joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004c5e0
Capabilities:
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 8], 0
mov rbx, rcx
je 0x14004c68c
cmp qword [rcx + 0x10], 0
je 0x14004c68c
cmp edx, 0x187
jne 0x14004c61e
mov rcx, qword [rcx + 0xc0]
test rcx, rcx
jne 0x14004c617
xor eax, eax
jmp 0x14004c63b
call fcn.14003cb80
jmp 0x14004c63b
cmp edx, 0x188
jne 0x14004c642
mov rcx, qword [rcx + 0xc0]
test rcx, rcx
jne 0x14004c636
xor eax, eax
jmp 0x14004c63b
call fcn.14003caf0
mov qword [rbx + 0xb0], rax
mov rdx, qword [rbx + 0xb0]
mov rcx, qword [rbx + 0x10]
call fcn.140049860
mov rcx, rbx
call fcn.14004e580
mov edx, 1
mov rcx, rbx
call fcn.14004a100
mov rcx, rbx
call fcn.14004caa0
mov rcx, rbx
call fcn.14004a240
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14004c68c
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.140043460
add rsp, 0x20
pop rbx
ret

Function at 0x14004c6a0
Capabilities:
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 8], 0
mov rbx, rcx
je 0x14004c6f6
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14004c6f6
mov dword [rbx + 0xfc], edx
call fcn.140049890
mov edx, 1
mov rcx, rbx
call fcn.14004a100
mov rcx, rbx
call fcn.14004caa0
mov rcx, rbx
call fcn.14004a240
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14004c6f6
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.140043460
add rsp, 0x20
pop rbx
ret

Function at 0x14004c820
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbx, rcx
mov rax, qword [rcx]
test rax, rax
jne 0x14003cc6e
lea ecx, [rax + 0x78]
call fcn.14005d524
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14003cc6b
xor edx, edx
lea r8d, [rdx + 0x78]
mov rcx, rax
call fcn.140061460
mov rcx, rdi
call fcn.140008430
nop
mov qword [rbx], rax
mov rcx, rax
call fcn.140008ca0
test eax, eax
jne 0x14003cc82
mov rcx, qword [rbx]
call fcn.140008730
mov rcx, qword [rbx]
call fcn.140008ca0
test eax, eax
je 0x14003ccc4
mov rcx, qword [rbx]
call fcn.140008be0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rax + 8]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [0x1401a1138], rax
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rcx + 0xc0]
jmp 0x14003cc20

Function at 0x14004e490
Capabilities:
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x98]
call fcn.14003a760
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14004e4ba
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.140043460
add rsp, 0x20
pop rbx
ret

Function at 0x14004e6e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp fcn.14004e6f0
Function at 0x14004f100
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rbx, rdx
mov rdi, rcx
lea rdx, [0x14009bc34]
mov rcx, qword [rcx + 0x20]
call fcn.140048080
lea rdx, [0x14009bc34]
mov rcx, qword [rdi + 0x20]
call fcn.140048160
lea rdx, [0x14009bc34]
mov rcx, qword [rdi + 0x20]
call fcn.140048180
lea rdx, [0x14009bc34]
mov rcx, qword [rdi + 0x20]
call fcn.1400481a0
mov eax, dword [rdi + 0xf8]
add eax, 0xfffffffe
mov rcx, qword [rdi + 0x20]
cmp eax, 2
ja 0x14004f180
mov edx, 1
call fcn.140048240
jmp 0x14004f29d
xor edx, edx
call fcn.140048240
mov ecx, dword [0x1401a36c8]
mov rax, qword gs:[0x58]
mov r8d, 4
mov rdx, qword [rax + rcx*8]
mov eax, dword [r8 + rdx]
cmp dword [0x1401a1780], eax
jg 0x14004f2d6
lea rcx, [0x1401a1768]
call fcn.140032950
mov esi, dword [rbx]
mov rbx, qword [rbx + 8]
mov edx, 0x2742
lea rcx, [0x1401a1768]
call fcn.140033cf0
lea rdx, [0x1400b5794]
lea rcx, [0x1401a1768]
call fcn.140031610
mov rdx, qword [rbx + 0x10]
mov rdx, qword [rdx + 8]
lea rcx, [0x1401a1768]
call fcn.140031610
mov rdx, qword [0x1401a1770]
mov rcx, qword [rdi + 0x20]
call fcn.140048080
lea rcx, [0x1401a1768]
call fcn.140032950
cmp esi, 0xffffffff
je 0x14004f27a
mov edx, 8
mov rcx, qword [rdi + 0xa0]
call fcn.140057cd0
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
mov edx, esi
test cx, ax
mov rcx, qword [rdi + 0xe8]
je 0x14004f24f
mov r8d, 1
jmp 0x14004f252
xor r8d, r8d
call fcn.1400344c0
cmp dword [0x1401a15e4], 0
jne 0x14004f269
cmp dword [0x1401a15e0], 0
je 0x14004f27a
xor r8d, r8d
mov edx, esi
mov rcx, qword [rdi + 0xe8]
call fcn.1400344c0
mov rdx, qword [rdi + 0xe8]
lea rcx, [0x1401a1768]
call fcn.140031590
mov rdx, qword [rdi + 0xe8]
mov rcx, qword [rdi + 0x20]
call fcn.1400480a0
mov rcx, qword [rdi + 0x20]
call fcn.140048200
mov dword [rdi + 0x110], 0xffffffff
xor eax, eax
mov dword [rdi + 0x114], eax
mov qword [rdi + 0x118], rax
mov qword [rdi + 0x120], rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x1401a1780]
call fcn.14005db9c
cmp dword [0x1401a1780], 0xffffffff
jne 0x14004f1b0
xor eax, eax
mov qword [0x1401a1768], rax
mov qword [0x1401a1770], rax
mov qword [0x1401a1778], rax
mov edx, 0x80
lea rcx, [0x1401a1768]
call fcn.140033c10
lea rcx, [0x140096590]
call fcn.14005d96c
nop
lea rcx, [0x1401a1780]
call fcn.14005db3c
jmp 0x14004f1b0
Function at 0x140051030
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140195088]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
lea r8, str.Shell_TrayWnd
xor ecx, ecx
xor r9d, r9d
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
je 0x14005109a
xor r9d, r9d
lea r8, str.TrayNotifyWnd
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
je 0x14005109a
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005d680
add rsp, 0x60
pop rbx
ret
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x30
mov ecx, 5
call qword [sym.imp.SHELL32.dll_SHAppBarMessage]
test rax, rax
je 0x140051132
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x140051102
sub eax, 1
je 0x1400510d2
sub eax, 1
je 0x140051102
cmp eax, 1
jne 0x1400511a3
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x3c]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x44]
mov dword [rbx + 0xc], eax
lea eax, [rcx - 0x64]
mov dword [rbx], eax
lea eax, [rcx - 0x10]
mov dword [rbx + 8], eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005d680
add rsp, 0x60
pop rbx
ret
mov ecx, dword [rsp + 0x44]
lea eax, [rcx - 0x64]
mov dword [rbx + 4], eax
lea eax, [rcx - 0x10]
mov dword [rbx + 0xc], eax
mov eax, dword [rsp + 0x38]
mov dword [rbx], eax
mov eax, dword [rsp + 0x40]
mov dword [rbx + 8], eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005d680
add rsp, 0x60
pop rbx
ret
xor r9d, r9d
lea r8, str.Shell_TrayWnd
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
je 0x14005117f
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [rbx + 8]
mov eax, ecx
sub eax, dword [rbx]
cmp eax, 0x96
jle 0x14005116d
lea eax, [rcx - 0x96]
mov dword [rbx], eax
mov ecx, dword [rbx + 0xc]
mov eax, ecx
sub eax, dword [rbx + 4]
cmp eax, 0x1e
jle 0x1400511a3
lea eax, [rcx - 0x1e]
jmp 0x1400511a0
xor edx, edx
xor r9d, r9d
mov r8, rbx
lea ecx, [rdx + 0x30]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [rbx + 8]
sub eax, 0x96
mov dword [rbx], eax
mov eax, dword [rbx + 0xc]
sub eax, 0x1e
mov dword [rbx + 4], eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005d680
add rsp, 0x60
pop rbx
ret
Function at 0x1400568f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1208]
mov eax, 0x1308
call fcn.14005e010
sub rsp, rax
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x140195088]
xor rax, rsp
mov qword [rbp + 0x11f0], rax
mov rbx, r9
mov r12, r8
mov rsi, rdx
mov r14, rcx
mov r13d, dword [rbp + 0x1280]
mov rdi, qword [rbp + 0x1270]
mov r15, qword [rbp + 0x1278]
xor eax, eax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
xor r8d, r8d
mov rdx, r9
lea rcx, [rbp - 0x68]
call fcn.140031410
nop
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov edx, 0x80
lea rcx, [rsp + 0x78]
call fcn.140031390
nop
test rsi, rsi
je 0x140056ae9
test rbx, rbx
je 0x140056ae9
test rdi, rdi
je 0x140056ae9
xor ebx, ebx
mov dword [r15], ebx
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp - 0x30]
call fcn.140061460
mov dword [rbp - 0x70], 0x104
mov dword [rsp + 0x68], 0x800
mov dword [rsp + 0x6c], 0x800
mov r8, r12
mov rdx, rsi
mov rcx, r14
call fcn.1400571a0
mov r12, rax
test rax, rax
je 0x140056ae9
lea rax, [rbp - 0x38]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x30]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x140056adf
mov esi, ebx
lea r14, [0x1401a2b70]
nop
mov dword [rsp + 0x6c], 0x800
mov word [rbp + 0x1e0], bx
mov byte [0x1401a2b70], bl
mov dword [rsp + 0x68], 0x800
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x6c]
lea r8, [rbp + 0x1e0]
mov edx, esi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140056ad7
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x78]
call fcn.140031da0
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.140032430
test eax, eax
jne 0x140056b20
inc esi
cmp esi, dword [rsp + 0x70]
jb 0x140056a60
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x78]
call fcn.140031450
nop
lea rcx, [rbp - 0x68]
call fcn.140031450
mov rcx, qword [rbp + 0x11f0]
xor rcx, rsp
call fcn.14005d680
add rsp, 0x1308
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x68]
cmp eax, 1
jae 0x140056b37
mov dword [r15], ebx
jmp 0x140056ae9
mov dword [r15], eax
cmp eax, r13d
jle 0x140056b45
mov dword [r15], r13d
mov eax, r13d
test eax, eax
jle 0x140056ae9
sub r14, rdi
nop dword [rax]
movzx eax, byte [r14 + rdi]
mov byte [rdi], al
inc ebx
lea rdi, [rdi + 1]
cmp ebx, dword [r15]
jl 0x140056b50
jmp 0x140056ae9
Function at 0x140056c10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x1200]
mov eax, 0x1300
call fcn.14005e010
sub rsp, rax
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x140195088]
xor rax, rsp
mov qword [rbp + 0x11f0], rax
mov rbx, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
xor r8d, r8d
mov rdx, r9
lea rcx, [rbp - 0x70]
call fcn.140031410
nop
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov edx, 0x80
lea rcx, [rsp + 0x78]
call fcn.140031390
nop
test rdi, rdi
je 0x140056deb
test rbx, rbx
je 0x140056deb
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp - 0x30]
call fcn.140061460
mov dword [rsp + 0x74], 0x104
mov dword [rsp + 0x68], 0x800
mov dword [rsp + 0x6c], 0x800
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.1400571a0
mov rdi, rax
test rax, rax
je 0x140056deb
lea rax, [rbp - 0x40]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x54]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x74]
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x140056de1
xor esi, esi
mov ebx, esi
test eax, eax
je 0x140056de1
lea r14, [0x1401a2360]
mov dword [rsp + 0x6c], 0x800
mov word [rbp + 0x1e0], si
mov byte [0x1401a2360], sil
mov dword [rsp + 0x68], 0x800
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x6c]
lea r8, [rbp + 0x1e0]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140056dd9
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x78]
call fcn.140031da0
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x70]
call fcn.140032430
test eax, eax
jne 0x140056e1e
inc ebx
cmp ebx, dword [rsp + 0x70]
jb 0x140056d61
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x78]
call fcn.140031450
nop
lea rcx, [rbp - 0x70]
call fcn.140031450
xor eax, eax
mov rcx, qword [rbp + 0x11f0]
xor rcx, rsp
call fcn.14005d680
add rsp, 0x1300
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x78]
cmp dword [rsp + 0x68], 1
jb 0x140056df0
call fcn.140031450
nop
lea rcx, [rbp - 0x70]
call fcn.140031450
mov rax, r14
jmp 0x140056e01

Function at 0x140056f00
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1401a1940]
test rcx, rcx
jne 0x140056f17
xor eax, eax
add rsp, 0x28
ret
mov edx, 1
call fcn.140056f50
test eax, eax
je 0x140056f2f
mov eax, 1
add rsp, 0x28
ret
mov rcx, qword [0x1401a1940]
xor edx, edx
add rsp, 0x28
jmp fcn.140056f50
Function at 0x140056f50
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x11f0]
mov eax, 0x12f0
call fcn.14005e010
sub rsp, rax
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x1300], rbx
mov qword [rsp + 0x1308], rsi
mov qword [rsp + 0x1310], rdi
mov qword [rsp + 0x1318], r14
mov rax, qword [0x140195088]
xor rax, rsp
mov qword [rbp + 0x11e0], rax
mov ebx, edx
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov edx, 0x80
lea rcx, [rbp - 0x80]
call fcn.140031390
nop
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp - 0x40]
call fcn.140061460
mov dword [rsp + 0x7c], 0x104
mov dword [rsp + 0x70], 0x800
mov dword [rsp + 0x74], 0x800
xor esi, esi
mov qword [rsp + 0x68], rsi
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [str.SoftwareMicrosoftWindowsCurrentVersionRun]
mov qword [rsp + 0x20], rax
test ebx, ebx
mov rcx, 0xffffffff80000002
jne 0x14005701c
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005713f
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x14005713f
lea rax, [rbp - 0x50]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x64]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x54]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x7c]
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x140057135
mov ebx, esi
lea r14, [0x1401a1b50]
nop dword [rax + rax]
mov dword [rsp + 0x74], 0x800
mov word [rbp + 0x1d0], si
mov byte [0x1401a1b50], sil
mov dword [rsp + 0x70], 0x800
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x74]
lea r8, [rbp + 0x1d0]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140057129
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x80]
call fcn.140031da0
xor r8d, r8d
lea rdx, [0x1400a22a0]
lea rcx, [rbp - 0x80]
call fcn.140032480
test eax, eax
jne 0x140057176
inc ebx
cmp ebx, dword [rsp + 0x78]
jb 0x1400570b0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x80]
call fcn.140031450
xor eax, eax
mov rcx, qword [rbp + 0x11e0]
xor rcx, rsp
call fcn.14005d680
lea r11, [rsp + 0x12f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x80]
cmp dword [rsp + 0x70], 1
jb 0x140057143
call fcn.140031450
mov eax, 1
jmp 0x14005714a
Function at 0x140057280
Capabilities:
Delete registry value

Disassembly:
test rdx, rdx
je 0x14005735b
push rbx
sub rsp, 0x50
mov rax, qword [0x140195088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, r9
test rbx, rbx
je 0x140057349
lea rax, [0x1400a22a0]
lea r9, str.Ergonis
lea rcx, [0x1401a1950]
test r8, r8
jne 0x1400572e0
mov r8, qword [str.Software_s_s_s]
mov qword [rsp + 0x28], rdx
mov edx, 0xff
mov qword [rsp + 0x20], rax
call fcn.140004720
jmp 0x140057300
mov qword [rsp + 0x30], r8
mov r8, qword [str.Software_s_s_s_s]
mov qword [rsp + 0x28], rdx
mov edx, 0xff
mov qword [rsp + 0x20], rax
call fcn.140004720
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x1401a1950]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14005d680
add rsp, 0x50
pop rbx
ret

Function at 0x140057289
Capabilities:
Delete registry value

Disassembly:
test rdx, rdx
je 0x14005735b
push rbx
sub rsp, 0x50
mov rax, qword [0x140195088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, r9
test rbx, rbx
je 0x140057349
lea rax, [0x1400a22a0]
lea r9, str.Ergonis
lea rcx, [0x1401a1950]
test r8, r8
jne 0x1400572e0
mov r8, qword [str.Software_s_s_s]
mov qword [rsp + 0x28], rdx
mov edx, 0xff
mov qword [rsp + 0x20], rax
call fcn.140004720
jmp 0x140057300
mov qword [rsp + 0x30], r8
mov r8, qword [str.Software_s_s_s_s]
mov qword [rsp + 0x28], rdx
mov edx, 0xff
mov qword [rsp + 0x20], rax
call fcn.140004720
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x1401a1950]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14005d680
add rsp, 0x50
pop rbx
ret
Function at 0x140057360
Capabilities:
Set registry value

Disassembly:
test rdx, rdx
je 0x1400574b2
push rbx
push rbp
push rsi
push r14
sub rsp, 0x2b8
mov rax, qword [0x140195088]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
test r8, r8
je 0x140057496
test r9, r9
je 0x140057496
mov qword [rsp + 0x2b0], rdi
mov edi, dword [rsp + 0x300]
test edi, edi
js 0x14005748e
xor edx, edx
lea rcx, [rsp + 0x90]
mov r8d, 0x208
call fcn.140061460
xor r8d, r8d
mov dword [rsp + 0x60], 0x104
mov rdx, rbx
mov rcx, r14
call fcn.1400567f0
mov rbx, rax
test rax, rax
je 0x14005748e
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x64]
mov rcx, rbx
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x90]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp edi, 0x800
jge 0x140057485
mov dword [rsp + 0x28], edi
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14005d680
add rsp, 0x2b8
pop r14
pop rsi
pop rbp
pop rbx
ret

Function at 0x140057369
Capabilities:
Set registry value

Disassembly:
test rdx, rdx
je 0x1400574b2
push rbx
push rbp
push rsi
push r14
sub rsp, 0x2b8
mov rax, qword [0x140195088]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
test r8, r8
je 0x140057496
test r9, r9
je 0x140057496
mov qword [rsp + 0x2b0], rdi
mov edi, dword [rsp + 0x300]
test edi, edi
js 0x14005748e
xor edx, edx
lea rcx, [rsp + 0x90]
mov r8d, 0x208
call fcn.140061460
xor r8d, r8d
mov dword [rsp + 0x60], 0x104
mov rdx, rbx
mov rcx, r14
call fcn.1400567f0
mov rbx, rax
test rax, rax
je 0x14005748e
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x64]
mov rcx, rbx
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x90]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp edi, 0x800
jge 0x140057485
mov dword [rsp + 0x28], edi
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14005d680
add rsp, 0x2b8
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400574f0
Capabilities:
Set registry value

Disassembly:
mov rax, qword [rsp + 0x28]
mov r10, qword [rax + 8]
mov qword [rsp + 0x28], r10
jmp fcn.140057530

Function at 0x140057530
Capabilities:
Set registry value

Disassembly:
test rdx, rdx
je 0x140057702
push rbx
push rbp
push rsi
push r14
mov eax, 0x12b8
call fcn.14005e010
sub rsp, rax
mov rax, qword [0x140195088]
xor rax, rsp
mov qword [rsp + 0x12a0], rax
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
test r9, r9
je 0x1400576e6
mov rax, qword [rsp + 0x1300]
lea rcx, [rsp + 0x90]
test rax, rax
mov qword [rsp + 0x12b0], rdi
lea rdi, [0x14009bc34]
mov r8d, 0x208
cmovne rdi, rax
xor edx, edx
call fcn.140061460
mov r8, r14
mov dword [rsp + 0x60], 0x104
mov rdx, rbx
mov rcx, rsi
call fcn.1400567f0
mov rsi, rax
test rax, rax
je 0x1400576de
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x64]
mov rcx, rsi
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x90]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor edx, edx
mov word [rsp + 0x2a0], dx
test rdi, rdi
je 0x14005767b
mov r8d, 0x7fffffff
mov rax, rdi
mov ecx, r8d
nop
cmp word [rax], dx
je 0x14005765f
add rax, 2
sub rcx, 1
jne 0x140057650
test rcx, rcx
mov eax, 0x80070057
cmovne eax, edx
je 0x140057671
sub r8, rcx
jmp 0x140057674
mov r8, rdx
test rcx, rcx
jne 0x140057683
jmp 0x140057680
mov eax, 0x80070057
mov r8, rdx
test eax, eax
jne 0x1400576de
lea rbx, [r8 + r8]
cmp rbx, 0x800
jae 0x1400576d5
test r8, r8
je 0x1400576ac
add r8, r8
lea rcx, [rsp + 0x2a0]
mov rdx, rdi
call fcn.140061620
lea eax, [rbx + 1]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x2a0]
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x12b0]
mov rcx, qword [rsp + 0x12a0]
xor rcx, rsp
call fcn.14005d680
add rsp, 0x12b8
pop r14
pop rsi
pop rbp
pop rbx
ret