joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ead40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1800ead4b
xor eax, eax
ret
lea r11, [0x18010f3e0]
not ecx
cmp r8d, 8
jb 0x1800eae21
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1800ead70
test r8d, r8d
je 0x1800eae4d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x1800eae30
not ecx
mov eax, ecx
ret
Function at 0x1800efaf0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800efb74
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x18010fbd0]
cmp byte [rcx + rax], 0
je 0x1800efb74
dec r8
sub rdx, 1
jne 0x1800efb5a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14000adf0
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002dd98]
test rcx, rcx
je 0x14000ae2b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000ae1e
mov rcx, qword [0x14002dd98]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002dd98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002dda8], 0
je 0x14000af1e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x1400288a8]
mov qword [rsp + 0x80], rsi
lea rsi, [0x1400365d0]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000aeff
test al, 0x10
je 0x14000aeff
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000aea5
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x140015720
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x50], 0
mov rdi, rdx
mov rbx, rcx
jne 0x140015740
add rcx, 0xffffffffffffff90
call fcn.140015450
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x14001575b
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140018380
mov eax, 0x80004005
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140015900
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x50], 0
mov rdi, rdx
mov rbx, rcx
jne 0x140015920
add rcx, 0xffffffffffffff90
call fcn.140015450
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x14001593b
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140018620
mov eax, 0x80004005
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140016180
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x140030020]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp qword [rcx + 0xa0], 0
mov rbx, rcx
je 0x1400161af
xor eax, eax
jmp 0x140016292
mov r8d, dword [rcx + 0x60]
movsxd rax, edx
lea rdx, str.ManagerPollingExitEvent_d
imul rax, rax, 0xffffffffdc3cba00
mov qword [rcx + 0x78], rax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x158], rdi
call fcn.140014570
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r8d, dword [rbx + 0x60]
lea rdx, str.ManagerPollingPollNowEvent_d
lea rcx, [rsp + 0x30]
mov qword [rbx + 0x80], rax
call fcn.140014570
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r8d, dword [rbx + 0x60]
lea rdx, str.ManagerPollingChangeFrequencyEvent_d
lea rcx, [rsp + 0x30]
mov qword [rbx + 0x88], rax
call fcn.140014570
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [rbx - 0x70]
lea r8, [0x140016400]
mov qword [rbx + 0x90], rax
lea rax, [rbx + 0xa8]
xor edi, edi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x80004005
test rax, rax
mov qword [rbx + 0xa0], rax
cmovne ecx, edi
mov rdi, qword [rsp + 0x158]
mov eax, ecx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14001fb00
add rsp, 0x140
pop rbx
ret
Function at 0x140017580
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x50], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1400175a0
add rcx, 0xffffffffffffff90
call fcn.140015450
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x1400175bb
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14001bf70
mov eax, 0x80004005
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rbp, rdx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14001bf9b
mov rax, rdi
jmp 0x14001bfac
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x14001bfc6
test rax, rax
jne 0x14001bfc6
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x14001bff3
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c090
mov rsi, qword [rsp + 0x30]
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.OutOfBoxWizardCompletedStep
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c077
cmp dword [rsp + 0x78], 4
jne 0x14001c077
movzx eax, word [rsp + 0x60]
mov word [rbp], ax
jmp 0x14001c080
mov word [rbp], di
mov edi, 0x80004005
test rsi, rsi
je 0x14001c095
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c095
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400175d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x50], 0
movzx edi, dx
mov rbx, rcx
jne 0x1400175f0
add rcx, 0xffffffffffffff90
call fcn.140015450
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x14001760b
movzx edx, di
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14001c0b0
mov eax, 0x80004005
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
movzx ebp, dx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14001c0db
mov rax, rdi
jmp 0x14001c0ec
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x14001c106
test rax, rax
jne 0x14001c106
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x14001c133
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c1ab
mov rsi, qword [rsp + 0x70]
movsx eax, bp
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.OutOfBoxWizardCompletedStep
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x14001c1b0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c1b0
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140017620
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x50], 0
mov rdi, rdx
mov rbx, rcx
jne 0x140017640
add rcx, 0xffffffffffffff90
call fcn.140015450
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x14001765b
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14001c1d0
mov eax, 0x80004005
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rbp, rdx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14001c1fb
mov rax, rdi
jmp 0x14001c20c
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x14001c226
test rax, rax
jne 0x14001c226
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x14001c253
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c2ed
mov rsi, qword [rsp + 0x30]
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.DataState
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c2d5
cmp dword [rsp + 0x78], 4
jne 0x14001c2d5
mov eax, dword [rsp + 0x60]
mov dword [rbp], eax
jmp 0x14001c2dd
mov dword [rbp], edi
mov edi, 0x80004005
test rsi, rsi
je 0x14001c2f2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c2f2
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140017670
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x50], 0
mov edi, edx
mov rbx, rcx
jne 0x14001768f
add rcx, 0xffffffffffffff90
call fcn.140015450
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x1400176a9
mov edx, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14001c310
mov eax, 0x80004005
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov ebp, edx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14001c33a
mov rax, rdi
jmp 0x14001c34b
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x14001c365
test rax, rax
jne 0x14001c365
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x14001c392
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c407
mov rsi, qword [rsp + 0x70]
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DataState
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x14001c40c
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c40c
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400179b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x50], 0
movzx edi, dx
mov rbx, rcx
jne 0x1400179d0
add rcx, 0xffffffffffffff90
call fcn.140015450
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x1400179ef
cmp di, 0xffff
sete dl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14001c570
mov eax, 0x80004005
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
movzx ebp, dl
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14001c59b
mov rax, rdi
jmp 0x14001c5ac
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x14001c5c6
test rax, rax
jne 0x14001c5c6
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x14001c5f3
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c670
mov rsi, qword [rsp + 0x70]
mov eax, edi
test bpl, bpl
setne al
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableBubbleNotification
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x14001c675
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c675
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018260
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov ebp, edx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14001828a
mov rax, rdi
jmp 0x14001829b
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x1400182b5
test rax, rax
jne 0x1400182b5
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x1400182e2
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140018357
mov rsi, qword [rsp + 0x70]
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x140025b68]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x14001835c
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001835c
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018380
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rbp, rdx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x1400183ab
mov rax, rdi
jmp 0x1400183bc
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x1400183d6
test rax, rax
jne 0x1400183d6
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x140018403
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400184a5
mov rsi, qword [rsp + 0x30]
mov dword [rsp + 0x60], DispGetParam
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, [0x140025b68]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140018489
cmp dword [rsp + 0x78], 4
jne 0x140018489
mov eax, dword [rsp + 0x60]
mov dword [rbp], eax
jmp 0x140018495
mov dword [rbp], DispGetParam
mov edi, 0x80004005
test rsi, rsi
je 0x1400184aa
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400184aa
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400184d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rbp, rdx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x1400184ff
mov rax, rdi
jmp 0x140018510
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x14001852a
test rax, rax
jne 0x14001852a
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x140018557
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140018601
mov rsi, qword [rsp + 0x70]
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.LastUpdateTimeLoWord
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r11d, dword [rsp + 0x6c]
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.LastUpdateTimeHiWord
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rsi, rsi
je 0x140018606
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140018606
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018620
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rbp, rdx
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14001864a
xor eax, eax
jmp 0x14001865b
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsp + 0x60], rax
cmp qword [rbx], rdi
je 0x140018675
test rax, rax
jne 0x140018675
mov ecx, 0x8007000e
call fcn.140002460
nop
lea rcx, str.WebServicesCommunicationCenter
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, str.WebServicesCommunicationCenter
lea rcx, [rsp + 0x60]
call fcn.14000c020
test eax, eax
jns 0x1400186a2
mov ecx, eax
call fcn.140002460
int3
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140018791
mov rsi, qword [rsp + 0x30]
mov dword [rsp + 0x60], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.LastUpdateTimeLoWord
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001871f
cmp dword [rsp + 0x70], 4
je 0x14001872c
mov dword [rsp + 0x78], 0
mov edi, 0x80004005
mov dword [rsp + 0x60], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.LastUpdateTimeHiWord
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001876b
cmp dword [rsp + 0x70], 4
je 0x140018778
mov dword [rsp + 0x7c], 0
mov edi, 0x80004005
mov rax, qword [rsp + 0x78]
mov qword [rbp], rax
test rsi, rsi
je 0x140018796
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140018796
mov edi, 0x80004005
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret