joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140050ff0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
mov rdi, rsp
mov ecx, 0x24
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
call fcn.140019950
mov r9d, 0xa16
lea r8, [0x140198b40]
lea rdx, [0x140198b98]
mov rcx, rax
call fcn.14002e330
mov rcx, qword [rsp + 0xa8]
call fcn.140019950
mov r9d, 0xa17
lea r8, [0x140198c00]
lea rdx, [0x140196328]
mov rcx, rax
call fcn.14002e330
mov edx, 1
mov rcx, qword [rsp + 0xb0]
call fcn.1400573b0
mov r9d, 0xa18
lea r8, [0x140198cd0]
lea rdx, [0x140196408]
mov rcx, rax
call fcn.14002e330
mov rcx, qword [rsp + 0xa0]
call fcn.14002e590
test rax, rax
jne 0x1400510cd
mov rcx, qword [rsp + 0xa8]
call fcn.14002e590
test rax, rax
jne 0x1400510cd
mov qword [rsp + 0x78], 1
jmp 0x1400510d6
mov qword [rsp + 0x78], 0
mov r9d, 0xa19
lea r8, [0x140198d30]
lea rdx, [0x140198de0]
mov rcx, qword [rsp + 0x78]
call fcn.14002e330
mov rcx, qword [rsp + 0xb0]
call fcn.140031f50
mov rcx, qword [rsp + 0xa0]
call fcn.1400565d0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140051122
xor eax, eax
jmp 0x140051216
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
xor r8d, r8d
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
jne 0x1400511e2
cmp dword [rsp + 0x44], 3
jne 0x140051174
mov qword [rsp + 0x80], 1
jmp 0x140051180
mov qword [rsp + 0x80], 0
mov r9d, 0xa25
lea r8, [0x140198ec0]
lea rdx, str.dwType__REG_BINARY
mov rcx, qword [rsp + 0x80]
call fcn.14002e330
mov eax, dword [rsp + 0x64]
mov edx, eax
mov rcx, qword [rsp + 0xb0]
call fcn.14005a3c0
lea rcx, [rsp + 0x64]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x74], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x74], 0
jne 0x140051202
mov qword [rsp + 0x88], 1
jmp 0x14005120e
mov qword [rsp + 0x88], 0
mov rax, qword [rsp + 0x88]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.1400a1e60
mov rax, rdi
add rsp, 0x90
pop rdi
ret
Function at 0x140052940
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x1a0
mov rdi, rsp
mov ecx, 0x68
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
lea rcx, [rsp + 0x68]
call fcn.140007bf0
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x178], rax
mov r9, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x40]
lea rdx, str.LastError__u_:__s
mov rcx, qword [rsp + 0x178]
call fcn.140071560
mov r8, rax
lea rdx, [0x140196848]
lea rcx, [rsp + 0xc0]
call fcn.140073680
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x188], rax
lea r8, [0x140196768]
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x118]
call fcn.140073540
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x198], rax
mov rcx, qword [rsp + 0x198]
call fcn.14006d090
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
lea rcx, [rsp + 0x118]
call fcn.140007ce0
nop
lea rcx, [rsp + 0xc0]
call fcn.140007ce0
nop
lea rcx, [rsp + 0x68]
call fcn.140007ce0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsp
lea rdx, [0x14019e7c0]
call fcn.1400a1e60
add rsp, 0x1a0
pop rdi
ret

Function at 0x140053040
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, SafeArrayGetLBound
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
call fcn.140019950
mov r9d, 0xb3f
lea r8, [0x140199ce0]
lea rdx, [0x140198a88]
mov rcx, rax
call fcn.14002e330
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.140046cb0
mov r9d, 0xb40
lea r8, [0x140199d40]
lea rdx, [0x140197ab8]
mov rcx, rax
call fcn.14002e330
mov rcx, qword [rsp + 0x50]
call fcn.14002e590
test rax, rax
jne 0x1400530d3
cmp qword [rsp + 0x60], 0
jge 0x1400530d7
xor eax, eax
jmp 0x140053146
lea rdx, [0x140196c58]
mov rcx, qword [rsp + 0x50]
call fcn.140104680
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400530f9
xor eax, eax
jmp 0x140053146
mov r9, qword [rsp + 0x20]
mov r8, qword [rsp + 0x60]
mov edx, 1
mov rcx, qword [rsp + 0x58]
call fcn.1401069e0
cmp rax, qword [rsp + 0x60]
jne 0x140053124
mov qword [rsp + 0x30], 1
jmp 0x14005312d
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x20]
call fcn.140104940
mov rax, qword [rsp + 0x28]
add rsp, 0x40
pop rdi
ret
Function at 0x140053160
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x130
mov rdi, rsp
mov ecx, 0x4c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x140]
lea rax, [rsp + 0x160]
mov qword [rsp + 0x38], rax
lea rdx, [0x140197bc8]
lea rcx, [rsp + 0x60]
call fcn.140007b90
nop
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x158]
mov r8, qword [rsp + 0x150]
mov edx, dword [rsp + 0x148]
mov rcx, qword [rsp + 0x140]
call fcn.140053460
lea rcx, [rsp + 0x60]
call fcn.14006d120
cmp rax, 0x3fff
jle 0x140053251
mov r8d, 0x3fff
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x60]
call fcn.14006ffe0
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x128], rax
mov rcx, qword [rsp + 0x128]
call fcn.14006d090
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
lea rcx, [rsp + 0xc8]
call fcn.140007ce0
jmp 0x140053264
lea rcx, [rsp + 0x60]
call fcn.14006d090
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x60]
call fcn.140007ce0
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.1400a1e60
add rsp, 0x130
pop rdi
ret
Function at 0x1400561b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x160
mov rdi, rsp
mov ecx, 0x58
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x170]
call fcn.140019950
mov r9d, 0x77c
lea r8, [0x140197550]
lea rdx, str.IsValidString__szKeyName_
mov rcx, rax
call fcn.14002e330
mov rcx, qword [rsp + 0x178]
call fcn.140019950
mov r9d, 0x77d
lea r8, [0x140197650]
lea rdx, str.IsValidString__szKeyValue_
mov rcx, rax
call fcn.14002e330
mov rcx, qword [rsp + 0x170]
call fcn.14002e590
test rax, rax
jne 0x14005625d
mov rcx, qword [rsp + 0x178]
call fcn.14002e590
test rax, rax
jne 0x14005625d
mov qword [rsp + 0x128], 1
jmp 0x140056269
mov qword [rsp + 0x128], 0
mov r9d, 0x77f
lea r8, [0x1401976c0]
lea rdx, str.IsEmptyStr__szKeyName___FALSE__IsEmptyStr__szKeyValue___FALSE
mov rcx, qword [rsp + 0x128]
call fcn.14002e330
mov rcx, qword [rsp + 0x178]
call fcn.1400c34c0
lea rax, [rax + rax + 2]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x170]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140056327
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1401954a4]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x78]
call fcn.140007b90
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x138], rax
mov r8, qword [rsp + 0x170]
mov rdx, qword [rsp + 0x138]
lea rcx, [rsp + 0xd0]
call fcn.140073540
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x148], rax
mov rcx, qword [rsp + 0x148]
call fcn.14006d090
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400563e5
mov dword [rsp + 0x150], 1
jmp 0x1400563f0
mov dword [rsp + 0x150], 0
movzx eax, byte [rsp + 0x150]
mov byte [rsp + 0x74], al
lea rcx, [rsp + 0xd0]
call fcn.140007ce0
nop
lea rcx, [rsp + 0x78]
call fcn.140007ce0
movzx eax, byte [rsp + 0x74]
test eax, eax
je 0x140056458
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1401959f8]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsp
lea rdx, [0x14019f1b8]
call fcn.1400a1e60
add rsp, 0x160
pop rdi
ret
Function at 0x14005cbc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, SafeArrayGetLBound
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
cmp qword [rsp + 0x60], 0xffffffffffffffff
jl 0x14005cbfb
mov qword [rsp + 0x38], 1
jmp 0x14005cc04
mov qword [rsp + 0x38], 0
mov r9d, 0x1fe
lea r8, [0x1401a57c0]
lea rdx, str.npReadDataSize____1
mov rcx, qword [rsp + 0x38]
call fcn.14002e330
mov rcx, qword [rsp + 0x58]
call fcn.140019950
mov r9d, 0x1ff
lea r8, [0x1401a5810]
lea rdx, [0x1401a5860]
mov rcx, rax
call fcn.14002e330
mov rcx, qword [rsp + 0x58]
call fcn.14002e590
test rax, rax
je 0x14005cc63
mov rax, 0xffffffffffffffff
jmp 0x14005cd4d
mov qword [rsp + 0x20], 0xffffffffffffffff
lea rdx, [0x1401a4c84]
mov rcx, qword [rsp + 0x58]
call fcn.140104680
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14005cd3e
cmp qword [rsp + 0x60], 0xffffffffffffffff
jne 0x14005ccc8
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.140105ff0
mov rcx, qword [rsp + 0x28]
call fcn.140109ec0
cdqe
mov qword [rsp + 0x60], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.140105ff0
cmp qword [rsp + 0x60], 0
jle 0x14005cd2b
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call fcn.14005a3c0
mov r9, qword [rsp + 0x28]
mov r8, qword [rsp + 0x60]
mov edx, 1
mov rcx, rax
call fcn.140105540
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x28]
call fcn.140108f50
test eax, eax
jne 0x14005cd29
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.14005a540
mov rcx, qword [rsp + 0x28]
call fcn.140104940
mov rax, qword [rsp + 0x30]
jmp 0x14005cd4d
jmp 0x14005cd34
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x28]
call fcn.140104940
mov rcx, qword [rsp + 0x50]
call fcn.14005a740
mov rax, qword [rsp + 0x20]
add rsp, 0x40
pop rdi
ret

Function at 0x14005e180
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14005e200
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14005e1e4
mov r9d, 0xc8
lea r8, [0x1401a8dc0]
lea rdx, [0x1401a8814]
xor ecx, ecx
call fcn.14002e330
mov ecx, 0xffffffff
call fcn.1400f7990
mov rax, qword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x14005e430
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14005e4b0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14005e49e
mov r9d, 0xd4
lea r8, [0x1401a8e30]
lea rdx, [0x1401a8a94]
xor ecx, ecx
call fcn.14002e330
mov ecx, 0xffffffff
call fcn.1400f7990
mov rax, qword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret

Function at 0x14005f270
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
cmp qword [rsp + 0x40], 0
jle 0x14005f2a1
mov qword [rsp + 0x28], 1
jmp 0x14005f2aa
mov qword [rsp + 0x28], 0
mov r9d, 0x38
lea r8, [0x1401a86b0]
lea rdx, [0x1401a8708]
mov rcx, qword [rsp + 0x28]
call fcn.14002e330
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14005f310
mov r9d, 0x41
lea r8, [0x1401a8720]
lea rdx, [0x1401a8714]
xor ecx, ecx
call fcn.14002e330
mov ecx, 0xffffffff
call fcn.1400f7990
lea rax, [0x140253418]
lock inc qword [rax]
mov rax, qword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x140067e90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.140046cb0
mov r9d, 0x13a
lea r8, [0x1401b2a50]
lea rdx, [0x1401b2a28]
mov rcx, rax
call fcn.14002e330
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
jne 0x140067ef6
xor eax, eax
jmp 0x140067f33
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x10]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call fcn.1401069e0
cmp rax, qword [rsp + 0x50]
jne 0x140067f25
mov qword [rsp + 0x20], 1
jmp 0x140067f2e
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x1400810e0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, SafeArrayGetLBound
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
jne 0x140081148
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x140175028]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x167c
lea rdx, [0x140175280]
mov ecx, 2
call fcn.1400c1790
cmp eax, 1
jne 0x140081148
int3
xor eax, eax
test eax, eax
jne 0x140081103
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x10], 0
je 0x14008117a
mov r8, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x10]
call fcn.140082fb0
jmp 0x1400811fd
movzx eax, byte [0x140253488]
test eax, eax
jne 0x1400811bf
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400811b8
lea rdx, str.RegDeleteKeyExW
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140253480], rax
mov byte [0x140253488], 1
cmp qword [0x140253480], 0
je 0x1400811ea
xor r9d, r9d
mov rax, qword [rsp + 0x50]
mov r8d, dword [rax + 8]
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [0x140253480]
jmp 0x1400811fd
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add rsp, 0x40
pop rdi
ret

Function at 0x140081210
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x140081278
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x140175028]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x16a5
lea rdx, [0x140175280]
mov ecx, 2
call fcn.1400c1790
cmp eax, 1
jne 0x140081278
int3
xor eax, eax
test eax, eax
jne 0x140081233
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add rsp, 0x30
pop rdi
ret
Function at 0x140082fb0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, SafeArrayGetLBound
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x140083097
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14008303b
lea rax, str.hAdvAPI32___0
mov qword [rsp + 0x28], rax
lea rax, [0x140175028]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x29c
lea rdx, str.G:win_androidplugins_vprj_win_sdkcompiler_normalVCToolsMSVC14.27.29110ATLMFCinclude_atltransactionmanager.h
mov ecx, 2
call fcn.1400c1790
cmp eax, 1
jne 0x14008303b
int3
cmp qword [rsp + 0x30], 0
jne 0x14008304a
mov eax, 1
jmp 0x1400830b9
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140083095
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x38]
jmp 0x1400830b9
jmp 0x1400830b4
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0
je 0x1400830b4
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1400830b9
mov eax, 1
add rsp, 0x40
pop rdi
ret
Function at 0x140084d60
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x140084dcd
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x140175028]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1866
lea rdx, [0x140175280]
mov ecx, 2
call fcn.1400c1790
cmp eax, 1
jne 0x140084dcd
int3
xor eax, eax
test eax, eax
jne 0x140084d88
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
pop rdi
ret

Function at 0x140084e10
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, reloc.OLEAUT32.dll_SafeArrayLock
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
jne 0x140084e7d
lea rax, str.m_hKey___0
mov qword [rsp + 0x28], rax
lea rax, [0x140175028]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1886
lea rdx, [0x140175280]
mov ecx, 2
call fcn.1400c1790
cmp eax, 1
jne 0x140084e7d
int3
xor eax, eax
test eax, eax
jne 0x140084e38
cmp qword [rsp + 0x70], 0
je 0x140084e95
mov dword [rsp + 0x44], 1
jmp 0x140084e9d
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140084ee6
lea rax, [0x140175260]
mov qword [rsp + 0x28], rax
lea rax, [0x140175028]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1887
lea rdx, [0x140175280]
mov ecx, 2
call fcn.1400c1790
cmp eax, 1
jne 0x140084ee6
int3
cmp dword [rsp + 0x40], 0
jne 0x140084ef4
mov eax, SafeArrayGetElemsize
jmp 0x140084f73
xor eax, eax
test eax, eax
jne 0x140084e83
mov dword [rsp + 0x38], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1400c34c0
inc eax
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x3c], 1
jne 0x140084f0c
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x50
pop rdi
ret
Function at 0x14008eb50
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, rsp
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
call fcn.1400916e0
mov rdx, qword [rsp + 0x30]
lea rcx, [0x14008ea20]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.14008ead0
add rsp, 0x20
pop rdi
ret

Function at 0x1400bf690
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400bf170
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400bf6cf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14016bd70]
jmp 0x1400bf6d9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x140127030
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x380b01d10
Capabilities:
Access peb ldr_data

Disassembly:
push rdi
push rsi
mov rsi, rcx
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
mov rbx, rdi
mov rcx, qword [rbx + 0x50]
call fcn.380b01cd5
mov eax, eax
cmp rsi, rax
jne 0x380b01d44
mov rax, qword [rbx + 0x20]
jmp 0x380b01d55
mov rbx, qword [rbx]
test rbx, rbx
je 0x380b01d51
cmp rdi, rbx
jne 0x380b01d2e
or rax, 0xffffffffffffffff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x380b01d5d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
mov r15, rdx
push r14
push r13
push r12
push rbp
xor ebp, ebp
push rdi
push rsi
push rbx
mov rbx, rcx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r14d, dword [rdi + 0x20]
mov r12d, dword [rdi + 0x1c]
mov r13d, dword [rdi + 0x24]
add r14, rcx
cmp ebp, dword [rdi + 0x18]
jae 0x380b01dc8
mov esi, ebp
xor edx, edx
mov ecx, dword [r14 + rsi*4]
add rcx, rbx
call fcn.380b01c90
cmp rax, r15
jne 0x380b01dc4
add rsi, rsi
add rsi, rbx
movzx eax, word [rsi + r13]
lea rax, [rbx + rax*4]
mov eax, dword [rax + r12]
add rax, rbx
jmp 0x380b01dc8
inc ebp
jmp 0x380b01d92
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x380b023b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.380b02fd0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.380b02fd0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]