joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff790183f04
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x7ff7904d6b68]
xor rax, rsp
mov qword [rbp + 0x160], rax
and qword [r8], 0
mov rsi, rcx
mov byte [rcx + 3], 0
mov r14, r8
and dword [rcx + 4], 0
mov rbx, rdx
lea rcx, [rsp + 0x20]
mov edi, 2
call fcn.7ff790184114
cmp byte [rsp + 0x23], 0
je 0x7ff790184038
cmp byte [rsp + 0x22], 0
mov ebx, dword [rsp + 0x20]
jne 0x7ff790183fa6
test bl, bl
jne 0x7ff790183fa6
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindFileNameW]
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.7ff7901b58ec
test al, al
je 0x7ff790184014
call fcn.7ff7901840c4
test al, al
jne 0x7ff790213218
mov ecx, 0x1e
call qword [sym.imp.api_ms_win_shcore_sysinfo_l1_1_0.dll_IsOS]
nop dword [rax + rax]
test eax, eax
jne 0x7ff790213218
lea r8, str.LocalExplorerIsShellMutex
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x7ff790183ffd
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
mov qword [r14], rdi
call fcn.7ff7901840c4
test al, al
jne 0x7ff790213218
mov dword [rsi], ebx
mov edi, 3
mov dword [rsi + 4], edi
mov rax, rsi
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.7ff7901bf100
add rsp, 0x270
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
xorps xmm0, xmm0
lea rdx, [rsp + 0x28]
xor eax, eax
mov rcx, rbx
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x38], xmm0
call fcn.7ff79016406c
test eax, eax
je 0x7ff790184014
mov rax, qword [rsp + 0x40]
mov rcx, rax
sub rcx, qword [0x7ff790463810]
jne 0x7ff79018407a
mov rcx, qword [rsp + 0x48]
sub rcx, qword [0x7ff790463818]
test rcx, rcx
je 0x7ff7901840a9
sub rax, qword [0x7ff7904664c0]
je 0x7ff7901840b0
test rax, rax
mov ecx, 4
cmovne edi, ecx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_ILFree]
nop dword [rax + rax]
jmp 0x7ff790184014
mov edi, 6
jmp 0x7ff790184093
mov rax, qword [rsp + 0x48]
sub rax, qword [0x7ff7904664c8]
jmp 0x7ff790184088
Function at 0x7ff7901847bc
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x58
lea rcx, [rbp + 0x30]
call fcn.7ff7901c3784
nop
mov edx, 0x5c
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
nop dword [rax + rax]
test rax, rax
je 0x7ff79018486c
add rax, 2
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x18]
lea rcx, [rbp + 0x28]
call fcn.7ff7901c38e8
and dword [rbp + 0x20], 0
mov dword [rbp + 0x18], 4
lea rax, [rbp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, 0x10010
lea r8, str.WaitForDebuggerPresent
mov rdx, qword [rbp + 0x28]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x28]
test eax, eax
je 0x7ff79021347e
test rcx, rcx
je 0x7ff79018486c
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x7ff790184881
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
xor eax, eax
add rsp, 0x58
pop rbx
pop rbp
ret

Function at 0x7ff790185270
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x40]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x7ff7901852ce
mov rcx, qword [rsp + 0x40]
lea rdx, [0x7ff790463820]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
add rsp, 0x38
ret
Function at 0x7ff790186ae8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
and qword [rbp + 0x18], 0
lea rdx, [rbp + 0x18]
xor dil, dil
call fcn.7ff790186c2c
test eax, eax
js 0x7ff790213e5a
mov r9, qword [rbp + 0x18]
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionProfileList
and qword [rbp - 0x20], 0
lea rdx, [0x7ff790463100]
and qword [rbp - 0x18], 0
lea rcx, [rbp - 0x20]
and qword [rbp - 0x10], 0
call fcn.7ff790186c04
test eax, eax
js 0x7ff790213e78
mov rdx, qword [rbp - 0x20]
lea rax, [rbp + 0x10]
and qword [rbp + 0x10], 0
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jg 0x7ff790213e96
js 0x7ff790213ea5
and qword [rsp + 0x28], 0
lea rdx, str.Migrated
mov rcx, qword [rbp + 0x10]
xor r9d, r9d
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
sete dil
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x7ff790186bc0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
cmp qword [rbp - 0x20], 0
je 0x7ff790186bd7
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x7ff790186bec
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov al, dil
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x7ff7901acef0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
call fcn.7ff7901ad03c
lea rcx, str.Enable_Balloon_Tip
call qword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_RegisterWindowMessageW]
nop dword [rax + rax]
lea rcx, str.ShowOnlyQuickLaunchDeskBand
mov dword [rbx + 0x220], eax
call qword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_RegisterWindowMessageW]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x370]
mov dword [rbx + 0x224], eax
mov rax, qword [rcx]
movabs r10, 0xf835ae6f36dc6b70
mov rax, qword [rax + 0x58]
call qword [0x7ff79045bf28]
xor r9d, r9d
lea rdx, str.ReuseImmersiveShellPointer
xor r8d, r8d
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
call qword [sym.imp.api_ms_win_core_registryuserspecific_l1_1_0.dll_SHRegGetBoolUSValueW]
nop dword [rax + rax]
xor edi, edi
test eax, eax
setne al
mov byte [rbx + 0x1c0], al
lea rcx, [0x7ff7904d8e10]
call fcn.7ff7901c8018
test al, al
je 0x7ff7901acf9c
call fcn.7ff79026bc10
mov r9d, 0x82000000
jmp 0x7ff7901acfa7
call fcn.7ff79026bc10
mov r9d, 0x80000000
mov qword [rsp + 0x58], rbx
lea rdx, str.Shell_TrayWnd
neg eax
mov rax, qword [0x7ff7904d80c0]
mov qword [rsp + 0x50], rax
sbb ecx, ecx
mov qword [rsp + 0x48], rdi
and ecx, 0x400000
mov qword [rsp + 0x40], rdi
xor r8d, r8d
mov dword [rsp + 0x38], edi
add ecx, 0x180
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_CreateWindowExW]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
jmp fcn.7ff7901ad010

Function at 0x7ff7901ad010
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
mov ecx, 0x56
call qword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
nop dword [rax + rax]
test eax, eax
jne 0x7ff7901ef3b8
add rsp, 0x28
ret
mov ecx, 1
xor eax, eax
lock cmpxchg dword [0x7ff7904d87f8], ecx
jne 0x7ff7901ad02d
lea r8d, [rcx + 7]
xor r9d, r9d
lea rcx, [0x7ff7901f0930]
xor edx, edx
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
Function at 0x7ff7901ae690
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
sub rsp, 0x58
lea rax, [r11 - 0x18]
mov dword [rsp + 0x78], 0
mov qword [r11 - 0x28], rax
mov r9d, 0x10000012
lea rax, [r11 - 0x14]
mov dword [rsp + 0x40], 4
mov qword [r11 - 0x30], rax
lea rax, [r11 + 0x20]
mov qword [r11 - 0x38], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
je 0x7ff7901ae6f4
cmp eax, 0xea
je 0x7ff7901ae729
test eax, eax
jle 0x7ff7901ae721
movzx eax, cx
or eax, 0x80070000
add rsp, 0x58
ret
cmp dword [rsp + 0x78], 4
mov ecx, 0xd
jne 0x7ff79022b094
mov eax, dword [rsp + 0x44]
cmp eax, 1
ja 0x7ff7901ae6e6
xor ecx, ecx
cmp eax, 1
mov rax, qword [rsp + 0x80]
sete cl
mov dword [rax], ecx
xor ecx, ecx
mov eax, ecx
add rsp, 0x58
ret
mov ecx, 0xd
jmp 0x7ff7901ae6e6
cmp dword [rsp + 0x40], 4
jne 0x7ff7901ae6e6
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x30]
cmp dx, 1
ja 0x7ff7901ae6e6
xor ecx, ecx
mov edx, 0x31
cmp dx, ax
mov rax, qword [rsp + 0x80]
sete cl
mov dword [rax], ecx
xor ecx, ecx
jmp 0x7ff7901ae721
Function at 0x7ff7901b172c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov byte [r11 + 0x20], r9b
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, r8
lea rax, [r11 + 0x20]
mov rbp, rdx
mov qword [r11 - 0x40], rax
xor r12d, r12d
lea r9, [r11 - 0x38]
mov r14, rcx
mov qword [r11 - 0x48], r12
mov rdx, rsi
mov dword [r11 + 0x20], r12d
mov rcx, rbp
xor r8d, r8d
mov edi, r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
mov r15d, 0x80070000
test eax, eax
jg 0x7ff79022c7be
test ebx, ebx
js 0x7ff7901b1866
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 1
ja 0x7ff7901b188f
mov eax, dword [rsp + 0x88]
test eax, eax
je 0x7ff7901b188f
test al, 1
jne 0x7ff7901b188f
mov ecx, eax
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x7ff79022c7c9
lea rax, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x7ff79022c7d3
test ebx, ebx
js 0x7ff7901b1866
mov esi, dword [rsp + 0x88]
shr esi, 1
dec esi
cmp dword [rsp + 0x30], 2
je 0x7ff79022c7de
cmp word [rdi + rsi*2], r12w
jne 0x7ff7901b188f
mov rcx, qword [r14]
inc esi
test rcx, rcx
jne 0x7ff79022c86d
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r12
test rdi, rdi
je 0x7ff7901b1863
test rsi, rsi
je 0x7ff7901b1863
lea rax, [rsi - 1]
mov qword [r14], rdi
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rsi
mov word [rdi + rsi*2 - 2], r12w
mov rdi, r12
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ebx, 0x8007000d
jmp 0x7ff7901b1866
Function at 0x7ff7901b1e2c
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x30
mov al, byte [0x7ff7904d8630]
xor ebx, ebx
test al, al
jne 0x7ff7901b1f29
call fcn.7ff7901b1fb8
mov ebx, eax
test eax, eax
js 0x7ff7901b1f29
mov cl, byte [0x7ff7904d8630]
test cl, cl
jne 0x7ff7901b1f24
lea rbp, str.LocalSessionImmersiveColorPreference
mov edx, 1
mov r8, rbp
mov ecx, 0xf001f
mov bl, 1
xor dil, dil
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_OpenFileMappingW]
nop dword [rax + rax]
test rax, rax
je 0x7ff79022ca5a
mov qword [0x7ff7904d8628], rax
mov byte [0x7ff7904d8631], bl
mov al, byte [0x7ff7904d8631]
mov rcx, qword [0x7ff7904d8628]
neg al
mov qword [rsp + 0x20], 8
sbb edx, edx
xor r9d, r9d
and edx, 0xf001b
xor r8d, r8d
add edx, 4
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
nop dword [rax + rax]
mov qword [0x7ff7904d8638], rax
mov rax, qword [0x7ff7904d8638]
test rax, rax
je 0x7ff7901b1f3c
xor ebx, ebx
test dil, dil
jne 0x7ff79022cab5
call fcn.7ff7901b1f4c
mov rcx, qword [0x7ff7904d84e0]
test eax, eax
cmovne rcx, qword [0x7ff7904d84d8]
mov qword [0x7ff7904d84e0], rcx
call fcn.7ff7901b203c
call fcn.7ff7901b2248
mov byte [0x7ff7904d8630], 1
call fcn.7ff7901b2218
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ebx, 0x80004005
jmp 0x7ff7901b1f24

Function at 0x7ff7901b1fb8
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x7ff7904d9388]
mov ebx, 0x80004005
test rax, rax
jne 0x7ff7901b1fff
lea r8, str.LocalSessionImmersiveColorMutex
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
nop dword [rax + rax]
mov rcx, rax
test rax, rax
je 0x7ff7901b1fff
xor eax, eax
lock cmpxchg qword [0x7ff7904d9388], rcx
jne 0x7ff79022cb2c
mov rax, qword [0x7ff7904d9388]
test rax, rax
je 0x7ff7901b202b
mov rcx, qword [0x7ff7904d9388]
or edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
btr eax, 7
neg eax
sbb ecx, ecx
and ebx, ecx
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x7ff7901b203c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rsi
sub rsp, 0x40
lea rax, [r11 + 8]
mov dword [rsp + 0x50], 4
mov qword [r11 - 0x18], rax
lea rsi, [0x7ff7904d84e0]
mov qword [r11 - 0x20], rsi
lea r8, str.DefaultStartColor
and qword [r11 - 0x28], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
mov r9d, 0x10
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x7ff7901b20a2
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x7ff79022cb3e
mov rcx, rsi
call fcn.7ff7901b21ec
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
Function at 0x7ff7901b20c8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x50
cmp dword [0x7ff7904d9390], 0
mov rdi, rcx
jne 0x7ff79022cb9e
and qword [rax - 0x18], 0
lea rdx, [rax - 0x18]
mov ebx, 0x20019
mov dword [rax + 0x10], 4
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
nop dword [rax + rax]
mov rax, qword [0x7ff7904da830]
lea r8, str.StartColorMenu
mov rcx, qword [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
test rax, rax
mov dword [rsp + 0x48], ebx
mov r9d, 0x10
cmovne rcx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x7ff79022cbae
test ebx, ebx
js 0x7ff7901b21b7
mov rax, qword [0x7ff7904da830]
lea r8, [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAccent
mov qword [rsp + 0x30], r8
test rax, rax
mov r9d, 0x10
lea r8, str.AccentColorMenu
cmovne rcx, rax
lea rax, [rdi + 4]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x7ff79022cbbc
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x7ff7901b21cd
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
js 0x7ff79022cbca
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x7ff7901b2248
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x7ff7904d6b68]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, [r11 - 0x28]
mov dword [rsp + 0x40], 0x10
mov qword [r11 - 0x38], rax
lea r8, str.PersonalColors_Background
lea rax, [r11 - 0x20]
mov r9d, 2
mov qword [r11 - 0x40], rax
lea rdx, str.SoftwarePoliciesMicrosoftWindowsPersonalization
and qword [r11 - 0x48], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
xor edx, edx
test eax, eax
lea ecx, [rdx + 1]
cmove edx, ecx
xchg dword [0x7ff7904d9390], edx
call fcn.7ff7901b22d8
mov byte [0x7ff7904da838], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff7901bf100
add rsp, 0x68
ret
Function at 0x7ff7901b47e4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x118]
xor ebx, ebx
inc rax
mov rdi, rcx
test rax, 0xfffffffffffffffe
jne 0x7ff7901b4884
and qword [rsp + 0x28], rbx
lea r8, [0x7ff790196200]
and dword [rsp + 0x20], ebx
mov r9, rcx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
nop dword [rax + rax]
mov qword [rdi + 0x118], rax
test rax, rax
je 0x7ff7901b4892
xor r8d, r8d
lea rcx, [0x7ff7903c5400]
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpoolWait]
nop dword [rax + rax]
mov qword [rdi + 0x110], rax
test rax, rax
je 0x7ff79022db8e
xor ebx, ebx
mov rdx, qword [rdi + 0x118]
xor r8d, r8d
mov rcx, qword [rdi + 0x110]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_SetThreadpoolWait]
nop dword [rax + rax]
and qword [rdi + 0x110], 0
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call fcn.7ff79018056c
mov ebx, eax
test eax, eax
jns 0x7ff7901b4834
jmp 0x7ff7901b4884
call fcn.7ff79018056c
mov ebx, eax
test eax, eax
js 0x7ff7901b4884
jmp 0x7ff7901b485f
Function at 0x7ff7901b6054
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, r8
mov qword [r11 + 8], rbx
mov rdi, rdx
test rcx, rcx
je 0x7ff79022e312
test rdx, rdx
je 0x7ff79022e32a
lea rax, [r11 + 8]
mov r9d, 0x20019
xor r8d, r8d
mov qword [r11 - 0x18], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x7ff7901b60f1
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x7ff7901b60f1
test rsi, rsi
je 0x7ff7901b6112
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
mov esi, ebx
test eax, eax
sete sil
test rdi, rdi
je 0x7ff7901b60ef
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ebx, esi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov esi, 1
jmp 0x7ff7901b60de
mov ecx, 0x57
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
jmp 0x7ff7901b6101
mov qword [rsp + 0x40], rcx
jmp 0x7ff7901b60ad

Function at 0x7ff7901b727c
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor r14d, r14d
mov esi, r9d
mov rbp, r8
mov rbx, rcx
test rdx, rdx
je 0x7ff79022ed9e
cmp word [rdx], r14w
je 0x7ff79022ed9e
mov qword [r11 - 0x28], r14
lea rax, [r11 + 0x10]
mov qword [r11 - 0x30], rax
xor r9d, r9d
mov qword [r11 - 0x38], r14
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov dword [r11 - 0x48], r14d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x7ff7901b732c
mov rcx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x98]
mov r9d, esi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rax, qword [rsp + 0x90]
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x78]
mov edi, eax
cmp rcx, rbx
je 0x7ff7901b732c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 0x78], rbx
jmp 0x7ff7901b72e7
Function at 0x7ff7901b79b8
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x7ff7904d6b68]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 0x208
mov qword [rsp + 0x30], rax
lea r8, str.Taskman
xor ebx, ebx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 2]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x7ff7901b7a63
movzx ecx, bx
mov word [rbp - 0x20], bx
jle 0x7ff7901b7a3c
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x7ff79022eedc
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.7ff7901bf100
mov rbx, qword [rsp + 0x310]
add rsp, 0x300
pop rbp
ret
movzx ecx, word [rbp - 0x20]
jmp 0x7ff7901b7a3a
test cx, cx
je 0x7ff7901b7a42
xor edx, edx
mov dword [rsp + 0x70], 0x68
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov eax, 1
lea rdx, [rbp - 0x20]
mov word [rbp - 0x50], ax
xor r9d, r9d
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
nop dword [rax + rax]
test eax, eax
je 0x7ff7901b7a42
mov rcx, qword [rsp + 0x58]
call 0x7ff7904035cc
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x7ff7901b7a42

Function at 0x7ff7901b7f34
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea r8, [rsp + 0x38]
mov edx, 0x20000070
lea r9d, [rbx + 2]
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
nop dword [rax + rax]
test eax, eax
jle 0x7ff7901b7f62
cmp dword [rsp + 0x38], 1
sete bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x7ff7901b8048
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x458
mov rax, qword [0x7ff7904d6b68]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov eax, dword [0x7ff7904d864c]
test eax, eax
je 0x7ff7901b808a
cmp eax, 1
sete al
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.7ff7901bf100
add rsp, 0x458
ret
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x202
lea rdx, [rsp + 0x30]
mov ecx, 0xc
call qword [sym.imp.SspiCli.dll_GetUserNameExW]
nop dword [rax + rax]
neg al
sbb eax, eax
add eax, 2
mov dword [0x7ff7904d864c], eax
jmp 0x7ff7901b806b