joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140279a08
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], r8
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, rdx
mov rax, qword [rsp + 0x60]
cmp byte [rax], 0
je 0x140279b4b
cmp byte [r9], 0
je 0x140279b4b
and qword [r11 + 8], 0
xor edx, edx
lea rcx, [r11 + 8]
call fcn.140032750
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionOOBEHealth
lea rcx, str.OOBEHealth
call fcn.14027f484
mov rcx, qword [rsp + 0x38]
test eax, eax
jns 0x140279a84
mov r9d, eax
lea r8, str.onecoreuapinternal_shellincOOBEHealthTracker.h
mov edx, 0x42f
call fcn.14009cb2c
jmp 0x140279b32
and qword [rsp + 0x50], 0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14006e14c
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x140279ad1
mov edx, 0x432
jmp 0x140279b0d
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
lea rdx, str.Census
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x140279b1c
mov edx, 0x435
mov r9d, eax
lea r8, str.onecoreuapinternal_shellincOOBEHealthTracker.h
call fcn.140195f4c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140279b32
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov byte [rbx], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140279b4b
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140279b6c
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], r8
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, rdx
mov rax, qword [rsp + 0x60]
cmp byte [rax], 0
je 0x140279caf
cmp byte [r9], 0
je 0x140279caf
and qword [r11 + 8], 0
xor edx, edx
lea rcx, [r11 + 8]
call fcn.140032750
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionOOBEHealth
lea rcx, str.OOBEHealth
call fcn.14027f484
mov rcx, qword [rsp + 0x38]
test eax, eax
jns 0x140279be8
mov r9d, eax
lea r8, str.onecoreuapinternal_shellincOOBEHealthTracker.h
mov edx, 0x42f
call fcn.14009cb2c
jmp 0x140279c96
and qword [rsp + 0x50], 0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14006e14c
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x140279c35
mov edx, 0x432
jmp 0x140279c71
mov dword [rsp + 0x28], SafeArrayDestroy
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
lea rdx, str.HealthEvaluation
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x140279c80
mov edx, 0x435
mov r9d, eax
lea r8, str.onecoreuapinternal_shellincOOBEHealthTracker.h
call fcn.140195f4c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140279c96
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov byte [rbx], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140279caf
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140279cd0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], r8
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, rdx
mov rax, qword [rsp + 0x60]
cmp byte [rax], 0
je 0x140279e13
cmp byte [r9], 0
je 0x140279e13
and qword [r11 + 8], 0
xor edx, edx
lea rcx, [r11 + 8]
call fcn.140032750
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionOOBEHealth
lea rcx, str.OOBEHealth
call fcn.14027f484
mov rcx, qword [rsp + 0x38]
test eax, eax
jns 0x140279d4c
mov r9d, eax
lea r8, str.onecoreuapinternal_shellincOOBEHealthTracker.h
mov edx, 0x42f
call fcn.14009cb2c
jmp 0x140279dfa
and qword [rsp + 0x50], 0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14006e14c
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x140279d99
mov edx, 0x432
jmp 0x140279dd5
mov dword [rsp + 0x28], reloc.SHELL32.dll_PathCleanupSpec
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
lea rdx, str.Health
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x140279de4
mov edx, 0x435
mov r9d, eax
lea r8, str.onecoreuapinternal_shellincOOBEHealthTracker.h
call fcn.140195f4c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140279dfa
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov byte [rbx], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140279e13
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14027dbe8
Capabilities:
Delete registry value

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x40
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov rbx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rcx, rbx
lea r8, str.TransitionCflScenario
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationCFLExperienceManagerData
call fcn.14007b130
cmp dword [rsp + 0x50], 0
lea r8, str.DefaultAccountAction
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionOOBE
mov rcx, rbx
je 0x14027dc59
mov r9d, 4
mov dword [rsp + 0x50], 2
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call fcn.14019c1d4
jmp 0x14027dc65
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
nop dword [rax + rax]
lea r8, str.LaunchCflScenario
mov rcx, rbx
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationCFLExperienceManagerData
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHDeleteValueW]
nop dword [rax + rax]
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x14027e790
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
and dword [rcx], 0
lea rax, [r11 + 8]
mov qword [r11 - 0x28], rax
lea rsi, str.ContentDeliveryAllowedOverride
lea rax, [r11 + 0x10]
mov dword [rsp + 0x60], 4
mov rdi, rcx
mov qword [r11 - 0x30], rax
and qword [r11 - 0x38], 0
lea rbp, str.SoftwareMicrosoftWindowsCurrentVersionContentDeliveryManagerDebug
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8, rsi
mov rdx, rbp
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14027e7fd
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x14027e83a
cmp ebx, 0x80070002
je 0x14027e840
mov rcx, qword [rsp + 0x58]
lea rax, str.RegKey:__ws__ws
mov qword [rsp + 0x30], rsi
lea r8, str.onecoreuap_shellcontentdeliverymanagerutilsincContentDeliveryManagerSettings.h
mov qword [rsp + 0x28], rbp
mov r9d, ebx
mov edx, 0x4f
mov qword [rsp + 0x20], rax
call fcn.1401c78e8
jmp 0x14027e842
mov eax, dword [rsp + 0x68]
mov dword [rdi], eax
xor ebx, ebx
test ebx, ebx
jns 0x14027e85f
mov rcx, qword [rsp + 0x58]
lea r8, str.onecoreuapinternal_shellincContentDeliveryManagerSettings.h
mov r9d, ebx
mov edx, 0x1b1
call fcn.14001e09c
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14027edc0
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x110
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, reloc.SHCORE.dll_Ordinal_200
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.SHELL32.dll_SHRestricted
lea rdx, [rsp + 0x30]
mov ecx, SafeArrayDestroy
call qword [sym.imp.SspiCli.dll_GetUserNameExW]
nop dword [rax + rax]
test al, al
je 0x14027ee4f
lea rdx, [0x14030ab44]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscspn]
nop dword [rax + rax]
lea r8, [rsp + 0x30]
mov edx, reloc.SHELL32.dll_SHRestricted
mov r9, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcsncpy_s]
nop dword [rax + rax]
mov al, 1
jmp 0x14027ee51
xor al, al
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400a15a0
add rsp, 0x110
pop rbx
ret

Function at 0x14027ef04
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0xe0
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rdx
lea rcx, [rsp + 0x50]
xor esi, esi
mov r8d, DAD_DragLeave
mov qword [rdx], rsi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], DAD_DragLeave
mov qword [rsp + 0x30], rax
lea r8, str.ImageIdentifier
lea rax, [rsp + 0x50]
mov r9d, 0x20000002
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionOOBE
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
lea rax, [rsp + 0x50]
or r9, 0xffffffffffffffff
inc r9
cmp word [rax + r9*2], si
jne 0x14027ef8e
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rbx
call fcn.140031f80
mov ebx, eax
test eax, eax
jns 0x14027efcd
mov rcx, qword [rsp + 0xe8]
lea r8, str.onecoreuapinternal_shellincOOBEHealthTracker.h
mov r9d, eax
mov edx, 0x462
call fcn.14001e09c
mov eax, ebx
jmp 0x14027efcf
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400a15a0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rsi
ret
Function at 0x14027eff8
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x378]
sub rsp, 0x470
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov rsi, rdx
mov edi, ecx
and qword [rdx], 0
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14000a6a4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x14033d238]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140345380]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x14027f07a
mov edx, 0x148
jmp 0x14027f13d
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ebx, 0x104
mov edx, ebx
lea rcx, [rbp + 0x150]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14027f0cb
lea r9, [0x14030cb68]
lea r8, [rbp + 0x150]
mov edx, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
nop dword [rax + rax]
test edi, edi
je 0x14027f111
cmp edi, 1
je 0x14027f0e3
mov ebx, 0x80070057
mov r9d, ebx
mov edx, 0x16d
jmp 0x14027f140
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, str.Microsoft.Windows.Explorer_RecentFiles
mov rax, qword [rax + 0x18]
call qword [case.0x14006b68f.0]
mov ebx, eax
test eax, eax
jns 0x14027f155
mov edx, 0x165
jmp 0x14027f13d
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, str.Microsoft.Windows.Explorer
mov rax, qword [rax + 0x18]
call qword [case.0x14006b68f.0]
mov ebx, eax
test eax, eax
jns 0x14027f155
mov edx, 0x169
mov r9d, eax
lea r8, str.onecoreuapinternal_shellincprivate_frequentplaceslist.h
mov rcx, qword [rbp + 0x378]
call fcn.14001e09c
jmp 0x14027f165
mov rax, qword [rsp + 0x30]
and qword [rsp + 0x30], 0
mov qword [rsi], rax
xor ebx, ebx
lea rcx, [rsp + 0x30]
call fcn.14000a6a4
mov eax, ebx
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.1400a15a0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14027fe58
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
and dword [rsp + 0x50], 0
lea rax, [r11 + 0x10]
mov qword [r11 - 0x18], rax
lea r8, str.MobileOS
lea rax, [r11 + 8]
mov dword [rsp + 0x58], 4
mov qword [r11 - 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionContentDeliveryManagerContextPhonePairing
and qword [r11 - 0x28], 0
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14027feb6
cmp dword [rsp + 0x50], 1
sete al
jmp 0x14027feb8
xor al, al
add rsp, 0x48
ret
Function at 0x14027ff54
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rsi
sub rsp, 0x20
and qword [rax + 8], 0
xor ebx, ebx
mov qword [rax + 0x10], rbx
xor edx, edx
lea rcx, [rax + 8]
call fcn.140070bd8
lea rdx, [rsp + 0x30]
call fcn.140070c20
test eax, eax
js 0x14027ffc0
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.14019dcac
lea rcx, [rsp + 0x38]
call fcn.1400207e0
mov rbx, qword [rsp + 0x38]
test eax, eax
js 0x14027ffc0
mov rdx, rbx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x14027ffc0
mov sil, 1
jmp 0x14027ffc3
xor sil, sil
test rbx, rbx
je 0x14027ffd8
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
nop
cmp qword [rsp + 0x30], 0
je 0x14027fff2
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
mov al, sil
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140295f64
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, r8
mov rsi, r9
lea r8, [rax - 0x10]
mov rbx, rdx
mov rdi, rcx
call qword [0x1403ad3c0]
nop dword [rax + rax]
test eax, eax
jne 0x14029602b
cmp dword [rsp + 0x48], eax
je 0x140295fca
and dword [rsp + 0x40], eax
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rdi
call qword [0x1403ad3c8]
nop dword [rax + rax]
test eax, eax
jne 0x14029602b
cmp dword [rsp + 0x40], eax
setle al
jmp 0x14029602d
and dword [rsp + 0x44], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x28], rax
mov r8, rsi
and qword [rsp + 0x20], 0
mov rdx, rbp
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14029602b
cmp dword [rsp + 0x40], 4
jne 0x14029602b
mov eax, dword [rsp + 0x80]
cmp dword [rsp + 0x44], eax
sete al
jmp 0x14029602d
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140296168
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x40
lea rax, [r11 + 8]
mov edi, 1
mov qword [r11 - 0x18], rax
lea r8, str.SystemProductName
and qword [r11 - 0x20], 0
lea rdx, str.HardwareDescriptionSystemBIOS
and qword [r11 - 0x28], 0
mov rcx, 0xffffffff80000002
lea r9d, [rdi + 1]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14029625c
mov ecx, dword [rsp + 0x50]
and qword [rsp + 0x58], 0
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140070bd8
mov rbx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r9d, [rdi + 1]
mov qword [rsp + 0x28], rbx
lea r8, str.SystemProductName
and qword [rsp + 0x20], 0
lea rdx, str.HardwareDescriptionSystemBIOS
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140296248
or edx, 0xffffffff
mov dword [rsp + 0x20], edi
mov rcx, rbx
lea r8, str.Surface_Go
mov r9d, edx
xor ebx, ebx
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
nop dword [rax + rax]
cmp eax, 2
jne 0x14029625c
xor dil, dil
test rbx, rbx
je 0x14029625c
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x60]
mov al, dil
add rsp, 0x40
pop rdi
ret
Function at 0x1402962ec
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rcx + 0x10], 0
mov rdi, rcx
je 0x1402964e4
mov rax, qword [rcx]
lea rcx, [0x1403459d8]
mov rdx, qword [rax]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
jne 0x1402964e4
mov rcx, qword [rdi + 0x10]
lea r9d, [rax + 2]
lea r8d, [rax + 0xc]
lea rdx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAclInformation]
nop dword [rax + rax]
test eax, eax
je 0x1402964e4
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x40]
mov ebx, dword [rsp + 0x54]
mov r9d, 1
lea r8d, [r9 + 3]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAclInformation]
nop dword [rax + rax]
mov rcx, qword [rdi]
mov r14d, 2
test eax, eax
cmovne r14d, dword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov r15d, eax
mov eax, 0xffff
lea esi, [r15 + 8]
add ebx, esi
cmp esi, eax
ja 0x1402964e4
cmp ebx, eax
ja 0x1402964e4
lea r8d, [rsi + rbx]
lea r9, [rsp + 0x48]
call fcn.14008ef3c
test eax, eax
js 0x1402964e4
mov rbp, qword [rsp + 0x48]
mov r8d, r14d
mov rcx, rbp
mov edx, ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeAcl]
nop dword [rax + rax]
add rbx, rbp
mov r8d, r15d
mov byte [rbx], 1
lea rcx, [rbx + 8]
mov word [rbx + 2], si
mov dword [rbx + 4], 2
mov rdx, qword [rdi]
mov rdx, qword [rdx]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
or r15d, 0xffffffff
mov dword [rsp + 0x20], esi
mov r8d, r15d
mov r9, rbx
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAce]
nop dword [rax + rax]
test eax, eax
je 0x1402964d5
xor esi, esi
xor ebx, ebx
cmp dword [rsp + 0x50], ebx
jbe 0x1402964a7
mov rcx, qword [rdi + 0x10]
lea r8, [rsp + 0x48]
mov edx, ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetAce]
nop dword [rax + rax]
test eax, eax
je 0x140296496
mov r9, qword [rsp + 0x48]
mov r8d, r15d
mov edx, r14d
mov rcx, rbp
movzx eax, word [r9 + 2]
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAce]
nop dword [rax + rax]
test eax, eax
mov eax, 1
cmove esi, eax
jmp 0x14029649b
mov eax, 1
add ebx, eax
cmp ebx, dword [rsp + 0x50]
jb 0x14029644c
test esi, esi
jne 0x1402964d5
and qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, qword [rdi + 8]
mov r8d, 0x20000004
mov qword [rsp + 0x28], rbp
and qword [rsp + 0x20], 0
lea edx, [r9 + 4]
call qword [0x1403ad2a8]
nop dword [rax + rax]
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a15a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140298708
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x40
mov edi, r8d
mov rbx, rdx
mov byte [r9], 0
mov rax, qword [rsp + 0x70]
mov byte [rax], 1
and qword [r11 + 0x28], 0
xor edx, edx
lea rcx, [r11 + 0x28]
call fcn.140032750
lea r8, [rsp + 0x70]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionOOBEHealth
lea rcx, str.OOBEHealth
call fcn.14027f484
mov rcx, qword [rsp + 0x48]
test eax, eax
jns 0x140298771
mov r9d, eax
lea r8, str.onecoreuapinternal_shellincOOBEHealthTracker.h
mov edx, 0x418
call fcn.14009cb2c
jmp 0x1402987c6
lea eax, [rdi + 4]
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
and qword [rsp + 0x20], 0
mov r9d, 8
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x1402987c0
cmp dword [rsp + 0x50], 4
jbe 0x1402987c0
cmp byte [rbx], 0xe
je 0x1402987c6
and dword [rbx], 0
mov byte [rbx], SafeArrayDestroy
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1402987dc
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1402987fc
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rbp + 0x170], rax
and qword [rsp + 0x48], 0
mov rsi, rdx
and qword [rsp + 0x50], 0
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
and qword [rsp + 0x58], 0
lea rcx, [rsp + 0x48]
mov r9d, 0x2001f
call fcn.140297e78
jmp 0x14029885e
lea rdx, [rsp + 0x70]
call fcn.1402987fc
mov ebx, eax
test eax, eax
jne 0x1402988c0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x70]
and qword [rsp + 0x28], 0
xor edx, edx
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
lea rcx, [rsp + 0x48]
test eax, eax
je 0x140298854
call fcn.14027cd60
mov rdx, rsi
mov rcx, rdi
call fcn.14027d34c
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.14027cd60
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400a15a0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret

Function at 0x1402988f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
sub rsp, 0x48
and qword [r9], 0
lea rax, [r11 + 0x18]
mov qword [r11 - 0x18], rax
lea r8, str.Timestamp
mov ecx, 8
mov qword [r11 - 0x20], r9
and qword [r11 - 0x28], 0
mov r9d, ecx
mov dword [rsp + 0x60], ecx
mov rcx, 0xffffffff80000001
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jle 0x14029894a
movzx eax, ax
or eax, 0x80070000
add rsp, 0x48
ret