joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cbb88
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
and dword [rsp + 0x50], 0
lea rax, [r11 + 0x10]
mov qword [r11 - 0x18], rax
lea r8, str.ConnectedSearchUseWeb
lea rax, [r11 + 8]
mov dword [rsp + 0x58], 4
mov qword [r11 - 0x20], rax
lea rdx, str.SoftwarePoliciesMicrosoftWindowsWindows_Search
and qword [r11 - 0x28], 0
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
cmp eax, 0x490
je 0x1400cbbe4
cmp eax, 2
jne 0x1400cbc32
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea r8, str.ConnectedSearchUseWeb
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwarePoliciesMicrosoftWindowsWindows_Search
and qword [rsp + 0x20], 0
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x1400cbc3f
cmp dword [rsp + 0x50], eax
setne al
jmp 0x1400cbc41
mov al, 1
add rsp, 0x48
ret
Function at 0x1400ecd68
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rdx
lea rcx, [rax + 8]
xor esi, esi
xor edx, edx
mov qword [rax + 8], rsi
call fcn.14006e14c
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionFeedsDSB
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x1400ece1a
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], si
jne 0x1400ecdda
mov rcx, qword [rsp + 0x60]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x140316630]
mov r9d, 1
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1400ece27
jle 0x1400ece29
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1400ece29
mov ebx, esi
lea rcx, [rsp + 0x60]
call fcn.14009a144
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1400ece4c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbx
sub rsp, 0x50
and qword [rax + 8], 0
lea rcx, [rax + 8]
xor edx, edx
call fcn.14006e14c
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionFeedsDSB
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
and dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x1400ecee8
mov rcx, qword [rsp + 0x60]
lea r9d, [rax + 4]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.IsDynamicContentAvailable
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1400ecef5
jle 0x1400ecef7
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1400ecef7
xor ebx, ebx
lea rcx, [rsp + 0x60]
call fcn.14009a144
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x1400ed074
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov rdi, rcx
and qword [rbp + 0x30], 0
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov rax, qword [rcx]
lea r9, str.Configs
mov r8, qword [rax + 8]
lea rdx, [0x14030e4a0]
lea rcx, [rbp - 0x18]
call fcn.14002bb10
mov ebx, eax
test eax, eax
js 0x1400ed149
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.14006e14c
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x18]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x1400ed133
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x28]
xor r8d, r8d
lea rdx, str.GlobalProfileId
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1400ed140
jle 0x1400ed149
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1400ed149
mov rax, qword [rdi + 8]
mov byte [rax], 1
xor ebx, ebx
lea rcx, [rbp - 0x18]
call fcn.1400813e4
lea rcx, [rbp + 0x30]
call fcn.14009a144
mov eax, ebx
add rsp, 0x50
pop rdi
pop rbx
pop rbp
ret

Function at 0x1400ef240
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
and qword [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14006e14c
lea rax, [rsp + 0x40]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionFeeds
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x1400ef2ad
mov rcx, qword [rsp + 0x40]
lea rdx, str.HeadlinesShownTemporaryForProtocolLaunch
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1400ef2ba
jle 0x1400ef2bc
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1400ef2bc
xor ebx, ebx
lea rcx, [rsp + 0x40]
call fcn.14009a144
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1400f2590
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rax, [rsp + 0x50]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
lea r8, str.HeadlinesShownTemporaryForProtocolLaunch
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionFeeds
call fcn.14007b130
test eax, eax
js 0x1400f2629
cmp dword [rsp + 0x50], 0
je 0x1400f2629
xor r8d, r8d
mov byte [rbx + 0x121], 1
mov rcx, rbx
lea edx, [r8 + 2]
call fcn.1400f5248
mov byte [rbx + 0x121], 0
call fcn.1400ef240
lea rcx, [rsp + 0x48]
call fcn.1400ed654
lea rcx, [0x14038ab98]
call fcn.1400ac79c
test al, al
je 0x1400f2629
lea r8, str.PartnerCode
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionFeeds
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegDeleteKeyValueW]
nop dword [rax + rax]
add rsp, 0x30
pop rbx
ret
Function at 0x1400f4a8c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x60
and qword [rax + 0x20], 0
mov rdi, rcx
lea rcx, [rax + 0x20]
mov dword [rax - 0x18], 1
xor edx, edx
call fcn.14006e14c
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionFeeds
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
and dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x1400f4b31
mov rcx, qword [rsp + 0x88]
lea r9d, [rax + 4]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1400f4b3e
jle 0x1400f4b40
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1400f4b40
xor ebx, ebx
lea rcx, [rsp + 0x88]
call fcn.14009a144
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x1400f4c3c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x90
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, rcx
mov dword [rsp + 0x58], PathIsExe
mov dword [rsp + 0x5c], 1
lea rax, [r11 - 0x40]
mov qword [r11 - 0x68], rax
lea rax, [r11 - 0x38]
mov qword [r11 - 0x70], rax
lea rax, [r11 - 0x3c]
mov qword [r11 - 0x78], rax
mov r9d, 2
lea r8, str.LastUserInteractedDate
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionFeeds
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jle 0x1400f4cb9
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x1400f4d37
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x48]
lea rdx, str._02hu__02hu__4huT_02hu__02hu__02hu
lea rcx, [rsp + 0x60]
call fcn.1400a29c0
movzx ecx, word [rsp + 0x40]
mov word [rbx], cx
movzx ecx, word [rsp + 0x44]
mov word [rbx + 2], cx
movzx ecx, word [rsp + 0x48]
mov word [rbx + 6], cx
movzx ecx, word [rsp + 0x4c]
mov word [rbx + 8], cx
movzx ecx, word [rsp + 0x50]
mov word [rbx + 0xa], cx
movzx ecx, word [rsp + 0x54]
mov word [rbx + 0xc], cx
mov al, 1
jmp 0x1400f4d39
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400a15a0
add rsp, 0x90
pop rbx
ret
Function at 0x1400f9740
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbx, r9
mov r12, r8
mov r15, rdx
mov r14, rcx
and dword [rax + 0x18], 0
lea rdx, [rax + 0x18]
mov rcx, qword [r8]
call sub.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer
movabs rdx, 0xcbf29ce484222325
mov r9d, dword [rsp + 0x70]
add r9, r9
mov r8d, 0
je 0x1400f97af
movzx ecx, byte [r8 + rax]
xor rdx, rcx
movabs r10, 0x100000001b3
imul rdx, r10
inc r8
cmp r8, r9
jb 0x1400f9791
mov rsi, qword [r14 + 0x30]
and rsi, rdx
mov r8, rsi
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.1400fc798
mov rdi, qword [rax]
mov rcx, qword [r14 + 0x18]
mov rax, rsi
add rax, rax
cmp rdi, qword [rcx + rax*8]
je 0x1400f980e
mov rdi, qword [rdi + 8]
lea r8, [rdi + 0x10]
mov rdx, r12
call fcn.1400f9fd4
test al, al
jne 0x1400f97c9
lea rcx, [r14 + 8]
mov r8, rbx
lea rdx, [rsp + 0x70]
call fcn.1400fcb98
mov qword [r15], rdi
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x1400f98b3
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400f9847
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rcx, qword [r14 + 0x18]
mov r8, rsi
add r8, r8
mov rdx, qword [rcx + r8*8]
mov rax, rsi
add rax, rax
cmp rdx, qword [r14 + 8]
jne 0x1400f986c
mov qword [rcx + rax*8], rbx
mov rax, qword [r14 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400f989f
shl rsi, 4
add rsi, rcx
cmp rdx, rdi
jne 0x1400f987d
mov qword [rsi], rbx
jmp 0x1400f989f
mov rax, qword [rsi + 8]
mov rcx, qword [rax]
mov qword [rsi + 8], rcx
cmp rcx, rbx
je 0x1400f989f
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r14
call fcn.1400fc540
nop
mov qword [r15], rbx
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400fbcf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rbp + 0x30], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], reloc.SHCORE.dll_Ordinal_200
mov qword [rsp + 0x30], rax
lea r8, str.ActiveMUID
lea rax, [rsp + 0x60]
mov dword [rsp + 0x44], 1
mov qword [rsp + 0x28], rax
mov rbx, rdx
lea rax, [rsp + 0x44]
mov r9d, 2
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionFeeds
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
call fcn.1400f450c
mov rcx, rax
cmp dword [rax], 5
jbe 0x1400fbdca
movabs rdx, 0x400000000000
call fcn.14004c478
test al, al
je 0x1400fbdca
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rax
lea rdx, [0x14032dc9c]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x58], 0x1000000
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.140003108
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1400a15a0
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rbp
ret
Function at 0x140103f7c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
cmp qword [rcx], 0
je 0x14010402f
mov rcx, r8
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14010402f
and qword [rsp + 0x50], 0
mov rcx, qword [rdi]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 1
mov r9d, 0x80000000
xor r8d, r8d
mov rdx, rsi
mov rax, qword [rax + 0x18]
call qword [case.0x14006b68f.0]
mov ecx, eax
call fcn.14019c3d8
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x68], rcx
test rcx, rcx
je 0x14010400a
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006b68f.0]
nop
lea r8, [rsp + 0x68]
mov rdx, rbx
mov rcx, rdi
call fcn.1401039fc
nop
cmp qword [rsp + 0x50], 0
je 0x140104033
lea rcx, [rsp + 0x50]
call fcn.1400f621c
jmp 0x140104033
and qword [rbx], 0
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1401040f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
movzx edx, dx
lea rcx, [0x140000000]
mov r8d, 0x100
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_FindResourceW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1401041a7
mov rdx, rax
lea rcx, [0x140000000]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
nop dword [rax + rax]
mov rdx, rdi
lea rcx, [0x140000000]
mov esi, eax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
nop dword [rax + rax]
test rax, rax
je 0x1401041be
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
nop dword [rax + rax]
test rax, rax
je 0x140104190
mov qword [rbx + 8], rax
mov rax, rbx
mov qword [rbx], rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rsp + 0x28]
lea r8, str.pcshell_shellexplorer_feedscontentcompositionhost.cpp
mov edx, 0x304
call fcn.1401fc31c
int3
mov rcx, qword [rsp + 0x28]
lea r8, str.pcshell_shellexplorer_feedscontentcompositionhost.cpp
mov edx, reloc.SHELL32.dll_Ordinal_764
call fcn.1401fc31c
int3
mov rcx, qword [rsp + 0x28]
lea r8, str.pcshell_shellexplorer_feedscontentcompositionhost.cpp
mov edx, 0x301
call fcn.1401fc31c
int3
Function at 0x140107340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and dword [rax + 8], 0
mov rdi, rdx
mov rsi, rcx
lea rdx, [rax + 8]
mov rcx, qword [r8]
mov r14, r8
movabs rbx, 0xcbf29ce484222325
call sub.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer
mov r8d, dword [rsp + 0x40]
mov edx, 0
add r8, r8
je 0x1401073a2
movzx ecx, byte [rdx + rax]
movabs r9, 0x100000001b3
xor rbx, rcx
inc rdx
imul rbx, r9
cmp rdx, r8
jb 0x140107385
mov rbp, qword [rsi + 0x30]
and rbp, rbx
mov rbx, qword [rsi + 0x18]
mov rax, rbp
add rax, rax
mov rbx, qword [rbx + rax*8]
mov r8, rbp
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400fc798
cmp rbx, qword [rax]
je 0x1401073fa
lea rdx, [rbx + 0x10]
mov r8, r14
call fcn.1400f9fd4
test al, al
je 0x1401073e1
mov rbx, qword [rbx]
jmp 0x1401073b7
lea r8, [rbx + 0x10]
mov rdx, r14
call fcn.1400f9fd4
test al, al
je 0x1401073f5
mov rbx, qword [rsi + 8]
mov qword [rdi], rbx
jmp 0x140107401
mov rax, qword [rsi + 8]
mov qword [rdi], rax
mov rbx, qword [rsp + 0x48]
mov rax, rdi
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x14010c160
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0x48
lea rax, [r11 + 8]
mov dword [rsp + 0x50], 8
mov qword [r11 - 0x18], rax
mov rcx, 0xffffffff80000001
mov qword [r11 - 0x20], r9
mov r9d, Shell_MergeMenus
and qword [r11 - 0x28], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jle 0x14010c1a9
movzx eax, ax
or eax, 0x80070000
add rsp, 0x48
ret
Function at 0x1401122b8
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
cmp qword [rcx], 0
je 0x1401122d7
call fcn.14029f03c
test al, al
jne 0x14011235e
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [0x1403ad7b8]
nop dword [rax + rax]
test rax, rax
je 0x14011235e
lea rdx, str.IsExplorerShuttingDown
mov rcx, rax
call qword [0x1403ad630]
nop dword [rax + rax]
test rax, rax
jne 0x14011235e
call fcn.14027f7c8
call fcn.14027dbe8
call fcn.1400a529c
test al, al
je 0x140112333
mov r8b, 1
or edx, 0xffffffff
xor ecx, ecx
call qword [0x1403ad820]
nop dword [rax + rax]
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
nop dword [rax + rax]
test eax, eax
jne 0x14011235e
mov rcx, qword [rsp + 0x28]
lea r8, str.shellliblogontaskslogontasks.cpp
mov edx, 0x779
call fcn.14019dc84
mov rcx, qword [rbx + 8]
xor edx, edx
mov rcx, qword [rcx]
call fcn.140095718
mov ecx, 0x2bf20
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
Function at 0x140114904
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x68], rax
and qword [r11 - 0x30], 0
mov dword [rsp + 0x40], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rax, [r11 - 0x38]
mov qword [r11 - 0x48], rax
lea rax, [r11 - 0x20]
mov qword [r11 - 0x50], rax
and qword [r11 - 0x58], 0
mov r9d, 8
lea r8, str.FirstLogonTimeOnCurrentInstallation
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerLogonStats
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x78]
test eax, eax
jne 0x1401149af
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_SystemTimeToFileTime]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x78]
test eax, eax
je 0x1401149c3
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
jmp 0x14011499c
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400a15a0
add rsp, 0x78
ret
mov r9d, eax
lea r8, str.onecoreuapinternal_shellincScoobeEligibilityContext.h
mov edx, RestartDialog
call fcn.1401fc340
lea r8, str.onecoreuapinternal_shellincScoobeEligibilityContext.h
lea edx, [rax + 0x3a]
call fcn.1401fc31c
int3

Function at 0x140115890
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ebx, ebx
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetThreadUILanguage]
nop dword [rax + rax]
movzx ecx, ax
mov r9d, 0x104
lea r8, [rsp + 0x30]
lea edx, [rbx + 0x5c]
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
nop dword [rax + rax]
test eax, eax
je 0x1401158ff
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x30]
call qword [0x1403ad578]
nop dword [rax + rax]
test eax, eax
js 0x1401158ff
cmp dword [rsp + 0x20], ebx
setne bl
mov al, bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400a15a0
add rsp, 0x250
pop rbx
ret
Function at 0x14012d794
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x48
test ecx, 0x3308
jne 0x14012d832
call fcn.14006ec30
test al, al
jne 0x14012d832
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x30], rax
lea r8, [0x14030efa0]
lea rax, [rsp + 0x58]
mov r9d, 0x20010010
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRetailDemoOobeWrite
and qword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
cmp dword [rsp + 0x58], 0
jne 0x14012d832
call fcn.140070b30
test al, al
jne 0x14012d832
call fcn.1401fc980
test eax, eax
jne 0x14012d832
call fcn.1401fc920
test eax, eax
jne 0x14012d832
call fcn.1400ed020
test eax, eax
jne 0x14012d832
call fcn.14020dbe0
test al, al
jne 0x14012d832
mov al, 1
jmp 0x14012d834
xor al, al
add rsp, 0x48
ret
Function at 0x1401389c8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rbp - 8], rax
mov ebx, ecx
lea r9, [rbp - 0x20]
xor esi, esi
lea r8, str.PDEShown
mov rcx, 0xffffffff80000001
movzx edi, sil
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionCloudExperienceHostIntentPersonalDataExport
mov dword [rbp - 0x20], esi
call fcn.14002c200
mov eax, dword [rbp - 0x20]
cmp eax, 2
cmova eax, esi
mov dword [rbp - 0x20], eax
test ebx, 0x3308
jne 0x140138b8c
call fcn.1401223ec
test al, al
jne 0x140138b8c
cmp dword [rbp - 0x20], 2
jae 0x140138b8c
call fcn.140070d20
test al, al
jne 0x140138b8c
call fcn.1400728f8
test al, al
jne 0x140138b8c
call fcn.140070b74
test al, al
jne 0x140138b8c
lea ecx, [rsi + 0xd]
call qword [sym.imp.api_ms_win_shcore_sysinfo_l1_1_0.dll_IsOS]
nop dword [rax + rax]
test eax, eax
jne 0x140138b8c
call fcn.14006ec30
test al, al
jne 0x140138b8c
lea rax, [rbp - 0x1c]
mov r9d, 0x20010010
mov qword [rsp + 0x30], rax
lea ebx, [rsi + 4]
lea rax, [rbp - 0x10]
mov dword [rbp - 0x1c], ebx
mov qword [rsp + 0x28], rax
lea r8, [0x14030efa0]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRetailDemoOobeWrite
mov qword [rsp + 0x20], rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
cmp dword [rbp - 0x10], esi
jne 0x140138b8c
call fcn.14006ebe0
test al, al
jne 0x140138b8c
call fcn.140070b30
test al, al
jne 0x140138b8c
call fcn.1401fc980
test eax, eax
jne 0x140138b8c
call fcn.1401fc920
test eax, eax
jne 0x140138b8c
call fcn.1400ed020
test eax, eax
jne 0x140138b8c
call fcn.14020dbe0
test al, al
jne 0x140138b8c
call fcn.14006f0d8
test al, al
jne 0x140138b8c
call fcn.140120a00
test al, al
jne 0x140138b8c
mov edx, ebx
mov qword [rbp - 0x10], rsi
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_core_localization_l1_2_3.dll_GetUserDefaultGeoName]
nop dword [rax + rax]
test eax, eax
jne 0x140138b60
mov rcx, qword [rbp + 8]
lea r8, str.shellliblogontaskslogontasks.cpp
mov edx, 0x12ea
call fcn.14019dc84
or edx, 0xffffffff
lea r8, [0x1403172c0]
mov ebx, 1
lea rcx, [rbp - 0x10]
mov r9d, edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
nop dword [rax + rax]
cmp eax, 2
cmove edi, ebx
mov ebx, dword [rbp - 0x20]
lea rdx, [0x140110800]
call fcn.140122234
mov rcx, qword [rax + 8]
cmp dword [rcx], 5
jbe 0x140138bf0
movabs rdx, 0x400000000000
call fcn.14004c478
test al, al
je 0x140138bf0
lea rax, [rbp - 0x18]
movzx edx, dil
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x1c]
mov dword [rbp - 0x1c], edx
lea rdx, [0x140330fe7]
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x18], 0x1000000
mov dword [rbp - 0x10], ebx
call fcn.14019ab10
mov al, dil
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400a15a0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret