joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023ce4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.140018ae4
lea r11, [rbx + 0x12d8]
mov esi, 4
lea rdx, str.Auto
xor r8d, r8d
mov rcx, rdi
mov r9d, esi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x12e0]
lea rdx, str.ModemComPortNumber
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x12e4]
lea rdx, str.FlowControl
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x12e8]
lea rdx, str.BaudRate
mov r9d, esi
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140023e94
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.14002d7b8
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x12e0]
lea rdx, str.NetworkMode
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x12e4]
mov qword [rsp + 0x28], rcx
lea rdx, str.NetworkAccessDescription
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rsp + 0x40], 0x206
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140023f24
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.140018ae4
lea r11, [rbx + 0x12d8]
lea rdx, str.Auto
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x12e0]
lea rdx, str.NetworkMode
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rbx, 0x12e4
mov rcx, rbx
call fcn.14005d25c
lea rdx, str.NetworkAccessDescription
mov r9d, 1
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400240c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.14002d7b8
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x12e0]
lea rdx, str.DefaultBusinessCard
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], 0x410
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x16f0]
mov qword [rsp + 0x28], rcx
lea rdx, str.InboxDirectory
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x1904]
lea rdx, str.AcceptBusinessCards
mov esi, 4
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x10], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x1900]
mov qword [rsp + 0x28], rcx
lea rdx, str.AcceptCalendarItems
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x18fc]
lea rdx, str.AcceptEmailMessages
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x18f8]
lea rdx, str.AcceptNotes
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x1908]
mov qword [rsp + 0x28], rcx
lea rdx, str.AcceptOther
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x190c]
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov dword [rbp + 0x10], esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SendBusinessCardOnRequest
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rbp + 0x10]
lea rax, [rbx + 0x1910]
mov qword [rsp + 0x28], rcx
lea rdx, str.AllowOpenReceivedFile
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rbp + 0x10], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x1400242b4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
call fcn.140018ae4
lea r11, [rdi + 0x12d8]
mov r12d, 4
lea rdx, str.Auto
xor r8d, r8d
mov rcx, rsi
mov r9d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rbx, [rdi + 0x12e0]
mov rcx, rbx
call fcn.14005d25c
lea r9d, [r12 - 3]
lea rdx, str.DefaultBusinessCard
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rbx, [rdi + 0x16f0]
mov rcx, rbx
call fcn.14005d25c
lea r9d, [r12 - 3]
lea rdx, str.InboxDirectory
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x1904]
lea rdx, str.AcceptBusinessCards
mov r9d, r12d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x1900]
lea rdx, str.AcceptCalendarItems
mov r9d, r12d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x18fc]
lea rdx, str.AcceptEmailMessages
mov r9d, r12d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x18f8]
lea rdx, str.AcceptNotes
mov r9d, r12d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x190c]
lea rdx, str.SendBusinessCardOnRequest
mov r9d, r12d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x1910]
mov dword [rsp + 0x28], r12d
mov r9d, r12d
xor r8d, r8d
lea rdx, str.AllowOpenReceivedFile
mov rcx, rsi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x1908]
lea rdx, str.AcceptOther
mov r9d, r12d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r12
ret

Function at 0x140024604
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.14002d7b8
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x12e0]
lea rdx, str.InboxDirectory
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140024664
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.140018ae4
lea r11, [rbx + 0x12d8]
mov r9d, 4
lea rdx, str.Auto
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rbx, 0x12e0
mov rcx, rbx
call fcn.14005d25c
lea rdx, str.InboxDirectory
mov r9d, 1
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400247c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.14002d7b8
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x12e0]
lea rdx, str.Root
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x14e8]
mov qword [rsp + 0x28], rcx
lea rdx, str.FlistFormat
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x14ec]
lea rdx, str.DenyHiddenAccess
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x14f0]
lea rdx, str.DenyReadOnlyAccess
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400248c4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
call fcn.140018ae4
lea r11, [rdi + 0x12d8]
mov ebp, 4
lea rdx, str.Auto
xor r8d, r8d
mov rcx, rsi
mov r9d, ebp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rbx, [rdi + 0x12e0]
mov rcx, rbx
call fcn.14005d25c
lea r9d, [rbp - 3]
lea rdx, str.Root
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x14ec]
lea rdx, str.DenyHiddenAccess
mov r9d, ebp
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x14f0]
lea rdx, str.DenyReadOnlyAccess
mov r9d, ebp
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140024ab4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.14002d7b8
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x12e0]
lea rdx, str.UserSinkApp
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x14ec]
mov qword [rsp + 0x28], rcx
lea rdx, str.DefaultAction
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x14e8]
lea rdx, str.WaitForRegisterTimeout
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x14f0]
lea rdx, str.VdpReconnect
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x14f4]
mov qword [rsp + 0x28], rcx
lea rdx, str.LastVdpSource
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rsp + 0x40], 6
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140024be4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
call fcn.140018ae4
lea r11, [rdi + 0x12d8]
mov ebp, 4
lea rdx, str.Auto
xor r8d, r8d
mov rcx, rsi
mov r9d, ebp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rbx, [rdi + 0x12e0]
mov rcx, rbx
call fcn.14005d25c
lea r9d, [rbp - 3]
lea rdx, str.UserSinkApp
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x14ec]
lea rdx, str.DefaultAction
mov r9d, ebp
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x14e8]
lea rdx, str.WaitForRegisterTimeout
mov r9d, ebp
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x14f0]
lea rdx, str.VdpReconnect
mov r9d, ebp
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x14f4]
lea r9d, [rbp - 1]
lea rdx, str.LastVdpSource
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 6
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140024f64
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.14002d7b8
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x12e0]
lea rdx, str.LocalStoreDirectory
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x14f4]
mov qword [rsp + 0x28], rcx
lea rdx, str.SyncBusinessCards
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x14f0]
lea rdx, str.SyncCalendarItems
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x14ec]
lea rdx, str.SyncEmailMessages
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x14e8]
mov qword [rsp + 0x28], rcx
lea rdx, str.SyncNotes
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140025094
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
call fcn.140018ae4
lea r11, [rdi + 0x12d8]
mov ebp, 4
lea rdx, str.Auto
xor r8d, r8d
mov rcx, rsi
mov r9d, ebp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rbx, [rdi + 0x12e0]
mov rcx, rbx
call fcn.14005d25c
lea r9d, [rbp - 3]
lea rdx, str.LocalStoreDirectory
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x14f4]
lea rdx, str.SyncBusinessCards
mov r9d, ebp
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x14f0]
lea rdx, str.SyncCalendarItems
mov r9d, ebp
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x14ec]
lea rdx, str.SyncEmailMessages
mov r9d, ebp
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x14e8]
lea rdx, str.SyncNotes
mov r9d, ebp
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400257e4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.14002d7b8
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x12e0]
lea rdx, str.PrinterName
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x14e8]
mov qword [rsp + 0x28], rcx
lea rdx, str.TempDirectory
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140025874
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
call fcn.140018ae4
lea r11, [rdi + 0x12d8]
mov r9d, 4
lea rdx, str.Auto
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rbx, [rdi + 0x12e0]
mov rcx, rbx
call fcn.14005d25c
lea rdx, str.PrinterName
mov r9d, 1
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rbx, [rdi + 0x14e8]
mov rcx, rbx
call fcn.14005d25c
lea rdx, str.TempDirectory
mov r9d, 1
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140025f24
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.14002d7b8
lea rcx, [rsp + 0x40]
lea rax, [rbx + 0x12e0]
lea rdx, str.ObexThrottleBytes
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140025f84
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.140018ae4
lea r11, [rbx + 0x12d8]
lea rdx, str.Auto
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rbx + 0x12e0]
lea rdx, str.ObexThrottleBytes
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140027984
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x1400d9180]
xor rax, rsp
mov qword [rsp + 0x270], rax
movzx edx, byte [rcx + 0x424]
movzx r8d, byte [rcx + 0x423]
movzx eax, byte [rcx + 0x425]
movzx r10d, byte [rcx + 0x422]
movzx r11d, byte [rcx + 0x421]
movzx r9d, byte [rcx + 0x420]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r8d
mov rdi, rcx
mov dword [rsp + 0x28], r10d
lea r8, str.SoftwareWIDCOMMBTConfigDevices
lea rdx, str._s_02x:_02x:_02x:_02x:_02x:_02x
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], r11d
call fcn.14002d41c
mov ebx, 0x20019
call fcn.140018004
test eax, eax
mov ecx, 0x20119
lea rax, [rsp + 0x58]
cmovne ebx, ecx
mov rcx, qword [rdi + 0x418]
lea rdx, [rsp + 0x60]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140027a80
lea rax, [rsp + 0x50]
lea rcx, [rdi + 0x838]
lea rdx, str.TrustedMaskUser
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], 8
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14005ba20
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret

Function at 0x140028bf4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
lea r8, [rcx + 0x210]
mov rcx, qword [rcx + 0x528]
mov rsi, rdx
mov edx, 0x104
add rcx, 0x210
call fcn.14005fbe4
mov rcx, qword [rdi + 0x528]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x20]
lea r11, [rdi + 0x420]
lea rdx, str.BDAddress
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 6
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x426]
lea rdx, str.BDDevClass
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rbx, [rdi + 0x429]
mov rcx, rbx
call fcn.14005bc90
lea rdx, str.BDName
mov r9d, 3
inc eax
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x524]
mov ebx, 4
lea rdx, str.DefaultConnection
xor r8d, r8d
mov rcx, rsi
mov r9d, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r11, [rdi + 0x530]
lea rdx, str.Flags
mov r9d, ebx
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140028d84
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x1400d9180]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.String
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140028e02
lea rcx, [rbx + 0x420]
mov edx, 0x104
lea r8, [rsp + 0x40]
cmp dword [rsp + 0x30], eax
jne 0x140028dfd
lea r8, [0x14009c390]
call fcn.14005fbe4
lea rcx, [rsp + 0x30]
lea rax, [rbx + 0x628]
lea rdx, str.ItemData
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x30]
lea rax, [rbx + 0x62c]
mov qword [rsp + 0x28], rcx
lea rdx, str.Notify
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14005ba20
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret