joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400134d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
lea rax, [rsp + 0x38]
mov rdi, rcx
xor ebx, ebx
lea rdx, str.Software2345Pinyin
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x38], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400135e9
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov dword [rsp + 0x30], 0x104
mov word [rsp + 0x50], bx
call fcn.1400c2130
cmp qword [rsi + 0x18], 8
jb 0x14001355d
mov rsi, qword [rsi]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400135de
cmp dword [rsp + 0x30], ebx
jbe 0x1400135de
cmp dword [rsp + 0x40], 1
jne 0x1400135de
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
cmp word [rsp + 0x50], bx
je 0x1400135cc
lea rax, [rsp + 0x50]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400135c2
lea rdx, [rsp + 0x50]
mov r8, rbx
mov rcx, rdi
call fcn.140006900
jmp 0x1400135f8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
mov rax, rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400bcae0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400181e0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, rdx
mov rsi, rcx
xor r14d, r14d
mov dword [rbp - 0x11], r14d
mov qword [rbp + 0x37], 7
mov qword [rbp + 0x2f], r14
mov word [rbp + 0x1f], r14w
lea r8d, [r14 + 4]
lea rdx, str.Path
lea rcx, [rbp + 0x1f]
call fcn.140006900
nop
mov edi, 1
mov dword [rbp - 0x11], edi
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0x2021f
xor r8d, r8d
lea rdx, str.Software2345Pinyin
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001836e
mov rax, qword [rsi + 0x10]
lea ecx, [rax*2 + 2]
cmp qword [rsi + 0x18], 8
jb 0x14001828e
mov rsi, qword [rsi]
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 8
cmovae rdx, qword [rbp + 0x1f]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rsi
mov r9d, edi
xor r8d, r8d
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001836e
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x17], 7
mov qword [rbp + 0xf], r14
mov word [rbp - 1], r14w
mov r8d, 7
lea rdx, str.Version
lea rcx, [rbp - 1]
call fcn.140006900
mov edi, 3
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0x2021f
xor r8d, r8d
lea rdx, str.Software2345Pinyin
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001836e
mov rax, qword [rbx + 0x10]
lea ecx, [rax*2 + 2]
cmp qword [rbx + 0x18], 8
jb 0x140018332
mov rbx, qword [rbx]
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001836e
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x140018370
xor bl, bl
test dil, 2
je 0x14001839a
and edi, 0xfffffffd
cmp qword [rbp + 0x17], 8
jb 0x140018389
mov rcx, qword [rbp - 1]
call fcn.1400bd20c
mov qword [rbp + 0x17], 7
mov qword [rbp + 0xf], r14
mov word [rbp - 1], r14w
test dil, 1
je 0x1400183b0
cmp qword [rbp + 0x37], 8
jb 0x1400183b0
mov rcx, qword [rbp + 0x1f]
call fcn.1400bd20c
movzx eax, bl
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400bcae0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140018f00
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
movzx edi, dl
xor ebx, ebx
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov dword [rsp + 0x20], ebx
mov word [rsp + 0x30], bx
call fcn.1400c2130
mov edx, 0x103
lea rcx, [rsp + 0x30]
test dil, dil
je 0x140018f5e
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x140018f64
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
mov word [rsi], bx
cmp word [rsp + 0x30], bx
je 0x140018f8d
lea rax, [rsp + 0x30]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140018f83
lea rdx, [rsp + 0x30]
mov r8, rbx
mov rcx, rsi
call fcn.140006900
mov rax, rsi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400bcae0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001cbc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x310], rbx
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rbx
mov word [rcx], bx
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x58], bx
mov r9d, edx
lea r8, str.SystemCurrentControlSetControlKeyboard_Layouts
lea rdx, str._s_08x
lea rcx, [rsp + 0x58]
call fcn.140061ab0
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001cdf5
mov word [rbp - 0x40], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp - 0x3e]
call fcn.1400c2130
mov dword [rsp + 0x30], 0x206
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Layout_Display_Name
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001cd8e
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rbx
mov word [rsp + 0x78], bx
cmp word [rbp - 0x40], ax
jne 0x14001ccf1
mov eax, ebx
jmp 0x14001cd0a
lea rcx, [rbp - 0x40]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14001cd00
mov r8, rax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x78]
call fcn.140006900
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.14001d0b0
mov rsi, rax
cmp rdi, rax
je 0x14001cd5b
cmp qword [rdi + 0x18], 8
jb 0x14001cd41
mov rcx, qword [rdi]
call fcn.1400bd20c
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
mov rdx, rsi
mov rcx, rdi
call fcn.14000b0c0
cmp qword [rbp - 0x50], 8
jb 0x14001cd6b
mov rcx, qword [rbp - 0x68]
call fcn.1400bd20c
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
cmp qword [rbp - 0x70], 8
jb 0x14001cde9
mov rcx, qword [rsp + 0x78]
call fcn.1400bd20c
jmp 0x14001cde9
mov dword [rsp + 0x30], 0x206
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Layout_Text
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [rbp - 0x40], 0
je 0x14001cdda
lea rcx, [rbp - 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x14001cdd0
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.140006900
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rsp + 0x70], 8
jb 0x14001ce07
mov rcx, qword [rsp + 0x58]
call fcn.1400bd20c
mov rax, rdi
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x310]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001ce30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], rbx
mov word [rcx], bx
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x58], bx
cmp qword [r9 + 0x18], 8
jb 0x14001cea0
mov r9, qword [r9]
cmp qword [r8 + 0x18], 8
jb 0x14001ceaa
mov r8, qword [r8]
mov qword [rsp + 0x28], r9
mov dword [rsp + 0x20], edx
mov r9, r8
lea r8, str.SoftwareMicrosoftCTFTIP
lea rdx, str._s_sLanguageProfile0x_08x_s
lea rcx, [rsp + 0x58]
call fcn.140061ab0
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d075
mov word [rbp - 0x40], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp - 0x3e]
call fcn.1400c2130
mov dword [rsp + 0x30], 0x206
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Display_Description
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d00e
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rbx
mov word [rsp + 0x78], bx
cmp word [rbp - 0x40], ax
jne 0x14001cf78
mov rax, rbx
jmp 0x14001cf8a
lea rcx, [rbp - 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14001cf80
mov r8, rax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x78]
call fcn.140006900
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.14001d0b0
mov rsi, rax
cmp rdi, rax
je 0x14001cfdb
cmp qword [rdi + 0x18], 8
jb 0x14001cfc1
mov rcx, qword [rdi]
call fcn.1400bd20c
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
mov word [rdi], bx
mov rdx, rsi
mov rcx, rdi
call fcn.14000b0c0
cmp qword [rbp - 0x50], 8
jb 0x14001cfeb
mov rcx, qword [rbp - 0x68]
call fcn.1400bd20c
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
cmp qword [rbp - 0x70], 8
jb 0x14001d069
mov rcx, qword [rsp + 0x78]
call fcn.1400bd20c
jmp 0x14001d069
mov dword [rsp + 0x30], 0x206
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Description
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [rbp - 0x40], 0
je 0x14001d05a
lea rcx, [rbp - 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x14001d050
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.140006900
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rsp + 0x70], 8
jb 0x14001d087
mov rcx, qword [rsp + 0x58]
call fcn.1400bd20c
mov rax, rdi
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400bcae0
add rsp, 0x2e8
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001ece0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x37], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
xor r14d, r14d
mov qword [rbp - 0x19], r14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r14
mov word [rbp + 0x17], r14w
movzx eax, word [str.SoftwareMicrosoftOffice]
neg ax
sbb r8, r8
and r8d, 0x19
lea rdx, str.SoftwareMicrosoftOffice
lea rcx, [rbp + 0x17]
call fcn.140006900
nop
lea r8, [rbp - 0x29]
lea rdx, [rbp + 0x17]
call fcn.1400ba4e0
nop
cmp qword [rbp + 0x2f], 8
jb 0x14001ed75
mov rcx, qword [rbp + 0x17]
call fcn.1400bd20c
mov eax, 7
mov qword [rbp + 0xf], rax
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
mov rsi, qword [rbp - 0x29]
mov rbx, rsi
mov rdi, qword [rbp - 0x21]
cmp rsi, rdi
je 0x14001ee4c
lea r15, str.WordOptions
cmp qword [rbx + 0x18], 8
jb 0x14001edae
mov r9, qword [rbx]
jmp 0x14001edb1
mov r9, rbx
mov qword [rsp + 0x20], r15
lea r8, str.SoftwareMicrosoftOffice
lea rdx, str._s_s_s
lea rcx, [rbp - 9]
call fcn.140061ab0
mov qword [rbp - 0x39], r14
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rdx, qword [rbp - 9]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ee3b
mov dword [rbp - 0x31], r14d
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.IMEControlActive
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rbx, 0x20
cmp rbx, rdi
jne 0x14001eda2
mov rax, qword [rbp + 0xf]
cmp rax, 8
jb 0x14001ee5b
mov rcx, qword [rbp - 9]
call fcn.1400bd20c
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
test rsi, rsi
je 0x14001eeb0
mov rbx, rsi
cmp rsi, rdi
je 0x14001eea8
nop dword [rax]
cmp qword [rbx + 0x18], 8
jb 0x14001ee8f
mov rcx, qword [rbx]
call fcn.1400bd20c
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
add rbx, 0x20
cmp rbx, rdi
jne 0x14001ee80
mov rcx, rsi
call fcn.1400bd20c
mov al, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400bcae0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140020b70
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x290
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov esi, edx
xor edi, edi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str..DEFAULTKeyboard_LayoutSubstitutes
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140020c80
mov ecx, 0x800
call fcn.1400bbc88
mov rdi, rax
mov ecx, 0x800
call fcn.1400bbc88
mov rbx, rax
test rdi, rdi
je 0x140020c6c
test rax, rax
je 0x140020c64
xor edx, edx
mov r8d, 0x800
mov rcx, rdi
call fcn.1400c2130
lea rax, [0x140125cd8]
mov qword [rsp + 0x20], rax
lea r9, str.RC::RCInputImeUninstaller::FindSubstituteID
lea r8, str._s__:__s
mov edx, 0x400
mov rcx, rdi
call fcn.140007140
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call fcn.1400c2130
lea r9, str..DEFAULTKeyboard_LayoutSubstitutes
mov r8, rdi
mov edx, 0x400
mov rcx, rbx
call fcn.140007140
mov rcx, rbx
call fcn.140015100
mov rcx, rdi
call fcn.1400bd2dc
test rbx, rbx
je 0x140020c79
mov rcx, rbx
call fcn.1400bd2dc
xor eax, eax
jmp 0x140020d62
xor bpl, bpl
mov ebx, 0xd0010804
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x48], di
mov r8d, ebx
lea rdx, [0x140125ed8]
lea rcx, [rsp + 0x48]
call fcn.140061ab0
mov word [rsp + 0x70], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x72]
call fcn.1400c2130
mov dword [rsp + 0x30], 0x208
nop
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140020d3d
xor edx, edx
lea r8d, [rax + 0x10]
lea rcx, [rsp + 0x70]
call fcn.1400be988
cmp eax, esi
je 0x140020d3a
add ebx, 0x10000
mov r8d, ebx
lea rdx, [0x140125ed8]
lea rcx, [rsp + 0x48]
call fcn.140061ab0
jmp 0x140020cd0
mov bpl, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bpl, bpl
cmovne edi, ebx
cmp qword [rsp + 0x60], 8
jb 0x140020d60
mov rcx, qword [rsp + 0x48]
call fcn.1400bd20c
mov eax, edi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400bcae0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140020d90
Capabilities:
Delete registry value

Disassembly:
test edx, edx
je 0x140020f0c
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, edx
xor edi, edi
mov qword [r11 - 0x48], rdi
lea rax, [r11 - 0x48]
mov qword [r11 - 0x58], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str..DEFAULTKeyboard_LayoutSubstitutes
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140020e91
mov ecx, 0x800
call fcn.1400bbc88
mov rdi, rax
mov ecx, 0x800
call fcn.1400bbc88
mov rbx, rax
test rdi, rdi
je 0x140020e82
test rax, rax
je 0x140020e7a
xor edx, edx
mov r8d, 0x800
mov rcx, rdi
call fcn.1400c2130
lea rax, [0x140125cd8]
mov qword [rsp + 0x20], rax
lea r9, str.RC::RCInputImeUninstaller::DeleteSubstituteID
lea r8, str._s__:__s
mov edx, 0x400
mov rcx, rdi
call fcn.140007140
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call fcn.1400c2130
lea r9, str..DEFAULTKeyboard_LayoutSubstitutes
mov r8, rdi
mov edx, 0x400
mov rcx, rbx
call fcn.140007140
mov rcx, rbx
call fcn.140015100
mov rcx, rdi
call fcn.1400bd2dc
test rbx, rbx
je 0x140020ef2
mov rcx, rbx
call fcn.1400bd2dc
jmp 0x140020ef2
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x40], di
mov r8d, ebx
lea rdx, [0x140125ed8]
lea rcx, [rsp + 0x40]
call fcn.140061ab0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rsp + 0x58], 8
jb 0x140020ef2
mov rcx, qword [rsp + 0x40]
call fcn.1400bd20c
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140020d98
Capabilities:
Delete registry value

Disassembly:
test edx, edx
je 0x140020f0c
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, edx
xor edi, edi
mov qword [r11 - 0x48], rdi
lea rax, [r11 - 0x48]
mov qword [r11 - 0x58], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str..DEFAULTKeyboard_LayoutSubstitutes
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140020e91
mov ecx, 0x800
call fcn.1400bbc88
mov rdi, rax
mov ecx, 0x800
call fcn.1400bbc88
mov rbx, rax
test rdi, rdi
je 0x140020e82
test rax, rax
je 0x140020e7a
xor edx, edx
mov r8d, 0x800
mov rcx, rdi
call fcn.1400c2130
lea rax, [0x140125cd8]
mov qword [rsp + 0x20], rax
lea r9, str.RC::RCInputImeUninstaller::DeleteSubstituteID
lea r8, str._s__:__s
mov edx, 0x400
mov rcx, rdi
call fcn.140007140
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call fcn.1400c2130
lea r9, str..DEFAULTKeyboard_LayoutSubstitutes
mov r8, rdi
mov edx, 0x400
mov rcx, rbx
call fcn.140007140
mov rcx, rbx
call fcn.140015100
mov rcx, rdi
call fcn.1400bd2dc
test rbx, rbx
je 0x140020ef2
mov rcx, rbx
call fcn.1400bd2dc
jmp 0x140020ef2
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x40], di
mov r8d, ebx
lea rdx, [0x140125ed8]
lea rcx, [rsp + 0x40]
call fcn.140061ab0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rsp + 0x58], 8
jb 0x140020ef2
mov rcx, qword [rsp + 0x40]
call fcn.1400bd20c
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140024b00
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rax
mov word [rsp + 0x48], ax
lea rax, str.89E1D5C2_A068_44B6_B820_F8406C8A4706
mov qword [rsp + 0x20], rax
mov r9d, 0x804
lea r8, str.0055AAB0_EACB_46DB_9BB4_1B97FC046D02
lea rdx, str.SoftwareMicrosoftCTFTIP_sLanguageProfile0x_08x_s
lea rcx, [rsp + 0x48]
call fcn.140061ab0
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140024bd6
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Enable
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rsp + 0x60], 8
jb 0x140024be8
mov rcx, qword [rsp + 0x48]
call fcn.1400bd20c
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400bcae0
add rsp, 0x78
ret

Function at 0x1400257d0
Capabilities:
Delete registry key

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rdx
cmp qword [rdx + 0x10], 0
je 0x1400258ce
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x28], di
cmp qword [rdx + 0x18], 8
jb 0x14002582c
mov r9, qword [rdx]
jmp 0x14002582f
mov r9, rdx
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerLow_RightsElevationPolicy
lea rdx, [0x1401261a8]
lea rcx, [rsp + 0x28]
call fcn.140061ab0
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp qword [rbx + 0x18], 8
jb 0x14002586f
mov rbx, qword [rbx]
mov r9, rbx
lea r8, str.SOFTWAREWow6432NodeMicrosoftInternet_ExplorerLow_RightsElevationPolicy
lea rdx, [0x1401261a8]
lea rcx, [rsp + 0x28]
call fcn.140061ab0
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
cmp qword [rsp + 0x40], 8
jb 0x1400258bb
mov rcx, qword [rsp + 0x28]
call fcn.1400bd20c
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x28], di
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret