joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a2f0
Capabilities:
Print debug messages

Disassembly:
jmp 0x14000a520
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13e0]
mov eax, 0x14e0
call fcn.14001a240
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rbp + 0x13d0], rax
mov r14, r8
mov esi, edx
mov r15, rcx
mov rdi, qword [rbp + 0x1448]
xor r12d, r12d
mov word [rbp + 0x3d0], r12w
mov byte [rbp - 0x30], r12b
mov rdx, qword [rbp + 0x1450]
mov ecx, dword [rdx]
mov dword [rsp + 0x38], ecx
mov eax, dword [rdx + 4]
mov dword [rsp + 0x3c], eax
call fcn.140004c60
mov ebx, eax
mov r8d, 1
mov dword [rsp + 0x30], r8d
mov ecx, r12d
mov eax, 8
cmp byte [rdx + 8], cl
cmovne ecx, eax
mov dword [rsp + 0x34], ecx
lock xadd dword [0x140070110], r8d
inc r8d
mov dword [rsp + 0x40], r8d
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x74], ebx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], r15
xor eax, eax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov rax, qword [0x1400701c8]
test rax, rax
je 0x14000a622
call rax
mov qword [rbp - 0x50], rax
jmp 0x14000a626
mov qword [rbp - 0x50], r12
mov rax, qword [0x1400701d8]
test rax, rax
je 0x14000a643
mov r8d, 0x400
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x30]
call rax
mov rax, qword [0x1400701d0]
test rax, rax
je 0x14000a656
lea rcx, [rsp + 0x30]
call rax
mov rax, qword [0x140070190]
test rax, rax
je 0x14000a669
lea rcx, [rsp + 0x30]
call rax
cmp dword [rsp + 0x38], r12d
jge 0x14000a754
cmp byte [0x140070201], r12b
jne 0x14000a6c5
mov rax, qword [0x140070208]
test rax, rax
je 0x14000a691
call rax
movzx r12d, al
jmp 0x14000a69d
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
jne 0x14000a6c5
mov rax, qword [0x140070210]
test rax, rax
je 0x14000a71b
cmp byte [0x1400701f0], r12b
jne 0x14000a71b
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call rax
jmp 0x14000a71b
mov rax, qword [0x140070210]
test rax, rax
je 0x14000a6ee
cmp byte [0x1400701f0], 0
jne 0x14000a6ee
mov r8d, 0x800
lea rdx, [rbp + 0x3d0]
lea rcx, [rsp + 0x30]
call rax
cmp word [rbp + 0x3d0], 0
jne 0x14000a70e
lea r8, [rsp + 0x30]
mov edx, 0x800
lea rcx, [rbp + 0x3d0]
call fcn.1400048d0
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x140070200], 0
je 0x14000a733
mov rax, qword [0x1400701c0]
test rax, rax
je 0x14000a733
call rax
nop
mov rcx, qword [rbp + 0x13d0]
xor rcx, rsp
call fcn.140019840
add rsp, 0x14e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140006060
nop
int3
Function at 0x14000a520
Capabilities:
Print debug messages

Disassembly:
jmp 0x14000a520
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13e0]
mov eax, 0x14e0
call fcn.14001a240
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rbp + 0x13d0], rax
mov r14, r8
mov esi, edx
mov r15, rcx
mov rdi, qword [rbp + 0x1448]
xor r12d, r12d
mov word [rbp + 0x3d0], r12w
mov byte [rbp - 0x30], r12b
mov rdx, qword [rbp + 0x1450]
mov ecx, dword [rdx]
mov dword [rsp + 0x38], ecx
mov eax, dword [rdx + 4]
mov dword [rsp + 0x3c], eax
call fcn.140004c60
mov ebx, eax
mov r8d, 1
mov dword [rsp + 0x30], r8d
mov ecx, r12d
mov eax, 8
cmp byte [rdx + 8], cl
cmovne ecx, eax
mov dword [rsp + 0x34], ecx
lock xadd dword [0x140070110], r8d
inc r8d
mov dword [rsp + 0x40], r8d
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x74], ebx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], r15
xor eax, eax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov rax, qword [0x1400701c8]
test rax, rax
je 0x14000a622
call rax
mov qword [rbp - 0x50], rax
jmp 0x14000a626
mov qword [rbp - 0x50], r12
mov rax, qword [0x1400701d8]
test rax, rax
je 0x14000a643
mov r8d, 0x400
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x30]
call rax
mov rax, qword [0x1400701d0]
test rax, rax
je 0x14000a656
lea rcx, [rsp + 0x30]
call rax
mov rax, qword [0x140070190]
test rax, rax
je 0x14000a669
lea rcx, [rsp + 0x30]
call rax
cmp dword [rsp + 0x38], r12d
jge 0x14000a754
cmp byte [0x140070201], r12b
jne 0x14000a6c5
mov rax, qword [0x140070208]
test rax, rax
je 0x14000a691
call rax
movzx r12d, al
jmp 0x14000a69d
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
jne 0x14000a6c5
mov rax, qword [0x140070210]
test rax, rax
je 0x14000a71b
cmp byte [0x1400701f0], r12b
jne 0x14000a71b
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call rax
jmp 0x14000a71b
mov rax, qword [0x140070210]
test rax, rax
je 0x14000a6ee
cmp byte [0x1400701f0], 0
jne 0x14000a6ee
mov r8d, 0x800
lea rdx, [rbp + 0x3d0]
lea rcx, [rsp + 0x30]
call rax
cmp word [rbp + 0x3d0], 0
jne 0x14000a70e
lea r8, [rsp + 0x30]
mov edx, 0x800
lea rcx, [rbp + 0x3d0]
call fcn.1400048d0
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x140070200], 0
je 0x14000a733
mov rax, qword [0x1400701c0]
test rax, rax
je 0x14000a733
call rax
nop
mov rcx, qword [rbp + 0x13d0]
xor rcx, rsp
call fcn.140019840
add rsp, 0x14e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140006060
nop
int3
Function at 0x14000d070
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
test byte [rcx + 0x290], 4
mov rbx, rcx
je 0x14000d08f
lea rcx, str.Enter_Metering::Metering_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbx + 0x390]
test rcx, rcx
je 0x14000d0a1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx + 0x300]
test rcx, rcx
je 0x14000d0b3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x2e0]
test rcx, rcx
je 0x14000d0c5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x320]
mov qword [rbx + 0x390], 0
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [rbx + 0x348]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
test byte [rbx + 0x290], 4
je 0x14000d100
lea rcx, str.Leave_Metering::Metering_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000d115
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov qword [rbx], 0
mov rcx, qword [rbx + 0x3a8]
test rcx, rcx
je 0x14000d127
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbx + 0x3a0]
test rcx, rcx
je 0x14000d139
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, vtable.RpcServer::CM_MMEndpointNotify.0
mov qword [rbx + 0x2d8], 0
lea rcx, [rbx + 0x2a8]
mov qword [rbx + 0x2a0], rax
call fcn.14000a760
lea rcx, [rbx + 8]
add rsp, 0x20
pop rbx
jmp fcn.1400166d0
Function at 0x14000e0f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xf90]
mov eax, 0x1090
call fcn.14001a240
sub rsp, rax
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rbp + 0xf80], rax
mov rbx, r8
mov esi, edx
mov rdi, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x80]
call fcn.14001cd80
lea r14, [rbp + 0xfd8]
call fcn.140004740
mov qword [rsp + 0x30], r14
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x28], 0
mov r9, 0xffffffffffffffff
mov r8d, 0x400
mov qword [rsp + 0x20], rbx
mov rcx, qword [rax]
call fcn.140028db8
test dword [rdi + 0x290], esi
je 0x14000e189
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
test sil, 1
je 0x14000e1cd
lea r8, str.ZONE_ERROR
lea edx, [rax + 0x40]
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 2
je 0x14000e1e9
lea r8, str.ZONE_WARN
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 4
je 0x14000e205
lea r8, str.ZONE_FUNCTION
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 8
je 0x14000e221
lea r8, str.ZONE_VERBOSE
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 0x10
je 0x14000e23d
lea r8, str.ZONE_EVENT
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, 0x40
je 0x14000e259
lea r8, str.ZONE_GET
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
test sil, sil
jns 0x14000e274
lea r8, str.ZONE_SRVEVENT
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
bt esi, 8
jae 0x14000e290
lea r8, str.ZONE_VERBOSE_2
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
bt esi, 9
jae 0x14000e2ac
lea r8, str.ZONE_EVENTLOG
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
bt esi, 0xa
jae 0x14000e2c8
lea r8, str.ZONE_EVENTLOG_VERBOSE_2
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002050
xor edx, edx
lea rcx, [rbp + 0x780]
mov r8d, 0x800
call fcn.14001cd80
lea rax, [rbp - 0x80]
mov edx, 0x800
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, str._Metering__s::_s
lea rcx, [rbp + 0x780]
call fcn.140002050
mov rcx, qword [rbp + 0xf80]
xor rcx, rsp
call fcn.140019840
add rsp, 0x1090
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000e320
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rbx, r8
lea rcx, [rsp + 0x60]
mov edi, edx
mov r8d, 0x800
xor edx, edx
call fcn.14001cd80
lea rsi, [rsp + 0x8a8]
call fcn.140004740
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x60]
xor esi, esi
mov r8d, 0x400
mov qword [rsp + 0x28], rsi
mov rcx, qword [rax]
mov qword [rsp + 0x20], rbx
lea r9, [rsi - 1]
call fcn.140028db8
lea rdx, str.FMService_EventLog
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14000e3ee
mov qword [rsp + 0x40], rsi
lea edx, [rsi + 1]
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x50], rcx
xor r9d, r9d
lea rcx, [0x14005b2b0]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov rcx, rax
mov dword [rsp + 0x30], esi
mov word [rsp + 0x28], dx
movzx edx, di
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140019840
add rsp, 0x870
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000e980
Capabilities:
Print debug messages
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0x898
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x870], rax
test byte [rcx + 0x290], 4
mov qword [r11 + 0x10], rbx
mov rbx, qword [rcx + 0x3a0]
mov qword [r11 + 0x18], rbp
mov qword [r11 - 0x10], rdi
mov rdi, rcx
mov qword [r11 - 0x18], r14
je 0x14000e9e0
lea r8, str.Enter_Metering::SetDefaultFunction_r_n
mov edx, 0x400
lea rcx, [rsp + 0x70]
call fcn.140002050
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r14d, r14d
mov ebp, r14d
cmp dword [rdi + 0x3b0], r14d
jbe 0x14000eb39
mov qword [rsp + 0x890], rsi
nop dword [rax + rax]
test rbx, rbx
je 0x14000eb1c
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r14w
jne 0x14000ea10
test rax, rax
je 0x14000eb1c
mov r8d, dword [rbx + 0x108]
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
call fcn.140010b60
mov r8d, dword [rbx + 0x10c]
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
call fcn.140011100
mov eax, dword [rbx + 0x120]
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x60], eax
call fcn.14000bcd0
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
test eax, eax
je 0x14000eaa1
movups xmm0, xmmword [0x14005b028]
mov r8d, dword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x384
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x20], rax
call fcn.14000be10
jmp 0x14000eb1c
lea r8, [rsp + 0x40]
call fcn.1400100e0
test al, al
je 0x14000eb1c
xor edx, edx
lea rcx, [rsp + 0x470]
mov r8d, 0x400
call fcn.14001cd80
mov r9d, 0x384
lea r8, str.2b24be42_a892_11dc_8314_0800200c9a66__d
lea rcx, [rsp + 0x470]
lea edx, [r9 + 0x7c]
call fcn.140002050
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
mov rcx, rsi
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x470]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rbx, 0x124
inc ebp
cmp ebp, dword [rdi + 0x3b0]
jb 0x14000ea00
mov rsi, qword [rsp + 0x890]
mov rbx, qword [rdi + 0x3a8]
mov rbp, qword [rsp + 0x8b0]
cmp dword [rdi + 0x3b4], r14d
jbe 0x14000ebc4
test rbx, rbx
je 0x14000ebb1
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000eb60
test rax, rax
je 0x14000ebb1
mov r8d, dword [rbx + 0x108]
mov r9d, 1
mov rdx, rbx
mov rcx, rdi
call fcn.140010b60
mov r8d, dword [rbx + 0x10c]
mov r9d, 1
mov rdx, rbx
mov rcx, rdi
call fcn.140011100
mov r8d, dword [rbx + 0x10c]
mov rdx, rbx
mov rcx, rdi
call fcn.1400113e0
add rbx, 0x124
inc r14d
cmp r14d, dword [rdi + 0x3b4]
jb 0x14000eb51
test byte [rdi + 0x290], 4
mov rdi, qword [rsp + 0x888]
mov r14, qword [rsp + 0x880]
mov rbx, qword [rsp + 0x8a8]
je 0x14000ec06
lea r8, str.Leave_Metering::SetDefaultFunction_r_n
mov edx, 0x400
lea rcx, [rsp + 0x70]
call fcn.140002050
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov al, 1
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.140019840
add rsp, 0x898
ret
Function at 0x1400100e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov qword [rsp + 0x30], 0
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test r9d, r9d
jne 0x140010124
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioCapture
jmp 0x140010135
cmp r9d, 1
jne 0x1400101ea
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.140031158
lea r8, [0x14005d4c0]
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.1400310d4
mov r8, rsi
lea rcx, [rsp + 0x40]
mov edx, 0x200
call fcn.1400310d4
lea r8, str.FxProperties
mov edx, 0x200
lea rcx, [rsp + 0x40]
call fcn.1400310d4
lea rax, [rsp + 0x30]
mov r9d, 0x2001b
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400101b7
mov rax, qword [rsp + 0x30]
mov qword [rbx], rax
mov al, 1
jmp 0x1400101ec
test byte [rdi + 0x290], 1
je 0x1400101ea
mov r9d, eax
lea r8, str.Cannot_Open_FxProperty_Key__x_r_n
mov edx, 0x400
lea rcx, [rsp + 0x440]
call fcn.140002050
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140019840
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140010220
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r8d
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rsi, rcx
call fcn.14000bcd0
mov r9d, edi
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x140010291
movups xmm0, xmmword [0x14005b028]
mov r8d, dword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x384
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.14000be10
test eax, eax
setne al
jmp 0x1400102e8
lea r8, [rsp + 0x40]
call fcn.1400100e0
test al, al
je 0x1400102e6
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_900
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
test eax, eax
jne 0x1400102e0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1400102e8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140019840
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x140010300
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov edi, r9d
mov r8d, r9d
mov rbx, rdx
mov rbp, rcx
call fcn.14000bcd0
mov r9d, edi
mov rdx, rbx
mov rcx, rbp
test eax, eax
je 0x140010371
movups xmm0, xmmword [0x14005b028]
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x384
mov r8, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rax
call fcn.14000c0d0
test eax, eax
setne al
jmp 0x1400103d5
lea r8, [rsp + 0x40]
mov dword [rsp + 0x50], 4
call fcn.1400100e0
test al, al
je 0x1400103d3
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.2b24be42_a892_11dc_8314_0800200c9a66_900
lea rax, [rsp + 0x54]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
jne 0x1400103cd
mov eax, dword [rsp + 0x54]
mov dword [rsi], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1400103d5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140019840
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140010400
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x4c8
movaps xmmword [rsp + 0x4b0], xmm6
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
movaps xmm6, xmmword [r8]
mov r14d, r9d
mov edi, dword [rsp + 0x518]
mov rbx, rdx
mov r8d, edi
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rcx
call fcn.14000bcd0
mov r9d, edi
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x140010492
mov r8d, dword [rsp + 0x510]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
movdqa xmmword [rsp + 0x80], xmm6
call fcn.14000be10
test eax, eax
setne al
jmp 0x1400105c2
lea r8, [rsp + 0x90]
call fcn.1400100e0
test al, al
je 0x1400105c0
xor edx, edx
mov qword [rsp + 0x4c0], rbp
mov r8d, 0x400
lea rcx, [rsp + 0xa0]
call fcn.14001cd80
movzx r9d, byte [rsp + 0x8c]
mov edx, 0x400
movzx eax, byte [rsp + 0x8f]
movzx ecx, byte [rsp + 0x8e]
movzx r8d, byte [rsp + 0x8d]
movzx r10d, byte [rsp + 0x8b]
movzx r11d, byte [rsp + 0x8a]
movzx ebx, byte [rsp + 0x89]
movzx edi, byte [rsp + 0x88]
movzx esi, word [rsp + 0x86]
movzx ebp, word [rsp + 0x84]
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x58], r8d
lea r8, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X__d
mov dword [rsp + 0x50], r9d
mov r9d, dword [rsp + 0x80]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call fcn.140002050
mov rbx, qword [rsp + 0x90]
lea rax, [rsp + 0x510]
mov rcx, rbx
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbp, qword [rsp + 0x4c0]
mov rcx, rbx
test eax, eax
jne 0x1400105ba
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1400105c2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.140019840
movaps xmm6, xmmword [rsp + 0x4b0]
add rsp, 0x4c8
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400105f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x3c8]
sub rsp, 0x4c8
movaps xmmword [rsp + 0x4b0], xmm6
mov rax, qword [0x14006c038]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
movaps xmm6, xmmword [r8]
mov r12d, r9d
mov edi, dword [rbp + 0x428]
mov rbx, rdx
mov r15, qword [rbp + 0x420]
mov r8d, edi
movaps xmmword [rbp - 0x80], xmm6
mov rsi, rcx
call fcn.14000bcd0
mov r9d, edi
mov rdx, rbx
mov rcx, rsi
test eax, eax
je 0x140010681
mov dword [rsp + 0x30], 1
lea rax, [rbp - 0x80]
mov dword [rsp + 0x28], r12d
mov r8, r15
mov qword [rsp + 0x20], rax
movdqa xmmword [rbp - 0x80], xmm6
call fcn.14000c0d0
test eax, eax
setne al
jmp 0x140010782
lea r8, [rbp - 0x70]
mov dword [rbp - 0x68], 4
call fcn.1400100e0
test al, al
je 0x140010780
xor edx, edx
mov qword [rsp + 0x4c0], r14
mov r8d, 0x400
lea rcx, [rbp - 0x60]
call fcn.14001cd80
movzx r9d, byte [rbp - 0x74]
mov edx, 0x400
movzx eax, byte [rbp - 0x71]
movzx ecx, byte [rbp - 0x72]
movzx r8d, byte [rbp - 0x73]
movzx r10d, byte [rbp - 0x75]
movzx r11d, byte [rbp - 0x76]
movzx ebx, byte [rbp - 0x77]
movzx edi, byte [rbp - 0x78]
movzx esi, word [rbp - 0x7a]
movzx r14d, word [rbp - 0x7c]
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
lea rcx, [rbp - 0x60]
mov dword [rsp + 0x58], r8d
lea r8, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X__d
mov dword [rsp + 0x50], r9d
mov r9d, dword [rbp - 0x80]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
call fcn.140002050
mov rbx, qword [rbp - 0x70]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x64]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14, qword [rsp + 0x4c0]
test eax, eax
jne 0x140010777
test r15, r15
je 0x14001076a
mov eax, dword [rbp - 0x64]
mov dword [r15], eax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140010782
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140019840
movaps xmm6, xmmword [rsp + 0x4b0]
add rsp, 0x4c8
pop r15
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret