joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008cca0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, r8
mov rbx, rdx
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov r8d, 0x20019
lea rdx, [rsp + 0x58]
call fcn.14008c7e0
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14008cda9
mov dword [rsp + 0x50], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008cd23
cmp dword [rsp + 0x54], 3
je 0x14008cda4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
je 0x14008cda4
call fcn.1400c1f80
cmp dword [rax + 0x78], 6
jl 0x14008cda4
call fcn.1400c1f80
mov rbp, rax
mov r8b, 1
mov edx, edi
lea rcx, [rsp + 0x70]
call fcn.140089310
nop
cmp qword [rax + 0x18], 8
jb 0x14008cd5c
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rsi
lea rax, str.Failed_to_read_registry_value__s__error:___d___s_
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x29b
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootMobileMeServicesSyncNotifyIcon.cpp
lea r8, str.CSyncNotifyIcon::_readPersistedStateData
mov edx, 6
mov rcx, rbp
call fcn.1400c2500
nop
lea rcx, [rsp + 0x70]
call fcn.140052120
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14008cdb4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400e6b50
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140090170
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
lea rdi, str.TrayUtils::LaunchExplorerToDesktop
mov qword [rsp + 0x40], rdi
call fcn.1400c1f80
lea rsi, [0x140273c80]
cmp dword [rax + 0x78], 7
jl 0x1400901e8
call fcn.1400c1f80
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], SafeArrayGetLBound
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootCommonLogUtils.h
lea r8, str._________ENTER
mov edx, 7
mov rcx, rax
call fcn.1400c23b0
nop
cmp qword [rbx + 0x10], 0
je 0x1400902c1
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], ax
lea r8d, [rax + 9]
lea rdx, str._select__
lea rcx, [rsp + 0x48]
call fcn.1400523d0
nop
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x140090231
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140052250
mov r8d, 1
lea rdx, [0x14027846c]
lea rcx, [rsp + 0x48]
call fcn.140052250
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
xor r8d, r8d
lea rcx, [0x140278470]
call fcn.1400cb8a0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140090307
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400902ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400902ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e6a28
jmp 0x140090307
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [rsp + 0x20], 0xa
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [0x140274888]
call fcn.1400cc590
nop
call fcn.1400c1f80
cmp dword [rax + 0x78], 7
jl 0x140090345
call fcn.1400c1f80
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayLock
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootCommonLogUtils.h
lea r8, str._________LEAVE
mov edx, 7
mov rcx, rax
call fcn.1400c23b0
nop
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14009cc60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, [rsp + 0x30]
call fcn.1400a0860
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x68], 4
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], ebx
lea rdx, str.AppStoreBalloonShownTime
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14009ccbb
cmp dword [rsp + 0x70], 4
jne 0x14009ccbb
mov ebx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14009cccb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x14009d740
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rsi, rcx
xor r14d, r14d
mov bpl, 1
call fcn.1400c1f80
cmp dword [rax + 0x78], 7
jl 0x14009d7cb
call fcn.1400c1f80
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14009d797
mov rcx, qword [rsi]
mov qword [rsp + 0x30], rcx
lea rcx, str.Looking_for_web_payload_assets_at:__s
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x25
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootMobileMeServicesStatusWindowPayload.h
lea r8, str.IsStatusWindowPayloadPresentAndComplete
mov edx, 7
mov rcx, rax
call fcn.1400c2500
lea rdi, [0x140376300]
lea r12, str.ERROR__Required_web_payload_asset:__s_was_not_found_
lea r13, str.Web_payload_asset:__s_found.
lea r15, [0x140376348]
nop word [rax + rax]
mov rbx, qword [rdi]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x14009d813
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400523d0
nop
lea r8, [rsp + 0x48]
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.140073ab0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14009d881
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009d87c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009d9a0
call fcn.1400e6a28
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae rcx, qword [rsp + 0x68]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14009d8df
xor bpl, bpl
call fcn.1400c1f80
cmp dword [rax + 0x78], 3
jl 0x14009d91d
call fcn.1400c1f80
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x2d
mov edx, 3
jmp 0x14009d906
call fcn.1400c1f80
cmp dword [rax + 0x78], 7
jl 0x14009d91d
call fcn.1400c1f80
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x31
mov edx, 7
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootMobileMeServicesStatusWindowPayload.h
lea r8, str.IsStatusWindowPayloadPresentAndComplete
mov rcx, rax
call fcn.1400c2500
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x14009d95e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009d959
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009d9a7
call fcn.1400e6a28
add rdi, 8
cmp rdi, r15
jne 0x14009d7f0
movzx eax, bpl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14009dff0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rsi, rcx
lea rbp, str.TrayWnd::LoginCompleted
mov qword [rsp + 0x60], rbp
call fcn.1400c1f80
lea r14, [0x140273c80]
cmp dword [rax + 0x78], 7
jl 0x14009e056
call fcn.1400c1f80
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], SafeArrayGetLBound
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootCommonLogUtils.h
lea r8, str._________ENTER
mov edx, 7
mov rcx, rax
call fcn.1400c23b0
nop
mov byte [rsi + 0x6c], 1
cmp qword [rsi + 0x528], 0
je 0x14009e089
lea rcx, [rsi + 0x500]
call sub.KERNEL32.dll_EnterCriticalSection
mov rdi, qword [rsi + 0x4f8]
lea rcx, [rsi + 0x500]
call sub.KERNEL32.dll_LeaveCriticalSection
nop
test rdi, rdi
jne 0x14009e095
mov rcx, rsi
call fcn.1400a9990
test al, al
je 0x14009e0b4
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [0x1400a6360]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov dl, 1
mov rcx, qword [str.iCloudServicesStartupTask]
call fcn.1400d8970
nop
call fcn.1400c1f80
cmp dword [rax + 0x78], 7
jl 0x14009e101
call fcn.1400c1f80
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayLock
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootCommonLogUtils.h
lea r8, str._________LEAVE
mov edx, 7
mov rcx, rax
call fcn.1400c23b0
nop
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14009e120
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
lea r12, str.TrayWnd::LogoutCompleted
mov qword [rsp + 0x70], r12
call fcn.1400c1f80
lea r15, [0x140273c80]
cmp dword [rax + 0x78], 7
jl 0x14009e18d
call fcn.1400c1f80
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], SafeArrayGetLBound
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootCommonLogUtils.h
lea r8, str._________ENTER
mov edx, 7
mov rcx, rax
call fcn.1400c23b0
nop
lea r14, str.TrayWnd::_doDeviceDeregistration
mov qword [rsp + 0x80], r14
call fcn.1400c1f80
cmp dword [rax + 0x78], 7
jl 0x14009e1da
call fcn.1400c1f80
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], SafeArrayGetLBound
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootCommonLogUtils.h
lea r8, str._________ENTER
mov edx, 7
mov rcx, rax
call fcn.1400c23b0
nop
mov rcx, rsi
call fcn.1400a9e00
mov rcx, rsi
call fcn.1400a9d00
mov ecx, 0x28
call fcn.1400e69ec
mov rbx, rax
test rax, rax
je 0x14009e259
xor ebp, ebp
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rbp
lea rcx, [rax + 8]
mov qword [rcx], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov qword [rax], rsi
cmp rcx, rdi
je 0x14009e23b
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x14009e233
mov rdi, qword [rdi]
mov rdx, rdi
call fcn.1400523d0
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
mov r9, rbx
lea r8, [0x1400a6070]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
call fcn.1400c1f80
cmp dword [rax + 0x78], 7
jl 0x14009e297
call fcn.1400c1f80
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayLock
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootCommonLogUtils.h
lea r8, str._________LEAVE
mov edx, 7
mov rcx, rax
call fcn.1400c23b0
nop
mov byte [rsi + 0x6c], 1
call fcn.1400c1f80
cmp dword [rax + 0x78], 7
jl 0x14009e2d9
call fcn.1400c1f80
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayLock
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootCommonLogUtils.h
lea r8, str._________LEAVE
mov edx, 7
mov rcx, rax
call fcn.1400c23b0
nop
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400a4b10
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rbp + 0x37], rax
movzx ebx, dl
lea rcx, [rbp - 0x21]
call fcn.1400a0860
nop
mov dword [rbp - 0x29], ebx
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.UsageBalloonShown
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rdi, eax
test eax, eax
je 0x1400a4d1a
call fcn.1400c1f80
cmp dword [rax + 0x78], 3
jl 0x1400a4d1a
call fcn.1400c1f80
mov rsi, rax
xor r14d, r14d
mov qword [rbp - 9], r14
movdqa xmm0, xmmword [0x140272430]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp - 9], r14w
mov r8b, 1
mov edx, edi
lea rcx, [rbp + 0x17]
call fcn.140078e10
mov rbx, rax
lea rax, [rbp - 9]
cmp rax, rbx
je 0x1400a4c35
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x1400a4c04
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4bff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a4c6c
call fcn.1400e6a28
movdqa xmm0, xmmword [0x140272430]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp - 9], r14w
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 7], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x1400a4c78
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4c73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a4c73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e6a28
mov qword [rbp + 0x27], r14
mov qword [rbp + 0x2f], 7
mov word [rbp + 0x17], r14w
lea rax, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rax, qword [rbp - 9]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
lea r8, str.TrayWnd::SetFirstUsageBalloonShown
mov qword [rsp + 0x30], r8
lea rax, str._s:_Failed_to_write_value_to_registry__error:___Iu___S__
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x177
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootMobileMeServicesTrayWnd.cpp
mov edx, 3
mov rcx, rsi
call fcn.1400c23b0
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x1400a4d1a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4d14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a4d14
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e6a28
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1400a4d29
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400a7960
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, [rsp + 0x30]
call fcn.1400a0860
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], 0
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.UsageBalloonShown
mov dword [rsp + 0x70], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a79c3
cmp dword [rsp + 0x78], 4
jne 0x1400a79c3
cmp dword [rsp + 0x68], eax
je 0x1400a79c3
mov bl, 1
jmp 0x1400a79c5
xor bl, bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400a79d5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x50
pop rbx
ret

Function at 0x1400a8d70
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov rsi, rcx
mov edi, dword [r8]
mov rcx, rdx
mov rbx, rdx
jb 0x1400a8d95
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x1402723e8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [rbx + 0x18]
test edi, edi
je 0x1400a8dcc
cmp rax, 8
jb 0x1400a8db9
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, str.__Error__d:__s_n
mov edx, edi
call fcn.14006c5c0
jmp 0x1400a8de4
cmp rax, 8
jb 0x1400a8dd5
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str.___s_n
call fcn.14006c5c0
mov rax, qword [rsi + 8]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400a8e18
mov rcx, qword [rcx + 0x540]
test rcx, rcx
je 0x1400a8e18
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400a8e18
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a9800
Capabilities:
Delete file
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x4c0
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor esi, esi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], SafeArrayGetLBound
mov byte [rsp + 0x68], sil
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
mov rbx, rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x2a0]
call sub.VCRUNTIME140.dll_memset
mov r9, rbx
lea r8, [0x14027bf68]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x90]
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
lea r8d, [rsi + 0x10]
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r9, [rsp + 0x2a0]
lea r8, [rsp + 0x90]
lea rdx, str._siCWLogs__s.zip
lea rcx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x38], 3
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov eax, 0x614
mov word [rsp + 0x50], ax
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
lea rax, [rsp + 0x90]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400a9940
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.1400523d0
nop
mov rax, rdi
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400aed30
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r15, r9
mov r12d, r8d
mov r13, rdx
mov rsi, qword [0x140376158]
xor r14d, r14d
mov qword [rsp + 0x20], r14
cmp dword [0x1403754e8], r14d
jne 0x1400aee13
mov eax, dword [0x1403754e4]
test eax, eax
jne 0x1400aee13
mov edi, r14d
mov r8d, dword [0x1403754f0]
test r8d, r8d
je 0x1400aeda8
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1403754e4]
mov r8d, dword [0x1403754f0]
test eax, eax
je 0x1400aedb5
mov ebx, 1
mov edi, ebx
jmp 0x1400aede4
test r8d, r8d
jne 0x1400aedc8
call fcn.140057280
test eax, eax
jne 0x1400aedc8
lea ebx, [rax + 1]
jmp 0x1400aede4
lea rdx, [rsp + 0x20]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, 1
test eax, eax
cmovne edi, ebx
test edi, edi
jne 0x1400aee18
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x1400aee05
cmp eax, 0x78
je 0x1400aee05
cmp eax, 1
je 0x1400aee05
cmp eax, 0x32
jne 0x1400aee0d
mov dword [0x1403754e4], ebx
mov edi, ebx
test edi, edi
jne 0x1400aee18
jmp 0x1400aee1b
mov ebx, 1
mov r14d, ebx
test r14d, r14d
jne 0x1400aee61
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x1400aee54
mov ebx, 0x54f
movzx ebx, bx
or ebx, 0x80070000
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
jle 0x1400aee3a
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1400aee3a
test rsi, rsi
jne 0x1400aeeaa
lea rcx, str.LoadIconMetric
call fcn.14006a8e0
mov rsi, rax
test rax, rax
jne 0x1400aeea3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x1400aee96
mov ebx, 0x54f
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1400aeebc
jle 0x1400aeebc
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1400aeebc
mov qword [0x140376158], rax
mov r9, r15
mov r8d, r12d
mov rdx, r13
mov rcx, qword [rsp + 0x60]
call rsi
mov ebx, eax
cmp dword [0x1403754e8], 0
je 0x1400aeed2
cmp dword [0x1403754e4], 0
jne 0x1400aee3a
mov rdx, qword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
jmp 0x1400aee3a
Function at 0x1400b0390
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
mov edi, esi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREApple_Inc.Internet_Services
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b040e
mov eax, esi
mov rdi, qword [rsp + 0x48]
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x60], esi
test eax, eax
jne 0x1400b046c
mov dword [rsp + 0x40], 0x20a
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, [0x14027e280]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b046c
mov eax, dword [rsp + 0x48]
dec eax
cmp eax, 1
ja 0x1400b046c
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400b04b4
test al, 1
jne 0x1400b046c
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], 0
je 0x1400b04b9
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
test rdi, rdi
je 0x1400b048c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov word [rsp + 0x70], si
call fcn.1400c1f80
cmp dword [rax + 0x78], 7
jl 0x1400b0502
call fcn.1400c1f80
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], rcx
lea rcx, str.Using_install_path_from_registry:__s
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x88
lea r9, str.D:BWA29B6E26C_BE36_0MobileMeServices_237_srcrootCommonAppData.cpp
lea r8, str.AppData::GetInstallPath
mov edx, 7
mov rcx, rax
call fcn.1400c2500
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400b0520
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.1400523d0
jmp 0x1400b047e