joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019b30
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov qword [rsp + 0x30], 0
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test r9d, r9d
jne 0x140019b74
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioCapture
jmp 0x140019b85
cmp r9d, 1
jne 0x140019c3a
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.14003c608
lea r8, [0x14006a5f0]
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.14003c584
mov r8, rsi
lea rcx, [rsp + 0x40]
mov edx, 0x200
call fcn.14003c584
lea r8, str.FxProperties
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.14003c584
lea rax, [rsp + 0x30]
mov r9d, 0x2001b
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140019c07
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
mov al, 1
jmp 0x140019c3c
test byte [rdi + 0x298], 1
je 0x140019c3a
mov r9d, eax
lea r8, str.Cannot_Open_FxProperty_Key__x_r_n
mov edx, 0x400
lea rcx, [rsp + 0x440]
call fcn.140002050
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140024cf0
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140019c70
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r8d
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rsi, rcx
call fcn.140015180
mov r9d, edi
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x140019ce1
movups xmm0, xmmword [0x140068080]
mov r8d, dword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x384
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.1400152c0
test eax, eax
setne al
jmp 0x140019d38
lea r8, [rsp + 0x40]
call fcn.140019b30
test al, al
je 0x140019d36
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_900
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
test eax, eax
jne 0x140019d30
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140019d38
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024cf0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x140019d50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rbp, rcx
call fcn.140015180
mov r9d, edi
mov rdx, rbx
mov rcx, rbp
test eax, eax
je 0x140019dc1
movups xmm0, xmmword [0x140068080]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x384
mov r8, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.140015580
test eax, eax
setne al
jmp 0x140019e25
lea r8, [rsp + 0x40]
mov dword [rsp + 0x50], 4
call fcn.140019b30
test al, al
je 0x140019e23
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_900
lea rax, [rsp + 0x54]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
jne 0x140019e1d
mov eax, dword [rsp + 0x54]
mov dword [rsi], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140019e25
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140019e50
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x4c8
movaps xmmword [rsp + 0x4b0], xmm6
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
movaps xmm6, xmmword [r8]
mov r14d, r9d
mov edi, dword [rsp + 0x518]
mov rbx, rdx
mov r8d, edi
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rcx
call fcn.140015180
mov r9d, edi
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x140019ee2
mov r8d, dword [rsp + 0x510]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
movdqa xmmword [rsp + 0x80], xmm6
call fcn.1400152c0
test eax, eax
setne al
jmp 0x14001a012
lea r8, [rsp + 0x90]
call fcn.140019b30
test al, al
je 0x14001a010
xor edx, edx
mov qword [rsp + 0x4c0], rbp
mov r8d, 0x400
lea rcx, [rsp + 0xa0]
call fcn.140028230
movzx r9d, byte [rsp + 0x8c]
mov edx, 0x400
movzx eax, byte [rsp + 0x8f]
movzx ecx, byte [rsp + 0x8e]
movzx r8d, byte [rsp + 0x8d]
movzx r10d, byte [rsp + 0x8b]
movzx r11d, byte [rsp + 0x8a]
movzx ebx, byte [rsp + 0x89]
movzx edi, byte [rsp + 0x88]
movzx esi, word [rsp + 0x86]
movzx ebp, word [rsp + 0x84]
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x58], r8d
lea r8, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X__d
mov dword [rsp + 0x50], r9d
mov r9d, dword [rsp + 0x80]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call fcn.140002050
mov rbx, qword [rsp + 0x90]
lea rax, [rsp + 0x510]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbp, qword [rsp + 0x4c0]
mov rcx, rbx
test eax, eax
jne 0x14001a00a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001a012
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.140024cf0
movaps xmm6, xmmword [rsp + 0x4b0]
add rsp, 0x4c8
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001a040
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x3c8]
sub rsp, 0x4c8
movaps xmmword [rsp + 0x4b0], xmm6
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
movaps xmm6, xmmword [r8]
mov r12d, r9d
mov edi, dword [rbp + 0x428]
mov rbx, rdx
mov r15, qword [rbp + 0x420]
mov r8d, edi
movaps xmmword [rbp - 0x80], xmm6
mov rsi, rcx
call fcn.140015180
mov r9d, edi
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x14001a0d1
mov dword [rsp + 0x30], 1
lea rax, [rbp - 0x80]
mov dword [rsp + 0x28], r12d
mov r8, r15
mov qword [rsp + 0x20], rax
movdqa xmmword [rbp - 0x80], xmm6
call fcn.140015580
test eax, eax
setne al
jmp 0x14001a1d2
lea r8, [rbp - 0x70]
mov dword [rbp - 0x68], 4
call fcn.140019b30
test al, al
je 0x14001a1d0
xor edx, edx
mov qword [rsp + 0x4c0], r14
mov r8d, 0x400
lea rcx, [rbp - 0x60]
call fcn.140028230
movzx r9d, byte [rbp - 0x74]
mov edx, 0x400
movzx eax, byte [rbp - 0x71]
movzx ecx, byte [rbp - 0x72]
movzx r8d, byte [rbp - 0x73]
movzx r10d, byte [rbp - 0x75]
movzx r11d, byte [rbp - 0x76]
movzx ebx, byte [rbp - 0x77]
movzx edi, byte [rbp - 0x78]
movzx esi, word [rbp - 0x7a]
movzx r14d, word [rbp - 0x7c]
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
lea rcx, [rbp - 0x60]
mov dword [rsp + 0x58], r8d
lea r8, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X__d
mov dword [rsp + 0x50], r9d
mov r9d, dword [rbp - 0x80]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
call fcn.140002050
mov rbx, qword [rbp - 0x70]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x64]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14, qword [rsp + 0x4c0]
test eax, eax
jne 0x14001a1c7
test r15, r15
je 0x14001a1ba
mov eax, dword [rbp - 0x64]
mov dword [r15], eax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001a1d2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140024cf0
movaps xmm6, xmmword [rsp + 0x4b0]
add rsp, 0x4c8
pop r15
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001a200
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x4c8
movaps xmmword [rsp + 0x4b0], xmm6
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
movaps xmm6, xmmword [r8]
mov r14d, r9d
mov edi, dword [rsp + 0x518]
mov rbx, rdx
mov r8d, edi
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rcx
call fcn.140015180
mov r9d, edi
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x14001a295
mov eax, dword [rsp + 0x520]
mov r8d, dword [rsp + 0x510]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
movdqa xmmword [rsp + 0x80], xmm6
call fcn.1400152c0
test eax, eax
setne al
jmp 0x14001a3c5
lea r8, [rsp + 0x90]
call fcn.140019b30
test al, al
je 0x14001a3c3
xor edx, edx
mov qword [rsp + 0x4c0], rbp
mov r8d, 0x400
lea rcx, [rsp + 0xa0]
call fcn.140028230
movzx r9d, byte [rsp + 0x8c]
mov edx, 0x400
movzx eax, byte [rsp + 0x8f]
movzx ecx, byte [rsp + 0x8e]
movzx r8d, byte [rsp + 0x8d]
movzx r10d, byte [rsp + 0x8b]
movzx r11d, byte [rsp + 0x8a]
movzx ebx, byte [rsp + 0x89]
movzx edi, byte [rsp + 0x88]
movzx esi, word [rsp + 0x86]
movzx ebp, word [rsp + 0x84]
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x58], r8d
lea r8, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X__d
mov dword [rsp + 0x50], r9d
mov r9d, dword [rsp + 0x80]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call fcn.140002050
mov rbx, qword [rsp + 0x90]
lea rax, [rsp + 0x510]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbp, qword [rsp + 0x4c0]
mov rcx, rbx
test eax, eax
jne 0x14001a3bd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001a3c5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.140024cf0
movaps xmm6, xmmword [rsp + 0x4b0]
add rsp, 0x4c8
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001a3f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x3c8]
sub rsp, 0x4c8
movaps xmmword [rsp + 0x4b0], xmm6
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
movaps xmm6, xmmword [r8]
mov r12d, r9d
mov edi, dword [rbp + 0x428]
mov rbx, rdx
mov r15, qword [rbp + 0x420]
mov r8d, edi
movaps xmmword [rbp - 0x80], xmm6
mov rsi, rcx
call fcn.140015180
mov r9d, edi
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x14001a483
mov eax, dword [rbp + 0x430]
mov r8, r15
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x80]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
movdqa xmmword [rbp - 0x80], xmm6
call fcn.140015580
test eax, eax
setne al
jmp 0x14001a584
lea r8, [rbp - 0x70]
mov dword [rbp - 0x68], 4
call fcn.140019b30
test al, al
je 0x14001a582
xor edx, edx
mov qword [rsp + 0x4c0], r14
mov r8d, 0x400
lea rcx, [rbp - 0x60]
call fcn.140028230
movzx r9d, byte [rbp - 0x74]
mov edx, 0x400
movzx eax, byte [rbp - 0x71]
movzx ecx, byte [rbp - 0x72]
movzx r8d, byte [rbp - 0x73]
movzx r10d, byte [rbp - 0x75]
movzx r11d, byte [rbp - 0x76]
movzx ebx, byte [rbp - 0x77]
movzx edi, byte [rbp - 0x78]
movzx esi, word [rbp - 0x7a]
movzx r14d, word [rbp - 0x7c]
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
lea rcx, [rbp - 0x60]
mov dword [rsp + 0x58], r8d
lea r8, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X__d
mov dword [rsp + 0x50], r9d
mov r9d, dword [rbp - 0x80]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
call fcn.140002050
mov rbx, qword [rbp - 0x70]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x64]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14, qword [rsp + 0x4c0]
test eax, eax
jne 0x14001a579
test r15, r15
je 0x14001a56c
mov eax, dword [rbp - 0x64]
mov dword [r15], eax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001a584
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140024cf0
movaps xmm6, xmmword [rsp + 0x4b0]
add rsp, 0x4c8
pop r15
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001a5b0
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r8d
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rsi, rcx
call fcn.140015180
mov r9d, edi
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x14001a621
movups xmm0, xmmword [0x140068080]
mov r8d, dword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.1400152c0
test eax, eax
setne al
jmp 0x14001a678
lea r8, [rsp + 0x40]
call fcn.140019b30
test al, al
je 0x14001a676
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_2
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
test eax, eax
jne 0x14001a670
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001a678
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024cf0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001a690
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rbp, rcx
call fcn.140015180
mov r9d, edi
mov rdx, rbx
mov rcx, rbp
test eax, eax
je 0x14001a701
movups xmm0, xmmword [0x140068080]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 2
mov r8, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.140015580
test eax, eax
setne al
jmp 0x14001a765
lea r8, [rsp + 0x40]
mov dword [rsp + 0x50], 4
call fcn.140019b30
test al, al
je 0x14001a763
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_2
lea rax, [rsp + 0x54]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
jne 0x14001a75d
mov eax, dword [rsp + 0x54]
mov dword [rsi], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001a765
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001a790
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rbp, rcx
call fcn.140015180
mov r9d, edi
mov rdx, rbx
mov rcx, rbp
test eax, eax
je 0x14001a801
movups xmm0, xmmword [0x140068070]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x66
mov r8, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.140015580
test eax, eax
setne al
jmp 0x14001a865
lea r8, [rsp + 0x40]
mov dword [rsp + 0x50], 4
call fcn.140019b30
test al, al
je 0x14001a863
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_102
lea rax, [rsp + 0x54]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
jne 0x14001a85d
mov eax, dword [rsp + 0x54]
mov dword [rsi], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001a865
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001a890
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r8d
mov rbx, rdx
xor r8d, r8d
mov rdi, rcx
call fcn.140015180
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
test eax, eax
je 0x14001a900
movups xmm0, xmmword [0x140068070]
mov r8d, dword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.1400152c0
test eax, eax
setne al
jmp 0x14001a957
lea r8, [rsp + 0x40]
call fcn.140019b30
test al, al
je 0x14001a955
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_2
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
test eax, eax
jne 0x14001a94f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001a957
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14001a970
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r8d
mov rbx, rdx
xor r8d, r8d
mov rdi, rcx
call fcn.140015180
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
test eax, eax
je 0x14001a9e0
movups xmm0, xmmword [0x140068070]
mov r8d, dword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0xca
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.1400152c0
test eax, eax
setne al
jmp 0x14001aa37
lea r8, [rsp + 0x40]
call fcn.140019b30
test al, al
je 0x14001aa35
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_202
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
test eax, eax
jne 0x14001aa2f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001aa37
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x14001aa50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, r8
mov rbx, rdx
xor r8d, r8d
mov rsi, rcx
call fcn.140015180
xor r9d, r9d
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x14001aac1
movups xmm0, xmmword [0x140068070]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 2
mov r8, rdi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.140015580
test eax, eax
setne al
jmp 0x14001ab25
lea r8, [rsp + 0x40]
mov dword [rsp + 0x50], 4
call fcn.140019b30
test al, al
je 0x14001ab23
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_2
lea rax, [rsp + 0x54]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
jne 0x14001ab1d
mov eax, dword [rsp + 0x54]
mov dword [rdi], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001ab25
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x14001ab50
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r8d
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rsi, rcx
call fcn.140015180
mov r9d, edi
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x14001abc1
movups xmm0, xmmword [0x140068080]
mov r8d, dword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 7
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.1400152c0
test eax, eax
setne al
jmp 0x14001ac18
lea r8, [rsp + 0x40]
call fcn.140019b30
test al, al
je 0x14001ac16
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
test eax, eax
jne 0x14001ac10
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001ac18
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024cf0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001ac30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14007d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rbp, rcx
call fcn.140015180
mov r9d, edi
mov rdx, rbx
mov rcx, rbp
test eax, eax
je 0x14001aca1
movups xmm0, xmmword [0x140068080]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 7
mov r8, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.140015580
test eax, eax
setne al
jmp 0x14001ad05
lea r8, [rsp + 0x40]
mov dword [rsp + 0x50], 4
call fcn.140019b30
test al, al
je 0x14001ad03
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_7
lea rax, [rsp + 0x54]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
jne 0x14001acfd
mov eax, dword [rsp + 0x54]
mov dword [rsi], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001ad05
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140024cf0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret