joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400260b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, rcx
mov rbp, r8
mov rdi, rdx
lea rcx, [rsp + 0x42]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], bx
call fcn.1400c2130
cmp qword [rdi + 0x18], 8
mov dword [rsp + 0x30], 0x208
jb 0x140026105
mov rdi, qword [rdi]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [rsp + 0x40], bx
jne 0x140026137
mov r8, rbx
jmp 0x14002614a
lea rax, [rsp + 0x40]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bx
jne 0x140026140
lea rcx, [rbp + 8]
lea rdx, [rsp + 0x40]
call fcn.140006900
lea rax, [rsp + 0x30]
lea rdx, str.Profile
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [rsp + 0x40], bx
je 0x1400261aa
lea rax, [rsp + 0x40]
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400261a0
lea rcx, [rbp + 0x28]
lea rdx, [rsp + 0x40]
mov r8, rbx
call fcn.140006900
lea rcx, [rsp + 0x30]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rcx
lea rdx, str.KeyboardLayout
xor r9d, r9d
mov rcx, rsi
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret

Function at 0x140026210
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [r8 + 0x18]
lea rbx, [r8 + 8]
mov rdi, r8
add eax, eax
cmp qword [rbx + 0x18], 8
mov rsi, rcx
jb 0x14002623b
mov r8, qword [rbx]
jmp 0x14002623e
mov r8, rbx
cmp qword [rdx + 0x18], 8
jb 0x140026248
mov rdx, qword [rdx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [rdi + 0x38]
lea rax, [rdi + 0x28]
add ecx, ecx
cmp qword [rax + 0x18], 8
jb 0x140026273
mov rax, qword [rax]
mov dword [rsp + 0x28], ecx
lea rdx, str.Profile
mov r9d, 1
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rbx + 0x18], 8
mov dword [rsp + 0x48], 0
jb 0x1400262a7
mov rbx, qword [rbx]
lea rcx, str.00000000_0000_0000_0000_000000000000
mov rdx, rbx
call fcn.1400be994
test rax, rax
je 0x1400262c2
mov eax, dword [rdi + 4]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x48]
lea rdx, str.KeyboardLayout
mov r9d, 4
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140027040
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, r8
mov r15, rdx
test rdx, rdx
jne 0x140027123
mov ecx, 0x800
call fcn.1400bbc88
mov rdi, rax
mov ecx, 0x800
call fcn.1400bbc88
mov rbx, rax
test rdi, rdi
je 0x14002710d
test rax, rax
je 0x140027105
xor edx, edx
mov r8d, 0x800
mov rcx, rdi
call fcn.1400c2130
lea rax, [0x1401271f8]
mov qword [rsp + 0x20], rax
lea r9, str.RC::RCInputManagerBase::SavePreloadInputIDArrayToRegistry
lea r8, str._s__:__s
mov edx, 0x400
mov rcx, rdi
call fcn.140007140
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call fcn.1400c2130
mov r8, rdi
mov edx, 0x400
mov rcx, rbx
call fcn.140007140
mov rcx, rbx
call fcn.140015100
mov rcx, rdi
call fcn.1400bd2dc
test rbx, rbx
je 0x140027226
mov rcx, rbx
call fcn.1400bd2dc
jmp 0x140027226
call fcn.140027250
mov esi, 1
mov rbx, qword [r14]
cmp rbx, qword [r14 + 8]
je 0x140027226
xor r12d, r12d
nop dword [rax]
mov edi, dword [rbx]
mov edx, esi
lea rcx, [rbp - 0x28]
call fcn.140061a30
nop
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x38], r12
mov word [rbp - 0x48], r12w
mov r8d, edi
lea rdx, [0x140125ed8]
lea rcx, [rbp - 0x48]
call fcn.140061ab0
mov eax, dword [rbp - 0x38]
add eax, eax
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400271f5
inc esi
cmp qword [rbp - 0x30], 8
jb 0x1400271c4
mov rcx, qword [rbp - 0x48]
call fcn.1400bd20c
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x38], r12
mov word [rbp - 0x48], r12w
cmp qword [rbp - 0x10], 8
jb 0x1400271e5
mov rcx, qword [rbp - 0x28]
call fcn.1400bd20c
add rbx, 4
cmp rbx, qword [r14 + 8]
