joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400054f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x1d0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x140066550]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
mov rbx, rdx
mov qword [r11 - 0x18], rdx
xor dil, dil
xor edx, edx
mov r8d, 0x178
lea rcx, [rsp + 0x40]
call fcn.1400208e0
mov r11d, dword [rbx + 0x1c0]
mov dword [rsp + 0x58], r11d
movzx eax, word [rbx + 4]
mov word [rsp + 0x7c], ax
movzx eax, word [rbx + 8]
mov word [rsp + 0x7e], ax
movzx eax, word [rbx + 0x10]
mov word [rsp + 0x82], ax
movzx eax, word [rbx + 0xc]
mov word [rsp + 0x80], ax
movzx eax, word [rbx + 0x34]
mov word [rsp + 0x8c], ax
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x5c], eax
mov eax, dword [rbx]
mov dword [rsp + 0x60], eax
mov eax, dword [rbx + 0x1c]
mov dword [rsp + 0x64], eax
mov eax, dword [rbx + 0x24]
mov dword [rsp + 0x90], eax
mov eax, dword [rbx + 0x20]
mov dword [rsp + 0x98], eax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x16c], eax
mov eax, dword [rbx + 0x14]
mov dword [rsp + 0x17c], eax
mov eax, dword [rbx + 0x38]
mov dword [rsp + 0x18c], eax
mov eax, dword [rbx + 0x3c]
mov dword [rsp + 0x19c], eax
movzx eax, word [rbx + 0x74]
mov word [rsp + 0xc0], ax
movzx eax, word [rbx + 0x78]
mov word [rsp + 0xc2], ax
movzx eax, word [rbx + 0x80]
mov word [rsp + 0xc6], ax
movzx eax, word [rbx + 0x7c]
mov word [rsp + 0xc4], ax
movzx eax, word [rbx + 0xa4]
mov word [rsp + 0xd0], ax
mov eax, dword [rbx + 0xa0]
mov dword [rsp + 0xa0], eax
mov eax, dword [rbx + 0x70]
mov dword [rsp + 0xa4], eax
mov eax, dword [rbx + 0x8c]
mov dword [rsp + 0xa8], eax
mov eax, dword [rbx + 0x94]
mov dword [rsp + 0xd4], eax
mov eax, dword [rbx + 0x90]
mov dword [rsp + 0xdc], eax
mov eax, dword [rbx + 0x88]
mov dword [rsp + 0x170], eax
mov eax, dword [rbx + 0x84]
mov dword [rsp + 0x180], eax
mov eax, dword [rbx + 0xa8]
mov dword [rsp + 0x190], eax
mov eax, dword [rbx + 0xac]
mov dword [rsp + 0x1a0], eax
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x140051780]
xor edx, edx
lea r8d, [rdx + 0x15]
lea rcx, [0x1400517e0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400056d5
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400056eb
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov edx, 0x178
call qword [rax + 0x198]
movzx edi, dil
mov ecx, 1
test eax, eax
cmovns edi, ecx
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400056eb
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [rsp + 0x30], 0
lea rcx, [rbx + 0x190]
call fcn.140004f10
nop
lea rcx, [rbx + 0x120]
call fcn.140004f10
nop
lea rcx, [rbx + 0xb0]
call fcn.140004f10
nop
lea rcx, [rbx + 0x40]
call fcn.140004f10
mov al, dil
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.1400209e0
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1d0
pop rdi
ret
Function at 0x1400061fc
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x1c0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x140066550]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rsi, rdx
xor ebx, ebx
mov dword [rsp + 0x40], 0x104
xor edx, edx
mov r8d, 0x104
lea rcx, [r11 - 0x128]
call fcn.1400208e0
mov dil, 1
and qword [rsp + 0x70], rbx
mov qword [rsp + 0x98], 0xf
and qword [rsp + 0x90], rbx
mov byte [rsp + 0x80], bl
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xa0]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140006362
test dil, dil
je 0x1400062db
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0xa0]
call fcn.14001f8f0
mov r8, rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.140005324
xor dil, dil
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x14000631c
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0xa0]
call fcn.14001f8f0
mov r8, rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.140005324
inc ebx
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xa0]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400062a7
lea rax, str..ConfigPersist.cpp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0xe1b
mov r8d, ebx
lea rdx, str.Total_available_cofigurations_as_of_now_are___d__n
lea rcx, [rsp + 0x58]
call fcn.140002484
cmp dword [0x140067e2c], ebx
jne 0x1400063b6
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
lea rcx, [rsp + 0x70]
call fcn.140004f10
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400209e0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000b3a0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14000b3e1
xor r9d, r9d
lea rax, str.m_hKey___0
lea rdx, [0x140053e20]
lea ecx, [r9 + 2]
mov r8d, 0x1476
mov qword [rsp + 0x20], rax
call fcn.140021fb0
cmp eax, 1
jne 0x14000b3e1
int3
cmp byte [0x140068098], 0
jne 0x14000b425
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14000b415
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140068090], rax
jmp 0x14000b41c
mov rax, qword [0x140068090]
mov byte [0x140068098], 1
jmp 0x14000b42c
mov rax, qword [0x140068090]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000b442
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x14000b448
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000b638
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14000b67e
xor r9d, r9d
lea rax, str.m_hKey___0
lea rdx, [0x140053e20]
lea ecx, [r9 + 2]
mov r8d, 0x1615
mov qword [rsp + 0x20], rax
call fcn.140021fb0
cmp eax, 1
jne 0x14000b67e
int3
mov rcx, qword [rbx]
lea rax, [rsp + 0x50]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000b6b0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov ebx, r9d
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
jne 0x14000b700
xor r9d, r9d
lea rax, str.m_hKey___0
lea rdx, [0x140053e20]
lea ecx, [r9 + 2]
mov r8d, 0x1621
mov qword [r11 - 0x18], rax
call fcn.140021fb0
cmp eax, 1
jne 0x14000b700
int3
xor eax, eax
test rdi, rdi
setne al
test eax, eax
jne 0x14000b73e
xor r9d, r9d
lea rax, str.__atl_condVal
lea rdx, [0x140053e20]
lea ecx, [r9 + 2]
mov r8d, 0x1622
mov qword [rsp + 0x20], rax
call fcn.140021fb0
cmp eax, 1
jne 0x14000b737
int3
mov eax, 0xd
jmp 0x14000b799
cmp ebx, 1
je 0x14000b773
cmp ebx, 2
je 0x14000b773
xor r9d, r9d
lea rax, str._dwType____1______dwType____2___
lea rdx, [0x140053e20]
lea ecx, [r9 + 2]
mov r8d, 0x1623
mov qword [rsp + 0x20], rax
call fcn.140021fb0
cmp eax, 1
jne 0x14000b773
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsi]
mov r9d, ebx
inc eax
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000b7b0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x30
xor ebx, ebx
mov rsi, r8
mov r12, rdx
mov rbp, rcx
mov edi, 2
cmp qword [rcx], rbx
jne 0x14000b806
lea rax, str.m_hKey___0
lea rdx, [0x140053e20]
xor r9d, r9d
mov r8d, 0x162e
mov ecx, edi
mov qword [r11 - 0x18], rax
call fcn.140021fb0
cmp eax, 1
jne 0x14000b806
int3
cmp rsi, rbx
mov eax, ebx
setne al
cmp eax, ebx
jne 0x14000b842
lea rax, str.__atl_condVal
lea rdx, [0x140053e20]
xor r9d, r9d
mov r8d, 0x162f
mov ecx, edi
mov qword [rsp + 0x20], rax
call fcn.140021fb0
cmp eax, 1
jne 0x14000b83b
int3
mov eax, 0xd
jmp 0x14000b879
mov rdi, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ecx, eax
add ebx, eax
add rdi, rcx
cmp eax, 1
jne 0x14000b845
mov rcx, qword [rbp]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x14000bd4c
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x70
xor ebx, ebx
lea rcx, [r11 + 0x18]
mov rax, rdx
mov qword [r11 - 0x20], rbx
mov qword [r11 - 0x28], rbx
mov qword [r11 - 0x30], rbx
mov qword [r11 - 0x38], rbx
mov qword [r11 - 0x40], rbx
mov qword [r11 - 0x48], rbx
mov qword [r11 - 0x50], rbx
mov qword [r11 - 0x58], rcx
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
xor edx, edx
mov dword [r11 + 0x18], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, ebx
je 0x14000bdf3
mov rdx, qword [0x1400681d0]
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_statreg.h
lea r9, str.Should_not_be_here___n
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3f3
call fcn.14000b184
lea r11, [0x140053c30]
lea rdx, [0x140053fb0]
lea ecx, [rbx + 2]
xor r9d, r9d
mov r8d, 0x3f4
mov qword [rsp + 0x20], r11
call fcn.140021fb0
cmp eax, 1
jne 0x14000bdef
int3
xor eax, eax
jmp 0x14000bdff
cmp dword [rsp + 0x90], ebx
seta bl
mov eax, ebx
add rsp, 0x70
pop rbx
ret
Function at 0x14000c138
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x140066550]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor edi, edi
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x104
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x5c], edi
mov dword [rsp + 0x58], edi
call fcn.1400208e0
lea r11, [rsp + 0x5c]
mov qword [rsp + 0x40], r11
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareinteldisplayigfxcuiprofilesCurrent
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
jne 0x14000c25c
cmp qword [rsp + 0x50], rdi
je 0x14000c25c
lea rdx, str.Select_Profile
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x58], 3
call fcn.140020e00
mov rcx, qword [rsp + 0x50]
lea r9d, [rdi + 4]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], r9d
lea rdx, str.CurrentPresetProfileType
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x50]
lea esi, [rdi + 1]
lea rdx, str.CurrentPresetProfileName
xor r8d, r8d
add eax, esi
mov r9d, esi
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp ebx, edi
jne 0x14000c251
cmp eax, edi
cmove edi, esi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400209e0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000d868
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
sub rsp, 0x58
and qword [rax - 0x28], 0
and qword [rax - 0x20], 0
and dword [rax + 0x20], 0
lea r8, [rax - 0x28]
lea rdx, str.SoftwareIntelDisplayigfxcuiMedia
mov esi, 4
mov rcx, 0xffffffff80000001
mov dword [rax - 0x38], 1
mov dword [rax + 0x18], esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea r8, [rsp + 0x48]
lea rdx, str.SoftwareIntelDisplayigfxcuiMedia
mov rcx, 0xffffffff80000002
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test ebx, ebx
je 0x14000d8cd
test eax, eax
jne 0x14000da89
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x80]
lea rbx, str.EnableACE
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000da89
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x14000da60
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x88]
lea rdx, str.TrackACEUserchange
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
test eax, eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x88]
jne 0x14000d9f5
lea rax, [rsp + 0x70]
lea rdx, str.TrackLastHKLMforACE
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000d9c2
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x78], eax
je 0x14000da89
lea rax, [rsp + 0x78]
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
mov r9d, esi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r11d, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x70], r11d
jmp 0x14000da68
lea rax, [rsp + 0x30]
lea rdx, str.SyncHKCUforACE
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x14000da32
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x28], rax
jmp 0x14000d999
lea rax, [rsp + 0x78]
mov r9d, esi
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rax, [rsp + 0x30]
lea rdx, str.SyncHKCUforACE
jmp 0x14000d9ca
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
lea rdx, str.TrackLastHKLMforACE
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000da99
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000daa9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x58
pop rsi
pop rbx
ret
Function at 0x14000e54c
Capabilities:
Create directory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x370
mov rax, qword [0x140066550]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov rbp, rcx
xor ecx, ecx
mov r12, r8
mov rdi, rdx
call qword [sym.imp.ole32.dll_CoInitialize]
mov edx, 0x5c
mov rcx, rdi
call fcn.140021e20
mov rsi, rax
test rax, rax
je 0x14000e6ee
mov rcx, rdi
call fcn.14001f8f0
mov rcx, rsi
mov rbx, rax
call fcn.14001f8f0
lea rcx, [rsp + 0x40]
sub rbx, rax
mov rdx, rdi
mov r8, rbx
call fcn.1400247b0
mov rcx, rsi
call fcn.14001f8f0
lea rbx, [rsp + 0x40]
mov rcx, rdi
sub rbx, rax
call fcn.14001f8f0
lea rdx, [0x140054818]
lea rcx, [rsp + 0x40]
mov byte [rax + rbx], 0
call fcn.140020d60
lea rdx, [rsp + 0x40]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x14000e60e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000e6ee
lea rax, [rsp + 0x30]
mov esi, 1
lea r9, [0x140057798]
lea rcx, [0x1400577b8]
xor edx, edx
mov r8d, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x14000e663
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
mov rax, qword [rcx]
call qword [rax + QueryPathOfRegTypeLib]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
test eax, eax
je 0x14000e66a
test rcx, rcx
je 0x14000e663
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, ebx
jmp 0x14000e6f3
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x38]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
test eax, eax
jne 0x14000e658
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
lea rdx, [0x1400577a8]
call qword [rax]
mov ebx, eax
test eax, eax
js 0x14000e6de
lea rax, [rsp + 0x150]
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea rdx, [rsp + 0x150]
mov r8d, esi
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000e663
mov eax, 0x80070057
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.1400209e0
add rsp, 0x370
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000ebec
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x140066550]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r9d, dword [rcx + 8]
and qword [rsp + 0x48], 0
and dword [rsp + 0x50], 0
mov rdi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rsi, rcx
lea rcx, [rsp + 0x48]
or r9d, 0x2001f
call fcn.14000b550
mov ebx, eax
test eax, eax
je 0x14000eca3
cmp eax, 2
je 0x14000ed0a
cmp eax, 3
je 0x14000ed0a
mov rdx, qword [0x1400681c0]
lea rax, str.D:Program_FilesMicrosoft_Visual_Studio_9.0VCATLMFCINCLUDE_atlbase.h
lea r9, str.CRegKey::RecurseDeleteKey_:_Failed_to_Open_Key__s_Error___d__n
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x166a
mov qword [rsp + 0x20], rdi
call fcn.14000b184
jmp 0x14000ed0a
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000ebec
mov ebx, eax
test eax, eax
jne 0x14000ed0a
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x70]
xor edx, edx
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x14000ec8e
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000ecf8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
and dword [rsp + 0x50], 0
mov rdx, rdi
mov rcx, rsi
call fcn.14000b3a0
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000ed1a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400209e0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14000f860
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x48
lea rdi, [0x140054af8]
lea rdx, str.Inside_IsModifyRotCapsForDC
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x38], 0xc08
call fcn.140002484
xor ebx, ebx
lea rax, [rsp + 0x78]
lea rdx, str.SoftwareIntelDisplayigfxcuiigfxcfg
lea r9d, [rbx + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x14000f927
lea rdx, str.IsModifyRotCapsForDC_returned_SUCCESS
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x38], 0xc0e
call fcn.140002484
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
lea rdx, str.DCRotationCaps
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x68], 1
sete bl
mov eax, ebx
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x140010188
Capabilities:
Get geographical location
Identify system language via api
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x60
and qword [rax + 0x10], 0
and dword [rax + 8], 0
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor r9d, r9d
movzx ebx, ax
xor r8d, r8d
lea edx, [r9 + 3]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, eax
lea r8d, [rax + 1]
movsxd rcx, r8d
call fcn.14001ec90
mov r9d, esi
mov edx, 3
mov r8, rax
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1400102aa
lea rax, [rsp + 0x70]
lea rdx, str.SoftwareIntelDisplayigfxcuihkcmd_resources
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140010285
mov rcx, qword [rsp + 0x78]
lea r9d, [rax + 1]
lea rdx, str.UserLangID
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140010278
lea rax, [0x140054af8]
lea rdx, str.ERROR:_Couldnt_set_the_registry_value_for_registry_User_Language_in_File:_persistence.cpp_r_n
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x1294
call fcn.140002484
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400102aa
lea rax, [0x140054af8]
lea rdx, str.ERROR:_Couldnt_Open_regsitry_szMUIRegPath_in_File:_persistence.cpp_r_n
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x129b
call fcn.140002484
test rdi, rdi
je 0x1400102b7
mov rcx, rdi
call fcn.14001f3d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret