joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d5dc0
Capabilities:
Create service

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x1800d5e5d
xor eax, eax
jmp 0x1800d5e6d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
add rsp, 0x88
ret

Function at 0x1800d5e80
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1800d5ec6
xor eax, eax
jmp 0x1800d5f1d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1800d5efe
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x1800d5efe
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x422
je 0x1800d5efe
mov dword [rsp + 0x2c], 0
jmp 0x1800d5f06
mov dword [rsp + 0x2c], 1
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsp + 0x28]
add rsp, 0x38
ret

Function at 0x1800d5f30
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe0
mov rax, qword [0x180222e50]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor eax, eax
mov word [rsp + 0x50], ax
lea rax, [rsp + 0x52]
mov rdi, rax
xor eax, eax
mov ecx, 0x7e
rep stosb byte [rdi], al
mov qword [rsp + 0x40], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
cmp eax, 5
jae 0x1800d5fa1
mov r8, qword [rsp + 0xf0]
lea rdx, str..Global_s
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1800d5fbb
mov r8, qword [rsp + 0xf0]
lea rdx, str.._s
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x1800d5ffb
xor eax, eax
jmp 0x1800d6028
cmp qword [rsp + 0xf8], 0
je 0x1800d6018
mov rax, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
jmp 0x1800d6023
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1800fbf40
add rsp, 0xe0
pop rdi
ret
Function at 0x1800d6050
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x180222e50]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800d60c5
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800fbf40
add rsp, 0x68
ret

Function at 0x1800d60e0
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800d613c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x1800da7c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x40], 0xffffffffffffffff
jne 0x1800da8a4
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x48]
cmp dword [rax - 8], 0
jne 0x1800da7f2
mov dword [rsp + 0x50], 1
jmp 0x1800da7fa
mov dword [rsp + 0x50], 0
cmp dword [rsp + 0x50], 0
jne 0x1800da894
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 7
mov edx, 0xc0000000
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x70]
mov qword [rcx + 0x40], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x40], 0xffffffffffffffff
je 0x1800da894
mov eax, 0xfeff
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, 2
lea rdx, [rsp + 0x40]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x40], 0xffffffffffffffff
jne 0x1800da8a4
xor eax, eax
jmp 0x1800da8a9
mov eax, 1
add rsp, 0x68
ret

Function at 0x1800da8b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [rsp + 0x70]
add rax, 8
mov r8d, 1
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1800f3200
nop
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x70]
call qword [rax + 0x18]
test eax, eax
je 0x1800da957
cmp qword [rsp + 0x78], 0
je 0x1800da957
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x48], 0
mov rcx, qword [rsp + 0x78]
call fcn.1800fbc94
mov eax, eax
shl rax, 1
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, eax
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [rsp + 0x30]
call fcn.1800f3280
add rsp, 0x68
ret

Function at 0x1800daa10
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1800e5080
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp dword [rax + 8], 0
je 0x1800e50bc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rsp + 0x30]
sub eax, dword [rcx + 0xc]
mov rcx, qword [rsp + 0x30]
cmp eax, dword [rcx + 8]
ja 0x1800e50c0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rsp + 0x30]
cmp eax, dword [rcx + 0xc]
jb 0x1800e50c0
xor eax, eax
jmp 0x1800e50c5
mov eax, 1
add rsp, 0x28
ret
Function at 0x1800e7ee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
shr edx, 4
mov rsi, r9
inc dx
movzx r9d, r8w
mov rdi, rcx
movzx r8d, dx
mov edx, 6
and ebx, 0xf
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1800e7f43
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1800e7f43
xor edx, edx
nop dword [rax + rax]
movzx ecx, word [rax]
cmp ebx, edx
je 0x1800e7f55
inc edx
lea rax, [rax + rcx*2 + 2]
cmp edx, 0x10
jl 0x1800e7f30
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rbx, dword [rsp + 0x50]
lea rdx, [rax + 2]
mov rcx, rsi
mov r8, rbx
call fcn.1800e7c00
test eax, eax
jne 0x1800e7f73
mov byte [rbx + rsi - 1], al
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
dec eax
add rsp, 0x20
pop rdi
ret

Function at 0x1800e96b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
shr edx, 4
mov rsi, r9
inc dx
movzx r9d, r8w
mov rdi, rcx
movzx r8d, dx
mov edx, 6
and ebx, 0xf
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1800e971b
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rax
test rax, rax
je 0x1800e971b
xor ebp, ebp
mov eax, ebp
movzx ecx, word [rdx]
add rdx, 2
cmp ebx, eax
je 0x1800e9732
inc eax
lea rdx, [rdx + rcx*2]
cmp eax, 0x10
jl 0x1800e9705
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov edi, dword [rsp + 0x50]
dec edi
cmp ecx, edi
cmovle edi, ecx
movsxd rcx, edi
lea rbx, [rcx + rcx]
mov rcx, rsi
mov r8, rbx
call fcn.1800fcc50
mov word [rbx + rsi], bp
mov eax, edi
jmp 0x1800e971d
Function at 0x1800f38e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea rbp, [rcx + 0x20]
mov r13, rcx
mov r15d, r9d
mov rcx, rbp
mov r12d, edx
call fcn.1800f2a30
xor esi, esi
add r13, 8
mov rcx, r13
mov r14d, esi
mov edi, esi
call fcn.1800f33c0
mov ebx, eax
test eax, eax
jle 0x1800f394b
nop
mov edx, edi
mov rcx, r13
call fcn.1800f3400
cmp dword [rax], r12d
je 0x1800f39a6
cmp dword [rax + 4], 1
jne 0x1800f399e
inc edi
cmp edi, ebx
jl 0x1800f3930
xor eax, eax
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x2c], rax
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x3c], eax
mov qword [rsp + 0x24], rax
mov rax, qword [rsp + 0x80]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x38], rax
test r14d, r14d
je 0x1800f39b4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x24], 2
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
mov qword [rsp + 0x28], rax
jmp 0x1800f39c1
mov r14d, 1
jmp 0x1800f394b
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + reloc.WS2_32.dll_recv]
xor eax, eax
jmp 0x1800f39f8
mov dword [rsp + 0x24], 1
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.1800f38c0
mov r11, qword [rbp]
mov rcx, rbp
call qword [r11 + reloc.WS2_32.dll_recv]
test rsi, rsi
je 0x1800f39f3
or edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1800f3ca0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, r8
mov rdi, rcx
test rdx, rdx
je 0x1800f3cce
or r9d, 0x20019
mov r8d, r9d
call fcn.1800f3c00
mov rbx, rax
jmp 0x1800f3cd1
mov rbx, rcx
test rbx, rbx
je 0x1800f3d77
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800f3d6a
cmp dword [rsp + 0x30], 4
jne 0x1800f3d6a
mov eax, dword [rsp + 0x58]
mov ecx, 4
mov rdx, rsi
cmp eax, ecx
cmova eax, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800f3d6a
cmp rbx, rdi
je 0x1800f3d55
mov rcx, rbx
call fcn.1800f3c80
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
cmp rbx, rdi
je 0x1800f3d77
mov rcx, rbx
call fcn.1800f3c80
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x1800f3d90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, r8
mov rdi, rcx
test rdx, rdx
je 0x1800f3dbe
or r9d, 0x20019
mov r8d, r9d
call fcn.1800f3c00
mov rbx, rax
jmp 0x1800f3dc1
mov rbx, rcx
test rbx, rbx
je 0x1800f3e5f
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800f3e52
cmp dword [rsp + 0x30], 3
jne 0x1800f3e52
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x78], eax
jb 0x1800f3e52
lea rax, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800f3e52
cmp rbx, rdi
je 0x1800f3e3d
mov rcx, rbx
call fcn.1800f3c80
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
cmp rbx, rdi
je 0x1800f3e5f
mov rcx, rbx
call fcn.1800f3c80
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x1800f3e80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x40
mov rbp, r8
mov rsi, rcx
test rdx, rdx
je 0x1800f3eae
or r9d, 0x20019
mov r8d, r9d
call fcn.1800f3c00
mov rbx, rax
jmp 0x1800f3eb1
mov rbx, rcx
mov qword [rsp + 0x50], rdi
test rbx, rbx
je 0x1800f3f63
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800f3f56
cmp dword [rsp + 0x30], 3
jne 0x1800f3f56
mov ecx, dword [rsp + 0x58]
call fcn.1800fb374
mov rdi, rax
test rax, rax
je 0x1800f3f56
lea rax, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800f3f4e
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
mov qword [rax], rdi
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
cmp rbx, rsi
je 0x1800f3f47
mov rcx, rbx
call fcn.1800f3c80
mov eax, 1
jmp 0x1800f3f65
mov rcx, rdi
call fcn.1800fb418
cmp rbx, rsi
je 0x1800f3f63
mov rcx, rbx
call fcn.1800f3c80
xor eax, eax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret
Function at 0x1800f3f80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x40
mov rbp, r8
mov rdi, rcx
test rdx, rdx
je 0x1800f3fae
or r9d, 0x20019
mov r8d, r9d
call fcn.1800f3c00
mov rbx, rax
jmp 0x1800f3fb1
mov rbx, rcx
mov qword [rsp + 0x50], rsi
test rbx, rbx
je 0x1800f40a0
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800f4093
mov eax, dword [rsp + 0x30]
cmp eax, 1
je 0x1800f400a
cmp eax, 2
je 0x1800f400a
cmp eax, 6
je 0x1800f400a
cmp eax, 7
jne 0x1800f4093
mov ecx, dword [rsp + 0x58]
add ecx, 2
call fcn.1800fb374
mov r8d, dword [rsp + 0x58]
xor edx, edx
add r8d, 2
mov rcx, rax
mov rsi, rax
call fcn.1800fb1e0
lea r11, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800f407a
mov rcx, qword [rsp + 0x70]
mov rdx, rsi
call fcn.1800e8410
cmp rbx, rdi
je 0x1800f406b
mov rcx, rbx
call fcn.1800f3c80
mov rcx, rsi
call fcn.1800fb418
mov eax, 1
jmp 0x1800f40a2
mov rcx, rsi
call fcn.1800fb418
mov rcx, qword [rsp + 0x70]
lea rdx, [0x1801a9e70]
call fcn.1800e8410
cmp rbx, rdi
je 0x1800f40a0
mov rcx, rbx
call fcn.1800f3c80
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1800f4360
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, rcx
test rdx, rdx
je 0x1800f438e
or r9d, 0x20006
mov r8d, r9d
call fcn.1800f3c30
mov rbx, rax
jmp 0x1800f4391
mov rbx, rcx
test rbx, rbx
je 0x1800f43f0
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1800f43e3
cmp rbx, rdi
je 0x1800f43ce
mov rcx, rbx
call fcn.1800f3c80
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp rbx, rdi
je 0x1800f43f0
mov rcx, rbx
call fcn.1800f3c80
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1800f4410
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, rcx
test rdx, rdx
je 0x1800f443e
or r9d, 0x20006
mov r8d, r9d
call fcn.1800f3c30
mov rbx, rax
jmp 0x1800f4441
mov rbx, rcx
test rbx, rbx
je 0x1800f44a0
mov eax, dword [rsp + 0x68]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1800f4493
cmp rbx, rdi
je 0x1800f447e
mov rcx, rbx
call fcn.1800f3c80
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp rbx, rdi
je 0x1800f44a0
mov rcx, rbx
call fcn.1800f3c80
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1800f44c0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x30
mov rbp, r8
mov rsi, rcx
test rdx, rdx
je 0x1800f44ee
or r9d, 0x20006
mov r8d, r9d
call fcn.1800f3c30
mov rbx, rax
jmp 0x1800f44f1
mov rbx, rcx
test rbx, rbx
je 0x1800f4568
mov rdx, qword [rsp + 0x60]
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [rsp + 0x40], rdi
mov rdi, rdx
mov r9d, 1
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x40]
test eax, eax
jne 0x1800f455b
cmp rbx, rsi
je 0x1800f4546
mov rcx, rbx
call fcn.1800f3c80
mov eax, 1
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp rbx, rsi
je 0x1800f4568
mov rcx, rbx
call fcn.1800f3c80
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rsi
ret
Function at 0x1800f4580
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbp
push rsi
sub rsp, 0x68
xor eax, eax
mov esi, edx
xor r9d, r9d
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], rax
lea rax, [r11 + 0x18]
xor r8d, r8d
xor edx, edx
mov qword [r11 - 0x50], rax
lea rax, [r11 + 0x20]
mov rbp, rcx
mov qword [r11 - 0x58], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1800f470c
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x60], rdi
cmp dword [rsp + 0x98], eax
je 0x1800f46e2
mov eax, dword [rsp + 0x90]
mov ecx, 0x104
cmp eax, ecx
cmovb eax, ecx
mov dword [rsp + 0x90], eax
lea ecx, [rax + 1]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1800fb374
mov rbx, rax
test rax, rax
je 0x1800f4708
nop word [rax + rax]
mov r8d, dword [rsp + 0x90]
xor edx, edx
mov rcx, rbx
inc r8d
add r8, r8
call fcn.1800fb1e0
mov r9d, dword [rsp + 0x90]
mov r8, rbx
xor edx, edx
mov rcx, rbp
inc r9d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1800f4700
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
or r8d, 0x2001f
call fcn.1800f3c00
mov rdi, rax
test rax, rax
je 0x1800f4700
mov edx, esi
mov rcx, rax
call fcn.1800f4580
mov rcx, rdi
test eax, eax
je 0x1800f46fb
call fcn.1800f3c80
mov r11, qword [0x18023fd88]
test r11, r11
je 0x1800f46bd
test esi, esi
je 0x1800f46bd
xor r9d, r9d
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call r11
jmp 0x1800f46c9
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x1800f4700
dec dword [rsp + 0x98]
jne 0x1800f4630
mov rcx, rbx
call fcn.1800fb418
mov eax, 1
mov rbx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x60]
add rsp, 0x68
pop rsi
pop rbp
ret
call fcn.1800f3c80
mov rcx, rbx
call fcn.1800fb418
xor eax, eax
jmp 0x1800f46e7
xor eax, eax
add rsp, 0x68
pop rsi
pop rbp
ret
Function at 0x1800f4720
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov esi, r9d
mov rbp, r8
mov r12, rdx
mov rdi, rcx
test rdx, rdx
je 0x1800f475f
mov r8d, r9d
or r8d, 0x2001f
call fcn.1800f3c00
mov rbx, rax
jmp 0x1800f4762
mov rbx, rcx
test rbx, rbx
je 0x1800f47f9
mov rcx, rbx
test rbp, rbp
je 0x1800f4794
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x1800f47ec
cmp rbx, rdi
je 0x1800f478d
mov rcx, rbx
call fcn.1800f3c80
mov eax, 1
jmp 0x1800f47fb
mov edx, esi
call fcn.1800f4580
test eax, eax
je 0x1800f47ec
cmp rbx, rdi
je 0x1800f47ac
mov rcx, rbx
call fcn.1800f3c80
mov rax, qword [0x18023fd88]
test rax, rax
je 0x1800f47d5
test esi, esi
je 0x1800f47d5
xor r9d, r9d
mov r8d, esi
mov rdx, r12
mov rcx, rdi
call rax
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x1800f47fb
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x1800f47fb
cmp rbx, rdi
je 0x1800f47f9
mov rcx, rbx
call fcn.1800f3c80
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov r9d, dword [rcx + 8]
mov rcx, qword [rcx]
jmp 0x1800f4720

Function at 0x1800f4b00
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov esi, r9d
mov rbp, r8
mov r12, rdx
mov rdi, rcx
test rdx, rdx
je 0x1800f475f
mov r8d, r9d
or r8d, 0x2001f
call fcn.1800f3c00
mov rbx, rax
jmp 0x1800f4762
mov rbx, rcx
test rbx, rbx
je 0x1800f47f9
mov rcx, rbx
test rbp, rbp
je 0x1800f4794
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x1800f47ec
cmp rbx, rdi
je 0x1800f478d
mov rcx, rbx
call fcn.1800f3c80
mov eax, 1
jmp 0x1800f47fb
mov edx, esi
call fcn.1800f4580
test eax, eax
je 0x1800f47ec
cmp rbx, rdi
je 0x1800f47ac
mov rcx, rbx
call fcn.1800f3c80
mov rax, qword [0x18023fd88]
test rax, rax
je 0x1800f47d5
test esi, esi
je 0x1800f47d5
xor r9d, r9d
mov r8d, esi
mov rdx, r12
mov rcx, rdi
call rax
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x1800f47fb
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x1800f47fb
cmp rbx, rdi
je 0x1800f47f9
mov rcx, rbx
call fcn.1800f3c80
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov r9d, dword [rcx + 8]
mov rcx, qword [rcx]
jmp 0x1800f4720

Function at 0x1800f4b10
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov r8, rdx
xor edx, edx
jmp fcn.1800f4b00