jne 0x140027140
jmp 0x140027226
cmp qword [rbp - 0x30], 8
jb 0x140027205
mov rcx, qword [rbp - 0x48]
call fcn.1400bd20c
mov qword [rbp - 0x30], 7
mov qword [rbp - 0x38], r12
mov word [rbp - 0x48], r12w
cmp qword [rbp - 0x10], 8
jb 0x140027226
mov rcx, qword [rbp - 0x28]
call fcn.1400bd20c
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bcae0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140027250
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
test rdx, rdx
jne 0x14002730f
mov ecx, 0x800
call fcn.1400bbc88
mov ecx, 0x800
mov rdi, rax
call fcn.1400bbc88
mov rbx, rax
test rdi, rdi
je 0x140027300
test rax, rax
je 0x1400272f8
xor edx, edx
mov r8d, 0x800
mov rcx, rdi
call fcn.1400c2130
lea rax, [0x1401271f8]
lea r9, str.RC::RCInputManagerBase::ClearAllPreloadInputIDsInRegistry
lea r8, str._s__:__s
mov edx, 0x400
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140007140
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call fcn.1400c2130
mov r8, rdi
mov edx, 0x400
mov rcx, rbx
call fcn.140007140
mov rcx, rbx
call fcn.140015100
mov rcx, rdi
call fcn.1400bd2dc
test rbx, rbx
je 0x140027366
mov rcx, rbx
call fcn.1400bd2dc
jmp 0x140027366
mov ebx, 1
lea rcx, [rsp + 0x30]
mov edx, ebx
call fcn.140061a30
cmp qword [rsp + 0x48], 8
lea rdx, [rsp + 0x30]
cmovae rdx, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x140027354
inc ebx
cmp qword [rsp + 0x48], 8
jb 0x140027314
mov rcx, qword [rsp + 0x30]
call fcn.1400bd20c
jmp 0x140027314
cmp qword [rsp + 0x48], 8
jb 0x140027366
mov rcx, qword [rsp + 0x30]
call fcn.1400bd20c
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x140027380
Capabilities:
Delete registry key

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rsi
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rdx
test rdx, rdx
jne 0x140027455
mov ecx, 0x800
call fcn.1400bbc88
mov rdi, rax
mov ecx, 0x800
call fcn.1400bbc88
mov rbx, rax
test rdi, rdi
je 0x140027442
test rax, rax
je 0x14002743a
xor edx, edx
mov r8d, 0x800
mov rcx, rdi
call fcn.1400c2130
lea rax, [0x1401271f8]
mov qword [rsp + 0x20], rax
lea r9, str.RC::RCInputManagerBase::ClearAllSortOrderInRegistry
lea r8, str._s__:__s
mov edx, 0x400
mov rcx, rdi
call fcn.140007140
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call fcn.1400c2130
mov r8, rdi
mov edx, 0x400
mov rcx, rbx
call fcn.140007140
mov rcx, rbx
call fcn.140015100
mov rcx, rdi
call fcn.1400bd2dc
test rbx, rbx
je 0x1400274cd
mov rcx, rbx
call fcn.1400bd2dc
jmp 0x1400274cd
xor esi, esi
mov ebx, esi
nop dword [rax]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x38], si
mov r8d, ebx
lea rdx, str._08d
lea rcx, [rsp + 0x38]
call fcn.140061ab0
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x1400274bb
inc ebx
cmp qword [rsp + 0x50], 8
jb 0x140027460
mov rcx, qword [rsp + 0x38]
call fcn.1400bd20c
jmp 0x140027460
cmp qword [rsp + 0x50], 8
jb 0x1400274cd
mov rcx, qword [rsp + 0x38]
call fcn.1400bd20c
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1400274f0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, r8
mov r14, rdx
mov rdx, r8
call fcn.1400ba770
cmp qword [rbx + 0x18], 8
jb 0x140027532
mov rbx, qword [rbx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140027688
mov dword [rsp + 0x30], 1
mov rbx, qword [r14]
cmp rbx, qword [r14 + 8]
je 0x14002767d
lea rdi, [rbx + 0x20]
xor ebp, ebp
nop dword [rax + rax]
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbp
mov word [rsp + 0x48], bp
lea rsi, [rdi - 0x18]
cmp qword [rdi], 8
jb 0x1400275a2
mov rdx, qword [rsi]
jmp 0x1400275a5
mov rdx, rsi
lea rcx, str.00000000_0000_0000_0000_000000000000
call fcn.1400be994
test rax, rax
jne 0x1400275ee
cmp qword [rdi + 0x20], 8
jb 0x1400275c3
mov rax, qword [rdi + 8]
jmp 0x1400275c7
lea rax, [rdi + 8]
cmp qword [rdi], 8
jb 0x1400275d0
mov rsi, qword [rsi]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8d, dword [rbx]
lea rdx, str._04X:_s_s
lea rcx, [rsp + 0x48]
call fcn.140061ab0
jmp 0x140027606
mov r9d, dword [rdi - 0x1c]
mov r8d, dword [rbx]
lea rdx, str._04X:_08X
lea rcx, [rsp + 0x48]
call fcn.140061ab0
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14002766b
inc dword [rsp + 0x30]
cmp qword [rsp + 0x60], 8
jb 0x140027657
mov rcx, qword [rsp + 0x48]
call fcn.1400bd20c
add rbx, 0x48
add rdi, 0x48
cmp rbx, qword [r14 + 8]
jne 0x140027580
jmp 0x14002767d
cmp qword [rsp + 0x60], 8
jb 0x14002767d
mov rcx, qword [rsp + 0x48]
call fcn.1400bd20c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400bcae0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140027ab0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r15d, edx
test edx, edx
jne 0x140027af7
xor al, al
jmp 0x140027ca6
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Control_PanelInput_MethodHot_Keys
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140027af0
xor r12b, r12b
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x11], xmm0
xor r13d, r13d
mov qword [rbp - 1], r13
mov qword [rbp + 0x27], 7
mov qword [rbp + 0x1f], r13
mov word [rbp + 0xf], r13w
lea r8d, [rax + 0x23]
lea rdx, str.Control_PanelInput_MethodHot_Keys
lea rcx, [rbp + 0xf]
call fcn.140006900
nop
lea r8, [rbp - 0x11]
lea rdx, [rbp + 0xf]
call fcn.1400ba4e0
nop
cmp qword [rbp + 0x27], 8
jb 0x140027b77
mov rcx, qword [rbp + 0xf]
call fcn.1400bd20c
mov r14, qword [rbp - 0x11]
mov rbx, r14
mov rsi, qword [rbp - 9]
cmp r14, rsi
je 0x140027c5a
mov dword [rbp - 0x29], r13d
mov dword [rbp - 0x25], 4
mov qword [rbp + 0x27], 7
mov qword [rbp + 0x1f], r13
mov word [rbp + 0xf], r13w
mov r8d, 0xa
lea rdx, str.Target_IME
lea rcx, [rbp + 0xf]
call fcn.140006900
cmp qword [rbx + 0x18], 8
jb 0x140027bc9
mov rdx, qword [rbx]
jmp 0x140027bcc
mov rdx, rbx
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140027c2a
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rdx, qword [rbp + 0xf]
lea rax, [rbp - 0x25]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete dil
cmp qword [rbp + 0x27], 8
jb 0x140027c40
mov rcx, qword [rbp + 0xf]
call fcn.1400bd20c
test dil, dil
je 0x140027c4b
cmp dword [rbp - 0x29], r15d
je 0x140027c57
add rbx, 0x20
cmp rbx, rsi
jmp 0x140027b85
mov r12b, 1
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test r14, r14
je 0x140027ca2
mov rbx, r14
cmp r14, rsi
je 0x140027c9a
cmp qword [rbx + 0x18], 8
jb 0x140027c81
mov rcx, qword [rbx]
call fcn.1400bd20c
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r13
mov word [rbx], r13w
add rbx, 0x20
cmp rbx, rsi
jne 0x140027c72
mov rcx, r14
call fcn.1400bd20c
movzx eax, r12b
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400bcae0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140027ce0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov r15d, edx
test edx, edx
jne 0x140027d27
xor al, al
jmp 0x140027ef2
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.Control_PanelInput_MethodHot_Keys
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140027d20
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
xor r12d, r12d
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x37], 7
mov qword [rbp + 0x2f], r12
mov word [rbp + 0x1f], r12w
lea r8d, [rax + 0x23]
lea rdx, str.Control_PanelInput_MethodHot_Keys
lea rcx, [rbp + 0x1f]
call fcn.140006900
nop
lea r8, [rbp - 1]
lea rdx, [rbp + 0x1f]
call fcn.1400ba4e0
nop
cmp qword [rbp + 0x37], 8
jb 0x140027da4
mov rcx, qword [rbp + 0x1f]
call fcn.1400bd20c
mov r14, qword [rbp - 1]
mov rbx, r14
mov rsi, qword [rbp + 7]
cmp r14, rsi
je 0x140027ea6
nop dword [rax + rax]
mov dword [rbp - 0x19], r12d
mov dword [rbp - 0x15], 4
mov qword [rbp + 0x37], 7
mov qword [rbp + 0x2f], r12
mov word [rbp + 0x1f], r12w
mov r8d, 0xa
lea rdx, str.Target_IME
lea rcx, [rbp + 0x1f]
call fcn.140006900
cmp qword [rbx + 0x18], 8
jb 0x140027dfe
mov rdx, qword [rbx]
jmp 0x140027e01
mov rdx, rbx
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140027e5f
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 8
cmovae rdx, qword [rbp + 0x1f]
lea rax, [rbp - 0x15]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete dil
cmp qword [rbp + 0x37], 8
jb 0x140027e75
mov rcx, qword [rbp + 0x1f]
call fcn.1400bd20c
test dil, dil
je 0x140027e99
cmp dword [rbp - 0x19], r15d
jne 0x140027e99
cmp qword [rbx + 0x18], 8
jb 0x140027e8c
mov rdx, qword [rbx]
jmp 0x140027e8f
mov rdx, rbx
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rbx, 0x20
cmp rbx, rsi
jne 0x140027dc0
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test r14, r14
je 0x140027ef0
mov rbx, r14
cmp r14, rsi
je 0x140027ee8
nop
cmp qword [rbx + 0x18], 8
jb 0x140027ecf
mov rcx, qword [rbx]
call fcn.1400bd20c
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
add rbx, 0x20
cmp rbx, rsi
jne 0x140027ec0
mov rcx, r14
call fcn.1400bd20c
mov al, 1
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400bcae0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002cc80
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
movsxd rbx, r9d
mov rbp, r8
mov rdi, rdx
mov rcx, rbx
call fcn.1400bebd0
mov rsi, rax
test rax, rax
je 0x14002cefe
lea r11, [0x1400f74b0]
or r8, 0xffffffffffffffff
inc r8
cmp byte [r11 + r8], 0
jne 0x14002ccc6
test rbp, rbp
je 0x14002ce51
xor r9d, r9d
test ebx, ebx
jle 0x14002cd15
mov r10, rax
sub rbp, rax
nop word [rax + rax]
mov eax, r9d
cdq
idiv r8d
movsxd rax, edx
movzx ecx, byte [rax + r11]
xor cl, byte [r10 + rbp]
ror cl, 3
mov byte [r10], cl
inc r9d
lea r10, [r10 + 1]
cmp r9d, ebx
jl 0x14002ccf0
lea rcx, [rsp + 0x30]
call fcn.14006d290
nop
mov dword [rsp + 0x20], 2
mov r9d, 2
mov r8d, 0x40000000
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14006fad0
test al, al
jne 0x14002cdf2
mov ecx, 0x800
call fcn.1400bbc88
mov rsi, rax
mov ecx, 0x800
call fcn.1400bbc88
mov rbx, rax
test rsi, rsi
je 0x14002cde1
test rax, rax
je 0x14002cdd9
xor edx, edx
mov r8d, 0x800
mov rcx, rsi
call fcn.1400c2130
lea rax, [0x140127c80]
mov qword [rsp + 0x20], rax
lea r9, str.RC::RCWordLibFileUtil::SaveWordlibToFile
lea r8, str._s__:__s
mov edx, 0x400
mov rcx, rsi
call fcn.140007140
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call fcn.1400c2130
cmp qword [rdi + 0x18], 8
jb 0x14002cdbe
mov rdi, qword [rdi]
mov r9, rdi
mov r8, rsi
mov edx, 0x400
mov rcx, rbx
call fcn.140007140
mov rcx, rbx
call fcn.140015100
mov rcx, rsi
call fcn.1400bd2dc
test rbx, rbx
je 0x14002cdee
mov rcx, rbx
call fcn.1400bd2dc
xor bl, bl
jmp 0x14002ce3f
mov dword [rsp + 0x68], 0
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x14002ce08
xor bl, bl
jmp 0x14002ce36
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x14002ce04
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002ce04
cmp ebx, dword [rsp + 0x68]
sete bl
mov rcx, rsi
call fcn.1400beb90
nop
lea rcx, [rsp + 0x30]
call fcn.14006fa80
movzx eax, bl
jmp 0x14002cf00
mov rcx, rax
call fcn.1400beb90
mov ecx, 0x800
call fcn.1400bbc88
mov rsi, rax
mov ecx, 0x800
call fcn.1400bbc88
mov rbx, rax
test rsi, rsi
je 0x14002cef1
test rax, rax
je 0x14002cee9
xor edx, edx
mov r8d, 0x800
mov rcx, rsi
call fcn.1400c2130
lea rax, [0x140127c38]
mov qword [rsp + 0x20], rax
lea r9, str.RC::RCWordLibFileUtil::SaveWordlibToFile
lea r8, str._s__:__s
mov edx, 0x400
mov rcx, rsi
call fcn.140007140
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call fcn.1400c2130
cmp qword [rdi + 0x18], 8
jb 0x14002cece
mov rdi, qword [rdi]
mov r9, rdi
mov r8, rsi
mov edx, 0x400
mov rcx, rbx
call fcn.140007140
mov rcx, rbx
call fcn.140015100
mov rcx, rsi
call fcn.1400bd2dc
test rbx, rbx
je 0x14002cefe
mov rcx, rbx
call fcn.1400bd2dc
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140043350
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x4b0
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov eax, dword [rdx]
mov rdi, rdx
mov rbx, rcx
mov r9d, eax
movzx r10d, ax
sar r9d, 0x10
cmp r9d, 0x18
jge 0x140043492
cmp r10d, 0x18
jge 0x140043492
mov r8, qword [rcx + 8]
movsxd rax, r9d
lea rcx, [rax + rax*2]
mov rax, qword [rbx]
lea rdx, [r10 + rcx*8]
mov rcx, qword [rax]
mov eax, dword [r8]
mov dword [rcx + rdx*4 + 0x54], eax
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x400
call fcn.1400c2130
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x70]
mov eax, dword [rcx]
mov dword [rsp + 0xa4], 0xffffffff
mov dword [rsp + 0xa0], eax
inc dword [rcx]
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 8]
movups xmm0, xmmword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x10]
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x50], rax
mov rax, qword [rbx + 0x18]
movups xmm1, xmmword [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov rax, qword [rbx]
movaps xmmword [rsp + 0x80], xmm1
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rsp + 0x58]
movaps xmmword [rsp + 0x90], xmm0
call fcn.140048180
mov rax, qword [rbx + 0x10]
mov rcx, qword [rax]
test rcx, rcx
je 0x140043492
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x140043492
mov r9, qword [rbx + 0x18]
lea rdx, [rsp + 0xa0]
mov r8d, 0x400
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x4b0
pop rdi
ret
Function at 0x140044db0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
lea rcx, [rsp + 0x38]
call fcn.14006d290
nop
mov dword [rsp + 0x20], 3
mov r9d, 1
mov r8d, 0x80000000
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.14006fad0
test al, al
je 0x140044ece
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140044ece
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140044eb4
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140044e41
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140044eb4
mov ecx, dword [rsp + 0x48]
shl rcx, 0x20
add rcx, rdi
cmp rcx, 4
jb 0x140044eb4
xor eax, eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], eax
cmp qword [rbx], 0xffffffffffffffff
je 0x140044ece
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x34]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140044eb4
cmp dword [rsp + 0x30], 4
jne 0x140044eb4
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140044ea7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140044ea7
mov qword [rbx], 0xffffffffffffffff
cmp dword [rsp + 0x34], 0xffff0001
sete bl
jmp 0x140044ed0
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140044ece
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140044ece
mov qword [rbx], 0xffffffffffffffff
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.14006fa80
movzx eax, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret