joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d0970
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d1372
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f3108]
test eax, eax
je 0x2fc4d140a
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f3110]
mov qword [rbp - 8], rax
jmp 0x2fc4d13ee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d13e2
cmp qword [rbp - 0x10], 0
je 0x2fc4d13e2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d13a8
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d140b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d1510
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d1538
mov eax, 0
jmp 0x2fc4d1586
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d1561
mov eax, 0
jmp 0x2fc4d1586
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d1581
mov eax, 0
jmp 0x2fc4d1586
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d158c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d160a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d1601
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d1601
mov rax, qword [rbp - 8]
jmp 0x2fc4d161f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d15d4
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x180001070
Capabilities:
Allocate or change rwx memory
Create process on windows
Resume thread

Disassembly:
sub rsp, 0x5b8
mov edx, 0x68
lea rcx, [rsp + 0x70]
call section..text
mov dword [rsp + 0x70], 0x68
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x44
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.rundll32.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18000118c
mov dword [rsp + 0x110], 0x100003
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x800
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x800
lea r8, section..data
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1d8], rax
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x180834058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1808341df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180834089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18083406f
add dl, dl
jne 0x180834096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1808340f6
xor eax, eax
add dl, dl
jne 0x1808340a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1808341ad
add dl, dl
jne 0x1808340b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808340c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808340d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808340dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1808340ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18083407e
mov eax, 1
add dl, dl
jne 0x180834106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180834113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1808340fb
sub eax, ebx
mov ebx, 1
jne 0x18083414c
mov ecx, 1
add dl, dl
jne 0x18083412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18083413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180834123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18083407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180834168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180834175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18083415d
cmp eax, 0x7d00
jae 0x18083419b
cmp eax, 0x500
jb 0x180834196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18083407e
cmp eax, 0x7f
ja 0x18083419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18083407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1808341d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18083407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
push rcx
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
push rax
mov ecx, dword [rax + 0x18]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
add rax, rdx
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140005a30
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
movzx eax, word [0x140044f60]
movups xmm0, xmmword [str.HPPresetRoot]
movsd xmm1, qword [0x140044f58]
mov word [rsp + 0x60], ax
movzx eax, word [0x140044f90]
lea r8, [rsp + 0x68]
movups xmmword [rsp + 0x48], xmm0
movups xmm0, xmmword [str.HPRestrictedUserGuid]
movsd qword [rsp + 0x58], xmm1
mov word [rbp - 0x70], ax
mov eax, dword [0x140044fc8]
lea rdx, [rsp + 0x48]
mov dword [rbp - 0x38], eax
lea rax, [rsp + 0x40]
xor ebx, ebx
movups xmm1, xmmword [0x140044f78]
movups xmmword [rsp + 0x68], xmm0
movsd xmm0, qword [0x140044f88]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1e0]
xor r9d, r9d
movsd qword [rbp - 0x78], xmm0
movups xmm0, xmmword [str.SoftwareHewlett_Packard_]
movups xmmword [rsp + 0x78], xmm1
mov dword [rsp + 0x28], 0x208
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rax
movups xmm1, xmmword [0x140044fa8]
movups xmmword [rbp - 0x68], xmm0
movups xmm0, xmmword [0x140044fb8]
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x58], xmm1
call qword [sym.imp.WINSPOOL.DRV_GetPrinterDataExW]
test eax, eax
jne 0x140005b74
movzx eax, word [rbp + rbx - 0x68]
lea rbx, [rbx + 2]
mov word [rbp + rbx - 0x32], ax
test ax, ax
jne 0x140005b11
lea rax, [rbp - 0x30]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140005b30
lea r8, [rbp + 0x1e0]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rax + rdx*2 - 2], cx
test cx, cx
jne 0x140005b50
lea rdx, [rbp - 0x30]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.140023790
mov rbx, qword [rsp + 0x518]
add rsp, 0x500
pop rbp
ret
Function at 0x140005ba0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x840
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rsp + 0x830], rax
movzx ebx, cx
mov rsi, r8
mov ebp, edx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x806
mov word [rsp + 0x20], di
call fcn.140027190
mov rcx, qword [0x1400575d8]
mov eax, ebp
shr eax, 4
lea edx, [rdi + 6]
movzx r9d, bx
inc eax
and ebp, 0xf
movzx r14d, ax
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x140005c36
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x717
jne 0x140005c70
mov rcx, qword [0x1400575d8]
lea edx, [rdi + 6]
mov r9d, 0x400
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x140005c70
mov rcx, qword [0x1400575d8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140005c70
nop dword [rax + rax]
movzx ecx, word [rax]
add rax, 2
test cx, cx
je 0x140005c69
movzx ebx, cx
cmp edi, ebp
je 0x140005c90
mov ecx, ebx
lea rax, [rax + rbx*2]
inc edi
cmp edi, 0x10
jl 0x140005c50
xor eax, eax
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140023790
add rsp, 0x840
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x403
mov rdx, rax
cmp ebx, ecx
cmovg ebx, ecx
lea rcx, [rsp + 0x20]
movsxd r8, ebx
call fcn.140023fd0
lea rax, [rsp + 0x20]
lea rdx, [rsp + 0x20]
sub rsi, rax
nop word [rax + rax]
movzx ecx, word [rdx]
lea rdx, [rdx + 2]
mov word [rsi + rdx - 2], cx
test cx, cx
jne 0x140005cc0
mov eax, ebx
jmp 0x140005c72

Function at 0x140005d00
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xe0
xor ebx, ebx
lea rcx, [rsp + 0x70]
xor edx, edx
lea r8d, [rbx + 0x68]
call fcn.140027190
mov eax, 5
lea rdx, str.Control_printers
mov word [rsp + 0xb0], ax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140005d91
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [rbx + 1]
add rsp, 0xe0
pop rbx
ret
mov eax, ebx
add rsp, 0xe0
pop rbx
ret
Function at 0x140005da0
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x140005e74
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
mov rdi, rdx
mov dword [rsp + 0x40], 0
test rcx, rcx
je 0x140005e0e
lea rdx, str._empa
call fcn.140024230
test rax, rax
jne 0x140005e05
mov rcx, qword [rbx + 0x20]
lea rdx, str._mppqs
call fcn.140024230
test rax, rax
jne 0x140005e05
mov rcx, qword [rbx + 0x20]
lea rdx, str._policy
call fcn.140024230
test rax, rax
je 0x140005e0e
lea rcx, str.19728374
jmp 0x140005e2f
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140005e38
lea rdx, str._dmpa
call fcn.140024230
test rax, rax
je 0x140005e38
lea rcx, str.843575861
call fcn.140023d28
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x140005e6a
lea rax, [rsp + 0x40]
lea rdx, str.UPDMPA
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140006a30
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, rdx
xorps xmm0, xmm0
mov rbx, rcx
lea rdx, str._dst
mov rcx, rax
movdqu xmmword [rsp + 0x30], xmm0
call fcn.140024230
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x140006acc
test rcx, rcx
jne 0x140006a8e
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x140006b5c
mov rcx, qword [rsp + 0x38]
mov rdx, qword [str.ServicesTab]
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006b5c
mov dword [rsp + 0x60], eax
jmp 0x140006b34
test rcx, rcx
jne 0x140006af8
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x140006b5c
mov rcx, qword [rsp + 0x38]
mov rdx, qword [str.ServicesTab]
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006b5c
mov dword [rsp + 0x60], 1
test rbx, rbx
je 0x140006b5c
mov rdx, qword [str.MystServicesTab]
lea r9, [rsp + 0x60]
mov r8d, 4
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140006b6c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140006b7c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x40
pop rbx
ret
Function at 0x140006b90
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, rdx
xorps xmm0, xmm0
mov rbx, rcx
lea rdx, str._dod
mov rcx, rax
movdqu xmmword [rsp + 0x30], xmm0
call fcn.140024230
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x140006c2c
test rcx, rcx
jne 0x140006bee
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x140006cbc
mov rcx, qword [rsp + 0x38]
mov rdx, qword [str.OnlineDiagnostics]
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006cbc
mov dword [rsp + 0x60], eax
jmp 0x140006c94
test rcx, rcx
jne 0x140006c58
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x140006cbc
mov rcx, qword [rsp + 0x38]
mov rdx, qword [str.OnlineDiagnostics]
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006cbc
mov dword [rsp + 0x60], 1
test rbx, rbx
je 0x140006cbc
mov rdx, qword [str.MystOnlineDiag]
lea r9, [rsp + 0x60]
mov r8d, 4
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140006ccc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140006cdc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x40
pop rbx
ret
Function at 0x140006cf0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, rdx
xorps xmm0, xmm0
mov rbx, rcx
lea rdx, str._dos
mov rcx, rax
movdqu xmmword [rsp + 0x30], xmm0
call fcn.140024230
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x140006d8c
test rcx, rcx
jne 0x140006d4e
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x140006e1c
mov rcx, qword [rsp + 0x38]
mov rdx, qword [str.OnlineSupport]
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006e1c
mov dword [rsp + 0x60], eax
jmp 0x140006df4
test rcx, rcx
jne 0x140006db8
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x140006e1c
mov rcx, qword [rsp + 0x38]
mov rdx, qword [str.OnlineSupport]
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006e1c
mov dword [rsp + 0x60], 1
test rbx, rbx
je 0x140006e1c
mov rdx, qword [str.MystOnlineSupport]
lea r9, [rsp + 0x60]
mov r8d, 4
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140006e2c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140006e3c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x40
pop rbx
ret
Function at 0x140006e50
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, rdx
xorps xmm0, xmm0
mov rbx, rcx
lea rdx, str._dpm
mov rcx, rax
movdqu xmmword [rsp + 0x30], xmm0
call fcn.140024230
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x140006eec
test rcx, rcx
jne 0x140006eae
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x140006f7c
mov rcx, qword [rsp + 0x38]
mov rdx, qword [str.ProductManuals]
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006f7c
mov dword [rsp + 0x60], eax
jmp 0x140006f54
test rcx, rcx
jne 0x140006f18
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x140006f7c
mov rcx, qword [rsp + 0x38]
mov rdx, qword [str.ProductManuals]
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006f7c
mov dword [rsp + 0x60], 1
test rbx, rbx
je 0x140006f7c
mov rdx, qword [str.MystOnlineProdManuals]
lea r9, [rsp + 0x60]
mov r8d, 4
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140006f8c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140006f9c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x40
pop rbx
ret
Function at 0x140006fb0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, rdx
xorps xmm0, xmm0
mov rbx, rcx
lea rdx, str._ddu
mov rcx, rax
movdqu xmmword [rsp + 0x30], xmm0
call fcn.140024230
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x14000704c
test rcx, rcx
jne 0x14000700e
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x1400070dc
mov rcx, qword [rsp + 0x38]
mov rdx, qword [str.DriverUpdates]
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400070dc
mov dword [rsp + 0x60], eax
jmp 0x1400070b4
test rcx, rcx
jne 0x140007078
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x1400070dc
mov rcx, qword [rsp + 0x38]
mov rdx, qword [str.DriverUpdates]
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400070dc
mov dword [rsp + 0x60], 1
test rbx, rbx
je 0x1400070dc
mov rdx, qword [str.MystOnlineDriverUpdates]
lea r9, [rsp + 0x60]
mov r8d, 4
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400070ec
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400070fc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x40
pop rbx
ret
Function at 0x140007110
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, rdx
xorps xmm0, xmm0
mov rbx, rcx
lea rdx, str._dso
mov rcx, rax
movdqu xmmword [rsp + 0x30], xmm0
call fcn.140024230
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x1400071ac
test rcx, rcx
jne 0x14000716e
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x14000723c
mov rcx, qword [rsp + 0x38]
mov rdx, qword [str.OrderSupplies]
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000723c
mov dword [rsp + 0x60], eax
jmp 0x140007214
test rcx, rcx
jne 0x1400071d8
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x14000723c
mov rcx, qword [rsp + 0x38]
mov rdx, qword [str.OrderSupplies]
lea rax, [rsp + 0x60]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000723c
mov dword [rsp + 0x60], 1
test rbx, rbx
je 0x14000723c
mov rdx, qword [str.MystOnlineOrderSupplies]
lea r9, [rsp + 0x60]
mov r8d, 4
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000724c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000725c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x40
pop rbx
ret