joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a650
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r12, rdx
mov r13, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov dword [rsp + 0x60], ecx
mov qword [rsp + 0x68], rcx
lea rsi, [r13 + 0x10]
mov r15, qword [rsi + 0x10]
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r15
cmp rax, 8
jb 0x14001a8e3
cmp qword [rsi + 0x18], 8
jb 0x14001a6c0
mov rsi, qword [rsi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rcx
lea rbp, [r15 + 8]
mov ebx, 7
lea r14, [rsp + 0x30]
lea rdi, [rbx - 8]
cmp rbp, rbx
jbe 0x14001a734
mov rbx, rbp
or rbx, 7
cmp rbx, rdx
jbe 0x14001a6f7
mov rbx, rdx
jmp 0x14001a703
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, rdi
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14001a8e9
lfence
add rcx, rcx
call fcn.140012d70
mov r14, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, rsi
mov rcx, r14
call fcn.1401a9040
movups xmm0, xmmword [0x14020a5d0]
movups xmmword [rbx + r14], xmm0
xor eax, eax
mov word [r14 + rbp*2], ax
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
mov r9d, 0x20206
mov rdx, qword [r13 + 8]
lea rcx, [rsp + 0x58]
call fcn.140018800
test eax, eax
setne sil
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14001a7d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a7cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a8dd
call fcn.1401853a0
mov rbx, qword [rsp + 0x58]
test sil, sil
jne 0x14001a8a7
movabs rax, 0x346dc5d63886594b
imul qword [r12 + 8]
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x70], rdx
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
lea rdx, str.EventStateLastTime
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [r12]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EventStateLastError
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, [r12 + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14001a86d
mov rdx, qword [rdx]
test rdx, rdx
je 0x14001a8a7
lea rdi, [rdi + 1]
cmp word [rdx + rdi*2], 0
jne 0x14001a872
lea eax, [rdi*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, str.EventStateLastDeviceId
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
test rbx, rbx
je 0x14001a8b5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140185380
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1401b3c00
nop
call fcn.140008810
int3
call fcn.140008770
int3
Function at 0x14001ada0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
lea r8, [rcx + 0x10]
cmp qword [r8 + 0x18], 8
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rax
jb 0x14001add2
mov r8, qword [r8]
mov rdx, qword [rcx + 8]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 0x20206
mov dword [rsp + 0x20], eax
call fcn.140018690
test eax, eax
jne 0x14001ae2a
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
lea rdx, str.IsInstalling
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x40], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp qword [rsp + 0x48], 0
je 0x14001ae3d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140185380
add rsp, 0x78
ret

Function at 0x14001ae50
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor eax, eax
lea r8, [rcx + 0x10]
cmp qword [r8 + 0x18], 8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
jb 0x14001ae82
mov r8, qword [r8]
mov rdx, qword [rcx + 8]
mov r9d, 0x20206
lea rcx, [rsp + 0x20]
call fcn.140018800
test eax, eax
jne 0x14001aeac
mov rcx, qword [rsp + 0x20]
lea rdx, str.IsInstalling
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp qword [rsp + 0x20], 0
je 0x14001aebf
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140185380
add rsp, 0x48
ret

Function at 0x14001aee0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
lea r8, [rcx + 0x10]
cmp qword [r8 + 0x18], 8
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
jb 0x14001af14
mov r8, qword [r8]
mov rdx, qword [rcx + 8]
mov r9d, 0x20219
lea rcx, [rsp + 0x40]
call fcn.140018800
test eax, eax
jne 0x14001af78
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.IsInstalling
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001af78
cmp dword [rsp + 0x38], 4
jne 0x14001af78
cmp dword [rsp + 0x30], ebx
seta bl
cmp qword [rsp + 0x40], 0
je 0x14001af8b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140185380
add rsp, 0x60
pop rbx
ret
Function at 0x14001b510
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rcx
xor ecx, ecx
call fcn.1401b3c78
mov rdi, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rax
lea r8, [rbx + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x14001b568
mov r8, qword [r8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 0x20206
mov dword [rsp + 0x20], eax
mov rdx, qword [rbx + 8]
lea rcx, [rsp + 0x48]
call fcn.140018690
mov dword [rsp + 0x40], eax
mov rbx, qword [rsp + 0x48]
test eax, eax
je 0x14001b5f9
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x60]
call fcn.1401a8d80
call fcn.140138af0
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 3
lea rcx, [rsp + 0x70]
call fcn.14000f010
nop
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400d90b6.0]
cmp dword [rsp + 0x68], eax
setl byte [rbp + 0x68]
jl 0x14001b6a9
lea rdx, str.UpdateLastSyncTime:_Failed_to_open_key__SoftwareSophosAutoUpdateUpdateStatus_:
lea rcx, [rsp + 0x60]
call fcn.140012480
jmp 0x14001b690
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.LastSyncedTime
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x40], eax
test eax, eax
je 0x14001b6b4
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x60]
call fcn.1401a8d80
call fcn.140138af0
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 3
lea rcx, [rsp + 0x70]
call fcn.14000f010
nop
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400d90b6.0]
cmp dword [rsp + 0x68], eax
setl byte [rbp + 0x68]
jl 0x14001b6a9
lea rdx, str.UpdateLastSyncTime:_Failed_to_write_LastSyncedTime:
lea rcx, [rsp + 0x60]
call fcn.1400215c0
mov rcx, rax
call fcn.140021490
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1400214d0
mov byte [rbp + 0x68], 1
lea rcx, [rsp + 0x60]
call fcn.14000afe0
nop
test rbx, rbx
je 0x14001b6c2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140185380
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001b6f0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rcx
xor ecx, ecx
call fcn.1401b3c78
mov rdi, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rax
lea r8, [rbx + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x14001b748
mov r8, qword [r8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 0x20206
mov dword [rsp + 0x20], eax
mov rdx, qword [rbx + 8]
lea rcx, [rsp + 0x48]
call fcn.140018690
mov dword [rsp + 0x40], eax
mov rbx, qword [rsp + 0x48]
test eax, eax
je 0x14001b7d2
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x60]
call fcn.1401a8d80
call fcn.140138af0
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 3
lea rcx, [rsp + 0x70]
call fcn.14000f010
nop
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400d90b6.0]
cmp dword [rsp + 0x68], eax
setl byte [rbp + 0x68]
jl 0x14001b877
lea rcx, [rsp + 0x60]
call fcn.140021620
jmp 0x14001b85e
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.LastInstallStartedTime
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x40], eax
test eax, eax
je 0x14001b882
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x60]
call fcn.1401a8d80
call fcn.140138af0
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 3
lea rcx, [rsp + 0x70]
call fcn.14000f010
nop
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400d90b6.0]
cmp dword [rsp + 0x68], eax
setl byte [rbp + 0x68]
jl 0x14001b877
lea rcx, [rsp + 0x60]
call fcn.140021690
mov rcx, rax
call fcn.140021490
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1400214d0
mov byte [rbp + 0x68], 1
lea rcx, [rsp + 0x60]
call fcn.14000afe0
nop
test rbx, rbx
je 0x14001b890
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140185380
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001d880
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rdx
mov qword [rsp + 0x38], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x50], rsi
lea r8, [rcx + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x14001d8d2
mov r8, qword [r8]
mov r9d, 0x20219
mov rdx, qword [rcx + 8]
lea rcx, [rsp + 0x40]
call fcn.140018800
mov rdi, qword [rsp + 0x40]
test eax, eax
jne 0x14001d97b
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.CrtResult
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d97b
cmp dword [rsp + 0x38], 4
jne 0x14001d97b
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0x60]
call fcn.1401a8d80
lea rcx, [rsp + 0x60]
call fcn.14001e8d0
nop
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.14001eaf0
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140020010
nop
lea rcx, [rsp + 0x60]
call fcn.14001d9e0
jmp 0x14001d9a0
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
xor r8d, r8d
lea rdx, [0x14020a460]
mov rcx, rbx
call fcn.14000b550
nop
test rdi, rdi
je 0x14001d9ae
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140185380
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140026520
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x140026542
xor eax, eax
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x1400265ce
lfence
mov rdi, rbp
nop dword [rax]
mov rcx, rbx
call fcn.140010b00
test rax, rax
jle 0x14002659e
cmp rdi, rax
mov rsi, rdi
mov rcx, r14
cmovge rsi, rax
mov rax, qword [rbx + 0x38]
mov r8, rsi
mov rdx, qword [rax]
call fcn.1401a9040
mov rax, qword [rbx + 0x50]
sub rdi, rsi
sub dword [rax], esi
mov rcx, qword [rbx + 0x38]
movsxd rax, esi
add qword [rcx], rax
jmp 0x1400265be
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1400d90b6.0]
cmp eax, 0xffffffff
je 0x1400265c6
mov byte [r14], al
dec rdi
mov esi, 1
add r14, rsi
test rdi, rdi
jg 0x140026560
sub rbp, rdi
jmp 0x1400266b8
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400265e5
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400265e7
xor ecx, ecx
movsxd rax, ecx
mov rdi, rbp
test ecx, ecx
je 0x14002661c
cmp rax, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.1401a9040
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
mov rdi, rsi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400266b2
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140026657
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x140026690
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.1401b538c
sub rsi, rax
add r14, rax
mov rdi, rsi
cmp rax, 0xfff
jne 0x1400266b2
cmp rsi, rax
ja 0x140026660
test rdi, rdi
je 0x1400266b2
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1401b538c
mov rsi, rdi
sub rsi, rax
sub rbp, rsi
lfence
mov rsi, qword [rsp + 0x28]
mov rax, rbp
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
Function at 0x1400603e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1d0
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rsi, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x80], r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
mov rax, qword [rdx]
mov r15, qword [rax + 0x10]
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r12w
lea r8d, [r12 + 0x1b]
lea rdx, str.SophosAutoUpdateRepairKit
lea rcx, [rsp + 0x30]
call fcn.14000b550
nop
mov r9d, 0x20219
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x90]
mov rcx, rdi
mov rax, r15
call qword [case.0x1400d90b6.0]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400604c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400604c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400605b8
call fcn.1401853a0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r12w
mov dword [rsp + 0x88], 8
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400605be
imul rcx, qword [rsp + 0xa0], 0x989680
cmp rcx, qword [r14]
jge 0x14006055f
mov qword [rbx], rcx
mov byte [rbx + 8], 1
lea rcx, vtable.RegistryHandle.0
mov qword [rsp + 0x90], rcx
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14006055a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
jmp 0x140060590
lea rcx, vtable.RegistryHandle.0
mov qword [rsp + 0x90], rcx
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140060582
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140060589
mov byte [rbx + 8], 0
mov rax, rbx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140185380
mov rbx, qword [rsp + 0x210]
add rsp, 0x1d0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1401b3c00
int3
lea rdx, str.Failed_to_get_registry_value
lea rcx, [rsp + 0x60]
call fcn.140010040
nop
lea rdx, [rsp + 0x60]
mov ecx, edi
call fcn.140030620
int3
Function at 0x1400605e0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x1c0
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rdi, rcx
mov qword [rsp + 0x58], rdx
mov rcx, qword [rdx]
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
lea rbx, [rcx + rdx]
sar rbx, 0x17
mov rax, rbx
shr rax, 0x3f
add rbx, rax
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov rax, qword [rdi]
mov rsi, qword [rax + 8]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
lea r8d, [r14 + 0x1b]
lea rdx, str.SophosAutoUpdateRepairKit
lea rcx, [rsp + 0x30]
call fcn.14000b550
nop
mov dword [rsp + 0x20], r14d
mov r9d, 0xf023f
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x80]
mov rcx, rdi
mov rax, rsi
call qword [case.0x1400d90b6.0]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400606dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400606d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060778
call fcn.1401853a0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
mov qword [rsp + 0x90], rbx
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
lea rdx, str.LastSduUploadTime
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x14006077e
lea rax, vtable.RegistryHandle.0
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140060754
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140185380
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1c0
pop r14
pop rdi
pop rsi
ret
call fcn.1401b3c00
nop
lea rdx, str.Failed_to_set_registry_value_of_type_QWORD
lea rcx, [rsp + 0x60]
call fcn.140010040
nop
lea rdx, [rsp + 0x60]
mov ecx, ebx
call fcn.140030620
int3
Function at 0x140060e40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140060ee4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140060ea0
mov ecx, dword [r10]
jmp 0x140060fc7
cmp ecx, 0x4e0
jb 0x140060fc7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140060f00
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140060f50
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x140060e80
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x140060e70
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x140061050
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x140061266
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140061114
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400610d0
mov ecx, dword [r10]
jmp 0x1400611f7
cmp ecx, 0x4e0
jb 0x1400611f7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140061130
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140061180
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x1400610b0
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x1400610a0
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x14006128a
cmp r8, r14
jne 0x140061080
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret