joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a4440
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [0x1403ff444]
mov edi, r8d
movsxd rsi, edx
mov rbx, rcx
test eax, eax
jne 0x1400a447f
lea rcx, [0x1403ff440]
mov dword [0x1403ff440], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x1403ff444]
cmp eax, 6
jne 0x1400a44a3
cmp dword [0x1403ff448], 0
jne 0x1400a44a3
cmp dword [rbx + 0x2c], 0
je 0x1400a44c7
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400a44c7
cmp edi, 1
jne 0x1400a44c7
jmp 0x1400a44b2
cmp dword [rbx + 0x2c], 0
je 0x1400a44c7
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400a44c7
mov rcx, qword [rcx + 0x40]
xor r9d, r9d
mov r8, rsi
mov edx, 0x8011
call qword [sym.imp.USER32.dll_PostMessageW]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a9180
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x1400a91c4
lea r8, str.MouseEventCtrl.cpp
mov edx, 0x8b
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140055180
mov rcx, qword [rcx + 0x28]
test rcx, rcx
jne 0x1400a91f4
lea r8, str.MouseEventCtrl.cpp
mov edx, 0x8c
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140055180
cmp dword [rbx + 0x30], 0
je 0x1400a924d
test rdi, rdi
je 0x1400a921e
mov rcx, qword [rbx + 8]
call fcn.1400fe1b8
mov rcx, qword [rbx + 0x28]
xor r9d, r9d
mov r8, rax
mov rdx, rdi
call fcn.140113db0
mov rcx, qword [rbx + 0x28]
movzx eax, word [rbx + 0x38]
xor r8d, r8d
add ax, word [rsi + 4]
mov rcx, qword [rcx + 0x40]
movzx r9d, ax
movzx eax, word [rbx + 0x34]
add ax, word [rsi]
movzx edx, ax
shl r9, 0x10
or r9, rdx
mov edx, 0x412
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a96a0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
sub rsp, 0x60
mov qword [rax - 0x18], 0xfffffffffffffffe
xor ebx, ebx
mov rcx, qword [0x1403ff640]
test rcx, rcx
jne 0x1400a9748
mov qword [rax - 0x28], rbx
mov dword [rax - 0x30], ebx
mov qword [rax - 0x38], rbx
mov dword [rax - 0x40], 3
mov dword [rax - 0x48], 1
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea rax, [0x1403ff640]
mov qword [rsp + 0x20], rax
lea r9, [0x140355ff0]
xor edx, edx
lea r8d, [rbx + 1]
lea rcx, [0x140355fe0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400a9738
mov r9d, eax
lea r8, str.NahimicSetting.cpp
mov edx, 0x91
lea rcx, str._VCpl__RETURN_ON_ERROR:_Line___d__File___s__hr__0x_X_n
add rsp, 0x60
pop rbx
jmp fcn.140055180
mov rcx, qword [0x1403ff640]
test rcx, rcx
je 0x1400a98df
xorps xmm0, xmm0
movss dword [rsp + 0x70], xmm0
mov qword [rsp + 0x78], rbx
mov rax, qword [rcx]
lea rdx, [rsp + 0x78]
call qword [rax + 0x80]
test eax, eax
jns 0x1400a9788
mov r9d, eax
lea r8, str.NahimicSetting.cpp
mov edx, 0x9a
lea rcx, str._VCpl__RETURN_ON_ERROR:_Line___d__File___s__hr__0x_X_n
call fcn.140055180
jmp 0x1400a9891
mov qword [rsp + 0x88], rbx
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea r8, [rsp + 0x88]
mov edx, 0x65
call qword [rax + 0x48]
test eax, eax
jns 0x1400a97b3
mov edx, LoadRegTypeLib
jmp 0x1400a97e0
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
lea r9, [0x1403ff630]
lea r8, [0x1403ff634]
lea rdx, [rsp + 0x70]
call qword [rax + 0x80]
test eax, eax
jns 0x1400a97fb
mov edx, 0xa4
mov r9d, eax
lea r8, str.NahimicSetting.cpp
lea rcx, str._VCpl__RETURN_ON_ERROR:_Line___d__File___s__hr__0x_X_n
call fcn.140055180
jmp 0x1400a987d
mov qword [rsp + 0x80], rbx
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea r8, [rsp + 0x80]
mov edx, 0x6a
call qword [rax + 0x48]
test eax, eax
jns 0x1400a9826
mov edx, 0xa9
jmp 0x1400a9853
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
lea r9, [0x1403ff628]
lea r8, [0x1403ff62c]
lea rdx, [rsp + 0x70]
call qword [rax + 0x80]
test eax, eax
jns 0x1400a98a7
mov edx, 0xae
mov r9d, eax
lea r8, str.NahimicSetting.cpp
lea rcx, str._VCpl__RETURN_ON_ERROR:_Line___d__File___s__hr__0x_X_n
call fcn.140055180
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400a987d
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1400a9891
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400a98e5
mov rax, qword [rcx]
call qword [rax + 0x10]
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400a98bb
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1400a98cf
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400a98df
mov rax, qword [rcx]
call qword [rax + 0x10]
inc dword [0x1403ff638]
add rsp, 0x60
pop rbx
ret
Function at 0x1400b4340
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x60
mov rax, qword [rcx]
mov r14d, r9d
mov ebp, edx
mov rbx, rcx
call qword [rax + 0x98]
test eax, eax
jns 0x1400b438f
lea r8, str.PngCtrlV2.cpp
mov edx, 0x24b
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
jmp fcn.140055180
mov qword [rsp + 0x70], rsi
movsxd rsi, eax
mov qword [rsp + 0x78], rdi
cmp rsi, qword [rbx + 0x90]
jge 0x1400b43ba
test eax, eax
js 0x1400b44cc
mov rax, qword [rbx + 0x88]
mov rdi, qword [rax + rsi*8]
jmp 0x1400b43bc
xor edi, edi
test rdi, rdi
jne 0x1400b4402
mov rax, qword [rbx]
mov r8d, r14d
mov edx, ebp
mov rcx, rbx
call qword [rax + 0x98]
test eax, eax
js 0x1400b43f7
movsxd rdi, eax
cmp rdi, qword [rbx + 0x90]
jge 0x1400b43f7
test eax, eax
js 0x1400b44d2
mov rax, qword [rbx + 0x88]
mov rdi, qword [rax + rdi*8]
jmp 0x1400b43f9
xor edi, edi
test rdi, rdi
je 0x1400b44af
cmp rsi, qword [rbx + 0x130]
jge 0x1400b4420
test rsi, rsi
js 0x1400b44d8
mov rax, qword [rbx + 0x128]
mov edx, dword [rax + rsi*4]
jmp 0x1400b4422
xor edx, edx
test byte [rbx + 0x50], 0x20
je 0x1400b4441
mov ecx, dword [rbx + 0x4c]
mov eax, 0x80808081
imul ecx, edx
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov rax, qword [rsp + 0x90]
mov ebx, dword [rdi + 0x18]
mov esi, dword [rdi + 0x1c]
test rax, rax
jne 0x1400b4458
xor ecx, ecx
jmp 0x1400b445c
mov rcx, qword [rax + 8]
mov rax, qword [rsp + 0x98]
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], dl
mov rdx, rcx
mov dword [rsp + 0x48], esi
mov rcx, rdi
mov r11d, dword [rax + 0xc]
mov r9d, dword [rax + 4]
sub r11d, r9d
mov r10d, dword [rax + 8]
mov r8d, dword [rax]
sub r10d, r8d
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], r10d
call fcn.1400481d0
mov rsi, qword [rsp + 0x70]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rdi, qword [rsp + 0x78]
mov rsp, r11
pop r14
ret
call fcn.1400f91a0
int3
call fcn.1400f91a0
int3
call fcn.1400f91a0
int3
Function at 0x1400b4b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r14
sub rsp, 0x20
xor ebx, ebx
lea r8, [0x140351610]
mov qword [rsp + 0x50], rbx
mov rbp, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r14, rax
test rax, rax
jne 0x1400b4b72
mov edx, 0x31a
jmp 0x1400b4c5e
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
jne 0x1400b4b8e
mov edx, 0x31d
jmp 0x1400b4c5e
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
jne 0x1400b4bb5
mov edx, 0x321
jmp 0x1400b4c5e
mov rdx, rsi
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
jne 0x1400b4bd5
mov edx, 0x325
jmp 0x1400b4c5e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400b4cb9
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.14029f520
lea r8, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jns 0x1400b4c3b
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea r8, str.PngCtrlV2.cpp
mov edx, 0x32f
mov r9d, eax
lea rcx, str._VCpl__EXIT_ON_ERROR:_Line___d__File___s__hr__0x_X_n
call fcn.140055180
jmp 0x1400b4c71
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x1400b4c4c
mov edx, 0x331
jmp 0x1400b4c5e
call fcn.1400828a0
mov rdi, rax
test rax, rax
jne 0x1400b4ca5
mov edx, 0x334
lea r8, str.PngCtrlV2.cpp
lea rcx, str._VCpl__EXIT_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b4c8a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x50], 0
test rbx, rbx
je 0x1400b4ca1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x1400b4ce3
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rdi
call fcn.1400b4890
mov rbx, rax
test rdi, rdi
je 0x1400b4ce0
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400b5220
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rsi, edx
mov rdi, r8
mov rbx, rcx
test edx, edx
jne 0x1400b5253
mov rax, qword [rcx + 0x88]
test rax, rax
jne 0x1400b52c5
mov rax, qword [rcx + 0x70]
test rax, rax
je 0x1400b5258
jmp 0x1400b52c5
cmp esi, 3
jne 0x1400b52c5
mov rcx, qword [rcx - 0x1f0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov edx, 0xd4
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbp, rax
test rdi, rdi
jne 0x1400b5282
xor r8d, r8d
jmp 0x1400b5286
mov r8, qword [rdi + 8]
mov rcx, qword [rbx - 0x1f0]
xor r9d, r9d
lea edx, [r9 + 0x30]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx - 0x1f0]
mov edx, 0xd3
movzx eax, bp
mov r8d, 3
shl eax, 0x10
shr ebp, 0x10
or eax, ebp
movsxd r9, eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbp, qword [rsp + 0x30]
test rdi, rdi
jne 0x1400b52ef
lea r8, str.TextCtrl.cpp
lea edx, [rdi + 0x4d]
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140055180
mov qword [rbx + rsi*8 + 0x70], rdi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b70f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
movsxd rbp, edx
mov esi, r8d
mov rbx, rcx
test edx, edx
jns 0x1400b7133
lea r8, str.PngListBox.cpp
mov edx, 0x1f9
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
jmp fcn.140055180
mov rcx, qword [rcx + 0x40]
xor r9d, r9d
mov r8, rbp
mov qword [rsp + 0x38], r14
mov edx, 0x199
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1400b7156
mov dword [rax], esi
jmp 0x1400b71a1
mov ecx, 0x10
mov qword [rsp + 0x30], rdi
call fcn.1400f8110
mov rdi, rax
test rax, rax
je 0x1400b719c
xor eax, eax
mov r9, rdi
mov qword [rdi], rax
mov r8, rbp
mov qword [rdi + 8], rax
mov edx, 0x19a
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbx + 0x360]
mov dword [rdi], esi
mov rdx, rdi
call fcn.140133d78
mov rdi, qword [rsp + 0x30]
test esi, esi
je 0x1400b71c0
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
mov r8, rbp
mov dword [rbx + 0x350], ebp
mov edx, 0x186
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400bcb70
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x90], 0
mov rbx, rcx
jne 0x1400bcba0
lea r8, str.PowerMgrSetting.cpp
mov edx, 0x73
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
add rsp, 0x20
pop rbx
jmp fcn.140055180
mov r9d, dword [rcx + 0xb0]
lea r8, str.Enabled
lea rcx, [0x140400ce0]
lea rdx, str.PowerMgnt
call fcn.140107c34
mov r9d, dword [rbx + 0xac]
lea r8, str.DelayTime
lea rdx, str.PowerMgnt
lea rcx, [0x140400ce0]
call fcn.140107c34
mov r9d, dword [rbx + 0xa8]
lea r8, str.OnlyBattery
lea rdx, str.PowerMgnt
lea rcx, [0x140400ce0]
call fcn.140107c34
mov rax, qword [rbx + 0x90]
test dword [rax + 0xcc], 0x200000
je 0x1400bcc37
mov r9d, dword [rbx + 0xb4]
lea r8, str.PowerState
lea rdx, str.PowerMgnt
lea rcx, [0x140400ce0]
call fcn.140107c34
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400bcc50
Function at 0x1400c0780
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rdi, r8
mov rsi, rcx
test rcx, rcx
jne 0x1400c07cc
lea r8, str.RegClient.cpp
lea edx, [rcx + 0x5f]
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
test rdi, rdi
jne 0x1400c07f9
lea r8, str.RegClient.cpp
lea edx, [rdi + 0x60]
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
xor ebp, ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
lea rcx, [rsp + 0x38]
call fcn.1400c12f0
nop
mov dword [rsp + 0x80], ebp
mov ebx, 1
mov r9d, ebx
mov r8, rsi
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.140015610
test eax, eax
je 0x1400c0896
lea r8, str.RegClient.cpp
lea edx, [rbp + 0x6d]
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
mov ebx, ebp
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400c0874
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400c0884
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x98], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c0851
cmp dword [rsp + 0x30], 4
jne 0x1400c0851
mov eax, dword [rsp + 0x80]
mov dword [rdi], eax
jmp 0x1400c0853
Function at 0x1400c0900
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rsi, r9
mov rdi, r8
test rdx, rdx
jne 0x1400c0942
lea r8, str.RegClient.cpp
mov edx, 0x7c
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x1400c0a63
test rsi, rsi
jne 0x1400c0962
lea r8, str.RegClient.cpp
lea edx, [rsi + 0x7d]
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x1400c0a63
xor eax, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x80], eax
mov r9d, dword [rsp + 0xa0]
or r9d, 1
mov r8, rdx
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.140015610
test eax, eax
je 0x1400c09c9
lea r8, str.RegClient.cpp
mov edx, 0x85
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400c0a63
jmp 0x1400c0a5c
mov dword [rsp + 0x88], 4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rdi]
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c0a54
cmp dword [rsp + 0x30], 4
jne 0x1400c0a54
mov eax, dword [rsp + 0x80]
mov dword [rsi], eax
test rbx, rbx
je 0x1400c0a2a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400c0a47
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
test rbx, rbx
je 0x1400c0a63
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400c0a80
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400c0a90
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov ebp, r9d
mov rbx, r8
mov rdi, rdx
test rdx, rdx
jne 0x1400c0b02
mov edx, 0x93
lea r8, str.RegClient.cpp
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
nop
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400c0af3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [r8]
movzx eax, word [rax]
cmp ax, word [0x140345b70]
jne 0x1400c0b18
mov edx, 0x94
jmp 0x1400c0ac2
xor eax, eax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rax
mov esi, dword [rsp + 0x90]
mov r8d, esi
call fcn.1400c1a70
test eax, eax
jne 0x1400c0b68
mov r8d, esi
mov rdx, rdi
call fcn.1400c1470
test eax, eax
jne 0x1400c0b68
lea r8, str.RegClient.cpp
mov edx, LoadRegTypeLib
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
nop
jmp 0x1400c0ad6
or esi, 2
mov r9d, esi
mov r8, rdi
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x38]
call fcn.140015610
test eax, eax
je 0x1400c0bb8
lea r8, str.RegClient.cpp
mov edx, 0xa2
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400c0ad6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400c0ad6
mov dword [rsp + 0x70], ebp
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rbx]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400c0c1c
lea r8, str.RegClient.cpp
mov edx, 0xa6
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
nop
test rdi, rdi
je 0x1400c0ad6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400c0ad6
test rdi, rdi
je 0x1400c0c2b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400c0c48
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c0c60
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov esi, r8d
mov rdi, rcx
test rcx, rcx
jne 0x1400c0cae
lea r8, str.RegClient.cpp
mov edx, VariantTimeToSystemTime
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x78]
call fcn.1400c12f0
nop
lea r9d, [rbx + 2]
mov r8, rdi
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x38]
call fcn.140015610
test eax, eax
je 0x1400c0cec
mov edx, 0xbc
jmp 0x1400c0d24
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400c0d39
mov edx, 0xc0
lea r8, str.RegClient.cpp
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x1400c0d3e
mov ebx, 1
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400c0d5f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400c0d6f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400c0e20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov esi, r8d
mov rdi, rcx
test rcx, rcx
jne 0x1400c0e6f
lea r8, str.RegClient.cpp
mov edx, 0xcd
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x40]
call fcn.1400c12f0
nop
mov dword [rsp + 0x80], ebx
lea r9d, [rbx + 3]
mov r8, rdi
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140015610
test eax, eax
je 0x1400c0eb7
mov edx, 0xd8
jmp 0x1400c0f41
mov dword [rsp + 0x98], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c0f0b
cmp dword [rsp + 0x30], 4
jne 0x1400c0f0b
cmp dword [rsp + 0x80], esi
je 0x1400c0f56
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400c0f56
mov edx, 0xe0
lea r8, str.RegClient.cpp
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x1400c0f5b
mov ebx, 1
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400c0f7c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400c0f8c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret