmp 0x140098af2
mov rbx, qword [rsp + 0x38]
xor r8d, r8d
lea rdx, str.lenovo
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_4467]
movzx edi, bpl
mov ecx, 1
cmp eax, 0xffffffff
cmovne edi, ecx
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
test rbx, rbx
je 0x140098b37
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
movzx eax, dil
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400a2af0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call qword [sym.imp.BCGCBPRO2300u120.dll_public_virtual:_void___cdecl_CBCGPRecentFilesListBox::OnChoosePinnedFile_wchar_t_const____ptr64____ptr64]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a2b2b
mov rax, qword [0x1404672c0]
call qword [rax + 0x1168]
test rax, rax
je 0x1400a2b2b
mov rcx, qword [rax]
add rsp, 0x20
pop rbx
jmp fcn.1400ed280
add rsp, 0x20
pop rbx
ret
Function at 0x1400a2b40
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov ebx, edx
mov rdi, rcx
lea rdx, [rsp + 0x20]
call qword [sym.imp.BCGCBPRO2300u120.dll_public:_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_CBCGPRecentFilesListBox::GetItemPath_int____ptr64]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a2bab
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.BCGCBPRO2300u120.dll_public_virtual:_void___cdecl_CBCGPRecentFilesListBox::OnChooseRecentFile_unsigned_int____ptr64]
mov rax, qword [0x1404672c0]
call qword [rax + 0x1168]
test rax, rax
je 0x1400a2c3e
mov rcx, qword [rax]
call fcn.1400ed280
jmp 0x1400a2c3e
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
call sub.mfc120u.dll_Ordinal_2170
mov rcx, qword [rax + 8]
mov rcx, qword [rcx + reloc.mfc120u.dll_Ordinal_280]
mov rax, qword [rcx]
lea edx, [rbx - 0xe110]
call qword [rax]
mov r8, qword [rsp + 0x20]
mov edx, 0x57
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc120u.dll_Ordinal_4611]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140190f20
nop
mov rbx, qword [0x1404672c0]
mov rcx, rax
call fcn.140191980
mov rcx, rax
call qword [rbx + Ordinal_6578]
nop
lea rcx, [rsp + 0x28]
call fcn.1401918b0
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x340]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret