joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ac20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400a9080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000ac4d
xor eax, eax
jmp 0x14000ad9b
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000ac87
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14000ac87
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14000ad9b
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000ad8e
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000acca
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000acd9
movsx ecx, dil
jmp 0x14000ad2d
lea r8, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x41]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
je 0x14000ad47
sub eax, 1
je 0x14000ad47
cmp eax, 2
jne 0x14000ad8e
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call fcn.140014888
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000ad93
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14000ad74
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.140015174
cmp rsi, rax
jne 0x14000ad8e
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14000ad93
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000d440
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000b830
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x14000b852
xor eax, eax
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
je 0x14000b8e6
mov rdi, rbp
mov qword [rsp + 0x50], r15
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000b8b3
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x14000b8b3
cmp rdi, rcx
mov r15, rdi
cmovge r15, rcx
mov rcx, r14
mov r8, r15
call fcn.14002b8e0
mov rax, qword [rsi]
sub rdi, r15
sub dword [rax], r15d
mov rcx, qword [rbx + 0x38]
movsxd rax, r15d
add qword [rcx], rax
jmp 0x14000b8d1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14000b8d9
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov r15d, 1
add r14, r15
test rdi, rdi
jg 0x14000b873
mov r15, qword [rsp + 0x50]
sub rbp, rdi
jmp 0x14000b9cf
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000b8fd
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000b8ff
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000b931
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.14002b8e0
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000b9cc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000b96c
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x14000b9ad
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.140014c0c
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x14000b9cc
cmp rsi, rax
ja 0x14000b980
test rsi, rsi
je 0x14000b9cc
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140014c0c
sub rsi, rax
sub rbp, rsi
mov rsi, qword [rsp + 0x40]
mov rax, rbp
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x14000bab0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov r15, rdx
mov rbx, rcx
je 0x14000bb51
mov rdi, r8
test r8, r8
jle 0x14000bb49
lea rsi, [rcx + 0x58]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000bb23
mov rax, qword [rsi]
movsxd rdx, dword [rax]
test edx, edx
jle 0x14000bb23
cmp rdi, rdx
mov rbp, rdi
cmovge rbp, rdx
mov rdx, r15
mov r8, rbp
call fcn.14002b8e0
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x40]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000bb41
mov rax, qword [rbx]
mov rcx, rbx
movzx edx, byte [r15]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000bb49
dec rdi
lea rsi, [rbx + 0x58]
mov ebp, 1
add r15, rbp
test rdi, rdi
jg 0x14000bae4
sub r14, rdi
mov rax, r14
jmp 0x14000bbc8
mov rax, qword [rcx + 0x40]
mov rsi, r14
mov r9, qword [rax]
test r9, r9
je 0x14000bb68
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000bb6a
xor ecx, ecx
movsxd rdi, ecx
test r14, r14
jle 0x14000bbc2
test ecx, ecx
jle 0x14000bba3
cmp r14, rdi
mov rcx, r9
cmovl rdi, r14
mov r8, rdi
call fcn.14002b8e0
mov rax, qword [rbx + 0x58]
add r15, rdi
sub r14, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x40]
movsxd rax, edi
add qword [rcx], rax
test r14, r14
jle 0x14000bbc2
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x14000bbc2
mov r8, r14
mov edx, 1
mov rcx, r15
call fcn.140015174
sub r14, rax
sub rsi, r14
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14000db6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000dbb6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000dbb6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000dbb6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000dbb6
cmp dword [rcx + 0x84], 0xe
jbe 0x14000dbb6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000dbb8
xor al, al
add rsp, 0x28
ret
Function at 0x1400135b8
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14001344b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001344b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001344b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001344b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001344b
cmp dword [rcx + 0x84], 0xe
jbe 0x14001344b
cmp dword [rcx + 0xf8], 0
je 0x14001344b
mov ecx, ebx
call fcn.1400134ec
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400132dc
cmp dword [rbp + 0x20], 0
je 0x140013498
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400134a0
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400133e4

Function at 0x14002b560
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002b588
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002b588
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001000
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x140003008]
xor rax, rsp
mov qword [rbp + 0x100], rax
xor eax, eax
lea rcx, [rbp - 0x40]
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
mov r13, rdx
mov qword [rsp + 0x58], rax
xor edx, edx
mov qword [rsp + 0x60], rax
mov r8d, 0x140
mov qword [rsp + 0x40], rax
movups xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x48], rax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
call sub.VCRUNTIME140.dll_memset
lea rcx, str.samlib.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.ntdll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.SamConnect
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SamOpenDomain
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SamCreateUser2InDomain
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SamSetInformationUser
mov rcx, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SamQuerySecurityObject
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlInitUnicodeString
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [r13 + 8]
lea rcx, [rbp - 0x80]
mov rbx, rax
call rbx
mov rdx, qword [r13 + 0x10]
lea rcx, [rsp + 0x68]
call rbx
xor r9d, r9d
lea rdx, [rsp + 0x50]
xor ecx, ecx
lea r8d, [r9 + 0x21]
call rsi
lea r9, [rsp + 0x40]
mov r8d, 1
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov edx, 5
call qword [sym.imp.ADVAPI32.dll_LsaQueryInformationPolicy]
mov r8, qword [rsp + 0x48]
lea r9, [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov edx, 0x211
mov r8, qword [r8 + 0x10]
call r14
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x80]
lea rax, [rsp + 0x7c]
mov r9d, 0xf07ff
mov qword [rsp + 0x28], rax
mov r8d, 0x10
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call r15
mov rdx, qword [rsp + 0x70]
lea rcx, [rbp + 0xa0]
call rbx
mov rcx, qword [rsp + 0x60]
lea r8, [rbp - 0x40]
or dword [rbp + 0xdc], 0x1000000
mov edx, 0x15
mov byte [rbp + 0xf9], 1
call r12
xor eax, eax
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.140001220
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400050b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x60
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, r8
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov r14, rdx
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
lea rcx, [0x140028c50]
mov r8d, 0x208
test eax, eax
jne 0x14000523a
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x38], r8d
call fcn.140007440
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbp
call qword [0x140028e70]
mov r9d, 0xc0
mov qword [rsp + 0x28], rbx
mov r8, r14
mov dword [rsp + 0x20], 0xc4
lea rdx, [0x140028c56]
lea rcx, str._ws_ws_n_c_c__ws___
call fcn.140001010
xor edi, edi
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x140005171
test rax, rax
je 0x140005202
mov qword [rsp + 0x98], rsi
mov rcx, rdi
mov qword [rsp + 0x50], r15
lea r15, [0x140027a70]
nop word [rax + rax]
lea rsi, [rbx + rcx*2]
mov edx, 0x80
movzx ecx, word [rsi]
call fcn.14000a8d8
test eax, eax
je 0x1400051db
call fcn.1400082b8
cdqe
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [r15 + rcx*2], 0
jne 0x1400051c3
xor edx, edx
div rcx
movzx eax, word [r15 + rdx*2]
mov word [rsi], ax
inc edi
mov rax, 0xffffffffffffffff
mov ecx, edi
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400051e6
cmp rcx, rax
jb 0x1400051a0
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov eax, dword [rsp + 0x30]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, rbx
lea rcx, str._ws_n_n
call fcn.140001010
mov rdi, qword [rsp + 0x58]
jmp 0x140005282
mov dword [rsp + 0x3c], 0x208
call fcn.140007440
lea rax, [rsp + 0x3c]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbp
call qword [0x140028e70]
mov r8, r14
lea rdx, [0x140028c56]
lea rcx, str.Failed_to_read:__ws_ws_n_n
call fcn.140001010
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140006220
add rsp, 0x60
pop r14
pop rbp
pop rbx
ret
Function at 0x1400052a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
mov eax, 0x2050
call fcn.140019820
sub rsp, rax
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x2040], rax
lea rax, [rsp + 0x30]
xor ebx, ebx
mov r9d, 0xf003f
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
test eax, eax
je 0x140005355
mov r8d, 0x208
mov dword [rsp + 0x38], 0x208
lea rcx, [0x140028c50]
call fcn.140007440
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
lea edx, [rbx + 3]
mov rcx, 0xffffffff80000002
call qword [0x140028e70]
lea r8, str.SYSTEMCurrentControlSetControlSystemInformation
lea rdx, [0x140028c56]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x14000553b
mov qword [rsp + 0x2060], rsi
lea rcx, [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
mov r8d, 0x1ffe
call fcn.140007440
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x1ffe
mov qword [rsp + 0x28], rax
lea rdx, str.ComputerHardwareIds
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400054cf
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x140005435
mov qword [rsp + 0x2068], rdi
mov qword [rsp + 0x2070], r14
lea r14, [0x140027a70]
nop
mov eax, ebx
lea rdi, [rsp + 0x40]
movzx ecx, word [rdi + rax*2]
lea rdi, [rdi + rax*2]
mov edx, 0x80
call fcn.14000a8d8
test eax, eax
je 0x14000541b
call fcn.1400082b8
cdqe
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x140005400
dec rcx
xor edx, edx
div rcx
movzx eax, word [r14 + rdx*2]
mov word [rdi], ax
mov eax, dword [rsp + 0x38]
inc ebx
cmp ebx, eax
jb 0x1400053d0
mov r14, qword [rsp + 0x2070]
mov rdi, qword [rsp + 0x2068]
mov dword [rsp + 0x28], eax
lea rdx, str.ComputerHardwareIds
lea rax, [rsp + 0x40]
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
mov dword [rsp + 0x3c], 0x208
mov r8d, 0x208
lea rcx, [0x140028c50]
call fcn.140007440
lea rax, [rsp + 0x3c]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x140028e70]
mov eax, dword [rsp + 0x38]
lea r8, str.ComputerHardwareIds
mov dword [rsp + 0x28], eax
lea rdx, [0x140028c56]
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
lea rcx, str._ws_ws_n_c_c_multi_string_of_length__d_n_n
call fcn.140001010
jmp 0x14000552a
xor edx, edx
mov dword [rsp + 0x3c], 0x208
mov r8d, 0x208
lea rcx, [0x140028c50]
call fcn.140007440
lea rax, [rsp + 0x3c]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x140028e70]
lea r8, str.ComputerHardwareIds
lea rdx, [0x140028c56]
lea rcx, str.Failed_to_read:__ws_ws_n_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x2060]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140006220
add rsp, 0x2050
pop rbx
ret
Function at 0x140005560
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r8
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
xor r8d, r8d
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
mov rsi, rdx
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140005602
xor edx, edx
mov dword [rsp + 0x38], 0x208
mov r8d, 0x208
lea rcx, [0x140028c50]
call fcn.140007440
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x140028e70]
mov r8, rsi
lea rdx, [0x140028c56]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x1400056f4
mov rbx, qword [rsp + 0x30]
call fcn.1400082b8
mov dword [rsp + 0x40], eax
call fcn.1400082b8
mov dword [rsp + 0x44], eax
mov r9d, 0xb
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 8
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
mov dword [rsp + 0x38], 0x208
lea rcx, [0x140028c50]
mov r8d, 0x208
test eax, eax
jne 0x1400056ab
call fcn.140007440
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x140028e70]
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
mov r8, rdi
lea rdx, [0x140028c56]
lea rcx, str._ws_ws_n_c_c_qword_n_n
call fcn.140001010
jmp 0x1400056eb
call fcn.140007440
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x140028e70]
mov r8, rdi
lea rdx, [0x140028c56]
lea rcx, str.Failed_to_write:__ws_ws_n_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140006220
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005710
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, r8
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov r9d, 0xf003f
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400057b2
xor edx, edx
mov dword [rsp + 0x38], 0x208
mov r8d, 0x208
lea rcx, [0x140028c50]
call fcn.140007440
lea rax, [rsp + 0x38]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
lea edx, [rbx + 3]
mov rcx, rdi
call qword [0x140028e70]
mov r8, rsi
lea rdx, [0x140028c56]
lea rcx, str.Failed_to_open_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140005926
mov rsi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov rcx, rsi
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov dword [rsp + 0x38], ebx
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000583c
xor edx, edx
mov dword [rsp + 0x3c], 0x208
mov r8d, 0x208
lea rcx, [0x140028c50]
call fcn.140007440
lea rax, [rsp + 0x3c]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x140028e70]
mov r8, rbp
lea rdx, [0x140028c56]
lea rcx, str.Failed_to_query_size_of:__ws_ws_n_n
call fcn.140001010
jmp 0x14000591d
mov ecx, dword [rsp + 0x38]
call fcn.14000a958
mov rdi, rax
test rax, rax
jne 0x14000585e
lea rcx, str.Failed_to_allocate_buffer_for_SpoofBinary_n_n
call fcn.140001010
jmp 0x14000591d
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x14000588a
call fcn.1400082b8
and eax, 0x800000ff
jge 0x14000587b
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov eax, dword [rsp + 0x38]
cmp ebx, eax
jb 0x140005866
mov dword [rsp + 0x28], eax
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14000a944
xor edx, edx
mov dword [rsp + 0x3c], 0x208
mov r8d, 0x208
lea rcx, [0x140028c50]
call fcn.140007440
lea rax, [rsp + 0x3c]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rsi
call qword [0x140028e70]
mov eax, dword [rsp + 0x38]
lea rdx, [0x140028c56]
mov dword [rsp + 0x28], eax
lea rcx, str._ws_ws_n_c_c_binary_of_length__d_n_n
mov r9d, 0xc0
mov dword [rsp + 0x20], 0xc4
mov r8, rbp
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140006220
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005950
Capabilities:
Delete registry key

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov qword [rsp + 0x50], 0
mov rdi, rdx
lea r8, [rsp + 0x50]
mov rdx, rsi
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp eax, 0x3fd
jne 0x1400059cc
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140005a2c
xor edx, edx
mov dword [rsp + 0x58], 0x208
mov r8d, 0x208
lea rcx, [0x140028c50]
call fcn.140007440
lea rax, [rsp + 0x58]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x140028e70]
mov r8, rsi
lea rdx, [0x140028c56]
lea rcx, str.Failed_to_create_key:__ws_ws_n_n
call fcn.140001010
jmp 0x140005b59
mov r8, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCopyTreeW]
test eax, eax
jne 0x140005af7
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor edx, edx
mov dword [rsp + 0x58], 0x208
lea rcx, [0x140028c50]
mov r8d, 0x208
test eax, eax
jne 0x140005ac4
call fcn.140007440
lea rax, [rsp + 0x58]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x140028e70]
mov r9d, 0xc0
mov qword [rsp + 0x28], rsi
mov r8, rdi
mov dword [rsp + 0x20], 0xc4
lea rdx, [0x140028c56]
lea rcx, str._ws_ws_n_c_c_renamed_to__ws_n_n
call fcn.140001010
jmp 0x140005b4e
call fcn.140007440
lea rax, [rsp + 0x58]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x140028e70]
lea rcx, str.Failed_to_delete_key:__ws_ws_n_n
jmp 0x140005b3f
xor edx, edx
mov dword [rsp + 0x58], 0x208
mov r8d, 0x208
lea rcx, [0x140028c50]
call fcn.140007440
lea rax, [rsp + 0x58]
mov r9d, 0x208
lea r8, [0x140028c50]
mov qword [rsp + 0x20], rax
mov edx, 3
mov rcx, rbx
call qword [0x140028e70]
lea rcx, str.Failed_to_copy_key:__ws_ws_n_n
mov r8, rdi
lea rdx, [0x140028c56]
call fcn.140001010
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140006220
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret