joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e5e78
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x100151100]
lea rcx, [0x100151100]
xor edi, edi
call qword [rax + 0x18]
and qword [rsp + 0x68], rdi
lea rdx, [0x10001e7f0]
mov rbx, rax
lea rax, [rsp + 0x68]
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000e5f2a
mov rsi, qword [rsp + 0x68]
and dword [rsp + 0x50], edi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x60]
lea rdx, [0x100026560]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000e5f1c
cmp dword [rsp + 0x60], 4
jne 0x1000e5f1c
test eax, eax
jne 0x1000e5f1c
cmp dword [rsp + 0x50], edi
lea eax, [rdi + 1]
cmovne edi, eax
test rsi, rsi
je 0x1000e5f2a
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rbx
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1000e5f45
mov rcx, qword [rbx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, edi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1000e5f58
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x50
and dword [rax + 0x10], 0
and dword [rax + 0x18], 0
and qword [rax - 0x30], 0
mov dword [rax + 0x20], 4
mov rcx, qword [0x100152eb8]
lea r12, [0x100152eb8]
mov ebx, 1
lea r15, [0x10001dc38]
cmp rcx, r12
je 0x1000e5fad
test byte [rcx + 0x1c], bl
je 0x1000e5fad
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x6a]
mov r8, r15
call fcn.100034764
xor edi, edi
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x40]
and qword [rsp + 0x40], rdi
and dword [rsp + 0x80], edi
xor ecx, ecx
call sub.NETAPI32.dll_NetGetJoinInformation
mov esi, eax
mov rcx, qword [0x100152eb8]
cmp rcx, r12
je 0x1000e6017
test byte [rcx + 0x1c], 2
je 0x1000e6017
cmp byte [rcx + 0x19], 4
jb 0x1000e6017
mov eax, dword [rsp + 0x80]
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x6c]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov r9d, esi
mov r8, r15
mov qword [rsp + 0x20], rax
call fcn.1000e3770
mov rcx, qword [0x100152eb8]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1000e6030
mov rcx, rax
call sub.NETAPI32.dll_NetApiBufferFree
mov rcx, qword [0x100152eb8]
test esi, esi
jne 0x1000e608d
cmp dword [rsp + 0x80], 3
jne 0x1000e6069
cmp rcx, r12
je 0x1000e6065
test byte [rcx + 0x1c], 2
je 0x1000e6065
cmp byte [rcx + 0x19], 4
jb 0x1000e6065
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x6d]
mov r8, r15
call fcn.100034764
mov rcx, qword [0x100152eb8]
mov edi, ebx
jmp 0x1000e60b9
cmp rcx, r12
je 0x1000e60e1
test byte [rcx + 0x1c], 2
je 0x1000e60b9
cmp byte [rcx + 0x19], 4
jb 0x1000e60b9
mov rcx, qword [rcx + 0x10]
mov edx, 0x6e
mov r8, r15
call fcn.100034764
jmp 0x1000e60b2
cmp rcx, r12
je 0x1000e60e1
test byte [rcx + 0x1c], 2
je 0x1000e60b9
cmp byte [rcx + 0x19], 2
jb 0x1000e60b9
mov rcx, qword [rcx + 0x10]
mov edx, 0x6f
mov r9d, esi
mov r8, r15
call fcn.100036328
mov rcx, qword [0x100152eb8]
cmp rcx, r12
je 0x1000e60dd
test byte [rcx + 0x1c], bl
je 0x1000e60dd
cmp byte [rcx + 0x19], 5
jb 0x1000e60dd
mov rcx, qword [rcx + 0x10]
mov edx, 0x70
mov r9d, edi
mov r8, r15
call fcn.100036328
test edi, edi
jne 0x1000e60e3
xor ebx, ebx
lea rax, [rsp + 0x48]
lea rdx, [0x1000265a0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000e617e
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x98]
lea r8, [0x1000265f0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
lea rdx, [0x100026610]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov r9d, 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1000e616e
cmp dword [rsp + 0x88], 4
jne 0x1000e616e
xor ebx, ebx
cmp dword [rsp + 0x90], ebx
sete bl
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1000e617e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x50
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1000e6194
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebp, ebp
mov rbx, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov edi, eax
cmp eax, ebp
jne 0x1000e6322
mov edi, ebp
cmp rcx, rbp
je 0x1000e620b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov rcx, qword [rsp + 0x60]
cmp edi, ebp
mov qword [rsp + 0x48], rcx
jmp 0x1000e6231
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1000e6194
mov rcx, qword [rsp + 0x48]
mov edi, eax
cmp eax, ebp
jne 0x1000e6322
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebp
je 0x1000e6219
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x1000e6283
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
cmp qword [rbx + 8], rbp
jne 0x1000e62db
cmp qword [rbx + 0x10], rbp
jne 0x1000e62db
lea rcx, [0x100026660]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, rbp
je 0x1000e62b6
lea rdx, [0x1000266b8]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rbx + 8], rax
jmp 0x1000e62db
lea rcx, [0x1000266c8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, rbp
je 0x1000e62db
lea rdx, [0x1000266e8]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rbx + 0x10], rax
mov rax, qword [rbx + 8]
cmp rax, rbp
je 0x1000e62f4
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call rax
jmp 0x1000e630c
mov rax, qword [rbx + 0x10]
cmp rax, rbp
je 0x1000e6307
mov rcx, qword [rbx]
mov rdx, rsi
call rax
jmp 0x1000e630c
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rsp + 0x48]
mov ebx, eax
cmp rcx, rbp
je 0x1000e631e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000e632f
cmp rcx, rbp
je 0x1000e632d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10011b980
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000e64dc
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rbp, rdx
mov rsi, rcx
mov rcx, qword [0x100152eb8]
lea r14, [0x100152eb8]
mov r12d, 5
lea r13, [0x10001dc28]
cmp rcx, r14
je 0x1000e6542
test byte [rcx + 0x1c], 1
je 0x1000e6542
cmp byte [rcx + 0x19], r12b
jb 0x1000e6542
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 5]
mov r9, rsi
mov r8, r13
mov qword [rax - 0x68], rbp
call fcn.100065b78
mov r15d, 0x80
xor edx, edx
mov rcx, rbp
mov r8, r15
xor ebx, ebx
call sub.msvcrt.dll_memset
and qword [rsp + 0xa0], rbx
lea r8d, [rbx + 0x2c]
lea rcx, [rsp + 0x34]
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], 4
mov rcx, qword [0x100152eb8]
lea edi, [rbx + 2]
cmp rcx, r14
je 0x1000e65a4
test byte [rcx + 0x1c], dil
je 0x1000e65a4
cmp byte [rcx + 0x19], r12b
jb 0x1000e65a4
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xb]
mov r9, rsi
mov r8, r13
call fcn.100034788
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
mov r11d, eax
test eax, eax
je 0x1000e6627
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x1000e66ae
test byte [rcx + 0x1c], dil
je 0x1000e66ae
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, edi
cmovns eax, r12d
cmp edx, eax
jl 0x1000e66ae
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
mov r9d, ebx
mov r8, r13
mov dword [rsp + 0x20], r11d
call fcn.10003b338
jmp 0x1000e66ae
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x10]
cmp r9, r15
jbe 0x1000e666d
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x1000e6666
test byte [rcx + 0x1c], dil
je 0x1000e6666
cmp byte [rcx + 0x19], dil
jb 0x1000e6666
mov rcx, qword [rcx + 0x10]
mov edx, 0xd
mov r8, r13
mov qword [rsp + 0x20], r15
call fcn.1000e6358
mov ebx, 0x80004005
jmp 0x1000e66ae
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x1000e6696
test byte [rcx + 0x1c], dil
je 0x1000e6696
cmp byte [rcx + 0x19], r12b
jb 0x1000e6696
mov rcx, qword [rcx + 0x10]
mov edx, 0xe
mov r8, r13
call fcn.100034814
mov rdx, qword [rsp + 0xa0]
mov rcx, rbp
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x1000e6702
test byte [rcx + 0x1c], 1
je 0x1000e6702
movzx eax, byte [rcx + 0x19]
test ebx, ebx
cmovns edi, r12d
cmp eax, edi
jl 0x1000e6702
test ebx, ebx
js 0x1000e66e6
movzx eax, word [rbp]
jmp 0x1000e66e9
or eax, 0xffffffff
mov rcx, qword [rcx + 0x10]
mov edx, 0xf
mov r9d, ebx
mov r8, r13
mov word [rsp + 0x20], ax
call fcn.10006c100
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1000e6728
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x460
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r12, r8
mov ebp, edx
mov rsi, rcx
mov rax, qword [0x100152eb8]
lea rdx, [0x100152eb8]
mov ecx, 5
cmp rax, rdx
je 0x1000e6799
test byte [rax + 0x1c], 1
je 0x1000e6799
cmp byte [rax + 0x19], cl
jb 0x1000e6799
lea edx, [rcx + 0xb]
mov rcx, qword [rax + 0x10]
lea r8, [0x10001dc28]
mov r9, rsi
mov dword [rsp + 0x20], ebp
call fcn.10006c5c8
mov rax, qword [0x100152eb8]
xor edi, edi
lea ebx, [rdi + 2]
lea r14d, [rdi + 0x17]
cmp bx, word [rsi]
je 0x1000e67b7
cmp r14w, word [rsi]
je 0x1000e67b7
mov edi, 0x80070057
jmp 0x1000e688d
mov dword [rsp + 0x30], ebx
and dword [rsp + 0x28], edi
and qword [rsp + 0x20], rdi
lea r8, [rsp + 0x40]
mov r9d, 0x401
mov edx, 0x80
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x1000e6841
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
movzx edi, ax
mov r9d, eax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
mov rax, qword [0x100152eb8]
lea rsi, [0x100152eb8]
cmp rax, rsi
je 0x1000e68d2
test byte [rax + 0x1c], bl
je 0x1000e6894
cmp byte [rax + 0x19], bl
jb 0x1000e6894
mov rcx, qword [rax + 0x10]
lea r8, [0x10001dc28]
mov edx, 0x11
call fcn.100036328
mov rax, qword [0x100152eb8]
jmp 0x1000e6894
test ebp, ebp
je 0x1000e6879
cmp r14w, word [rsi]
jne 0x1000e6879
lea rcx, [rsp + 0x40]
mov edx, 0x25
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
je 0x1000e6863
mov byte [rax], dil
lea r8, [rsp + 0x40]
lea rdx, [0x1000266f8]
mov rcx, r12
call fcn.100039d9c
jmp 0x1000e6886
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.1000696b4
mov rax, qword [0x100152eb8]
lea rsi, [0x100152eb8]
cmp rax, rsi
je 0x1000e68d2
test byte [rax + 0x1c], 1
je 0x1000e68d2
movzx ecx, byte [rax + 0x19]
test edi, edi
mov edx, 5
cmovns ebx, edx
cmp ecx, ebx
jl 0x1000e68d2
mov rcx, qword [r12]
lea r8, [0x10001dc28]
mov edx, 0x12
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + 0x10]
mov r9d, edi
call fcn.10003b984
mov eax, edi
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.10011b980
mov rbx, qword [rsp + 0x498]
add rsp, 0x460
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000e724c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
mov rcx, qword [0x100152eb8]
lea rbp, [0x100152eb8]
mov ebx, 1
cmp rcx, rbp
je 0x1000e7285
test byte [rcx + 0x1c], bl
je 0x1000e7285
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x1d]
lea r8, [0x10001dc28]
call fcn.100034764
lea rax, [rsp + 0x78]
lea rdx, [0x1000269f0]
xor esi, esi
and qword [rsp + 0x78], rsi
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000e7338
mov rsi, qword [rsp + 0x78]
and dword [rsp + 0x60], edi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
lea rdx, [0x100026a50]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000e7338
cmp dword [rsp + 0x70], 4
jne 0x1000e7338
test eax, eax
jne 0x1000e7338
cmp dword [rsp + 0x60], ebx
jne 0x1000e7338
mov edi, ebx
mov rcx, qword [0x100152eb8]
cmp rcx, rbp
je 0x1000e736d
test byte [rcx + 0x1c], 2
je 0x1000e733f
cmp byte [rcx + 0x19], 3
jb 0x1000e733f
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x1f]
lea r8, [0x10001dc28]
call fcn.100034764
mov rcx, qword [0x100152eb8]
cmp rcx, rbp
je 0x1000e736d
test byte [rcx + 0x1c], bl
je 0x1000e736d
cmp byte [rcx + 0x19], 5
jb 0x1000e736d
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
test edi, edi
lea r8, [0x10001dc28]
mov edx, 0x20
sete r9b
call fcn.100036328
xor ebx, ebx
test edi, edi
sete bl
test rsi, rsi
je 0x1000e7382
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1000eba94
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r14
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r12, r9
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
lea r14, [0x100152eb8]
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x1000ebafc
test byte [rcx + 0x1c], 1
je 0x1000ebafc
cmp byte [rcx + 0x19], 5
jb 0x1000ebafc
mov edx, 0x55
mov qword [rax - 0x58], r8
mov r9, rdi
lea r8, [0x10001dc18]
mov rcx, qword [rcx + 0x10]
call fcn.10003b380
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.100035d98
nop
lea rcx, [rsp + 0x38]
call fcn.100069790
mov r8, qword [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov rcx, rbp
call fcn.1000ee744
mov ebx, eax
test eax, eax
jne 0x1000ebbd0
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1000ebb8a
cmp dword [rsp + 0x34], 4
je 0x1000ebb88
lea ebx, [rax + 0xd]
mov r10, qword [0x100152eb8]
jmp 0x1000ebbfa
xor ebx, ebx
cmp ebx, 2
jne 0x1000ebbf3
mov ebx, 0x490
mov r10, qword [0x100152eb8]
cmp r10, r14
je 0x1000ebc34
test byte [r10 + 0x1c], 2
je 0x1000ebbfa
cmp byte [r10 + 0x19], 4
jb 0x1000ebbfa
mov edx, 0x56
lea r8, [0x10001dc18]
mov rcx, qword [r10 + 0x10]
call fcn.100034764
mov r10, qword [0x100152eb8]
jmp 0x1000ebbfa
cmp eax, 2
jne 0x1000ebbf3
mov rax, qword [rbp]
mov r9, r12
mov r8, rsi
mov rdx, rdi
mov rcx, rbp
call qword [rax + 0x38]
mov ebx, eax
mov r10, qword [0x100152eb8]
jmp 0x1000ebbfa
mov r10, qword [0x100152eb8]
cmp r10, r14
je 0x1000ebc34
test byte [r10 + 0x1c], 1
je 0x1000ebc34
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1000ebc34
mov edx, 0x57
mov r9d, ebx
lea r8, [0x10001dc18]
mov rcx, qword [r10 + 0x10]
call fcn.100036328
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000ebc55
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1000ebc65
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x1000ed048
Capabilities:
Delete registry value

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea r12, [0x100152eb8]
lea rbp, [0x10001dc18]
mov rcx, qword [0x100152eb8]
cmp rcx, r12
je 0x1000ed0ac
test byte [rcx + 0x1c], 1
je 0x1000ed0ac
cmp byte [rcx + 0x19], 5
jb 0x1000ed0ac
mov edx, 0x7a
mov qword [rsp + 0x20], r8
mov r9, rbx
mov r8, rbp
mov rcx, qword [rcx + 0x10]
call fcn.10003b380
and qword [rsp + 0x38], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.100035d98
nop
lea rcx, [rsp + 0x88]
call fcn.100069790
mov r8, qword [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1000ed62c
mov ebx, eax
mov esi, 2
mov r10, qword [0x100152eb8]
cmp r10, r12
je 0x1000ed12a
test byte [r10 + 0x1c], sil
je 0x1000ed12a
cmp byte [r10 + 0x19], 4
jb 0x1000ed12a
lea edx, [rsi + 0x79]
mov r9d, eax
mov r8, rbp
mov rcx, qword [r10 + 0x10]
call fcn.100036328
mov r10, qword [0x100152eb8]
test ebx, ebx
jne 0x1000ed1b3
mov rdx, rdi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
mov r10, qword [0x100152eb8]
cmp r10, r12
je 0x1000ed17a
test byte [r10 + 0x1c], sil
je 0x1000ed17a
cmp byte [r10 + 0x19], 4
jb 0x1000ed17a
mov edx, 0x7c
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8, rbp
mov rcx, qword [r10 + 0x10]
call fcn.10009b2f4
mov r10, qword [0x100152eb8]
cmp ebx, esi
jne 0x1000ed1e6
mov ebx, 0x490
cmp r10, r12
je 0x1000ed21c
test byte [r10 + 0x1c], sil
je 0x1000ed1e6
cmp byte [r10 + 0x19], 4
jb 0x1000ed1e6
mov edx, 0x7d
mov r8, rbp
mov rcx, qword [r10 + 0x10]
call fcn.100034764
mov r10, qword [0x100152eb8]
jmp 0x1000ed1e6
cmp ebx, esi
jne 0x1000ed1e6
mov ebx, 0x490
cmp r10, r12
je 0x1000ed21c
test byte [r10 + 0x1c], sil
je 0x1000ed1e6
cmp byte [r10 + 0x19], 4
jb 0x1000ed1e6
mov edx, 0x7e
mov r8, rbp
mov rcx, qword [r10 + 0x10]
call fcn.100034764
mov r10, qword [0x100152eb8]
cmp r10, r12
je 0x1000ed21c
test byte [r10 + 0x1c], 1
je 0x1000ed21c
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1000ed21c
mov edx, 0x7f
mov r9d, ebx
mov r8, rbp
mov rcx, qword [r10 + 0x10]
call fcn.100036328
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000ed240
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1000ed250
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x1000f4028
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rsi, r9
mov rdi, r8
mov dword [rax + 0x10], ebp
mov eax, dword [rsp + 0x70]
mov qword [rsp + 0x30], rbp
add eax, eax
mov dword [rsp + 0x70], eax
cmp rdx, rbp
je 0x1000f417d
cmp word [rdx], bp
je 0x1000f417d
cmp r8, rbp
je 0x1000f415d
cmp word [r8], bp
je 0x1000f415d
cmp r9, rbp
jne 0x1000f40a9
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f41ab
test byte [rcx + 0x1c], 1
je 0x1000f41ab
lea edx, [rbp + 0xc]
jmp 0x1000f419b
mov eax, dword [0x100157a34]
neg eax
lea rax, [rsp + 0x30]
sbb r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
and r9d, 0x100
add r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000f4149
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000f4149
mov r8d, dword [rsp + 0x58]
cmp r8d, 1
je 0x1000f4149
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
mov ebx, 0xd
cmp rcx, rax
je 0x1000f4149
test byte [rcx + 0x1c], 1
je 0x1000f4149
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x10001dbe8]
mov edx, ebx
mov r9, rdi
call fcn.10009b2f4
mov rcx, qword [rsp + 0x30]
cmp rcx, rbp
je 0x1000f4159
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000f41b0
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f41ab
test byte [rcx + 0x1c], 1
je 0x1000f41ab
mov edx, 0xb
jmp 0x1000f419b
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000f41ab
test byte [rcx + 0x1c], 1
je 0x1000f41ab
mov edx, 0xa
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100034764
mov eax, 0x57
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1000f41cc
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
sub rsp, 0x50
xor r12d, r12d
mov rsi, r9
mov r10, rcx
mov qword [rax + 0x10], r12
cmp r9, r12
je 0x1000f4396
cmp word [r9], r12w
je 0x1000f4396
mov rdi, qword [rsp + 0x90]
cmp rdi, r12
je 0x1000f4376
cmp word [rdi], r12w
je 0x1000f4376
mov ebp, 0x7fffffff
mov rcx, rdi
mov rax, rbp
cmp word [rcx], r12w
je 0x1000f4239
add rcx, 2
sub rax, 1
jne 0x1000f4229
cmp rax, r12
je 0x1000f4329
sub rbp, rax
mov eax, dword [0x100157a34]
mov qword [rsp + 0x40], r12
neg eax
lea rax, [rsp + 0x78]
lea rdx, [0x100026d28]
sbb ecx, ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r8
and ecx, 0x100
xor r9d, r9d
xor r8d, r8d
add ecx, 0x20006
mov dword [rsp + 0x28], ecx
mov rcx, r10
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
cmp eax, r12d
je 0x1000f42db
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000f4362
test byte [rcx + 0x1c], 1
je 0x1000f4362
mov edx, 0x12
lea r9, [0x100026d28]
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
mov dword [rsp + 0x20], eax
call fcn.10009b2f4
jmp 0x1000f4362
mov rcx, qword [rsp + 0x78]
lea eax, [rbp + rbp + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp eax, r12d
je 0x1000f4362
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000f4362
test byte [rcx + 0x1c], 1
je 0x1000f4362
mov edx, 0x13
mov r9, rdi
jmp 0x1000f42c2
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000f435d
test byte [rcx + 0x1c], 1
je 0x1000f435d
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
mov edx, 0x11
mov r9d, 0x80070057
call fcn.100036328
mov ebx, 0x57
mov rcx, qword [rsp + 0x78]
cmp rcx, r12
je 0x1000f4372
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000f43c9
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000f43c4
test byte [rcx + 0x1c], 1
je 0x1000f43c4
mov edx, 0x10
jmp 0x1000f43b4
mov rcx, qword [0x100152eb8]
lea rdx, [0x100152eb8]
cmp rcx, rdx
je 0x1000f43c4
test byte [rcx + 0x1c], 1
je 0x1000f43c4
mov edx, 0xf
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100034764
mov eax, 0x57
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret