joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c4ab0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, r9
mov rbp, r8
mov rax, qword [rsp + 0x70]
mov r10d, dword [rax]
mov dword [r9], r10d
xor ebx, ebx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400c4b02
mov edi, ebx
mov rbx, qword [rsp + 0x30]
test edi, edi
jne 0x1400c4b31
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x68]
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test rbx, rbx
je 0x1400c4b3f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400c4b60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x124
lea rcx, [rsp + 0x44]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x124
test rsi, rsi
jne 0x1400c4bad
lea eax, [rsi + 0xd]
jmp 0x1400c4c62
lea rax, [rsp + 0x40]
mov r9d, 2
mov qword [rsp + 0x30], rax
mov r8, rbp
lea rax, [rsp + 0x44]
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400c4bf3
lea rdx, [rsp + 0x44]
mov rcx, rdi
call fcn.1400570a0
xor eax, eax
jmp 0x1400c4c62
cmp eax, 2
je 0x1400c4bef
cmp eax, 0xea
jne 0x1400c4c62
mov ecx, dword [rsp + 0x40]
mov qword [rsp + 0x1a8], rbx
call fcn.1400e6a30
mov rbx, rax
mov r9d, 2
lea rax, [rsp + 0x40]
mov r8, rbp
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], rbx
mov rcx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x1400c4c50
mov rdx, rbx
mov rcx, rdi
call fcn.1400570a0
mov rcx, rbx
call fcn.1400e6a28
mov rbx, qword [rsp + 0x1a8]
mov eax, esi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400e6b50
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c4f50
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x70
mov esi, r9d
mov rbp, r8
xor ebx, ebx
mov qword [r11 - 0x18], rbx
lea rax, [r11 - 0x20]
mov qword [r11 - 0x38], rax
lea rax, [r11 - 0x18]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test eax, eax
jne 0x1400c4fa9
mov edi, ebx
mov rbx, qword [rsp + 0x60]
test edi, edi
jne 0x1400c4fd8
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 4]
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test rbx, rbx
je 0x1400c4fe6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400c5000
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
xor esi, esi
mov edi, esi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5062
mov eax, esi
mov rdi, qword [rsp + 0x38]
test eax, eax
jne 0x1400c50fd
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c50fd
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x1400c5104
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400c50c0
test al, 1
jne 0x1400c5104
shr rax, 1
cmp word [rsp + rax*2 + 0x3e], 0
jmp 0x1400c5102
mov word [rsp + 0x40], si
mov bl, 1
test rdi, rdi
je 0x1400c50d5
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp eax, 0xea
je 0x1400c50c5
xor bl, bl
jmp 0x1400c50c7
Function at 0x1400c7290
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov ecx, 0x105
lea rdx, [rsp + 0x30]
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
test eax, eax
je 0x1400c7307
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], di
jne 0x1400c72f0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400523d0
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400e6b50
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret

Function at 0x1400c7330
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1400c7354
cmp word [rcx], 0
je 0x1400c7354
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400c7354
shr eax, 4
and al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x1400c7360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1400c7380
cmp word [rcx], 0
je 0x1400c7380
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x1400c7900
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x70
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor r15d, r15d
mov rsi, rdx
mov rbx, rcx
test r8b, r8b
je 0x1400c7a33
lea r8d, [r15 + 1]
mov qword [r11 + 0x18], r14
lea rdx, [0x140287fd8]
mov qword [r11 - 0x50], r15
lea rcx, [r11 - 0x50]
mov qword [r11 - 0x40], r15
mov qword [r11 - 0x38], 7
call fcn.1400523d0
mov eax, dword [rsp + 0x58]
lea rdi, [rsp + 0x48]
lea r14d, [rax + rax]
mov rax, qword [rsp + 0x60]
cmp rax, 8
cmovae rdi, qword [rsp + 0x48]
cmp qword [rbx + 0x10], r15
je 0x1400c79eb
test rdi, rdi
je 0x1400c79eb
test r14d, r14d
je 0x1400c79eb
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x1400c798f
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400c79e6
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], r15d
mov r8d, r14d
mov qword [rsp + 0x20], r15
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x60]
mov r14, qword [rsp + 0xb0]
cmp rax, 8
jb 0x1400c7a33
mov rcx, qword [rsp + 0x48]
lea rdx, [rax*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c7a2e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c7a2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e6a28
mov edi, dword [rsi + 0x10]
add edi, edi
cmp qword [rsi + 0x18], 8
jb 0x1400c7a42
mov rsi, qword [rsi]
cmp qword [rbx + 0x10], r15
je 0x1400c7abd
test rsi, rsi
je 0x1400c7abd
test edi, edi
je 0x1400c7abd
cmp qword [rbx + 0x18], 8
jb 0x1400c7a5b
mov rbx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov rcx, rbx
mov dword [rsp + 0x20], 4
lea edx, [r9 + 4]
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400c7abd
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], r15d
mov r8d, edi
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp edi, dword [rsp + 0x40]
mov rcx, rbp
sete bl
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400c7abf
xor bl, bl
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400e6b50
add rsp, 0x70
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c7b10
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
cmp qword [rdx + 0x18], 8
mov rdi, rcx
mov rcx, rdx
mov rbx, rdx
jb 0x1400c7b2d
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400c7b9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 8]
mov dword [rcx], eax
call fcn.1400c1f80
cmp dword [rax + 0x78], 3
jl 0x1400c7b9b
call fcn.1400c1f80
cmp qword [rbx + 0x18], 8
mov rcx, qword [rdi + 8]
mov edx, dword [rcx]
jb 0x1400c7b63
mov rbx, qword [rbx]
mov dword [rsp + 0x38], edx
lea rcx, str.Could_not_delete__s:__d
mov qword [rsp + 0x30], rbx
lea r9, str.D:BWA6FBB69CA_F410_0iCloudCommon_131_srcrootiCCUtilsFileUtils.cpp
mov qword [rsp + 0x28], rcx
lea r8, str.DeleteFilesWildcard::_lambda_021f0a1cf058730d4af814404dac7312_::operator___
mov rcx, rax
mov dword [rsp + 0x20], 0x54d
mov edx, 3
call fcn.1400c2500
mov rbx, qword [rsp + 0x50]
mov al, 1
add rsp, 0x40
pop rdi
ret

Function at 0x1400c7bb0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
cmp byte [r8], 0
mov rax, rdx
jne 0x1400c7bef
cmp qword [rdx + 0x18], 8
mov qword [rsp + 0x20], rbx
jb 0x1400c7bcc
mov rax, qword [rdx]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test eax, eax
jne 0x1400c7be5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
Function at 0x1400cb770
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx edi, dx
lea r8, [rsp + 0x40]
mov ebx, ecx
xor edx, edx
lea rcx, [0x140376468]
xor r9d, r9d
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceBeginInitialize]
test eax, eax
jne 0x1400cb7a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
cmp dword [rsp + 0x40], 0
je 0x1400cb7d6
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
call fcn.1400cb660
xor edx, edx
mov dword [0x140376460], eax
lea rcx, [0x140376468]
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceComplete]
test eax, eax
je 0x1400cb890
test di, di
je 0x1400cb7ee
movzx ecx, di
call fcn.1400cb660
mov r8d, eax
mov dword [0x140376460], eax
jmp 0x1400cb7f5
mov r8d, dword [0x140376460]
test ebx, ebx
jns 0x1400cb7fb
neg ebx
sub r8d, 1
je 0x1400cb87d
sub r8d, 1
je 0x1400cb86a
sub r8d, 1
je 0x1400cb87d
cmp r8d, 1
jne 0x1400cb87d
mov eax, 0x66666667
imul ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cmp eax, r8d
jne 0x1400cb85a
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x64
sub ebx, eax
cmp ebx, 0xb
je 0x1400cb85a
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
cmp ebx, 1
setg al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
cmp ebx, 1
mov rbx, qword [rsp + 0x30]
setne al
add rsp, 0x20
pop rdi
ret
call fcn.1400e68f0
int3
Function at 0x1400cbcd0
Capabilities:
Compare security identifiers
Enumerate process modules

Disassembly:
push rbx
push rdi
push r12
push r13
push r15
sub rsp, 0x280
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r13d, r13d
mov qword [rsp + 0x38], rcx
mov r15, r8
mov rdi, rcx
test dl, dl
je 0x1400cbd21
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rbx, rax
call fcn.1400ccb60
mov rcx, rbx
mov r13, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x1400cbd2d
mov qword [r15], 0xffffffffffffffff
xor r12d, r12d
test rdi, rdi
je 0x1400cbebd
cmp word [rdi], r12w
je 0x1400cbebd
xor ebx, ebx
mov dword [rsp + 0x20], r12d
test r15, r15
lea rcx, [rsp + 0x20]
setne bl
add ebx, 0x410
mov dword [rsp + 0x28], ebx
call fcn.1400ccac0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400cbebd
mov qword [rsp + 0x2b8], rbp
xor ebp, ebp
cmp dword [rsp + 0x20], ebp
jle 0x1400cbeac
mov qword [rsp + 0x270], r14
mov r14, rax
mov qword [rsp + 0x278], rsi
nop dword [rax]
test r12d, r12d
jne 0x1400cbe97
mov r8d, dword [r14]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400cbe83
test r13, r13
je 0x1400cbe0d
mov rcx, rax
call fcn.1400ccb60
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
je 0x1400cbdf2
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1400cbdf2
mov sil, 1
jmp 0x1400cbdfa
xor sil, sil
test rdi, rdi
je 0x1400cbe75
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test sil, sil
je 0x1400cbe75
mov rdi, qword [rsp + 0x38]
lea r9, [rsp + 0x24]
mov qword [rsp + 0x30], 0
mov r8d, 8
mov dword [rsp + 0x24], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1400cbe75
mov rdx, qword [rsp + 0x30]
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov rcx, rbx
call sub.KERNEL32.dll_K32GetModuleBaseNameW
test eax, eax
je 0x1400cbe75
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400cbe75
mov r12d, dword [r14]
test r15, r15
je 0x1400cbe75
mov qword [r15], rbx
jmp 0x1400cbe83
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x38]
mov ebx, dword [rsp + 0x28]
inc ebp
add r14, 4
cmp ebp, dword [rsp + 0x20]
jl 0x1400cbda0
mov rax, qword [rsp + 0x40]
mov r14, qword [rsp + 0x270]
mov rsi, qword [rsp + 0x278]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbp, qword [rsp + 0x2b8]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, r12d
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400e6b50
add rsp, 0x280
pop r15
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x1400cc590
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x90
xorps xmm0, xmm0
xor ebx, ebx
movups xmmword [rax - 0x78], xmm0
mov dword [rax - 0x74], 0x540
movups xmmword [rax - 0x68], xmm0
mov qword [rax - 0x68], rcx
lea rcx, [rsp + 0x20]
mov dword [rax - 0x78], 0x70
mov qword [rax - 0x60], rdx
movups xmmword [rax - 0x58], xmm0
movups xmmword [rax - 0x48], xmm0
movups xmmword [rax - 0x38], xmm0
movups xmmword [rax - 0x28], xmm0
movups xmmword [rax - 0x18], xmm0
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], r9
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1400cc5fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x90
pop rbx
ret
Function at 0x1400ccac0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rsi, rcx
mov dword [rcx], ebx
xor edi, edi
mov dword [rsp + 0x30], ebx
nop dword [rax]
add edi, 0x200
test rbx, rbx
je 0x1400ccaf4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea r8, [rsp + 0x30]
mov edx, edi
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x1400ccb32
mov eax, dword [rsp + 0x30]
cmp edi, eax
jbe 0x1400ccae0
shr eax, 2
mov dword [rsi], eax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test rbx, rbx
je 0x1400ccb1f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400cf170
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r14, r9
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
xor sil, sil
cmp qword [rdx + 0x18], 8
jb 0x1400cf1ab
mov rdx, qword [rdx]
xor r15d, r15d
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400cf2cf
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400cf1f0
mov rdx, qword [rdi]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20119
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400cf2cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test eax, eax
je 0x1400cf352
call fcn.1400c1f80
cmp dword [rax + 0x78], 3
jl 0x1400cf352
call fcn.1400c1f80
mov r14, rax
mov r8b, 1
mov edx, ebp
lea rcx, [rsp + 0x60]
call fcn.140089310
nop
cmp qword [rax + 0x18], 8
jb 0x1400cf269
mov rax, qword [rax]
cmp qword [rbx + 0x18], 8
jb 0x1400cf273
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x1400cf27d
mov rdi, qword [rdi]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdi
lea rax, str.Error_occurred_while_reading_registry___path:__s__key:__s__error:___d___s__
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x7a
lea r9, str.D:BWA6FBB69CA_F410_0iCloudCommon_131_srcrootiCCUtilsWinLogSettings.cpp
lea r8, str.GetRegistry
mov edx, 3
mov rcx, r14
call fcn.1400c2500
nop
lea rcx, [rsp + 0x60]
call fcn.140052120
jmp 0x1400cf352
mov dword [rsp + 0x50], r15d
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400cf2e1
mov rdx, qword [rbx]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400cf347
cmp dword [rsp + 0x50], r15d
jbe 0x1400cf347
cmp qword [rbx + 0x18], 8
jb 0x1400cf316
mov rbx, qword [rbx]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, sil
mov ecx, 1
test eax, eax
cmove esi, ecx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400e6b50
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d0bc0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov qword [r11 + 0x20], rsi
lea rax, [r11 + 0x18]
mov qword [r11 - 0x18], rax
lea rax, [r11 + 0x20]
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rsi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareApple_Inc.Internet_ServicesLogging
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400d0c21
mov eax, esi
mov rsi, qword [rsp + 0x78]
test eax, eax
jne 0x1400d0d1d
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400d0ce2
mov r9, rbx
mov r10, qword [rbx + 0x18]
cmp r10, 8
jb 0x1400d0c46
mov r9, qword [rbx]
cmp rcx, 4
jne 0x1400d0c8a
lea rax, [0x140273368]
movzx edx, word [r9]
movzx r8d, word [0x140273368]
cmp dx, r8w
jb 0x1400d0c8a
sub r9, rax
cmp dx, r8w
ja 0x1400d0c8a
cmp rcx, 1
je 0x1400d0ce2
dec rcx
add rax, 2
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x1400d0c6c
cmp r10, 8
jb 0x1400d0c93
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x1400d0c9d
mov rdi, qword [rdi]
test rbx, rbx
je 0x1400d0d01
mov rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x1400d0cb0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1400d0cfd
cmp qword [rdi + 0x18], 8
jb 0x1400d0cec
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
je 0x1400d0d1d
test eax, eax
je 0x1400d0d1d
mov r9d, 0x40040
lea r8, str.iCloud_Logging
lea rdx, str.Unable_to_set_registry_key_to_enable_iCloudDrive_logging.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
test rsi, rsi
je 0x1400d0d2b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400dfad0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0x800
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400dfb74
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
jbe 0x1400dfb50
mov ebx, SafeArrayGetDim
jmp 0x1400dfb74
mov eax, dword [rsp + 0x30]
xor ebx, ebx
test eax, eax
je 0x1400dfb6f
test al, 1
jne 0x1400dfb68
shr rax, 1
cmp word [rsp + rax*2 + 0x3e], bx
je 0x1400dfb74
mov ebx, SafeArrayGetDim
jmp 0x1400dfb74
mov word [rsp + 0x40], bx
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400dfb80
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400523d0
mov eax, ebx
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400e6b50
add rsp, 0x850
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400e7b5c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400e7ba6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400e7ba6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400e7ba6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400e7ba6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400e7ba6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400e7ba8
xor al, al
add rsp, 0x28
ret