joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006e054
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 8
jb 0x14006e064
mov rcx, qword [r11 + 0x30]
and rcx, r9
mov r9, qword [r11 + 0x18]
add rcx, rcx
mov rax, qword [r9 + rcx*8 + 8]
cmp rax, qword [r11 + 8]
je 0x14006e0b9
mov r10, qword [r9 + rcx*8]
mov rcx, qword [r8]
cmp rcx, qword [rax + 0x10]
je 0x14006e0b4
cmp rax, r10
je 0x14006e0b9
mov rax, qword [rax + 8]
jmp 0x14006e0a3
test rax, rax
jne 0x14006e0bd
mov rax, qword [r11 + 8]
mov qword [rdx], rax
mov rax, rdx
ret

Function at 0x14006f608
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
lea r14, [rcx + 0x18]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
nop
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + rbx]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x14006f64a
mov rax, qword [rbp + 0x88]
and rax, rcx
add rax, rax
mov rcx, qword [rbp + 0x70]
mov rdi, qword [rcx + rax*8 + 8]
cmp rdi, qword [rbp + 0x60]
je 0x14006f698
mov rdx, qword [rcx + rax*8]
mov eax, dword [rbx]
cmp eax, dword [rdi + 0x10]
je 0x14006f6c8
cmp rdi, rdx
jne 0x14006f770
mov rax, qword [rbp + 0x48]
lock inc qword [rax + 0x48]
and qword [rsi], 0
and qword [rsi + 8], 0
test r14, r14
je 0x14006f751
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
nop
jmp 0x14006f751
test rdi, rdi
je 0x14006f698
cmp rdi, qword [rbp + 0x60]
je 0x14006f698
mov rbx, qword [rdi + 0x28]
cmp qword [rbp + 0x40], 0
jne 0x14006f779
mov r8, qword [rbp + 0x98]
mov r9, qword [rbx]
cmp r8, r9
je 0x14006f717
cmp r8, rbx
je 0x14006f717
mov rdx, qword [rbx + 8]
mov qword [rdx], r9
mov rcx, qword [r9 + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [r9 + 8], rdx
mov qword [rbx + 8], rax
mov rax, qword [rbp + 0x48]
lock inc qword [rax + 0x40]
mov rdx, qword [rdi + 0x20]
test rdx, rdx
je 0x14006f731
lock inc dword [rdx + 8]
mov rdx, qword [rdi + 0x20]
mov rax, qword [rdi + 0x18]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
test r14, r14
je 0x14006f751
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
nop
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
mov rdi, qword [rdi + 8]
jmp 0x14006f68a
lea rcx, [rbx + 0x14]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
jmp 0x14006f6e2
Function at 0x140070164
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rdi, rcx
lea rsi, [rcx + 0x18]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov qword [rsp + 0x50], rsi
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
movzx eax, byte [rcx + r14]
xor r9, rax
movabs rdx, 0x100000001b3
imul r9, rdx
inc rcx
cmp rcx, 4
jb 0x1400701a3
mov rax, qword [rdi + 0x88]
and rax, r9
add rax, rax
mov rcx, qword [rdi + 0x70]
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, qword [rdi + 0x60]
je 0x1400701ef
mov rdx, qword [rcx + rax*8]
mov eax, dword [r14]
cmp eax, dword [rbx + 0x10]
je 0x140070251
cmp rbx, rdx
jne 0x14007025e
mov r9, rbp
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14007026c
nop
test rsi, rsi
je 0x14007023d
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
nop
jmp 0x14007023d
mov rdx, qword [rbx + 0x28]
mov rcx, rdi
call fcn.140070c50
lea rcx, [rbx + 0x18]
mov rdx, rbp
call fcn.140070cc0
nop
lea rcx, [rsp + 0x50]
call fcn.140070854
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
test rbx, rbx
je 0x1400701ef
cmp rbx, qword [rdi + 0x60]
je 0x1400701ef
jmp 0x14007021a
mov rbx, qword [rbx + 8]
jmp 0x1400701e5

Function at 0x140070dbc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 4
jb 0x140070dcc
mov rcx, qword [r11 + 0x30]
and rcx, r9
mov r9, qword [r11 + 0x18]
add rcx, rcx
mov rax, qword [r9 + rcx*8 + 8]
cmp rax, qword [r11 + 8]
je 0x140070e15
mov r10, qword [r9 + rcx*8]
mov ecx, dword [r8]
cmp ecx, dword [rax + 0x10]
je 0x140070e21
cmp rax, r10
jne 0x140070e28
mov rax, qword [r11 + 8]
mov qword [rdx], rax
mov rax, rdx
ret
test rax, rax
jne 0x140070e19
jmp 0x140070e15
mov rax, qword [rax + 8]
jmp 0x140070e0b

Function at 0x140071124
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 8
jb 0x140071134
mov rcx, qword [r11 + 0x30]
and rcx, r9
mov r9, qword [r11 + 0x18]
add rcx, rcx
mov rax, qword [r9 + rcx*8 + 8]
cmp rax, qword [r11 + 8]
je 0x14007117e
mov r10, qword [r9 + rcx*8]
mov rcx, qword [r8]
cmp rcx, qword [rax + 0x10]
jne 0x14007118a
test rax, rax
jne 0x140071182
mov rax, qword [r11 + 8]
mov qword [rdx], rax
mov rax, rdx
ret
cmp rax, r10
je 0x14007117e
mov rax, qword [rax + 8]
jmp 0x140071173
Function at 0x140072028
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, r8
mov rdi, rcx
mov rcx, qword [rdx]
test rcx, rcx
je 0x140072043
mov rcx, qword [rcx]
mov edx, 0x2710
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x14007210b
call fcn.1400abad4
cmp dword [rax], 2
jbe 0x1400720a0
lea rcx, str.Failed_to_wait_for_SenseCncProxy_to_become_ready
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x78], 0x80004005
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1404705fc]
mov rcx, rax
call fcn.140004d64
and dword [rsp + 0x68], 0
or edx, 0xffffffff
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
lea rdx, [rsp + 0x68]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
nop dword [rax + rax]
lea rcx, [rsp + 0x38]
call fcn.1402c5254
nop
mov eax, dword [rsp + 0x68]
lea rdx, [rdi + 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 2]
lea rcx, [rsp + 0x38]
call fcn.1402c55b4
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140072104
call fcn.14008a480
mov eax, 0x800705b4
jmp 0x14007210d
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140073a50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, r8
mov rdi, rdx
mov r14, rcx
movabs rbp, 0xcbf29ce484222325
xor ecx, ecx
movzx eax, byte [rcx + r8]
xor rbp, rax
movabs rdx, 0x100000001b3
imul rbp, rdx
inc rcx
cmp rcx, 8
jb 0x140073a81
mov rcx, qword [r14 + 0x30]
and rcx, rbp
add rcx, rcx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
lea r13, [r14 + 8]
mov rsi, qword [r13]
cmp rax, rsi
je 0x140073ae8
mov r8, qword [rdx + rcx*8]
mov rcx, qword [r15]
cmp rcx, qword [rax + 0x10]
je 0x140073ba5
cmp rax, r8
jne 0x140073b9c
mov rsi, rax
xor eax, eax
test rax, rax
jne 0x140073bb6
mov rcx, r14
call fcn.140073bf8
mov qword [rsp + 0x20], r13
and qword [rsp + 0x28], 0
mov ecx, 0x30
call fcn.1400daac0
mov rbx, rax
mov qword [rsp + 0x28], rax
mov rcx, qword [r15]
mov qword [rax + 0x10], rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx + 0x18], xmm0
mov qword [rbx + 0x28], rax
mov rcx, r14
call fcn.140073c2c
test al, al
jne 0x140073bbf
mov rdx, qword [rsi + 8]
inc qword [r14 + 0x10]
mov qword [rbx], rsi
mov qword [rbx + 8], rdx
mov qword [rdx], rbx
mov qword [rsi + 8], rbx
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 0x30]
and rax, rbp
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [r13]
je 0x140073b6a
cmp r8, rsi
jne 0x140073bad
mov qword [rcx + rax*8], rbx
jmp 0x140073b73
mov qword [rcx + rax*8], rbx
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rax, rdi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [rax + 8]
jmp 0x140073ac7
mov rsi, qword [rax]
jmp 0x140073adf
cmp qword [rcx + rax*8 + 8], rdx
je 0x140073b6e
jmp 0x140073b73
mov qword [rdi], rax
mov byte [rdi + 8], 0
jmp 0x140073b7a
mov rcx, r14
call fcn.1403154a4
mov r9, rbp
lea r8, [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1400b6c80
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov rsi, qword [rsp + 0x20]
jmp 0x140073b31
Function at 0x140078c38
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
lea r14, [rcx + 0x18]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
nop
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + rbx]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x140078c7a
mov rax, qword [rbp + 0x88]
and rax, rcx
add rax, rax
mov rcx, qword [rbp + 0x70]
mov rdi, qword [rcx + rax*8 + 8]
cmp rdi, qword [rbp + 0x60]
je 0x140078cd1
mov rdx, qword [rcx + rax*8]
mov rax, qword [rbx]
cmp rax, qword [rdi + 0x10]
je 0x140078ccc
cmp rdi, rdx
je 0x140078cd1
mov rdi, qword [rdi + 8]
jmp 0x140078cbb
test rdi, rdi
jne 0x140078d29
mov rax, qword [rbp + 0x48]
lock inc qword [rax + 0x48]
and qword [rsi], 0
and qword [rsi + 8], 0
test r14, r14
je 0x140078d0a
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
nop
jmp 0x140078d0a
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
nop
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
cmp rdi, qword [rbp + 0x60]
je 0x140078cd1
mov rbx, qword [rdi + 0x28]
cmp qword [rbp + 0x40], 0
jne 0x140078da2
mov r8, qword [rbp + 0x98]
mov r9, qword [rbx]
cmp r8, rbx
je 0x140078d6f
cmp r8, r9
je 0x140078d6f
mov rdx, qword [rbx + 8]
mov qword [rdx], r9
mov rcx, qword [r9 + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [r9 + 8], rdx
mov qword [rbx + 8], rax
mov rax, qword [rbp + 0x48]
lock inc qword [rax + 0x40]
mov rdx, qword [rdi + 0x20]
test rdx, rdx
je 0x140078d89
lock inc dword [rdx + 8]
mov rdx, qword [rdi + 0x20]
mov rax, qword [rdi + 0x18]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
test r14, r14
je 0x140078d0a
jmp 0x140078cfa
lea rcx, [rbx + 0x18]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
jmp 0x140078d3a
Function at 0x14007d1fc
Capabilities:
Compare security identifiers
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov rsi, rdx
mov rbp, rcx
lea r14, [rcx + 0x18]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov qword [rsp + 0x50], r14
mov rbx, qword [r15]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
nop dword [rax + rax]
movabs rcx, 0xcbf29ce484222325
mov r8d, eax
xor edx, edx
test eax, eax
je 0x14007d277
movzx eax, byte [rdx + rbx]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, r8
jb 0x14007d25a
mov rax, qword [rbp + 0x88]
and rax, rcx
add rax, rax
mov rcx, qword [rbp + 0x70]
mov rdi, qword [rcx + rax*8 + 8]
cmp rdi, qword [rbp + 0x60]
je 0x14007d349
mov rbx, qword [rcx + rax*8]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x14007d382
test rdi, rdi
je 0x14007d349
cmp rdi, qword [rbp + 0x60]
je 0x14007d349
mov rbx, qword [rdi + 0x28]
cmp qword [rbp + 0x40], 0
jne 0x14007d390
mov r8, qword [rbp + 0x98]
mov r9, qword [rbx]
cmp r8, rbx
je 0x14007d30d
cmp r8, r9
je 0x14007d30d
mov rdx, qword [rbx + 8]
mov qword [rdx], r9
mov rcx, qword [r9 + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [r9 + 8], rdx
mov qword [rbx + 8], rax
mov rax, qword [rbp + 0x48]
lock inc qword [rax + 0x40]
mov rdx, qword [rdi + 0x20]
test rdx, rdx
je 0x14007d327
lock inc dword [rdx + 8]
mov rdx, qword [rdi + 0x20]
mov rax, qword [rdi + 0x18]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
test r14, r14
je 0x14007d365
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
nop
jmp 0x14007d365
mov rax, qword [rbp + 0x48]
lock inc qword [rax + 0x48]
and qword [rsi], 0
and qword [rsi + 8], 0
lea rcx, [rsp + 0x50]
call fcn.140070854
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
cmp rdi, rbx
je 0x14007d349
mov rdi, qword [rdi + 8]
jmp 0x14007d29b
lea rcx, [rbx + 0x18]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
jmp 0x14007d2d8
Function at 0x1400872c0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs r9, 0x100000001b3
movzx ecx, byte [rdx + 6]
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, r9
xor rax, r8
imul rax, r9
xor rax, rcx
movzx ecx, byte [rdx + 7]
imul rax, r9
xor rax, rcx
imul rax, r9
ret
Function at 0x14008f854
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, qword [r8]
mov r10, rcx
test rax, rax
je 0x14008f8d0
mov r11, qword [rax + 0x40]
movabs r8, 0xcbf29ce484222325
mov qword [rsp + 0x18], r11
xor r9d, r9d
movzx eax, byte [rsp + r9 + 0x18]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 8
jb 0x14008f875
mov rcx, qword [r10 + 0x30]
and rcx, r8
mov r8, qword [r10 + 0x18]
add rcx, rcx
mov rax, qword [r8 + rcx*8 + 8]
cmp rax, qword [r10 + 8]
je 0x14008f8bd
mov r9, qword [r8 + rcx*8]
cmp r11, qword [rax + 0x10]
je 0x14008f8c3
cmp rax, r9
jne 0x14008f8d6
mov rax, qword [r10 + 8]
jmp 0x14008f8c8
test rax, rax
je 0x14008f8bd
mov qword [rdx], rax
mov rax, rdx
ret
mov rax, qword [rcx + 8]
jmp 0x14008f8c8
mov rax, qword [rax + 8]
jmp 0x14008f8b2
Function at 0x14009476c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, r9
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
and qword [rbp - 0x28], 0
mov r9d, 0x20019
mov r8, rax
lea rdx, [rbp - 0x28]
mov rcx, rsi
call fcn.140094c4c
mov dword [rdi], eax
test eax, eax
jne 0x140094820
and dword [rbp + 0x20], eax
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400947c2
mov rdx, qword [rbx]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
xor r8d, r8d
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov dword [rdi], eax
test eax, eax
jne 0x140094848
mov ebx, dword [rbp + 0x20]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140094804
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400abad4
nop
mov r8, rax
cmp dword [rax], 3
ja 0x140094872
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140094844
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
xor eax, eax
jmp 0x140094806
call fcn.1400abad4
mov r8, rax
cmp dword [rax], 4
ja 0x1400948ca
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14009486b
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
mov eax, SafeArrayGetDim
jmp 0x140094806
and dword [rbp - 0x30], 0
mov rcx, rsi
call fcn.1400df740
mov qword [rbp - 0x20], rax
mov ecx, dword [rdi]
mov dword [rbp - 0x2c], ecx
lea rax, str.Could_not_open_or_create_the_registry_path._Return_default_value
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea rdx, [0x14046902f]
mov rcx, r8
call fcn.140005ca0
jmp 0x14009482e
and dword [rbp - 0x2c], 0
mov ecx, dword [rdi]
mov dword [rbp - 0x30], ecx
mov rcx, rsi
call fcn.1400df740
mov qword [rbp - 0x18], rax
mov rcx, rbx
call fcn.1400df740
mov qword [rbp - 0x20], rax
lea rax, str.Failed_to_read_registry_value_type._Return_default_value
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea rdx, [0x140469073]
mov rcx, r8
call fcn.1400044ac
jmp 0x140094855
Function at 0x140094a04
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r14d, dword [rbp + 0x58]
mov r13d, r9d
mov rsi, r8
mov rbx, rdx
mov r15, rcx
cmp r14d, 0x4000000
ja 0x140094ae8
mov r8, qword [rbp + 0x70]
mov rdx, rcx
mov rcx, rsi
mov r9d, 0x20019
call fcn.140094c4c
mov edi, eax
test eax, eax
jne 0x140094aef
cmp qword [rbx + 0x18], 8
mov r8, rbx
jb 0x140094a6c
mov r8, qword [rbx]
mov r12, qword [rbp + 0x60]
mov r9d, r13d
mov rcx, qword [r15]
xor edx, edx
mov qword [rsp + 0x30], r12
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x140094ba9
mov eax, dword [r12]
mov ecx, eax
shr rcx, 1
cmp byte [rbp + 0x50], dil
mov rdi, qword [rbp + 0x68]
cmove ecx, eax
mov dword [rdi], ecx
cmp ecx, 1
jb 0x140094bb8
cmp ecx, r14d
ja 0x140094bb8
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, SafeArrayGetDim
jmp 0x140094ac9
call fcn.1400abad4
mov r8, rax
cmp dword [rax], 5
jbe 0x140094ba2
mov rcx, rsi
mov dword [rbp + 0x58], edi
call fcn.1400df740
mov qword [rbp - 0x20], rax
lea rdx, [0x140468e0e]
lea rax, str.Could_not_open_or_create_the_registry_path._Return_default_value
mov rcx, r8
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
call fcn.1400030f4
jmp 0x140094ba2
mov rcx, rsi
mov dword [rbp + 0x58], edi
call fcn.1400df740
mov rcx, rbx
mov qword [rbp - 0x18], rax
call fcn.1400df740
mov qword [rbp - 0x20], rax
lea rdx, [0x140468dcd]
lea rax, str.Failed_to_get_registry_value_size._Return_default_value
xor r8d, r8d
mov qword [rbp - 0x10], rax
mov rcx, r9
lea rax, [rbp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call fcn.140006fb0
mov eax, edi
jmp 0x140094ac9
call fcn.1400abad4
mov r9, rax
cmp dword [rax], 5
jbe 0x140094ba2
jmp 0x140094b46
call fcn.1400abad4
mov r8, rax
cmp dword [rax], 4
jbe 0x140094ae8
mov ecx, dword [r12]
mov dword [rbp + 0x78], ecx
mov ecx, dword [rdi]
mov dword [rbp - 0x20], ecx
mov rcx, rsi
mov dword [rbp + 0x58], r14d
call fcn.1400df740
mov rcx, rbx
mov qword [rbp - 0x10], rax
call fcn.1400df740
mov qword [rbp - 0x18], rax
lea rdx, [0x140468e93]
lea rax, str.Registry_value_is_empty_or_bigger_than_max_length._Return_default_value
mov rcx, r8
mov qword [rbp - 8], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call fcn.14000fa04
jmp 0x140094ae8
Function at 0x140096668
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rsi, r9
mov r15, r8
mov ebx, edx
mov rdi, rcx
mov byte [r9], 1
and qword [rbp - 0x20], 0
mov r9d, 0x20019
mov r8, qword [rbp + 0x40]
lea rdx, [rbp - 0x20]
mov rcx, r15
call fcn.140094c4c
mov r14d, eax
test eax, eax
jne 0x1400967cb
mov dword [rbp - 0x2c], 4
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400966cf
mov rdx, qword [rdi]
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
jne 0x140096739
mov byte [rsi], al
mov ebx, dword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140096719
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400abad4
mov r8, rax
cmp dword [rax], 4
jbe 0x1400967ac
mov dword [rbp + 0x38], ebx
mov dword [rbp - 0x30], r14d
mov rcx, r15
call fcn.1400df740
mov qword [rbp - 0x10], rax
mov rcx, rdi
call fcn.1400df740
mov qword [rbp - 0x18], rax
lea rax, str.Failed_to_read_registry_value._Return_default_value
mov qword [rbp - 8], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
lea rdx, [0x14045cc1a]
mov rcx, r8
call fcn.1400044ac
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140096719
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x140096719
call fcn.1400abad4
mov r8, rax
cmp dword [rax], 3
jbe 0x140096829
mov dword [rbp + 0x38], ebx
mov rcx, r15
call fcn.1400df740
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x30], r14d
lea rax, str.Could_not_open_or_create_the_registry_path._Return_default_value
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea rdx, [0x14045cc69]
mov rcx, r8
call fcn.140005ca0
lea rcx, [rbp - 0x20]
call fcn.1401303f4
jmp 0x140096719