joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a9c20
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x5a9cc7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x5a9d6a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x5a9cc7
cmp r9, 0
je 0x5a9e23
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x5a9d80
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x5f5440
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5f5515
movdqa xmm0, xmmword [0x0074e570]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5f5481
movdqa xmm0, xmmword [0x0074e580]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5f5597
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5f556b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0074e240]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0074e590]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x6020a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60223b
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x6020c1
inc rcx
cmp rbx, rcx
jle 0x602231
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x6020be
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.0057a520
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x008ed680]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005fe3e0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x602225
test rdx, rdx
je 0x60221a
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403de0
xorps xmm15, xmm15
mov r14, qword [0x00955940]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x6021e9
xor eax, eax
lea rbx, [0x0074cab8]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006d0b93]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044f820
jmp 0x602210
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0074ca88]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044f760
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.006020a0
Function at 0x640320
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x640422
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call fcn.0058e320
test rdi, rdi
jne 0x640373
mov rbx, qword [0x009000f0]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x00687440]
call fcn.004124a0
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x78]
call fcn.006402c0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call fcn.00403de0
xorps xmm15, xmm15
mov r14, qword [0x00955940]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x6403f5
xor eax, eax
lea rbx, [0x0074cab8]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006d0b93]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call fcn.0044f820
jmp 0x64041c
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0074ca88]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call fcn.0044f760
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.00465340
mov rax, qword [rsp + 8]
jmp fcn.00640320
Function at 0x100005db4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x30
and qword [rax + 0x18], 0
and dword [rax + 8], 0
and dword [rcx + 0xd0], 0
mov dword [rax + 0x10], 4
lea rax, [rax + 0x18]
mov rbx, rcx
mov dword [rcx + 0xd4], 0x7530
lea rdx, [0x1000022e0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x100005e64
lea rax, [rsp + 0x48]
lea rdx, [0x100002330]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100005e54
mov eax, dword [rsp + 0x40]
mov ecx, 0x2710
cmp eax, ecx
mov dword [rbx + 0xd4], eax
jge 0x100005e54
mov dword [rbx + 0xd4], ecx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x100005e64
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x100009734
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r13
push r14
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
lea r13, [0x100023920]
mov qword [rax + 8], r13
xor ebp, ebp
mov qword [rax - 0x38], rbp
mov qword [rax - 0x40], rbp
mov dword [rax - 0x48], 6
xor r9d, r9d
xor r8d, r8d
lea edx, [rbp + 1]
mov rcx, r13
call sub.MFC42u.dll_CGopherConnection::CGopherConnection
nop
lea rax, [0x1000037d8]
mov qword [0x100023920], rax
lea rcx, [0x100023d08]
call sub.MFC42u.dll_CFile::CFile
lea rbx, [0x100002a48]
mov qword [0x100023d08], rbx
lea rcx, [0x100023d88]
call sub.MFC42u.dll_CFile::CFile
mov qword [0x100023d88], rbx
lea rcx, [0x100023e08]
call sub.MFC42u.dll_CFile::CFile
mov qword [0x100023e08], rbx
lea rcx, [0x100023e88]
call sub.MFC42u.dll_CFile::CFile
mov qword [0x100023e88], rbx
lea rcx, [0x100023f08]
call sub.MFC42u.dll_CFile::CFile
lea rbx, [0x1000028b8]
mov qword [0x100023f08], rbx
lea rcx, [0x100023f88]
call sub.MFC42u.dll_CFile::CFile
mov qword [0x100023f88], rbx
mov word [0x100024008], bp
xor r9d, r9d
lea r8d, [rbp + 5]
lea r14, [0x100024008]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [0x10002441c], ebp
mov qword [0x100024838], rbp
mov qword [0x100024830], rbp
mov r9d, 0x104
lea r8, [0x100024628]
lea edx, [rbp + 0x67]
mov rcx, qword [0x100022048]
call qword [sym.imp.USER32.dll_LoadStringW]
mov edi, 0x138a
lea rbx, [0x100024420]
mov esi, 0x103
mov r9d, esi
mov r8, rbx
mov edx, edi
mov rcx, qword [0x100022048]
call qword [sym.imp.USER32.dll_LoadStringW]
inc edi
lea ecx, [rax + 1]
movsxd rdx, ecx
lea rbx, [rbx + rdx*2]
or ecx, 0xffffffff
sub ecx, eax
add esi, ecx
cmp edi, 0x138c
jl 0x100009877
mov word [rbx], bp
mov dword [0x1000239e0], 0x98
mov rax, qword [0x100022048]
mov qword [0x1000239f0], rax
lea rax, [0x100024420]
mov qword [0x1000239f8], rax
mov dword [0x100023a0c], 1
lea rcx, [0x100024212]
mov qword [0x100023a10], rcx
mov word [0x100024212], bp
mov dword [0x100023a18], 0x104
mov qword [0x100023a30], r14
lea rax, [0x100024628]
mov qword [0x100023a38], rax
mov qword [0x100023a60], 0x66
mov ecx, dword [0x100023a40]
or ecx, 0x81a64
btr ecx, 0x17
mov dword [0x100023a40], ecx
mov rax, r13
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
Function at 0x10000a8e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x40
and qword [rax - 0x10], 0
and dword [rax + 0x18], 0
mov dword [rax - 0x18], 4
lea rax, [rax - 0x10]
mov rbx, rcx
lea rdx, [0x1000022e0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x10000a930
lea eax, [rcx + 1]
jmp 0x10000a97e
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10000a967
cmp dword [rsp + 0x68], 4
je 0x10000a96f
cmp dword [rsp + 0x68], 3
je 0x10000a96f
mov dword [rsp + 0x60], 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x60]
add rsp, 0x40
pop rbx
ret

Function at 0x10000b284
Capabilities:
Delete file

Disassembly:
sub rsp, 0x858
mov rax, qword [0x10001f190]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov r9d, 0x208
lea r8, [rsp + 0x430]
lea rcx, [rsp + 0x20]
mov edx, r9d
call fcn.10000b310
test eax, eax
je 0x10000b2c7
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r9d, 0x208
lea r8, [rsp + 0x430]
lea rcx, [rsp + 0x20]
mov edx, r9d
call fcn.10000b434
test eax, eax
je 0x10000b2f1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.100019220
add rsp, 0x858
ret
Function at 0x10000b310
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rsi, r8
mov rdi, rcx
xor ebx, ebx
mov word [rcx], bx
mov word [r8], bx
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CDaoIndexFieldInfo::CDaoIndexFieldInfo
nop
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CDaoIndexFieldInfo::CDaoIndexFieldInfo
nop
mov edx, 0xa3
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CPropertySheet::OnCtlColor
mov edx, 0xa4
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CPropertySheet::OnCtlColor
mov ebp, 0x208
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
jne 0x10000b399
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
xor eax, eax
jmp 0x10000b41f
mov r8, qword [rsp + 0x60]
mov rdx, rbp
mov rcx, rsi
call fcn.100008ffc
cmp bx, word [0x100022970]
jne 0x10000b3e0
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [0x100022970]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, ebx
jne 0x10000b3e0
mov word [0x100022970], bx
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
jmp 0x10000b413
lea r8, [0x100022970]
mov rdx, rbp
mov rcx, rdi
call fcn.100005be8
mov r8, qword [rsp + 0x50]
mov rdx, rbp
mov rcx, rdi
call fcn.100008ffc
nop
lea rcx, [rsp + 0x50]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
mov ebx, 1
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x10000b434
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rsi, r8
mov rdi, rcx
call fcn.10001866c
mov rdx, rax
lea rcx, [rsp + 0x28]
call sub.MFC42u.dll_CByteArray::CByteArray
nop
xor ebx, ebx
mov word [rdi], bx
mov word [rsi], bx
lea rcx, [rsp + 0x70]
call sub.MFC42u.dll_CDaoIndexFieldInfo::CDaoIndexFieldInfo
nop
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CDaoIndexFieldInfo::CDaoIndexFieldInfo
nop
mov edx, 0xa3
lea rcx, [rsp + 0x70]
call sub.MFC42u.dll_CPropertySheet::OnCtlColor
mov edx, 0xa5
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CPropertySheet::OnCtlColor
mov ebp, 0x208
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
jne 0x10000b4de
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x70]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov qword [rcx + 8], rax
xor eax, eax
jmp 0x10000b57e
mov r8, qword [rsp + 0x70]
mov rdx, rbp
mov rcx, rsi
call fcn.100008ffc
cmp bx, word [0x100022760]
jne 0x10000b530
xor r9d, r9d
lea r8d, [r9 + 9]
lea rdx, [0x100022760]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, ebx
jne 0x10000b530
mov word [0x100022760], bx
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x70]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
jmp 0x10000b56e
lea r8, [0x100022760]
mov rdx, rbp
mov rcx, rdi
call fcn.100005be8
mov r8, qword [rsp + 0x60]
mov rdx, rbp
mov rcx, rdi
call fcn.100008ffc
nop
lea rcx, [rsp + 0x60]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
lea rcx, [rsp + 0x70]
call sub.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef
nop
mov ebx, 1
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov qword [rdx + 8], rcx
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x10000cf3c
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0xc0
mov rax, qword [0x10001f190]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
mov rcx, qword [0x100027010]
lea r8, [rsp + 0x30]
mov r9d, 0x40
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x10000cfa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x100023720]
lea r9, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.100019220
add rsp, 0xc0
pop rbx
ret

Function at 0x10000cfc0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x10001f190]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rcx, qword [0x100023720]
lea rax, [rsp + 0x58]
xor edi, edi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov rbx, r8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x10000d0fd
cmp dword [rsp + 0x58], 1
jne 0x10000d0f2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea r8d, [rdi + 1]
lea rdx, [0x100003ae0]
mov r9, rbx
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
lea rdx, [0x100024a80]
lea rax, [rsp + 0x60]
sub rdx, rax
mov r11d, 0x80
lea rcx, [rsp + 0x60]
lea rax, [r11 + 0x7fffff7e]
cmp rax, rdi
je 0x10000d091
movzx eax, word [rdx + rcx]
cmp ax, di
je 0x10000d091
mov word [rcx], ax
add rcx, 2
sub r11, 1
jne 0x10000d06f
cmp r11, rdi
jne 0x10000d09a
sub rcx, 2
mov word [rcx], di
mov edi, 0x100
lea r8, [0x1000039e8]
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.10000cea4
lea rcx, [rsp + 0x60]
mov r8, rbx
mov rdx, rdi
call fcn.10000cea4
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x60]
lea rdx, [0x100003ac8]
mov r8d, 1
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.100019220
mov rbx, qword [rsp + 0x180]
add rsp, 0x170
pop rdi
ret
Function at 0x10000d124
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x10001f190]
xor rax, rsp
mov qword [rsp + 0xc0], rax
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
lea rdx, [0x100003a10]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10000d27f
lea rbx, [0x100024a80]
xor edx, edx
mov r8d, 0x82
mov rcx, rbx
mov dword [rsp + 0x38], 0x80
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x30]
lea r11, [rsp + 0x38]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x3c]
lea rdx, [0x1000039f8]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [0x100003d50]
mov edx, 5
call fcn.10000cf3c
lea rcx, [0x100003cf0]
mov edx, 6
call fcn.10000cf3c
lea rcx, [0x100003ca0]
mov edx, 7
call fcn.10000cf3c
mov rcx, qword [0x100027010]
mov r9d, 0x40
lea edx, [r9 - 0x38]
lea r8, [rsp + 0x40]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x10000d27f
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x100023720]
lea r9, [rsp + 0x40]
lea rdx, [0x100003c50]
mov r8d, 1
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
lea r8, [0x100003aa8]
lea rdx, [0x100003be0]
mov rcx, rbx
call fcn.10000cfc0
lea r8, [0x100003a90]
lea rdx, [0x100003b70]
mov rcx, rbx
call fcn.10000cfc0
lea r8, [0x100003a70]
lea rdx, [0x100003b00]
mov rcx, rbx
call fcn.10000cfc0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x10000d28f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.100019220
add rsp, 0xd0
pop rbx
ret
Function at 0x10000d2b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x1e0
mov rax, qword [0x10001f190]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov r12d, 0x100
lea rax, [r11 - 0x128]
mov rdi, rdx
sub rcx, rax
xor ebp, ebp
mov dword [rsp + 0x30], r12d
lea r8d, [r12 - 0x80]
lea rdx, [r11 - 0x128]
lea rax, [r8 + 0x7fffff7e]
cmp rax, rbp
je 0x10000d320
movzx eax, word [rcx + rdx]
cmp ax, bp
je 0x10000d320
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x10000d2fe
cmp r8, rbp
jne 0x10000d329
sub rdx, 2
mov word [rdx], bp
lea r8, [0x1000026ec]
lea rcx, [rsp + 0xd0]
mov rdx, r12
call fcn.10000cea4
lea r8, [0x100003ae0]
lea rcx, [rsp + 0xd0]
mov rdx, r12
call fcn.10000cea4
mov rcx, qword [0x100023720]
lea r11, [rsp + 0x38]
lea rdx, [rsp + 0xd0]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x10000d490
movsxd rbx, dword [rsp + 0x30]
xor edx, edx
mov rcx, rdi
mov r8, rbx
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
sub ebx, 2
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x10000d485
mov rcx, rdi
mov esi, ebp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebp
jle 0x10000d3fe
mov rbx, rdi
cmp word [rbx], 0x5c
je 0x10000d485
mov rcx, rdi
inc esi
add rbx, 2
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, eax
jl 0x10000d3e1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebp
je 0x10000d485
lea rax, [rsp + 0x50]
mov rdx, rdi
mov ecx, 0x40
sub rdx, rax
lea r8, [rsp + 0x50]
lea rax, [rcx + 0x7fffffbe]
cmp rax, rbp
je 0x10000d444
movzx eax, word [rdx + r8]
cmp ax, bp
je 0x10000d444
mov word [r8], ax
add r8, 2
sub rcx, 1
jne 0x10000d420
cmp rcx, rbp
jne 0x10000d44d
sub r8, 2
mov word [r8], bp
lea r8, [0x100024a80]
mov rdx, r12
mov rcx, rdi
call fcn.10000b75c
lea r8, [0x1000039e8]
mov rdx, r12
mov rcx, rdi
call fcn.10000cea4
lea r8, [rsp + 0x50]
mov rdx, r12
mov rcx, rdi
call fcn.10000cea4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.100019220
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x10000d774
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
add eax, 0xffffffff
jne 0x10000d7f2
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x10000d7c2
call qword [sym.imp.KERNEL32.dll_CancelIo]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x10000d7d2
call qword [sym.imp.WS2_32.dll_closesocket]
lea rcx, [0x100003da0]
call sub.ntdll.dll_DbgPrint
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
pop rbx
ret