joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a69c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
or rcx, 0xffffffffffffffff
mov rbx, r8
mov r8, qword [r8]
xor edi, edi
mov rsi, rdx
movabs rbp, 0xcbf29ce484222325
inc rcx
cmp word [r8 + rcx*2], di
jne 0x14000a6c9
mov rdx, rdi
add rcx, rcx
je 0x14000a6f9
movzx eax, byte [rdx + r8]
movabs r9, 0x100000001b3
xor rbp, rax
inc rdx
imul rbp, r9
cmp rdx, rcx
jb 0x14000a6db
mov r9, rbp
lea rdx, [rsp + 0x20]
mov r8, rbx
call fcn.14000c148
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14000a71f
mov qword [rsi], rax
mov byte [rsi + 8], dil
jmp 0x14000a8b9
movabs rax, 0x2e8ba2e8ba2e8ba
cmp qword [0x140092490], rax
jne 0x14000a740
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov r8, rbx
lea rdx, [0x140092488]
lea rcx, [rsp + 0x30]
call fcn.14000c1e0
mov rdx, qword [0x140092490]
xorps xmm0, xmm0
lea rcx, [rdx + 1]
test rcx, rcx
js 0x14000a76e
cvtsi2ss xmm0, rcx
jmp 0x14000a783
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rbx, qword [0x1400924b8]
xorps xmm2, xmm2
test rbx, rbx
js 0x14000a799
cvtsi2ss xmm2, rbx
jmp 0x14000a7b1
mov rax, rbx
mov rcx, rbx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movss xmm3, dword [0x140092480]
movaps xmm1, xmm0
mov rdi, qword [rsp + 0x38]
divss xmm1, xmm2
comiss xmm1, xmm3
jbe 0x14000a853
divss xmm0, xmm3
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x14007f608]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x14000a7fc
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x14000a7fc
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x14000a82a
cmp rbx, 0x200
jae 0x14000a827
shl rbx, 3
cmp rbx, rcx
jae 0x14000a82a
mov rbx, rcx
mov rdx, rbx
call fcn.140009a98
lea r8, [rdi + 0x10]
mov r9, rbp
lea rdx, [rsp + 0x30]
call fcn.14000c148
mov rdx, qword [0x140092490]
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov r8, qword [rsp + 0x20]
inc rdx
mov r9, qword [r8 + 8]
mov qword [0x140092490], rdx
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [r9], rdi
mov qword [r8 + 8], rdi
mov rax, qword [0x1400924b0]
mov rcx, qword [0x140092498]
and rax, rbp
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x140092488]
jne 0x14000a89b
mov qword [rcx + rax*8], rdi
jmp 0x14000a8ad
cmp rdx, r8
jne 0x14000a8a6
mov qword [rcx + rax*8], rdi
jmp 0x14000a8b2
cmp qword [rcx + rax*8 + 8], r9
jne 0x14000a8b2
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14000ae2c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rbx, qword [rdx]
or r8, 0xffffffffffffffff
movabs rcx, 0xcbf29ce484222325
mov r10, r8
mov r11, rcx
xor r9d, r9d
mov rdi, rdx
inc r10
cmp word [rbx + r10*2], r9w
jne 0x14000ae58
movabs rsi, 0x100000001b3
mov rdx, r9
add r10, r10
je 0x14000ae87
movzx eax, byte [rdx + rbx]
inc rdx
xor r11, rax
imul r11, rsi
cmp rdx, r10
jb 0x14000ae74
mov rdx, qword [rdi + 8]
inc r8
cmp word [rdx + r8*2], r9w
jne 0x14000ae8b
add r8, r8
je 0x14000aeae
movzx eax, byte [r9 + rdx]
inc r9
xor rcx, rax
imul rcx, rsi
cmp r9, r8
jb 0x14000ae9a
mov rbx, qword [rsp + 8]
xor rcx, r11
mov rsi, qword [rsp + 0x10]
mov rax, rcx
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14000c614
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x14000c6a6
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x14000c680
lea rcx, [0x140070628]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c69f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000c69f
mov rdx, qword [rdi]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
jmp 0x14000c68f
cmp dword [rdi + 8], 0
je 0x14000c69f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, 1
jmp 0x14000c68f
cmp byte [0x1400916f8], 0
jne 0x14000c6f1
lea rcx, [0x140070628]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c6dd
lea rdx, [0x140070528]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
mov qword [0x1400916f0], rax
jmp 0x14000c6e4
mov r10, qword [0x1400916f0]
mov eax, 1
mov byte [0x1400916f8], al
jmp 0x14000c6f8
mov r10, qword [0x1400916f0]
mov rcx, qword [rbx]
mov rdx, rsi
test r10, r10
je 0x14000c689
mov r8d, dword [rbx + 8]
xor r9d, r9d
call r10
jmp 0x14000c68f
Function at 0x14000f118
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x140090008]
xor rax, rsp
mov qword [rbp + 0x350], rax
xor r15d, r15d
mov qword [rsp + 0x38], rcx
mov rbx, rdx
mov qword [rsp + 0x30], r15
mov rsi, r8
mov qword [rsp + 0x40], r15
xor edx, edx
mov rcx, rbx
lea r8d, [r15 + 0x60]
mov r14, r9
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x14000f199
xor edx, edx
lea r8d, [r15 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x14000f199
call fcn.14000da04
mov ebx, eax
jmp 0x14000f288
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14000f1ba
call fcn.14000da04
jmp 0x14000f278
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14000f1b0
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
inc eax
cmp eax, ebx
jae 0x14000f1ec
mov ebx, 0x8007000e
jmp 0x14000f27a
mov ecx, eax
test eax, eax
je 0x14000f21e
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14000f2c6
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000f21e
lea rcx, [rsp + 0x40]
call fcn.14000d9d8
jmp 0x14000f228
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], r15
je 0x14000f1e2
mov rax, qword [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x28], ebx
mov r9d, ebx
mov r8, rsi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14000f1b0
mov r8d, dword [rbp + 0x3b0]
mov ecx, eax
mov rax, qword [rsp + 0x40]
mov word [rax + rcx*2], r15w
lea rcx, [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
call fcn.14000ef80
mov ebx, eax
test rdi, rdi
je 0x14000f288
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x40], rax
je 0x14000f29e
lea rcx, [rsp + 0x40]
call fcn.14000d9cc
mov eax, ebx
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140052570
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070216
call fcn.140002fa4
int3
Function at 0x14000f664
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x140090008]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r15d, r15d
mov rdi, r8
mov rbp, rdx
mov r14, rcx
cmp qword [rcx], r15
jne 0x14000f6a1
mov eax, 0x8000ffff
jmp 0x14000f71a
test rdi, rdi
jne 0x14000f6ad
mov eax, 0x80004003
jmp 0x14000f71a
mov qword [r8], r15
lea rax, [rsp + 0x30]
mov rcx, qword [rcx]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x14000f6ef
cmp eax, 0xea
jne 0x14000f70d
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x14000f70d
mov eax, dword [rsp + 0x34]
lea ecx, [rax - 1]
cmp ecx, 1
jbe 0x14000f741
cmp eax, 7
je 0x14000f741
mov ebx, 0x3f4
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140052570
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov word [rsp + 0x246], r15w
test ebx, ebx
jne 0x14000f75e
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
jmp 0x14000f70d
shr edx, 1
xor ecx, ecx
dec edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rsi, rax
test rax, rax
je 0x14000f7af
mov rcx, qword [r14]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x14000f7a1
mov qword [rdi], rsi
jmp 0x14000f70d
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14000f70d
mov eax, 0x8007000e
jmp 0x14000f71a
Function at 0x140010340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov esi, r9d
mov rdi, r8
mov r14, rdx
mov r15, rcx
test rcx, rcx
je 0x140010516
test rdx, rdx
je 0x140010516
test r8, r8
je 0x140010516
mov rbx, qword [rcx]
movzx eax, word [rbx]
test ax, ax
je 0x140010516
movzx ecx, ax
lea edi, [rbp + 0x20]
cmp cx, di
je 0x1400103aa
movzx eax, cx
cmp cx, 9
jne 0x1400103c1
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
movzx eax, word [rax]
movzx ecx, ax
test ax, ax
jne 0x14001039c
mov rdi, qword [rsp + 0x70]
test ax, ax
je 0x140010516
cmp esi, 5
jne 0x1400103fb
mov qword [r14], rbx
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
cmp word [rax], bp
jne 0x1400103d7
mov qword [r15], rax
mov dword [rdi], 5
mov eax, 1
jmp 0x140010518
sub ax, 0x2d
mov ecx, 0xfffd
mov r12d, 3
test cx, ax
je 0x140010414
mov dword [rdi], r12d
jmp 0x140010426
mov rcx, rbx
mov dword [rdi], 2
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
cmp esi, 4
jne 0x140010437
cmp dword [rdi], 2
jne 0x140010434
mov dword [rdi], ebp
jmp 0x1400103f1
mov esi, r12d
cmp dword [rdi], esi
je 0x140010445
test esi, esi
je 0x140010445
mov dword [rdi], 1
mov r12d, 0x5e
mov qword [r14], rbx
mov esi, ebp
mov edi, ebp
lea r13d, [r12 - 0x3c]
lea r15d, [r12 - 0x3e]
movzx eax, word [rbx]
cmp r12w, ax
jne 0x14001046e
xor edi, 1
movzx eax, r12w
jmp 0x1400104aa
cmp r13w, ax
jne 0x1400104a3
mov eax, r13d
test edi, edi
jne 0x1400104a3
test esi, esi
jne 0x140010490
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [rbx]
mov qword [r14], rax
jmp 0x140010497
mov word [rbx], r15w
mov ecx, r15d
mov eax, ebp
test esi, esi
sete al
mov esi, eax
movzx eax, cx
mov edi, ebp
test ax, ax
je 0x1400104c8
test esi, esi
jne 0x1400104ba
cmp ax, r15w
je 0x1400104c8
cmp ax, 9
je 0x1400104c8
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
jmp 0x14001045c
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov r15, qword [rsp + 0x60]
mov rcx, qword [r14]
mov word [rbx], bp
mov qword [r15], rax
jmp 0x140010500
lea rdx, [rdi + 2]
cmp word [rdx], bp
je 0x1400103f1
mov r8, rbx
mov rcx, rdi
sub r8, rdi
call sub.VCRUNTIME140.dll_memmove
lea rcx, [rdi + 4]
mov edx, r12d
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rdi, rax
test rax, rax
jne 0x1400104e1
jmp 0x1400103f1
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400107ac
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x278], rbx
mov rax, qword [0x140090008]
xor rax, rbp
mov qword [rbp + 0x210], rax
mov r12, r8
mov esi, edx
mov rdi, rcx
xor r13d, r13d
mov ebx, r13d
mov qword [rbp + 8], rbx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r15, rax
or r14, 0xffffffffffffffff
test rax, rax
je 0x14001094b
cmp rax, r14
je 0x14001094b
cmp rax, 7
je 0x14001094b
xor eax, eax
mov dword [rbp], eax
lea r8d, [r13 + 2]
lea rdx, [rbp]
lea rcx, str.vsconsoleoutput
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, r13d
cmp word [rbp], 0x31
sete al
test eax, eax
je 0x14001094b
test r12, r12
je 0x1400109b6
mov rax, r14
inc rax
cmp word [r12 + rax*2], r13w
jne 0x140010855
inc eax
cdqe
lea r14, [rax + rax]
mov eax, 0x80000000
add rax, r14
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x14001091c
movsxd rdi, r14d
cmp r14d, 0x400
jg 0x1400108bb
mov rcx, rdi
call fcn.140014858
test al, al
je 0x1400108bb
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x1400108a8
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400617c0
sub rsp, rax
lea rsi, [rsp + 0x40]
jmp 0x1400108e4
mov rax, rdi
not rax
cmp rax, 0x10
jb 0x1400109f2
lea rcx, [rdi + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14001091c
mov qword [rax], r13
mov rbx, rax
lea rsi, [rax + 0x10]
test rsi, rsi
je 0x14001091c
mov byte [rsi], r13b
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
or r9d, 0xffffffff
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rdi, rdi
and rdi, rsi
jmp 0x14001091f
mov rdi, r13
test rdi, rdi
je 0x1400109b6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, eax
mov qword [rsp + 0x20], r13
lea r9, [rbp]
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400109b6
mov word [rbp + 0x10], r13w
mov r9d, 0x100
lea r8, [rbp + 0x10]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov rdx, r12
lea rcx, [rbp]
call fcn.140009580
nop
lea rcx, [rbp]
call fcn.140013f0c
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [rbp + 0x10]
mov rdx, qword [rbp]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1400109b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 8]
jmp 0x1400109c4
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
jne 0x1400109b8
mov rcx, qword [rbp + 0x210]
xor rcx, rbp
call fcn.140052570
mov rbx, qword [rbp + 0x278]
lea rsp, [rbp + 0x220]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070216
call fcn.140002fa4
int3
Function at 0x140010d50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140090008]
xor rax, rsp
mov qword [rbp + 0x190], rax
movups xmm0, xmmword [0x140069fb8]
mov r14, rcx
mov esi, 1
xor edi, edi
movdqu xmmword [rsp + 0x70], xmm0
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov ebx, eax
test eax, eax
jns 0x140010dba
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xf
jl 0x140010d95
jmp 0x140010f54
test r14, r14
je 0x140010e9b
lea rax, [rsp + 0x58]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140010e9b
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x64]
mov dword [rsp + 0x60], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.EnableSecurity
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140010e39
cmp dword [rsp + 0x50], 4
jne 0x140010e39
xor esi, esi
cmp dword [rsp + 0x64], esi
sete sil
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rbp - 0x80]
mov dword [rsp + 0x68], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SecurityAppID
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140010e88
cmp dword [rsp + 0x50], 1
jne 0x140010e88
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call qword [sym.imp.ole32.dll_IIDFromString]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x140010f54
mov rax, qword [rsp + 0x70]
mov edi, 2
cmp rax, qword [0x140069fb8]
jne 0x140010ed5
mov rax, qword [rsp + 0x78]
cmp rax, qword [0x140069fc0]
jne 0x140010ed5
and qword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
xor ecx, ecx
mov dword [rsp + 0x28], edi
jmp 0x140010ef3
and qword [rsp + 0x40], 0
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x38], 8
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
xor edx, edx
lea r9, [0x140073530]
mov ebx, eax
lea rcx, [0x140069fd8]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140010f54
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140010f54
mov rax, qword [rcx]
mov r8, rdi
mov edx, 1
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, ebx
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140052570
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140010f94
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
and qword [rbp - 0x20], 0
and dword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
lea rdx, str.NewConfigurationWritten
lea rcx, [rbp + 0x28]
call fcn.140009580
and qword [rbp + 0x20], 0
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [0x140092860]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rbx, qword [rbp + 0x28]
test eax, eax
jne 0x140011026
mov rcx, qword [rbp + 0x20]
mov qword [rbp - 0x20], rcx
and dword [rbp - 0x18], eax
mov dword [rbp + 0x18], 1
lea r9d, [rax + 4]
mov dword [rsp + 0x28], r9d
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011041
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140011050
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140011144
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
mov rbp, rsp
sub rsp, 0x50
and qword [rbp - 0x20], 0
and dword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
and qword [rbp + 0x18], 0
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [0x140092860]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400111c6
mov rbx, qword [rbp + 0x18]
mov qword [rbp - 0x20], rbx
and dword [rbp - 0x18], eax
mov dword [rsp + 0x28], 0x34
lea rax, str.DevenvUpdateConfiguration
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ConfigurationChangedReason
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x14001121b
call fcn.140002dfc
mov rcx, rax
test rax, rax
je 0x140011234
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x18], rax
lea r8, str.ConfigurationChangedReason
lea rdx, str.Cannot_find_a_place_to_write_out_the__s__values_
lea rcx, [rbp + 0x18]
call fcn.14000a5cc
nop
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011217
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x140011229
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002fa4
int3
Function at 0x1400113bc
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140090008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov dil, r9b
mov r15, r8
mov r14, rdx
mov r12, rcx
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov rbx, qword [rbp - 0x28]
xor esi, esi
mov qword [rbp - 0x40], rsi
and dword [rbp - 0x38], esi
and qword [rbp - 0x30], rsi
test dil, dil
je 0x140011454
and qword [rbp - 0x48], rsi
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
xor r8d, r8d
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140011454
mov rsi, qword [rbp - 0x48]
mov qword [rbp - 0x40], rsi
and dword [rbp - 0x38], eax
test eax, eax
je 0x1400114f0
and qword [rbp - 0x50], 0
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140011499
test rsi, rsi
je 0x140011489
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rbp - 0x50]
mov qword [rbp - 0x40], rsi
and dword [rbp - 0x38], 0
test eax, eax
je 0x1400114f0
call fcn.140002dfc
mov rcx, rax
test rax, rax
je 0x140011547
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x50], rax
mov r8, r15
lea rdx, str.Cannot_find_a_place_to_write_out_the__s_value_
lea rcx, [rbp - 0x50]
call fcn.14000a5cc
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400114ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rbp - 0x40]
jmp 0x14001151b
mov qword [rbp - 0x50], rbx
mov dword [rsp + 0x28], 8
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, SafeArrayGetDim
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
test rsi, rsi
je 0x140011529
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140052570
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002fa4
int3