joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14020a770
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x10], 0
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xc], 0
cmp dword [rsp + 0x30], 0
jne 0x14020a7e0
mov eax, 1
jmp 0x14020a7e2
xor eax, eax
add rsp, 0x48
ret

Function at 0x14020aba0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x30], 0
je 0x14020abc2
xor eax, eax
jmp 0x14020ac31
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x10], 4
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xc], 4
cmp dword [rsp + 0x30], 0
jne 0x14020ac2f
mov eax, 1
jmp 0x14020ac31
xor eax, eax
add rsp, 0x48
ret

Function at 0x14020ac40
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x30], 0
je 0x14020ac62
xor eax, eax
jmp 0x14020aca5
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14020aca3
mov eax, 1
jmp 0x14020aca5
xor eax, eax
add rsp, 0x48
ret

Function at 0x14020acb0
Capabilities:
Set registry value

Disassembly:
movsd qword [rsp + 0x18], xmm2
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x30], 0
je 0x14020acd3
xor eax, eax
jmp 0x14020ad16
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14020ad14
mov eax, 1
jmp 0x14020ad16
xor eax, eax
add rsp, 0x48
ret
Function at 0x14020ad20
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x30], 0
je 0x14020ad45
xor eax, eax
jmp 0x14020adc8
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCR90.dll_wcslen]
add rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCR90.dll_wcslen]
mov ecx, eax
add ecx, 1
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xc], 1
cmp dword [rsp + 0x30], 0
jne 0x14020adc6
mov eax, 1
jmp 0x14020adc8
xor eax, eax
add rsp, 0x48
ret
Function at 0x14020b440
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x158
mov qword [rsp + 0x140], 0xfffffffffffffffe
mov rax, qword [rsp + 0x160]
cmp dword [rax + 0x30], 0
je 0x14020b477
xor eax, eax
jmp 0x14020b6cf
mov dword [rsp + 0x38], socket
lea rcx, [rsp + 0x100]
call fcn.1403ad38a
nop
mov edx, 2
mov ecx, socket
call qword [sym.imp.MSVCR90.dll_calloc]
mov qword [rsp + 0x30], rax
mov r8, 0xffffffffffffffff
mov edx, 5
lea rcx, [rsp + 0x100]
call sub.mfc90u.dll_CEditView::SerializeRaw
mov rax, qword [rsp + 0x170]
mov rax, qword [rax]
mov eax, dword [rax]
mov dword [rsp + 0x138], eax
xor eax, eax
test rax, rax
jg 0x14020b4e1
cmp qword [rsp + 0x110], 0
jg 0x14020b4e6
call sub.mfc90u.dll_AfxOleUnregisterServerClass
xor edx, edx
imul rdx, rdx, 4
mov rcx, qword [rsp + 0x108]
mov eax, dword [rsp + 0x138]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x170]
mov rax, qword [rax]
mov eax, dword [rax + 4]
mov dword [rsp + 0x13c], eax
xor eax, eax
cmp rax, 1
jg 0x14020b526
cmp qword [rsp + 0x110], 1
jg 0x14020b52b
call sub.mfc90u.dll_AfxOleUnregisterServerClass
mov edx, 1
imul rdx, rdx, 4
mov rcx, qword [rsp + 0x108]
mov eax, dword [rsp + 0x13c]
mov dword [rdx + rcx], eax
mov r9d, reloc.WS2_32.dll_recv
mov r8d, socket
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0xb0]
call fcn.1403acf3a
nop
mov qword [rsp + 0x20], 0
mov r9d, reloc.mfc90u.dll_CDaoTableDef::GetValidationRule
xor r8d, r8d
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x40]
call sub.mfc90u.dll_AFX_MODULE_THREAD_STATE::AFX_MODULE_THREAD_STATE
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x100]
call sub.mfc90u.dll_CRecordset::RebindParams
lea rcx, [rsp + 0x40]
call sub.mfc90u.dll_COleServerDoc::CanCloseFrame
lea rcx, [rsp + 0xb0]
call sub.mfc90u.dll_CDHtmlDialog::GetExternal
mov dword [rsp + 0x12c], eax
lea rcx, [rsp + 0xb0]
call sub.mfc90u.dll_DDX_LBString
mov r11, rax
mov eax, dword [rsp + 0x12c]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r11
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x160]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x128], eax
mov rcx, qword [rsp + 0x160]
mov eax, dword [rsp + 0x128]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x160]
mov eax, dword [rsp + 0x12c]
mov dword [rcx + 0x10], eax
mov rax, qword [rsp + 0x160]
mov dword [rax + 0xc], 2
cmp qword [rsp + 0x30], 0
je 0x14020b653
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCR90.dll_free]
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x128], 0
jne 0x14020b697
mov dword [rsp + 0x130], 1
lea rcx, [rsp + 0x40]
call sub.mfc90u.dll_CWnd::CWnd
nop
lea rcx, [rsp + 0xb0]
call sub.mfc90u.dll_CHtmlEditCtrl::CHtmlEditCtrl
nop
lea rcx, [rsp + 0x100]
call sub.mfc90u.dll_CDaoWorkspace::CDaoWorkspace
mov eax, dword [rsp + 0x130]
jmp 0x14020b6cf
mov dword [rsp + 0x134], 0
lea rcx, [rsp + 0x40]
call sub.mfc90u.dll_CWnd::CWnd
nop
lea rcx, [rsp + 0xb0]
call sub.mfc90u.dll_CHtmlEditCtrl::CHtmlEditCtrl
nop
lea rcx, [rsp + 0x100]
call sub.mfc90u.dll_CDaoWorkspace::CDaoWorkspace
mov eax, dword [rsp + 0x134]
add rsp, 0x158
ret
Function at 0x14020b6e0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x30], 0
je 0x14020b707
xor eax, eax
jmp 0x14020b77b
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x68]
mov dword [rcx + 0x10], eax
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xc], 3
cmp dword [rsp + 0x30], 0
jne 0x14020b76f
mov dword [rsp + 0x34], 1
jmp 0x14020b777
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret

Function at 0x14020b780
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x34], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x38]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 0xc], eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x34]
mov dword [rcx + 0x10], eax
cmp dword [rsp + 0x38], 0
jne 0x14020b80c
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x3c]
mov dword [rcx], eax
mov eax, 1
jmp 0x14020b80e
xor eax, eax
add rsp, 0x48
ret

Function at 0x14020b820
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x40], 8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x44], eax
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x44]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 0xc], eax
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x40]
mov dword [rcx + 0x10], eax
cmp dword [rsp + 0x44], 0
jne 0x14020b8b0
mov rax, qword [rsp + 0x70]
movsd xmm0, qword [rsp + 0x38]
movsd qword [rax], xmm0
mov eax, 1
jmp 0x14020b8b2
xor eax, eax
add rsp, 0x58
ret
Function at 0x14020b8c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x14020b9dd
cmp dword [rsp + 0x34], 0
jbe 0x14020b9dd
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
add eax, 1
mov ecx, eax
call sub.mfc90u.dll_new__
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x14020b9b0
cmp dword [rsp + 0x34], 0
jbe 0x14020b9b0
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.mfc90u.dll_CTreeCtrl::CTreeCtrl]
jmp 0x14020b9be
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.mfc90u.dll_CDocObjectServer::DoBeginPrinting]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call sub.mfc90u.dll_delete__
mov qword [rsp + 0x40], 0
jmp 0x14020b9eb
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.mfc90u.dll_CDocObjectServer::DoBeginPrinting]
mov rcx, qword [rsp + 0x70]
mov eax, dword [rsp + 0x3c]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x70]
mov eax, dword [rsp + 0x30]
mov dword [rcx + 0xc], eax
mov rcx, qword [rsp + 0x70]
mov eax, dword [rsp + 0x38]
mov dword [rcx + 0x10], eax
cmp dword [rsp + 0x3c], 0
jne 0x14020ba20
mov dword [rsp + 0x58], 1
jmp 0x14020ba28
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
add rsp, 0x68
ret
Function at 0x14020c110
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x80]
mov qword [rax], 0
mov rax, qword [rsp + 0x88]
mov dword [rax], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x14020c22c
cmp dword [rsp + 0x34], 0
jbe 0x14020c22c
mov rcx, qword [rsp + 0x88]
mov eax, dword [rsp + 0x34]
mov dword [rcx], eax
mov rax, qword [rsp + 0x88]
mov ecx, dword [rax]
call sub.mfc90u.dll_new__
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x40]
mov qword [rcx], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x14020c203
jmp 0x14020c22c
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call sub.mfc90u.dll_delete__
mov rax, qword [rsp + 0x80]
mov qword [rax], 0
mov rcx, qword [rsp + 0x70]
mov eax, dword [rsp + 0x38]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x70]
mov dword [rax + 0xc], 3
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
mov dword [rcx + 0x10], eax
cmp dword [rsp + 0x38], 0
jne 0x14020c267
mov dword [rsp + 0x50], 1
jmp 0x14020c26f
mov dword [rsp + 0x50], 0
mov eax, dword [rsp + 0x50]
add rsp, 0x68
ret

Function at 0x14020c550
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x20]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], 0
cmp dword [rsp + 0x20], 0
jne 0x14020c5a8
mov eax, 1
jmp 0x14020c5aa
xor eax, eax
add rsp, 0x38
ret
Function at 0x14020caf0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x880
mov rax, qword [0x1404e41f8]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov dword [rsp + 0x860], 1
mov dword [rsp + 0x40], 0
mov eax, dword [0x14043daa0]
mov dword [rsp + 0x60], eax
lea rdi, [rsp + 0x64]
xor eax, eax
mov ecx, 0x7fc
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0x800
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x890]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x103
jne 0x14020cbb1
mov dword [rsp + 0x860], 0
jmp 0x14020cc4a
cmp dword [rsp + 0x40], 0
jne 0x14020cc4a
mov rax, qword [rsp + 0x898]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x868], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x868]
mov rcx, qword [rsp + 0x898]
call sub.mfc90u.dll_COleDispatchImpl::Release
mov dword [rsp + 0x44], 0x800
mov eax, dword [rsp + 0x48]
add eax, 1
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x890]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x40], eax
jmp 0x14020cbb1
mov eax, dword [rsp + 0x860]
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.1403addc0
add rsp, 0x880
pop rdi
ret
Function at 0x14020cc70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x878
mov rax, qword [0x1404e41f8]
xor rax, rsp
mov qword [rsp + 0x868], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x44], 0x800
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x880]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x103
jne 0x14020cd12
mov dword [rsp + 0x4c], 0
jmp 0x14020cdb3
cmp dword [rsp + 0x40], 0
jne 0x14020cdb3
mov dword [rsp + 0x4c], 1
mov rax, qword [rsp + reloc.mfc90u.dll_CDocObjectServer::DoBeginPrinting]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x860], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x860]
mov rcx, qword [rsp + reloc.mfc90u.dll_CDocObjectServer::DoBeginPrinting]
call sub.mfc90u.dll_COleDispatchImpl::Release
mov dword [rsp + 0x44], 0x800
mov eax, dword [rsp + 0x48]
add eax, 1
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x880]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [rsp + 0x40], eax
jmp 0x14020cd12
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x868]
xor rcx, rsp
call fcn.1403addc0
add rsp, 0x878
ret
Function at 0x140213cf0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0x110]
test eax, eax
jne 0x140213e26
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x1e8], 0
jne 0x140213d49
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov qword [rcx + 0x1e8], rax
mov rax, qword [rsp + 0x40]
mov byte [rax + 0x110], 1
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov edx, 1
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x3d8]
mov rcx, qword [rsp + 0x40]
add rcx, 0x168
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x320]
and eax, 1
test eax, eax
je 0x140213dd9
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x320]
and eax, 0x80
test eax, eax
jne 0x140213dd9
call sub.mfc90u.dll_AfxFailMaxChars
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov edx, 0x7f86
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, qword [rsp + 0x40]
add rcx, 0x118
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rsp + 0x40]
cmp qword [rax + reloc.mfc90u.dll_COleStreamFile::COleStreamFile], 0
je 0x140213e0d
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
call fcn.140206960
jmp 0x140213e26
mov rdx, qword [rsp + 0x40]
lea rcx, [0x1404e65a8]
call fcn.1400f7980
mov rcx, rax
call fcn.140206960
add rsp, 0x38
ret
Function at 0x140217670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0xc0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1402177ba
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x1402176bf
call sub.mfc90u.dll_AfxOleUnregisterServerClass
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
add rax, 0x10
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 1
mov rcx, qword [rsp + 0x40]
call fcn.140065ce0
cmp eax, 9
jne 0x140217717
mov rax, qword [rsp + 0x80]
cmp dword [rax + 0x15c], 0
je 0x140217717
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x38], 1
cmp dword [0x1404e6674], 0
je 0x14021775a
mov rcx, qword [rsp + 0x40]
call fcn.140065ce0
cmp eax, 0x14
je 0x140217746
mov rcx, qword [rsp + 0x40]
call fcn.140065ce0
cmp eax, 0x13
jne 0x14021774e
mov dword [rsp + 0x38], 1
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x38]
mov dword [rcx + 0x14], eax
cmp dword [rsp + 0x38], 0
jne 0x14021776b
mov dword [rsp + 0x60], 1
jmp 0x140217773
mov dword [rsp + 0x60], 0
mov r10, qword [rsp + 0x40]
mov r10, qword [r10]
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x20], eax
mov r9d, 1
mov r8d, 1
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x40]
call qword [r10 + 0x30]
mov r11, qword [rsp + 0x40]
mov dword [r11 + 0x1c], 0xffffffff
jmp 0x14021769c
add rsp, 0x78
ret

Function at 0x14021cd20
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov ecx, setsockopt
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x14021cd40
xor eax, eax
jmp 0x14021ce1f
mov rax, qword [rsp + 0x80]
cmp qword [rax + reloc.mfc90u.dll_COleStreamFile::COleStreamFile], 0
je 0x14021cd68
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
mov qword [rsp + 0x68], rax
jmp 0x14021cd97
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x1e0]
call sub.mfc90u.dll_CWnd::ExecuteDlgInit
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
lea rcx, [0x1404e65a8]
call fcn.1400f7980
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14021ce1a
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
call fcn.1401febb0
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x14021ce1a
cmp dword [rsp + 0x40], 0
jne 0x14021ce1a
xor eax, eax
jmp 0x14021ce1f
mov eax, 1
add rsp, 0x78
ret
Function at 0x14022ac00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x78
movzx eax, byte [rsp + 0x88]
test eax, eax
je 0x14022acf6
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x118]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + reloc.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x90]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rax + 0xc]
sub eax, ecx
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x90]
mov ecx, dword [rsp + 0x30]
mov eax, dword [rax + 8]
sub eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x40]
add eax, ecx
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x24], eax
mov ecx, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x44]
add eax, ecx
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x80]
add rax, 0xc8
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.140230570
add rsp, 0x78
ret