joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051c38
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x60
mov ebx, edx
mov edi, ecx
test edx, edx
jne 0x140051c57
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x140051c59
mov eax, ebx
and dword [rsp + 0x40], 0
lea r8, [rsp + 0x30]
and dword [rsp + 0x58], 0
lea rdx, [rsp + 0x48]
xor r9d, r9d
mov dword [rsp + 0x30], eax
lea rcx, [0x14009d578]
mov qword [rsp + 0x38], 4
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x50], 4
call fcn.140051e58
mov rcx, qword [0x1400ad2f8]
lea rbp, [0x1400ad2f8]
cmp rcx, rbp
je 0x140051ccb
test byte [rcx + 0x1c], 4
je 0x140051ccb
mov rcx, qword [rcx + 0x10]
lea r8, str.ciX
mov edx, 0x1f
mov dword [rsp + 0x20], ebx
mov r9d, edi
call fcn.140035758
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
test eax, eax
jne 0x140051d49
mov rcx, qword [0x1400ad2f8]
cmp rcx, rbp
je 0x140051d3e
test byte [rcx + 0x1c], 4
je 0x140051d1e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [0x1400ad2f8]
lea r8, str.ciX
mov r9d, eax
mov edx, 0x20
mov rcx, qword [rcx + 0x10]
call fcn.14002efb8
mov rcx, qword [0x1400ad2f8]
cmp rcx, rbp
je 0x140051d3e
test byte [rcx + 0x1c], 4
je 0x140051d3e
mov rcx, qword [rcx + 0x10]
lea r8, str.ciX
mov edx, 0x21
call fcn.14002ef94
xor eax, eax
movabs byte [0], al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140052744
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1400ad768]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
lea rdx, [rbp + 0x27]
mov bl, dil
call qword [sym.imp.RPCRT4.dll_I_RpcBindingIsClientLocal]
test eax, eax
jne 0x14005281a
cmp dword [rbp + 0x27], edi
je 0x14005281a
lea ebx, [rdi + 1]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
lea r9, [rbp + 0x37]
mov r8d, ebx
mov rcx, rax
lea edx, [rdi + 8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
test eax, eax
je 0x14005281a
lea rax, [rbp + 0x2f]
mov dword [rbp + 0x3f], edi
mov qword [rsp + 0x50], rax
lea r8d, [rdi + 2]
mov dword [rsp + 0x48], edi
lea rcx, [rbp + 0x3f]
mov dword [rsp + 0x40], edi
xor r9d, r9d
mov dword [rsp + 0x38], edi
mov dl, bl
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov word [rbp + 0x43], 0x500
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140052810
mov rdx, qword [rbp + 0x2f]
lea r8, [rbp + 0x2b]
mov rcx, qword [rbp + 0x37]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CheckTokenMembership]
test eax, eax
je 0x140052806
cmp dword [rbp + 0x2b], edi
cmovne ebx, edi
mov rcx, qword [rbp + 0x2f]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_FreeSid]
mov rcx, qword [rbp + 0x37]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov al, bl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14001aad0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140052994
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x1400ad768]
xor rax, rsp
mov qword [rbp + 0x270], rax
xor r14d, r14d
mov r15, r8
cmp qword [0x1400af4d0], r14
mov rbx, rcx
jne 0x1400529e0
mov eax, 0x80004005
jmp 0x140052bcd
mov r12, r14
mov r13b, r14b
mov edi, 1
test rbx, rbx
je 0x140052a6a
mov rax, qword gs:[0x30]
cmp dword [rax + 0x179c], r14d
jne 0x140052a1e
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
test eax, eax
jle 0x140052a16
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x140052a1e
mov r12, rbx
mov r13b, dil
mov rcx, rbx
call fcn.140052744
test al, al
je 0x140052a6a
mov rcx, qword [0x1400ad2f8]
lea rsi, [0x1400ad2f8]
cmp rcx, rsi
je 0x140052bbd
mov r14d, 2
test byte [rcx + 0x1c], r14b
je 0x140052bbd
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 8]
lea r8, [0x1400a1888]
call fcn.14002ef94
jmp 0x140052bbd
mov esi, 0x2b0
lea rcx, [rsp + 0x30]
mov r8d, esi
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], esi
lea rsi, [0x1400ad2f8]
mov r14d, 2
movups xmm0, xmmword [0x1400a1878]
movdqu xmmword [rsp + 0x34], xmm0
test r15, r15
je 0x140052ab4
mov r8, r15
lea rcx, [rbp - 0x28]
mov edx, 0x104
call fcn.140010a10
jmp 0x140052b0e
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x104
lea rdx, [rbp - 0x28]
mov ecx, r14d
call qword [sym.imp.SspiCli.dll_GetUserNameExW]
test al, al
jne 0x140052b0e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x140052ae4
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [0x1400ad2f8]
cmp rcx, rsi
je 0x140052b0e
test byte [rcx + 0x1c], dil
je 0x140052b0e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400a1888]
mov edx, 0xb
mov r9d, eax
call fcn.14002efb8
lea rdx, [rbp + 0x1e0]
mov rcx, rbx
call fcn.140052570
mov ebx, eax
test eax, eax
js 0x140052b3a
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1e0]
call fcn.1400526c0
mov ebx, eax
test eax, eax
jns 0x140052b79
mov rcx, qword [0x1400ad2f8]
cmp rcx, rsi
je 0x140052b64
test byte [rcx + 0x1c], r14b
je 0x140052b64
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400a1888]
mov edx, 0xc
mov r9d, ebx
call fcn.14002efb8
mov word [rsp + 0x58], r14w
xor r14d, r14d
mov dword [rsp + 0x5c], r14d
cmp word [rbp - 0x28], r14w
je 0x140052bbb
mov rax, qword [0x1400af4d0]
lea rcx, [rsp + 0x30]
call qword [0x14008f7f0]
mov ebx, eax
test eax, eax
jns 0x140052bbb
mov rcx, qword [0x1400ad2f8]
cmp rcx, rsi
je 0x140052bbb
test byte [rcx + 0x1c], dil
je 0x140052bbb
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400a1888]
mov edx, 0xd
mov r9d, eax
call fcn.14002efb8
mov edi, ebx
test r13b, r13b
je 0x140052bcb
mov rcx, r12
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelfEx]
mov eax, edi
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.14001aad0
mov rbx, qword [rsp + 0x3c8]
add rsp, 0x380
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005332c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
and qword [r11 - 0x28], 0
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov r14, rcx
test rcx, rcx
je 0x1400533da
test rdx, rdx
je 0x1400533da
test r8, r8
je 0x1400533da
lea rax, [r11 - 0x28]
mov r9d, 0x20019
xor r8d, r8d
mov qword [r11 - 0x38], rax
lea rdx, [0x1400a1960]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ecx, eax
call fcn.14001f78c
mov ebx, eax
test eax, eax
js 0x1400533df
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ecx, eax
call fcn.14001f78c
mov ebx, eax
test eax, eax
js 0x1400533cd
test rdi, rdi
je 0x1400533cd
mov eax, dword [rsp + 0x60]
mov dword [rdi], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x1400533df
mov ebx, 0x80004003
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400546a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor r14d, r14d
mov dword [r11 + 0x18], 0x410
mov rax, rdx
mov qword [r8], r14
mov rsi, r8
mov qword [r11 + 0x20], r14
mov rbp, rcx
mov qword [r11 - 0x28], r14
lea r8, [r11 - 0x28]
mov edx, 0x20019
mov rcx, rax
mov ebx, r14d
call fcn.140055428
mov edi, eax
test eax, eax
jne 0x140054754
mov ecx, dword [rsp + 0x80]
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rbx, rax
test rax, rax
je 0x14005474f
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionDevices
mov qword [rsp + 0x28], rbx
mov r9d, 2
mov r8, rbp
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, eax
cmp eax, 0xea
jne 0x140054754
mov rcx, qword [0x1400af198]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0x1400546ec
mov edi, 8
test edi, edi
mov r8, r14
cmovne r8, rbx
cmovne rbx, r14
test r8, r8
je 0x140054775
mov rcx, qword [0x1400af198]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140054785
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x1400547de
mov edi, 0x709
mov r8, qword [rsp + 0x88]
test r8, r8
je 0x1400547b2
mov rcx, qword [0x1400af198]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov qword [rsp + 0x88], r14
test rbx, rbx
je 0x1400547c9
mov rcx, qword [0x1400af198]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov rbx, qword [rsp + 0x70]
mov eax, edi
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
mov r9, rbx
mov qword [rsp + 0x20], r14
lea r8, [0x1400a1a7c]
mov rdx, rbp
lea rcx, [rsp + 0x88]
call fcn.14001334c
mov edi, eax
test eax, eax
jne 0x14005478e
mov rcx, qword [rsp + 0x88]
mov qword [rsi], rcx
jmp 0x1400547aa

Function at 0x140054994
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, rdx
xor ebp, ebp
mov dword [r8], ebp
mov rdi, r8
mov rsi, rcx
mov qword [r11 + 0x18], rbp
lea r8, [r11 + 0x18]
mov edx, 0x20019
mov rcx, rax
call fcn.140055428
mov ebx, eax
test eax, eax
jne 0x140054a09
mov rcx, qword [rsp + 0x60]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionDevices
mov qword [rsp + 0x30], rbp
mov r9d, 0xffff
mov qword [rsp + 0x28], rbp
mov r8, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x140054a09
mov dword [rdi], 1
jmp 0x140054a0f
cmp ebx, 2
cmove ebx, ebp
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140054a1f
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140054a3c
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov rdi, rdx
and qword [rbp + 0x38], rbx
mov rsi, rcx
and qword [rbp + 0x30], rbx
and qword [rbp + 0x28], rbx
test rdx, rdx
jne 0x140054a7b
lea rdx, [rbp + 0x30]
xor ecx, ecx
call fcn.14001447c
lea ecx, [rdi + 2]
test eax, eax
mov rdi, qword [rbp + 0x30]
cmove ebx, ecx
test ebx, ebx
jne 0x140054ae1
lea r8, [rbp + 0x38]
mov edx, 0x20006
mov rcx, rsi
call fcn.140055428
mov ebx, eax
test eax, eax
jne 0x140054ae1
and qword [rsp + 0x30], 0
lea r8, [0x14009d4e0]
mov qword [rsp + 0x28], rdi
lea r9, str.SessionDefaultDevices
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0x28]
call fcn.14001334c
mov ebx, eax
test eax, eax
jne 0x140054ae1
mov rdx, qword [rbp + 0x28]
lea r8, str.Device
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegDeleteKeyValueW]
mov ebx, eax
mov r8, qword [rbp + 0x28]
test r8, r8
je 0x140054afe
mov rcx, qword [0x1400af198]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
and qword [rbp + 0x28], 0
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140054b12
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
and qword [rbp + 0x30], 0
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140054b21
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140054dd8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov dword [rsp + 0x68], 0x410
mov qword [rdx], rbp
lea r8, [rsp + 0x70]
mov rsi, rdx
mov qword [rsp + 0x70], rbp
mov edx, 0x20019
mov edi, ebp
call fcn.140055428
mov ebx, eax
test eax, eax
jne 0x140054e76
mov ecx, dword [rsp + 0x68]
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rdi, rax
test rax, rax
je 0x140054e71
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r8, str.Device
mov qword [rsp + 0x28], rdi
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov r9d, 2
mov qword [rsp + 0x20], rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
cmp eax, 0xea
jne 0x140054e76
mov rcx, qword [0x1400af198]
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0x140054e10
mov ebx, 8
test ebx, ebx
mov r8, rbp
cmovne r8, rdi
cmovne rdi, rbp
test r8, r8
je 0x140054e97
mov rcx, qword [0x1400af198]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140054ea7
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
jne 0x140054ebe
mov rcx, rdi
call fcn.14005546c
mov ebx, eax
test eax, eax
jne 0x140054ebe
mov qword [rsi], rdi
jmp 0x140054ed5
test rdi, rdi
je 0x140054ed5
mov rcx, qword [0x1400af198]
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140054eec
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x140054f0d
lea ebx, [rdx + 0x57]
jmp 0x140054f10
or dword [rdx], 0xffffffff
xor eax, eax
mov dword [rbp + 0x30], 4
mov dword [rbp + 0x28], eax
test ebx, ebx
jne 0x140054fca
and qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14001a430
and qword [rbp - 8], 0
lea rcx, [rbp - 0x10]
and qword [rbp - 0x10], 0
call fcn.14001a430
and qword [rbp - 0x10], 0
lea r8, [rbp - 8]
mov edx, 0x20019
mov rcx, rsi
call fcn.140055428
mov ebx, eax
test eax, eax
jne 0x140054fb5
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140054fb5
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x38]
lea rax, [rbp + 0x28]
xor r8d, r8d
lea rdx, str.LegacyDefaultPrinterMode
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
lea rcx, [rbp - 0x10]
call fcn.14001a430
lea rcx, [rbp - 8]
call fcn.14001a430
mov eax, dword [rbp + 0x28]
cmp ebx, 2
je 0x140054fdc
cmp eax, 1
ja 0x140054fdc
test ebx, ebx
jne 0x140054ff4
mov dword [rdi], eax
jmp 0x140054ff4
call fcn.140010f8c
xor ecx, ecx
mov rdx, rsi
test al, al
setne cl
xor ebx, ebx
mov dword [rdi], ecx
call fcn.140055508
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x14005500c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, rdx
and qword [rsp + 0x78], rbx
mov rsi, rcx
test rdx, rdx
jne 0x14005502b
lea ebx, [rdx + 0x57]
jmp 0x14005502e
or dword [rdx], 0xffffffff
xor eax, eax
mov dword [rsp + 0x70], 4
mov dword [rsp + 0x68], eax
test ebx, ebx
jne 0x140055092
lea r8, [rsp + 0x78]
mov edx, 0x20019
call fcn.140055428
mov ebx, eax
test eax, eax
jne 0x14005508e
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea r9d, [rbx + 0x10]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r8, [0x1400a1a80]
and qword [rsp + 0x20], 0
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
mov eax, dword [rsp + 0x68]
cmp ebx, 2
je 0x1400550a4
cmp eax, 1
ja 0x1400550a4
test ebx, ebx
jne 0x1400550b3
mov dword [rdi], eax
jmp 0x1400550b3
and dword [rdi], 0
xor ebx, ebx
mov rdx, rsi
xor ecx, ecx
call fcn.140055608
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400550c3
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400550d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x80
mov qword [rax - 0x10], rbp
mov rbp, rcx
mov qword [rax - 0x18], rsi
mov rsi, r8
mov qword [rax - 0x28], r12
mov qword [rax - 0x38], r15
xor r15d, r15d
mov qword [rax - 0x48], r15
mov qword [rax + 0x18], r15
mov qword [r8], r15
lea r12d, [r15 + 2]
test rdx, rdx
jne 0x14005512d
lea rdx, [rax - 0x48]
xor ecx, ecx
call fcn.14001447c
mov rdx, qword [rsp + 0x40]
test eax, eax
mov ebx, r15d
cmove ebx, r12d
test ebx, ebx
jne 0x14005527f
mov qword [rsp + 0x30], r15
lea r8, [0x14009d4e0]
mov qword [rsp + 0x28], rdx
lea r9, str.SessionDefaultDevices
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0xa0]
call fcn.14001334c
mov ebx, eax
test eax, eax
jne 0x14005527f
mov qword [rsp + 0x68], rdi
lea r8, [rsp + 0xa8]
mov qword [rsp + 0x58], r14
mov edx, 0x20019
mov r14, qword [rsp + 0xa0]
mov rcx, rbp
mov rdi, r15
mov dword [rsp + 0x98], 0x410
mov qword [rsp + 0xa8], r15
call fcn.140055428
mov ebx, eax
test eax, eax
jne 0x140055213
mov ecx, dword [rsp + 0x98]
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rdi, rax
test rax, rax
je 0x14005520e
mov rcx, qword [rsp + 0xa8]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
lea r8, str.Device
mov qword [rsp + 0x28], rdi
mov r9d, r12d
mov rdx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
cmp eax, 0xea
jne 0x140055213
mov rcx, qword [0x1400af198]
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0x1400551ab
mov ebx, 8
mov r14, qword [rsp + 0x58]
test ebx, ebx
mov r8, r15
cmovne r8, rdi
cmovne rdi, r15
test r8, r8
je 0x140055239
mov rcx, qword [0x1400af198]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x14005524c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
jne 0x140055263
mov rcx, rdi
call fcn.14005546c
mov ebx, eax
test eax, eax
jne 0x140055263
mov qword [rsi], rdi
jmp 0x14005527a
test rdi, rdi
je 0x14005527a
mov rcx, qword [0x1400af198]
mov r8, rdi
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov rdi, qword [rsp + 0x68]
mov r8, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
test r8, r8
je 0x1400552b2
mov rcx, qword [0x1400af198]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov qword [rsp + 0xa0], r15
mov rcx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
test rcx, rcx
je 0x1400552c7
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, ebx
add rsp, 0x80
pop rbx
ret
Function at 0x1400552d8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
and qword [r11 - 0x28], 0
mov rax, r8
and qword [r9], 0
lea r8, [r11 - 0x28]
mov rbp, rdx
mov dword [r11 + 0x20], 0x410
mov r14, rcx
mov edx, 0x20019
mov rcx, rax
mov rsi, r9
call fcn.140055428
mov edi, eax
test eax, eax
jne 0x1400553a8
mov ecx, dword [rsp + 0x88]
call sym.spoolsv.exe_PrvDllAllocSplMem
mov rbx, rax
test rax, rax
je 0x140055383
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov r9d, 2
mov qword [rsp + 0x28], rbx
mov r8, rbp
and qword [rsp + 0x20], 0
mov rdx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, eax
cmp eax, 0xea
jne 0x140055388
mov rcx, qword [0x1400af198]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0x140055323
mov edi, 8
test edi, edi
jne 0x140055391
mov qword [rsi], rbx
xor ebx, ebx
test rbx, rbx
je 0x1400553a8
mov rcx, qword [0x1400af198]
mov r8, rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400553b8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rbx, qword [rsp + 0x70]
mov eax, edi
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x140055508
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
mov rbp, rsp
sub rsp, 0x30
and qword [rbp + 0x28], 0
lea rcx, [rbp + 0x28]
mov rbx, rdx
call fcn.14001a430
and qword [rbp + 0x28], 0
lea rcx, [rbp + 0x20]
and qword [rbp + 0x20], 0
call fcn.14001a430
and qword [rbp + 0x20], 0
cmp dword [rbp + 0x10], 2
jb 0x140055552
mov ebx, 0x57
jmp 0x1400555d6
lea r8, [rbp + 0x28]
mov edx, 0x2001f
mov rcx, rbx
call fcn.140055428
mov ebx, eax
test eax, eax
jne 0x1400555d6
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400555d6
mov rcx, qword [rbp + 0x20]
lea r9d, [rax + 4]
lea rax, [rbp + 0x10]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LegacyDefaultPrinterMode
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x1400555d6
lea r9, str.Windows
xor r8d, r8d
lea edx, [rax + 0x1a]
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_SendNotifyMessageW]
mov ecx, dword [rbp + 0x10]
mov edx, ebx
call fcn.140053b88
lea rcx, [rbp + 0x20]
call fcn.14001a430
lea rcx, [rbp + 0x28]
call fcn.14001a430
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret
Function at 0x140055608
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1400ad768]
xor rax, rsp
mov qword [rbp + 0x47], rax
and qword [rbp - 0x19], 0
mov rbx, rdx
mov dword [rbp - 0x29], ecx
lea rcx, [rbp - 0x19]
call fcn.14001a430
and qword [rbp - 0x19], 0
lea rcx, [rbp - 0x21]
and qword [rbp - 0x21], 0
call fcn.14001a430
and qword [rbp - 0x21], 0
mov esi, 4
cmp dword [rbp - 0x29], 2
jb 0x140055669
lea ebx, [rsi + 0x53]
jmp 0x1400556cf
lea r8, [rbp - 0x19]
mov edx, 0x20006
mov rcx, rbx
call fcn.140055428
mov ebx, eax
test eax, eax
jne 0x1400556cf
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0x21]
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400556cf
mov rcx, qword [rbp - 0x21]
lea rax, [rbp - 0x29]
mov dword [rsp + 0x28], esi
lea rdx, [0x1400a1a80]
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
mov eax, dword [rbp - 0x29]
lea rdx, [0x140053b00]
mov dword [rbp - 0x11], eax
mov dword [rbp - 9], ebx
call fcn.1400545f8
mov rcx, qword [rax + 8]
cmp dword [rcx], 5
jbe 0x140055724
and dword [rbp + 0x33], 0
lea rax, [rbp - 0x11]
and dword [rbp + 0x43], 0
mov qword [rbp + 0x27], rax
lea rax, [rbp - 9]
mov qword [rbp + 0x37], rax
mov dword [rbp + 0x2f], esi
mov dword [rbp + 0x3f], esi
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
lea rdx, [0x14009cfaa]
mov dword [rsp + 0x20], esi
call fcn.140035cec
lea rcx, [rbp - 0x21]
call fcn.14001a430
lea rcx, [rbp - 0x19]
call fcn.14001a430
mov eax, ebx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14001aad0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret