joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006580
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, rdx
mov rbx, rcx
xor edi, edi
lea rdx, str._ddu
mov rcx, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
call fcn.14001bcc0
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x14000661f
test rcx, rcx
jne 0x1400065e5
lea r8, [rsp + 0x38]
lea rdx, [0x1400370f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x1400066af
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.DriverUpdates
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400066af
mov dword [rsp + 0x60], edi
jmp 0x140006687
test rcx, rcx
jne 0x14000664b
lea r8, [rsp + 0x38]
lea rdx, [0x1400370f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
add byte [rbp - 0x3f6bf040], al

Function at 0x1400066e0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, rdx
mov rbx, rcx
xor edi, edi
lea rdx, str._dso
mov rcx, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
call fcn.14001bcc0
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x14000677f
test rcx, rcx
jne 0x140006745
lea r8, [rsp + 0x38]
lea rdx, [0x1400370f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x14000680f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.OrderSupplies
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000680f
mov dword [rsp + 0x60], edi
jmp 0x1400067e7
test rcx, rcx
jne 0x1400067ab
lea r8, [rsp + 0x38]
lea rdx, [0x1400370f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x14000680f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
lea rdx, str.OrderSupplies
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000680f
mov dword [rsp + 0x60], 1
test rbx, rbx
je 0x14000680f
lea r9, [rsp + 0x60]
lea rdx, str.MystOnlineOrderSupplies
mov r8d, 4
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000681f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000682f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140006840
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x140006983
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x140006979
mov rcx, qword [rbx + 0x20]
mov qword [rsp + 0x58], rsi
xor esi, esi
lea rdx, str._dgst
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
call fcn.14001bcc0
mov rcx, qword [rsp + 0x30]
test rax, rax
je 0x1400068eb
test rcx, rcx
jne 0x1400068bd
lea r8, [rsp + 0x30]
lea rdx, [0x1400370f0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x140006954
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
lea rdx, str.ServicesTab
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140006954
test rcx, rcx
je 0x14000690c
lea rdx, str.ServicesTab
call fcn.1400171e0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], rsi
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.140006000
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.140006160
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.1400062c0
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.140006420
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.140006580
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.1400066e0
mov rcx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
test rcx, rcx
je 0x140006969
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140006979
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
repz ret
Function at 0x1400086b0
Capabilities:
Enumerate files on windows
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x650]
sub rsp, 0x750
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rbp + 0x640], rax
mov rax, qword [str.strings]
mov rbx, rcx
xor r12d, r12d
mov qword [rbp + 0x1a8], rax
mov rax, qword [0x1400381b8]
lea rcx, [rbp + 0x190]
mov qword [rbp + 0x1b0], rax
mov rax, qword [str.HP_Mombi_Driver_Name]
movzx r15d, r8b
mov qword [rbp + 0x1b8], rax
mov rax, qword [0x1400381c8]
mov rsi, rdx
mov qword [rbp + 0x1c0], rax
mov rax, qword [0x1400381d0]
xor r13b, r13b
mov qword [rbp + 0x1c8], rax
mov rax, qword [0x1400381d8]
mov word [rsp + 0x30], r12w
mov qword [rbp + 0x1d0], rax
mov rax, qword [0x1400381e0]
mov qword [rbp + 0x190], 0x73
mov qword [rbp + 0x1d8], rax
movzx eax, word [0x1400381e8]
lea r14d, [r12 + 0x5c]
mov word [rbp + 0x1e0], ax
mov rax, qword [str.HP_Mombi_Driver_Name_Ver]
mov qword [rbp + 0x1e8], rax
mov rax, qword [0x1400381f8]
mov qword [rbp + 0x1f0], rax
mov rax, qword [0x140038200]
mov qword [rbp + 0x1f8], rax
mov rax, qword [0x140038208]
mov qword [rbp + 0x200], rax
mov rax, qword [0x140038210]
mov qword [rbp + 0x208], rax
mov rax, qword [0x140038218]
mov qword [rbp + 0x210], rax
add byte [rdi], cl
mov bh, 5
cli
add al, byte [rax]
Function at 0x140008a20
Capabilities:
Check os version
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x1a18]
mov eax, 0x1b18
call fcn.1400214c0
sub rsp, rax
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rbp + 0x19f0], rax
mov rbx, r8
mov rdi, rcx
lea rdx, [rbp + 0xfe0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0xfe0]
mov edx, 0x5c
call fcn.14001bc94
xor esi, esi
test rax, rax
je 0x140008a81
mov word [rax], si
lea rdx, [rbp + 0xfe0]
mov ecx, 0x30
call qword [sym.imp.SETUPAPI.dll_SetupAddToSourceListW]
lea r8, [rsp + 0x70]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x70], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140008af5
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x40]
lea rdx, str.MystDeviceVerify
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x200
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Install.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140045d00], rax
test rax, rax
je 0x140009d51
mov qword [rsp + 0x1b48], r12
test rbx, rbx
je 0x140008b98
lea rdx, [0x140038250]
mov rcx, rbx
call fcn.14001ba8c
test rax, rax
je 0x140008b98
movzx ecx, word [0x140046094]
mov r12d, esi
and ecx, 0x3ff
dec ecx
je 0x140008b4c
cmp ecx, 0xc
jne 0x140008b52
mov r12d, 1
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, qword [0x140045d00]
mov edx, 0x66
mov r8, rax
mov eax, 0x25a
test r12d, r12d
lea r9, [0x140009e30]
cmovne edx, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, qword [0x140045d00]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x140009d49
lea rcx, str.RICHED20.DLL
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x1b10], r13
mov qword [rsp + 0x1b08], r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add al, byte [rax]
mov r12, qword [rsp + 0x1b48]
mov rcx, qword [rbp + 0x19f0]
xor rcx, rsp
call fcn.14001b510
add rsp, 0x1b18
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140009d70
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x330
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rbx, rcx
test rcx, rcx
je 0x140009e05
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x2fe
mov word [rsp + 0x20], ax
call fcn.14001d640
lea rdx, [rsp + 0x20]
mov r8d, 0x180
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x140009e05
lea rdx, str.RCLID_
lea rcx, [rsp + 0x20]
call fcn.14001bcc0
test rax, rax
je 0x140009e05
lea rcx, [rsp + 0x2c]
call fcn.14001ba04
movzx ecx, word [0x140046094]
lea r8, [rsp + 0x20]
mov edx, eax
call fcn.1400050e0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
invalid
mov eax, 1
Function at 0x14000a290
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x630
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rsp + 0x620], rax
mov rbx, rcx
mov rsi, rdx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x1fe
mov word [rsp + 0x20], di
call fcn.14001d640
lea rcx, [rsp + 0x222]
xor edx, edx
mov r8d, 0x3fe
mov word [rsp + 0x220], di
call fcn.14001d640
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x14000a345
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x220]
mov r8, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
test eax, eax
je 0x14000a345
lea rdx, [rsp + 0x220]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x620]
xor rcx, rsp
call fcn.14001b510
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000cb00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
xor bl, bl
test rcx, rcx
je 0x14000cc59
cmp qword [0x140043b88], 8
mov qword [rsp + 0x58], rdi
lea rdi, [0x140043b70]
cmovae rdi, qword [0x140043b70]
mov rdx, rdi
call fcn.14001bcc0
mov r11, rax
test rax, rax
je 0x14000cc4c
mov qword [rsp + 0x50], rsi
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
repne scasw ax, word [rdi]
lea rdx, [0x1400382c0]
not rcx
lea r13, [r11 + rcx*2]
lea rcx, [r13 + 2]
call fcn.14001bcc0
lea rdx, str..cfm
mov rcx, r13
mov r12, rax
call fcn.14001bcc0
test r12, r12
je 0x14000cc47
test rax, rax
je 0x14000cc47
sub r12, r13
mov qword [rsp + 0x48], rbp
sar r12, 1
lea eax, [r12 + 1]
movsxd rbp, eax
mov eax, 2
mul rbp
cmovo rax, rsi
mov rcx, rax
call fcn.140017e40
mov rsi, rax
test rax, rax
je 0x14000cc25
test rbp, rbp
je 0x14000cbd9
xor eax, eax
mov rdi, rsi
mov rcx, rbp
movzx eax, ax
rep stosw word [rdi], ax
movsxd r8, r12d
mov rdx, r13
mov rcx, rsi
call fcn.14001bae4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000cbf7
mov bl, 1
mov rax, qword [0x140045d10]
mov qword [rsp + 0x40], rsi
test rax, rax
jne 0x14000cc19
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x14000cc25
lea rcx, [rsp + 0x40]
mov edx, 1
call rax
mov rbp, qword [rsp + 0x48]
movzx eax, bl
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbx
ret
movzx eax, bl
jmp 0x14000cc2d
mov al, 1
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbx
ret
movzx eax, bl
add rsp, 0x30
pop rbx
ret
Function at 0x14000fd90
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov r11, rsp
push r12
push r13
push r14
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor sil, sil
mov eax, 2
mov r13d, 0x400
mul r13
mov rdi, rax
mov r14, 0xffffffffffffffff
cmovo rdi, r14
xor r12d, r12d
mov dword [r11 - 0x68], r12d
mov rax, qword [0x140045d08]
test rax, rax
jne 0x14000fe0c
call fcn.1400195b0
mov qword [0x140045d08], rax
test rax, rax
je 0x14000ff15
mov r8, qword [rsp + 0x88]
lea r9, [rsp + 0x20]
mov ebp, 1
mov edx, ebp
mov rcx, rdi
call rax
mov rbx, rax
test rax, rax
je 0x14000ff15
mov edx, r13d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.14000c2e0
nop
lea r8d, [rbp + 0xb]
lea rdx, str.pnputil.exe
lea rcx, [rsp + 0x38]
call fcn.14000c180
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
movzx edi, sil
cmp eax, 0xffffffff
cmovne edi, ebp
mov qword [rsp + 0x20], rbx
mov rax, qword [0x140045d10]
test rax, rax
jne 0x14000fec9
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x14000fed9
mov edx, ebp
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140045d10]
cmp qword [rsp + 0x50], 8
jb 0x14000ff0f
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rcx
test rcx, rcx
je 0x14000ff0f
test rax, rax
jne 0x14000ff06
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x14000ff0f
xor edx, edx
lea rcx, [rsp + 0x28]
call rax
movzx eax, dil
jmp 0x14000ff19
movzx eax, sil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001b510
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret

Function at 0x140013a90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140013ac3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140013b06
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140013b01
cmp rbx, r11
jae 0x140013b06
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140013af0
cmp rbx, r11
jb 0x140013b0a
xor eax, eax
jmp 0x140013b16
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140013d30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140045d08]
xor ebx, ebx
mov rdi, rcx
mov dword [rsp + 0x30], ebx
test rax, rax
jne 0x140013d60
call fcn.1400195b0
mov qword [0x140045d08], rax
test rax, rax
je 0x140013d79
mov r8, qword [rsp + 0x28]
lea r9, [rsp + 0x30]
mov edx, 1
mov ecx, 0x208
call rax
mov rbx, rax
mov qword [rdi + 8], rbx
test rbx, rbx
je 0x140013da9
xor edx, edx
mov r8d, 0x104
mov rcx, rbx
call fcn.14001d640
mov rdx, qword [rdi + 8]
lea rcx, str._WinDir_Inf
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140014d70
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x160], rbx
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov r12, rdx
mov rbx, rcx
mov qword [rbp], 7
xor r13d, r13d
mov qword [rbp - 8], r13
mov word [rbp - 0x18], r13w
lea rdx, [rbp - 0x18]
call fcn.1400154a0
mov esi, r13d
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], r13
mov word [rbp - 0x40], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14000c2e0
nop
call fcn.140014c40
test al, al
je 0x140014f65
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], r13
mov word [rbp - 0x68], r13w
lea r8d, [r13 + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_SettingsUPDProperties
lea rcx, [rbp - 0x68]
call fcn.14000c2e0
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x60], 2
mov byte [rsp + 0x68], r13b
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rdx, qword [rbp - 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x64], eax
test eax, eax
jne 0x140014e9d
cmp dword [rsp + 0x50], 1
jne 0x140014ea2
mov byte [rsp + 0x68], 1
jmp 0x140014ea2
mov qword [rsp + 0x58], r13
cmp qword [rbp - 0x50], 8
jb 0x140014ede
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140014ede
mov rdi, qword [0x140045d10]
test rdi, rdi
jne 0x140014ed6
call fcn.140019630
mov rdi, rax
mov qword [0x140045d10], rax
test rax, rax
je 0x140014ee5
xor edx, edx
lea rcx, [rbp - 0x78]
call rdi
mov rdi, qword [0x140045d10]
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], r13
mov word [rbp - 0x68], r13w
lea rdx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rdx, qword [rbp - 0x18]
mov qword [rsp + 0x78], r12
mov rcx, qword [rsp + 0x58]
and al, 0x58
Function at 0x140015020
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov qword [rbp + 0x37], 7
xor esi, esi
mov qword [rbp + 0x2f], rsi
mov word [rbp + 0x1f], si
lea rdx, [rbp + 0x1f]
call fcn.1400154a0
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], rsi
mov word [rbp - 9], si
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rbp - 9]
call fcn.14000c2e0
nop
mov qword [rbp - 0x59], rsi
mov qword [rbp - 0x19], 7
mov qword [rbp - 0x21], rsi
mov word [rbp - 0x31], si
lea r8d, [rsi + 0x38]
lea eax, [rsi + 0x38]
Function at 0x140015280
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rsp + 0x108], rbx
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov qword [rbp + 0x17], 7
xor ebx, ebx
mov qword [rbp + 0xf], rbx
mov word [rbp - 1], bx
lea rdx, [rbp - 1]
call fcn.1400154a0
mov qword [rbp - 0x21], rbx
call fcn.140014c40
test al, al
je 0x140015434
mov qword [rbp + 0x3f], 7
mov qword [rbp + 0x37], rbx
mov word [rbp + 0x27], bx
lea r8d, [rbx + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_SettingsUPDProperties
lea rcx, [rbp + 0x27]
call fcn.14000c2e0
mov qword [rbp - 0x49], rbx
mov dword [rbp - 0x41], 2
mov byte [rbp - 0x39], bl
lea rdx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rdx, qword [rbp + 0x27]
lea rax, [rbp - 0x2d]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rbp - 0x3d], eax
test eax, eax
jne 0x140015365
cmp dword [rbp - 0x2d], 1
jne 0x140015369
mov byte [rbp - 0x39], 1
jmp 0x140015369
mov qword [rbp - 0x49], rbx
cmp qword [rbp + 0x3f], 8
jb 0x1400153a2
mov rax, qword [rbp + 0x27]
mov qword [rbp - 0x19], rax
test rax, rax
je 0x1400153a2
mov rax, qword [0x140045d10]
test rax, rax
jne 0x14001539a
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x1400153a9
xor edx, edx
lea rcx, [rbp - 0x19]
call rax
mov rax, qword [0x140045d10]
mov qword [rbp + 0x3f], 7
mov qword [rbp + 0x37], rbx
mov word [rbp + 0x27], bx
lea rdx, [rbp - 1]
mov r8, qword [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, r8
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x14001543f
mov dword [rbp - 0x29], 8
mov dword [rbp - 0x31], 0xb
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x31]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x3d], eax
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x140015434
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
call fcn.1400171e0
mov dword [rbp - 0x3d], eax
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x140015434
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x3d], eax
mov rax, qword [0x140045d10]
mov r8, qword [rbp - 1]
mov rbx, qword [rbp - 0x21]
cmp qword [rbp + 0x17], 8
jb 0x140015471
mov qword [rbp - 0x11], r8
test r8, r8
je 0x140015471
test rax, rax
jne 0x140015469
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x140015471
xor edx, edx
lea rcx, [rbp - 0x11]
call rax
mov rax, rbx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14001b510
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rbp
ret
Function at 0x1400171e0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x140017252
test rdx, rdx
je 0x140017252
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140017244
cmp eax, 0xea
jne 0x140017257
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x140017257
mov eax, 0xd
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14001b510
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret