joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003ec0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov rax, qword [str.HPPresetRoot]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
mov rax, qword [0x140036ec0]
xor edi, edi
mov qword [rsp + 0x50], rax
mov rax, qword [0x140036ec8]
xor r9d, r9d
mov qword [rsp + 0x58], rax
movzx eax, word [0x140036ed0]
mov dword [rsp + 0x40], edi
mov word [rsp + 0x60], ax
mov rax, qword [str.HPRestrictedUserGuid]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140036ee0]
mov qword [rsp + 0x70], rax
mov rax, qword [0x140036ee8]
mov qword [rsp + 0x78], rax
mov rax, qword [0x140036ef0]
mov qword [rbp - 0x80], rax
mov rax, qword [0x140036ef8]
mov qword [rbp - 0x78], rax
movzx eax, word [0x140036f00]
mov word [rbp - 0x70], ax
mov rax, qword [str.SoftwareHewlett_Packard_]
mov qword [rbp - 0x68], rax
mov rax, qword [0x140036f10]
mov qword [rbp - 0x60], rax
mov rax, qword [0x140036f18]
mov qword [rbp - 0x58], rax
mov rax, qword [0x140036f20]
mov qword [rbp - 0x50], rax
mov rax, qword [0x140036f28]
mov qword [rbp - 0x48], rax
mov rax, qword [0x140036f30]
mov qword [rbp - 0x40], rax
mov eax, dword [0x140036f38]
mov dword [rbp - 0x38], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1e0]
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINSPOOL.DRV_GetPrinterDataExW]
test eax, eax
jne 0x140004033
movzx eax, word [rbp + rdi - 0x68]
add rdi, 2
mov word [rbp + rdi - 0x32], ax
test ax, ax
jne 0x140003fe1
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x30]
repne scasw ax, word [rdi]
xor ecx, ecx
lea rdx, [rbp + 0x1e0]
nop word [rax + rax]
movzx eax, word [rdx + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x140004010
lea rdx, [rbp - 0x30]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.14001a510
mov rdi, qword [rsp + 0x518]
add rsp, 0x500
pop rbp
ret

Function at 0x140004060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
movzx eax, cx
mov ecx, eax
cmp eax, 0xc04
je 0x14000407e
cmp eax, 0x1004
je 0x1400040ce
cmp eax, 0x1404
jne 0x140004083
mov eax, 0x404
mov rcx, qword [0x140044d00]
movzx r9d, ax
mov edx, 0xa
mov r8d, 0x1f4
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1400040c7
mov rcx, qword [0x140044d00]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400040c7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x1400040c9
xor eax, eax
add rsp, 0x28
ret
mov eax, 0x804
jmp 0x140004083
Function at 0x1400040e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x840
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rsp + 0x830], rax
movzx ebx, cx
mov rsi, r8
mov ebp, edx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x806
mov word [rsp + 0x20], di
call fcn.14001c640
mov rcx, qword [0x140044d00]
mov r11d, ebp
shr r11d, 4
lea edx, [rdi + 6]
movzx r9d, bx
inc r11d
and ebp, 0xf
movzx r12d, r11w
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x140004179
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x717
jne 0x1400041b1
mov rcx, qword [0x140044d00]
lea edx, [rdi + 6]
mov r9d, 0x400
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1400041b1
mov rcx, qword [0x140044d00]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rax
test rax, rax
je 0x1400041b1
movzx eax, word [rdx]
add rdx, 2
test ax, ax
je 0x1400041aa
movzx ebx, ax
cmp edi, ebp
je 0x1400041d1
mov eax, ebx
lea rdx, [rdx + rbx*2]
inc edi
cmp edi, 0x10
jl 0x140004191
xor eax, eax
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.14001a510
add rsp, 0x840
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 0x403
lea rcx, [rsp + 0x20]
cmp ebx, eax
cmovg ebx, eax
movsxd r8, ebx
call fcn.14001aae4
lea rax, [rsp + 0x20]
lea r11, [rsp + 0x20]
sub rsi, rax
nop word [rax + rax]
movzx ecx, word [r11]
add r11, 2
mov word [rsi + r11 - 2], cx
test cx, cx
jne 0x140004200
mov eax, ebx
jmp 0x1400041b3

Function at 0x140004240
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xe0
xor ebx, ebx
lea rcx, [rsp + 0x70]
xor edx, edx
lea r8d, [rbx + 0x68]
call fcn.14001c640
mov eax, 5
lea rdx, str.Control_printers
mov word [rsp + 0xb0], ax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400042d1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [rbx + 1]
add rsp, 0xe0
pop rbx
ret
mov eax, ebx
add rsp, 0xe0
pop rbx
ret
Function at 0x1400042e0
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x140004450
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
mov rdi, rdx
mov dword [rsp + 0x40], 0
test rcx, rcx
je 0x14000434e
lea rdx, str._empa
call fcn.14001acc0
test rax, rax
jne 0x140004345
mov rcx, qword [rbx + 0x20]
lea rdx, str._mppqs
call fcn.14001acc0
test rax, rax
jne 0x140004345
mov rcx, qword [rbx + 0x20]
lea rdx, str._policy
call fcn.14001acc0
test rax, rax
je 0x14000434e
lea rcx, str.19728374
jmp 0x14000436f
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140004378
lea rdx, str._dmpa
call fcn.14001acc0
test rax, rax
je 0x140004378
lea rcx, str.843575861
call fcn.14001aa04
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x1400043aa
lea rax, [rsp + 0x40]
lea rdx, str.UPDMPA
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [rsp + 0x58]
lea rdx, str.SoftwarePoliciesHewlett_PackardHP_Print_SettingsADSPrintPolicy
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004407
lea rcx, str.19728374
call fcn.14001aa04
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x50], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x50]
jmp 0x140004417
lea rcx, str.843575861
call fcn.14001aa04
mov dword [rsp + 0x50], eax
test eax, eax
je 0x140004446
lea rax, [rsp + 0x50]
lea rdx, str.UPDADS
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
repz ret
Function at 0x140005000
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, rdx
mov rbx, rcx
xor edi, edi
lea rdx, str._dst
mov rcx, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
call fcn.14001acc0
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x14000509f
test rcx, rcx
jne 0x140005065
lea r8, [rsp + 0x38]
lea rdx, [0x1400360f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x14000512f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.ServicesTab
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000512f
mov dword [rsp + 0x60], edi
jmp 0x140005107
test rcx, rcx
jne 0x1400050cb
lea r8, [rsp + 0x38]
lea rdx, [0x1400360f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x14000512f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.ServicesTab
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000512f
mov dword [rsp + 0x60], 1
test rbx, rbx
je 0x14000512f
lea r9, [rsp + 0x60]
lea rdx, str.MystServicesTab
mov r8d, 4
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000513f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000514f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140005160
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, rdx
mov rbx, rcx
xor edi, edi
lea rdx, str._dod
mov rcx, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
call fcn.14001acc0
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x1400051ff
test rcx, rcx
jne 0x1400051c5
lea r8, [rsp + 0x38]
lea rdx, [0x1400360f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x14000528f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.OnlineDiagnostics
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000528f
mov dword [rsp + 0x60], edi
jmp 0x140005267
test rcx, rcx
jne 0x14000522b
lea r8, [rsp + 0x38]
lea rdx, [0x1400360f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x14000528f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.OnlineDiagnostics
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000528f
mov dword [rsp + 0x60], 1
test rbx, rbx
je 0x14000528f
lea r9, [rsp + 0x60]
lea rdx, str.MystOnlineDiag
mov r8d, 4
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000529f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400052af
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400052c0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, rdx
mov rbx, rcx
xor edi, edi
lea rdx, str._dos
mov rcx, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
call fcn.14001acc0
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x14000535f
test rcx, rcx
jne 0x140005325
lea r8, [rsp + 0x38]
lea rdx, [0x1400360f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x1400053ef
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.OnlineSupport
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400053ef
mov dword [rsp + 0x60], edi
jmp 0x1400053c7
test rcx, rcx
jne 0x14000538b
lea r8, [rsp + 0x38]
lea rdx, [0x1400360f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x1400053ef
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.OnlineSupport
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400053ef
mov dword [rsp + 0x60], 1
test rbx, rbx
je 0x1400053ef
lea r9, [rsp + 0x60]
lea rdx, str.MystOnlineSupport
mov r8d, 4
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400053ff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000540f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140005420
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, rdx
mov rbx, rcx
xor edi, edi
lea rdx, str._dpm
mov rcx, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
call fcn.14001acc0
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x1400054bf
test rcx, rcx
jne 0x140005485
lea r8, [rsp + 0x38]
lea rdx, [0x1400360f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x14000554f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.ProductManuals
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000554f
mov dword [rsp + 0x60], edi
jmp 0x140005527
test rcx, rcx
jne 0x1400054eb
lea r8, [rsp + 0x38]
lea rdx, [0x1400360f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x14000554f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.ProductManuals
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000554f
mov dword [rsp + 0x60], 1
test rbx, rbx
je 0x14000554f
lea r9, [rsp + 0x60]
lea rdx, str.MystOnlineProdManuals
mov r8d, 4
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000555f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000556f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140005580
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, rdx
mov rbx, rcx
xor edi, edi
lea rdx, str._ddu
mov rcx, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
call fcn.14001acc0
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x14000561f
test rcx, rcx
jne 0x1400055e5
lea r8, [rsp + 0x38]
lea rdx, [0x1400360f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x1400056af
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.DriverUpdates
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400056af
mov dword [rsp + 0x60], edi
jmp 0x140005687
test rcx, rcx
jne 0x14000564b
lea r8, [rsp + 0x38]
lea rdx, [0x1400360f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x1400056af
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.DriverUpdates
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400056af
mov dword [rsp + 0x60], 1
test rbx, rbx
je 0x1400056af
lea r9, [rsp + 0x60]
lea rdx, str.MystOnlineDriverUpdates
mov r8d, 4
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400056bf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400056cf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400056e0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, rdx
mov rbx, rcx
xor edi, edi
lea rdx, str._dso
mov rcx, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
call fcn.14001acc0
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x14000577f
test rcx, rcx
jne 0x140005745
lea r8, [rsp + 0x38]
lea rdx, [0x1400360f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x14000580f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.OrderSupplies
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000580f
mov dword [rsp + 0x60], edi
jmp 0x1400057e7
test rcx, rcx
jne 0x1400057ab
lea r8, [rsp + 0x38]
lea rdx, [0x1400360f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x14000580f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.OrderSupplies
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000580f
mov dword [rsp + 0x60], 1
test rbx, rbx
je 0x14000580f
lea r9, [rsp + 0x60]
lea rdx, str.MystOnlineOrderSupplies
mov r8d, 4
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000581f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000582f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140005840
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x140005983
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x140005979
mov rcx, qword [rbx + 0x20]
mov qword [rsp + 0x58], rsi
xor esi, esi
lea rdx, str._dgst
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
call fcn.14001acc0
mov rcx, qword [rsp + 0x30]
test rax, rax
je 0x1400058eb
test rcx, rcx
jne 0x1400058bd
lea r8, [rsp + 0x30]
lea rdx, [0x1400360f0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x140005954
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
lea rdx, str.ServicesTab
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140005954
test rcx, rcx
je 0x14000590c
lea rdx, str.ServicesTab
call fcn.1400161e0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], rsi
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.140005000
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.140005160
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.1400052c0
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.140005420
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.140005580
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.1400056e0
mov rcx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
test rcx, rcx
je 0x140005969
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140005979
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
repz ret
Function at 0x140008d70
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x330
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rbx, rcx
test rcx, rcx
je 0x140008e05
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x2fe
mov word [rsp + 0x20], ax
call fcn.14001c640
lea rdx, [rsp + 0x20]
mov r8d, 0x180
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x140008e05
lea rdx, str.RCLID_
lea rcx, [rsp + 0x20]
call fcn.14001acc0
test rax, rax
je 0x140008e05
lea rcx, [rsp + 0x2c]
call fcn.14001aa04
movzx ecx, word [0x140045094]
lea r8, [rsp + 0x20]
mov edx, eax
call fcn.1400040e0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 1
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.14001a510
add rsp, 0x330
pop rbx
ret

Function at 0x140009290
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x630
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rsp + 0x620], rax
mov rbx, rcx
mov rsi, rdx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x1fe
mov word [rsp + 0x20], di
call fcn.14001c640
lea rcx, [rsp + 0x222]
xor edx, edx
mov r8d, 0x3fe
mov word [rsp + 0x220], di
call fcn.14001c640
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x140009345
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x220]
mov r8, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
test eax, eax
je 0x140009345
lea rdx, [rsp + 0x220]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x620]
xor rcx, rsp
call fcn.14001a510
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000bb00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
xor bl, bl
test rcx, rcx
je 0x14000bc59
cmp qword [0x140042b88], 8
mov qword [rsp + 0x58], rdi
lea rdi, [0x140042b70]
cmovae rdi, qword [0x140042b70]
mov rdx, rdi
call fcn.14001acc0
mov r11, rax
test rax, rax
je 0x14000bc4c
mov qword [rsp + 0x50], rsi
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
repne scasw ax, word [rdi]
lea rdx, [0x1400372c0]
not rcx
lea r13, [r11 + rcx*2]
lea rcx, [r13 + 2]
call fcn.14001acc0
lea rdx, str..cfm
mov rcx, r13
mov r12, rax
call fcn.14001acc0
test r12, r12
je 0x14000bc47
test rax, rax
je 0x14000bc47
sub r12, r13
mov qword [rsp + 0x48], rbp
sar r12, 1
lea eax, [r12 + 1]
movsxd rbp, eax
mov eax, 2
mul rbp
cmovo rax, rsi
mov rcx, rax
call fcn.140016e40
mov rsi, rax
test rax, rax
je 0x14000bc25
test rbp, rbp
je 0x14000bbd9
xor eax, eax
mov rdi, rsi
mov rcx, rbp
movzx eax, ax
rep stosw word [rdi], ax
movsxd r8, r12d
mov rdx, r13
mov rcx, rsi
call fcn.14001aae4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000bbf7
mov bl, 1
mov rax, qword [0x140044d10]
mov qword [rsp + 0x40], rsi
test rax, rax
jne 0x14000bc19
call fcn.140018630
mov qword [0x140044d10], rax
test rax, rax
je 0x14000bc25
lea rcx, [rsp + 0x40]
mov edx, 1
call rax
mov rbp, qword [rsp + 0x48]
movzx eax, bl
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbx
ret
movzx eax, bl
jmp 0x14000bc2d
mov al, 1
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbx
ret
movzx eax, bl
add rsp, 0x30
pop rbx
ret