joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041280
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x140041320
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140041320
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
repz ret

Function at 0x1400413a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesdec xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x1400413e0
aesdec xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400413e0
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm7
repz ret
Function at 0x140041e50
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.140041ec0
shl edx, 4
test eax, eax
jne 0x140041eb6
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x140041e7b
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x140042f80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x1400430a0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x140042fe0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x140042fe0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x140042fe0
Function at 0x140072600
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x140072635
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140072610
and r10, 0xf
je 0x140072665
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x140072640
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140072659
mov rax, r8
repz ret

Function at 0x140072670
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x1400726ad
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140072680
pxor xmm1, xmm1
and r10, 0xf
je 0x1400726e3
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x1400726bb
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x1400726d7
mov rax, r8
repz ret
Function at 0x14007c570
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp byte [0x14036b1f3], 0
je 0x14007c58a
test cl, cl
je 0x14007c6fc
lea rax, [rbp - 0x10]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCInstaller_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007c6f5
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14007c6f5
mov qword [rsp + 0x50], rbx
xor ebx, ebx
cmp byte [0x14036b1f3], bl
mov dword [rbp + 0x20], ebx
mov dword [rbp + 0x18], ebx
mov dword [rbp + 0x28], 4
jne 0x14007c61b
lea rax, [rbp + 0x28]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
lea rdx, str.bIsSingleClientApp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007c61b
cmp dword [rbp + 0x20], 4
jne 0x14007c61b
cmp dword [rbp + 0x18], ebx
setne byte [0x14036b1f1]
cmp byte [0x14036b1f1], bl
je 0x14007c6e6
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
mov dword [rbp + 0x18], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.bIsSCAcroAppInstalled
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007c668
cmp dword [rbp + 0x20], 4
jne 0x14007c668
cmp dword [rbp + 0x18], ebx
setne byte [0x14036b1f0]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
mov dword [rbp + 0x18], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SCAPackageLevel
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007c6a8
cmp dword [rbp + 0x20], 4
jne 0x14007c6a8
mov eax, dword [rbp + 0x18]
mov dword [0x140368008], eax
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
xor r8d, r8d
lea rdx, str.IsAcrInstalledInRdrMode
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007c6e6
cmp dword [rbp + 0x20], 4
jne 0x14007c6e6
cmp dword [rbp + 0x18], ebx
setne byte [0x14036b1f2]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov byte [0x14036b1f3], 1
add rsp, 0x40
pop rbp
ret
Function at 0x14007c9c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x868
mov rax, qword [0x14036aa00]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov r14, qword [rsp + 0x8b0]
mov rbp, rcx
mov rsi, qword [rsp + 0x8b8]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], r9
xor bl, bl
mov r9, r8
mov r8, rdx
mov edx, 0x400
call fcn.14007cfe0
test eax, eax
js 0x14007cacc
lea rax, [rsp + 0x40]
mov qword [rsp + 0x860], rdi
xor edi, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x40], rdi
lea rdx, [rsp + 0x50]
mov rcx, rbp
lea r9d, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007caa4
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov dword [rsp + 0x34], edi
mov dword [rsp + 0x38], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007ca99
cmp dword [rsp + 0x30], 4
jne 0x14007ca99
cmp dword [rsp + 0x34], edi
mov bl, 1
setne dil
mov dword [rsi], edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x860]
movzx eax, bl
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1402b48e0
add rsp, 0x868
pop r14
pop rsi
pop rbp
pop rbx
ret
movzx eax, bl
jmp 0x14007caaf
Function at 0x14007eb40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x14036aa00]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov ebx, edx
mov r15, rcx
xor r12d, r12d
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x40], r12
mov r8d, 0x208
movzx r14d, r12w
call sub.VCRUNTIME140.dll_memset
test ebx, ebx
mov dword [rsp + 0x30], r12d
mov esi, r12d
mov dword [rsp + 0x34], r12d
lea r8, str.SoftwareAdobeAcrobat_ReaderDCFeatureState
mov dword [rsp + 0x38], 4
mov edx, 0x104
lea rcx, [rsp + 0x50]
sete sil
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ebx, [r12 + 1]
test eax, eax
jne 0x14007ec5a
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x34]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007ec3b
cmp dword [rsp + 0x30], 4
jne 0x14007ec3b
cmp dword [rsp + 0x34], r12d
je 0x14007ec36
movzx edi, bx
jmp 0x14007ec41
mov edi, r12d
jmp 0x14007ec41
mov r14d, ebx
movzx edi, si
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14w, r14w
jne 0x14007ec5a
movzx eax, di
jmp 0x14007ed26
xor edx, edx
mov qword [rsp + 0x40], r12
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea r8, str.SoftwareAdobeAdobe_AcrobatDCFeatureState
mov dword [rsp + 0x34], r12d
mov edx, 0x104
mov dword [rsp + 0x30], r12d
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x38], 4
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007ed20
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007ed10
cmp dword [rsp + 0x34], 4
jne 0x14007ed10
cmp dword [rsp + 0x30], r12d
jne 0x14007ed13
mov rcx, qword [rsp + 0x40]
movzx ebx, r12w
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14007ed23
movzx ebx, si
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14007ed23
movzx ebx, si
movzx eax, bx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1402b48e0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14007fa10
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x14007facb
mov rbx, qword [rcx]
cmp qword [rdi], 0
je 0x14007fa96
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007fab6
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007fab6
mov qword [rsp + 0x28], 0
mov rdx, qword [rdi]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [str.PZ_]
nop
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x14007fab6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp byte [0x14036b228], 0
jne 0x14007fb16
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007fb06
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14036b220], rax
mov byte [0x14036b228], 1
jmp 0x14007fb1d
mov rax, qword [0x14036b220]
mov byte [0x14036b228], 1
jmp 0x14007fb1d
mov rax, qword [0x14036b220]
mov rdx, rsi
mov rcx, qword [rbx]
test rax, rax
je 0x14007fa9f
xor r9d, r9d
mov r8d, dword [rbx + 8]
call qword [str.PZ_]
nop
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140080590
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
mov ebx, 1
mov rsi, qword [str.PU6_]
xor ebp, ebp
mov rax, qword [str.XU6_]
cmp rsi, rax
jae 0x140080656
test ebx, ebx
js 0x140080722
mov rdi, qword [rsi]
test rdi, rdi
je 0x140080649
mov qword [rsp + 0x50], rbp
mov r9, qword [rdi + 0x10]
test r9, r9
jne 0x1400805e5
mov ebx, ebp
jmp 0x140080649
lea r8, [rsp + 0x50]
lea rdx, [0x1402bf6f0]
mov rcx, qword [rdi + 0x18]
mov rax, r9
call qword [str.PZ_]
mov ebx, eax
test eax, eax
js 0x14008062b
mov rax, qword [rdi + 0x20]
add rax, 8
mov qword [rsp + 0x20], rax
mov r9d, 5
lea r8d, [r9 - 1]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdi]
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140080642
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PZ_]
mov rax, qword [str.XU6_]
add rsi, 8
cmp rsi, rax
jb 0x1400805c3
test ebx, ebx
js 0x140080722
jne 0x14008071e
cmp byte [r14 + 0x60], bpl
je 0x140080708
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r14 + 0x50], rax
test rax, rax
je 0x1400806c2
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, r14
lea r8, [0x140080390]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x1400806bf
mov rcx, qword [r14 + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14 + 0x50], rbp
mov rbp, rbx
test rbp, rbp
jne 0x1400806d6
mov ebx, 0x80004005
mov rcx, r14
call fcn.140082450
jmp 0x140080722
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
mov ebx, eax
test eax, eax
jns 0x1400806fc
mov rcx, qword [r14 + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [r14 + 0x58]
add edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140080710
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
mov ebx, eax
test ebx, ebx
jns 0x140080722
mov rcx, r14
call fcn.140082450
jmp 0x140080722
mov byte [r14 + 0x60], bpl
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140081210
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x14036aa00]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call fcn.140083500
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140081293
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call fcn.140083500
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140081293
call fcn.14007f680
mov ebx, eax
jmp 0x1400813b8
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1400812b4
call fcn.14007f680
jmp 0x1400813a7
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400812d7
call fcn.14007f680
jmp 0x1400813a7
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x1400812f9
mov ebx, 0x8007000e
jmp 0x1400813a9
mov ecx, eax
test eax, eax
je 0x14008132e
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1400813f0
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14008132e
lea rcx, [rsp + 0x60]
call fcn.14007f4f0
jmp 0x140081338
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x14008134b
cmp qword [rsp + 0x60], 0
jne 0x14008135a
mov ebx, 0x8007000e
jmp 0x1400813a9
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140081384
call fcn.14007f680
jmp 0x1400813a7
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.140080d40
mov ebx, eax
test rdi, rdi
je 0x1400813b8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x1400813cf
lea rcx, [rsp + 0x60]
call fcn.14007fb50
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1402b48e0
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.14007f810
int3
Function at 0x1400824b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x38
xor r15d, r15d
mov esi, ecx
mov edi, r15d
lea r14d, [r15 + 1]
test ecx, ecx
je 0x140082558
lea rax, [rbp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1402bf700]
mov rcx, 0xffffffff80000002
mov ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140082558
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x48]
lea rax, [rbp + 0x38]
mov dword [rbp + 0x48], r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1402bf72c]
mov dword [rbp + 0x38], r15d
mov dword [rbp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140082546
cmp dword [rbp + 0x38], r15d
cmove ebx, r15d
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140082638
lea rax, [rbp + 0x50]
mov qword [rbp + 0x50], r15
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwarePoliciesAdobeAdobe_AcrobatDCFeatureLockDown
mov rcx, 0xffffffff80000002
mov ebx, r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400825de
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x38]
lea rax, [rbp + 0x40]
mov dword [rbp + 0x38], r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.bEnableATL7Compat
mov dword [rbp + 0x40], r15d
mov dword [rbp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400825d4
cmp dword [rbp + 0x38], 4
jne 0x1400825d4
cmp dword [rbp + 0x40], r14d
cmove ebx, r14d
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140082626
lea rdx, str.SetProcessDEPPolicy
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140082626
test esi, esi
je 0x140082617
mov ecx, ebx
xor ecx, r14d
lea ecx, [rcx*2 + 1]
jmp 0x14008261a
mov ecx, r15d
call qword [str.PZ_]
mov edi, eax
test eax, eax
jne 0x14008269b
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140082647
xor eax, eax
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rdx, str.NtSetInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14008269b
lea ebx, [rbx*4 + 9]
test esi, esi
jne 0x14008266f
mov ebx, 2
mov dword [rbp + 0x38], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
lea r8, [rbp + 0x38]
mov rcx, rax
mov rax, r14
lea edx, [r9 + 0x1e]
call qword [str.PZ_]
test eax, eax
mov edi, r15d
setns dil
mov eax, edi
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140083340
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
mov ecx, 0x200
call fcn.1402b492c
mov rdi, rax
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x78]
lea rdx, str.SoftwareAdobeAdobe_AcrobatDCLanguageNext
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1400833f2
lea r8, [rsp + 0x78]
lea rdx, str.SoftwareAdobeAdobe_AcrobatDCLanguageNext
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1400833f2
lea r8, [rsp + 0x78]
lea rdx, str.SoftwareAdobeAcrobat_ReaderDCLanguageNext
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1400833f2
lea r8, [rsp + 0x78]
lea rdx, str.SoftwareAdobeAcrobat_ReaderDCLanguageNext
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1400833f2
lea r8, [rsp + 0x78]
lea rdx, str.SoftwareAdobeAcrobat_ReaderDCLanguageCurrent
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400834dc
mov dword [rsp + 0x68], 0x200
xor edx, edx
mov r8d, 0x200
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
add dword [rsp + 0x68], 0xfffffffe
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x68]
shr eax, 1
test ebx, ebx
jne 0x1400834dc
cmp dword [rsp + 0x70], 1
jne 0x1400834dc
cmp eax, 4
jb 0x1400834dc
add eax, 0xfffffffc
lea rbx, [rdi + rax*2]
lea rdx, [0x1402bf9b8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400834d8
lea rdx, [0x1402bf9c0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400834d8
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswalpha]
test eax, eax
je 0x1400834dc
movzx ecx, word [rbx + 2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswalpha]
test eax, eax
je 0x1400834dc
movzx ecx, word [rbx + 4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswalpha]
test eax, eax
je 0x1400834dc
cmp word [rbx + 6], 0
jne 0x1400834dc
mov r8, rbx
mov edx, 4
mov rcx, rsi
call fcn.140082770
test eax, eax
js 0x1400834dc
mov ebx, 1
jmp 0x1400834e1
xor ebx, ebx
jmp 0x1400834e1
mov ebx, 0xffffffff
test rdi, rdi
je 0x1400834f3
mov edx, 2
mov rcx, rdi
call fcn.1402b46a0
mov eax, ebx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret