joyce8/EMBER2024-capa huggingface dataset:
Function at 0x106bcd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x106be39
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x106be39
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x106be39
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x106bd71
cmp rdi, r11
jae 0x106be39
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x106bd5b
cmp rdi, r11
jae 0x106be39
cmp word [rdi], 0
je 0x106be39
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x106bda5
mov edx, ebx
mov rcx, rsi
call fcn.0106be74
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x106bdc2
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.0107e488
test eax, eax
je 0x106be10
cmp eax, 0xc
je 0x106be05
cmp eax, 0x16
je 0x106bdfa
cmp eax, 0x22
je 0x106bdfa
cmp eax, 0x50
je 0x106be10
mov ecx, 0x80004005
call fcn.0106bfd0
int3
mov ecx, 0x80070057
call fcn.0106bfd0
int3
mov ecx, 0x8007000e
call fcn.0106bfd0
int3
test ebx, ebx
js 0x106be2e
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x106be2e
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
and word [rdi + rcx], 0
jmp 0x106be3b
mov ecx, 0x80070057
call fcn.0106bfd0
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x106cfa4
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xb0
mov rax, qword [0x0109d1a0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor edi, edi
mov r13d, edx
mov rbx, rcx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rcx + 0xb68], rdi
call fcn.0106c8c4
cmp r13d, edi
mov esi, 0x7fff
mov ebp, esi
mov r12d, edi
je 0x106d16c
lea r8, [rsp + 0x40]
lea rdx, [0x010674e0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, edi
jne 0x106d165
mov rax, qword [rsp + 0x40]
lea r8, [0x010675f0]
lea edx, [rdi + 0x20]
lea rcx, [rsp + 0x50]
mov r9d, r13d
mov dword [rsp + 0x20], 1
mov qword [rbx + 0xb68], rax
call fcn.0107e7ac
mov rcx, qword [rbx + 0xb68]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov word [rsp + 0x90], di
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, edi
jne 0x106d153
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r12d, [rdi + 4]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
lea rdx, [0x01067600]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
cmp eax, edi
lea rax, [rsp + 0x30]
lea rdx, [0x01067630]
cmove esi, dword [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x106d0e4
mov ebp, dword [rsp + 0x34]
jmp 0x106d11f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [0x01067658]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x106d11f
mov esi, dword [rsp + 0x34]
mov ebp, esi
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.0106c4c0
lea rcx, [rbx + 0x99c]
lea rdx, [rbx + 0xa3c]
mov r8d, 0xa0
mov r12d, eax
call fcn.01083500
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx + 0xb68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r12d, edi
jne 0x106d16c
mov edi, 0x80004005
jmp 0x106d1ce
movss xmm1, dword [0x01068580]
mov rcx, qword [rbx + 0x30]
mov eax, ebp
mov edx, esi
cvtsi2ss xmm0, rax
lea r8, [rbx + 0x99c]
mov r9d, 0xa0
mov dword [rbx + 0xc0], ebp
mov dword [rbx + 0xbc], esi
divss xmm0, xmm1
movss dword [rbx + 0xc8], xmm0
cvtsi2ss xmm0, rdx
mov edx, 0xb
divss xmm0, xmm1
movss dword [rbx + 0xc4], xmm0
call fcn.0108ee20
lea rcx, [0x01067678]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, edi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.0107dbd0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x10760a8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x010aaf10]
and qword [rsp + 0x50], 0
and dword [rsp + 0x48], 0
call fcn.01074c68
test eax, eax
mov edi, eax
je 0x10760e2
cmp dword [rbx + 0x134], 0
jne 0x1076142
mov dword [rsp + 0x48], 1
jmp 0x10760f0
cmp dword [rbx + 0x134], 1
jne 0x107614e
and dword [rsp + 0x48], 0
lea r8, [rsp + 0x50]
lea rdx, [0x01067c70]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov r9d, 4
lea rdx, [0x01067cb8]
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x107614e
mov dword [rbx + 0x134], 1
jmp 0x1076155
and dword [rbx + 0x134], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x10766c8
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov esi, edx
lea r8, [rax - 0x10]
lea rdx, [0x010668e8]
xor ebx, ebx
mov rcx, 0xffffffff80000002
mov qword [rax - 0x10], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x38]
cmp rcx, rbx
je 0x107677a
cmp esi, ebx
lea rdx, [0x01067d78]
je 0x1076730
lea r9d, [rbx + 4]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
jne 0x107676f
jmp 0x107676a
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x107676f
mov eax, dword [rsp + 0x68]
cmp eax, ebx
je 0x107676f
mov dword [rdi], eax
mov ebx, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1076828
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
and dword [rsp + 0x40], 0
mov rdi, rcx
lea rcx, [0x01067338]
mov r9d, 0x12
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
cmp rax, 0xffffffffffffffff
jne 0x1076861
xor ebx, ebx
jmp 0x1076882
lea rcx, [0x01067338]
mov r8, rax
mov edx, 1
call fcn.01075b48
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x1076928
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x44]
mov esi, 4
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x40]
mov r9d, esi
mov edx, 0x220794
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10768f7
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x44]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov r9d, esi
mov edx, 0x220794
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
jmp 0x10768fc
mov esi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1076928
cmp dword [rsp + 0x40], 0
jne 0x1076928
mov eax, dword [rdi + 0x124]
sub eax, 1
cdq
sub eax, edx
sar eax, 1
lea eax, [rax + rax + 2]
mov dword [rdi + 0x124], eax
lea r8, [rdi + 0x124]
mov edx, 1
mov rcx, rdi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp fcn.010766c8
Function at 0x1076a34
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor esi, esi
mov r12d, edx
mov rdi, rcx
and qword [rax - 0x30], rsi
and dword [rax - 0x34], esi
and dword [rax + 0x18], esi
lea rdx, [0x01067c10]
lea r8, [rax - 0x30]
or r15d, 0xffffffff
mov rcx, 0xffffffff80000002
mov dword [rax - 0x38], 4
mov dword [rax + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1076ace
lea rax, [rsp + 0x30]
lea rdx, [0x01067c38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1076ac3
mov eax, 0x80070006
jmp 0x1076c7a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.01076fc0
mov r14d, 0xa
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rdi + 0xc8]
test rax, rax
je 0x1076b0b
lea rcx, [0x01067da0]
xor r8d, r8d
xor edx, edx
call rax
mov ecx, r14d
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9, qword [rdi + 0xd8]
test r9, r9
je 0x1076b5e
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov rcx, rsi
call r9
mov ecx, r14d
mov bl, al
call qword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x1076b5e
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x1076b5e
lea r8, [rdi + 0x124]
mov edx, 1
mov rcx, rdi
mov dword [r8], eax
call fcn.010766c8
test r12d, r12d
mov rcx, rdi
je 0x1076b77
call fcn.01076828
mov r8d, dword [rdi + 0x124]
mov rcx, rdi
jmp 0x1076b7a
xor r8d, r8d
mov r9d, r15d
mov rdx, rsi
call fcn.01076794
mov ecx, r14d
mov bpl, al
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rdi + 0xf8]
test rax, rax
je 0x1076ba2
mov rcx, rsi
call rax
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rdi + 0xc8]
xor ebx, ebx
test rax, rax
je 0x1076bd3
lea rcx, [0x01067db0]
xor r8d, r8d
xor edx, edx
call rax
mov ecx, r14d
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rdi + 0xd8]
test rax, rax
je 0x1076bf7
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call rax
mov bpl, al
test bpl, bpl
je 0x1076c1e
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x1076c1e
lea r8, [rdi + 0x124]
mov edx, 1
mov rcx, rdi
mov dword [r8], eax
call fcn.010766c8
test r12d, r12d
mov rcx, rdi
je 0x1076c37
call fcn.01076828
mov r8d, dword [rdi + 0x124]
mov rcx, rdi
jmp 0x1076c3a
xor r8d, r8d
mov r9d, r15d
mov rdx, rbx
call fcn.01076794
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [rdi + 0xf8]
test r11, r11
je 0x1076c60
mov rcx, rbx
call r11
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi + 0x58]
test rcx, rcx
je 0x1076c78
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1076c98
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, qword [0x010aaf10]
mov esi, edx
xor edi, edi
and qword [rax - 0x18], rdi
and dword [rax + 0x20], edi
lea rdx, [0x01067c10]
lea r8, [rax - 0x18]
mov rcx, 0xffffffff80000002
mov dword [rax + 0x18], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1076d23
lea rax, [rsp + 0x60]
lea rdx, [0x01067c38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1076d18
mov eax, 0x80070006
jmp 0x1076ddc
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.01076fc0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [rbx + 0xc8]
test r11, r11
je 0x1076d5f
lea rcx, [0x01067c60]
xor r8d, r8d
xor edx, edx
call r11
mov ecx, 0xa
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x1076d7a
lea r8, [rbx + 0x124]
mov edx, 1
mov rcx, rbx
mov dword [r8], esi
call fcn.010766c8
cmp dword [rbx + 0x50], 0
mov rcx, rbx
je 0x1076d94
call fcn.01076828
mov r8d, dword [rbx + 0x124]
mov rcx, rbx
jmp 0x1076d97
xor r8d, r8d
or r9d, 0xffffffff
mov rdx, rdi
call fcn.01076794
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [rbx + 0xf8]
test r11, r11
je 0x1076dc0
mov rcx, rdi
call r11
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x1076dda
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1076df4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, qword [0x010aaf10]
mov esi, edx
xor edi, edi
and qword [rax - 0x18], rdi
and dword [rax + 0x20], edi
lea rdx, [0x01067c10]
lea r8, [rax - 0x18]
mov rcx, 0xffffffff80000002
mov dword [rax + 0x18], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1076e7f
lea rax, [rsp + 0x60]
lea rdx, [0x01067c38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1076e74
mov eax, 0x80070006
jmp 0x1076faa
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.01076fc0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx + 0xc8]
test rax, rax
je 0x1076eba
lea rcx, [0x01067da0]
xor r8d, r8d
xor edx, edx
call rax
mov ecx, 0xa
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x1076ed5
lea r8, [rbx + 0x124]
mov edx, 1
mov rcx, rbx
mov dword [r8], esi
call fcn.010766c8
cmp dword [rbx + 0x50], 0
mov rcx, rbx
je 0x1076eef
call fcn.01076828
mov r8d, dword [rbx + 0x124]
mov rcx, rbx
jmp 0x1076ef2
xor r8d, r8d
or r9d, 0xffffffff
mov rdx, rdi
call fcn.01076794
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx + 0xf8]
test rax, rax
je 0x1076f1a
mov rcx, rdi
call rax
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx + 0xc8]
xor edi, edi
test rax, rax
je 0x1076f44
lea rcx, [0x01067db0]
xor r8d, r8d
xor edx, edx
call rax
mov rdi, rax
test esi, esi
je 0x1076f5f
lea r8, [rbx + 0x124]
mov edx, 1
mov rcx, rbx
mov dword [r8], esi
call fcn.010766c8
cmp dword [rbx + 0x50], 0
mov rcx, rbx
je 0x1076f79
call fcn.01076828
mov r8d, dword [rbx + 0x124]
mov rcx, rbx
jmp 0x1076f7c
xor r8d, r8d
or r9d, 0xffffffff
mov rdx, rdi
call fcn.01076794
mov rax, qword [rbx + 0xf8]
test rax, rax
je 0x1076f99
mov rcx, rdi
call rax
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x1076fa8
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1076fc0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp dword [0x010aaf78], edi
jne 0x1076fe9
cmp dword [0x010aaf7c], edi
jne 0x1076fe9
mov eax, 0x80070006
jmp 0x1077165
mov qword [rcx + 0xc8], rdi
mov qword [rcx + 0xd0], rdi
mov qword [rcx + 0xd8], rdi
mov qword [rcx + 0xe0], rdi
mov qword [rcx + 0xe8], rdi
mov qword [rcx + 0xf0], rdi
mov qword [rcx + 0xf8], rdi
mov qword [rcx + 0x100], rdi
mov qword [rcx + 0x108], rdi
mov qword [rcx + 0x110], rdi
mov qword [rcx + 0x118], rdi
lea rcx, [0x01067dc0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, rdi
mov qword [rbx + 0x58], rax
je 0x1077163
lea rdx, [0x01067df0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01067e08]
mov qword [rbx + 0xc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01067e28]
mov qword [rbx + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x010aaf7c], edi
mov qword [rbx + 0xf8], rax
je 0x1077163
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01067e40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01067e60]
mov qword [rbx + 0xd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01067e80]
mov qword [rbx + 0xe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01067e98]
mov qword [rbx + 0xe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01067df0]
mov qword [rbx + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01067eb0]
mov qword [rbx + 0x100], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01067eb0]
mov qword [rbx + 0x108], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x58]
lea rdx, [0x01067ed0]
mov qword [rbx + 0x110], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x118], rax
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x10777d8
Capabilities:
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test edx, edx
mov rbx, rcx
mov edi, 0x80004005
je 0x107782e
cmp dword [rcx + 0x120], 0
jne 0x1077856
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
lea rdx, [0x01077460]
lea ecx, [r9 + 0xd]
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
test rax, rax
mov qword [0x010aaf28], rax
je 0x1077856
mov dword [rbx + 0x120], 1
jmp 0x1077854
mov rcx, qword [0x010aaf28]
test rcx, rcx
je 0x1077856
cmp dword [rbx + 0x120], 0
je 0x1077856
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
je 0x1077856
and dword [rbx + 0x120], 0
xor edi, edi
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1077d28
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rsi, qword [0x010aaf10]
xor ebx, ebx
cmp dword [0x010aafac], ebx
jne 0x1077d48
xor eax, eax
jmp 0x1077e57
mov rcx, rsi
mov dword [rsp + 0xa0], ebx
mov dword [rsp + 0x48], ebx
call fcn.01077288
cmp rax, rbx
mov rdi, rax
je 0x1077e55
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x2206b8
mov rcx, rdi
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, ebx
je 0x1077dad
cmp dword [rsp + 0x48], ebx
je 0x1077e46
lea r8, [rsp + 0x40]
lea rdx, [0x010668e8]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0xa8], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x40]
cmp rcx, rbx
je 0x1077e46
lea rax, [rsp + 0xa8]
lea rdx, [0x01067ee8]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x1077e3b
cvtsi2ss xmm1, dword [rsp + 0x98]
mov rcx, rsi
mulss xmm1, dword [0x01068708]
call fcn.01077ae4
mov ecx, 1
cmp eax, ebx
cmove ebx, ecx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp rdi, 0xffffffffffffffff
je 0x1077e55
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1078078
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rsi, qword [0x010aaf10]
xor edi, edi
movaps xmmword [rsp + 0x70], xmm6
cmp dword [0x010aafb0], edi
jne 0x10780a4
xor eax, eax
jmp 0x1078210
mov rcx, qword [rsi + 0x18]
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2206b8
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, edi
je 0x107820e
cmp dword [rsp + 0x50], edi
lea r8, [rsp + 0x48]
lea rdx, [0x010668e8]
mov rcx, 0xffffffff80000002
mov ebx, edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0xb0], edi
mov dword [rsp + 0xb8], edi
mov dword [rsp + 0xa8], 4
setne bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x48]
cmp rcx, rdi
je 0x107820e
lea rax, [rsp + 0xa8]
xor r9d, r9d
xor r8d, r8d
cmp ebx, edi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
je 0x1078172
lea rdx, [0x01067f00]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, [0x01067f28]
jmp 0x1078186
lea rdx, [0x01067f50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, [0x01067f78]
mov rcx, qword [rsp + 0x48]
lea r11, [rsp + 0xa8]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], r11
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
jne 0x107820e
movss xmm0, dword [0x01068708]
cvtsi2ss xmm2, dword [rsp + 0xb0]
cvtsi2ss xmm6, dword [rsp + 0xb8]
xor edx, edx
mov rcx, rsi
mulss xmm2, xmm0
mulss xmm6, xmm0
call fcn.01077e68
mov ebp, 1
mov ebx, edi
cmp eax, edi
movaps xmm2, xmm6
mov rcx, rsi
mov edx, ebp
cmove ebx, ebp
call fcn.01077e68
cmp eax, edi
cmove ebx, ebp
mov edi, ebx
mov eax, edi
mov rbx, qword [rsp + 0xa0]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret