joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024fc0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov r9d, 0xff
movaps xmmword [rax - 0x48], xmm6
mov rbx, rcx
movaps xmmword [rax - 0x58], xmm7
xor esi, esi
lea rcx, [rsp + 0x60]
mov r8d, r9d
mov qword [rax + 0x10], rsi
xor edx, edx
xor edi, edi
xor ebp, ebp
xor r14d, r14d
xor r15d, r15d
xor r12d, r12d
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x140025150
movss xmm6, dword [0x1400861c4]
mov r13d, 0x400
movss xmm7, dword [0x1400861c0]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140025182
cmp dword [rsp + 0x68], 0xff
jne 0x140025132
mov rcx, qword [rsp + 0x78]
lea r9, [rsp + 0xf0]
lea r8, [rsp + 0x30]
mov dword [rsp + 0xf0], 0x30
mov edx, 0x10000003
mov dword [rsp + 0x20], 0x18
call qword [sym.imp.USER32.dll_GetRawInputData]
dec eax
cmp eax, 0xfffffffd
ja 0x140025132
cmp dword [rsp + 0x30], 0
jne 0x140025132
lea rcx, [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test word [rsp + 0x4c], r13w
je 0x1400250aa
movsx eax, word [rsp + 0x4e]
jmp 0x1400250ac
xor eax, eax
movsxd r8, dword [rsp + 0x58]
movsxd r9, dword [rsp + 0x54]
add rsi, r8
movsxd rcx, eax
add rdi, r9
cdq
add rbp, rcx
xor eax, edx
sub eax, edx
cdqe
add r14, rax
mov eax, r8d
cdq
imul r8d, r8d
mov ecx, eax
mov eax, r9d
xor ecx, edx
imul r9d, r9d
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
add eax, ecx
add r8d, r9d
cdqe
add r15, rax
movd xmm0, r8d
cvtdq2ps xmm0, xmm0
call fcn.140056c9c
mulss xmm0, xmm6
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rbp
addss xmm0, xmm7
mov qword [rbx + 0x20], r14
mov qword [rbx + 0x28], r15
cvttss2si eax, xmm0
movsxd rcx, eax
mov rax, qword [rsp + 0xf8]
add r12, rcx
mov qword [rbx + 0x30], r12
mov qword [rbx], rax
mov r9d, 0xff
lea rcx, [rsp + 0x60]
mov r8d, r9d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x140025030
lea rcx, str.RawInputListener:_quitting_listener_thread...
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.RawInputListener:_Something_went_wrong__quitting_listener_thread...
jmp 0x140025157
Function at 0x140025c70
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x130
lea rax, vtable.LogMsg.0
mov rsi, rdx
mov qword [rcx], rax
lea rdx, [r11 + 8]
xor eax, eax
mov rbx, rcx
mov qword [rcx + 0x10c], rax
mov rbp, r8
mov qword [rcx + 0x118], rax
lea rcx, str.LogOutputDebug
mov dword [r11 + 8], eax
call fcn.140028ac0
test eax, eax
je 0x140025cd3
cmp dword [rsp + 0x140], 0
je 0x140025cd3
or dword [rbx + 0x10c], 1
lea rdx, [rsp + 0x140]
lea rcx, str.LogOutputFile
call fcn.140028ac0
test eax, eax
je 0x140025cfc
cmp dword [rsp + 0x140], 0
je 0x140025cfc
or dword [rbx + 0x10c], 4
lea rdx, [rsp + 0x140]
lea rcx, str.LogMaskLevel
call fcn.140028ac0
test eax, eax
je 0x140025d25
mov eax, dword [rsp + 0x140]
test eax, eax
je 0x140025d25
mov dword [rbx + 0x110], eax
mov rdx, rsi
lea rcx, [rbx + 8]
call fcn.1400046d0
test byte [rbx + 0x10c], 4
je 0x140025d83
lea r9, [rbx + 8]
mov r8, rbp
lea rdx, str._s_s.txt
lea rcx, [rsp + 0x20]
call fcn.1400046d0
lea rdx, [0x140086214]
lea rcx, [rsp + 0x20]
call fcn.140054510
mov qword [rbx + 0x118], rax
test rax, rax
jne 0x140025d83
lea rcx, str.fopen_failed.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
and dword [rbx + 0x10c], 0xfffffffb
lea r11, [rsp + 0x130]
mov rax, rbx
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140025e80
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rdi
sub rsp, 0x648
mov rdi, r8
mov rbx, rcx
test dword [rcx + 0x110], edx
je 0x140025f9c
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x20]
call fcn.1400045e0
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x240]
mov r9, rdi
mov qword [rsp + 0x20], 0
or r8, 0xffffffffffffffff
mov rcx, qword [rax]
or rcx, 1
call fcn.140051364
test byte [rbx + 0x10c], 5
mov rsi, qword [rsp + 0x640]
je 0x140025f9c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x3c]
lea rdx, str._02d:_02d:_02d:_03d
movzx eax, word [rsp + 0x3e]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x440]
call fcn.1400046d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea r8, [rbx + 8]
lea rax, [rsp + 0x240]
lea r9, [rsp + 0x440]
mov qword [rsp + 0x20], rax
lea rdx, str._s__t_s__s_GetLastError___x_r_n
lea rcx, [rsp + 0x40]
call fcn.1400046d0
test byte [rbx + 0x10c], 1
je 0x140025f76
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [rbx + 0x10c], 4
je 0x140025f9c
mov rcx, qword [rbx + 0x118]
lea rdx, [rsp + 0x40]
call fcn.1400261e0
mov rcx, qword [rbx + 0x118]
call fcn.140057364
add rsp, 0x648
pop rdi
pop rbx
ret
Function at 0x140025fb0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x440
test byte [rcx + 0x10c], 5
mov rdi, r9
mov esi, r8d
mov rbx, rcx
je 0x1400260a3
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0x3c]
lea rcx, [rsp + 0x240]
movzx eax, word [rsp + 0x3e]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rdx, str._02d:_02d:_02d:_03d
call fcn.1400046d0
test esi, esi
je 0x140026047
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea r8, [rbx + 8]
lea r9, [rsp + 0x240]
mov qword [rsp + 0x20], rdi
lea rdx, str._s__t_s__s_GetLastError___x_r_n
lea rcx, [rsp + 0x40]
call fcn.1400046d0
jmp 0x140026069
lea r8, [rbx + 8]
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x240]
lea rdx, str._s__t_s__s_r_n
lea rcx, [rsp + 0x40]
call fcn.1400046d0
test byte [rbx + 0x10c], 1
je 0x14002607d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [rbx + 0x10c], 4
je 0x1400260a3
mov rcx, qword [rbx + 0x118]
lea rdx, [rsp + 0x40]
call fcn.1400261e0
mov rcx, qword [rbx + 0x118]
call fcn.140057364
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400260c0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rdi
sub rsp, 0x648
mov rdi, r8
mov rbx, rcx
test dword [rcx + 0x110], edx
je 0x1400261d2
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x20]
call fcn.1400045e0
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x240]
mov r9, rdi
mov qword [rsp + 0x20], 0
or r8, 0xffffffffffffffff
mov rcx, qword [rax]
or rcx, 1
call fcn.140051364
test byte [rbx + 0x10c], 5
mov rsi, qword [rsp + 0x640]
je 0x1400261d2
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x3c]
lea rdx, str._02d:_02d:_02d:_03d
movzx eax, word [rsp + 0x3e]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x440]
call fcn.1400046d0
lea rax, [rsp + 0x240]
lea r8, [rbx + 8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x440]
lea rdx, str._s__t_s__s_r_n
lea rcx, [rsp + 0x40]
call fcn.1400046d0
test byte [rbx + 0x10c], 1
je 0x1400261ac
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [rbx + 0x10c], 4
je 0x1400261d2
mov rcx, qword [rbx + 0x118]
lea rdx, [rsp + 0x40]
call fcn.1400261e0
mov rcx, qword [rbx + 0x118]
call fcn.140057364
add rsp, 0x648
pop rdi
pop rbx
ret
Function at 0x1400268e0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
test rcx, rcx
jne 0x14002690a
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140026935
lea r8, str.EEU_RegisterDeviceNotification:Invalid_Parameter_
mov edx, 0x100
add rsp, 0x28
jmp fcn.140025e80
call qword [sym.imp.USER32.dll_UnregisterDeviceNotification]
test eax, eax
jne 0x140026935
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140026935
lea r8, str.EEU_RegisterDeviceNotification:UnregisterDeviceNotification___failed
mov edx, 0x100
add rsp, 0x28
jmp fcn.140025e80
add rsp, 0x28
ret

Function at 0x140026940
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
test rcx, rcx
jne 0x14002696a
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140026995
lea r8, str.EEU_UnRegisterPowerNotification:Invalid_Parameter_
mov edx, 0x100
add rsp, 0x28
jmp fcn.140025e80
call qword [sym.imp.USER32.dll_UnregisterPowerSettingNotification]
test eax, eax
jne 0x140026995
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140026995
lea r8, str.EEU_UnRegisterPowerNotification:UnregisterPowerSettingNotification___failed
mov edx, 0x100
add rsp, 0x28
jmp fcn.140025e80
add rsp, 0x28
ret
Function at 0x140027230
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub rsp, 0x2e8
xor eax, eax
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x68]
call fcn.14002e170
xor edx, edx
mov dword [rsp + 0x70], 0x68
mov r8d, 0x200
lea rcx, [rsp + 0xe0]
call fcn.14002e170
mov edx, 0x200
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400273b5
lea rax, [rsp + 0xe0]
or rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400272a0
lea rax, [rcx + 0x2f]
cmp rax, 0x200
jae 0x1400273b5
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x2e0], rbx
add rcx, rax
lea r9, str.GlobalAti_VariBrightMonitorEvent
lea r8, str.atibtmon.exe
lea rdx, str._s__s
call fcn.1400046d0
xor ebx, ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor ecx, ecx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140027359
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140027349
lea r8, str.VBMonitorProcessStart:_Failed_to_create_VariBright_Monitor_Process
mov edx, 0x2000
call fcn.140025e80
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2e8
ret
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002736e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140027383
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x50], rbx
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140027349
mov r9d, dword [rsp + 0x60]
lea r8, str.VBMonitorProcessStart:_VariBright_Monitor_Process__ProcessID__lu__created
mov edx, 0x2000
call fcn.1400260c0
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2e8
ret
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140027351
lea r9, str.VBMonitorProcessStart:_Failed_to_retreive_VBMonitor_Full_Name
xor r8d, r8d
mov edx, 0x60004004
call fcn.140025e10
add rsp, 0x2e8
ret
Function at 0x140028670
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x20], rax
mov r9d, 0x10000
xor r8d, r8d
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400286c9
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400286bc
lea r8, str.DeleteRegKey_RegOpenKeyEx_failed.
lea edx, [rbx + 7]
call fcn.140025e80
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x1400286fd
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400286fb
mov r9, rdi
lea r8, str.DeleteRegKey_RegDeleteKey_failed_for_pcPath___s.
mov edx, 8
call fcn.140025e80
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140028720
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov rdi, r8
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov dword [rsp + 0x20], 0
mov rsi, rdx
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1400287a6
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140028794
mov r9, rsi
lea r8, str.WriteRegKey_RegCreateKeyEx_failed_for_pcPath___s.
lea edx, [rbx + 7]
call fcn.140025e80
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x1400287da
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400287d8
mov r9, rdi
lea r8, str.WriteRegKey_RegSetValueEx_failed_for_value___s.
mov edx, 8
call fcn.140025e80
xor ebx, ebx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140028800
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, r9
mov qword [rsp + 0x48], 0
mov rdi, r8
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rsi, rdx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x1400288c1
mov rcx, qword [rsp + 0x48]
mov r9d, 0xffff
mov dword [rsp + 0x44], eax
mov r8, rdi
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x200
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov rdx, qword [rsp + 0x80]
mov ebx, eax
mov ecx, dword [rsp + 0x40]
mov dword [rdx], ecx
test eax, eax
je 0x1400288b4
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400288b4
mov r9, rdi
lea r8, str.GetMultiSzRegValue:_RegGetValue_failed_for_lpValueName___s.
mov edx, 8
call fcn.140025e80
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400288e1
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400288e1
mov r9, rsi
lea r8, str.GetMultiSzRegValue:_RegOpenKeyEx_failed_for_lpKeyPath___s.
mov edx, 8
call fcn.140025e80
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140028940
Capabilities:
Check for sandbox username or hostname
Get session information
Get session user name
Impersonate user

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rdi, r8
mov ebx, edx
test ecx, ecx
je 0x1400289a5
mov rdx, r8
mov ecx, 0x2001f
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x140028992
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140028982
lea r8, str.GetProfileRootHandle_RegOpenCurrentUser_failed.
mov edx, 8
call fcn.140025e80
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
xor eax, eax
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x38]
xor ecx, ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea r8d, [rcx + 5]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], 0x38
mov qword [rsp + 0x20], rax
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x140028965
lea rdx, [rsp + 0x98]
mov ecx, ebx
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x140028a4a
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140028a30
lea r8, str.GetProfileRootHandle_WTSQueryUserToken_failed.
lea edx, [rax + 8]
call fcn.140025e80
mov rcx, qword [rsp + 0x38]
call sub.WTSAPI32.dll_WTSFreeMemory
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0x30]
mov ebx, 1
call qword [sym.imp.USERENV.dll_LoadUserProfileA]
test eax, eax
jne 0x140028a83
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140028a81
lea r8, str.OpenProfilePathKey_LoadUserProfile_failed.
lea edx, [rbx + 7]
call fcn.140025e80
xor ebx, ebx
mov rcx, qword [rsp + 0x60]
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140028ac0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov dword [rsp + 0x60], 4
mov rdi, rcx
lea rax, [rsp + 0x68]
lea rdx, str.SoftwareAMDEEU
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov r9d, 0x20019
xor r8d, r8d
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140028b41
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140028b2f
lea r9, str.SoftwareAMDEEU
lea r8, str.ReadRegKey_RegOpenKeyEx_failed_for_pcPath___s.
lea edx, [rbx + 7]
call fcn.140025e80
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov r9d, 0x10
mov qword [rsp + 0x28], rsi
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x140028b95
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140028b93
mov r9, rdi
lea r8, str.ReadRegKey_RegGetValue_failed_for_value___s.
mov edx, 8
call fcn.140025e80
xor ebx, ebx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140028bc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, r8
mov rsi, rdx
mov edi, 1
test r9d, r9d
je 0x140028c00
sub r9d, edi
je 0x140028bf9
cmp r9d, edi
je 0x140028bf2
mov ebx, edi
jmp 0x140028c05
mov ebx, 2
jmp 0x140028c05
mov ebx, 8
jmp 0x140028c05
mov ebx, 0x10
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140028c46
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140028c42
mov r9, rsi
lea r8, str.ReadRegKey_RegOpenKeyEx_failed_for_pcPath___s.
mov edx, 8
call fcn.140025e80
xor eax, eax
jmp 0x140028caf
mov rax, qword [rsp + 0x88]
mov r9d, ebx
mov rcx, qword [rsp + 0x40]
mov r8, rbp
mov qword [rsp + 0x30], rax
xor edx, edx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x140028ca2
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140028ca0
mov r9, rbp
lea r8, str.ReadRegKey_RegGetValue_failed_for_value___s.
mov edx, 8
call fcn.140025e80
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140028cd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, r9
lea rax, [rsp + 0x40]
mov rdi, r8
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rsi, rdx
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140028d31
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140028d2d
mov r9, rsi
lea r8, str.ReadRegKey_RegOpenKeyEx_failed_for_pcPath___s.
lea edx, [rbx + 7]
call fcn.140025e80
xor eax, eax
jmp 0x140028d95
mov rax, qword [rsp + 0x80]
mov r9d, 2
mov rcx, qword [rsp + 0x40]
mov r8, rdi
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140028d88
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140028d86
mov r9, rdi
lea r8, str.ReadRegKey_RegGetValue_failed_for_value___s.
mov edx, 8
call fcn.140025e80
xor ebx, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140028db0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, r9
mov qword [rsp + 0x30], 0
mov rdi, r8
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rbp, rdx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test eax, eax
jne 0x140028eb2
test rdi, rdi
je 0x140028e9e
test rbx, rbx
je 0x140028e9e
mov rax, rbx
lea ecx, [rsi + 1]
cmp byte [rax], 0
jne 0x140028e1c
cmp byte [rax + 1], 0
je 0x140028e2b
cmp ecx, 0x200
jae 0x140028e2b
inc rax
inc ecx
jmp 0x140028e11
inc ecx
cmp ecx, 0x200
jae 0x140028e8a
mov dword [rsp + 0x28], ecx
mov r9d, 7
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
test eax, eax
je 0x140028ea3
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140028ea3
mov r9, rdi
lea r8, str.SetMultiSzRegValue:_RegSetValueEx_failed_for_lpValueName___s.
mov edx, 8
call fcn.140025e80
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140028ed4
mov rcx, qword [rsp + 0x30]
mov ebx, 0x7a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140028ed4
mov ebx, 0x57
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140028ed4
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140028ed2
mov r9, rbp
lea r8, str.SetMultiSzRegValue:_RegOpenKeyEx_failed_for_lpKeyPath___s.
mov edx, 8
call fcn.140025e80
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret