joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010c28
Capabilities:
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov rdi, rcx
call sym.__pth_gpointer_locked
mov rbx, rax
test rax, rax
je 0x140010dcd
mov rcx, qword [rax + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140010dcd
lea rbp, [rsp + 0x20]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140010dcd
lea rsi, [rbx + 0x38]
mov rcx, rsi
call sym.pthread_mutex_lock
call sym.pthread_self
cmp rax, rdi
mov al, byte [rbx + 0x40]
jne 0x140010cda
test al, 3
jne 0x140010cec
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock inc dword [0x1400a1d48]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140010cab
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
not edx
and dl, 3
jne 0x140010dc0
and eax, 0xfffffffe
mov rcx, rsi
mov dword [rbx + 0x44], eax
mov al, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call sym.pthread_mutex_unlock
call sym._pthread_invoke_cancel
mov edx, dword [rbx + 0x44]
not edx
and dl, 3
jne 0x140010d99
test al, 0xc
je 0x140010d05
mov rcx, rsi
call sym.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
jne 0x140010dcd
xor eax, eax
jmp 0x140010dd2
test al, 0xf
jne 0x140010dcd
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140010dc0
mov rcx, qword [rbx + 0x28]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [sym._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, rbp
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov al, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock inc dword [0x1400a1d48]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140010d85
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call sym.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140010dc0
test al, 3
jne 0x140010cec
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock inc dword [0x1400a1d48]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140010dc0
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call sym.pthread_mutex_unlock
jmp 0x140010cfe
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140010dde
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140073138]
mov rsi, rcx
mov rcx, rdi
mov ebx, edx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
test rax, rax
je 0x140010e2b
cmp qword [rax + 0x1d8], rsi
jne 0x140010e2b
test byte [rax + 0x40], 0xc
jne 0x140010e2b
cmp dword [rax + 0xbc], 0
jne 0x140010e2b
mov rax, qword [rax + 0x28]
dec rax
cmp rax, 0xfffffffffffffffd
jbe 0x140010e3a
mov rcx, rdi
mov ebx, 3
call sym.pthread_mutex_unlock
jmp 0x140010e62
mov rcx, rdi
call sym.pthread_mutex_unlock
test ebx, ebx
je 0x140010e62
sub ebx, 2
cmp ebx, 0x15
ja 0x140010e5d
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
mov ebx, 0x16
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x14001102b
Capabilities:
Create thread
Resume thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rsi, rdx
mov rbp, r8
mov r12, r9
call sym.pop_pthread_mem
mov rbx, rax
test rax, rax
je 0x1400110ff
test rdi, rdi
je 0x140011061
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
xor r11d, r11d
mov dword [rbx + 0x44], 1
mov dword [rbx + 0xbc], r11d
mov qword [rbx + 0x28], 0xffffffffffffffff
mov qword [rbx + 8], r12
mov r12, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rbp
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call r12
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x1400110ba
mov eax, ebp
neg eax
sbb ecx, ecx
inc ebp
and ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebp, 5
jne 0x14001108b
mov qword [rbx + 0x38], 0xffffffffffffffff
lea r12, [rbx + 0x68]
mov rcx, r12
call sym.replace_spin_keys.constprop.0
xor r10d, r10d
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xc0], r10d
mov dword [rbx + 0xb8], r10d
jne 0x140011109
test rdi, rdi
je 0x1400110f7
xor r9d, r9d
mov qword [rdi], r9
mov rcx, rbx
call sym.push_pthread_mem
mov eax, 0xb
jmp 0x14001120c
xor ebp, ebp
test rsi, rsi
je 0x140011135
mov eax, dword [rsi]
mov rbp, qword [rsi + 0x10]
mov dword [rbx + 0x44], eax
test al, 8
je 0x140011130
call sym.__pthread_self_lite
mov eax, dword [rax + 0xc0]
mov dword [rbx + 0xc0], eax
jmp 0x140011135
mov eax, dword [rsi + 0x18]
jmp 0x140011128
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov r9, rbx
mov edx, ebp
mov qword [rsp + 0x28], r8
xor ecx, ecx
lea r8, [sym.pthread_create_wrapper]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x140011195
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140011175
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call sym.pthread_mutex_destroy
mov rcx, r12
call sym.replace_spin_keys.constprop.0
xor ecx, ecx
mov qword [rbx + 0x30], rcx
mov qword [rbx + 0x28], rcx
jmp 0x1400110ec
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jl 0x1400111c3
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x1400111c3
mov edx, 0xf
cmp eax, 0xe
jg 0x1400111c3
mov edx, 2
cmp eax, edx
cmovle edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
je 0x1400111f9
xor edx, edx
mov rcx, rsi
mov qword [rbx + 0x28], rdx
call rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140011202
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140015f30
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
or edx, 0xffffffff
test rax, rax
jle 0x140015f5a
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x14004eee0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov rcx, rbx
call method.std::__basic_file_char_.fd__
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call sym.read
movsxd rbp, eax
inc eax
jne 0x14004ef18
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 4
je 0x14004eef1
mov rax, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14005ab30
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x14005ab50
mov rcx, qword [rcx]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp rax
mov esi, 4
lea rdi, [rsp + 0x2c]
mov ecx, dword [rbx + 0x10]
mov r8d, esi
mov rdx, rdi
call sym.read
test eax, eax
jle 0x14005ab82
cdqe
add rdi, rax
sub rsi, rax
jne 0x14005ab5a
mov eax, dword [rsp + 0x2c]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
inc eax
je 0x14005ab92
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 4
je 0x14005ab5a
jmp 0x14005ab86
Function at 0x14005f4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [rcx]
mov rbx, rdx
mov eax, ecx
not eax
test ax, 0x101
jne 0x14005f4e0
add dword [rdx + 8], 0xc
mov r9b, byte [rsi]
test r9b, r9b
jns 0x14005f50b
xor edx, edx
test byte [rsi + 1], 2
je 0x14005f4fd
mov eax, dword [rbx + 0x14]
mov r8d, 0x64
cdq
idiv r8d
mov eax, dword [rsi + 4]
sub eax, 0x13
imul eax, eax, 0x64
add eax, edx
mov dword [rbx + 0x14], eax
and cx, 0x402
cmp cx, 0x400
jne 0x14005f5b6
mov eax, r9d
not eax
test al, 0x18
je 0x14005f59a
test r9d, 4
je 0x14005f59a
mov eax, dword [rbx + 0x14]
lea r11, [0x14007b920]
xor r10d, r10d
lea ecx, [rax + 0x76c]
call method.std._anonymous_namespace_::is_leap_int_
mov ecx, dword [rbx + 0x1c]
mov r8, rax
neg r8
and r8d, 0x1a
add r8, r11
movzx edi, word [r8 + r10*2]
mov rdx, r10
lea r10, [r10 + 1]
cmp edi, ecx
jle 0x14005f555
test r9d, 8
jne 0x14005f576
lea r8d, [rdx - 1]
mov dword [rbx + 0x10], r8d
and r9d, 0x10
jne 0x14005f597
movzx eax, al
dec edx
imul rax, rax, 0xd
movsxd rdx, edx
add rax, rdx
movzx eax, word [r11 + rax*2]
sub ecx, eax
inc ecx
mov dword [rbx + 0xc], ecx
or byte [rsi], 0x18
mov edx, dword [rbx + 0x10]
test byte [rsi], 8
jne 0x14005f5a7
cmp edx, 0xb
ja 0x14005f5b6
mov ecx, dword [rbx + 0x14]
mov r8d, dword [rbx + 0xc]
call method.std._anonymous_namespace_::day_of_the_week_int__int__int_
mov dword [rbx + 0x18], eax
mov eax, dword [rsi]
mov dil, byte [rsi]
and ax, 0x404
cmp ax, 0x400
jne 0x14005f604
movsxd r9, dword [rbx + 0x10]
test edi, 8
jne 0x14005f5d7
cmp r9d, 0xb
ja 0x14005f604
mov eax, dword [rbx + 0x14]
lea ecx, [rax + 0x76c]
call method.std._anonymous_namespace_::is_leap_int_
lea rcx, [0x14007b920]
mov edx, dword [rbx + 0xc]
movzx eax, al
imul rax, rax, 0xd
add rax, r9
movzx eax, word [rcx + rax*2]
lea eax, [rdx + rax - 1]
mov dword [rbx + 0x1c], eax
test edi, 0x60
je 0x14005f6e7
test edi, 2
je 0x14005f6e7
mov ebp, dword [rbx + 0x14]
test edi, 4
jne 0x14005f679
mov r12d, edi
mov r8d, 1
xor edx, edx
mov ecx, ebp
call method.std._anonymous_namespace_::day_of_the_week_int__int__int_
shr r12b, 5
mov r8d, 7
xor r12d, 1
and r12d, 1
sub eax, r12d
mov edx, eax
mov eax, r8d
sub eax, edx
cdq
idiv r8d
mov al, byte [rsi + 2]
and eax, 0x3f
dec eax
imul eax, eax, 7
lea ecx, [rdx + rax]
mov eax, dword [rbx + 0x18]
sub eax, r12d
add eax, 7
cdq
idiv r8d
add ecx, edx
mov dword [rbx + 0x1c], ecx
mov eax, edi
not eax
test al, 0x18
je 0x14005f6e7
lea ecx, [rbp + 0x76c]
lea r10, [0x14007b920]
xor r9d, r9d
call method.std._anonymous_namespace_::is_leap_int_
mov ecx, dword [rbx + 0x1c]
mov r8, rax
neg r8
and r8d, 0x1a
add r8, r10
movzx r11d, word [r8 + r9*2]
mov rdx, r9
lea r9, [r9 + 1]
cmp r11d, ecx
jle 0x14005f6a6
test edi, 8
jne 0x14005f6c7
lea r8d, [rdx - 1]
mov dword [rbx + 0x10], r8d
and edi, 0x10
jne 0x14005f6e7
movzx eax, al
dec edx
imul rax, rax, 0xd
movsxd rdx, edx
add rax, rdx
movzx eax, word [r10 + rax*2]
sub ecx, eax
inc ecx
mov dword [rbx + 0xc], ecx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140072970
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
xor edx, edx
lea rcx, [0x140073780]
call sym.pthread_mutex_init
xor r8d, r8d
lea rbp, [rsp + 0x40]
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x140073788], r8
mov qword [0x140073790], r8
mov qword [0x140073798], r8
call sym.getenv
xor r9d, r9d
mov dword [rsp + 0x78], 0x100
mov rbx, rax
lea rax, str.glibcxx.eh_pool
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x48], rax
lea rax, str.obj_size
mov qword [rsp + 0x58], rax
lea rax, str.obj_count
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x50], 8
mov qword [rsp + 0x68], 9
mov qword [rsp + 0x70], rax
test rbx, rbx
je 0x140072ab7
cmp byte [rbx], 0x3a
jne 0x140072a15
inc rbx
xor edx, edx
mov r9, rbx
mov r8d, 0xf
mov rcx, rbp
mov qword [rsp + 0x20], 0xf
call method.std::basic_string_view_char__std::char_traits_char___.compare_unsigned_long_long__unsigned_long_long__char_const__unsigned_long_long__const
test eax, eax
jne 0x140072aa2
cmp byte [rbx + 0xf], 0x2e
jne 0x140072aa2
add rbx, 0x10
lea rsi, [rsp + 0x50]
mov rdi, qword [rsi]
xor edx, edx
mov r9, rbx
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r8, rdi
call method.std::basic_string_view_char__std::char_traits_char___.compare_unsigned_long_long__unsigned_long_long__char_const__unsigned_long_long__const
test eax, eax
jne 0x140072a66
cmp byte [rbx + rdi], 0x3d
je 0x140072a79
add rsi, 0x18
lea rax, [rsp + 0x80]
cmp rsi, rax
je 0x140072aa2
jmp 0x140072a44
lea rdx, [rsp + 0x38]
lea rcx, [rbx + rdi + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x38]
mov dl, byte [rbx]
cmp dl, 0x3a
je 0x140072a9b
test dl, dl
jne 0x140072aa2
test eax, eax
js 0x140072aa2
mov dword [rsi + 0x10], eax
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
jmp 0x140072a04
mov eax, dword [rsp + 0x78]
mov edx, 0x1000
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x60]
test eax, eax
jne 0x140072ad2
mov eax, 6
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x140073798], rbx
je 0x140072b1c
mov rcx, rbx
call sym.malloc
mov qword [0x140073790], rax
test rax, rax
jne 0x140072b0c
xor ecx, ecx
mov qword [0x140073798], rcx
jmp 0x140072b1c
xor edx, edx
mov qword [0x140073788], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
lea rcx, [sym.__tcf_0_1]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.atexit
Function at 0x140007e44
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007e8e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007e8e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007e8e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007e8e
cmp dword [rcx + 0x84], 0xe
jbe 0x140007e8e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140007e90
xor al, al
add rsp, 0x28
ret

Function at 0x14000e640
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000e46c
Function at 0x140018f40
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140018f68
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140018f68
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140003a00
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x140003a15
mov rcx, qword [rcx + 0x30]
call rax
mov rbx, qword [0x14014a4f0]
mov qword [rsp + 0x38], rdi
cmp qword [rbx + 8], 0
je 0x140003a5e
lea rcx, [rbx + 0x18]
call fcn.1400a19b0
test eax, eax
jne 0x140003ac0
lea rcx, [rbx + 0x90]
call fcn.1400a1a84
lea rdx, [rbx + 0x18]
lea rcx, [rbx + 0x90]
call fcn.1400a1a9c
lea rcx, [rbx + 0x18]
call fcn.1400a19d4
cmp qword [0x140144e98], 8
lea rcx, [0x140144e80]
cmovae rcx, qword [0x140144e80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [0x140144f38], 8
lea rcx, [0x140144f20]
cmovae rcx, qword [0x140144f20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [0x140144eb8], 8
lea rcx, [0x140144ea0]
cmovae rcx, qword [0x140144ea0]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, eax
call fcn.1400a16a4
int3
outsd dx, dword [rsi]
add byte [rbp], ch
imul eax, dword [rax], 0x610074
add byte [eax], al
add byte [rdi], ch
add byte [0x140247ac7], ah
add byte [rdx], ah
invalid
add byte [rdx], dh
invalid

Function at 0x140005b40
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov rax, qword [0x140144038]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
test rax, rax
je 0x140005bcc
mov qword [rsp + 0x40], rbp
xor bpl, bpl
cmp dword [rsp + 0x20], ebx
jle 0x140005bba
mov qword [rsp + 0x48], rdi
mov rdi, rsi
mov rcx, qword [rdi]
lea rdx, str.__system_level
call fcn.1400a9404
test eax, eax
je 0x140005bb2
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x20]
jl 0x140005b91
jmp 0x140005bb5
mov bpl, 1
mov rdi, qword [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
movzx eax, bpl
mov rbp, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a23f0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
Function at 0x140005cf0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140144038]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, r9
movzx r14d, cl
movzx esi, cl
shl esi, 9
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
lea rdx, [0x14010f1b0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140005d50
lea rcx, [rsp + 0x58]
call fcn.1400049c0
nop
lea rdx, str.2355FF0C_CD74_421A_8631_57546E824C2D
mov r8, rbx
inc r8
cmp word [rdx + r8*2], 0
jne 0x140005d70
lea rcx, [rsp + 0x58]
call fcn.140008c60
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
or esi, 0x20007
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea rcx, [r14 - 0x7fffffff]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test eax, eax
jne 0x140005e26
nop dword [rax + rax]
lea rbx, [rbx + 1]
cmp word [rdi + rbx*2], bp
jne 0x140005de0
lea rax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
lea r8, [0x14010f138]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov esi, eax
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x140005e90
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, esi
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140005e66
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005ec9
call fcn.1400a2410
mov eax, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a23f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov dword [rsp + 0x28], 0x18
lea rax, str.MSPCManager
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [0x14010f198]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140005e28
call fcn.1400a92b0
int3
Function at 0x140005ed0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140144038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movzx ebp, r9b
mov dword [rsp + 0x58], r8d
movzx esi, cl
movzx edi, cl
shl edi, 9
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rdx, str.SoftwareMicrosoftEdgeUpdateClientState_
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rdx + r8*2], 0
jne 0x140005f25
lea rcx, [rsp + 0x60]
call fcn.1400049c0
nop
lea rdx, str.2355FF0C_CD74_421A_8631_57546E824C2D
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140005f42
mov r8, rbx
lea rcx, [rsp + 0x60]
call fcn.140008c60
test bpl, bpl
jne 0x140005fa9
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r9d, edi
or r9d, 0x20019
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [rsi - 0x7fffffff]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140005f9e
xor ebx, ebx
jmp 0x14000603b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
or edi, 0x20007
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsi - 0x7fffffff]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140006001
mov ebx, eax
jmp 0x14000603b
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.updatefreqhourshint
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140006079
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006074
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000609e
call fcn.1400a2410
mov eax, ebx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400a23f0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a92b0
int3
Function at 0x140007ce0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov r8d, 0x12
lea rdx, str.WindowsMasterSetup
lea rcx, [rsp + 0x60]
call fcn.1400049c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, gethostbyname
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
lea rcx, [rsp + 0x40]
call fcn.1400049c0
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae r8, qword [rsp + 0x60]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, 0xfffffffd
sete bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140007db7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007db2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007e83
call fcn.1400a2410
movdqa xmm0, xmmword [0x140128f10]
movdqu xmmword [rsp + 0x50], xmm0
xor edi, edi
mov word [rsp + 0x40], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140007e0a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007e05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007e7d
call fcn.1400a2410
movdqa xmm0, xmmword [0x140128f10]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], di
lea rax, str.true
lea rcx, str.false
test bl, bl
cmovne rcx, rax
mov qword [rsp + 0x30], rcx
lea rax, str.Delete_RunOnce_Registry_Result:__s
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xce
lea r9, str.EdgeUpdateOptions::DeleteRunOnceRegistry
lea r8, str.D:_a1_sinstaller_cppPCManagerInstallerSetupEdgeUpdateOptions.cpp
mov edx, 4
mov rcx, qword [0x14014a4e8]
call fcn.1400823a0
movzx eax, bl
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
call fcn.1400a92b0
nop
call fcn.1400a92b0
nop
int3