joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140081ea4
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov byte [r11 + 0x20], r9b
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r8
lea rax, [r11 + 0x20]
mov rbp, rdx
mov qword [r11 - 0x40], rax
xor r13d, r13d
lea r9, [r11 - 0x38]
mov r12, rcx
mov qword [r11 - 0x48], r13
mov rdx, rsi
mov dword [r11 + 0x20], r13d
mov rcx, rbp
xor r8d, r8d
mov edi, r13d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
mov r14d, 0x80070000
test eax, eax
jg 0x14017d2f4
test ebx, ebx
js 0x140081fe5
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x88]
dec eax
cmp eax, 1
ja 0x14017d2ff
test ecx, ecx
je 0x14017d2ff
test cl, 1
jne 0x14017d2ff
test ebx, ebx
js 0x140081fe5
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14017d38c
lea rax, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x14017d309
test ebx, ebx
js 0x140081fe5
mov esi, dword [rsp + 0x88]
shr esi, 1
dec esi
cmp dword [rsp + 0x30], 2
je 0x14017d314
test ebx, ebx
js 0x140081fe5
cmp word [rdi + rsi*2], r13w
jne 0x140082015
mov rcx, r12
inc esi
call fcn.140082024
test rdi, rdi
je 0x140081fe2
test rsi, rsi
je 0x140081fe2
lea rax, [rsi - 1]
mov qword [r12], rdi
mov qword [r12 + 8], rax
mov qword [r12 + 0x10], rsi
mov word [rdi + rsi*2 - 2], r13w
mov rdi, r13
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ebx, 0x8007000d
jmp 0x140081fe5
movzx ebx, ax
or ebx, r14d
jmp 0x140081f0c
mov ebx, 0x8007000d
jmp 0x140081f3b
movzx ebx, ax
or ebx, r14d
jmp 0x140081f91
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
je 0x140081fab
mov ecx, r14d
add rcx, rcx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
je 0x14017d38c
mov r8d, r14d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
je 0x14017d396
cmp eax, r14d
ja 0x14017d396
mov rcx, rdi
mov ebx, r13d
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rdi, rbp
lea esi, [r15 - 1]
jmp 0x140081faf
mov ebx, 0x8007000e
jmp 0x140081fe5
mov rcx, rbp
mov ebx, 0x8007007a
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
jmp 0x140081fab
Function at 0x140088b40
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, [r11 - 0x28]
mov dword [rsp + 0x40], reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [r11 - 0x38], rax
lea r8, str.PersonalColors_Background
lea rax, [r11 - 0x20]
mov r9d, 2
mov qword [r11 - 0x40], rax
lea rdx, str.SoftwarePoliciesMicrosoftWindowsPersonalization
and qword [r11 - 0x48], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
xor edx, edx
test eax, eax
lea ecx, [rdx + 1]
cmove edx, ecx
xchg dword [0x14037d280], edx
call fcn.140088bd0
mov byte [0x14037be1c], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a2260
add rsp, 0x68
ret

Function at 0x14008f3a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x40
mov ebx, dword [rsp + 0x78]
xor esi, esi
mov rdi, qword [rsp + 0x70]
cmp ebx, 0x7fffffff
ja 0x14008f416
lea eax, [rbx + rbx]
mov dword [rsp + 0x78], eax
lea rax, [r11 + 0x30]
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x14008f405
test ebx, ebx
je 0x14008f3f9
mov word [rdi], si
test eax, eax
jle 0x14008f405
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, 0x216
jmp 0x14008f3ee
Function at 0x14008f690
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rsp + 0x40], rax
or rbp, 0xffffffffffffffff
mov qword [rcx + 0x20], rdx
mov rbx, rcx
test rdx, rdx
je 0x14008f786
xor ebp, ebp
lea rdx, str.DisablePreviewDesktop
xor r8d, r8d
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
lea edi, [rbp + 1]
mov r9d, edi
call qword [sym.imp.api_ms_win_core_registryuserspecific_l1_1_0.dll_SHRegGetBoolUSValueW]
nop dword [rax + rax]
mov r8d, 0x1f4
lea rdx, str.DesktopLivePreviewHoverTime
test eax, eax
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
sete al
mov byte [rbx + 0x73], al
call fcn.140056248
mov rcx, qword [rbx + 0x20]
mov rdx, rbx
mov dword [rbx + 0x58], eax
call qword [0x14039e870]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x20]
lea r9, [rsp + 0x30]
and dword [rsp + 0x30], ebp
mov r8d, edi
and dword [rsp + 0x34], ebp
xor edx, edx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x20], SafeArrayDestroy
call qword [sym.imp.USER32.dll_SetGestureConfig]
nop dword [rax + rax]
mov rcx, rbx
call fcn.14008f7b4
mov rsi, qword [rbx + 0x98]
lea rcx, [rbx + 0x90]
mov rdx, qword [rsi]
mov rdi, qword [rdx + 0x78]
call fcn.140082784
lea rdx, [rbx + 0x90]
mov rcx, rsi
mov rax, rdi
call qword [case.0x14006c37f.0]
mov rax, rbp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a2260
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x140090f54
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rdi
mov qword [r11 + 0x10], rdx
push r14
sub rsp, 0x40
and dword [rsp + 0x58], 0
lea rax, [r11 + 0x10]
mov qword [r11 - 0x18], rax
lea rbp, [0x140305068]
and qword [r11 - 0x20], 0
lea r14, str.SoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager
and qword [r11 - 0x28], 0
mov rdi, r8
mov byte [r8], 0
mov r9d, 0xffff
mov r8, rbp
mov rdx, r14
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x140181522
mov ecx, 0x80000000
lea eax, [rbx + rcx]
test ecx, eax
je 0x140090fef
shr ebx, 0x1f
xor bl, 1
mov byte [rdi], bl
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
cmp ebx, 0x80070002
je 0x140090fce
jmp 0x140181530
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140090fc2
mov rcx, qword [rsp + 0x48]
lea rax, str.RegKey:__ws__ws
mov qword [rsp + 0x30], rbp
lea r8, [0x140338348]
mov qword [rsp + 0x28], r14
mov r9d, ebx
mov edx, Ordinal_254
mov qword [rsp + 0x20], rax
call fcn.1401ba878
mov eax, ebx
jmp 0x140090fd8
Function at 0x140093798
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
lea rdx, [rbp + 0x10]
mov byte [rbp + 0x10], 0
mov ecx, Ordinal_54
call fcn.140048b64
cmp byte [rbp + 0x10], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearch
jne 0x140181bc0
and qword [rbp + 0x10], 0
lea rax, [rbp + 0x10]
and qword [rbp - 0x18], 0
mov r9d, 0xf003f
mov qword [rbp - 0x20], rax
xor r8d, r8d
lea rax, [rbp - 0x18]
mov byte [rbp - 0x10], 1
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
sete bl
cmp byte [rbp - 0x10], 0
je 0x14009381b
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
call fcn.14006ee3c
test bl, bl
je 0x14009383e
mov rcx, qword [rbp + 0x10]
lea rdx, str.SearchboxTaskbarModeForceGlyph
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, eax
je 0x140181c60
mov rcx, qword [rbp + 0x10]
test rcx, rcx
jne 0x140093856
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140093847
mov rbx, 0xffffffff80000001
lea r9, [rbp + 0x10]
mov rcx, rbx
lea r8, str.SearchboxTaskbarMode
call fcn.14002cdc0
cmp eax, 0x80070002
jne 0x140093847
lea r9, [rbp + 0x10]
mov rcx, rbx
lea r8, str.SearchboxTaskbarModeForceGlyph
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearch
call fcn.14002cdc0
cmp eax, 0x80070002
jne 0x140093847
mov r9d, 4
mov dword [rbp + 0x18], 1
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], r9d
lea r8, str.SearchboxTaskbarModeForceGlyph
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearch
mov rcx, rbx
call fcn.14018f1f4
xor r8d, r8d
lea r9, str.TraySettings
mov ecx, 0xffff
lea edx, [r8 + 0x1a]
call qword [0x14039e760]
nop dword [rax + rax]
nop
jmp 0x140093847
xor r8d, r8d
lea r9, str.TraySettings
mov ecx, 0xffff
lea edx, [r8 + 0x1a]
call qword [0x14039e760]
nop dword [rax + rax]
nop
jmp 0x14009383e
Function at 0x140093a08
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp qword [0x140378590], 0
lea rax, [0x1401f0a00]
mov qword [0x14037d5d0], rax
jne 0x140093a7f
xor edi, edi
cmp byte [0x14037bdb8], dil
je 0x140093aa8
cmp byte [0x14037bda8], 0
lea rdx, [0x140378590]
jne 0x140181da3
mov rax, qword [0x140378170]
lea rcx, [0x140305338]
mov r9, rdx
mov r8, rdx
lea rdx, [0x140081de0]
call qword [case.0x14006c37f.0]
lea rax, [0x14037d5d0]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400a2260
mov rbx, qword [rsp + 0x190]
add rsp, 0x180
pop rdi
ret
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x114
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
jne 0x140181cb8
jmp 0x140181cde
cmp dword [rsp + 0x54], 6
setb cl
mov byte [0x14037bda8], cl
ja 0x140181cd1
jne 0x140181cd6
cmp dword [rsp + 0x58], 1
jbe 0x140181cd6
mov edi, 1
test cl, cl
jne 0x140181d97
lea rcx, str.advapi32.dll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140181d1c
test edi, edi
je 0x140181d90
lea rcx, [0x14030c4e0]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140181d90
lea rdx, [0x14030c4a0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x14037bdb0], rax
test rax, rax
je 0x140181d90
lea rdx, [0x14030c4b0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x140378170], rax
test rax, rax
je 0x140181d82
lea rdx, [0x14030c490]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x14037bda0], rax
test rax, rax
jne 0x140181d97
lea rax, [0x1400ec8e0]
mov qword [0x140378170], rax
mov byte [0x14037bda8], 1
mov byte [0x14037bdb8], 1
jmp 0x140093a4a
and qword [rsp + 0x48], 0
lea rax, [0x140305338]
mov qword [rsp + 0x38], rdx
lea rcx, [rsp + 0x40]
and qword [rsp + 0x30], 0
mov r9d, 1
and qword [rsp + 0x28], 0
mov r8, rax
mov qword [rsp + 0x20], rcx
lea rcx, [0x1401f0a10]
mov qword [0x140378590], rdx
mov qword [rsp + 0x40], rax
call qword [sym.imp.api_ms_win_eventing_classicprovider_l1_1_0.dll_RegisterTraceGuidsW]
nop dword [rax + rax]
nop
jmp 0x140093a7f
Function at 0x140096c18
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [0x14037be48]
test rbx, rbx
je 0x140096c3d
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor edx, edx
lea rcx, [0x1403006e0]
mov r8d, 0x800
mov ebx, 0x7ffe0030
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140096c98
lea rdx, str.RtlGetNtSystemRoot
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x140096c89
call qword [case.0x14006c37f.0]
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
mov qword [0x14037be48], rbx
jmp 0x140096c2e

Function at 0x140097584
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
mov r11, rsp
sub rsp, 0x58
and qword [r11 - 0x18], 0
lea rax, [r11 + 0x10]
mov rcx, qword [0x14037ca98]
lea rdx, str.Shutdown
mov qword [r11 - 0x20], rax
xor r9d, r9d
and qword [r11 - 0x28], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jg 0x140182f38
js 0x140097619
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov r9d, 4
lea rdx, str.CleanShutdown
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
add rsp, 0x58
ret
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0x1400975d6

Function at 0x140097688
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x40
mov rsi, qword [rsp + 0x70]
lea rax, [r11 + 0x30]
mov qword [r11 - 0x18], rax
mov bpl, r9b
lea rax, [r11 + 0x28]
mov dword [rsp + 0x78], 4
mov qword [r11 - 0x20], rax
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
and qword [r11 - 0x28], 0
mov rdi, r8
and dword [rsi], 0
mov r14, rdx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jg 0x140182f5c
test ebx, ebx
js 0x140182f6a
mov eax, dword [rsp + 0x70]
mov dword [rsi], eax
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1400976eb
test bpl, bpl
je 0x140182f7b
cmp ebx, 0x80070002
je 0x1400976f9
mov rcx, qword [rsp + 0x48]
lea rax, [0x1402ff860]
test rdi, rdi
lea r8, str.onecoreuap_shellcontentdeliverymanagerutilsincContentDeliveryManagerSettings.h
mov r9d, ebx
mov edx, 0x4f
cmove rdi, rax
lea rax, str.RegKey:__ws__ws
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.1401ba878
mov eax, ebx
jmp 0x1400976fb
Function at 0x1400977ec
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push rdi
sub rsp, 0x38
xor ebx, ebx
lea rax, [r11 + 0x20]
xor r8d, r8d
mov qword [r11 + 0x20], rbx
lea rdx, str.SystemSetup
mov qword [r11 - 0x28], rax
mov rcx, 0xffffffff80000002
lea edi, [rbx + 1]
mov r9d, edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140097887
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Upgrade
mov dword [rsp + 0x58], 4
mov dword [rsp + 0x50], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140097891
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
cmp dword [rsp + 0x50], 4
cmove ebx, edi
jmp 0x140097876
Function at 0x1400988a4
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14037d278]
mov ebx, 0x80004005
test rax, rax
jne 0x1400988eb
lea r8, [0x140305920]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
nop dword [rax + rax]
mov rcx, rax
test rax, rax
je 0x1400988eb
xor eax, eax
lock cmpxchg qword [0x14037d278], rcx
jne 0x140183434
mov rax, qword [0x14037d278]
test rax, rax
je 0x140098917
mov rcx, qword [0x14037d278]
or edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
btr eax, 7
neg eax
sbb ecx, ecx
and ebx, ecx
mov eax, ebx
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x1400988eb

Function at 0x14009bb74
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rdx
mov dword [rbp + 0x20], 4
lea rax, [rbp + 0x20]
mov rbx, rcx
mov qword [r11 - 0x18], rax
lea r8, str.Delay_Sec
lea rax, [rbp + 0x28]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [r11 - 0x20], rax
xor edx, edx
and qword [r11 - 0x28], 0
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14009bbd8
mov eax, dword [rbp + 0x28]
cmp eax, 0x418937
jae 0x14009bbd8
mov dword [rbx + 0x38], eax
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], 4
mov qword [rsp + 0x30], rax
lea r8, str.BoxedPriorityClass
lea rax, [rbp + 0x28]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14009bc2a
mov eax, dword [rbp + 0x28]
cmp eax, 0x4000
jne 0x1401858ac
mov dword [rbx + 0x4c], eax
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], 4
mov qword [rsp + 0x30], rax
lea r8, str.BoxedIoPriority
lea rax, [rbp + 0x28]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14009bc76
mov eax, dword [rbp + 0x28]
cmp eax, 2
ja 0x14009bc76
mov dword [rbx + 0x50], eax
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], 4
mov qword [rsp + 0x30], rax
lea r8, str.BoxedPagePriority
lea rax, [rbp + 0x28]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14009bcc2
mov eax, dword [rbp + 0x28]
cmp eax, 5
ja 0x14009bcc2
mov dword [rbx + 0x54], eax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
cmp eax, 0x20
je 0x14009bc27
cmp eax, 0x40
jne 0x14009bc2a
jmp 0x14009bc27
Function at 0x14009f170
Capabilities:
Resume thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov r14, r8
mov rcx, qword [rcx + 0x30]
mov rbp, rdx
test rcx, rcx
jne 0x1401853c2
mov ebx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp dword [rdi + 0x38], 0
je 0x14009f19f
cmp dword [rdi + 0x3c], 0
jne 0x1401853f0
lea r8, [rdi + 0x40]
call fcn.14018a8dc
mov ebx, eax
test eax, eax
js 0x14009f1a4
mov rcx, qword [rdi + 0x30]
mov dword [rdi + 0x3c], 1
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_job_l2_1_0.dll_AssignProcessToJobObject]
nop dword [rax + rax]
test eax, eax
jne 0x14018540f
call fcn.14002154c
mov ebx, eax
jmp 0x14009f1a4
lea r8, [rdi + 0x4c]
xor r9d, r9d
mov rdx, rbp
call fcn.14018a978
mov ebx, eax
test eax, eax
jns 0x14009f1a4
mov r9b, 1
lea r8, [rdi + 0x40]
mov rdx, rbp
call fcn.14018a978
nop
jmp 0x14009f1a4

Function at 0x14009f5dc
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
and qword [rsp + 0x28], 0
lea r8, [0x14009f240]
and dword [rsp + 0x20], 0
mov rbx, rcx
mov r9, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
nop dword [rax + rax]
test rax, rax
je 0x1401858f6
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
add rsp, 0x30
pop rbx
ret
and dword [rbx + 0x38], 0
mov rcx, rbx
call fcn.14009f258
nop
jmp 0x14009f622
Function at 0x14009f940
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
xor dil, dil
cmp qword [rcx + 0x18], 0
je 0x1401859e2
and qword [rbp - 0x30], 0
mov r9d, 1
lea r8, str.PastIconsStream
lea rdx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionTrayNotify
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_shcore_stream_l1_1_0.dll_SHOpenRegStream2W]
nop dword [rax + rax]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140035434
cmp qword [rbp - 0x30], 0
je 0x14009fa1a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], eax
mov dword [rbp - 0x28], SafeArrayUnaccessData
mov dword [rbp - 0x24], 5
mov dword [rbp - 0x20], 0x10001
mov rcx, qword [rsi + 0x18]
call fcn.140098fc0
mov ecx, eax
mov dword [rbp - 0x1c], eax
mov eax, dword [rbp - 0x28]
mov dword [rbp - 0x18], eax
test ecx, ecx
je 0x14009fa1a
mov r8d, SafeArrayUnaccessData
lea rdx, [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_shcore_stream_l1_1_0.dll_IStream_Write]
nop dword [rax + rax]
test eax, eax
js 0x14009fa1a
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rsi + 0x18]
call fcn.14009fa54
test eax, eax
setne dil
lea rcx, [rbp - 0x30]
call fcn.14000bb34
test dil, dil
je 0x1401859e2
mov al, dil
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400a2260
lea r11, [rsp + 0x60]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionTrayNotify
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14009fa2c
lea rdx, str.PastIconsStream
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
jmp 0x14009fa2c