joyce8/EMBER2024-capa huggingface dataset:
Function at 0x251f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x390
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov r14, rcx
xor ebx, ebx
lea rcx, [r11 - 0x256]
xor edx, edx
mov r8d, 0x21a
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x160], bx
call fcn.0003b290
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0xee
mov word [rsp + 0x70], bx
call fcn.0003b290
lea rcx, [0x0003d470]
call fcn.0001ebf8
mov r12, rax
cmp rax, rbx
jne 0x2527c
xor al, al
jmp 0x25437
lea rcx, [rsp + 0x50]
mov rdx, r14
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r15d, 1
mov edx, 0x810
mov ecx, r15d
call fcn.00036578
mov rsi, rax
cmp rax, rbx
je 0x2542c
mov r13d, ebx
xor edx, edx
lea rax, [rsp + 0x30]
mov r9, rsi
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, r12
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, ebx
jl 0x25424
add r13d, r15d
cmp dword [rsi + 4], r15d
jne 0x25419
movzx edi, word [rsi + 8]
lea rbp, [rsi + 0xc]
mov word [rsp + 0x40], di
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x42], di
cmp di, 2
jbe 0x253d1
cmp word [rbp], 0x21
jne 0x253d1
lea rdx, [0x0003d480]
lea rcx, [rsp + 0x40]
call fcn.000367b4
cmp al, bl
je 0x25332
mov rcx, r14
call fcn.000334e4
jmp 0x25415
cmp word [rbp], 0x21
jne 0x253d1
mov eax, 0xee
mov word [rsp + 0x70], bx
mov word [rsp + 0x160], bx
cmp di, ax
jae 0x25374
movzx edi, di
lea rdx, [rbp + 2]
lea rcx, [rsp + 0x70]
add rdi, 0xfffffffffffffffe
mov r8, rdi
call fcn.0003ad40
shr rdi, 1
mov word [rsp + rdi*2 + 0x70], bx
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x70]
mov r8d, 0x10e
call fcn.00026564
cmp al, bl
je 0x25419
cmp word [rsp + 0x160], bx
je 0x25415
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x160]
repne scasw ax, word [rdi]
mov rdx, r14
not rcx
sub rcx, r15
mov r8, rcx
lea rcx, [rsp + 0x160]
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
cmp eax, ebx
je 0x25421
mov al, bl
jmp 0x25415
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
cmp di, r15w
jbe 0x25402
cmp di, word [rsp + 0x50]
jbe 0x25402
movzx eax, di
shr eax, 1
sub eax, r15d
cmp word [rbp + rax*2], 0x5c
jne 0x25402
sub di, 2
mov word [rsp + 0x60], di
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov r8b, r15b
call qword [sym.imp.ntoskrnl.exe_RtlPrefixUnicodeString]
cmp al, bl
jne 0x25421
mov edx, r13d
jmp 0x252ae
mov bl, r15b
mov rcx, rsi
call fcn.000365f0
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.0003ac70
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x25470
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x50
cmp word [rcx], 0x21
mov rsi, rcx
jne 0x25502
lea rcx, [0x0003d470]
call fcn.0001ebf8
xor ebx, ebx
mov rbp, rax
cmp rax, rbx
jne 0x254b2
mov eax, 0xc000014d
jmp 0x255ed
lea rcx, [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
lea rdx, [rsp + 0x30]
mov r9d, 1
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, rbp
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x255eb
mov edx, 0x800
mov ecx, 1
call fcn.00036578
xor ebx, ebx
mov rbp, rax
cmp rax, rbx
jne 0x25525
mov eax, 0xc000009a
jmp 0x255ed
cmp word [rsi], bx
jne 0x25534
mov edi, 0xc000003b
jmp 0x255e3
mov r8d, 0x400
mov rdx, rax
mov rcx, rsi
call fcn.00033110
cmp eax, ebx
mov edi, eax
jl 0x255e3
or rcx, 0xffffffffffffffff
lea rdx, [0x0003d030]
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
cmp eax, ebx
jne 0x2557d
mov edi, 0xc0000039
jmp 0x255e3
lea rcx, [0x0003d470]
call fcn.0001ebf8
mov r12, rax
cmp rax, rbx
jne 0x25598
mov edi, 0xc000014d
jmp 0x255e3
lea rcx, [rsp + 0x40]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
lea rdx, [rsp + 0x40]
mov r9d, 1
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, r12
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, rbp
call fcn.000365f0
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
Function at 0x25610
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rdx, rcx
xor r13d, r13d
lea rcx, [rax - 0x38]
mov dword [rax + 0x10], r13d
mov dword [rax + 0x18], r13d
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [0x0003d470]
call fcn.0001ebf8
mov rdi, rax
cmp rax, r13
jne 0x25658
mov eax, 0xc000014d
jmp 0x257c5
mov edx, 0x810
mov ecx, 1
call fcn.00036578
mov rbp, rax
cmp rax, r13
jne 0x25682
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000009a
jmp 0x257c5
mov edx, 0x418
mov ecx, 1
call fcn.00036578
mov rsi, rax
cmp rax, r13
jne 0x256a3
mov ebx, 0xc000009a
jmp 0x257b2
mov ebx, 0xc0000001
mov r12d, r13d
xor edx, edx
jmp 0x2577d
inc r12d
cmp dword [rbp + 4], 1
jne 0x2577a
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x28], rax
mov r9, rsi
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jl 0x2577a
cmp dword [rsi + 0xc], r13d
je 0x2577a
mov edx, dword [rsi + 8]
add rdx, rsi
mov qword [rsp + 0x38], rdx
movzx ecx, word [rsi + 0xc]
mov word [rsp + 0x30], cx
movzx eax, word [rsi + 0xc]
mov word [rsp + 0x32], ax
cmp cx, 2
jbe 0x2574b
movzx eax, cx
shr rax, 1
cmp word [rdx + rax*2 - 2], r13w
jne 0x2574b
mov eax, 0xfffe
add cx, ax
mov word [rsp + 0x30], cx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
cmp eax, r13d
jne 0x2577a
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov ebx, eax
cmp eax, r13d
cmovge ebx, r13d
mov edx, r12d
lea rax, [rsp + 0x98]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, r13d
jge 0x256b2
mov rcx, rsi
call fcn.000365f0
mov rcx, rbp
call fcn.000365f0
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x257e0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x850
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, rcx
lea rcx, [rsp + 0x42]
xor r13d, r13d
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x40], r13w
call fcn.0003b290
lea rcx, [0x0003d4a0]
call fcn.0001ebf8
mov rsi, rax
cmp rax, r13
jne 0x25847
mov eax, 0xc000014d
jmp 0x259b1
cmp word [rbx], 0x21
jne 0x2589d
lea rax, [rsp + 0x40]
mov rdi, rbx
mov edx, 0x400
sub rdi, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffbfe]
cmp rax, r13
je 0x25885
movzx eax, word [rdi + rcx]
cmp ax, r13w
je 0x25885
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x25862
cmp rdx, r13
jne 0x2588e
sub rcx, 2
mov word [rcx], r13w
mov word [rsp + 0x83e], r13w
jmp 0x258cb
cmp word [rbx], r13w
jne 0x258ad
mov edi, 0xc000003b
jmp 0x259a6
lea rdx, [rsp + 0x40]
mov r8d, 0x400
mov rcx, rbx
call fcn.00033110
cmp eax, r13d
mov edi, eax
jl 0x259a6
lea rdx, [0x0003d030]
xor eax, eax
or r14, 0xffffffffffffffff
mov rdi, rdx
mov rcx, r14
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
cmp eax, r13d
jne 0x25902
mov edi, 0xc0000039
jmp 0x259a6
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r12d, [rcx + rcx + 0x34]
lea ecx, [rax + 1]
mov edx, r12d
mov edi, r12d
call fcn.00036578
mov rbp, rax
cmp rax, r13
jne 0x25942
mov edi, 0xc000009a
jmp 0x259a6
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.0003b290
xor eax, eax
mov dword [rbp], 0x11232fe
mov dword [rbp + 4], 0x34
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdx, rbx
not rcx
lea r8, [rcx + rcx]
lea rcx, [rbp + 0x34]
call fcn.0003ad40
lea rdx, [rsp + 0x30]
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, rbp
mov edi, eax
call fcn.000365f0
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.0003ac70
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x259e4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
lea rcx, [0x0003d4a0]
mov r15, rdx
mov dword [rax + 0x18], ebx
mov r12b, bl
movzx r13d, bx
mov dword [rax + 0x20], ebx
call fcn.0001ebf8
mov rdi, rax
cmp rax, rbx
jne 0x25a2b
xor al, al
jmp 0x25bb0
mov esi, 1
mov edx, 0x810
mov ecx, esi
call fcn.00036578
mov rbp, rax
cmp rax, rbx
jne 0x25a4f
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x25a24
mov edx, 0x418
mov ecx, esi
call fcn.00036578
mov rsi, rax
cmp rax, rbx
je 0x25b9d
mov r14d, ebx
xor edx, edx
lea rax, [rsp + 0x90]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, ebx
jl 0x25b92
inc r14d
cmp dword [rbp + 4], 3
jne 0x25b87
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [0x0003d480]
mov word [rsp + 0x30], cx
mov word [rsp + 0x32], cx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
call fcn.000367b4
cmp al, bl
je 0x25af6
cmp r13w, bx
jne 0x25b87
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 8]
call fcn.000334e4
cmp al, bl
je 0x25b87
jmp 0x25b1e
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x30]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlPrefixUnicodeString]
cmp al, bl
je 0x25b87
cmp r13w, word [rsp + 0x30]
jae 0x25b87
mov r13w, word [rsp + 0x30]
cmp r15, rbx
je 0x25b8f
lea rax, [rsp + 0x98]
lea rdx, [rsp + 0x30]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, ebx
jl 0x25b87
cmp dword [rsi + 0xc], 0x34
jbe 0x25b87
cmp dword [rsi + 4], 3
jne 0x25b87
mov ecx, dword [rsi + 8]
mov eax, dword [rsi + 0xc]
add eax, 0xfffffffe
add rcx, rsi
mov byte [rax + rcx], bl
mov eax, dword [rsi + 0xc]
dec eax
mov byte [rax + rcx], bl
mov eax, dword [rsi + 0xc]
cmp dword [rcx + 4], eax
jae 0x25b87
mov eax, dword [rcx + 8]
mov r12b, 1
mov dword [r15], eax
mov edx, r14d
jmp 0x25a6c
mov r12b, 1
mov rcx, rsi
call fcn.000365f0
mov bl, r12b
mov rcx, rbp
call fcn.000365f0
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x25bd0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rbx, rcx
xor r13d, r13d
lea rcx, [0x0003d4a0]
mov dword [rax + 0x10], r13d
mov dword [rax + 0x18], r13d
call fcn.0001ebf8
mov rdi, rax
cmp rax, r13
jne 0x25c0e
mov eax, 0xc000014d
jmp 0x25dbf
mov edx, 0x810
mov ecx, 1
call fcn.00036578
mov rbp, rax
cmp rax, r13
jne 0x25c38
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000009a
jmp 0x25dbf
mov edx, 0x418
mov ecx, 1
call fcn.00036578
mov rsi, rax
cmp rax, r13
jne 0x25c59
mov ebx, 0xc000009a
jmp 0x25dac
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ebx, 0xc0000001
mov r12d, r13d
xor edx, edx
jmp 0x25d77
inc r12d
cmp dword [rbp + 4], 3
jne 0x25d74
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x28], rax
mov r9, rsi
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jl 0x25d74
cmp dword [rsi + 0xc], 0x34
jbe 0x25d74
cmp dword [rsi + 4], 3
jne 0x25d74
mov edx, dword [rsi + 8]
mov eax, dword [rsi + 0xc]
mov r9d, 2
sub eax, r9d
add rdx, rsi
mov byte [rax + rdx], r13b
mov eax, dword [rsi + 0xc]
dec eax
mov byte [rax + rdx], r13b
mov eax, dword [rsi + 0xc]
cmp dword [rdx + 4], eax
jae 0x25d74
mov r8d, dword [rdx + 4]
add r8, rdx
mov qword [rsp + 0x38], r8
movzx ecx, word [rsi + 0xc]
sub cx, word [rdx + 4]
mov word [rsp + 0x32], cx
mov word [rsp + 0x30], cx
cmp cx, r9w
jbe 0x25d45
movzx eax, cx
shr rax, 1
cmp word [r8 + rax*2 - 2], r13w
jne 0x25d45
sub cx, r9w
mov word [rsp + 0x30], cx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
cmp eax, r13d
jne 0x25d74
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov ebx, eax
cmp eax, r13d
cmovge ebx, r13d
mov edx, r12d
lea rax, [rsp + 0x98]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, r13d
jge 0x25c76
mov rcx, rsi
call fcn.000365f0
mov rcx, rbp
call fcn.000365f0
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x25ddc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rbx, rcx
xor r15d, r15d
lea rcx, [0x0003d4a0]
mov r14d, edx
mov dword [rax + 0x18], r15d
mov dword [rax + 0x20], r15d
call fcn.0001ebf8
mov rsi, rax
cmp rax, r15
jne 0x25e21
mov eax, 0xc000014d
jmp 0x25fea
mov edx, 0x810
mov ecx, 1
call fcn.00036578
mov rbp, rax
cmp rax, r15
jne 0x25e4b
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000009a
jmp 0x25fea
mov edx, 0x418
mov ecx, 1
call fcn.00036578
mov rdi, rax
cmp rax, r15
jne 0x25e6c
mov ebx, 0xc000009a
jmp 0x25fd7
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ebx, 0xc0000001
mov r13d, r15d
xor edx, edx
lea rax, [rsp + 0xb0]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, r15d
jl 0x25fcf
inc r13d
cmp dword [rbp + 4], 3
jne 0x25f96
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb8]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x28], rax
mov r9, rdi
mov r8d, 1
mov rcx, rsi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r15d
jl 0x25f96
cmp dword [rdi + 0xc], 0x34
jbe 0x25f96
cmp dword [rdi + 4], 3
jne 0x25f96
mov eax, dword [rdi + 0xc]
mov r12d, dword [rdi + 8]
mov r8d, 2
sub eax, r8d
add r12, rdi
mov byte [rax + r12], r15b
mov eax, dword [rdi + 0xc]
dec eax
mov byte [rax + r12], r15b
mov eax, dword [r12 + 4]
cmp eax, dword [rdi + 0xc]
jae 0x25f96
lea rdx, [r12 + rax]
mov qword [rsp + 0x38], rdx
movzx ecx, word [rdi + 0xc]
sub cx, word [r12 + 4]
mov word [rsp + 0x32], cx
mov word [rsp + 0x30], cx
cmp cx, r8w
jbe 0x25f7e
movzx eax, cx
shr rax, 1
cmp word [rdx + rax*2 - 2], r15w
jne 0x25f7e
sub cx, r8w
mov word [rsp + 0x30], cx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
cmp eax, r15d
je 0x25f9e
mov edx, r13d
jmp 0x25e84
mov dword [r12 + 8], r14d
mov eax, dword [rdi + 0xc]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, r15d
cmp eax, r15d
cmovl ebx, eax
mov rcx, rdi
call fcn.000365f0
mov rcx, rbp
call fcn.000365f0
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x26bc8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x280], rax
and qword [rsp + 0x30], 0
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x81]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x80], 0
call fcn.0003b290
and dword [rsp + 0x38], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov edx, 0x80000000
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x240
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x26d2d
lea rcx, [rsp + 0x70]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea r11, [rsp + 0x38]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0x70]
mov r8d, 2
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
js 0x26d2d
mov ecx, 1
cmp dword [rsp + 0x84], ecx
je 0x26cc4
cmp dword [rsp + 0x84], 2
jne 0x26d2d
mov edx, dword [rsp + 0x88]
add rdx, 0x12
call fcn.00036578
mov rbx, rax
test rax, rax
je 0x26d2d
mov r8d, dword [rsp + 0x88]
xor edx, edx
mov rcx, rax
add r8, 0x12
call fcn.0003b290
lea rcx, [rbx + 0x10]
lea rdx, [rsp + 0x8c]
mov qword [rbx + 8], rcx
mov r8d, dword [rsp + 0x88]
call fcn.0003ad40
movzx r11d, word [rsp + 0x88]
mov word [rbx], r11w
movzx eax, word [rsp + 0x88]
mov word [rbx + 2], ax
mov rax, rbx
jmp 0x26d2f
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.0003ac70
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret

Function at 0x26ddc
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x40
mov rbx, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x60]
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
add rsp, 0x40
pop rbx
ret

Function at 0x26e28
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x60], rax
and dword [rsp + 0x30], 0
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x38]
mov rdx, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], r11
lea rdx, [rsp + 0x38]
mov r8d, 2
mov rcx, rbx
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x26e9d
cmp dword [rsp + 0x4c], 4
jne 0x26e98
mov ecx, dword [rsp + 0x54]
mov dword [rdi], ecx
jmp 0x26e9d
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.0003ac70
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
Function at 0x2b914
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x2c0
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
xor ebp, ebp
mov bl, cl
mov rdi, rdx
lea rcx, [r11 - 0x226]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x38], ebp
mov word [rsp + 0xa0], bp
call fcn.0003b290
lea r11, [rsp + 0xa0]
mov eax, 0x208
mov word [rsp + 0x50], bp
mov word [rsp + 0x52], ax
mov qword [rsp + 0x58], r11
cmp bl, bpl
je 0x2b9b9
cmp word [0x0004d8c0], bp
je 0x2bb16
lea rdx, [0x0004d8c0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rcx, [rsp + 0x90]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x30]
mov edx, 0x80000000
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rbp
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebp
jl 0x2bb16
mov edx, 0x818
mov ecx, 1
call fcn.00036578
mov rcx, qword [rsp + 0x30]
mov rbx, rax
cmp rax, rbp
je 0x2bb10
lea rax, [rsp + 0x38]
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov esi, ebp
mov dword [rsp + 0x20], 0x818
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, ebp
jl 0x2bb03
lea rdi, [rbx + 0x10]
movzx ecx, word [rbx + 0xc]
inc esi
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
cmp cx, 6
jb 0x2bad6
cmp word [rdi], 0x7b
je 0x2bac7
lea rdx, [rdi + 2]
cmp word [rdx], 0x7b
jne 0x2bad6
movzx eax, cx
shr rax, 1
cmp word [rdi + rax*2 - 2], 0x7d
jne 0x2bad6
mov eax, 0xfffe
mov qword [rsp + 0x48], rdx
add cx, ax
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
lea rcx, [rsp + 0x40]
mov edx, 5
call fcn.0002b794
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, esi
mov dword [rsp + 0x20], 0x818
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, ebp
jge 0x2ba77
mov rcx, rbx
call fcn.000365f0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.0003ac70
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret