joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001493c
Capabilities:
Connect to http server

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
cmp dword [0x1401e3f88], ebx
je 0x140014967
cmp dword [0x1401e3f90], ebx
je 0x140014967
lea rdx, [0x1402232e0]
lea rcx, str.Opening_server:__s_r_n
call fcn.140025c48
mov eax, dword [0x140223ce8]
lea r9, [0x140188d72]
test eax, eax
mov qword [rsp + 0x38], 1
mov ecx, ebx
mov edx, 0x800000
cmovne ecx, edx
neg eax
mov dword [rsp + 0x30], ecx
lea rdx, [0x1402232e0]
mov rcx, qword [0x140223280]
sbb r8w, r8w
and r8w, 0x16b
mov dword [rsp + 0x28], 3
add r8w, 0x50
mov qword [rsp + 0x20], r9
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [0x140223288], rax
mov dword [0x140225f6c], 1
mov qword [0x140223298], rbx
test rax, rax
jne 0x140014a19
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x140014a37
cmp dword [0x1401e3f88], ebx
je 0x140014a15
cmp dword [0x1401e3f90], ebx
je 0x140014a15
cmp word [0x1402321a0], bx
je 0x140014a15
lea rdx, [0x1402321a0]
lea rcx, str.NetConnect_failed._r_n
call fcn.140025aa4
xor eax, eax
jmp 0x140014a3c
mov rcx, qword [0x140245120]
xor r9d, r9d
xor r8d, r8d
mov dword [0x140225f6c], ebx
mov edx, 0x1427
call qword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
add rsp, 0x40
pop rbx
ret

Function at 0x140014cb8
Capabilities:
Send data

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x140223cf8]
test rax, rax
jne 0x140014cec
mov rcx, qword [0x140245120]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1427
call qword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
jmp 0x140014d88
movsxd rdx, dword [0x140223cec]
lea r9, [0x140223cf4]
mov r8d, dword [0x140223cf0]
mov ebx, 1
mov rcx, qword [0x140223290]
add rdx, rax
mov dword [0x140225f6c], ebx
call qword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x140014d51
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x140014d86
cmp dword [0x1401e3f88], 0
je 0x140014d4d
cmp dword [0x1401e3f90], 0
je 0x140014d4d
mov edx, eax
lea rcx, str.HttpWrite_Failed__GLE_d._r_n
call fcn.140025c48
xor eax, eax
jmp 0x140014d88
mov eax, dword [0x14024b090]
mov edx, 0x1427
and dword [0x140225f6c], 0
cmp dword [0x140223254], 3
mov rcx, qword [0x140245120]
cmove eax, ebx
xor r9d, r9d
xor r8d, r8d
mov dword [0x14024b090], eax
call qword [sym.imp.USER32.dll_PostMessageA]
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140014e24
Capabilities:
Read data from internet
Receive data

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, 0x38
lea rcx, [0x140223d18]
mov r8d, ebx
xor edx, edx
call fcn.140130a00
mov rcx, qword [0x140223290]
lea r9d, [rbx - 0x37]
lea rax, [0x140223d54]
mov dword [0x140223d18], ebx
mov r8d, r9d
mov qword [0x140223d38], rax
lea rdx, [0x140223d18]
mov dword [0x140223d40], 0x1000
mov dword [0x140225f6c], 1
call qword [sym.imp.WININET.dll_InternetReadFileExA]
xor ebx, ebx
test eax, eax
jne 0x140014ec6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x140014ee4
cmp dword [0x1401e3f88], ebx
je 0x140014ec2
cmp dword [0x1401e3f90], ebx
je 0x140014ec2
cmp word [0x1402321a0], bx
je 0x140014ec2
lea rdx, [0x1402321a0]
lea rcx, str.NetRead_Failed._r_n
call fcn.140025aa4
xor eax, eax
jmp 0x140014ee9
mov rcx, qword [0x140245120]
xor r9d, r9d
xor r8d, r8d
mov dword [0x140225f6c], ebx
mov edx, 0x1427
call qword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140016700
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, qword [str.ETW0]
xor r15d, r15d
or r12, 0xffffffffffffffff
mov ebp, r15d
test rsi, rsi
je 0x14001673b
mov rax, r12
inc rax
cmp word [rsi + rax*2], r15w
jne 0x14001672f
jmp 0x14001673e
mov rax, r15
lea rdx, str..cab
mov rcx, r12
inc rcx
cmp word [rdx + rcx*2], r15w
jne 0x140016748
lea ebx, [rcx + 0xb]
add ebx, eax
cmp ebx, 0x104
jle 0x1400167a9
cmp dword [0x1401e3f88], r15d
je 0x14001678e
cmp dword [0x1401e3f90], r15d
je 0x14001678e
cmp word [0x1402321a0], r15w
je 0x14001678e
lea rdx, [0x1402321a0]
lea rcx, str.Proposed_temp_filename_length_greater_than_MAX_PATH__cant_create._r_n
call fcn.140025aa4
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
movsxd r14, ebx
lea rcx, [r14 + r14]
call fcn.14015319c
mov qword [0x1402313e0], rax
test rax, rax
je 0x14001678e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
test ebx, ebx
jle 0x1400167e2
mov rcx, qword [0x1402313e0]
mov r9, r12
mov r8, rsi
mov rdx, r14
call fcn.1401525e0
mov rdx, qword [0x1402313e0]
lea rcx, [0x140189654]
mov r8d, ebx
call fcn.14003348c
mov rcx, qword [0x1402313e0]
test rcx, rcx
je 0x140016813
mov rax, r12
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140016807
jmp 0x140016816
mov rax, r15
mov edx, ebx
sub edx, eax
test rcx, rcx
je 0x14001682e
mov rax, r12
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140016822
jmp 0x140016831
mov rax, r15
cdqe
mov r8, rdi
lea rcx, [rcx + rax*2]
call fcn.1400332c4
mov rdx, qword [0x1402313e0]
lea rcx, str..cab
mov r8d, ebx
call fcn.14003348c
mov rcx, qword [0x1402313e0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x100
mov edx, 0xc0000000
mov dword [rsp + 0x20], 1
call fcn.140106fdc
mov rdi, rax
cmp rax, r12
jne 0x1400168bb
mov ecx, 0x64
inc ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebp, 0x32
jl 0x1400167c1
mov rcx, qword [0x1402313e0]
test rcx, rcx
je 0x14001678e
call fcn.140152ed8
mov qword [0x1402313e0], r15
jmp 0x14001678e
mov rdx, qword [0x1402451b8]
lea r9, [rsp + 0x70]
mov rcx, rdi
mov qword [rsp + 0x20], r15
mov r8d, dword [rdx + 0x30]
mov rdx, qword [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140016790
Function at 0x14001cfa0
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor r8d, r8d
mov rbx, rcx
mov rcx, qword [0x140245128]
lea edx, [r8 + 7]
call fcn.1400208c0
cmp dword [0x14022602c], 5
je 0x14001d009
mov edi, 0x438
mov rcx, rbx
mov edx, edi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
lea edx, [rdi + 0x2e]
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageA]
mov edx, edi
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
lea edx, [rdi + 0x2d]
mov rcx, rax
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x140225f84], 0
jne 0x14001d06b
mov edx, 0x450
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor r8d, r8d
mov edi, eax
test eax, eax
setne r8b
call fcn.1400228a4
mov edx, 0x450
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x140225f84], 0
jne 0x14001d06b
test edi, edi
jne 0x14001d06b
lea edx, [rdi + 2]
mov rcx, rbx
lea r9d, [rdi + 1]
lea r8d, [rdi + 0x1d]
call fcn.1400211b4
jmp 0x14001d080
xor r9d, r9d
mov edx, 0x111
mov rcx, rbx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001e5b4
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rdx + 0x40], 0
mov r9d, 1
mov rbx, rdx
mov rdi, rcx
lea edx, [r9 + 4]
je 0x14001e647
mov r8d, 0xbe
call fcn.1400211b4
mov edx, 0x448
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
cmp dword [rbx + 0x1c], 0
jne 0x14001e61d
mov edx, 0x440
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rbx + 0x10]
test byte [rax], 2
je 0x14001e69d
cmp dword [rbx + 0x1c], 0
jne 0x14001e69d
cmp dword [rbx + 0x50], 0
jne 0x14001e69d
mov edx, 0x447
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 5
jmp 0x14001e694
mov r8d, 0xbd
call fcn.1400211b4
mov edx, 0x448
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x440
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x447
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001e7dc
Capabilities:
Hide graphical window

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rdi
sub rsp, 0x40
cmp dword [rdx + 0x18], 0
mov rdi, rdx
mov rbx, rcx
je 0x14001e81a
mov dword [rax - 0x18], 0x14
xor r9d, r9d
and dword [rax - 0x20], 0
xor r8d, r8d
and dword [rax - 0x28], 0
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x14001e94e
call fcn.140017c00
mov eax, dword [0x140231608]
mov ebp, 1
cmp dword [0x14023160c], eax
je 0x14001e89a
mov r9d, ebp
lea edx, [rbp + 3]
lea r8d, [rbp + 0x65]
mov rcx, rbx
call fcn.1400211b4
mov r9d, ebp
mov edx, 0x3ed
mov r8d, 0xa2
mov rcx, rbx
call fcn.1400211b4
mov r9d, ebp
lea edx, [rbp + 2]
mov r8d, 0xa3
mov rcx, rbx
call fcn.1400211b4
mov r9d, ebp
mov edx, 0x447
mov r8d, 0xb0
mov rcx, rbx
call fcn.1400211b4
mov r9d, ebp
mov edx, 0x453
mov r8d, 0xb1
mov rcx, rbx
call fcn.1400211b4
cmp dword [rdi + 0x50], 0
je 0x14001e8eb
mov edx, 4
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov edx, 4
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 3
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x14001e926
mov rax, qword [rdi + 0x10]
test byte [rax], 2
je 0x14001e926
mov edx, 0x447
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, ebp
call qword [sym.imp.USER32.dll_EnableWindow]
mov edx, 0x447
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, ebp
call qword [sym.imp.USER32.dll_ShowWindow]
and dword [rdi + 0x40], 0
mov rdx, rdi
mov rcx, rbx
call fcn.14001e5b4
mov edx, 0x3ec
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140021d00
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1401e3028]
xor rax, rsp
mov qword [rsp + 0x40], rax
movzx ebx, cx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [0x1402313fc], eax
call qword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x140231608], eax
test bx, bx
je 0x140021d45
movzx ecx, bx
call fcn.140021be0
test eax, eax
jne 0x140021dab
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, ax
movzx ebx, ax
call fcn.140021be0
test eax, eax
jne 0x140021dab
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ecx, ax
movzx ebx, ax
call fcn.140021be0
test eax, eax
jne 0x140021dab
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx ecx, ax
movzx ebx, ax
call fcn.140021be0
test eax, eax
jne 0x140021dab
movzx ebx, word [0x1402313fc]
movzx ecx, bx
call fcn.140021be0
test eax, eax
jne 0x140021dab
mov ebx, 0x409
mov ecx, ebx
call fcn.140021be0
test eax, eax
je 0x140021e67
mov ecx, dword [0x1402313fc]
cmp bx, cx
je 0x140021db9
movzx ecx, bx
call fcn.140050354
mov rcx, qword [0x1401e3c58]
lea r8, [rsp + 0x28]
mov r9d, reloc.Cabinet.dll_FCIFlushFolder
mov edx, 0x92
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140021e06
mov r8b, 1
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x28]
call fcn.140033124
mov ecx, dword [rsp + 0x24]
test ecx, ecx
je 0x140021e06
mov eax, ecx
shr rax, 0x10
test ax, ax
cmove bx, cx
lea r8, [rsp + 0x24]
mov word [0x140231e14], bx
lea rdx, [rsp + 0x20]
movzx ecx, bx
call fcn.140050700
mov cl, byte [rsp + 0x20]
lea r8, [rsp + 0x24]
mov byte [0x140231e10], cl
lea rdx, [rsp + 0x20]
movzx ecx, word [0x140231e14]
call fcn.140050700
mov ecx, dword [rsp + 0x24]
mov edx, 0x77
mov dword [0x14023160c], ecx
mov rcx, qword [0x1401e3c58]
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [0x140231158], rax
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14012e400
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140021f14
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x1401e3028]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor ebx, ebx
cmp dword [0x14024b560], ebx
je 0x140021f4c
cmp qword [0x14024b578], rbx
setne bl
jmp 0x140022098
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x90
call fcn.140130a00
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rcx, str.USER32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x14002205d
lea rdx, [0x14018b048]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14024b598], rax
test rax, rax
je 0x14002205d
lea rdx, [0x14018b060]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14024b590], rax
test rax, rax
je 0x14002205d
lea rdx, str.MonitorFromRect
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14024b588], rax
test rax, rax
je 0x14002205d
lea rdx, str.MonitorFromPoint
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14024b580], rax
test rax, rax
je 0x14002205d
lea rdx, [0x14018b0a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14024b570], rax
test rax, rax
je 0x14002205d
lea rdx, str.GetMonitorInfoA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14024b578], rax
test rax, rax
je 0x14002205d
lea rdx, str.EnumDisplayDevicesA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14024b568], rax
test rax, rax
je 0x14002205d
mov ebx, 1
jmp 0x14002208e
mov qword [0x14024b598], rbx
mov qword [0x14024b590], rbx
mov qword [0x14024b588], rbx
mov qword [0x14024b580], rbx
mov qword [0x14024b578], rbx
mov qword [0x14024b570], rbx
mov qword [0x14024b568], rbx
mov dword [0x14024b560], 1
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14012e400
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rdi
ret
Function at 0x14002216c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x1401e3028]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov r8, qword [r8]
or r12, 0xffffffffffffffff
mov rsi, rdx
mov rbx, rcx
mov r9, r12
lea rcx, [rsp + 0x50]
mov edx, 0x104
call fcn.14014f790
lea rcx, [rsp + 0x50]
mov rax, r12
inc rax
cmp byte [rcx + rax], 0
jne 0x1400221b9
cdqe
lea rdx, [rsp + 0x50]
add rdx, rax
mov r15d, 1
jmp 0x1400221dc
cmp byte [rdx], 0x5c
je 0x1400221ef
sub rdx, r15
lea rax, [rsp + 0x50]
cmp rdx, rax
ja 0x1400221d4
cmp byte [rdx], 0x5c
jne 0x140022342
mov rcx, qword [rsi]
lea rdi, [rdx + 1]
mov byte [rdx], 0
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140022342
mov ecx, dword [rbx + 0x14]
test ecx, ecx
je 0x140022301
sub ecx, r15d
je 0x1400222fa
sub ecx, r15d
je 0x1400222d7
cmp ecx, r15d
jne 0x140022337
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x48]
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
mov rdx, rdi
mov dword [rsp + 0x20], r15d
call fcn.14003f454
test eax, eax
je 0x140022337
mov rdi, qword [rsp + 0x40]
mov r9d, r12d
and dword [rsp + 0x28], 0
mov r8, rdi
and qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
mov rcx, rsi
add rcx, rcx
call fcn.14015319c
mov qword [rbx + 8], rax
test rax, rax
je 0x1400222c8
mov dword [rsp + 0x28], esi
mov r9d, r12d
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [rsi + rsi]
mov dword [rbx], r15d
mov dword [rbx + 0x10], eax
test rdi, rdi
je 0x140022337
mov rcx, rdi
call fcn.140152ed8
jmp 0x140022337
mov dword [rsp + 0x20], 3
mov rcx, qword [rsp + 0x30]
lea r8, [rbx + 8]
lea r9, [rbx + 0x10]
mov rdx, rdi
call fcn.14003f454
test eax, eax
je 0x140022337
jmp 0x140022334
mov dword [rsp + 0x20], r15d
jmp 0x1400222df
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 8]
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140022337
mov dword [rbx], r15d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.14012e400
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x170
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140022368
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0x88
lea r8, [rbp + 0x1f]
lea rdx, [rbp + 0x27]
lea rcx, str.HKLMSoftwareMicrosoftOffice11.0Registration
call fcn.14003f510
xor ebx, ebx
test eax, eax
je 0x140022407
mov rdx, qword [rbp + 0x1f]
lea rax, [rbp + 0x7f]
mov rcx, qword [rbp + 0x27]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140022407
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x58], rbx
xor r9d, r9d
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x48], rbx
xor edx, edx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x140022415
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, dword [rbp + 0x67]
inc eax
mov ecx, eax
mov dword [rbp + 0x67], eax
call fcn.14015319c
mov rdi, rax
test rax, rax
je 0x1400223fd
mov esi, ebx
cmp dword [rbp + 0x6f], ebx
jbe 0x14002251c
mov eax, dword [rbp + 0x67]
lea r9, [rbp + 0x77]
mov rcx, qword [rbp + 0x7f]
mov r8, rdi
mov qword [rsp + 0x38], rbx
mov edx, esi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x77], eax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14002254d
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], bl
jne 0x140022470
cmp eax, 0x26
jne 0x14002249d
cmp byte [rdi + 9], 0x2d
jne 0x140022511
cmp byte [rdi + 0xe], 0x2d
jne 0x140022511
cmp byte [rdi + 0x13], 0x2d
jne 0x140022511
cmp byte [rdi + 0x18], 0x2d
jmp 0x1400224b8
cmp eax, 0x24
jne 0x140022511
cmp byte [rdi + 8], 0x2d
jne 0x140022511
cmp byte [rdi + 0xd], 0x2d
jne 0x140022511
cmp byte [rdi + 0x12], 0x2d
jne 0x140022511
cmp byte [rdi + 0x17], 0x2d
jne 0x140022511
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x17]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140022511
mov rcx, qword [rbp + 0x17]
lea r9, [0x1401e3c98]
lea r8, [0x1401e3c90]
mov dword [rsp + 0x20], 3
lea rdx, [0x1401e4370]
call fcn.14003f454
mov rcx, qword [rbp + 0x17]
test eax, eax
jne 0x14002253b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, dword [rbp + 0x6f]
jb 0x140022437
mov rcx, rdi
call fcn.140152ed8
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, dword [rbp + 0x6f]
setb bl
mov eax, ebx
jmp 0x140022409
mov dword [0x1401e3c88], 1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002251c
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.140152ed8
jmp 0x140022407
Function at 0x1400228a4
Capabilities:
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1401e3028]
xor rax, rsp
mov qword [rbp + 0x80], rax
cmp dword [0x1401e3d28], 0
mov dword [rsp + 0x50], r8d
je 0x1400228e7
cmp dword [0x1401e3d30], r8d
jne 0x1400228e7
mov eax, 1
jmp 0x140022a02
lea rax, str.MicrosoftPCHealthErrorReportingDW
or rdx, 0xffffffffffffffff
lea r9, str.HKCUSoftware
mov qword [rsp + 0x20], rax
lea r8, [0x14018b12c]
lea rcx, [rsp + 0x70]
call fcn.140003d50
mov rax, qword [0x1401e3d40]
test rax, rax
je 0x14002294e
cmp byte [rax], 0
je 0x14002294e
mov r8d, 0x104
lea rdx, [rsp + 0x70]
lea rcx, [0x14018a3a4]
call fcn.1400334ec
mov rcx, qword [0x1401e3d40]
lea rdx, [rsp + 0x70]
mov r8d, 0x104
call fcn.1400334ec
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.14003f510
test eax, eax
je 0x140022a00
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
xor r9d, r9d
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140022a00
mov rdx, qword [0x1401e3d48]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
mov r9d, 4
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140022a00
mov eax, dword [rsp + 0x50]
and dword [0x1401e3d3c], 0
mov dword [0x1401e3d30], eax
mov eax, 1
mov dword [0x1401e3d28], eax
mov dword [0x1401e3d38], 4
jmp 0x140022a02
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14012e400
add rsp, 0x190
pop rbp
ret
Function at 0x140022a1c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1401e3028]
xor rax, rsp
mov qword [rbp + 0x80], rax
cmp dword [0x1401e3cb0], 0
mov dword [rsp + 0x50], r8d
je 0x140022a63
cmp dword [0x1401e3cb8], r8d
jne 0x140022a63
mov eax, 1
jmp 0x140022bab
mov r8, rcx
or rbx, 0xffffffffffffffff
mov r9, rbx
lea rcx, [rsp + 0x70]
mov edx, 0x104
call fcn.14014f790
mov rax, qword [0x1401e3cc8]
test rax, rax
je 0x140022abb
cmp byte [rax], 0
je 0x140022abb
mov r8d, 0x104
lea rdx, [rsp + 0x70]
lea rcx, [0x14018a3a4]
call fcn.1400334ec
mov rcx, qword [0x1401e3cc8]
lea rdx, [rsp + 0x70]
mov r8d, 0x104
call fcn.1400334ec
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.14003f510
test eax, eax
je 0x140022ba9
mov rdx, qword [rsp + 0x58]
test rdx, rdx
jne 0x140022ae5
xor ebx, ebx
jmp 0x140022b03
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140022ae5
movsxd rbx, ebx
add rbx, rdx
jmp 0x140022afe
cmp byte [rbx], 0x5c
je 0x140022b0c
dec rbx
cmp rbx, rdx
ja 0x140022af6
cmp byte [rbx], 0x5c
jne 0x140022ba9
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], 0
mov byte [rbx], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140022ba9
mov rdx, qword [0x1401e3cd0]
test rdx, rdx
je 0x140022b57
cmp byte [rdx], al
jne 0x140022b5b
lea rdx, [rbx + 1]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov ebx, 4
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov r9d, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140022ba9
mov eax, dword [rsp + 0x50]
and dword [0x1401e3cc4], 0
mov dword [0x1401e3cb8], eax
mov dword [0x1401e3cc0], ebx
mov dword [0x1401e3cb0], 1
jmp 0x140022a59
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14012e400
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x190
pop rbp
ret

Function at 0x140022bcc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
cmp dword [0x14024b534], ebx
je 0x140022bee
cmp word [0x140231400], bx
setne bl
mov eax, ebx
jmp 0x140022c40
lea rdi, [0x140231400]
mov dword [0x14024b534], 1
mov rdx, rdi
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140022c37
mov rcx, rdi
call fcn.140025e70
cmp rax, rdi
je 0x140022c27
cmp word [rax + 2], bx
jne 0x140022c27
mov word [rax], bx
call fcn.140024e98
test eax, eax
je 0x140022c37
mov eax, 1
jmp 0x140022c40
mov word [0x140231400], bx
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret