joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c8dc
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14004f0e8]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
mov r8d, 0x104
lea rdx, [0x1400505d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
jne 0x14000c9b1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call fcn.14000d2fc
cmp dword [rax], 2
jbe 0x14000c99d
mov dword [rsp + 0x48], ebx
lea rcx, str.GetModuleFileName_failed
mov qword [rsp + 0x40], rcx
test ebx, ebx
jle 0x14000c96c
movzx ebx, bx
or ebx, 0x80070000
mov dword [rsp + 0x50], ebx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1400439ab]
mov rcx, rax
call fcn.140001de0
lea rdx, [0x1400361c0]
mov rcx, rdi
call fcn.14000e090
jmp 0x14000caf1
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x140036140]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], si
movups xmmword [rbp - 0x10], xmm0
movdqu xmmword [rbp], xmm1
mov word [rbp - 0x10], si
movups xmmword [rbp + 0x50], xmm0
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], si
movups xmmword [rbp + 0x30], xmm0
movdqu xmmword [rbp + 0x40], xmm1
mov word [rbp + 0x30], si
mov r8d, eax
lea rdx, [0x1400505d0]
lea rcx, [rbp - 0x30]
call fcn.14000e060
nop
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x50]
lea r8, [rbp - 0x10]
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.14002891c
test al, al
sete bl
lea rcx, [rbp - 0x30]
call fcn.14000e93c
test bl, bl
je 0x14000ca47
lea rdx, [0x1400361c0]
mov rcx, rdi
call fcn.14000e090
jmp 0x14000caca
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov ecx, 7
mov qword [rsp + 0x78], rcx
mov word [rsp + 0x60], si
lea rax, [rbp - 0x30]
mov qword [rsp + 0x50], rax
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
mov word [rbp - 0x30], si
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.14000e6c4
mov rbx, rax
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x50]
call fcn.14000e6c4
nop
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x30]
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.1400286c4
nop
lea rcx, [rbp + 0x30]
call fcn.14000e93c
nop
lea rcx, [rbp + 0x50]
call fcn.14000e93c
nop
lea rcx, [rbp - 0x10]
call fcn.14000e93c
nop
lea rcx, [rbp + 0x10]
call fcn.14000e93c
mov rax, rdi
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140011260
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000fd24
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov rdi, rcx
and dword [rax - 0x18], 0
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x14000fd57
mov rcx, qword [rdx]
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
sete dl
mov rcx, qword [rsp + 0x48]
lea rax, str.Could_not_read_file_version_info
mov qword [rsp + 0x20], rax
movzx r9d, dl
lea r8, str.amcorewcd_sourcecommon_src_versioninfo.cpp
mov edx, 0x84
call fcn.14000b39c
mov ecx, esi
call fcn.1400123a0
mov qword [rdi], rax
mov dword [rsp + 0x30], 1
cmp qword [rbx + 0x18], 8
jb 0x14000fdae
mov rbx, qword [rbx]
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
lea rdx, str.Could_not_retrieve_file_version_info
mov qword [rsp + 0x20], rdx
mov r9d, eax
lea r8, str.amcorewcd_sourcecommon_src_versioninfo.cpp
mov edx, 0x8d
call fcn.14000fe04
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400119d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x140011a1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140011a1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140011a1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140011a1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140011a1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140011a1c
xor al, al
add rsp, 0x28
ret
Function at 0x140017c28
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x14004f0e8]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov r9, rcx
mov r14d, 0x104
xor ebx, ebx
lea rcx, [rsp + 0x50]
mov edx, r14d
mov qword [r8], rbx
mov rsi, r8
call fcn.140017af0
lea r8, [0x14003aca0]
mov edx, r14d
lea rcx, [rsp + 0x50]
call fcn.140017a64
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140017cdd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x140017dd1
mov rcx, qword [rbp + 0x188]
lea r8, [0x14003ac38]
lea edx, [r14 - 0x3b]
call fcn.14000d34c
mov ebx, eax
jmp 0x140017dd1
lea rdx, [rsp + 0x34]
mov dword [rsp + 0x34], ebx
mov rcx, rax
mov dword [rsp + 0x30], ebx
call fcn.140016d00
mov edi, eax
test eax, eax
jns 0x140017d1a
mov rcx, qword [rbp + 0x188]
lea r8, [0x14003ac38]
mov r9d, eax
mov edx, 0xcf
call fcn.14000d31c
mov ebx, edi
jmp 0x140017dd1
lea r8, [0x14003aca8]
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.140017a64
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140017d76
mov rcx, qword [rbp + 0x188]
lea r8, [0x14003ac38]
mov edx, 0xd5
call fcn.14000d34c
lea rcx, [rsp + 0x38]
mov ebx, eax
call fcn.140010870
jmp 0x140017dd1
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140016d00
mov edi, eax
test eax, eax
jns 0x140017db3
mov rcx, qword [rbp + 0x188]
lea r8, [0x14003ac38]
mov r9d, eax
mov edx, 0xd7
call fcn.14000d31c
lea rcx, [rsp + 0x38]
call fcn.140010870
jmp 0x140017d13
lea rcx, [rsp + 0x38]
call fcn.140010870
movsxd rdx, dword [rsp + 0x30]
movsxd rcx, dword [rsp + 0x34]
shl rdx, 0x1f
or rdx, rcx
mov qword [rsi], rdx
lea rcx, [rsp + 0x40]
call fcn.140010870
mov eax, ebx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140011260
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001af24
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
sub rsp, 0x68
and qword [r11 - 0x18], 0
lea rax, str.Sense
and qword [r11 - 0x10], 0
lea rcx, [r11 - 0x28]
mov qword [r11 - 0x28], rax
lea rax, [0x140018320]
mov qword [r11 - 0x20], rax
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_StartServiceCtrlDispatcherW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
lea rdx, str.Failed_to_start_service_control_dispatcher
mov qword [rsp + 0x20], rdx
lea r8, str.amcorewcd_source_service_src_service.cpp
mov edx, 0x8a
mov r9d, eax
call fcn.14000fe04
cmp qword [0x1400503c0], 0
jne 0x14001afc0
cmp dword [0x14004f19c], 1
je 0x14001b044
mov rcx, qword [rsp + 0x68]
lea rax, str.Service_control_dispatcher_failed_without_saying_so...
mov r9d, 0x8007000e
mov qword [rsp + 0x20], rax
lea r8, str.amcorewcd_source_service_src_service.cpp
mov edx, 0x8f
call fcn.14001bc60
int3
cmp dword [0x14004f19c], 1
je 0x14001b044
call fcn.14000d2fc
cmp dword [rax], 2
jbe 0x14001b024
mov ecx, dword [0x14004f19c]
lea rdx, [0x140043499]
mov dword [rsp + 0x70], ecx
lea rcx, str.Service_stopped_with_unexpected_service_status._Terminating_process
mov qword [rsp + 0x80], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov dword [rsp + 0x78], 0x507
call fcn.1400010b8
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rcx, rax
mov edx, 2
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
add rsp, 0x68
ret

Function at 0x14001ec74
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
sub r9, r8
mov rax, rdx
sub rax, rcx
mov r15, r8
xor rax, r9
mov rbp, rdx
mov r14, rcx
test rax, 0xfffffffffffffffe
jne 0x14001ecfd
lea rdx, [r11 + 0x28]
lea rcx, [r11 + 8]
call fcn.1400183ac
sub r15, r14
mov rbx, qword [rax]
cmp r14, rbp
je 0x14001ed01
mov rcx, qword [rbx + 8]
movzx edx, word [r15 + r14]
movzx esi, word [r14]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x140026a92.0]
mov rcx, qword [rbx + 8]
movzx edx, si
movzx edi, ax
mov r8, qword [rcx]
mov rax, qword [r8 + 0x40]
call qword [case.0x140026a92.0]
cmp ax, di
jne 0x14001ecfd
add r14, 2
jmp 0x14001ecbc
xor al, al
jmp 0x14001ed03
mov al, 1
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140027dac
Capabilities:
Check if file exists
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14004f0e8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov qword [rbp - 0x11], rcx
xor r15d, r15d
cmp qword [rdx + 0x18], 8
mov rbx, rcx
mov rdi, rdx
mov rcx, rdx
jb 0x140027dec
mov rcx, qword [rdx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x140027e7f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r14d, eax
call fcn.14000d2fc
mov rsi, rax
cmp dword [rax], 2
jbe 0x140027e64
mov rcx, rdi
call fcn.140007720
mov qword [rbp - 9], rax
lea rdx, [0x140043947]
lea rax, str.Failed_to_expand_environment_strings_in_path
mov dword [rbp - 0x19], r14d
mov qword [rbp - 0x11], rax
mov rcx, rsi
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
call fcn.140001ea4
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
jmp 0x140027f5f
xor r8d, r8d
lea edx, [rax - 1]
lea rcx, [rbp + 7]
call fcn.14000f874
cmp qword [rbp + 0x1f], 8
lea rdx, [rbp + 7]
mov rcx, rdi
cmovae rdx, qword [rbp + 7]
cmp qword [rdi + 0x18], 8
jb 0x140027ea9
mov rcx, qword [rdi]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
jne 0x140027f35
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r14d, eax
call fcn.14000d2fc
mov rsi, rax
cmp dword [rax], 2
jbe 0x140027f1d
mov rcx, rdi
call fcn.140007720
mov qword [rbp - 0x11], rax
lea rdx, [0x140043947]
lea rax, str.Failed_to_expand_environment_strings_in_path_after_increasing_buffer_size
mov dword [rbp - 0x19], r14d
mov qword [rbp - 9], rax
mov rcx, rsi
lea rax, [rbp - 0x11]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
call fcn.140001ea4
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
jmp 0x140027f56
movups xmm0, xmmword [rbp + 7]
mov word [rbp + 7], r15w
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx], xmm0
movdqa xmm0, xmmword [0x140036140]
movdqu xmmword [rbp + 0x17], xmm0
movups xmmword [rbx + 0x10], xmm1
lea rcx, [rbp + 7]
call fcn.14000e93c
mov rax, rbx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140011260
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140029168
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x140029181
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
test al, 3
je 0x1400291c4
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14002919e
mov rcx, qword [rbx]
and eax, 0xfffffffc
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop dword [rax + rax]
test eax, eax
jne 0x1400291c4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
jmp 0x140029267
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x1400291d1
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140029201
test al, 0x10
je 0x140029201
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x1400291f3
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop dword [rax + rax]
jmp 0x14002921a
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14002920e
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140029265
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
lea edx, [rax - 2]
cmp edx, 1
jbe 0x140029265
cmp qword [rbx + 0x18], 8
jb 0x14002923e
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop dword [rax + rax]
test eax, eax
jne 0x140029265
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002a4b0
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, rdx
mov rdi, rcx
and qword [rbp + 0x38], 0
lea rdx, [rbp + 0x38]
mov rcx, rsi
call fcn.14002a738
mov ebx, eax
test eax, eax
je 0x14002a552
call fcn.14000d2fc
mov rdi, rax
cmp dword [rax], 3
jbe 0x14002a53f
mov rcx, rsi
call fcn.140007720
mov qword [rbp - 0x40], rax
mov dword [rbp + 0x30], ebx
lea rax, str.Could_not_open_the_registry_key
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [0x140043c83]
mov rcx, rdi
call fcn.1400072c8
test ebx, ebx
jle 0x14002a5ce
movzx ebx, bx
or ebx, 0x80070000
jmp 0x14002a5ce
lea rax, [rbp - 0x18]
mov qword [rbp - 0x40], rax
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14002a567
mov rdx, qword [rdi]
lea rcx, [rbp - 0x18]
call qword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
nop dword [rax + rax]
test al, al
jne 0x14002a5de
call fcn.14000d2fc
mov rbx, rax
cmp dword [rax], 3
jbe 0x14002a5c0
mov rcx, rdi
call fcn.140007720
mov qword [rbp + 0x30], rax
lea rax, str.Could_not_create_a_UNICODE_STRING_to_hold_valueName
mov qword [rbp - 0x38], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [0x140043d92]
mov rcx, rbx
call fcn.14000950c
lea rcx, [rbp - 0x40]
call fcn.14002a22c
mov ebx, 0x80070057
lea rcx, [rbp + 0x38]
call fcn.140010828
mov eax, ebx
jmp 0x14002a6f6
lea rdx, [rbp - 0x18]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14002a688
cmp eax, 0xc0000034
je 0x14002a688
call fcn.14000d2fc
mov r14, rax
cmp dword [rax], 3
jbe 0x14002a66d
mov rcx, rsi
call fcn.140007720
mov qword [rbp - 0x38], rax
mov rcx, rdi
call fcn.140007720
mov qword [rbp - 0x30], rax
mov dword [rbp + 0x30], ebx
lea rax, str.Failed_to_delete_registry_value
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea rdx, [0x140043d17]
mov rcx, r14
call fcn.140002434
lea rcx, [rbp - 0x40]
call fcn.14002a22c
lea rcx, [rbp + 0x38]
call fcn.140010828
bts ebx, 0x1c
jmp 0x14002a5d7
call fcn.14000d2fc
mov rbx, rax
cmp dword [rax], 4
jbe 0x14002a6e2
mov rcx, rsi
call fcn.140007720
mov qword [rbp + 0x30], rax
mov rcx, rdi
call fcn.140007720
mov qword [rbp - 0x28], rax
lea rax, str.Delete_registry_value
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea rdx, [0x140043d58]
mov rcx, rbx
call fcn.14000189c
lea rcx, [rbp - 0x40]
call fcn.14002a22c
lea rcx, [rbp + 0x38]
call fcn.140010828
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14002a80c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp - 0x30], 0
mov rdi, rdx
mov rsi, rcx
movzx r14d, r9b
mov rdx, r8
lea rcx, [rbp - 0x30]
mov r15, r8
call fcn.14002a250
mov ebx, eax
test eax, eax
je 0x14002a85c
jle 0x14002a9a9
movzx ebx, ax
jmp 0x14002a930
cmp qword [rdi + 0x18], 8
lea r9d, [r14*2 + 1]
mov eax, dword [rdi + 0x10]
lea ecx, [rax*2 + 2]
mov rax, rdi
jb 0x14002a87b
mov rax, qword [rdi]
cmp qword [rsi + 0x18], 8
mov rdx, rsi
jb 0x14002a888
mov rdx, qword [rsi]
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14002a938
call fcn.14000d2fc
mov r14, rax
cmp dword [rax], 3
jbe 0x14002a929
mov rcx, rdi
call fcn.140007720
mov rcx, r15
mov qword [rbp - 0x28], rax
call fcn.140007720
mov rcx, rsi
mov qword [rbp - 0x20], rax
call fcn.140007720
mov qword [rbp - 0x18], rax
lea rdx, [0x140043dc3]
lea rax, str.Failed_to_set_registry_key
mov dword [rbp + 0x40], ebx
mov qword [rbp - 0x10], rax
mov rcx, r14
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call fcn.140002804
test ebx, ebx
jle 0x14002a9a9
movzx ebx, bx
or ebx, 0x80070000
jmp 0x14002a9a9
call fcn.14000d2fc
mov rbx, rax
cmp dword [rax], 4
jbe 0x14002a9a7
mov rcx, rdi
call fcn.140007720
mov rcx, r15
mov qword [rbp - 0x10], rax
call fcn.140007720
mov rcx, rsi
mov qword [rbp - 0x18], rax
call fcn.140007720
mov qword [rbp - 0x20], rax
lea rdx, [0x140043e0b]
lea rax, str.Write_registry_value
mov rcx, rbx
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
call fcn.1400020bc
xor ebx, ebx
lea rcx, [rbp - 0x30]
call fcn.140010828
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002ae20
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov byte [rax + 0x20], r9b
mov dword [rax + 0x10], edx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
and qword [rbp - 0x20], 0
mov rdi, rcx
lea rcx, [rbp - 0x20]
mov rdx, r8
mov r14, r8
call fcn.14002a250
mov ebx, eax
test eax, eax
je 0x14002ae68
jle 0x14002af95
movzx ebx, ax
jmp 0x14002af23
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x14002ae75
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x28]
mov esi, 4
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov r9d, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14002af2b
call fcn.14000d2fc
mov rsi, rax
cmp dword [rax], 3
jbe 0x14002af1c
mov ecx, dword [rbp + 0x28]
mov dword [rbp + 0x38], ecx
mov rcx, r14
call fcn.140007720
mov rcx, rdi
mov qword [rbp - 0x18], rax
call fcn.140007720
mov qword [rbp - 0x10], rax
lea rdx, [0x140043f69]
lea rax, str.Failed_to_set_registry_key
mov dword [rbp + 0x40], ebx
mov qword [rbp - 8], rax
mov rcx, rsi
lea rax, [rbp + 0x38]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call fcn.140002b5c
test ebx, ebx
jle 0x14002af95
movzx ebx, bx
or ebx, 0x80070000
jmp 0x14002af95
call fcn.14000d2fc
mov rbx, rax
cmp dword [rax], esi
jbe 0x14002af93
mov ecx, dword [rbp + 0x28]
mov dword [rbp + 0x38], ecx
mov rcx, r14
call fcn.140007720
mov rcx, rdi
mov qword [rbp - 8], rax
call fcn.140007720
mov qword [rbp - 0x10], rax
lea rdx, [0x140043fb1]
lea rax, str.Write_registry_value
mov rcx, rbx
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
call fcn.14000220c
xor ebx, ebx
lea rcx, [rbp - 0x20]
call fcn.140010828
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret