joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400269b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x1a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1d0], rbx
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x1c8], ebp
call fcn.140026c00
cmp rax, rdi
je 0x140026a2f
mov ecx, dword [0x1400e6084]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, rdi
jne 0x140026a08
mov rdx, qword [rdi]
mov ecx, dword [0x1400e6084]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x140026a2f
mov r9d, 0x17
lea r8, str.....lib1locTransMap.cxx
lea rdx, str.thrInst__this
lea rcx, [rsp + 0x58]
call fcn.140022960
mov rcx, rax
call fcn.140022860
nop
mov rbx, qword [rdi + 0x28]
test rbx, rbx
je 0x140026a5b
mov rsi, qword [rdi + 0x30]
cmp rbx, rsi
je 0x140026a52
mov rcx, qword [rbx]
call fcn.140073030
add rbx, 8
cmp rbx, rsi
jne 0x140026a41
mov rcx, qword [rdi + 0x28]
call fcn.140073020
mov qword [rdi + 0x28], rbp
mov qword [rdi + 0x30], rbp
mov qword [rdi + 0x38], rbp
lea rbx, [rdi + 8]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1400261e0
mov rcx, qword [rbx + 8]
call fcn.140073020
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1a0
pop rdi
pop rsi
pop rbp
ret

Function at 0x140026b60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rcx
mov ecx, dword [0x1400e6084]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rdi], rax
lea rcx, [rdi + 8]
call fcn.140025370
mov qword [rdi + 0x10], rax
mov byte [rax + 0x31], 1
mov rax, qword [rdi + 0x10]
mov qword [rax + 8], rax
mov rax, qword [rdi + 0x10]
mov qword [rax], rax
mov rax, qword [rdi + 0x10]
mov qword [rax + 0x10], rax
xor eax, eax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x38], rax
mov rdx, rdi
mov ecx, dword [0x1400e6084]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rax, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140026c00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov eax, dword [0x1400e6080]
test al, 1
jne 0x140026cb7
or eax, 1
mov dword [0x1400e6080], eax
mov ecx, dword [0x1400e6084]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [0x1400e6040], rax
lea rcx, [0x1400e6048]
call fcn.140025370
mov qword [0x1400e6050], rax
mov byte [rax + 0x31], 1
mov rax, qword [0x1400e6050]
mov qword [rax + 8], rax
mov rax, qword [0x1400e6050]
mov qword [rax], rax
mov rax, qword [0x1400e6050]
mov qword [rax + 0x10], rax
xor eax, eax
mov qword [0x1400e6058], rax
mov qword [0x1400e6068], rax
mov qword [0x1400e6070], rax
mov qword [0x1400e6078], rax
lea rbx, [0x1400e6040]
mov rdx, rbx
mov ecx, dword [0x1400e6084]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rcx, [0x1400b4530]
call fcn.140075530
nop
mov rax, rbx
jmp 0x140026cbe
lea rax, [0x1400e6040]
add rsp, 0x30
pop rbx
ret

Function at 0x140026d10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov ecx, dword [0x1400e6084]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140026d3f
mov ecx, dword [0x1400e6084]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x140026de6
mov eax, dword [0x1400e6080]
test al, 1
jne 0x140026ddf
or eax, 1
mov dword [0x1400e6080], eax
mov ecx, dword [0x1400e6084]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [0x1400e6040], rax
lea rcx, [0x1400e6048]
call fcn.140025370
mov qword [0x1400e6050], rax
mov byte [rax + 0x31], 1
mov rax, qword [0x1400e6050]
mov qword [rax + 8], rax
mov rax, qword [0x1400e6050]
mov qword [rax], rax
mov rax, qword [0x1400e6050]
mov qword [rax + 0x10], rax
xor ecx, ecx
mov qword [0x1400e6058], rcx
mov qword [0x1400e6068], rcx
mov qword [0x1400e6070], rcx
mov qword [0x1400e6078], rcx
lea rdx, [0x1400e6040]
mov ecx, dword [0x1400e6084]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rcx, [0x1400b4530]
call fcn.140075530
nop
lea rax, [0x1400e6040]
add rsp, 0x38
ret

Function at 0x140028510
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x190], rbx
mov rbx, rcx
mov dword [rsp + 0x188], 0
mov ecx, dword [0x1400e6098]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, rbx
jne 0x1400285a6
mov rdx, qword [rbx + 0x18]
mov ecx, dword [0x1400e6098]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp qword [rbx + 0x10], 0
je 0x140028578
lea rdx, str.restoring_locale
lea rcx, [0x1400e5b78]
call fcn.14000a020
nop
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x140028592
mov rcx, rdi
call fcn.1400269b0
mov rcx, rdi
call fcn.140073020
nop
mov rcx, qword [rbx + 0x10]
call fcn.140073030
nop
mov rcx, qword [rbx]
call fcn.140073030
jmp 0x1400285cd
mov r9d, 0x2c
lea r8, str.....lib1locLocaleSetter.cxx
lea rdx, str.thrInst__this
lea rcx, [rsp + 0x28]
call fcn.140022960
mov rcx, rax
call fcn.140022860
nop
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rdi
ret
Function at 0x140028640
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400e6098]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140028678
mov ecx, dword [0x1400e6098]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp qword [rax], 0
je 0x140028678
mov ecx, dword [0x1400e6098]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rax, [0x1400e6088]
add rsp, 0x28
ret
Function at 0x14002ad90
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1400e4340]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov edi, edx
mov rbx, rcx
mov qword [r11 - 0x50], rcx
xor esi, esi
mov qword [rcx], rsi
lea r9d, [rsi + 0xa]
lea r8, [r11 - 0x28]
lea edx, [rsi + 0x59]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14002af07
lea r9d, [rsi + 0xa]
lea r8, [rsp + 0x88]
lea edx, [rsi + 0x5a]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14002af02
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
or r9d, 0xffffffff
mov r8d, 0xfde9
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x58]
call fcn.14003f610
nop
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
or r9d, 0xffffffff
mov r8d, 0xfde9
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call fcn.14003f610
nop
lea rax, [0x1400b96b0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.140027020
mov rcx, qword [rax]
mov qword [rax], rsi
mov qword [rbx], rcx
mov rcx, qword [rsp + 0x70]
call fcn.140073030
nop
cmp byte [rsp + 0x50], sil
je 0x14002aebd
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002aec2
movsxd rdx, dword [rsp + 0x40]
call fcn.14001e970
mov rcx, qword [rsp + 0x48]
jmp 0x14002aec2
mov rcx, qword [rsp + 0x48]
call fcn.140073030
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], rsi
cmp byte [rsp + 0x68], 0
je 0x14002aef2
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14002aef7
movsxd rdx, dword [rsp + 0x58]
call fcn.14001e970
mov rcx, qword [rsp + 0x60]
jmp 0x14002aef7
mov rcx, qword [rsp + 0x60]
call fcn.140073030
nop
mov rax, rbx
jmp 0x14002af0a
mov rax, rbx
jmp 0x14002af0a
mov rax, rbx
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400755f0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140041c50
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x1b0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov esi, edx
mov rdi, rcx
mov eax, dword [0x1400e6260]
test al, 1
jne 0x140041cb6
or eax, 1
mov dword [0x1400e6260], eax
xor r9d, r9d
lea r8, str.GetLocaleInfoEx
lea rdx, str.Kernel32
lea rcx, [0x1400e6250]
call fcn.14004b920
lea rcx, [0x1400b46a0]
call fcn.140075530
nop
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x48], r12
mov byte [rsp + 0x50], r12b
mov rcx, qword [rdi + 0x290]
or r13, 0xffffffffffffffff
test rcx, rcx
je 0x140041d29
mov rax, qword [0x1400e6250]
test rax, rax
je 0x140041d29
xor r9d, r9d
xor r8d, r8d
mov edx, esi
call rax
test eax, eax
jle 0x140041e14
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.14002b210
mov r9d, dword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov edx, esi
mov rcx, qword [rdi + 0x290]
call qword [0x1400e6250]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140040f90
jmp 0x140041d97
mov ecx, dword [rdi + 0x2a0]
test ecx, ecx
je 0x140041e14
xor r9d, r9d
xor r8d, r8d
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movsxd rbp, eax
test eax, eax
jle 0x140041e14
mov eax, 2
mul rbp
cmovo rax, r13
mov rcx, rax
call fcn.1400725d0
mov rbx, rax
xor ecx, ecx
call fcn.140073030
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x48], rbx
mov r9d, ebp
mov r8, rbx
mov edx, esi
mov ecx, dword [rdi + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140040f90
movsxd rdi, dword [rsp + 0x40]
test edi, edi
jle 0x140041e14
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
mov r9d, r13d
mov r8d, 0xfde9
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14003f610
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x58], r12d
xor ecx, ecx
call fcn.140073030
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x60], r12
cmp byte [rsp + 0x50], 0
je 0x140041e04
test rbx, rbx
je 0x140041e04
mov rdx, rdi
add rdx, rdx
mov rcx, rbx
call fcn.14001e970
mov rcx, rbx
call fcn.140073030
mov rax, rsi
jmp 0x140041ea2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rax, [0x1400b59c8]
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x80], 0
mov byte [rsp + 0x180], 0
mov r9d, r13d
lea r8, str.GetLocaleInfo_Ex_
mov edx, 0x100
lea rcx, [rsp + 0x80]
call fcn.14001e6f0
lea r11, [0x1400b5a30]
mov qword [rsp + 0x78], r11
mov byte [rsp + 0x180], 0
mov r9d, r13d
lea r8, str.System
mov edx, 0x20
lea rcx, [rsp + 0x180]
call fcn.14001e6f0
mov edx, ebx
lea rcx, [rsp + 0x78]
call fcn.140020200
lea rdx, [0x1400e07e8]
lea rcx, [rsp + 0x78]
call fcn.140073110
nop
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1400462b0
Capabilities:
Compare security identifiers

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x1400462d2
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400462d2
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1400462d2
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x140046e20
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x170
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov rbp, r8
mov rdi, rdx
mov r12, rcx
lea rax, [rax + 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140046efc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rax, [0x1400b59c8]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x148], 0
or r9d, 0xffffffff
lea r8, str.GetTokenInformation_length_
mov edx, 0x100
lea rcx, [rsp + 0x48]
call fcn.14001e6f0
lea r11, [0x1400b5a30]
mov qword [rsp + 0x40], r11
mov byte [rsp + 0x148], 0
or r9d, 0xffffffff
lea r8, str.System
lea edx, [r9 + 0x21]
lea rcx, [rsp + 0x148]
call fcn.14001e6f0
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140020200
lea rdx, [0x1400e07e8]
lea rcx, [rsp + 0x40]
call fcn.140073110
int3
xor ebx, ebx
movsxd rax, dword [rsp + 0x1a8]
test eax, eax
je 0x140046f17
mov rcx, rax
call fcn.1400725d0
mov rsi, rax
jmp 0x140046f1a
mov rsi, rbx
xor ecx, ecx
call fcn.140073030
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x1a8]
mov r8, rsi
mov edx, 2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140046fdd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rax, [0x1400b59c8]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x148], 0
or r9d, 0xffffffff
lea r8, str.GetTokenInformation_data_
mov edx, 0x100
lea rcx, [rsp + 0x48]
call fcn.14001e6f0
lea r11, [0x1400b5a30]
mov qword [rsp + 0x40], r11
mov byte [rsp + 0x148], 0
or r9d, 0xffffffff
lea r8, str.System
lea edx, [r9 + 0x21]
lea rcx, [rsp + 0x148]
call fcn.14001e6f0
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140020200
lea rdx, [0x1400e07e8]
lea rcx, [rsp + 0x40]
call fcn.140073110
int3
cmp dword [rsi], 0
jbe 0x140047035
lea rdi, [rsi + 8]
nop
nop
nop
mov rdx, qword [r12]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14004700e
add ebx, 1
add rdi, 0x10
cmp ebx, dword [rsi]
jb 0x140046ff0
jmp 0x140047035
test rbp, rbp
je 0x140047029
mov eax, ebx
add rax, 1
shl rax, 4
mov ecx, dword [rax + rsi]
shr ecx, 2
and cl, 1
mov byte [rbp], cl
mov rcx, rsi
call fcn.140073030
mov al, 1
jmp 0x140047048
test rbp, rbp
je 0x14004703e
mov byte [rbp], 0
mov rcx, rsi
call fcn.140073030
xor al, al
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140063180
Capabilities:
Get hostname

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1400e4340]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, rcx
mov qword [r11 - 0x48], rcx
xor esi, esi
mov qword [rcx], rsi
mov dword [rsp + 0x40], 0x10
lea rdx, [r11 - 0x68]
lea rcx, [r11 - 0x38]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
movzx ecx, word [rsp + 0x70]
test eax, eax
cmove cx, si
mov word [rsp + 0x70], cx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
or r9d, 0xffffffff
mov r8d, 0xfde9
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14003f610
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x48], esi
mov rcx, qword [rdi]
call fcn.140073030
mov qword [rdi], rbx
cmp byte [rsp + 0x58], sil
je 0x140063242
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140063247
movsxd rdx, dword [rsp + 0x48]
call fcn.14001e970
mov rcx, qword [rsp + 0x50]
jmp 0x140063247
mov rcx, qword [rsp + 0x50]
call fcn.140073030
nop
mov rax, rdi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400755f0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140066da0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x158
mov ecx, dword [0x1400e6698]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140066dfd
lea rax, [0x1400b59c8]
lea r8, str.No_EventManager
lea rcx, [rsp + 0x28]
or r9d, 0xffffffff
mov edx, 0x100
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x128], 0
call fcn.14001e6f0
lea rdx, [0x1400e0790]
lea rcx, [rsp + 0x20]
call fcn.140073110
int3
mov ecx, dword [0x1400e6698]
add rsp, 0x158
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x14006b780
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
mov r14, r9
mov rbx, r8
mov r15, rcx
mov eax, dword [r8]
mov dword [r11 + 0x18], eax
mov dword [rsp + 0x38], 0
mov qword [r11 - 0x38], 0
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x20], 0
or r9d, 0xffffffff
mov r8d, 0xfde9
lea rcx, [r11 - 0x40]
call fcn.140049000
nop
mov edi, 0xea
nop
nop
mov rax, qword [rbx + 8]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, r14
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp eax, edi
je 0x14006b828
test eax, eax
jne 0x14006b91d
mov rbp, qword [rbx + 8]
mov edx, dword [rsp + 0x90]
test rbp, rbp
jne 0x14006b83d
test edx, edx
cmovne esi, edi
mov r8d, dword [rbx]
mov eax, r8d
cmp edx, r8d
cmovl eax, edx
xor r13d, r13d
test eax, eax
cmovg r13d, eax
mov ecx, r13d
cmp edx, r13d
cmovg ecx, edx
xor edi, edi
test ecx, ecx
cmovg edi, ecx
cmp edi, r8d
jg 0x14006b8b8
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
cmp edi, eax
jge 0x14006b87b
cmp edi, 0x80
jge 0x14006b8b8
cmp rbp, rbp
je 0x14006b893
movsxd r8, r13d
test r13d, r13d
jle 0x14006b893
mov rdx, rbp
mov rcx, rbp
call fcn.140074230
cmp byte [rbx + 0x10], 0
je 0x14006b8b4
mov r8, qword [rbx + 8]
test r8, r8
je 0x14006b8b4
mov eax, dword [rbx]
sub eax, edi
movsxd rdx, eax
movsxd rcx, edi
add rcx, r8
call fcn.14001e970
mov dword [rbx], edi
jmp 0x14006b90f
test edi, edi
je 0x14006b8c9
movsxd rcx, edi
call fcn.1400725d0
mov r12, rax
jmp 0x14006b8cc
xor r12d, r12d
movsxd r8, r13d
test r13d, r13d
jle 0x14006b8df
mov rdx, rbp
mov rcx, r12
call fcn.140074230
cmp byte [rbx + 0x10], 0
je 0x14006b8f6
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14006b8f6
movsxd rdx, dword [rbx]
call fcn.14001e970
mov rcx, qword [rbx + 8]
call fcn.140073030
xor r11d, r11d
test edi, edi
cmovg r11d, edi
mov dword [rbx], r11d
mov qword [rbx + 8], r12
mov edi, 0xea
cmp esi, edi
jne 0x14006b950
jmp 0x14006b7f0
cmp byte [rsp + 0x48], 0
je 0x14006b942
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14006b947
movsxd rdx, dword [rsp + 0x38]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x40]
jmp 0x14006b947
mov rcx, qword [rsp + 0x40]
call fcn.140073030
mov eax, esi
jmp 0x14006b981
cmp byte [rsp + 0x48], 0
je 0x14006b975
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14006b97a
movsxd rdx, dword [rsp + 0x38]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x40]
jmp 0x14006b97a
mov rcx, qword [rsp + 0x40]
call fcn.140073030
mov eax, esi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14006bdc0
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x190
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x1b0], eax
cmp byte [0x1400e3e01], al
je 0x14006bed8
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], al
mov dword [rsp + 0x20], eax
or r9d, 0xffffffff
mov r8d, 0xfde9
lea rcx, [rsp + 0x30]
call fcn.140049000
nop
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
cmp byte [rsp + 0x40], 0
je 0x14006be45
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14006be4a
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x38]
jmp 0x14006be4a
mov rcx, qword [rsp + 0x38]
call fcn.140073030
test ebx, ebx
je 0x14006beff
lea rax, [0x1400b59c8]
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x158], 0
or r9d, 0xffffffff
lea r8, str.RegDeleteValue
mov edx, 0x100
lea rcx, [rsp + 0x58]
call fcn.14001e6f0
lea r11, [0x1400b5a30]
mov qword [rsp + 0x50], r11
mov byte [rsp + 0x158], 0
or r9d, 0xffffffff
lea r8, str.System
lea edx, [r9 + 0x21]
lea rcx, [rsp + 0x158]
call fcn.14001e6f0
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140020200
lea rdx, [0x1400e07e8]
lea rcx, [rsp + 0x50]
call fcn.140073110
int3
mov r9d, 0x10a
lea r8, str.....lib1oswinRegistry.cxx
lea rdx, str.writeAllowed
lea rcx, [rsp + 0x50]
call fcn.140022960
mov rcx, rax
call fcn.140022860
int3
add rsp, 0x190
pop rbx
ret
Function at 0x14006bf30
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x1a0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rbx, r9
mov edi, r8d
mov rsi, rcx
xor eax, eax
mov dword [rsp + 0x48], eax
cmp byte [0x1400e3e01], al
je 0x14006c06b
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], al
mov dword [rsp + 0x20], eax
or r9d, 0xffffffff
mov r8d, 0xfde9
lea rcx, [rsp + 0x30]
call fcn.140049000
nop
mov eax, dword [rsp + 0x1d0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, edi
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp byte [rsp + 0x40], 0
je 0x14006bfd8
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14006bfdd
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.14001e970
mov rcx, qword [rsp + 0x38]
jmp 0x14006bfdd
mov rcx, qword [rsp + 0x38]
call fcn.140073030
test ebx, ebx
je 0x14006c092
lea rax, [0x1400b59c8]
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x160], 0
or r9d, 0xffffffff
lea r8, str.RegSetValueEx
mov edx, 0x100
lea rcx, [rsp + 0x60]
call fcn.14001e6f0
lea r11, [0x1400b5a30]
mov qword [rsp + 0x58], r11
mov byte [rsp + 0x160], 0
or r9d, 0xffffffff
lea r8, str.System
lea edx, [r9 + 0x21]
lea rcx, [rsp + 0x160]
call fcn.14001e6f0
mov edx, ebx
lea rcx, [rsp + 0x58]
call fcn.140020200
lea rdx, [0x1400e07e8]
lea rcx, [rsp + 0x58]
call fcn.140073110
int3
mov r9d, 0x122
lea r8, str.....lib1oswinRegistry.cxx
lea rdx, str.writeAllowed
lea rcx, [rsp + 0x58]
call fcn.140022960
mov rcx, rax
call fcn.140022860
int3
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret