joyce8/EMBER2024-capa huggingface dataset:
Function at 0x24b58
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rdx, rcx
xor r13d, r13d
lea rcx, [rax - 0x38]
mov dword [rax + 0x10], r13d
mov dword [rax + 0x18], r13d
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [0x0003c0f0]
call fcn.0001e470
mov rdi, rax
cmp rax, r13
jne 0x24ba0
mov eax, 0xc000014d
jmp 0x24d0d
mov edx, 0x810
mov ecx, 1
call fcn.000353f8
mov rbp, rax
cmp rax, r13
jne 0x24bca
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000009a
jmp 0x24d0d
mov edx, 0x418
mov ecx, 1
call fcn.000353f8
mov rsi, rax
cmp rax, r13
jne 0x24beb
mov ebx, 0xc000009a
jmp 0x24cfa
mov ebx, 0xc0000001
mov r12d, r13d
xor edx, edx
jmp 0x24cc5
inc r12d
cmp dword [rbp + 4], 1
jne 0x24cc2
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x28], rax
mov r9, rsi
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jl 0x24cc2
cmp dword [rsi + 0xc], r13d
je 0x24cc2
mov edx, dword [rsi + 8]
add rdx, rsi
mov qword [rsp + 0x38], rdx
movzx ecx, word [rsi + 0xc]
mov word [rsp + 0x30], cx
movzx eax, word [rsi + 0xc]
mov word [rsp + 0x32], ax
cmp cx, 2
jbe 0x24c93
movzx eax, cx
shr rax, 1
cmp word [rdx + rax*2 - 2], r13w
jne 0x24c93
mov eax, 0xfffe
add cx, ax
mov word [rsp + 0x30], cx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
cmp eax, r13d
jne 0x24cc2
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov ebx, eax
cmp eax, r13d
cmovge ebx, r13d
mov edx, r12d
lea rax, [rsp + 0x98]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, r13d
jge 0x24bfa
mov rcx, rsi
call fcn.00035470
mov rcx, rbp
call fcn.00035470
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x24d28
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x850
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, rcx
lea rcx, [rsp + 0x42]
xor r13d, r13d
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x40], r13w
call fcn.0003a110
lea rcx, [0x0003c120]
call fcn.0001e470
mov rsi, rax
cmp rax, r13
jne 0x24d8f
mov eax, 0xc000014d
jmp 0x24ef9
cmp word [rbx], 0x21
jne 0x24de5
lea rax, [rsp + 0x40]
mov rdi, rbx
mov edx, 0x400
sub rdi, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffbfe]
cmp rax, r13
je 0x24dcd
movzx eax, word [rdi + rcx]
cmp ax, r13w
je 0x24dcd
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x24daa
cmp rdx, r13
jne 0x24dd6
sub rcx, 2
mov word [rcx], r13w
mov word [rsp + 0x83e], r13w
jmp 0x24e13
cmp word [rbx], r13w
jne 0x24df5
mov edi, 0xc000003b
jmp 0x24eee
lea rdx, [rsp + 0x40]
mov r8d, 0x400
mov rcx, rbx
call fcn.0003212c
cmp eax, r13d
mov edi, eax
jl 0x24eee
lea rdx, [0x0003bcb0]
xor eax, eax
or r14, 0xffffffffffffffff
mov rdi, rdx
mov rcx, r14
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
cmp eax, r13d
jne 0x24e4a
mov edi, 0xc0000039
jmp 0x24eee
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r12d, [rcx + rcx + 0x34]
lea ecx, [rax + 1]
mov edx, r12d
mov edi, r12d
call fcn.000353f8
mov rbp, rax
cmp rax, r13
jne 0x24e8a
mov edi, 0xc000009a
jmp 0x24eee
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.0003a110
xor eax, eax
mov dword [rbp], 0x11232fe
mov dword [rbp + 4], 0x34
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdx, rbx
not rcx
lea r8, [rcx + rcx]
lea rcx, [rbp + 0x34]
call fcn.00039bc0
lea rdx, [rsp + 0x30]
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, rbp
mov edi, eax
call fcn.00035470
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.00039af0
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x24f2c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
lea rcx, [0x0003c120]
mov r15, rdx
mov dword [rax + 0x18], ebx
mov r12b, bl
movzx r13d, bx
mov dword [rax + 0x20], ebx
call fcn.0001e470
mov rdi, rax
cmp rax, rbx
jne 0x24f73
xor al, al
jmp 0x250f8
mov esi, 1
mov edx, 0x810
mov ecx, esi
call fcn.000353f8
mov rbp, rax
cmp rax, rbx
jne 0x24f97
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x24f6c
mov edx, 0x418
mov ecx, esi
call fcn.000353f8
mov rsi, rax
cmp rax, rbx
je 0x250e5
mov r14d, ebx
xor edx, edx
lea rax, [rsp + 0x90]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, ebx
jl 0x250da
inc r14d
cmp dword [rbp + 4], 3
jne 0x250cf
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [0x0003c100]
mov word [rsp + 0x30], cx
mov word [rsp + 0x32], cx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
call fcn.00035634
cmp al, bl
je 0x2503e
cmp r13w, bx
jne 0x250cf
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 8]
call fcn.00032500
cmp al, bl
je 0x250cf
jmp 0x25066
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x30]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlPrefixUnicodeString]
cmp al, bl
je 0x250cf
cmp r13w, word [rsp + 0x30]
jae 0x250cf
mov r13w, word [rsp + 0x30]
cmp r15, rbx
je 0x250d7
lea rax, [rsp + 0x98]
lea rdx, [rsp + 0x30]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, ebx
jl 0x250cf
cmp dword [rsi + 0xc], 0x34
jbe 0x250cf
cmp dword [rsi + 4], 3
jne 0x250cf
mov ecx, dword [rsi + 8]
mov eax, dword [rsi + 0xc]
add eax, 0xfffffffe
add rcx, rsi
mov byte [rax + rcx], bl
mov eax, dword [rsi + 0xc]
dec eax
mov byte [rax + rcx], bl
mov eax, dword [rsi + 0xc]
cmp dword [rcx + 4], eax
jae 0x250cf
mov eax, dword [rcx + 8]
mov r12b, 1
mov dword [r15], eax
mov edx, r14d
jmp 0x24fb4
mov r12b, 1
mov rcx, rsi
call fcn.00035470
mov bl, r12b
mov rcx, rbp
call fcn.00035470
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x25118
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rbx, rcx
xor r13d, r13d
lea rcx, [0x0003c120]
mov dword [rax + 0x10], r13d
mov dword [rax + 0x18], r13d
call fcn.0001e470
mov rdi, rax
cmp rax, r13
jne 0x25156
mov eax, 0xc000014d
jmp 0x25307
mov edx, 0x810
mov ecx, 1
call fcn.000353f8
mov rbp, rax
cmp rax, r13
jne 0x25180
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000009a
jmp 0x25307
mov edx, 0x418
mov ecx, 1
call fcn.000353f8
mov rsi, rax
cmp rax, r13
jne 0x251a1
mov ebx, 0xc000009a
jmp 0x252f4
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ebx, 0xc0000001
mov r12d, r13d
xor edx, edx
jmp 0x252bf
inc r12d
cmp dword [rbp + 4], 3
jne 0x252bc
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x28], rax
mov r9, rsi
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jl 0x252bc
cmp dword [rsi + 0xc], 0x34
jbe 0x252bc
cmp dword [rsi + 4], 3
jne 0x252bc
mov edx, dword [rsi + 8]
mov eax, dword [rsi + 0xc]
mov r9d, 2
sub eax, r9d
add rdx, rsi
mov byte [rax + rdx], r13b
mov eax, dword [rsi + 0xc]
dec eax
mov byte [rax + rdx], r13b
mov eax, dword [rsi + 0xc]
cmp dword [rdx + 4], eax
jae 0x252bc
mov r8d, dword [rdx + 4]
add r8, rdx
mov qword [rsp + 0x38], r8
movzx ecx, word [rsi + 0xc]
sub cx, word [rdx + 4]
mov word [rsp + 0x32], cx
mov word [rsp + 0x30], cx
cmp cx, r9w
jbe 0x2528d
movzx eax, cx
shr rax, 1
cmp word [r8 + rax*2 - 2], r13w
jne 0x2528d
sub cx, r9w
mov word [rsp + 0x30], cx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
cmp eax, r13d
jne 0x252bc
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov ebx, eax
cmp eax, r13d
cmovge ebx, r13d
mov edx, r12d
lea rax, [rsp + 0x98]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, r13d
jge 0x251be
mov rcx, rsi
call fcn.00035470
mov rcx, rbp
call fcn.00035470
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x25324
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rbx, rcx
xor r15d, r15d
lea rcx, [0x0003c120]
mov r14d, edx
mov dword [rax + 0x18], r15d
mov dword [rax + 0x20], r15d
call fcn.0001e470
mov rsi, rax
cmp rax, r15
jne 0x25369
mov eax, 0xc000014d
jmp 0x25532
mov edx, 0x810
mov ecx, 1
call fcn.000353f8
mov rbp, rax
cmp rax, r15
jne 0x25393
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000009a
jmp 0x25532
mov edx, 0x418
mov ecx, 1
call fcn.000353f8
mov rdi, rax
cmp rax, r15
jne 0x253b4
mov ebx, 0xc000009a
jmp 0x2551f
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ebx, 0xc0000001
mov r13d, r15d
xor edx, edx
lea rax, [rsp + 0xb0]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, r15d
jl 0x25517
inc r13d
cmp dword [rbp + 4], 3
jne 0x254de
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb8]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x28], rax
mov r9, rdi
mov r8d, 1
mov rcx, rsi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r15d
jl 0x254de
cmp dword [rdi + 0xc], 0x34
jbe 0x254de
cmp dword [rdi + 4], 3
jne 0x254de
mov eax, dword [rdi + 0xc]
mov r12d, dword [rdi + 8]
mov r8d, 2
sub eax, r8d
add r12, rdi
mov byte [rax + r12], r15b
mov eax, dword [rdi + 0xc]
dec eax
mov byte [rax + r12], r15b
mov eax, dword [r12 + 4]
cmp eax, dword [rdi + 0xc]
jae 0x254de
lea rdx, [r12 + rax]
mov qword [rsp + 0x38], rdx
movzx ecx, word [rdi + 0xc]
sub cx, word [r12 + 4]
mov word [rsp + 0x32], cx
mov word [rsp + 0x30], cx
cmp cx, r8w
jbe 0x254c6
movzx eax, cx
shr rax, 1
cmp word [rdx + rax*2 - 2], r15w
jne 0x254c6
sub cx, r8w
mov word [rsp + 0x30], cx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
cmp eax, r15d
je 0x254e6
mov edx, r13d
jmp 0x253cc
mov dword [r12 + 8], r14d
mov eax, dword [rdi + 0xc]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, r15d
cmp eax, r15d
cmovl ebx, eax
mov rcx, rdi
call fcn.00035470
mov rcx, rbp
call fcn.00035470
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x26110
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x280], rax
and qword [rsp + 0x30], 0
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x81]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x80], 0
call fcn.0003a110
and dword [rsp + 0x38], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov edx, 0x80000000
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x240
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x26275
lea rcx, [rsp + 0x70]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea r11, [rsp + 0x38]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0x70]
mov r8d, 2
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
js 0x26275
mov ecx, 1
cmp dword [rsp + 0x84], ecx
je 0x2620c
cmp dword [rsp + 0x84], 2
jne 0x26275
mov edx, dword [rsp + 0x88]
add rdx, 0x12
call fcn.000353f8
mov rbx, rax
test rax, rax
je 0x26275
mov r8d, dword [rsp + 0x88]
xor edx, edx
mov rcx, rax
add r8, 0x12
call fcn.0003a110
lea rcx, [rbx + 0x10]
lea rdx, [rsp + 0x8c]
mov qword [rbx + 8], rcx
mov r8d, dword [rsp + 0x88]
call fcn.00039bc0
movzx r11d, word [rsp + 0x88]
mov word [rbx], r11w
movzx eax, word [rsp + 0x88]
mov word [rbx + 2], ax
mov rax, rbx
jmp 0x26277
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.00039af0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret

Function at 0x26324
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x40
mov rbx, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x60]
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
add rsp, 0x40
pop rbx
ret

Function at 0x26370
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x60], rax
and dword [rsp + 0x30], 0
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x38]
mov rdx, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], r11
lea rdx, [rsp + 0x38]
mov r8d, 2
mov rcx, rbx
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x263e5
cmp dword [rsp + 0x4c], 4
jne 0x263e0
mov ecx, dword [rsp + 0x54]
mov dword [rdi], ecx
jmp 0x263e5
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.00039af0
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
Function at 0x2ae44
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x2c0
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
xor ebp, ebp
mov bl, cl
mov rdi, rdx
lea rcx, [r11 - 0x226]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x38], ebp
mov word [rsp + 0xa0], bp
call fcn.0003a110
lea r11, [rsp + 0xa0]
mov eax, 0x208
mov word [rsp + 0x50], bp
mov word [rsp + 0x52], ax
mov qword [rsp + 0x58], r11
cmp bl, bpl
je 0x2aee9
cmp word [0x0004ca70], bp
je 0x2b046
lea rdx, [0x0004ca70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rcx, [rsp + 0x90]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x30]
mov edx, 0x80000000
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rbp
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebp
jl 0x2b046
mov edx, 0x818
mov ecx, 1
call fcn.000353f8
mov rcx, qword [rsp + 0x30]
mov rbx, rax
cmp rax, rbp
je 0x2b040
lea rax, [rsp + 0x38]
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov esi, ebp
mov dword [rsp + 0x20], 0x818
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, ebp
jl 0x2b033
lea rdi, [rbx + 0x10]
movzx ecx, word [rbx + 0xc]
inc esi
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
cmp cx, 6
jb 0x2b006
cmp word [rdi], 0x7b
je 0x2aff7
lea rdx, [rdi + 2]
cmp word [rdx], 0x7b
jne 0x2b006
movzx eax, cx
shr rax, 1
cmp word [rdi + rax*2 - 2], 0x7d
jne 0x2b006
mov eax, 0xfffe
mov qword [rsp + 0x48], rdx
add cx, ax
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
lea rcx, [rsp + 0x40]
mov edx, 5
call fcn.0002acc4
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, esi
mov dword [rsp + 0x20], 0x818
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, ebp
jge 0x2afa7
mov rcx, rbx
call fcn.00035470
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.00039af0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x2b078
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x2d0
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov bl, cl
mov rdi, rdx
lea rcx, [r11 - 0x226]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0xb0], bp
call fcn.0003a110
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov eax, 0x208
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x38], ebp
mov word [rsp + 0x40], bp
mov word [rsp + 0x42], ax
cmp bl, bpl
je 0x2b123
cmp word [0x0004ca70], bp
je 0x2b248
lea rdx, [0x0004ca70]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rcx, [rsp + 0x90]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x30]
mov edx, 0x80000000
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rbp
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebp
jl 0x2b248
mov edx, 0x1000
mov ecx, 1
call fcn.000353f8
mov rcx, qword [rsp + 0x30]
mov rbx, rax
cmp rax, rbp
je 0x2b242
lea rax, [rsp + 0x38]
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov esi, ebp
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, ebp
jl 0x2b235
lea rdi, [rbx + 0xc]
movzx eax, word [rbx + 8]
inc esi
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x50], ax
mov word [rsp + 0x52], ax
cmp ax, bp
je 0x2b20c
cmp word [rdi], 0x7b
jne 0x2b20c
lea rcx, [rsp + 0x50]
mov edx, 5
call fcn.0002acc4
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, esi
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, ebp
jge 0x2b1dd
mov rcx, rbx
call fcn.00035470
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.00039af0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x2b31c
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, 5
lea rdx, [0x0003c740]
xor ecx, ecx
mov r8d, ebx
call fcn.0002ae44
lea rdx, [0x0003c800]
mov r8d, ebx
xor ecx, ecx
call fcn.0002ae44
lea rdx, [0x0003c890]
mov r8d, ebx
xor ecx, ecx
call fcn.0002b078
lea rdx, [0x0003c910]
mov r8d, ebx
xor ecx, ecx
call fcn.0002b078
lea rdx, [0x0003c9a0]
mov r8d, ebx
xor ecx, ecx
call fcn.0002ae44
lea rdx, [0x0003ca30]
mov r8d, ebx
xor ecx, ecx
call fcn.0002ae44
lea rdx, [0x0003cb00]
mov r8d, ebx
xor ecx, ecx
call fcn.0002ae44
lea rdx, [0x0003cbb0]
mov r8d, ebx
xor ecx, ecx
call fcn.0002b078
lea rdx, [0x0003cc50]
mov r8d, ebx
xor ecx, ecx
call fcn.0002b078
lea rdx, [0x0003cd00]
mov r8d, ebx
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.0002ae44

Function at 0x2b3dc
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, 5
lea rdx, [0x0003cda0]
mov cl, 1
mov r8d, ebx
call fcn.0002b078
lea rdx, [0x0003ce20]
mov r8d, ebx
mov cl, 1
call fcn.0002b078
lea rdx, [0x0003cea0]
mov r8d, ebx
mov cl, 1
call fcn.0002ae44
lea rdx, [0x0003cf10]
mov r8d, ebx
mov cl, 1
call fcn.0002b078
lea rdx, [0x0003cfa0]
mov r8d, ebx
mov cl, 1
call fcn.0002b078
lea rdx, [0x0003d030]
mov r8d, ebx
mov cl, 1
add rsp, 0x20
pop rbx
jmp fcn.0002ae44

Function at 0x2c6bc
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
cmp byte [0x0004cc79], 0
mov r12d, r9d
mov r13d, r8d
mov rsi, rdx
mov rbp, rcx
jne 0x2c6f3
mov eax, 0xc0000001
jmp 0x2c7a4
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call fcn.0002c3f8
test al, al
je 0x2c70f
xor eax, eax
jmp 0x2c7a4
lea rcx, [0x0003d0c0]
call fcn.0001e470
mov rdi, rax
test rax, rax
je 0x2c6e9
mov eax, 0x5432
mov r9d, 3
xor r8d, r8d
mov word [rsp + 0x30], ax
lea rax, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3c], r12d
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, eax
test eax, eax
js 0x2c799
mov ecx, 1
lock xadd dword [0x00049a44], ecx
inc ecx
mov r9d, r12d
mov r8d, r13d
mov rdx, rsi
mov dword [rbp], ecx
call fcn.0002c16c
test al, al
jne 0x2c799
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov ebx, 0xc0000001
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x2c7c4
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor bl, bl
xor esi, esi
mov ebp, ecx
cmp byte [0x0004cc79], bl
jne 0x2c7f0
mov eax, 0xc0000001
jmp 0x2c89e
lea rcx, [0x0003d0c0]
call fcn.0001e470
mov rdi, rax
test rax, rax
je 0x2c7e6
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x00059000]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rax, qword [0x00059070]
lea rcx, [0x00059070]
jmp 0x2c834
mov rsi, rax
cmp dword [rax + 0x10], ebp
je 0x2c83b
mov rax, qword [rax]
cmp rax, rcx
jne 0x2c829
jmp 0x2c84b
mov rdx, qword [rax]
mov rax, qword [rax + 8]
mov bl, 1
mov qword [rax], rdx
mov qword [rdx + 8], rax
lea rcx, [0x00059000]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
test bl, bl
je 0x2c88e
mov rdx, qword [rsi + 0x20]
mov rcx, rdi
add rdx, 0x20
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, qword [rsi + 0x20]
mov ebx, eax
call fcn.0002c11c
mov edx, 0x49544650
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x2c893
mov ebx, 0xc0000225
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret