joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c9e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push r15
sub rsp, 0x570
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r14
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rsp + 0x560], rax
mov r15d, r8d
mov rsi, rdx
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x60], rbx
mov r9d, 0x2001f
lea r8, str.SOFTWAREDigitalPersonaDBNameIndex
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.14000bad4
test eax, 0x1fff0000
je 0x14001ca64
cmp eax, 0x80000000
jb 0x14001ca7b
mov ecx, eax
call fcn.140032390
test eax, eax
je 0x14001ca7b
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x350]
call fcn.140034b00
mov dword [rsp + 0x40], 0x104
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x140]
call fcn.140034b00
mov dword [rsp + 0x44], 0x104
mov dword [rsp + 0x4c], ebx
mov r14d, ebx
mov dword [rsp + 0x48], ebx
mov edx, r14d
inc r14d
mov dword [rsp + 0x48], r14d
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x350]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x14001cbc9
mov dword [rsp + 0x40], 0x104
mov dword [rsp + 0x44], 0x104
test r15d, r15d
je 0x14001cb75
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0xa0]
call fcn.140002f30
nop
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0xc8]
call fcn.140002f30
nop
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.1400134d8
nop
lea rcx, [rsp + 0xa0]
jmp 0x14001cbbf
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0xf0]
call fcn.140002f30
nop
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x118]
call fcn.140002f30
nop
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.1400134d8
nop
lea rcx, [rsp + 0xf0]
call fcn.1400150cc
jmp 0x14001cac0
cmp qword [rsp + 0x50], rbx
je 0x14001cbe0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
jmp 0x14001cbea
mov eax, ebx
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.140033cb0
lea r11, [rsp + 0x570]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x14001cd44
Capabilities:
Get domain trust relationships

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x120
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov r15, rdx
mov r12, rcx
mov r8d, 0xa
lea rdx, str.NETBIOSDomain2DNSDomain
lea rcx, [r11 - 0xa8]
call fcn.14002de00
nop
mov ebx, 0x54b
lea r8, str.Try_to_resolve_trusted_domain_name...
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.140030824
xor sil, sil
and qword [rsp + 0x38], 0
and dword [rsp + 0x34], 0
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x38]
mov edx, 0x22
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_DsEnumerateDomainTrustsW]
test eax, 0x1fff0000
je 0x14001cdea
cmp eax, 0x80000000
jb 0x14001ce01
mov ecx, eax
call fcn.140032390
test eax, eax
je 0x14001ce01
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
xor edi, edi
mov dword [rsp + 0x40], edi
cmp edi, dword [rsp + 0x34]
jae 0x14001ce72
mov eax, edi
imul r14, rax, 0x38
mov r9, qword [rsp + 0x38]
mov rax, qword [r14 + r9 + 8]
mov qword [rsp + 0x20], rax
mov r9, qword [r14 + r9]
lea r8, str.NetBios__ls__DNS__ls
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.140030824
mov rdx, qword [rsp + 0x38]
mov rdx, qword [r14 + rdx]
mov rcx, r12
call fcn.140011c90
test eax, eax
jne 0x14001ce6e
mov rdx, r15
mov rcx, qword [rsp + 0x38]
mov rcx, qword [r14 + rcx + 8]
call fcn.1400179e4
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov sil, 1
jmp 0x14001ce72
inc edi
jmp 0x14001ce03
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001ce81
call sub.NETAPI32.dll_NetApiBufferFree
test sil, sil
jne 0x14001cf45
mov esi, 2
mov edx, esi
lea rcx, [rsp + 0x58]
call fcn.140013f04
nop
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x78]
call fcn.1400149d8
nop
cmp qword [rax + 0x20], 8
jb 0x14001ceb9
mov rdx, qword [rax + 8]
jmp 0x14001cebd
lea rdx, [rax + 8]
mov rcx, r12
call fcn.140011c90
test eax, eax
sete dil
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x78]
call fcn.140011b58
nop
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, qword [rsp + 0x78]
call fcn.140011434
and qword [rsp + 0x78], 0
test dil, dil
je 0x14001cf3a
lea r8, str.Found_computer_domain___
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.140030824
mov edx, esi
lea rcx, [rsp + 0x48]
call fcn.140014028
nop
mov rdx, r15
mov rcx, qword [rsp + 0x50]
call fcn.1400179e4
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x48]
call fcn.140015058
nop
lea rcx, [rsp + 0x58]
call fcn.140015058
nop
jmp 0x14001cf4b
mov r8d, ebx
lea rdx, [0x14004ee5e]
lea rcx, [rsp + 0xa0]
call fcn.140030b9c
nop
lea rcx, [rsp + 0xa0]
call fcn.14002e7a8
test ebx, ebx
mov eax, 0x8007054b
js 0x14001cf7b
mov eax, ebx
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140033cb0
mov rbx, qword [rsp + 0x160]
add rsp, 0x120
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14001db9c
Capabilities:
Get user security identifier

Disassembly:
push rbp
push rdi
push r15
sub rsp, 0x110
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov qword [rbp + 0x100], rbx
mov qword [rbp + 0x108], rsi
mov rax, qword [0x140078790]
xor rax, rbp
mov qword [rbp + 0xc0], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x20], rdx
mov r8d, 0xa
lea rdx, str.SamToSid
lea rcx, [rbp + 0x50]
call fcn.14002de00
nop
and dword [rbp], 0
and dword [rbp + 8], 0
lea rax, [rbp + 0xc]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rbp]
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
cmp dword [rbp], 0
jne 0x14001dc63
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x1fff0000
je 0x14001dc4c
cmp eax, 0x80000000
jb 0x14001dc63
mov ecx, eax
call fcn.140032390
test eax, eax
je 0x14001dc63
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
mov eax, dword [rbp]
lea rcx, [rax + 0xf]
movabs rdx, 0xffffffffffffff0
cmp rcx, rax
ja 0x14001dc7c
mov rcx, rdx
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140033c40
sub rsp, rcx
lea r15, [rsp + 0x40]
mov r8d, dword [rbp + 8]
inc r8d
add r8, r8
lea rax, [r8 + 0xf]
cmp rax, r8
ja 0x14001dca6
mov rax, rdx
and rax, 0xfffffffffffffff0
call fcn.140033c40
sub rsp, rax
lea rbx, [rsp + 0x40]
xor edx, edx
mov rcx, rbx
call fcn.140034b00
lea rax, [rbp + 0xc]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp]
mov r8, r15
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x14001dd20
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x1fff0000
je 0x14001dd09
cmp eax, 0x80000000
jb 0x14001dd20
mov ecx, eax
call fcn.140032390
test eax, eax
je 0x14001dd20
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
and qword [rbp + 0x10], 0
lea rdx, [rbp + 0x10]
mov rcx, r15
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
jne 0x14001dd67
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x1fff0000
je 0x14001dd50
cmp eax, 0x80000000
jb 0x14001dd67
mov ecx, eax
call fcn.140032390
test eax, eax
je 0x14001dd67
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
mov rdx, rsi
mov rcx, qword [rbp + 0x10]
call fcn.1400179e4
mov ebx, eax
mov dword [rbp + 4], eax
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
jmp 0x14001dd90
mov r8d, ebx
lea rdx, [0x14004ee5e]
lea rcx, [rbp + 0x50]
call fcn.140030b9c
test ebx, ebx
jns 0x14001ddb4
mov rdx, rsi
mov rcx, rdi
call fcn.14001b3e0
mov ebx, eax
cmp ebx, 0x80070534
jne 0x14001ddc3
mov ebx, 0x2118
jmp 0x14001ddcc
test ebx, ebx
jns 0x14001ddcc
mov ebx, 0x8007054b
lea rcx, [rbp + 0x50]
call fcn.14002e7a8
mov eax, ebx
mov rcx, qword [rbp + 0xc0]
xor rcx, rbp
call fcn.140033cb0
mov rbx, qword [rbp + 0x100]
mov rsi, qword [rbp + 0x108]
lea rsp, [rbp + 0xd0]
pop r15
pop rdi
pop rbp
ret
Function at 0x140020810
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xe8
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rbp - 9], rax
mov r13d, r9d
mov r12d, r8d
mov rsi, rcx
mov qword [rsp + 0x50], rdx
mov rbx, qword [rbp + 0x77]
mov r15, qword [rbp + 0x7f]
mov r8d, 0xa
lea rdx, str.CDPTranslateNameFunc::CDPTranslateNameFunc
lea rcx, [rbp - 0x79]
call fcn.14002de00
nop
mov rcx, rsi
call fcn.14001c878
test al, al
je 0x140020883
mov edi, 0x8007054b
jmp 0x1400209dc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
and qword [rsp + 0x48], 0
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [rsi]
mov edi, eax
test eax, eax
jne 0x14002099a
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002099a
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, r13d
mov r8d, r12d
xor edx, edx
call qword [rsi + 0x10]
mov edi, eax
test eax, eax
jne 0x14002095c
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x14002095c
mov rax, qword [rax + 8]
mov r9d, dword [rax]
lea r8, str.Name_cracked__Status__d
xor edx, edx
lea rcx, [rbp - 0x79]
call fcn.140030824
mov rax, qword [rsp + 0x40]
mov r8, qword [rax + 8]
cmp dword [r8], edi
jne 0x14002093b
mov edx, dword [r15]
or r9, 0xffffffffffffffff
mov r8, qword [r8 + 0x10]
mov rcx, rbx
call fcn.140037eb8
mov rcx, rbx
call fcn.140037f9c
inc eax
mov dword [r15], eax
jmp 0x140020952
lea r8, str.Name_cannot_be_translated...
xor edx, edx
lea rcx, [rbp - 0x79]
call fcn.140030824
mov edi, 0x2118
mov rcx, qword [rsp + 0x40]
call qword [rsi + 0x18]
jmp 0x140020990
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, r14d
mov dword [rsp + 0x20], ebx
mov r9d, edi
lea r8, str.Cannot_Crack_name._Error__d__Time__d
xor edx, edx
lea rcx, [rbp - 0x79]
call fcn.140030824
cmp ebx, 0x3e8
jbe 0x140020990
mov rcx, rsi
call fcn.14001d18c
lea rcx, [rsp + 0x48]
call qword [rsi + VariantCopy]
jmp 0x1400209c4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r14d
mov dword [rsp + 0x20], eax
mov r9d, edi
lea r8, str.Cannot_bind_to_DS._Error__d__Time__d
xor edx, edx
lea rcx, [rbp - 0x79]
call fcn.140030824
mov rcx, rsi
call fcn.14001d18c
test edi, 0x1fff0000
jne 0x1400209dc
movzx ecx, di
or ecx, 0x80070000
test edi, edi
cmovle ecx, edi
mov edi, ecx
lea rcx, [rbp - 0x79]
call fcn.14002e7a8
mov eax, edi
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.140033cb0
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14002cccc
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x130
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor r8d, r8d
lea rdx, str.::GetHostKey
lea rcx, [r11 - 0x88]
call fcn.14002de00
nop
xor edi, edi
mov dword [rsp + 0x30], edi
call fcn.1400290dc
test eax, eax
jns 0x14002cd2f
mov ecx, eax
call fcn.140032390
lea r8, str.TPM_is_supported...
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.140030824
lea rsi, vtable.CCryptBlob_struct__CRYPTOAPI_BLOB__class__heap_allocator_.0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], edi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002cd6e
call fcn.140009660
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], edi
lea rcx, [rsp + 0x40]
call fcn.14002d044
test eax, eax
jns 0x14002cd8c
mov ecx, eax
call fcn.140032390
mov r9d, dword [rsp + 0x40]
lea r8, str.Got_private_key_from_TPM__size__d
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.140030824
cmp dword [rsp + 0x40], edi
je 0x14002cdb8
cmp qword [rsp + 0x48], rdi
je 0x14002cdb8
mov eax, edi
jmp 0x14002cdbd
mov eax, 1
test al, al
je 0x14002cdcb
mov ecx, 0x80090005
call fcn.140032390
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14002cdf6
call fcn.140007048
jmp 0x14002cdf8
mov eax, edi
test eax, eax
jns 0x14002ce03
mov ecx, eax
call fcn.140032390
mov qword [rsp + 0x80], rdi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x14002ce5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x1fff0000
je 0x14002ce4a
mov ecx, eax
call fcn.140032390
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
lea r8, str.Import_key_to_DPHost_container...
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.140030824
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
nop
mov qword [rsp + 0x38], rsi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002ce96
call fcn.140009660
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], edi
mov r8d, dword [rsp + 0x30]
lea rdx, [0x14004ee5e]
lea rcx, [rsp + 0xb0]
call fcn.140030b9c
nop
lea rcx, [rsp + 0xb0]
call fcn.14002e7a8
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140033cb0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002e664
Capabilities:
Get file size
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x60
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rbx, rcx
lea rax, vtable.DPTraceNS::COutput.0
mov qword [rcx], rax
lea rax, vtable.DPTraceNS::CLogFileOutput.0
mov qword [rcx], rax
xor edx, edx
lea rcx, [r11 - 0x20]
call fcn.14002dfe4
nop
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x48]
call fcn.14002f4ac
test al, al
jne 0x14002e6b6
jmp 0x14002e73c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x14002e73c
and dword [rsp + 0x78], 0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rbx + 8]
test eax, eax
jne 0x14002e72a
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
lea r8d, [rax + 2]
lea rdx, [0x140058070]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14002e73c
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002e752
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
and dword [rsp + 0x50], 0
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x14002ed00
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x250
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x30]
call fcn.140034b00
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x30]
call fcn.140037f9c
cmp word [rsp + rax*2 + 0x2e], 0x5c
je 0x14002ed85
or r9, 0xffffffffffffffff
lea r8, [0x140054958]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14003b03c
xor ebx, ebx
mov word [rsp + 0x236], bx
lea r8, str.dpappver.dll
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140037dd0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14002edcf
lea rdx, str.HeapDetectionStart
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002edcf
mov rcx, rdi
call rax
nop
mov eax, 1
jmp 0x14002edcf
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140033cb0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x14002f73c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
cmp eax, dword [0x14007a9d4]
jbe 0x14002f879
xor edx, edx
lea rcx, [rbp - 0x18]
call fcn.14002dfe4
nop
xor r14d, r14d
mov ebx, r14d
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14002f816
mov dword [rbp + 0x30], r14d
lea ebx, [r14 + 4]
mov dword [rbp + 0x38], ebx
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x40]
xor r8d, r8d
lea rdx, str.TraceToFile
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002f7c9
cmp dword [rbp + 0x40], ebx
jne 0x14002f7c9
mov eax, r14d
test eax, eax
mov eax, dword [rbp + 0x30]
je 0x14002f7ce
mov eax, 1
cmp eax, 1
cmovne ebx, r14d
lea rcx, [rbp - 0x18]
call fcn.1400300ac
test al, al
je 0x14002f7e5
or ebx, 8
lea rcx, [rbp - 0x18]
call fcn.140030048
test al, al
je 0x14002f7f5
or ebx, 0x20
lea rcx, [rbp - 0x18]
call fcn.14002ff60
test al, al
je 0x14002f806
bts ebx, 7
lea rcx, [rbp - 0x18]
call fcn.14002ffd4
test al, al
je 0x14002f816
or ebx, 0x40
cmp ebx, dword [0x140078754]
je 0x14002f856
lea rsi, [0x14007ac18]
mov qword [rbp - 0x28], rsi
mov byte [rbp - 0x20], r14b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rbp - 0x20], 1
xor ecx, ecx
call fcn.14002f0cc
mov ecx, ebx
call fcn.14002f920
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rbp - 0x20], r14b
lea eax, [rdi + 0x7530]
xchg dword [0x14007a9d4], eax
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14002f875
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14002fbc4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov rax, qword [0x14007a9c0]
test rax, rax
jne 0x14002fcea
xor edx, edx
lea rcx, [rbp - 0x18]
call fcn.14002dfe4
nop
lea rcx, [rbp - 0x18]
call fcn.140030048
test al, al
jne 0x14002fc2a
mov ecx, 8
call fcn.1400331b4
mov qword [rbp + 0x10], rax
test rax, rax
je 0x14002fc25
lea rcx, vtable.DPTraceNS::COutput.0
mov qword [rax], rcx
lea rcx, vtable.DPTraceNS::CNoOutput.0
mov qword [rax], rcx
jmp 0x14002fcc4
and dword [rbp + 0x10], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14002fc75
mov dword [rbp + 0x18], 4
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
lea rdx, str.TraceToFile
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002fc75
cmp dword [rbp + 0x20], 4
jne 0x14002fc75
test eax, eax
mov eax, dword [rbp + 0x10]
je 0x14002fc7a
mov eax, 1
cmp eax, 1
jne 0x14002fc9d
mov ecx, 0x220
call fcn.1400331b4
mov qword [rbp + 0x10], rax
test rax, rax
je 0x14002fc9b
mov rcx, rax
call fcn.14002e108
nop
jmp 0x14002fcc4
mov ecx, 8
call fcn.1400331b4
mov qword [rbp + 0x10], rax
test rax, rax
je 0x14002fcc4
lea rcx, vtable.DPTraceNS::COutput.0
mov qword [rax], rcx
lea rcx, vtable.DPTraceNS::CNoOutput.0
mov qword [rax], rcx
mov qword [0x14007a9c0], rax
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14002fcdf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x18], 0
and dword [rbp - 0x10], 0
mov rax, qword [0x14007a9c0]
add rsp, 0x50
pop rbp
ret

Function at 0x14002fcf0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
and qword [rbp - 0x18], 0
and dword [rbp - 0x10], 0
and qword [rbp - 8], 0
xor edi, edi
mov r9d, 0x20019
lea r8, str.SOFTWAREPoliciesDigitalPersonaAltus
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x18]
call fcn.14000bad4
mov rbx, qword [rbp - 0x18]
test eax, eax
jne 0x14002fd9c
mov dword [rbp + 0x20], 1
mov dword [rbp + 0x28], 4
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
xor r8d, r8d
lea rdx, str.NetworkSupport
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002fd84
cmp dword [rbp + 0x30], 4
jne 0x14002fd84
test eax, eax
jne 0x14002fd84
cmp dword [rbp + 0x20], edi
sete dil
test rbx, rbx
je 0x14002fd98
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov qword [rbp - 0x18], rbx
and dword [rbp - 0x10], 0
test rbx, rbx
je 0x14002fdaf
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x18], 0
and dword [rbp - 0x10], 0
mov eax, edi
add rsp, 0x50
pop rdi
pop rbx
pop rbp
ret
Function at 0x14002ff60
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x30
xor ebx, ebx
mov dword [rsp + 0x40], ebx
cmp qword [rcx], rbx
je 0x14002ffbc
mov rcx, qword [rcx]
lea rax, [r11 + 0x10]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x18]
lea rax, [r11 + 8]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [r11 - 0x18], rax
lea rdx, str.DoLog
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ffbc
cmp dword [rsp + 0x50], 4
jne 0x14002ffbc
mov eax, ebx
test eax, eax
jne 0x14002ffbc
cmp dword [rsp + 0x40], ebx
seta al
jmp 0x14002ffbe
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x14002ffd4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x30
xor ebx, ebx
mov dword [rsp + 0x40], ebx
cmp qword [rcx], rbx
je 0x140030030
mov rcx, qword [rcx]
lea rax, [r11 + 0x10]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x18]
lea rax, [r11 + 8]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [r11 - 0x18], rax
lea rdx, str.DoProfiling
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140030030
cmp dword [rsp + 0x50], 4
jne 0x140030030
mov eax, ebx
test eax, eax
jne 0x140030030
cmp dword [rsp + 0x40], ebx
seta al
jmp 0x140030032
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x140030048
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x30
xor ebx, ebx
mov dword [rsp + 0x40], ebx
cmp qword [rcx], rbx
je 0x1400300a4
mov rcx, qword [rcx]
lea rax, [r11 + 0x10]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x18]
lea rax, [r11 + 8]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [r11 - 0x18], rax
lea rdx, str.DoTrace
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400300a4
cmp dword [rsp + 0x50], 4
jne 0x1400300a4
mov eax, ebx
test eax, eax
jne 0x1400300a4
cmp dword [rsp + 0x40], ebx
seta al
jmp 0x1400300a6
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x1400300ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x30
xor ebx, ebx
mov dword [rsp + 0x40], ebx
cmp qword [rcx], rbx
je 0x140030108
mov rcx, qword [rcx]
lea rax, [r11 + 0x10]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x18]
lea rax, [r11 + 8]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [r11 - 0x18], rax
lea rdx, str.NewFileAlways
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140030108
cmp dword [rsp + 0x50], 4
jne 0x140030108
mov eax, ebx
test eax, eax
jne 0x140030108
cmp dword [rsp + 0x40], ebx
seta al
jmp 0x14003010a
mov al, 1
add rsp, 0x30
pop rbx
ret