joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e924
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x14003e0a8]
xor rax, rsp
mov qword [rbp + 0x220], rax
movsxd rbx, edx
xor r12d, r12d
mov rsi, rcx
shl rbx, 5
add rbx, qword [rcx + 0x28]
mov rdi, qword [rbx + 8]
test rdi, rdi
je 0x14000ea7b
mov rcx, rdi
call qword [0x140032578]
test rax, rax
je 0x14000e992
lea edx, [r12 + 0x10]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [0x1400324c0]
cmp byte [rbx + 0x16], r12b
jne 0x14000ea7b
mov rcx, qword [rsi + 0x20]
mov edx, 0x4ce
call qword [0x1400324d8]
movsxd r8, dword [rbx + 0x10]
xor r9d, r9d
mov rcx, rax
mov edx, 0x150
call qword [0x1400324c0]
mov rbx, rax
test rax, rax
je 0x14000ea7b
lea rcx, [rbp - 0x1e]
xor edx, edx
mov r8d, 0x232
mov word [rbp - 0x20], r12w
call fcn.14001dbc0
lea r8, str.__s___p__u
lea rcx, [rbp - 0x20]
mov r9, rbx
mov edx, 0x234
mov dword [rsp + 0x20], edi
call fcn.1400040ec
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x78]
call fcn.14001dbc0
xor eax, eax
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x70], 0x68
add byte [rcx + rcx*4 + 0x64], cl
and al, 0x50
Function at 0x14000f8f8
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor eax, eax
xor ebp, ebp
mov rbx, rdx
mov rsi, rcx
lea r12, [0x140035618]
mov qword [r11 - 0x20], rax
test rdx, rdx
je 0x14000f92e
mov qword [r11 - 0x28], rdx
cmp word [rdx], bp
jne 0x14000f933
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rcx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r8, [0x14000f8d8]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x60], ebp
call qword [0x140032158]
mov rdi, rax
test rax, rax
je 0x14000f97f
or edx, 0xffffffff
mov rcx, rax
call qword [0x140032160]
mov rcx, rdi
call qword [0x1400320f8]
jmp 0x14000f9a0
test rbx, rbx
je 0x14000f989
cmp word [rbx], bp
jne 0x14000f98c
mov rbx, r12
mov r9d, 0x1010
mov r8, rbx
mov rdx, rsi
xor ecx, ecx
call qword [0x1400325b0]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x14000fdf4
Capabilities:
Create process on windows

Disassembly:
cmp ecx, edx
jg 0x140010076
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf60]
mov eax, 0x1060
call fcn.140027460
sub rsp, rax
mov rax, qword [0x14003e0a8]
xor rax, rsp
mov qword [rbp + 0xf50], rax
mov rdi, r8
mov esi, ecx
cmp ecx, 0xffffffff
je 0x14001004d
xor r15d, r15d
test ecx, ecx
mov ebx, 0x7ce
sete r14b
lea rcx, [rbp - 0x4e]
xor edx, edx
mov r8d, ebx
mov word [rbp - 0x50], r15w
call fcn.14001dbc0
lea rcx, [rbp + 0x782]
mov r8d, ebx
xor edx, edx
mov word [rbp + 0x780], r15w
call fcn.14001dbc0
xor edx, edx
lea r13d, [r15 + 0x40]
lea ecx, [rdx + 2]
mov dword [rsp + 0x34], r15d
call qword [0x1400325e8]
lea rdx, [rsp + 0x34]
lea rcx, str.2CB51501_DA86_4216_9C9B_2C52A64BA047
call qword [0x1400325f0]
mov ecx, dword [rsp + 0x34]
test ecx, ecx
je 0x14000fed6
lea rax, str.StrRuntimeLicCheckFailed
lea rdx, str.StrRuntimeLicCheckWarning
test r14b, r14b
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x50]
cmovne rdx, rax
mov dword [rsp + 0x30], 0x3e8
call qword [0x1400325f8]
mov ecx, dword [rsp + 0x34]
call qword [0x1400325e0]
lea rax, [rbp - 0x50]
cmp word [rbp - 0x50], r15w
je 0x14000ff0c
cmp word [rax], 0x5c
jne 0x14000ff02
lea rcx, [rax + 2]
cmp word [rcx], 0x6e
jne 0x14000ff02
mov edx, 0xd
mov word [rax], dx
lea eax, [rdx - 3]
mov word [rcx], ax
mov rax, rcx
add rax, 2
cmp word [rax], r15w
jne 0x14000fee1
lea rax, [rsp + 0x30]
lea r12, [rdi + 0x1bf0]
lea r9, [rbp + 0x780]
lea rdx, str._ProductName_
lea rcx, [rbp - 0x50]
mov r8, r12
mov dword [rsp + 0x30], 0x3e8
mov qword [rsp + 0x20], rax
call fcn.1400109a0
add rdi, 0x1cb8
lea rbx, [rbp + 0x780]
je 0x14000ffc0
cmp word [rdi], r15w
je 0x14000ffc0
lea rdx, str._LinkBuy_
lea rcx, [rbp + 0x780]
mov r13d, 0x44
call fcn.14001e9a8
test rax, rax
je 0x14000ffc0
lea rdx, [0x140035b70]
mov rcx, rdi
call fcn.14001e9a8
test rax, rax
je 0x14000ff8d
add rax, 6
jmp 0x14000ff90
mov rax, rdi
lea rcx, [rsp + 0x30]
lea r9, [rbp - 0x50]
lea rdx, str._LinkBuy_
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x780]
mov r8, rax
mov dword [rsp + 0x30], 0x3e8
call fcn.1400109a0
lea rbx, [rbp - 0x50]
test r14b, r14b
jne 0x14000fffe
lea rax, [rbp + 0x780]
mov r9d, esi
mov r8, rbx
mov edx, 0x7d0
cmp rbx, rax
jne 0x14000ffeb
lea rcx, [rbp - 0x50]
call fcn.1400040ec
lea rbx, [rbp - 0x50]
jmp 0x14000fffe
lea rcx, [rbp + 0x780]
call fcn.1400040ec
lea rbx, [rbp + 0x780]
mov r9d, r13d
mov r8, r12
mov rdx, rbx
xor ecx, ecx
call qword [0x1400325b0]
test r13b, 4
je 0x14001004d
cmp eax, 6
jne 0x14001004d
lea ebx, [rax + 0x6a]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, ebx
call fcn.14001dbc0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x70], 1
call qword [0x140032428]
mov rcx, qword [rbp + 0xf50]
xor rcx, rsp
call fcn.14001d120
mov rbx, qword [rsp + 0x10a8]
add rsp, 0x1060
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400106a0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x14003e0a8]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rax, [rsp + 0x48]
mov bl, cl
lea rdx, str.Control_PanelDesktop
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [0x140032018]
test eax, eax
jne 0x1400107a6
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x114
call qword [0x1400320c0]
cmp dword [rsp + 0x60], 1
jne 0x14001071c
movzx eax, bl
mov r9d, 4
lea rdx, str.ScreenSaveUsePassword
mov dword [rsp + 0x40], eax
jmp 0x14001074c
lea rax, [0x140035d20]
test bl, bl
lea r8, [0x140035d24]
lea rcx, [rsp + 0x40]
mov edx, 4
cmovne r8, rax
call fcn.140004074
mov r9d, 1
lea rdx, str.ScreenSaverIsSecure
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [0x140032030]
mov rcx, qword [rsp + 0x48]
call qword [0x140032008]
and qword [rsp + 0x30], 0
xor r8d, r8d
lea edx, [r8 + 0x1a]
lea r9, str.Windows
mov ecx, 0xffff
mov dword [rsp + 0x28], 0x7d0
mov dword [rsp + 0x20], 2
call qword [0x140032570]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14001d120
add rsp, 0x180
pop rbx
ret
Function at 0x140012800
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x5e0]
sub rsp, 0x6e0
mov rax, qword [0x14003e0a8]
xor rax, rsp
mov qword [rbp + 0x5d0], rax
mov rbx, rcx
mov r12d, 0x206
lea rcx, [rbp - 0x5e]
xor esi, esi
xor edx, edx
mov r8d, r12d
mov word [rbp - 0x60], si
call fcn.14001dbc0
lea r11, [rbp - 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801a
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [0x140032430]
test eax, eax
jns 0x1400128be
cmp eax, 0x80070005
je 0x1400128be
lea rcx, str...UMSettings.cpp
cdqe
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rcx
mov dword [rbp - 0x80], 0x26b
mov qword [rbp - 0x78], rax
call qword [0x140032358]
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x70]
lea r8d, [rsi + 0x28]
mov dword [rbp - 0x70], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rsp + 0x48]
call fcn.14001eeb4
int3
cmp word [rbp - 0x60], si
je 0x140012a15
lea rcx, [rbp - 0x60]
call qword [0x140032350]
dec eax
movsxd rcx, eax
cmp word [rbp + rcx*2 - 0x60], 0x5c
jne 0x1400128e4
mov word [rbp + rcx*2 - 0x60], si
lea rcx, [rbp + 0x1b2]
mov r8, r12
xor edx, edx
mov word [rbp + 0x1b0], si
call fcn.14001dbc0
mov edi, 0x208
lea r8, [rbp - 0x60]
lea rcx, [rbp + 0x1b0]
mov edx, edi
call fcn.140004074
lea r8, [0x140034f90]
lea rcx, [rbp + 0x1b0]
mov edx, edi
call fcn.14000728c
lea r8, str.Realtime_SoftUltraMon
lea rcx, [rbp + 0x1b0]
mov edx, edi
call fcn.14000728c
lea rcx, [rbp + 0x3c2]
mov r8, r12
xor edx, edx
mov word [rbp + 0x3c0], si
call fcn.14001dbc0
mov dword [rsp + 0x30], 1
lea r9, [rbp + 0x1b0]
lea r8, str._s_u._u._u
lea rcx, [rbp + 0x3c0]
mov edx, edi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
call fcn.1400040ec
lea rcx, [rbp + 0x3c0]
call fcn.1400079e4
test al, al
jne 0x1400129df
xor edx, edx
lea rcx, [rsp + 0x72]
mov word [rsp + 0x70], si
lea r8d, [rdx + 0x26]
call fcn.14001dbc0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x40], sil
call fcn.14001b1cc
mov r9b, byte [rsp + 0x40]
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x1b0]
call fcn.14001a124
lea r8, [rbp + 0x3c0]
mov edx, 0x104
mov rcx, rbx
call fcn.140007a6c
mov rcx, rbx
call fcn.1400079e4
test al, al
jne 0x140012a15
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [0x140032420]
cmp eax, 5
jne 0x140012a3c
mov word [rbx], si
mov rcx, qword [rbp + 0x5d0]
xor rcx, rsp
call fcn.14001d120
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
test eax, eax
je 0x140012a15
cmp eax, 0x50
je 0x140012a15
cmp eax, 0xb7
je 0x140012a15
lea rcx, str...UMSettings.cpp
cdqe
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rcx
mov dword [rbp - 0x80], 0x2aa
mov qword [rbp - 0x78], rax
call qword [0x140032358]
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x70]
mov r8d, 0x28
mov dword [rbp - 0x70], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rsp + 0x48]
call fcn.14001eeb4
int3
Function at 0x140019170
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
and dword [rbp + 0x7f], 0
mov rax, rdx
lea rdx, [rbp - 9]
mov qword [r11 - 0x70], rdx
lea rdx, [rbp + 0x7f]
mov rbx, r8
mov qword [r11 - 0x78], rdx
mov rdx, rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov dword [rbp - 9], 4
call qword [0x140032010]
test eax, eax
jne 0x1400191d3
cmp dword [rbp + 0x7f], eax
setne al
mov byte [rbx], al
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
cmp eax, 2
je 0x1400191c2
and qword [rbp - 1], 0
lea rcx, str...UMSettings.cpp
cdqe
mov dword [rbp + 0xf], 0x8d8
mov qword [rbp + 0x17], rax
mov qword [rbp + 7], rcx
call qword [0x140032358]
lea rcx, [rbp + 0x27]
lea rdx, [rbp - 1]
mov r8d, 0x28
mov dword [rbp + 0x1f], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rbp + 0x27]
call fcn.14001eeb4
int3

Function at 0x140019224
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, rdx
lea rdx, [r11 + 0x20]
xor r9d, r9d
mov qword [r11 - 0x60], rdx
mov qword [r11 - 0x68], r8
mov rdx, rcx
xor r8d, r8d
mov rcx, rax
mov dword [r11 + 0x20], 4
call qword [0x140032010]
test eax, eax
je 0x1400192b2
cmp eax, 2
je 0x1400192b2
and qword [rsp + 0x30], 0
lea rcx, str...UMSettings.cpp
cdqe
mov dword [rsp + 0x40], 0x8e7
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rcx
call qword [0x140032358]
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov r8d, 0x28
mov dword [rsp + 0x50], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rsp + 0x58]
call fcn.14001eeb4
int3
add rsp, 0x88
ret

Function at 0x1400192bc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x88
lea eax, [r9 + r9]
mov r10, rdx
mov rdx, rcx
mov dword [r11 + 0x20], eax
lea rax, [r11 + 0x20]
xor r9d, r9d
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x68], r8
xor r8d, r8d
mov rcx, r10
call qword [0x140032010]
test eax, eax
je 0x14001934a
cmp eax, 2
je 0x14001934a
and qword [rsp + 0x30], 0
lea rcx, str...UMSettings.cpp
cdqe
mov dword [rsp + 0x40], 0x8ef
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rcx
call qword [0x140032358]
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov r8d, 0x28
mov dword [rsp + 0x50], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rsp + 0x58]
call fcn.14001eeb4
int3
add rsp, 0x88
ret
Function at 0x140019354
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
movsxd rbx, edx
mov rdi, r9
mov r10, r8
mov r9, rcx
cmp ebx, 0x3e
je 0x1400193a1
mov rdx, rbx
cmp rbx, 0x3e
jb 0x140019388
lea rcx, str.invalid_bitset_N__position
call fcn.14001d078
int3
mov al, bl
shr rdx, 6
and al, 0x3f
movzx ecx, al
mov rax, qword [r9 + rdx*8]
bt rax, rcx
jae 0x140019468
mov rcx, qword [rsp + 0xb0]
xor eax, eax
mov r9d, 4
cmp byte [rsp + 0xb8], al
mov dword [rsp + 0x28], r9d
mov rdx, r10
setne al
xor r8d, r8d
mov dword [rsp + 0x98], eax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [0x140032030]
test eax, eax
je 0x140019436
and qword [rsp + 0x30], 0
lea rcx, str...UMSettings.cpp
cdqe
mov dword [rsp + 0x40], 0x8fa
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rcx
call qword [0x140032358]
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov r8d, 0x28
mov dword [rsp + 0x50], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rsp + 0x58]
call fcn.14001eeb4
int3
cmp ebx, 0x3e
je 0x140019468
mov rax, rbx
cmp rbx, 0x3e
jb 0x140019451
lea rcx, str.invalid_bitset_N__position
call fcn.14001d078
int3
and al, 0x3f
mov r8, rbx
mov edx, 1
mov cl, al
shr r8, 6
shl rdx, cl
or qword [rdi + r8*8], rdx
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret

Function at 0x14001947c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
movsxd rbx, edx
mov rdi, r9
mov r10, r8
mov r9, rcx
cmp ebx, 0x3e
je 0x1400194c9
mov rdx, rbx
cmp rbx, 0x3e
jb 0x1400194b0
lea rcx, str.invalid_bitset_N__position
call fcn.14001d078
int3
mov al, bl
shr rdx, 6
and al, 0x3f
movzx ecx, al
mov rax, qword [r9 + rdx*8]
bt rax, rcx
jae 0x14001957d
mov rcx, qword [rsp + 0xb0]
lea rax, [rsp + 0xb8]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, r10
mov qword [rsp + 0x20], rax
call qword [0x140032030]
test eax, eax
je 0x14001954b
and qword [rsp + 0x30], 0
lea rcx, str...UMSettings.cpp
cdqe
mov dword [rsp + 0x40], 0x90d
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rcx
call qword [0x140032358]
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov r8d, 0x28
mov dword [rsp + 0x50], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rsp + 0x58]
call fcn.14001eeb4
int3
cmp ebx, 0x3e
je 0x14001957d
mov rax, rbx
cmp rbx, 0x3e
jb 0x140019566
lea rcx, str.invalid_bitset_N__position
call fcn.14001d078
int3
and al, 0x3f
mov r8, rbx
mov edx, 1
mov cl, al
shr r8, 6
shl rdx, cl
or qword [rdi + r8*8], rdx
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140019590
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
movsxd rdi, edx
mov rsi, r9
mov rbp, r8
mov rdx, rcx
cmp edi, 0x3e
je 0x1400195e8
mov r10, rdi
cmp rdi, 0x3e
jb 0x1400195ce
lea rcx, str.invalid_bitset_N__position
call fcn.14001d078
int3
mov al, dil
shr r10, 6
and al, 0x3f
movzx ecx, al
mov rax, qword [rdx + r10*8]
bt rax, rcx
jae 0x1400196a3
mov rbx, qword [rsp + 0xb8]
mov rcx, rbx
call qword [0x140032350]
mov rcx, qword [rsp + 0xb0]
xor r8d, r8d
lea eax, [rax + rax + 2]
mov rdx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov ebx, 1
mov r9d, ebx
call qword [0x140032030]
test eax, eax
je 0x140019676
and qword [rsp + 0x30], 0
lea rcx, str...UMSettings.cpp
cdqe
mov dword [rsp + 0x40], 0x91a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rcx
call qword [0x140032358]
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x30]
lea r8d, [rbx + 0x27]
mov dword [rsp + 0x50], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rsp + 0x58]
call fcn.14001eeb4
int3
cmp edi, 0x3e
je 0x1400196a3
mov rax, rdi
cmp rdi, 0x3e
jb 0x140019691
lea rcx, str.invalid_bitset_N__position
call fcn.14001d078
int3
mov rdx, rax
and al, 0x3f
mov cl, al
shr rdx, 6
shl rbx, cl
or qword [rsi + rdx*8], rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400196bc
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
movsxd rbx, edx
mov rdi, r9
mov r10, rcx
cmp rbx, 0x3e
jb 0x1400196ea
lea rcx, str.invalid_bitset_N__position
call fcn.14001d078
int3
mov al, bl
mov esi, 1
shr rbx, 6
and al, 0x3f
mov cl, al
shl rsi, cl
test qword [r10 + rbx*8], rsi
je 0x14001979c
mov al, byte [rsp + 0xb8]
test al, al
je 0x14001972c
mov byte [rsp + 0x28], al
mov rax, qword [rsp + 0xb0]
mov rcx, r10
mov qword [rsp + 0x20], rax
call fcn.140019354
jmp 0x14001979c
mov rcx, qword [rsp + 0xb0]
mov rdx, r8
call qword [0x140032048]
test eax, eax
je 0x140019798
cmp eax, 2
je 0x140019798
and qword [rsp + 0x30], 0
lea rcx, str...UMSettings.cpp
cdqe
mov dword [rsp + 0x40], 0x92e
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rcx
call qword [0x140032358]
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov r8d, 0x28
mov dword [rsp + 0x50], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rsp + 0x58]
call fcn.14001eeb4
int3
or qword [rdi + rbx*8], rsi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140019b8c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0xc0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rsi, rdx
mov rbx, rcx
xor r12d, r12d
mov dword [rax + 0x18], r12d
lea rax, [rax + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Mirror_Monitors
call qword [0x140032010]
mov r11d, dword [rsp + 0xf0]
test r11d, r11d
je 0x140019d4a
lea eax, [r12 + 2]
add r11d, eax
mov dword [rsp + 0xf0], r11d
mov ecx, r11d
shr rcx, 1
mul rcx
lea rcx, [r12 - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.14001d104
mov rdi, rax
test rax, rax
jne 0x140019c66
mov qword [rsp + 0x38], r12
lea rax, str...UMSettings.cpp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x971
mov qword [rsp + 0x50], r12
call qword [0x140032358]
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x38]
lea r8d, [r12 + 0x28]
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rsp + 0x68]
call fcn.14001eeb4
int3
mov r8d, dword [rsp + 0xf0]
xor edx, edx
mov rcx, rax
call fcn.14001dbc0
lea r11, [rsp + 0xf0]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Mirror_Monitors
mov rcx, rbx
call qword [0x140032010]
cmp word [rdi], r12w
je 0x140019d42
mov qword [rsp + 0x30], r12
mov rcx, rdi
lea r8, [rsp + 0x30]
lea rdx, [0x14003715c]
call fcn.14001e718
test rax, rax
je 0x140019d42
mov dword [rsp + 0xf8], r12d
lea r8, [rsp + 0xf8]
lea rdx, [0x1400371a0]
mov rcx, rax
call fcn.14001e894
cmp eax, 1
jne 0x140019d3b
mov rbx, qword [rsi]
lea r8, [rsp + 0xf8]
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.14001bdb8
mov r11, rax
mov rax, qword [rsi + 8]
movabs rcx, 0x3ffffffffffffffe
sub rcx, rax
cmp rcx, 1
jae 0x140019d29
lea rcx, str.list_T__too_long
call fcn.14001d01c
inc rax
mov qword [rsi + 8], rax
mov qword [rbx + 8], r11
mov rax, qword [r11 + 8]
mov qword [rax], r11
xor ecx, ecx
jmp 0x140019cb2
mov rcx, rdi
call fcn.14001e710
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop r12
pop rdi
pop rsi
ret

Function at 0x140019eac
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
and dword [rbp + 0x18], 0
lea rax, [rbp + 0x20]
lea rdx, str.SettingsVersion
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x18]
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], 4
mov qword [rsp + 0x20], rax
call qword [0x140032010]
test eax, eax
je 0x140019f3b
cmp eax, 2
je 0x140019f3b
and qword [rbp - 0x50], 0
lea rcx, str...UMSettings.cpp
cdqe
mov dword [rbp - 0x40], 0x9c8
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x48], rcx
call qword [0x140032358]
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 0x50]
mov r8d, 0x28
mov dword [rbp - 0x30], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rbp - 0x28]
call fcn.14001eeb4
int3
mov eax, dword [rbp + 0x18]
add rsp, 0x80
pop rbp
ret
Function at 0x140019f48
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x14003e0a8]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
lea rax, [rsp + 0x68]
mov rbx, r8
xor edi, edi
mov r9d, 0x10009
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rdi
call qword [0x140032018]
test eax, eax
jne 0x14001a0b2
lea rcx, [rbp - 0x2e]
xor edx, edx
mov r8d, 0x1fe
mov word [rbp - 0x30], di
call fcn.14001dbc0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x70], 0x100
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], edi
call qword [0x140032040]
jmp 0x14001a00e
lea rdx, [rbp - 0x30]
mov r8, rbx
call fcn.140019f48
mov dword [rsp + 0x70], 0x100
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], rdi
dec edx
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x30]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x60], edx
mov qword [rsp + 0x20], rdi
call qword [0x140032050]
mov rcx, qword [rsp + 0x68]
test eax, eax
je 0x140019ffa
lea rdx, [0x140034d18]
call qword [0x140032038]
test eax, eax
je 0x14001a0a5
lea rcx, str...UMSettings.cpp
cdqe
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rcx
mov dword [rbp - 0x78], 0x9e2
mov qword [rbp - 0x70], rax
call qword [0x140032358]
lea rcx, [rbp - 0x60]
lea rdx, [rsp + 0x78]
mov r8d, 0x28
mov dword [rbp - 0x68], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rbp - 0x60]
call fcn.14001eeb4
int3
mov rcx, qword [rsp + 0x68]
call qword [0x140032008]
jmp 0x14001a10a
cmp eax, 2
je 0x14001a10a
cmp eax, 5
je 0x14001a107
lea rcx, str...UMSettings.cpp
cdqe
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rcx
mov dword [rbp - 0x78], 0x9f4
mov qword [rbp - 0x70], rax
call qword [0x140032358]
lea rcx, [rbp - 0x60]
lea rdx, [rsp + 0x78]
mov r8d, 0x28
mov dword [rbp - 0x68], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rbp - 0x60]
call fcn.14001eeb4
int3
mov byte [rbx], 1
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14001d120
add rsp, 0x2e0
pop rdi
pop rbx
pop rbp
ret
Function at 0x14001efef
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14003e0a8]
jne 0x14001d13a
rol rcx, 0x10
test cx, 0xffff
jne 0x14001d136
repz ret
ror rcx, 0x10
jmp 0x14001ef48
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14003fee0]
call qword [0x1400322b0]
mov rax, qword [0x14003ffd8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.14002ddaa
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001efcd
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14003fee0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call fcn.14002dda4
jmp 0x14001efef
mov rax, qword [rsp + 0x88]
mov qword [0x14003ffd8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14003ff78], rax
mov rax, qword [0x14003ffd8]
mov qword [0x14003fe50], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14003ff60], rax
mov dword [0x14003fe40], 0xc0000409
mov dword [0x14003fe44], 1
mov rax, qword [0x14003e0a8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14003e0b0]
mov qword [rsp + 0x70], rax
call qword [0x1400322c8]
mov dword [0x14003fed8], eax
mov ecx, 1
call fcn.1400259f8
xor ecx, ecx
call qword [0x1400322d0]
lea rcx, [0x1400327e0]
call qword [0x1400322d8]
cmp dword [0x14003fed8], 0
jne 0x14001f076
mov ecx, 1
call fcn.1400259f8
call qword [0x140032118]
mov edx, 0xc0000409
mov rcx, rax
call qword [0x1400322e0]
add rsp, 0x88
ret

Function at 0x140024f34
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140024da4