joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400107b0
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x4c0
movaps xmmword [rsp + 0x4b0], xmm6
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
movaps xmm6, xmmword [r8]
mov rbx, rdx
mov edi, dword [rsp + 0x508]
mov rsi, rcx
mov r8d, edi
movaps xmmword [rsp + 0x80], xmm6
call fcn.14000bcd0
mov r9d, edi
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x140010843
mov eax, dword [rsp + 0x510]
mov r8d, dword [rsp + 0x500]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], 0x384
mov qword [rsp + 0x20], rax
movdqa xmmword [rsp + 0x80], xmm6
call fcn.14000be10
test eax, eax
setne al
jmp 0x140010976
lea r8, [rsp + 0x90]
call fcn.1400100e0
test al, al
je 0x140010974
xor edx, edx
mov qword [rsp + 0x4e0], rbp
mov r8d, 0x400
lea rcx, [rsp + 0xa0]
call fcn.14001cd80
movzx r9d, byte [rsp + 0x8c]
mov edx, 0x400
movzx eax, byte [rsp + 0x8f]
movzx ecx, byte [rsp + 0x8e]
movzx r8d, byte [rsp + 0x8d]
movzx r10d, byte [rsp + 0x8b]
movzx r11d, byte [rsp + 0x8a]
movzx ebx, byte [rsp + 0x89]
movzx edi, byte [rsp + 0x88]
movzx esi, word [rsp + 0x86]
movzx ebp, word [rsp + 0x84]
mov dword [rsp + 0x70], 0x384
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x58], r8d
lea r8, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X__d
mov dword [rsp + 0x50], r9d
mov r9d, dword [rsp + 0x80]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call fcn.140002050
mov rbx, qword [rsp + 0x90]
lea rax, [rsp + 0x500]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbp, qword [rsp + 0x4e0]
mov rcx, rbx
test eax, eax
jne 0x14001096e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140010976
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.140019840
movaps xmm6, xmmword [rsp + 0x4b0]
add rsp, 0x4c0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400109a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x3c8]
sub rsp, 0x4c8
movaps xmmword [rsp + 0x4b0], xmm6
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
movaps xmm6, xmmword [r8]
mov r12d, r9d
mov edi, dword [rbp + 0x428]
mov rbx, rdx
mov r15, qword [rbp + 0x420]
mov r8d, edi
movaps xmmword [rbp - 0x80], xmm6
mov rsi, rcx
call fcn.14000bcd0
mov r9d, edi
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x140010a33
mov eax, dword [rbp + 0x430]
mov r8, r15
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x80]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
movdqa xmmword [rbp - 0x80], xmm6
call fcn.14000c0d0
test eax, eax
setne al
jmp 0x140010b34
lea r8, [rbp - 0x70]
mov dword [rbp - 0x68], 4
call fcn.1400100e0
test al, al
je 0x140010b32
xor edx, edx
mov qword [rsp + 0x4c0], r14
mov r8d, 0x400
lea rcx, [rbp - 0x60]
call fcn.14001cd80
movzx r9d, byte [rbp - 0x74]
mov edx, 0x400
movzx eax, byte [rbp - 0x71]
movzx ecx, byte [rbp - 0x72]
movzx r8d, byte [rbp - 0x73]
movzx r10d, byte [rbp - 0x75]
movzx r11d, byte [rbp - 0x76]
movzx ebx, byte [rbp - 0x77]
movzx edi, byte [rbp - 0x78]
movzx esi, word [rbp - 0x7a]
movzx r14d, word [rbp - 0x7c]
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
lea rcx, [rbp - 0x60]
mov dword [rsp + 0x58], r8d
lea r8, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X__d
mov dword [rsp + 0x50], r9d
mov r9d, dword [rbp - 0x80]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
call fcn.140002050
mov rbx, qword [rbp - 0x70]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x64]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14, qword [rsp + 0x4c0]
test eax, eax
jne 0x140010b29
test r15, r15
je 0x140010b1c
mov eax, dword [rbp - 0x64]
mov dword [r15], eax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140010b34
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140019840
movaps xmm6, xmmword [rsp + 0x4b0]
add rsp, 0x4c8
pop r15
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140010b60
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r8d
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rsi, rcx
call fcn.14000bcd0
mov r9d, edi
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x140010bd1
movups xmm0, xmmword [0x14005b028]
mov r8d, dword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.14000be10
test eax, eax
setne al
jmp 0x140010c28
lea r8, [rsp + 0x40]
call fcn.1400100e0
test al, al
je 0x140010c26
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_2
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
test eax, eax
jne 0x140010c20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140010c28
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140019840
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x140010c40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rbp, rcx
call fcn.14000bcd0
mov r9d, edi
mov rdx, rbx
mov rcx, rbp
test eax, eax
je 0x140010cb1
movups xmm0, xmmword [0x14005b028]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 2
mov r8, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.14000c0d0
test eax, eax
setne al
jmp 0x140010d15
lea r8, [rsp + 0x40]
mov dword [rsp + 0x50], 4
call fcn.1400100e0
test al, al
je 0x140010d13
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_2
lea rax, [rsp + 0x54]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
jne 0x140010d0d
mov eax, dword [rsp + 0x54]
mov dword [rsi], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140010d15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140019840
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140010d40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rbp, rcx
call fcn.14000bcd0
mov r9d, edi
mov rdx, rbx
mov rcx, rbp
test eax, eax
je 0x140010db1
movups xmm0, xmmword [0x14005b018]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x66
mov r8, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.14000c0d0
test eax, eax
setne al
jmp 0x140010e15
lea r8, [rsp + 0x40]
mov dword [rsp + 0x50], 4
call fcn.1400100e0
test al, al
je 0x140010e13
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_102
lea rax, [rsp + 0x54]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
jne 0x140010e0d
mov eax, dword [rsp + 0x54]
mov dword [rsi], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140010e15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140019840
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x140010e40
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r8d
mov rbx, rdx
xor r8d, r8d
mov rdi, rcx
call fcn.14000bcd0
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
test eax, eax
je 0x140010eb0
movups xmm0, xmmword [0x14005b018]
mov r8d, dword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.14000be10
test eax, eax
setne al
jmp 0x140010f07
lea r8, [rsp + 0x40]
call fcn.1400100e0
test al, al
je 0x140010f05
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_2
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
test eax, eax
jne 0x140010eff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140010f07
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140019840
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140010f20
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r8d
mov rbx, rdx
xor r8d, r8d
mov rdi, rcx
call fcn.14000bcd0
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
test eax, eax
je 0x140010f90
movups xmm0, xmmword [0x14005b018]
mov r8d, dword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0xca
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.14000be10
test eax, eax
setne al
jmp 0x140010fe7
lea r8, [rsp + 0x40]
call fcn.1400100e0
test al, al
je 0x140010fe5
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_202
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
test eax, eax
jne 0x140010fdf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140010fe7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140019840
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x140011000
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, r8
mov rbx, rdx
xor r8d, r8d
mov rsi, rcx
call fcn.14000bcd0
xor r9d, r9d
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x140011071
movups xmm0, xmmword [0x14005b018]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 2
mov r8, rdi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.14000c0d0
test eax, eax
setne al
jmp 0x1400110d5
lea r8, [rsp + 0x40]
mov dword [rsp + 0x50], 4
call fcn.1400100e0
test al, al
je 0x1400110d3
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_2
lea rax, [rsp + 0x54]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
jne 0x1400110cd
mov eax, dword [rsp + 0x54]
mov dword [rdi], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1400110d5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140019840
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x140011100
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r8d
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rsi, rcx
call fcn.14000bcd0
mov r9d, edi
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x140011171
movups xmm0, xmmword [0x14005b028]
mov r8d, dword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 7
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.14000be10
test eax, eax
setne al
jmp 0x1400111c8
lea r8, [rsp + 0x40]
call fcn.1400100e0
test al, al
je 0x1400111c6
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
test eax, eax
jne 0x1400111c0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1400111c8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140019840
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400111e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rbp, rcx
call fcn.14000bcd0
mov r9d, edi
mov rdx, rbx
mov rcx, rbp
test eax, eax
je 0x140011251
movups xmm0, xmmword [0x14005b028]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 7
mov r8, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.14000c0d0
test eax, eax
setne al
jmp 0x1400112b5
lea r8, [rsp + 0x40]
mov dword [rsp + 0x50], 4
call fcn.1400100e0
test al, al
je 0x1400112b3
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_7
lea rax, [rsp + 0x54]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
jne 0x1400112ad
mov eax, dword [rsp + 0x54]
mov dword [rsi], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1400112b5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140019840
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400112e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rbp, rcx
call fcn.14000bcd0
mov r9d, edi
mov rdx, rbx
mov rcx, rbp
test eax, eax
je 0x140011351
movups xmm0, xmmword [0x14005b018]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x6b
mov r8, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.14000c0d0
test eax, eax
setne al
jmp 0x1400113b5
lea r8, [rsp + 0x40]
mov dword [rsp + 0x50], 4
call fcn.1400100e0
test al, al
je 0x1400113b3
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_107
lea rax, [rsp + 0x54]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
jne 0x1400113ad
mov eax, dword [rsp + 0x54]
mov dword [rsi], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1400113b5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140019840
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400113e0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r8d
mov rbx, rdx
mov r8d, 1
mov rdi, rcx
call fcn.14000bcd0
mov r9d, 1
mov rdx, rbx
mov rcx, rdi
test eax, eax
je 0x140011453
movups xmm0, xmmword [0x14005b018]
mov r8d, dword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x28], 7
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.14000be10
test eax, eax
setne al
jmp 0x1400114aa
lea r8, [rsp + 0x40]
call fcn.1400100e0
test al, al
je 0x1400114a8
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.BE73ED5B_FC1C_4875_AC4F_833FFF79CDAA_7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
test eax, eax
jne 0x1400114a2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1400114aa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140019840
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1400114d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rdi, r8
mov qword [rsp + 0x30], 0
test r9d, r9d
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender
mov rbx, rdx
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioCapture
mov rsi, rcx
cmovne r8, rax
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140031158
lea r8, [0x14005d4c0]
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.1400310d4
mov r8, rbx
lea rcx, [rsp + 0x40]
mov edx, 0x200
call fcn.1400310d4
lea r8, str.Properties
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.1400310d4
lea rax, [rsp + 0x30]
mov r9d, 0x2001b
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001159d
mov rax, qword [rsp + 0x30]
mov qword [rdi], rax
mov al, 1
jmp 0x1400115d2
test byte [rsi + 0x290], 1
je 0x1400115d0
mov r9d, eax
lea r8, str.Cannot_Open_EndpointProperty_Key__x_r_n
mov edx, 0x400
lea rcx, [rsp + 0x440]
call fcn.140002050
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140019840
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140011600
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov rdi, r9
mov rbx, r8
mov rsi, rcx
test r9, r9
je 0x140011703
test rbx, rbx
je 0x140011703
lea rax, [rsp + 0x30]
mov r9d, 0x2001b
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400116db
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400116a8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140011716
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov r9, rbx
lea r8, str.SetRegByKeyName:__s__s_Reg_Set_fail_err_x_n
mov qword [rsp + 0x20], rdi
mov edx, 1
mov rcx, rsi
call fcn.14000e0f0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140011714
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov r9, rbx
lea r8, str.SetRegByKeyName:__s__s_Reg_Open_fail_err_x_n
mov qword [rsp + 0x20], rdi
mov edx, 1
mov rcx, rsi
call fcn.14000e0f0
jmp 0x140011714
lea r8, str.SetRegByKeyName:_ValueName_or_SubkeyName_empty_n
mov edx, 1
call fcn.14000e0f0
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140019840
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140011740
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x90]
mov rdi, r9
mov qword [rsp + 0x30], 0
mov rbx, r8
mov dword [rsp + 0x38], 4
mov rsi, rcx
test r9, r9
je 0x140011853
test rbx, rbx
je 0x140011853
test rbp, rbp
je 0x140011853
lea rax, [rsp + 0x30]
mov r9d, 0x2001b
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001182b
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400117f8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140011866
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov r9, rbx
lea r8, str.GetRegByKeyName:__s__s_Reg_Get_fail_err_x_n
mov qword [rsp + 0x20], rdi
mov edx, 1
mov rcx, rsi
call fcn.14000e0f0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140011864
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov r9, rbx
lea r8, str.GetRegByKeyName:__s__s_Reg_Open_fail_err_x_n
mov qword [rsp + 0x20], rdi
mov edx, 1
mov rcx, rsi
call fcn.14000e0f0
jmp 0x140011864
lea r8, str.GetRegByKeyName:_ValueName_or_SubkeyName_or_pRetValue_empty_n
mov edx, 1
call fcn.14000e0f0
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140019840
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140011880
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, qword [rsp + 0x480]
lea rcx, [rsp + 0x40]
mov rbx, r8
xor edx, edx
mov r8d, 0x400
mov rsi, r9
call fcn.14001cd80
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x200
mov r9d, 0x2001b
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140011969
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001195e
test rdi, rdi
je 0x14001194c
movsxd rdx, dword [rsp + 0x488]
lea r9, [rsp + 0x40]
add rdx, rdx
lea r8, [0x14005b1b8]
mov rcx, rdi
call fcn.140002050
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x14001196b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140019840
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret