joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1415aaa26
Capabilities:
Encode data using xor

Disassembly:
shr r8b, 0xe7
pop rbp
xor sil, sil
sar r8w, 0x21
sub edi, edi
movsxd r10, r10d
call fcn.1415e12e6
mov ecx, 0x49861484
lea r8, [r8 + rcx - 0x49861488]
add cl, 0xa3
mov r10d, 0x79e89b8
mov esi, dword [r10 + r8 - 0x79e89b8]
xor esi, r11d
mov eax, r10d
lea esi, [rcx + rsi - 0x649ef9a]
not esi
neg esi
shl r10, cl
shl al, 0xa2
sub ecx, ecx
lea esi, [rsi + rcx + 0x7eaabb23]
movsx edx, cx
movzx edi, dl
xor esi, 0xda3b73b7
or r10b, 0x10
call fcn.14152c853
rol r10d, 2
ror qword [rsp + rax - 0x8c00], 0x27
sar dword [rsp + rax*2 - 0x117fd], 0xaf
mov qword [rsp + rax*2 - 0x11800], rbp
mov r8d, edx
xor dword [rsp + rax - 0x8c00], r10d
add rsi, 0x6f9dee3d
jae 0x141550e66
mov edx, dword [r8]
mov ebp, 0xd8827311
mov eax, dword [r8 + 4]
movzx ecx, bpl
movzx r10d, bp
mov ecx, dword [r8 + rcx - 9]
lea rbp, [rbp*4 + 0x6ab75d8f]
movsx r9d, r10b
xadd r9d, ebp
lea r8, [r8 + rbp - 0xd]
push rbp
push rbp
div ecx
mov dword [r8 + rbp*2 - 0x22], edx
lea r11, [r9*2 - 0x494af95a]
shr bpl, 1
mov dword [r10 + r8 - 0x730d], eax
shr r9d, 0xaf
mov edx, dword [rbp + rbx - 8]
sbb r9b, r11b
lea rbx, [rbx + rbp*4 - 0x1c]
jnp 0x141570fab
or byte [rsp + rbp + 3], r10b
xor edx, edi
add byte [rsp + rbp - 7], 0xac
movzx ecx, word [rsp + r10*8 - 0x3987d]
inc r10b
ror edx, 3
sar dword [rsp + rbp*2 - 0xb], cl
or cl, r10b
sar r11, cl
bswap edx
call fcn.14159eb20
mov qword [rsp], rsi
xor r10d, 0x748c9f32
xchg word [rsp + 0xc], si
movsx eax, si
pop rdi
lea r10d, [rax + r10 + 0x3bac8e11]
xadd byte [rsp + rax*4 + 1], ah
ror r10d, 2
not word [rsp + rax - 0x8bfb]
not rdi
dec r10d
dec word [rsp + rax*2 - 0x117fa]
lea rdx, [rdi + rax*8 - 0x1d663650]
jne 0x14157ee96
jmp 0x141571464

Function at 0x1415bef41
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rax, [rdx + rdx*4 + 0x799623bd]
movzx edx, byte [rsi + r8 + 0x168a5a5f]
dec ebx
sar ebx, 0x2e
bswap ebx
xor dl, r11b
rol eax, cl
inc dl
call fcn.1415f9d72
mov qword [rsp + rbp*8], rbx
xor dword [rsp + rbp*8], eax
lea rbx, [rbp + r11*4 + 0x2939faba]
jmp 0x1415feae0
or r10, rdx
shl rbx, 0x39
movsxd rdi, edi
sal bl, 0x81
neg dx
add r9, rdi
mov r10w, word [rbp + rdx*4 - 0x5a2aeae8]
sub ecx, 0xcd33d095
adc si, dx
lea rax, [rbx*2 + 0x543f00b5]
lea rbp, [rbp + rsi*2 + 0x2d14b4c0]
dec ebx
lea r8, [r8 + rsi + 0x168a5a5e]
jbe 0x1415a010a
xor dx, cx
pop rbx
movsxd rax, eax
and r11b, cl
adc cl, r11b
add r8, rax
sub dil, 0x3c
js 0x1415929d9
call fcn.141544465
rol edi, 1
inc edi
push rdx
xor edi, 0xa81f5fae
shr qword [rsp + rdx*2 - 0x2d148a8c], 0xdd
movsx ecx, word [rsp + rsi - 0x168a1517]
bswap edi
not rsi
movzx ebx, dl
xor edi, 0x4d2bf737
mov dword [rsp + rdx*2 - 0x2d148a89], edx
mov qword [rsp + rsi + 0x168a151a], r11
or rbx, rdx
mov r10d, esi
xor dword [rsp + rsi + 0x168a151a], edi
xor cl, cl
pop r11
jp 0x1415f5668
Function at 0x1415c1fdc
Capabilities:
Encode data using base64

Disassembly:
lea rbp, [rbp + rbx*2 - 0x544385f2]
setge bl
shr r10d, cl
movzx ecx, byte [rsp + rax - 0x71ecf738]
mov esi, ebx
mov dword [rbp + rbx*2 - 0x54438400], r10d
inc dword [rsp + rax - 0x71ecf736]
mov qword [rsp + rcx*2 - 0x12e], r9
ret
or bpl, r9b
adc r8, rax
lea r10, [r10 + rdi - 0x6e2e0004]
ror ebp, 0xaa
mov r9d, dword [r10 + rdi - 0x6e2e0000]
setae dil
xor r9d, ebx
xor cx, di
adc rdx, rdi
inc r11
rol r9d, 1
ror cl, 0xe1
inc r9d
shr rcx, 0xee
add dx, di
ror r9d, 1
jmp 0x14152e311
adc r9, rdx
rol rbx, cl
pop rsi
mov r10d, dword [rbp + rcx*2 - 0x12e7c]
mov cl, byte [rbp + rcx*8 - 0x4b9ec]
or ax, 0xf729
push rdi
jno 0x141547f1d
lea eax, [rax + rcx - 0x76d0abaf]
movsx ebp, r11b
lea r9, [rcx + 0x6e2e260c]
rol cx, 0xea
neg eax
not r11b
movsx edi, bpl
xor eax, 0xdba1972f
not dl
not eax
shr r9w, 0xaf
push rbx
jnp 0x141536d32
sete r11b
xchg r9d, edi
xor dword [rsp + rdi - 0x6e2e0000], eax
pop rbx
inc r9
lea r11, [rcx + rbp*2 - 0x177c8f49]
movsxd rax, eax
jge 0x141574872

Function at 0x1415ce02c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, dword [r10 + rdi + 0x6a624868]
mov ecx, ebp
xor edi, ebx
neg ecx
dec edi
ror edi, 1
neg edi
sar ebp, 0x61
xchg bp, ax
lea edi, [rdi + rbp*2 + 0x5594ae81]
movsx r11d, cl
movzx r9d, r11b
shr bpl, 0xc5
push rbx
or r11w, 0xe322
jnp 0x141587058
not r9d
mov qword [rsp], 0xffffffff959db798
mov eax, dword [rsp + 4]
mov dword [rsi], r9d
pop rdi
lea r10, [r10 + rdi + 0x6a624864]
inc rax
lea rbp, [rdi + rax*8 - 0x3cf52ff8]
jns 0x141588025

Function at 0x1415d2cad
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + r10*4 - 0x6c], rsi
neg r10b
inc dil
lea rdx, [r10 + rbx*8 - 0x45fb43d9]
ror dil, 1
inc dl
jp 0x1415e704c
jne 0x141532a8a

Function at 0x1415dc232
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
mov ebx, dword [r8]
mov qword [rsp], r10
xor ebx, r11d
neg word [rsp + 2]
sub ebx, 0xc21a6338
call fcn.14159bb25

Function at 0x1415e03b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.14154fcbb
mov r9d, 0x38039abd
push r9
lea r10, [r9 + r10 - 0x38039ac1]
movsx r11d, word [rsp + r9 - 0x38039abb]
sar byte [rsp + r11 - 0x3802], 0xe6
mov r11d, dword [r9 + r10 - 0x38039abd]
mov ecx, r9d
call fcn.14158931c
and rsp, 0xfffffffffffffff0
jmp 0x14156e651
mov qword [rbp + riz - 8], rax
lea rsp, [rsp + 8]
mov qword [rbp + riz - 0x10], rsp
push 0xffffffffab8088ac
lea rsp, [rsp + 8]
sub rsp, rcx
jmp 0x1415cb2a8
Function at 0x1415e5709
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
adc rdx, rsi
xor bx, r11w
xchg r10, rax
not bx
inc edi
mov qword [rsp + rsi - 0x54aa0716], rdx
rol bx, 1
neg bx
inc rsi
lea rcx, [rdx + rdx*2 - 0x44ff366f]
inc bx
rol word [rsp + rax - 0x670235af], 0x88
sub word [rsp + rsi - 0x54aa071c], 0x10a
neg bx
neg esi
call fcn.1415f9221
movzx eax, cx
pop rdi
or r10d, 0x28085fb4
movsxd rbp, ebp
adc rsi, rbp
inc r11
sal rax, 0x60
and rax, rdx
mov r10, qword [r8 + rdx + 0x42418042]
jle 0x1415c5b5f
mov rdx, qword [r8 + rdx + 0x4241804a]
adc cl, byte [r8 + riz + 0x10]
xor ax, r9w
ror r9, 0xc9
lea r8, [r8 + r9*8 - 0x3361286]
ror r9w, 0xcc
rol r9, 0xd4
shrd r10, rdx, cl
mov qword [r8], r10
shr r9w, 0x2b
mov r10d, eax
jmp rsi
dec ecx
mov qword [rsp + rdx - 0x54aa0716], r11
mov qword [rsp + rsi - 0x71e], r10
xor dword [rsp + rdx - 0x54aa0716], ecx
not dword [rsp + rdx - 0x54aa071c]
lea rax, [r10*2 + 0x2923b42c]
mov r11, qword [rsp + rdx - 0x54aa0716]
sub edi, 0xcbbc01e
sub si, 0xd7a1
movsxd rcx, ecx
add r9, rcx
xadd rdx, rsi
lea r8, [r8 + r10 - 0x6702353e]
movzx ebx, word [r8 + rsi - 0x54aa071e]
or r10b, al
js 0x1415c70e6

Function at 0x141600f72
Capabilities:
Encode data using xor

Disassembly:
add r11b, dl
lea rbp, [rax*8 - 0x48e2fc70]
rol ecx, 2
lea r9, [rbp*8 - 0x58cede4c]
inc edi
dec ecx
xor ecx, 0xeb35d392
shr rbp, 0xa1
push r9
je 0x141551a97
sub ecx, 0x96951a37
bswap ecx
mov rdx, qword [rsp + 0x10]
add rdx, 0x823e3
jmp rdx
ror r10d, 1
movzx eax, cx
or esi, dword [rsp + r8*4 - 2]
jge 0x1415241fc
bswap r10d
shl r8b, 0x27
inc sil
mov qword [rsp + r8 - 0x80], rbp
lea rbp, [r8 + rdx*4 - 0xad2add9]
inc dx
shr ecx, 0xe7
xor dword [rsp + r8 - 0x80], r10d
pop rbp
inc al
movsxd r10, r10d
ror edx, 0x58
sar rcx, 0x9b
call fcn.141548baa
mov qword [rsp + r10*2 - 0x168], rax
mov eax, dword [r10 + r8 - 0xb4]
xor eax, r11d
lea eax, [rax + rdx - 0x30014b27]
not eax
movzx esi, dl
xchg ebx, edi
ror sil, 0xc4
neg eax
lea eax, [rdx + rax + 0xb6d4b6f]
xor eax, 0xda3b73b7
neg byte [rsp + r10 - 0xb3]
or dword [rsp + r10*2 - 0x168], ebx
adc qword [rsp + rdx - 0x733d6fb4], 0xffffffffb91d8b36
mov qword [rsp + r10*8 - 0x5a0], r11
movsx ecx, sil
lea r11, [rbx + r10*8 + 0x572ddaa3]
shl ebx, cl
xor dword [rsp + r10*8 - 0x5a0], eax
call fcn.14159f412
inc r8
shl rcx, 0x97
sbb r10d, r8d
sar dx, 0x89
add esi, 0xe683dfa2
jnp 0x1415446f1

Function at 0x141607fc6
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
xor edi, 0xcdb0c106
xadd word [rsp + rcx*2 - 0x282ba9d5], r11w
lea rcx, [rax + rax*4 + 0x55808a0c]
call fcn.1415c5d9b
Function at 0x140015f80
Capabilities:
Check for time delay via gettickcount
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp dword [0x140c47b60], 0
mov rsi, rcx
je 0x140015ff4
or rcx, 0xffffffffffffffff
xor eax, eax
lea rbx, [0x140c47c68]
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 0x104
ja 0x140016154
sub rsi, rbx
nop
nop
movzx eax, byte [rbx]
add rbx, 1
test al, al
mov byte [rsi + rbx - 1], al
jne 0x140015fe0
jmp 0x14001614f
call fcn.1400494c0
call fcn.140049400
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov rdi, rax
mov word [rsp + 0x50], 0
call sub.ntdll.dll_memset
mov rax, qword [rdi]
lea rdx, [rsp + 0x50]
mov r8d, Ordinal_265
mov rcx, rdi
call qword [rax + 0x48]
test eax, eax
jne 0x1400160bf
lea rax, [rsp + 0x38]
lea rdx, [0x1403b5350]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400160b0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea rdi, [0x140c47b64]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rdx, [0x1403b5360]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x40], Ordinal_265
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x1400160b7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140016154
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400160da
lea rdi, [0x140c47b64]
lea rdx, [rsp + 0x50]
mov r8d, Ordinal_265
mov rcx, rdi
call qword [sym.imp.ntdll.dll_wcstombs]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rbx, [0x140c47c68]
lea rdx, [0x1403b5370]
and eax, 0x3e8
mov rcx, rbx
mov r8d, eax
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [0x140c47c6c]
mov r8, rdi
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
je 0x1400160b0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
mov dword [0x140c47b60], 1
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 0x104
ja 0x140016154
sub rsi, rbx
movzx eax, byte [rbx]
add rbx, 1
test al, al
mov byte [rsi + rbx - 1], al
jne 0x140016140
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140161080
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140016300
Capabilities:
Get user security identifier

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, reloc.MFC80U.DLL_Ordinal_320
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x190], rbx
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, rdx
mov rbx, rcx
lea rbp, [rcx + 0x50]
mov dword [rbp], 7
add rcx, 0x58
call qword [sym.imp.MFC80U.DLL_Ordinal_2149]
lea rcx, [rbx + 0x60]
call qword [sym.imp.MFC80U.DLL_Ordinal_2149]
lea rcx, [rbx + 0x68]
call qword [sym.imp.MFC80U.DLL_Ordinal_2149]
lea rcx, [rbx + 0x70]
call qword [sym.imp.MFC80U.DLL_Ordinal_2149]
mov byte [rbx + 0x4c], 0
test rsi, rsi
jne 0x14001637f
xor al, al
jmp 0x1400164f4
mov qword [rsp + 0x50], 0
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.140019b90
mov rdi, qword [rsp + 0x50]
mov dword [rsp + 0x40], 0x44
mov dword [rsp + 0x44], 0x80
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xe0]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x14001644a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400164a9
cmp dword [rsp + 0x40], 0x44
jbe 0x1400163fd
mov ecx, 0x80004005
call fcn.14001a960
int3
mov eax, dword [rsp + 0x44]
cmp eax, 0x80
jbe 0x14001641a
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140019a60
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xe0]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x1400164a9
mov byte [rbx + 0x4c], 1
lea rdx, [rbx + 8]
lea r8, [rsp + 0xe0]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1400164a9
mov rdx, rdi
lea rcx, [rbx + 0x60]
call qword [sym.imp.MFC80U.DLL_Ordinal_788]
mov rdx, rsi
lea rcx, [rbx + 0x58]
call qword [sym.imp.MFC80U.DLL_Ordinal_788]
xor edx, edx
lea rcx, [rbx + 0x70]
call qword [sym.imp.MFC80U.DLL_Ordinal_788]
nop
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x50], rax
je 0x1400164a5
lea rcx, [rsp + 0x50]
call fcn.140019bf0
mov al, 1
jmp 0x1400164f4
mov dword [rbp], 7
lea rcx, [rbx + 0x58]
call qword [sym.imp.MFC80U.DLL_Ordinal_2149]
lea rcx, [rbx + 0x60]
call qword [sym.imp.MFC80U.DLL_Ordinal_2149]
lea rcx, [rbx + 0x68]
call qword [sym.imp.MFC80U.DLL_Ordinal_2149]
lea rcx, [rbx + 0x70]
call qword [sym.imp.MFC80U.DLL_Ordinal_2149]
mov byte [rbx + 0x4c], 0
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x50], rax
je 0x1400164f2
lea rcx, [rsp + 0x50]
call fcn.140019bf0
xor al, al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + 0x190]
add rsp, reloc.MFC80U.DLL_Ordinal_320
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140019890
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
cmp dword [rcx], 0
mov rsi, rdx
mov rdi, rcx
je 0x1400198ed
lea r8, [rcx + 0x108]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 0x104
ja 0x140019a2e
sub rsi, r8
nop
nop
movzx eax, byte [r8]
add r8, 1
test al, al
mov byte [rsi + r8 - 1], al
jne 0x1400198d0
mov eax, 1
add rsp, 0x48
pop rdi
pop rsi
ret
lea rax, [rsp + 0x30]
lea rdx, [0x1403b5350]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140019921
xor eax, eax
add rsp, 0x48
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x28], rax
lea rbp, [rdi + 4]
lea r9, [rsp + 0x78]
lea rdx, [0x1403b5360]
xor r8d, r8d
mov dword [rsp + 0x78], 1
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x70], Ordinal_265
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x140019980
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x48
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x60], rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rbx, [rdi + 0x108]
and eax, 0x3e8
lea rdx, [0x1403b5370]
mov rcx, rbx
mov r8d, eax
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 0x10c]
mov r8, rbp
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x1400199df
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rsi
ret
or rcx, 0xffffffffffffffff
mov dword [rdi], 1
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 0x104
ja 0x140019a24
sub rsi, rbx
nop
nop
nop
nop
movzx eax, byte [rbx]
add rbx, 1
test al, al
mov byte [rsi + rbx - 1], al
jne 0x140019a10
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140021570
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
mov eax, reloc.MFC80U.DLL_Ordinal_4144
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + Ordinal_4135], rax
lea rbx, [rsp + 0x1048]
mov rdx, rbx
call qword [sym.imp.MSVCR80.dll__vscprintf]
add eax, 1
cmp eax, 0x1000
jg 0x1400215fc
mov rdx, qword [rsp + 0x1040]
lea rcx, [rsp + 0x20]
mov r8, rbx
call qword [sym.imp.ntdll.dll_vsprintf]
cmp byte [0x140c45677], 0
je 0x1400215e9
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [0x140c45898], 0
je 0x1400215fc
lea rcx, [rsp + 0x20]
call fcn.1400216d0
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140161080
add rsp, reloc.MFC80U.DLL_Ordinal_4144
pop rbx
ret

Function at 0x140021620
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
mov eax, 0x2030
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x2020], rax
lea rbx, [rsp + 0x2048]
mov rdx, rbx
call qword [sym.imp.ntdll.dll__vscwprintf]
add eax, 1
cmp eax, 0x1000
jg 0x1400216ac
mov rdx, qword [rsp + 0x2040]
lea rcx, [rsp + 0x20]
mov r8, rbx
call qword [sym.imp.MSVCR80.dll__vswprintf]
cmp byte [0x140c45677], 0
je 0x140021699
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x140c45898], 0
je 0x1400216ac
lea rcx, [rsp + 0x20]
call fcn.140021a40
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.140161080
add rsp, 0x2030
pop rbx
ret
Function at 0x140023d80
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r9
mov rbp, r8
mov rbx, rcx
mov qword [r11 - 0x38], r8
mov qword [r11 - 0x30], r9
mov rdx, r8
lea rcx, [r11 - 0x60]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
mov r8, rax
mov rdx, 0xffffffff80000002
mov rcx, rbx
call fcn.140023c50
test al, al
jne 0x140023df4
mov rcx, rbp
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x140023ec7
cmp qword [rdi + 0x20], 8
jb 0x140023e01
mov rdx, qword [rdi + 8]
jmp 0x140023e05
lea rdx, [rdi + 8]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test eax, eax
je 0x140023e75
cmp eax, 2
je 0x140023e75
cmp byte [rbx + 0x1010], 0
je 0x140023e40
lea r8, [rbx + 0x10]
mov edx, 4
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x140023e40
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140023e55
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, rbp
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor al, al
jmp 0x140023ec7
cmp byte [rbx + 0x1010], 0
je 0x140023e9c
lea r8, [rbx + 0x10]
mov edx, 4
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
je 0x140023e9c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140023eb2
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, rbp
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rcx, rdi
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140023f30
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x4b0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x4f0], rbx
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + Ordinal_1189], rax
mov rsi, rdx
mov r13, rcx
mov rbx, qword [rdx + 0x10]
cmp qword [rdx + 8], rbx
jbe 0x140023f78
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rdi, qword [rsi + 8]
cmp rdi, qword [rsi + 0x10]
jbe 0x140023f88
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp rdi, rbx
je 0x140023ffa
mov rbp, qword [rsi + 0x10]
mov rcx, rbp
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rax, [rdx + rdx*4]
lea r12, [rdi + rax*8]
cmp rbx, rbp
je 0x140023fd8
sub rdi, rbx
lea rcx, [rdi + rbx]
mov rdx, rbx
call qword [reloc.MSVCP80.dll___4__basic_string__WU__char_traits__W_std__V__allocator__W_2__std__QEAAAEAV01_AEBV01__Z]
add rbx, 0x28
cmp rbx, rbp
jne 0x140023fc2
mov rdi, qword [rsi + 0x10]
mov rbx, r12
cmp r12, rdi
je 0x140023ff6
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
add rbx, 0x28
cmp rbx, rdi
jne 0x140023fe4
mov qword [rsi + 0x10], r12
xor edi, edi
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r13]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x140024052
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x1400240f4
mov ebx, edi
cmp dword [rsp + 0x60], ebx
jbe 0x1400240f2
nop
mov word [rsp + 0xa0], 0
xor edx, edx
mov r8d, reloc.MFC80U.DLL_Ordinal_1022
lea rcx, [rsp + 0xa2]
call sub.ntdll.dll_memset
mov dword [rsp + 0x64], 0x400
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x64]
lea r8, [rsp + 0xa0]
mov edx, ebx
mov rcx, qword [r13]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400240e5
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.1400044f0
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
add ebx, 1
cmp ebx, dword [rsp + 0x60]
jb 0x140024060
mov al, 1
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4b0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret