joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001b85
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
Function at 0x1400026dd
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
jmp 0x140006aee
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x1400043c2
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
sub rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x30], rax
jne 0x1400035e8
jmp 0x140003b6a
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
cmp eax, 0x5c
jne 0x14000174a
jmp 0x140003d7b
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x1400059f1
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x140003b6a
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140002304
jmp 0x140001bbd
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*2 + 2]
mov qword [rsp + 0x38], rax
jmp 0x140006aee
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x14000253f
jmp 0x1400075c3
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call fcn.140007739
jmp 0x140007717
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
jmp 0x1400035e8
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
test eax, eax
jne 0x14000253f
jmp 0x1400075c3
mov rcx, qword [rsp + 0x70]
call fcn.1400036a6
jmp 0x1400046f0
test eax, eax
je 0x14000321e
jmp 0x140002304
Function at 0x140008fa4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and dword [rbp - 0xc], 0
lea rax, [rbp - 0x10]
and dword [rbp - 0x10], 0
mov rsi, r8
mov r14d, r9d
mov qword [r11 - 0x30], rax
and qword [r11 - 0x38], 0
lea r9, [rbp - 0xc]
mov r15, rdx
xor r8d, r8d
mov rdx, rsi
mov rdi, rcx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140009074
mov ecx, dword [rbp - 0x10]
inc ecx
and ecx, 0xfffffffe
mov dword [rbp - 0x10], ecx
add ecx, 2
call fcn.14000c800
mov qword [rbp - 8], rax
mov rbx, rax
test rax, rax
jne 0x14000901e
lea eax, [rbx + 8]
jmp 0x140009074
lea rax, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0xc]
mov rdx, rsi
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140009069
mov ecx, dword [rbp - 0x10]
mov r9, rbx
mov r8d, dword [rbp - 0xc]
mov rdx, rsi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ecx
mov rcx, r15
call fcn.140009670
lea rcx, [rbp - 8]
call fcn.14000cca4
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x14000aaec
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140013008]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
or qword [rsp + 0x40], 0xffffffffffffffff
xor r14d, r14d
mov dword [0x1400539a0], r14d
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x14000ab54
mov r9d, r8d
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.14000a970
test eax, eax
je 0x14000ab54
mov dword [0x1400539a0], 0x3f2
jmp 0x14000ad2f
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rbx
mov dword [0x1400135f0], r14d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov qword [0x140053760], rax
cmp rax, 0xffffffffffffffff
je 0x14000ad0f
lea r9, [rsp + 0x48]
mov qword [0x140053768], r14
mov r8d, 2
mov qword [rsp + 0x20], r14
lea rdx, [0x140011154]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
lea rcx, str.Windows_Registry_Editor_Version
call fcn.14000c4bc
lea rcx, [0x1400108bc]
call fcn.14000c4bc
lea rcx, str.5.00
call fcn.14000c4bc
lea rcx, [0x140011134]
call fcn.14000c4bc
lea rcx, [rsp + 0x50]
mov ebx, 0x128
lea rax, [rsp + 0x50]
test rdi, rdi
je 0x14000ac49
mov rdx, rdi
sub rdx, rax
lea rax, [rbx + 0x7ffffed6]
test rax, rax
je 0x14000ac34
movzx eax, word [rdx + rcx]
test ax, ax
je 0x14000ac34
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x14000ac12
lea rax, [rcx - 2]
test rbx, rbx
cmovne rax, rcx
mov rcx, qword [rsp + 0x40]
jmp 0x14000ace4
mov r8, qword [str.HKEY_LOCAL_MACHINE]
mov rdx, rbx
sub r8, rax
lea rax, [rdx + 0x7ffffed6]
test rax, rax
je 0x14000ac79
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000ac79
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000ac56
test rdx, rdx
lea rax, [rcx - 2]
mov r8d, esi
lea rdx, [rsp + 0x50]
cmovne rax, rcx
mov rcx, 0xffffffff80000002
mov word [rax], r14w
call fcn.14000bff0
mov rdx, qword [str.HKEY_USERS]
lea rax, [rsp + 0x50]
sub rdx, rax
lea rcx, [rsp + 0x50]
lea rax, [rbx + 0x7ffffed6]
test rax, rax
je 0x14000acd2
movzx eax, word [rdx + rcx]
test ax, ax
je 0x14000acd2
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x14000acb0
lea rax, [rcx - 2]
test rbx, rbx
cmovne rax, rcx
mov rcx, 0xffffffff80000003
mov r8d, esi
mov word [rax], r14w
lea rdx, [rsp + 0x50]
call fcn.14000bff0
call fcn.14000ad54
mov rcx, qword [0x140053760]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x14000ad19
mov dword [0x1400539a0], 0x6e
test rdi, rdi
je 0x14000ad2f
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140001350
add rsp, 0x2b0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000ad54
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov r8d, dword [0x140053768]
test r8d, r8d
je 0x14000ada8
mov rcx, qword [0x140053760]
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
lea rdx, [0x140033760]
add r8d, r8d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
je 0x14000ad9e
mov eax, dword [0x140053768]
add eax, eax
cmp eax, dword [rsp + 0x40]
je 0x14000ada8
mov dword [0x1400539a0], 0x322
and dword [0x140053768], 0
add rsp, 0x38
ret

Function at 0x14000adbc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rdi
sub rsp, 0x30
mov ebx, dword [0x140053768]
lea rbp, [0x140013760]
mov r8d, dword [0x140053770]
mov rdi, rcx
cmp ebx, r8d
jne 0x14000aed3
mov rcx, qword [0x140053760]
lea r9, [rax + 0x10]
xor ebx, ebx
mov r8d, 0x10000
cmp dword [0x140013020], 1
mov qword [rax - 0x18], rbx
jne 0x14000ae30
lea rdx, [0x140033760]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x14000ae43
mov ecx, dword [rsp + 0x48]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
jmp 0x14000ae88
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
jne 0x14000ae54
mov dword [0x1400539a0], 0x2bf
xor eax, eax
jmp 0x14000aef2
mov r9d, dword [rsp + 0x48]
lea rax, [0x140033760]
mov edx, 1
mov dword [rsp + 0x28], 0x10000
mov r8, rbp
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 2]
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x48]
mov dword [0x140053770], eax
mov r8d, eax
mov eax, dword [0x140053778]
add eax, ecx
mov dword [0x140053768], ebx
mov ecx, dword [0x140053774]
mov dword [0x140053778], eax
test ecx, ecx
je 0x14000aeba
xor edx, edx
div ecx
mov ecx, eax
cmp eax, 0x64
jbe 0x14000aebf
mov ecx, 0x64
mov eax, dword [0x14005377c]
cmp eax, ecx
cmovne eax, ecx
cmp ebx, r8d
mov dword [0x14005377c], eax
jge 0x14000ae4d
movsxd rcx, ebx
mov eax, 1
movzx ecx, word [rbp + rcx*2 + 0x20000]
mov word [rdi], cx
inc dword [0x140053768]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000c560
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
and dword [rbp + 0x7f], 0
lea rax, [rbp + 0x1f]
mov r9d, r8d
mov qword [rsp + 0x20], rax
mov esi, r8d
or r9d, 9
xor r8d, r8d
mov r14, rdx
mov r15, rcx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000c6c5
mov rcx, qword [rbp + 0x1f]
lea rax, [rbp + 0x27]
mov qword [rsp + 0x58], rax
lea r8, [rbp + 0x7f]
lea rax, [rbp + 0xb]
xor r9d, r9d
mov qword [rsp + 0x50], rax
xor edx, edx
lea rax, [rbp + 0xf]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x13]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x1b]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14000c61f
cmp eax, 0xea
je 0x14000c61f
cmp eax, 0x7a
jne 0x14000c643
mov edx, dword [rbp + 0x77]
mov ecx, 0x40
inc edx
add rdx, rdx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14000c65a
lea ebx, [rax + 8]
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
jmp 0x14000c6dd
xor ebx, ebx
mov r9d, dword [rbp + 0x77]
mov r8, rdi
mov rcx, qword [rbp + 0x1f]
inc r9d
mov edx, ebx
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegEnumKeyW]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jne 0x14000c68f
mov rcx, qword [rbp + 0x1f]
mov r8d, esi
mov rdx, rdi
call fcn.14000c560
mov ecx, eax
test ecx, ecx
lea eax, [rbx + 1]
cmove eax, ebx
mov ebx, eax
cmp ecx, 0x103
je 0x14000c6a6
cmp eax, dword [rbp + 7]
jb 0x14000c65c
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140013910
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov eax, dword [0x14007eeb0]
xor esi, esi
imul eax, dword [0x14007fd94]
mov rdi, rcx
mov r14, qword [0x140080a50]
cmp eax, edx
jne 0x1400139c4
cmp qword [0x14007d7f8], rsi
je 0x140013ac1
lea rcx, [0x14007b838]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [0x14007d7f8]
call fcn.1400361b0
lea rcx, [0x14007b838]
mov qword [rdi + 0x2e0], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rdi
mov dword [rsp + 0x60], esi
call fcn.140013ae0
test rax, rax
je 0x140013ac1
lea rcx, [rsp + 0x60]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x140013f60]
xor ecx, ecx
mov dword [rsp + 0x20], esi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x480], rax
test rax, rax
je 0x140013ac1
lea rcx, [0x14007b838]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rdi + 0x2f8]
mov rbx, rsi
sub eax, 1
movsxd rdx, eax
js 0x140013a1a
test rdx, rdx
js 0x140013a13
cmp rdx, qword [rdi + 0x2f8]
jge 0x140013a13
mov rax, qword [rdi + 0x2f0]
mov rcx, qword [rax + rdx*8]
cmp dword [rcx + 8], 1
cmove rbx, rcx
sub rdx, 1
jns 0x1400139e2
test rbx, rbx
je 0x140013a1a
mov rbp, qword [rbx]
jmp 0x140013a20
call qword [sym.imp.mfc140u.dll_AfxRegDeleteKey]
int3
mov rbx, rsi
mov rbp, rsi
lea rcx, [0x14007b838]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x14007eed8], esi
mov r8d, esi
mov rdx, qword [0x14007d7f8]
mov eax, 4
cmovne r8d, eax
mov dword [rsp + 0x20], esi
mov r9, rbp
mov rcx, r14
call fcn.140034f00
mov r14, rax
test rax, rax
je 0x140013a82
lea rcx, [0x14007b838]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8d, dword [0x14007fd90]
lea rcx, [rdi + 0x2e0]
mov rdx, r14
call fcn.140010480
jmp 0x140013aa9
test rbp, rbp
je 0x140013ab6
lea rcx, [0x14007b838]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x14007fd90]
mov dword [rbx + 8], esi
mov dword [rbx + 0x10], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0xc], eax
lea rcx, [0x14007b838]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc dword [0x14007fd90]
mov esi, 1
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140028da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
xor edi, edi
mov qword [rax + 0x20], rdi
mov r8, rdx
lea rdx, [rax - 0x40]
call fcn.140029170
nop
lea rdx, [rbx + 0x10]
mov r8, rax
lea rcx, [rsp + 0x30]
call fcn.14001a5a0
nop
lea r8, [rsp + 0x98]
mov rdx, rax
call fcn.140029350
test al, al
sete bl
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x140028e1b
xor al, al
jmp 0x140028f82
mov dword [rsp + 0x80], edi
mov r8, rbp
lea rdx, [rsp + 0x38]
call fcn.140029100
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete dil
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov eax, dword [rsp + 0x80]
shr eax, 1
test dil, dil
je 0x140028f70
test eax, eax
jne 0x140028e94
lea rdx, [0x140052e08]
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
jmp 0x140028f70
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.140030af0
nop
mov r8, rbp
lea rdx, [rsp + 0x38]
call fcn.140029100
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete dil
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
nop
test rbx, rbx
je 0x140028f70
mov rax, qword [rsp + 0x58]
sub rax, rbx
sar rax, 1
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x140028f20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, rax
cmp rax, 0x1000
jb 0x140028f67
test bl, 0x1f
je 0x140028f37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rbx - 8]
cmp rax, rbx
jb 0x140028f47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rbx, rax
cmp rbx, 8
jae 0x140028f57
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rbx, 0x27
jbe 0x140028f64
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rbx, rax
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonUndo::XElementButtonUndo]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140028fa0
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x50], 0
mov r8, rdx
lea rdx, [rsp + 0x30]
call fcn.140029170
nop
lea rdx, [rbx + 8]
mov r8, rax
lea rcx, [rsp + 0x68]
call fcn.14001a5a0
nop
lea r8, [rsp + 0x50]
mov rdx, rax
call fcn.1400291e0
test al, al
sete bl
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x14002901c
xor al, al
jmp 0x140029074
mov rdi, qword [rdi]
mov ebx, dword [rdi - 0x10]
mov r8, rsi
lea rdx, [rsp + 0x68]
call fcn.140029100
mov rdx, qword [rax]
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140031200
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r10, rdx
mov rdx, qword [0x140081e08]
xor r9, rax
movzx eax, byte [r8 + 1]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [0x140081e20]
and rcx, r9
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov r9, qword [rdx + rcx*8]
lea r11, [rdx + rcx*8]
mov rdx, qword [0x140081df8]
cmp r9, rdx
jne 0x1400312ad
mov rcx, rdx
jmp 0x1400312b4
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400312d9
mov rcx, qword [r8]
cmp qword [rax + 0x10], rcx
je 0x1400312c7
mov rax, qword [rax]
jmp 0x1400312a3
mov rcx, qword [rax + 0x10]
cmp qword [r8], rcx
cmovne rax, rdx
mov qword [r10], rax
mov rax, r10
ret
mov qword [r10], rdx
mov rax, r10
ret
Function at 0x140032ce0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, r9
mov r11, r8
mov rsi, rdx
mov r10, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 4]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 5]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 6]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 7]
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x30]
and rcx, r9
mov r8, rcx
shl r8, 4
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8]
cmp rax, qword [r10 + 8]
jne 0x140032d9e
mov rbx, qword [r10 + 8]
jmp 0x140032da6
mov rbx, qword [rdx + r8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x140032dfe
mov rax, qword [r11]
add rcx, rcx
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
je 0x140032dc3
cmp rbx, qword [rdx + rcx*8]
jne 0x140032db1
jmp 0x140032dfe
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
lea rcx, [rdi + 0x18]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonUndo::XElementButtonUndo]
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140032e95
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x140032e38
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x18]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r10 + 8]
jne 0x140032e56
mov qword [rdx], rdi
mov rax, qword [r10 + 0x18]
mov qword [rax + r8 + 8], rdi
jmp 0x140032e82
cmp rax, rbx
jne 0x140032e60
mov qword [rdx], rdi
jmp 0x140032e82
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x140032e82
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r10
call fcn.140032f30
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140032ff0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rcx
movzx r8d, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov rsi, rdx
xor r8, rax
movzx eax, byte [rdi + 0x11]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdi + 0x12]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdi + 0x13]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdi + 0x14]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdi + 0x15]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdi + 0x16]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdi + 0x17]
imul r8, rcx
xor r8, rax
imul r8, rcx
mov rcx, qword [r9 + 0x18]
and rdx, r8
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], rdi
jne 0x1400330b7
cmp qword [rcx], rdi
jne 0x1400330ad
mov rax, qword [r9 + 8]
mov qword [rcx], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x1400330c2
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x1400330c2
cmp qword [rcx], rdi
jne 0x1400330c7
mov rax, qword [rdi]
mov qword [rcx], rax
mov rdi, qword [rsp + 0x40]
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x18]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r9 + 0x10]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonUndo::XElementButtonUndo]
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140036940
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub rsp, 0x28
test r8, r8
je 0x1400369a4
mov rdx, qword [r8]
test rdx, rdx
je 0x1400369a4
mov qword [rsp + 0x20], rbx
call fcn.140034450
mov rbx, rax
test rax, rax
je 0x140036998
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140036998
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rbx
mov ecx, 8
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x20]
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret