joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a0080
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x2058
call fcn.1402aba50
sub rsp, rax
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x2030], rax
test dword [0x14046e6d8], ecx
je 0x1400a019d
mov qword [rsp + 0x2050], rbx
mov qword [rsp + 0x2048], rsi
mov qword [rsp + 0x2040], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, ebx
lea rdx, str.AL___04d:_04d_:
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.140093970
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
lea rsi, [rsp + 0x2070]
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400a0110
mov edi, 0x1000
lea rbx, [rsp + 0x30]
sub rdi, rax
lea rbx, [rbx + rax*2]
call fcn.140092a40
mov r9, qword [rsp + 0x2068]
mov r8, rdi
mov qword [rsp + 0x28], rsi
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
call fcn.1402b828c
mov rax, qword [0x14046e6d0]
lea rcx, [rsp + 0x30]
mov rdi, qword [rsp + 0x2040]
mov rsi, qword [rsp + 0x2048]
mov rbx, qword [rsp + 0x2050]
test rax, rax
je 0x1400a0197
call rax
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x2058
ret
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x2058
ret

Function at 0x1400a0630
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r9
mov dword [rsp + 0x38], 4
mov rbx, r8
lea rax, [rsp + 0x30]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdi, rdx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400a0697
mov r9d, eax
lea rdx, str.ALUtilRegistryValueGet_RegOpenKeyEx_failed___s__d_n
mov r8, rdi
mov ecx, 1
call fcn.1400a0080
xor al, al
jmp 0x1400a0713
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400a0706
mov r8, rbx
mov ecx, 1
cmp eax, 2
jne 0x1400a06e8
lea rdx, str.ALUtilRegistryValueGet_RegQueryValueExW_failed___s_ERROR_FILE_NOT_FOUND_n
call fcn.1400a0080
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1400a0713
mov r9d, eax
lea rdx, str.ALUtilRegistryValueGet_RegQueryValueExW_failed___s__d_n
call fcn.1400a0080
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1400a0713
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400a0ab0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov rbx, rcx
mov qword [rsp + 0x28], rax
mov r9, rcx
mov dword [rsp + 0x20], 4
lea r8, [0x1400a0ba0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x1400a0b1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.ALThreadBase::Start_CreateThread_failed._LastError__d
lea ecx, [rdi + 1]
call fcn.1400a0080
xor al, al
jmp 0x1400a0b7e
lea rcx, [rbx + 8]
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rbx + 0x30], 0
lea rcx, [rbx + 8]
jne 0x1400a0b58
mov eax, dword [rsp + 0x30]
mov qword [rbx + 0x30], rdi
mov dil, 1
mov dword [rbx + 0x38], eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1400a0b75
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor dil, dil
mov rsi, qword [rsp + 0x58]
movzx eax, dil
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402ab320
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400a4a80
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, dword [rcx + 0xc]
mov rbx, rdx
mov r11d, r8d
mov r10, rcx
test eax, eax
jne 0x1400a4b4c
mov r9d, dword [rcx + 0xb0]
xor edx, edx
mov rax, qword [rcx + 0x88]
mov rax, qword [rax]
div r9
xor edx, edx
mov dword [rcx + 0xb4], eax
mov rdi, qword [rcx + 0x98]
mov r8, qword [rcx + 0xa8]
mov rcx, qword [rcx + 0x90]
mov rsi, qword [rdi]
mov rax, rsi
div r8
add rcx, rdx
mov r9, rdx
cmp rbx, rcx
jne 0x1400a4b23
mov rax, qword [r10 + 0xa0]
xor edx, edx
mov rax, qword [rax]
div r8
cmp rdx, r9
je 0x1400a4b15
sub r9, rdx
js 0x1400a4b0f
mov rax, r8
xor edx, edx
sub rax, r9
div r8
mov r8, rdx
jmp 0x1400a4b15
mov r8, r9
neg r8
mov rax, r11
cmp r8, r11
jb 0x1400a4b23
add rax, rsi
mov qword [rdi], rax
mov rax, qword [r10 + 0x88]
xor edx, edx
mov ecx, dword [r10 + 0xb0]
mov rax, qword [rax]
div rcx
mov dword [r10 + 0xb8], eax
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
pop rdi
ret
cmp eax, 1
jne 0x1400a4c04
mov rax, qword [rcx + 0x88]
xor edx, edx
mov ecx, dword [rcx + 0xb0]
mov rax, qword [rax + 8]
div rcx
xor edx, edx
mov dword [r10 + 0xbc], eax
mov rdi, qword [r10 + 0xa0]
mov r8, qword [r10 + 0xa8]
mov rcx, qword [r10 + 0x90]
mov rsi, qword [rdi]
mov rax, rsi
div r8
add rcx, rdx
mov r9, rdx
cmp rbx, rcx
jne 0x1400a4bda
mov rax, qword [r10 + 0x98]
xor edx, edx
mov rax, qword [rax]
div r8
cmp r9, rdx
jne 0x1400a4bb6
mov rdx, r8
jmp 0x1400a4bcb
sub rdx, r9
js 0x1400a4bc8
mov rax, r8
sub rax, rdx
xor edx, edx
div r8
jmp 0x1400a4bcb
neg rdx
sub r8, rdx
cmp r8, r11
jb 0x1400a4bda
lea rax, [rsi + r11]
mov qword [rdi], rax
mov rax, qword [r10 + 0x88]
xor edx, edx
mov ecx, dword [r10 + 0xb0]
mov rax, qword [rax + 8]
div rcx
mov dword [r10 + 0xc0], eax
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
pop rdi
ret
lea rdx, str.ALStreamFrameAccessorAudio::Release_failed__invalid_parameter_n
mov ecx, 1
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
pop rdi
jmp fcn.1400a0080

Function at 0x1400a8cd0
Capabilities:
Resume thread
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov r8d, dword [rcx + 0x40]
lea rdx, str.ALThreadMonitorIddCxNoOp::Start_m_AdapterConnectorIndex:_d_n
mov rbx, rcx
mov ecx, 4
call fcn.1400a0080
lea rdx, [rbx + 0x70]
mov rcx, rbx
call fcn.1400a8e50
test al, al
jne 0x1400a8d1b
mov r8d, dword [rbx + 0x40]
lea rdx, str.ALThreadMonitorIddCxNoOp::Start_failed__PrivateInitialize_m_AdapterConnectorIndex:_d_n
mov ecx, 4
call fcn.1400a0080
xor al, al
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400a0ab0
Function at 0x1400a8d70
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x40]
lea rdx, str.ALThreadMonitorIddCxNoOp::Run_AdapterConnectorIndex:_d_n
mov rbx, rcx
mov ecx, 4
call fcn.1400a0080
mov rcx, qword [rbx + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400a8dc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [rbx + 0x40]
lea rdx, str.ALThreadMonitorIddCxNoOp::Run_failed__WaitForSingleObject_AdapterConnectorIndex:_d_Error:_d_n
mov r9d, eax
mov ecx, 4
call fcn.1400a0080
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x1400a8de0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x80], 0
mov byte [rbx + 0xa8], 0
mov eax, dword [rbx + 0x58]
mov rcx, qword [rbx + 0x60]
test eax, eax
jne 0x1400a8e11
mov edx, dword [rbx + 0x74]
call fcn.14009f010
test al, al
jne 0x1400a8e24
lea rdx, str.ALMonitorIddCx::Unplug_DeviceControl.IoctlMonitorUnplug_failed__n
mov ecx, 1
call fcn.1400a0080
jmp 0x1400a8e24
cmp eax, 2
mov rdx, rcx
lea rcx, [rbx + 0x70]
sete r8b
call fcn.1400aacf0
mov r8d, dword [rbx + 0x40]
lea rdx, str.ALThreadMonitorIddCxNoOp::Run_exit..._AdapterConnectorIndex:_d_n
mov ecx, 4
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400a0080

