joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a260
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0xa8
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
lea rdx, str.ShowTDRMessage
call fcn.1400512d4
test rax, rax
je 0x14003a401
mov qword [rsp + 0xc0], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
test rax, rax
je 0x14003a3e3
lea rcx, str.AMD_FAULT_EVENT_NOTIFIED
mov qword [rsp + 0xb8], rbp
call qword [sym.imp.USER32.dll_RegisterWindowMessageA]
cmp dword [rsp + 0x20], 0
mov ebp, eax
jle 0x14003a3db
mov qword [rsp + 0xb0], rbx
mov ebx, 0xffffffff
mov qword [rsp + 0xc8], rdi
mov rdi, rsi
mov qword [rsp + 0xa0], r14
lea r14, [0x140000000]
nop word [rax + rax]
mov rdx, qword [rdi]
lea rcx, [rsp + 0x30]
mov r8d, 0x64
call fcn.14007702c
cmp rax, 0xffffffffffffffff
je 0x14003a3b6
cmp ebx, 5
ja case.default.0x14003a334
movsxd rax, ebx
mov ecx, dword [r14 + rax*4 + 0x3a40c]
add rcx, r14
jmp rcx
xor r9d, r9d
lea r8d, [r9 + 6]
jmp 0x14003a3a3
lea rcx, [rsp + 0x30]
call fcn.14005e414
mov r8d, 1
jmp 0x14003a3a0
lea rcx, [rsp + 0x30]
call fcn.14005e414
mov r8d, 2
jmp 0x14003a3a0
lea rcx, [rsp + 0x30]
call fcn.14005e414
mov r8d, 3
jmp 0x14003a3a0
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x10]
call fcn.140078b28
mov r9d, eax
mov r8d, 4
jmp 0x14003a3a3
lea rcx, [rsp + 0x30]
call fcn.14005e414
mov r8d, 5
movsxd r9, eax
mov edx, ebp
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_PostMessageA]
inc ebx
add rdi, 8
lea eax, [rbx + 1]
cmp eax, dword [rsp + 0x20]
jl 0x14003a300
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0xc0]
mov eax, 1
add rsp, 0xa8
ret
add rsp, 0xa8
ret
Function at 0x14003a950
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
cmp dword [rcx + 0x10], 0
je 0x14003ab60
call fcn.14000c470
test eax, eax
je 0x14003ab60
lea rax, [rbp + 0x27]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAMDSmartDCSmartDCList
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14003ab60
mov rcx, qword [rbp + 0x27]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x80], r14
xor r9d, r9d
xor r14d, r14d
xor r8d, r8d
mov qword [rsp + 0x58], r14
xor edx, edx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x14003ab58
cmp dword [rbp + 0x77], r14d
jbe 0x14003ab58
mov eax, dword [rbp + 0x6f]
inc dword [rbp + 0x67]
inc eax
mov ecx, eax
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x90], rsi
mov dword [rbp + 0x6f], eax
call fcn.140078544
mov ecx, dword [rbp + 0x67]
mov rbx, rax
call fcn.140078544
mov rsi, rax
test rbx, rbx
je 0x14003ab48
test rax, rax
je 0x14003ab40
mov qword [rsp + 0x88], rdi
mov edi, dword [rbp + 0x77]
mov ecx, dword [rbp + 0x6f]
xor edx, edx
mov eax, dword [rbp + 0x67]
mov r8d, ecx
mov dword [rbp + 0x17], ecx
dec edi
mov rcx, rbx
mov dword [rbp + 0x7f], eax
call fcn.1400514f0
mov r8d, dword [rbp + 0x67]
xor edx, edx
mov rcx, rsi
call fcn.1400514f0
mov rcx, qword [rbp + 0x27]
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x17]
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov qword [rsp + 0x28], r14
mov edx, edi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x14003ab28
lea r8, [rbp + 0x1f]
mov edx, 0xffffffff
xor ecx, ecx
call fcn.140043b70
test eax, eax
je 0x14003ab28
mov eax, dword [rbp + 0x7f]
test eax, eax
je 0x14003aaef
cmp byte [rsi], r14b
je 0x14003aaef
mov rcx, qword [rbp + 0x1f]
lea rdx, str.SOFTWAREMicrosoftDirectXUserGpuPreferences
mov dword [rsp + 0x28], eax
mov r9d, 2
mov r8, rbx
mov qword [rsp + 0x20], rsi
call fcn.1400442e0
jmp 0x14003ab02
mov rcx, qword [rbp + 0x1f]
lea rdx, str.SOFTWAREMicrosoftDirectXUserGpuPreferences
mov r8, rbx
call fcn.140043940
mov r8, rbx
lea rdx, str.SOFTWAREAMDSmartDCSmartDCList
mov rcx, 0xffffffff80000002
call fcn.140043940
lea r8, [rbp + 0x1f]
mov edx, 0xffffffff
xor ecx, ecx
call fcn.140043550
test edi, edi
jne 0x14003aa53
mov rcx, rsi
call fcn.140078530
mov rdi, qword [rsp + 0x88]
mov rcx, rbx
call fcn.140078530
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
mov r14, qword [rsp + 0x80]
add rsp, 0xa0
pop rbp
ret
Function at 0x1400401e0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x130
xor edi, edi
mov dword [rcx + 0x114], edx
lea rax, vtable.LogMsg.0
mov qword [rcx + 0x10c], rdi
mov qword [rcx], rax
lea rdx, [r11 + 0x10]
mov qword [rcx + 0x118], rdi
mov rbx, rcx
lea rcx, str.LogOutputDebug
mov dword [r11 + 0x10], edi
mov r14, r9
mov rbp, r8
call fcn.140043d40
test eax, eax
je 0x140040247
cmp dword [rsp + 0x158], edi
je 0x140040247
or dword [rbx + 0x10c], 1
lea rdx, [rsp + 0x158]
lea rcx, str.LogOutputFile
call fcn.140043d40
test eax, eax
je 0x14004026f
cmp dword [rsp + 0x158], edi
je 0x14004026f
or dword [rbx + 0x10c], 4
lea rdx, [rsp + 0x158]
lea rcx, str.LogOutputEtw
call fcn.140043d40
test eax, eax
je 0x1400402b8
cmp dword [rsp + 0x158], edi
je 0x1400402b8
or dword [rbx + 0x10c], 8
lea r9, [0x1400d9220]
lea r8, [0x1400d9220]
lea rdx, [0x140040800]
lea rcx, [0x1400b5080]
call fcn.140040910
lea rdx, [rsp + 0x158]
lea rcx, str.LogMaskLevel
call fcn.140043d40
test eax, eax
je 0x1400402e1
mov eax, dword [rsp + 0x158]
test eax, eax
je 0x1400402e1
mov dword [rbx + 0x110], eax
mov rdx, rbp
lea rcx, [rbx + 8]
call fcn.140003f20
test byte [rbx + 0x10c], 4
je 0x14004033f
lea r9, [rbx + 8]
mov r8, r14
lea rdx, str._s_s.txt
lea rcx, [rsp + 0x20]
call fcn.140003f20
lea rdx, [0x1400b5124]
lea rcx, [rsp + 0x20]
call fcn.1400777ac
mov qword [rbx + 0x118], rax
test rax, rax
jne 0x14004033f
lea rcx, str.fopen_failed.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
and dword [rbx + 0x10c], 0xfffffffb
cmp qword [0x1400e06c8], rdi
jne 0x140040369
mov ecx, 0x2e0
call fcn.14004ff3c
test rax, rax
je 0x140040362
mov rcx, rax
call fcn.140047f20
mov rdi, rax
mov qword [0x1400e06c8], rdi
lea r11, [rsp + 0x130]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400405d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x460
test byte [rcx + 0x10c], 0xd
mov rdi, r9
mov ebp, r8d
mov rbx, rcx
je 0x140040738
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x470], rsi
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0x3c]
lea rcx, [rsp + 0x260]
movzx eax, word [rsp + 0x3e]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rdx, str._02d:_02d:_02d:_03d
call fcn.140003f20
test ebp, ebp
je 0x14004066f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea r9, [rsp + 0x260]
lea r8, [rbx + 8]
mov qword [rsp + 0x20], rdi
lea rdx, str._s__t_s__s_GetLastError___x_r_n
lea rcx, [rsp + 0x60]
call fcn.140003f20
jmp 0x140040691
lea r9, [rsp + 0x260]
mov qword [rsp + 0x20], rdi
lea r8, [rbx + 8]
lea rdx, str._s__t_s__s_r_n
lea rcx, [rsp + 0x60]
call fcn.140003f20
test byte [rbx + 0x10c], 1
mov rsi, qword [rsp + 0x470]
je 0x1400406ad
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [rbx + 0x10c], 4
je 0x1400406d3
mov rcx, qword [rbx + 0x118]
lea rdx, [rsp + 0x60]
call fcn.140040ab0
mov rcx, qword [rbx + 0x118]
call fcn.14007d228
test byte [rbx + 0x10c], 8
je 0x140040738
test byte [0x1400e06c0], 1
je 0x140040738
lea rcx, [rsp + 0x60]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400406f1
inc eax
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rcx
mov r9d, 2
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x1400b50a0]
lea rcx, [0x1400d9220]
call fcn.140040950
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140042370
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub rsp, 0x2e8
xorps xmm1, xmm1
mov dword [rsp + 0x70], 0x68
xor eax, eax
lea rcx, [rsp + 0xe0]
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
xor edx, edx
mov dword [rsp + 0xd4], eax
mov r8d, 0x200
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x74], xmm1
movups xmmword [rsp + 0x84], xmm1
movups xmmword [rsp + 0x94], xmm1
movups xmmword [rsp + 0xa4], xmm1
movups xmmword [rsp + 0xb4], xmm1
movups xmmword [rsp + 0xc4], xmm1
call fcn.1400514f0
mov edx, 0x200
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140042519
lea rax, [rsp + 0xe0]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x140042404
lea rax, [rcx + 0x2f]
cmp rax, 0x200
jae 0x140042519
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x2e0], rbx
add rcx, rax
lea r9, str.GlobalAti_VariBrightMonitorEvent
lea r8, str.atibtmon.exe
lea rdx, str._s__s
call fcn.140003f20
xor ebx, ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor ecx, ecx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400424bd
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x1400424ad
lea r8, str.VBMonitorProcessStart:_Failed_to_create_VariBright_Monitor_Process
mov edx, 0x2000
call fcn.140040530
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2e8
ret
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400424d2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400424e7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x50], rbx
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x1400424ad
mov r9d, dword [rsp + 0x60]
lea r8, str.VBMonitorProcessStart:_VariBright_Monitor_Process__ProcessID__lu__created
mov edx, 0x2000
call fcn.140040750
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2e8
ret
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x1400424b5
lea r9, str.VBMonitorProcessStart:_Failed_to_retreive_VBMonitor_Full_Name
xor r8d, r8d
mov edx, 0x60004004
call fcn.140040490
add rsp, 0x2e8
ret
Function at 0x140043890
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x20], rax
mov r9d, 0x10000
xor r8d, r8d
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400438ec
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x1400438df
mov r9d, eax
lea r8, str.DeleteRegKey_RegOpenKeyEx_failed_with_error_code_0x_08x.
lea edx, [rbx + 7]
call fcn.140040530
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x140043924
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x140043922
mov r9, rdi
mov dword [rsp + 0x20], eax
lea r8, str.DeleteRegKey_RegDeleteKey_failed_for_pcPath___s_with_error_code_0x_08x.
mov edx, 8
call fcn.140040530
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140043940
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov rdi, r8
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov dword [rsp + 0x20], 0
mov rsi, rdx
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1400439ca
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x1400439b8
mov r9, rsi
mov dword [rsp + 0x20], eax
lea r8, str.DeleteRegValue_RegCreateKeyEx_failed_for_pcPath___s_with_error_code_0x_08x.
lea edx, [rbx + 7]
call fcn.140040530
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x140043a02
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x140043a00
mov r9, rdi
mov dword [rsp + 0x20], eax
lea r8, str.DeleteRegValue_RegDeleteValue_failed_for_value___s_with_error_code_0x_08x.
mov edx, 8
call fcn.140040530
xor ebx, ebx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140043a20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, r9
mov qword [rsp + 0x48], 0
mov rdi, r8
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rsi, rdx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x140043ae9
mov rcx, qword [rsp + 0x48]
mov r9d, 0xffff
mov dword [rsp + 0x44], eax
mov r8, rdi
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x200
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov rdx, qword [rsp + 0x80]
mov ebx, eax
mov ecx, dword [rsp + 0x40]
mov dword [rdx], ecx
test eax, eax
je 0x140043adc
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x140043adc
mov r9, rdi
mov dword [rsp + 0x20], eax
lea r8, str.GetMultiSzRegValue:_RegGetValue_failed_for_lpValueName___s_with_error_code_0x_08x.
mov edx, 8
call fcn.140040530
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140043b0d
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x140043b0d
mov r9, rsi
mov dword [rsp + 0x20], ebx
lea r8, str.GetMultiSzRegValue:_RegOpenKeyEx_failed_for_lpKeyPath___s_with_error_code_0x_08x.
mov edx, 8
call fcn.140040530
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140043b70
Capabilities:
Check for sandbox username or hostname
Get session information
Get session user name
Impersonate user

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rdi, r8
mov ebx, edx
test ecx, ecx
je 0x140043bdc
mov rdx, r8
mov ecx, 0x2001f
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x140043bc9
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x140043c54
lea r8, str.GetProfileRootHandle_RegOpenCurrentUser_failed_with_error_code_0x_08x.
mov r9d, eax
mov edx, 8
call fcn.140040530
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
xorps xmm0, xmm0
mov dword [rsp + 0x80], 0
xor eax, eax
lea r9, [rsp + 0x38]
xor ecx, ecx
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x30], 0x38
lea r8d, [rcx + 5]
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
jne 0x140043c64
cmp qword [0x1400da5d8], 0
je 0x140043c54
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400da5d8]
lea r8, str.GetProfileRootHandle_WTSQuerySessionInformation_failed_with_error_code_0x_08x.
mov r9d, eax
mov edx, 8
call fcn.140040530
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
lea rdx, [rsp + 0x98]
mov ecx, ebx
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x140043cbc
cmp qword [0x1400da5d8], 0
je 0x140043ca2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400da5d8]
lea r8, str.GetProfileRootHandle_WTSQueryUserToken_failed_with_error_code_0x_08x.
mov r9d, eax
mov edx, 8
call fcn.140040530
mov rcx, qword [rsp + 0x38]
call sub.WTSAPI32.dll_WTSFreeMemory
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0x30]
mov ebx, 1
call qword [sym.imp.USERENV.dll_LoadUserProfileA]
test eax, eax
jne 0x140043d03
cmp qword [0x1400da5d8], 0
je 0x140043d01
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400da5d8]
lea r8, str.OpenProfilePathKey_LoadUserProfile_failed_with_error_code_0x_08x.
mov r9d, eax
lea edx, [rbx + 7]
call fcn.140040530
xor ebx, ebx
mov rcx, qword [rsp + 0x60]
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140043d40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov dword [rsp + 0x60], 4
mov rdi, rcx
lea rax, [rsp + 0x68]
lea rdx, str.SoftwareAMDEEU
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov r9d, 0x20019
xor r8d, r8d
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140043dc5
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x140043db3
lea r9, str.SoftwareAMDEEU
mov dword [rsp + 0x20], eax
lea r8, str.ReadRegKey_RegOpenKeyEx_failed_for_pcPath___s_with_error_code_0x_08x.
lea edx, [rbx + 7]
call fcn.140040530
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov r9d, 0x10
mov qword [rsp + 0x28], rsi
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x140043e25
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x140043e23
mov dword [rsp + 0x28], eax
lea r8, str.ReadRegKey_RegGetValue_failed_for_value___s_and_ulSize___d_with_error_code_0x_08x.
mov eax, dword [rsp + 0x60]
mov r9, rdi
mov edx, 8
mov dword [rsp + 0x20], eax
call fcn.140040530
xor ebx, ebx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140043e50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, r8
mov rsi, rdx
mov edi, 1
test r9d, r9d
je 0x140043e9c
sub r9d, edi
je 0x140043e95
sub r9d, edi
je 0x140043e8e
cmp r9d, edi
je 0x140043e87
mov ebx, edi
jmp 0x140043ea1
mov ebx, 0x20
jmp 0x140043ea1
mov ebx, 2
jmp 0x140043ea1
mov ebx, 8
jmp 0x140043ea1
mov ebx, 0x10
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140043ee6
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x140043ee2
mov r9, rsi
mov dword [rsp + 0x20], eax
lea r8, str.ReadRegKey_RegOpenKeyEx_failed_for_pcPath___s_with_error_code_0x_08x.
mov edx, 8
call fcn.140040530
xor eax, eax
jmp 0x140043f65
mov rax, qword [rsp + 0x80]
mov r9d, ebx
mov rsi, qword [rsp + 0x88]
mov r8, rbp
mov rcx, qword [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov edx, eax
test eax, eax
je 0x140043f58
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x140043f56
mov eax, 0xffffffff
test rsi, rsi
je 0x140043f3a
mov eax, dword [rsi]
mov dword [rsp + 0x28], edx
lea r8, str.ReadRegKey_RegGetValue_failed_for_value___s_and_ulSize___d_with_error_code_0x_08x.
mov edx, 8
mov dword [rsp + 0x20], eax
mov r9, rbp
call fcn.140040530
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140043f80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, r9
lea rax, [rsp + 0x40]
mov rsi, r8
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, rdx
mov edi, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140043fe5
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x140043fe1
mov r9, rbx
mov dword [rsp + 0x20], eax
lea r8, str.ReadUCODEStringRegKey_RegOpenKeyEx_failed_for_pcPath___s_with_error_code_0x_08x.
lea edx, [rdi + 7]
call fcn.140040530
xor eax, eax
jmp 0x14004405f
mov rbx, qword [rsp + 0x80]
mov r9d, 2
mov rcx, qword [rsp + 0x40]
mov r8, rsi
mov qword [rsp + 0x30], rbx
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edx, eax
test eax, eax
je 0x140044052
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x140044050
mov eax, 0xffffffff
test rbx, rbx
je 0x140044034
mov eax, dword [rbx]
mov dword [rsp + 0x28], edx
lea r8, str.ReadUCODEStringRegKey_RegGetValueW_failed_for_value___s_and_ulSize___d_with_error_code_0x_08x.
mov edx, 8
mov dword [rsp + 0x20], eax
mov r9, rsi
call fcn.140040530
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140044080
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, r9
mov qword [rsp + 0x30], 0
mov rsi, r8
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rbp, rdx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x14004418f
test rsi, rsi
je 0x14004417b
test rdi, rdi
je 0x14004417b
mov rax, rdi
mov ebx, 1
cmp byte [rax], 0
lea rcx, [rax + 1]
mov rax, rcx
jne 0x1400440f4
cmp byte [rcx], 0
je 0x140044100
cmp ebx, 0x200
jae 0x140044100
inc ebx
jmp 0x1400440e3
inc ebx
cmp ebx, 0x200
jae 0x140044167
mov rcx, qword [rsp + 0x30]
mov r9d, 7
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test eax, eax
je 0x140044180
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x140044180
mov dword [rsp + 0x28], eax
lea r8, str.SetMultiSzRegValue:_RegSetValueEx_failed_for_lpValueName___s_and_multiSzLen___d_with_error_code_0x_08x.
mov r9, rsi
mov dword [rsp + 0x20], ebx
mov edx, 8
call fcn.140040530
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1400441b5
mov rcx, qword [rsp + 0x30]
mov edi, 0x7a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1400441b5
mov edi, 0x57
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1400441b5
mov rcx, qword [0x1400da5d8]
test rcx, rcx
je 0x1400441b3
mov r9, rbp
mov dword [rsp + 0x20], ebx
lea r8, str.SetMultiSzRegValue:_RegOpenKeyEx_failed_for_lpKeyPath___s_with_error_code_0x_08x.
mov edx, 8
call fcn.140040530
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret