joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b3fc
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r11d, dword [rcx]
mov esi, dword [rcx + 4]
mov ebp, dword [rcx + 8]
mov r14d, dword [rcx + 0xc]
mov ebx, dword [rcx + 0x10]
mov r12d, dword [rcx + 0x14]
mov r13d, dword [rcx + 0x18]
mov r15d, dword [rcx + 0x1c]
lea r9, [rcx + 0x28]
lea rax, [0x140097fa0]
mov r10, rcx
mov r10, qword [rsp + 0x68]
xor edi, edi
mov qword [rsp + 0x10], 0x10
sub r9, rax
mov ecx, dword [r10]
add r10, 4
mov r8d, ebx
rol ecx, 0x10
mov eax, ecx
mov edx, ecx
shl ecx, 8
shl eax, 8
shr edx, 8
xor edx, eax
lea rax, [r9 + rdi*4]
and edx, 0xff00ff
xor edx, ecx
ror r8d, 0xb
lea rcx, [0x140097fa0]
mov dword [rax + rcx], edx
mov eax, ebx
mov ecx, ebx
rol eax, 7
not ecx
xor r8d, eax
and ecx, r13d
mov eax, ebx
ror eax, 6
xor r8d, eax
mov eax, r12d
and eax, ebx
xor ecx, eax
lea rax, [0x140097fa0]
add r8d, ecx
mov ecx, esi
add r8d, dword [rax + rdi*4]
xor ecx, r11d
mov eax, r11d
add r8d, edx
and ecx, ebp
mov edx, r11d
add r8d, r15d
ror edx, 0xd
rol eax, 0xa
xor edx, eax
mov eax, r11d
mov r15d, r13d
ror eax, 2
mov r13d, r12d
mov r12d, ebx
xor edx, eax
mov eax, esi
lea ebx, [r8 + r14]
and eax, r11d
mov r14d, ebp
mov ebp, esi
xor ecx, eax
mov esi, r11d
inc rdi
add edx, ecx
lea r11d, [rdx + r8]
mov r8d, 0x10
cmp rdi, r8
jl 0x14001b457
mov r10, qword [rsp + 0x60]
lea rax, [0x140097fa0]
lea ecx, [r8 - 2]
lea rax, [rax + rdi*4]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
lea eax, [rcx + 3]
mov r9d, r8d
and eax, 0xf
and r9d, 0xf
mov edx, dword [r10 + rax*4 + 0x28]
mov rax, rcx
and eax, 0xf
mov ecx, dword [r10 + rax*4 + 0x28]
mov r8d, ecx
mov eax, ecx
shr ecx, 0xa
rol r8d, 0xf
rol eax, 0xd
xor r8d, eax
mov eax, edx
xor r8d, ecx
mov ecx, edx
shr edx, 3
rol ecx, 0xe
ror eax, 7
xor ecx, eax
mov rax, qword [rsp]
xor ecx, edx
add eax, 0xfffffffb
mov edx, r11d
add r8d, ecx
and eax, 0xf
mov ecx, ebx
add r8d, dword [r10 + rax*4 + 0x28]
not ecx
mov eax, ebx
add dword [r10 + r9*4 + 0x28], r8d
and ecx, r13d
mov r8d, ebx
ror r8d, 0xb
rol eax, 7
xor r8d, eax
mov eax, ebx
ror eax, 6
xor r8d, eax
mov eax, r12d
and eax, ebx
xor ecx, eax
mov rax, qword [rsp + 8]
add qword [rsp + 8], 4
add r8d, ecx
mov ecx, esi
add r8d, dword [rax]
xor ecx, r11d
mov eax, r11d
add r8d, dword [r10 + r9*4 + 0x28]
and ecx, ebp
add r8d, r15d
ror edx, 0xd
rol eax, 0xa
xor edx, eax
mov eax, r11d
mov r15d, r13d
ror eax, 2
mov r13d, r12d
mov r12d, ebx
xor edx, eax
lea ebx, [r8 + r14]
mov eax, esi
and eax, r11d
mov r14d, ebp
mov ebp, esi
xor ecx, eax
mov esi, r11d
add edx, ecx
mov rcx, qword [rsp]
lea r11d, [rdx + r8]
mov r8, qword [rsp + 0x10]
inc ecx
inc r8d
cmp ecx, 0x3e
mov qword [rsp], rcx
mov qword [rsp + 0x10], r8
jl 0x14001b52d
add dword [r10 + 0x10], ebx
add dword [r10], r11d
add dword [r10 + 4], esi
add dword [r10 + 8], ebp
add dword [r10 + 0xc], r14d
add dword [r10 + 0x14], r12d
add dword [r10 + 0x18], r13d
mov rbx, qword [rsp + 0x70]
add dword [r10 + 0x1c], r15d
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001b728
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r12, rcx
mov ecx, dword [rdx + 0x20]
xor ebp, ebp
mov rdi, rdx
cmp r12, rbp
je 0x14001b850
mov edx, ecx
shr edx, 3
and edx, 0x3f
rol ecx, 0x10
mov r13d, ecx
mov eax, ecx
shl ecx, 8
shr r13d, 8
shl eax, 8
xor r13d, eax
and r13d, 0xff00ff
xor r13d, ecx
mov ecx, dword [rdi + 0x24]
rol ecx, 0x10
mov r14d, ecx
mov eax, ecx
shl ecx, 8
shr r14d, 8
shl eax, 8
xor r14d, eax
and r14d, 0xff00ff
xor r14d, ecx
cmp edx, ebp
jbe 0x14001b7f8
lea esi, [rbp + 0x38]
mov byte [rdx + rdi + 0x28], 0x80
inc edx
cmp edx, esi
ja 0x14001b7c2
sub esi, edx
lea rcx, [rdx + rdi + 0x28]
mov r8d, esi
jmp 0x14001b7ef
mov eax, 0x40
cmp edx, eax
jae 0x14001b7dc
sub eax, edx
lea rcx, [rdx + rdi + 0x28]
xor edx, edx
mov r8d, eax
call sub.MSVCR90.dll_memset
lea rdx, [rdi + 0x28]
mov rcx, rdi
call fcn.14001b3fc
mov r8, rsi
lea rcx, [rdi + 0x28]
xor edx, edx
call sub.MSVCR90.dll_memset
jmp 0x14001b80b
xor edx, edx
lea rcx, [rdi + 0x28]
lea r8d, [rdx + 0x38]
call sub.MSVCR90.dll_memset
mov byte [rdi + 0x28], 0x80
lea rdx, [rdi + 0x28]
mov rcx, rdi
mov dword [rdi + 0x64], r13d
mov dword [rdi + 0x60], r14d
call fcn.14001b3fc
mov ecx, dword [rdi + rbp*4]
rol ecx, 0x10
mov edx, ecx
mov eax, ecx
shl ecx, 8
shr edx, 8
shl eax, 8
xor edx, eax
and edx, 0xff00ff
xor edx, ecx
mov dword [rdi + rbp*4], edx
inc rbp
mov dword [r12], edx
add r12, 4
cmp rbp, 8
jl 0x14001b81f
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
xor eax, eax
mov dword [rdi], eax
mov dword [rdi + 4], eax
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14001e6b0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor r8d, r8d
lea rdx, str..V3UpUI.cpp
lea rcx, [0x1400cb7f0]
call fcn.14002d870
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8, rax
lea rdx, str.PARAMETER:::__s_
lea rcx, [0x1400cb7f0]
call fcn.14002d9a0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14001e8bf
mov dword [rsp + 0x30], 0
jmp 0x14001e72d
mov eax, dword [rsp + 0x30]
add eax, 1
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x30], eax
jge 0x14001e87b
movsxd rcx, dword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + rcx*8]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14001e758
jmp 0x14001e722
mov r8d, 1
mov rdx, qword [rsp + 0x38]
lea rcx, [0x140096458]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x14001e7ca
lea rcx, [0x140082c68]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, [0x140082c68]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x14001e7ca
mov rcx, qword [rsp + 0x60]
add rcx, 0x378
mov rdx, qword [rsp + 0x38]
call qword [sym.imp.mfc90u.dll_COleCurrency::operator_]
mov rcx, qword [rsp + 0x60]
add rcx, 0x378
lea rdx, [0x140091b18]
call qword [sym.imp.mfc90u.dll_COleCurrency::operator_]
lea rdx, [0x140083168]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14001e7f4
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x380], 0
jmp 0x14001e876
lea rcx, [0x140083160]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, [0x140083160]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x14001e840
lea rcx, [0x140083160]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea rdx, [0x140083160]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x14001e851
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x384], 1
jmp 0x14001e876
lea rdx, [0x140082c68]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14001e876
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x388], 1
jmp 0x14001e722
mov rcx, qword [rsp + 0x60]
add rcx, 0x378
lea rdx, [0x140091b18]
call qword [sym.imp.mfc90u.dll_CPropertySet::SetFormatVersion]
mov rcx, qword [rsp + 0x60]
add rcx, 0x378
mov rdx, rax
call qword [sym.imp.mfc90u.dll_CToolBarCtrl::CToolBarCtrl]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x28], 0
jmp 0x14001e8f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
xor r8d, r8d
lea rdx, str..V3UpUI.cpp
lea rcx, [0x1400cb7f0]
call fcn.14002d870
mov r8d, dword [rsp + 0x40]
lea rdx, str._cmd_to_argvw.__d
lea rcx, [0x1400cb7f0]
call fcn.14002da20
add rsp, 0x58
ret
Function at 0x14001ec20
Capabilities:
Check if file exists
Copy file
Set file attributes

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1060
call fcn.140079d60
sub rsp, rax
mov rax, qword [0x1400bdbf0]
xor rax, rsp
mov qword [rsp + 0x1050], rax
cmp qword [rsp + 0x1078], 0
je 0x14001ec75
cmp qword [rsp + 0x1080], 0
je 0x14001ec75
cmp qword [rsp + 0x1088], 0
jne 0x14001ec7f
mov eax, 0x57
jmp 0x14001ee9a
mov dword [rsp + CWinApp::DelRegTree], 0
xor eax, eax
mov word [rsp + 0x40], ax
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x1078]
mov edx, CDHtmlElementEventSink::AddRef
lea rcx, [rsp + 0x40]
call entry0
mov rdx, qword [rsp + 0x1088]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x14001ed00
xor r8d, r8d
lea rdx, str..V3UpUI.cpp
lea rcx, [0x1400cb7f0]
call fcn.14002d870
lea rdx, str._CV3UpUIApp::CopyWorkingProcess2Temp__PathAppend_Org
lea rcx, [0x1400cb7f0]
call fcn.14002da20
mov eax, 0x65b
jmp 0x14001ee9a
xor eax, eax
mov word [rsp + 0x850], ax
lea rdi, [rsp + 0x852]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x1080]
mov edx, CDHtmlElementEventSink::AddRef
lea rcx, [rsp + 0x850]
call entry0
mov rdx, qword [rsp + 0x1088]
lea rcx, [rsp + 0x850]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x14001ed82
xor r8d, r8d
lea rdx, str..V3UpUI.cpp
lea rcx, [0x1400cb7f0]
call fcn.14002d870
lea rdx, str._CV3UpUIApp::CopyWorkingProcess2Temp__PathAppend_Dest
lea rcx, [0x1400cb7f0]
call fcn.14002da20
mov eax, 0x65b
jmp 0x14001ee9a
cmp dword [rsp + 0x1090], 1
jne 0x14001edae
lea rcx, [rsp + 0x850]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14001edae
mov dword [rsp + CWinApp::DelRegTree], 0
jmp 0x14001ee93
mov edx, 0x80
lea rcx, [rsp + 0x850]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x14001ee20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x840], eax
cmp dword [rsp + 0x840], 2
je 0x14001ee15
xor r8d, r8d
lea rdx, str..V3UpUI.cpp
lea rcx, [0x1400cb7f0]
call fcn.14002d870
mov r9d, dword [rsp + 0x840]
lea r8, [rsp + 0x850]
lea rdx, str._CV3UpUIApp::CopyWorkingProcess2Temp__SetFileAttributes_failed___s___u
lea rcx, [0x1400cb7f0]
call fcn.14002d9a0
mov dword [rsp + CWinApp::DelRegTree], 0
xor r8d, r8d
lea rdx, [rsp + 0x850]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14001ee93
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x840], eax
xor r8d, r8d
lea rdx, str..V3UpUI.cpp
lea rcx, [0x1400cb7f0]
call fcn.14002d870
lea rdx, [rsp + 0x850]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x840]
lea rdx, str._CV3UpUIApp::CopyWorkingProcess2Temp__CopyFile__Ret:_d___Src:_s___Dest:_s_
lea rcx, [0x1400cb7f0]
call fcn.14002da20
mov eax, dword [rsp + 0x840]
jmp 0x14001ee9a
mov eax, dword [rsp + 0x840]
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.14004d770
add rsp, 0x1060
pop rdi
ret
Function at 0x14002b7c0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x58
mov eax, dword [0x1400ca7c0]
test eax, eax
jne 0x14002b8ba
mov dword [rsp + 0x24], 0xffffffff
lea r9, [rsp + 0x24]
mov r8d, 0xffffffff
lea rdx, str.country_code
lea rcx, str.MAIN
call fcn.14002bf30
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x14002b88c
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x2c], 4
mov dword [rsp + 0x30], 0x51
mov dword [rsp + 0x34], 3
mov dword [rsp + 0x38], 0x52
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x40], 0x56
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x48], 0
jmp 0x14002b860
mov rax, qword [rsp + 0x48]
add rax, 1
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 4
jae 0x14002b88a
mov rcx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x24]
cmp dword [rsp + rcx*8 + 0x28], eax
jne 0x14002b888
mov rax, qword [rsp + 0x48]
mov eax, dword [rsp + rax*8 + 0x2c]
mov dword [0x1400ca7c0], eax
jmp 0x14002b88a
jmp 0x14002b852
jmp 0x14002b8ba
xor r8d, r8d
lea rdx, str...CommonClassMasterInfo.cpp
lea rcx, [0x1400cb7f0]
call fcn.14002d870
mov r8d, dword [rsp + 0x20]
lea rdx, str.MI::GS__gipd___u
lea rcx, [0x1400cb7f0]
call fcn.14002da20
mov eax, dword [0x1400ca7c0]
add rsp, 0x58
ret

Function at 0x14002d130
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor eax, eax
test eax, eax
jne 0x14002d148
xor eax, eax
test eax, eax
jne 0x14002d148
cmp qword [rsp + 0x60], 0
je 0x14002d166
mov dword [rsp + 0x34], 1
jmp 0x14002d16e
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14002d184
mov eax, 0xd
jmp 0x14002d1c6
xor eax, eax
test eax, eax
jne 0x14002d154
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x48
ret
Function at 0x14002d580
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x2068
call fcn.140079d60
sub rsp, rax
mov rax, qword [0x1400bdbf0]
xor rax, rsp
mov qword [rsp + 0x2058], rax
cmp qword [rsp + 0x2070], 0
jne 0x14002d5b6
xor eax, eax
jmp 0x14002d6c5
mov rax, qword [rsp + 0x2070]
movzx eax, word [rax]
test eax, eax
jne 0x14002d5cc
xor eax, eax
jmp 0x14002d6c5
mov dword [rsp + 0x30], 0x1000
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [rsp + 0x2048], eax
mov eax, dword [rsp + 0x2048]
add eax, 1
mov ecx, eax
shl rcx, 1
call qword [sym.imp.MSVCR90.dll_malloc]
mov qword [rsp + 0x2040], rax
cmp qword [rsp + 0x2040], 0
jne 0x14002d614
xor eax, eax
jmp 0x14002d6c5
mov edx, dword [rsp + 0x2048]
add edx, 1
mov rcx, qword [rsp + 0x2040]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14002d64e
mov rcx, qword [rsp + 0x2040]
call qword [sym.imp.MSVCR90.dll_free]
mov qword [rsp + 0x2040], 0
xor eax, eax
jmp 0x14002d6c5
mov rax, qword [rsp + 0x2070]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x2040]
lea r8, str._s_s
mov edx, 0x1000
lea rcx, [rsp + 0x40]
call fcn.140001080
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x2050], rax
mov rcx, qword [rsp + 0x2040]
call qword [sym.imp.MSVCR90.dll_free]
mov qword [rsp + 0x2040], 0
cmp qword [rsp + 0x2050], 0
je 0x14002d6c3
mov rax, qword [rsp + 0x2050]
jmp 0x14002d6c5
xor eax, eax
mov rcx, qword [rsp + 0x2058]
xor rcx, rsp
call fcn.14004d770
add rsp, 0x2068
ret
Function at 0x14002dea0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x870
mov rax, qword [0x1400bdbf0]
xor rax, rsp
mov qword [rsp + 0x868], rax
mov rax, qword [rsp + 0x880]
cmp dword [rax + 0xcb0], 1
jne 0x14002deda
mov eax, 0x4df
jmp 0x14002e17a
mov rax, qword [rsp + 0x880]
movzx eax, word [rax + 0xaa0]
test eax, eax
jne 0x14002def7
mov eax, 0xd
jmp 0x14002e17a
mov qword [rsp + CWnd::DestroyWindow], 0
call fcn.14002ebc0
mov r9d, eax
mov rdx, qword [rsp + 0x880]
add rdx, 0xcb4
lea rax, [rsp + 0x850]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + CDC::Detach], eax
cmp dword [rsp + 0x858], 0
jne 0x14002e0ba
mov dword [rsp + 0x860], 4
mov rcx, qword [rsp + 0x880]
add rcx, 0xc
lea rax, [rsp + 0x860]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DebugLogDelPolicy
mov rcx, qword [rsp + 0x850]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + CDC::Detach], eax
cmp dword [rsp + 0x858], 0
je 0x14002dfb0
mov rax, qword [rsp + 0x880]
mov dword [rax + 0xc], 3
mov rax, qword [rsp + 0x880]
movzx eax, word [rax + 0x220]
test eax, eax
jne 0x14002e0ac
mov rax, qword [rsp + 0x880]
cmp dword [rax + 0xebc], 1
jne 0x14002dfff
mov rdx, qword [rsp + 0x880]
add rdx, 0x220
mov r8d, CDHtmlElementEventSink::AddRef
mov rcx, qword [rsp + 0x880]
call fcn.14002e880
jmp 0x14002e0ac
mov dword [rsp + 0x860], 0x208
mov rcx, qword [rsp + 0x880]
add rcx, 0x220
mov r8d, 0x800
xor edx, edx
call sub.MSVCR90.dll_memset
mov rcx, qword [rsp + 0x880]
add rcx, 0x220
lea rax, [rsp + 0x860]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14008d4f0]
mov rcx, qword [rsp + 0x850]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + CDC::Detach], eax
cmp dword [rsp + 0x858], 0
jne 0x14002e08c
mov rcx, qword [rsp + 0x880]
add rcx, 0x220
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x14002e0ac
mov rcx, qword [rsp + 0x880]
add rcx, 0x220
lea r8, [0x14008d4e8]
mov edx, CDHtmlElementEventSink::AddRef
call entry0
mov rcx, qword [rsp + 0x850]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov word [rsp + 0x50], ax
lea rdi, [rsp + 0x52]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x880]
add rax, 0x18
mov r9, qword [rsp + 0x880]
add r9, 0x220
mov qword [rsp + 0x20], rax
lea r8, str._s_s.logs
mov edx, 0x800
lea rcx, [rsp + 0x50]
call fcn.14002e1a0
mov rdx, qword [rsp + 0x880]
add rdx, 0xaa0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov rax, qword [rsp + 0x880]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x880]
mov r9d, dword [rax + 8]
lea r8, [0x14008d448]
lea rcx, [rsp + 0x50]
call fcn.14002ee70
mov dword [rsp + CDC::Detach], eax
cmp dword [rsp + 0x85c], 0
jne 0x14002e173
mov rax, qword [rsp + 0x880]
mov dword [rax + CFrameWnd::GetMessageMap], 1
mov eax, dword [rsp + 0x85c]
mov rcx, qword [rsp + 0x868]
xor rcx, rsp
call fcn.14004d770
add rsp, 0x870
pop rdi
ret
Function at 0x14002e490
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x38], 0
call fcn.14002ebc0
mov r9d, eax
mov rdx, qword [rsp + 0x60]
add rdx, 0xcb4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x14002e58e
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14008d570]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x14002e56c
cmp dword [rsp + 0x38], 1
jne 0x14002e56c
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0xcac], 0
jne 0x14002e562
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
call fcn.14002e5e0
mov r11, qword [rsp + 0x60]
mov dword [r11 + CEditView::GetMessageMap], 1
mov dword [rsp + 0x34], 1
jmp 0x14002e583
mov rax, qword [rsp + 0x60]
mov dword [rax + CEditView::GetMessageMap], 0
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0xebc], 1
jne 0x14002e5b8
mov rdx, qword [rsp + 0x60]
add rdx, 0x220
mov r8d, CDHtmlElementEventSink::AddRef
mov rcx, qword [rsp + 0x60]
call fcn.14002e880
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r11d, eax
mov rax, qword [rsp + 0x60]
mov dword [rax + CDaoRecordset::GetThisClass], r11d
mov eax, dword [rsp + 0x34]
add rsp, 0x58
ret
Function at 0x14002e5e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x58], 0
jne 0x14002e5fb
jmp 0x14002e735
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x30], 4
mov rcx, qword [rsp + 0x50]
add rcx, 8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DebugLogMaxSize
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x14002e652
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], 0x800000
mov dword [rsp + 0x30], 0x208
mov rcx, qword [rsp + 0x50]
add rcx, 0x220
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14008d4f0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x14002e6ae
mov rcx, qword [rsp + 0x50]
add rcx, 0x220
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x14002e6cb
mov rcx, qword [rsp + 0x50]
add rcx, 0x220
lea r8, [0x14008d4e8]
mov edx, 0x104
call entry0
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DebugLogTime
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x14002e735
cmp dword [rsp + 0x34], 1
jb 0x14002e735
cmp dword [rsp + 0x34], 0x3c
ja 0x14002e735
mov ecx, dword [rsp + 0x34]
imul ecx, ecx, 0xea60
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xec0], ecx
add rsp, 0x48
ret
Function at 0x14002e740
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x38], 0
call fcn.14002ebc0
mov r9d, eax
mov rdx, qword [rsp + 0x60]
add rdx, 0xcb4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x14002e83e
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ErrLog
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x14002e81c
cmp dword [rsp + 0x38], 1
jne 0x14002e81c
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0xcac], 0
jne 0x14002e812
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
call fcn.14002e5e0
mov r11, qword [rsp + 0x60]
mov dword [r11 + CEditView::GetMessageMap], 1
mov dword [rsp + 0x34], 1
jmp 0x14002e833
mov rax, qword [rsp + 0x60]
mov dword [rax + CEditView::GetMessageMap], 0
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0xebc], 1
jne 0x14002e868
mov rdx, qword [rsp + 0x60]
add rdx, 0x220
mov r8d, CDHtmlElementEventSink::AddRef
mov rcx, qword [rsp + 0x60]
call fcn.14002e880
mov eax, dword [rsp + 0x34]
add rsp, 0x58
ret

Function at 0x14002e880
Capabilities:
Query environment variable

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
mov rax, qword [0x1400bdbf0]
xor rax, rsp
mov qword [rsp + 0x258], rax
cmp qword [rsp + 0x278], 0
je 0x14002e8be
cmp dword [rsp + 0x280], 0
ja 0x14002e8c3
jmp 0x14002e99c
lea rax, str._ALLUSERSPROFILE_Application_DataAhnLabAIS
mov qword [rsp + 0x240], rax
mov rcx, qword [rsp + 0x270]
call fcn.14002e9c0
cmp eax, 1
jne 0x14002e8f3
lea rax, str._PROGRAMDATA_AhnLabAIS
mov qword [rsp + 0x240], rax
xor eax, eax
mov word [rsp + 0x30], ax
lea rdi, [rsp + 0x32]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8d, delete[]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x248], eax
cmp dword [rsp + 0x248], 0
jbe 0x14002e93f
mov dword [rsp + 0x250], 1
jmp 0x14002e94a
mov dword [rsp + 0x250], 0
mov eax, dword [rsp + 0x250]
mov dword [rsp + reloc.mfc90u.dll_CView::CView], eax
cmp dword [rsp + reloc.mfc90u.dll_CView::CView], 0
jne 0x14002e979
mov edx, new[]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov dword [rsp + reloc.mfc90u.dll_CView::CView], eax
cmp dword [rsp + reloc.mfc90u.dll_CView::CView], 0
je 0x14002e99c
mov edx, dword [rsp + 0x280]
lea r8, [rsp + 0x30]
mov rcx, qword [rsp + 0x278]
call entry0
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.14004d770
add rsp, 0x260
pop rdi
ret