Function at 0x1400ab7f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x2058
call fcn.1402aba50
sub rsp, rax
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x2030], rax
test dword [0x14046e6e8], ecx
je 0x1400ab90d
mov qword [rsp + 0x2050], rbx
mov qword [rsp + 0x2048], rsi
mov qword [rsp + 0x2040], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, ebx
lea rdx, str.SE___04d:_04d_:
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.140093970
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
lea rsi, [rsp + 0x2070]
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400ab880
mov edi, 0x1000
lea rbx, [rsp + 0x30]
sub rdi, rax
lea rbx, [rbx + rax*2]
call fcn.140092a40
mov r9, qword [rsp + 0x2068]
mov r8, rdi
mov qword [rsp + 0x28], rsi
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
call fcn.1402b828c
mov rax, qword [0x14046e6e0]
lea rcx, [rsp + 0x30]
mov rdi, qword [rsp + 0x2040]
mov rsi, qword [rsp + 0x2048]
mov rbx, qword [rsp + 0x2050]
test rax, rax
je 0x1400ab907
call rax
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x2058
ret
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x2058
ret

Function at 0x1400abfc0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
xor eax, eax
add rcx, 8
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [rax + 7]
call fcn.1400ac6e0
test al, al
jne 0x1400abffb
lea rdx, str.Server::RaiseEvtDisplayChanged_failed___n
mov ecx, 1
add rsp, 0x38
jmp fcn.1400ab7f0
add rsp, 0x38
ret
Function at 0x1400ac000
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor r9d, r9d
mov rdi, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
jne 0x1400ac040
lea rdx, str.Server::RaiseEvtPowerSuspended_CreateEvent_failed___n
lea ecx, [rax + 1]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400ab7f0
mov qword [rsp + 0x40], rsi
lea rcx, [rdi + 8]
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea edx, [rsi + 9]
call fcn.1400ac6e0
test al, al
jne 0x1400ac078
lea rdx, str.Server::RaiseEvtPowerSuspended_failed__m_ThreadMainEventHandler.CommandSubmit__1__n
lea ecx, [rsi + 1]
call fcn.1400ab7f0
jmp 0x1400ac0e3
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8, rbx
mov qword [rsp + 0x20], rsi
lea rcx, [rdi + 8]
lea edx, [r9 + 0xb]
call fcn.1400ac6e0
test al, al
jne 0x1400ac0ac
lea rdx, str.Server::RaiseEvtPowerSuspended_failed__m_ThreadMainEventHandler.CommandSubmit__2__n
mov ecx, 1
call fcn.1400ab7f0
jmp 0x1400ac0e3
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400ac0c9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x1400ac0e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.SEServer::RaiseEvtPowerSuspended_WaitForSingleObject_failed___d_n
mov ecx, 1
mov r8d, eax
call fcn.1400ab7f0
mov rcx, rbx
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]

Function at 0x1400ac100
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
xor eax, eax
add rcx, 8
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [rax + 0xa]
call fcn.1400ac6e0
test al, al
jne 0x1400ac13b
lea rdx, str.SEServer::RaiseEvtPowerResumed_failed__n
mov ecx, 1
add rsp, 0x38
jmp fcn.1400ab7f0
add rsp, 0x38
ret

Function at 0x1400ac2e0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
xor eax, eax
add rcx, 8
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [rax + 0x17]
call fcn.1400ac6e0
test al, al
jne 0x1400ac31b
lea rdx, str.SEServer::SettingsClear_failed__n
mov ecx, 1
add rsp, 0x38
jmp fcn.1400ab7f0
add rsp, 0x38
ret

Function at 0x1400ac320
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
xor eax, eax
add rcx, 8
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.1400ac6e0
test al, al
jne 0x1400ac35a
lea rdx, str.SEServer::TrayAppStarted_failed__n
mov ecx, 1
add rsp, 0x38
jmp fcn.1400ab7f0
add rsp, 0x38
ret

Function at 0x1400ac360
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
xor eax, eax
add rcx, 8
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [rax + 1]
call fcn.1400ac6e0
test al, al
jne 0x1400ac39b
lea rdx, str.SEServer::TrayAppStopped_failed__n
mov ecx, 1
add rsp, 0x38
jmp fcn.1400ab7f0
add rsp, 0x38
ret
Function at 0x1400b0510
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
xor eax, eax
mov r9d, r8d
mov qword [rsp + 0x28], rax
mov rbx, rdx
mov qword [rsp + 0x20], rax
mov r8, rdx
lea edx, [rax + 6]
call fcn.1400ac6e0
test al, al
jne 0x1400b055d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
lea rdx, str.SECommunicationEvents::Disconnected_m_ThreadMainEventHandler.CommandSubmit_failed___s_n
mov ecx, 1
mov r8, rax
add rsp, 0x30
pop rbx
jmp fcn.1400ab7f0
add rsp, 0x30
pop rbx
ret

Function at 0x1400b0570
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
test r8d, r8d
jne 0x1400b05b0
mov rcx, qword [rcx + 8]
xor eax, eax
mov r8, rdx
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea edx, [rax + 0x16]
call fcn.1400ac6e0
test al, al
jne 0x1400b05b0
lea rdx, str.SECommunicationEvents::ConnectionConditionChange_m_ThreadMainEventHandler.CommandSubmit_failed__n
mov ecx, 1
add rsp, 0x38
jmp fcn.1400ab7f0
add rsp, 0x38
ret

Function at 0x1400b0670
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
xor eax, eax
mov r9d, r8d
mov qword [rsp + 0x28], rax
mov rbx, rdx
mov qword [rsp + 0x20], rax
mov r8, rdx
lea edx, [rax + 0x15]
call fcn.1400ac6e0
test al, al
jne 0x1400b06bd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
lea rdx, str.SECommunicationEvents::Disconnected_m_ThreadMainEventHandler.CommandSubmit_failed__Deleting__s_n
mov ecx, 1
mov r8, rax
add rsp, 0x30
pop rbx
jmp fcn.1400ab7f0
add rsp, 0x30
pop rbx
ret

Function at 0x1400b06d0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
xor eax, eax
mov rbx, rdx
mov qword [rsp + 0x28], rax
mov r8, rdx
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea edx, [rax + 0xd]
call fcn.1400ac6e0
test al, al
jne 0x1400b071d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
lea rdx, str.SECommunicationEvents::RotationChanged_failed___s_n
mov ecx, 1
mov r8, rax
add rsp, 0x30
pop rbx
jmp fcn.1400ab7f0
add rsp, 0x30
pop rbx
ret

Function at 0x1400b08a0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 8]
mov rax, rdx
movzx edx, r9b
xor r9d, r9d
mov qword [rsp + 0x28], r9
xor edx, 1
mov qword [rsp + 0x20], r9
add edx, 0xf
mov r9d, r8d
mov r8, rax
call fcn.1400ac6e0
test al, al
jne 0x1400b08e6
lea rdx, str.SECommunicationEvents::InputKeyboardSoftware_failed__n
mov ecx, 1
add rsp, 0x38
jmp fcn.1400ab7f0
add rsp, 0x38
ret
Function at 0x1400b0ca0
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov rbx, rcx
mov qword [rsp + 0x28], rax
mov r9, rcx
mov dword [rsp + 0x20], 4
lea r8, [0x1400b0d90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x1400b0d0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.SEThreadBase::Start_CreateThread_failed._LastError__d
lea ecx, [rdi + 1]
call fcn.1400ab7f0
xor al, al
jmp 0x1400b0d6e
lea rcx, [rbx + 8]
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rbx + 0x30], 0
lea rcx, [rbx + 8]
jne 0x1400b0d48
mov eax, dword [rsp + 0x30]
mov qword [rbx + 0x30], rdi
mov dil, 1
mov dword [rbx + 0x38], eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1400b0d65
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor dil, dil
mov rsi, qword [rsp + 0x58]
movzx eax, dil
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402ab320
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400b1590
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r9
mov dword [rsp + 0x38], 4
mov rbx, r8
lea rax, [rsp + 0x30]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdi, rdx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400b15fa
mov r9d, eax
lea rdx, str.SEUtilRegistryValueGet_RegOpenKeyEx_failed___s__d_n
mov r8, rdi
mov ecx, 1
call fcn.1400ab7f0
xor al, al
jmp 0x1400b16a7
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400b1669
mov r8, rbx
mov ecx, 1
cmp eax, 2
jne 0x1400b164b
lea rdx, str.SEUtilRegistryValueGet_RegQueryValueExW_failed___s_ERROR_FILE_NOT_FOUND_n
call fcn.1400ab7f0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1400b16a7
mov r9d, eax
lea rdx, str.SEUtilRegistryValueGet_RegQueryValueExW_failed___s__d_n
call fcn.1400ab7f0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1400b16a7
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x40], 1
mov r9, rbx
mov r8, rdi
mov ecx, 0x400
jne 0x1400b1699
lea rdx, str.SEUtilRegistryValueGet_RegQueryValueExW__s__s_Data:__s_n
mov qword [rsp + 0x20], rsi
call fcn.1400ab7f0
jmp 0x1400b16a5
lea rdx, str.SEUtilRegistryValueGet_RegQueryValueExW__s__s_n
call fcn.1400ab7f0
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b16c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r9
lea rax, [rsp + 0x38]
mov rdi, r8
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rbx, rdx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400b1722
mov r9d, eax
lea rdx, str.SEUtilRegistryValueStringGet_RegOpenKeyEx_failed___s__d_n
mov r8, rbx
mov ecx, 1
call fcn.1400ab7f0
xor al, al
jmp 0x1400b182b
xor ecx, ecx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov dword [rsp + 0x30], ecx
mov rdx, rdi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400b177a
mov r9d, eax
lea rdx, str.SEUtilRegistryValueStringGet_RegQueryValueExW__1__failed___s__d_n
mov r8, rdi
mov ecx, 1
call fcn.1400ab7f0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1400b182b
mov r8d, dword [rsp + 0x40]
cmp r8d, 1
je 0x1400b17a8
lea rdx, str.SEUtilRegistryValueStringGet_failed__Invalid_value_type:__d_n
mov ecx, 1
call fcn.1400ab7f0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1400b182b
mov ecx, dword [rsp + 0x30]
call fcn.1402ab3b0
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
mov rbx, rax
xor r8d, r8d
lea rax, [rsp + 0x30]
mov rdx, rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400b180b
mov r9d, eax
lea rdx, str.SEUtilRegistryValueStringGet_RegQueryValueExW__2__failed___s__d_n
mov r8, rdi
mov ecx, 1
call fcn.1400ab7f0
mov rcx, rbx
call fcn.1402ab340
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1400b182b
mov rdx, rbx
mov rcx, rsi
call fcn.14008fef0
mov rcx, rbx
call fcn.1402ab340
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b1840
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, qword [rsp + 0x80]
mov rdi, r8
mov ebp, r9d
cmp r9d, 1
mov r9, rdi
mov rbx, rdx
mov r8, rdx
mov ecx, 0x400
jne 0x1400b1890
lea rdx, str.SEUtilRegistryValueSet__Path:__s_Value:__s_Data:__s_n
mov qword [rsp + 0x20], rsi
call fcn.1400ab7f0
jmp 0x1400b189c
lea rdx, str.SEUtilRegistryValueSet_Path:__s_Value:__s_n
call fcn.1400ab7f0
lea rax, [rsp + 0x30]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400b18de
mov r9d, eax
lea rdx, str.SEUtilRegistryValueSet_RegOpenKeyEx_failed___s__d_n
mov r8, rbx
mov ecx, 1
call fcn.1400ab7f0
xor al, al
jmp 0x1400b1939
mov eax, dword [rsp + 0x88]
mov r9d, ebp
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400b192c
mov r9d, eax
lea rdx, str.SEUtilRegistryValueSet_RegSetValueExW_failed___s__d_n
mov r8, rdi
mov ecx, 1
call fcn.1400ab7f0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1400b1939
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402ab320
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400b1960
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov r9d, 2
mov rcx, 0xffffffff80000002
mov rdi, rdx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400b19be
mov r9d, eax
lea rdx, str.SEUtilRegistryValueDelete_RegOpenKeyEx_failed___s__d_n
mov r8, rdi
mov ecx, 1
call fcn.1400ab7f0
xor al, al
jmp 0x1400b1a03
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x1400b19f6
mov r9d, eax
lea rdx, str.SEUtilRegistryValueDelete_RegDeleteValue_failed___s__d_n
mov r8, rbx
mov ecx, 1
call fcn.1400ab7f0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1400b1a03
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402ab320
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret