joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000173ec
Capabilities:
Accept command line arguments

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
xor r14d, r14d
lea rax, [0x100002310]
mov qword [rsp + 0x20], rax
lea rax, [r11 + 0x18]
lea edi, [r14 + 6]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], edi
lea rax, [0x100002328]
mov qword [r11 - 0x80], rax
lea rax, [r11 + 8]
mov qword [r11 + 0x18], r14
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x48], 1
lea rax, [0x100002338]
mov qword [r11 - 0x68], rax
lea rax, [0x10003a658]
mov dword [r11 + 8], r14d
mov qword [r11 - 0x60], rax
lea rax, [0x100002348]
mov dword [rsp + 0x60], 0xa
mov qword [r11 - 0x50], rax
lea rax, [0x10003a660]
mov qword [r11 - 0x48], rax
mov dword [rsp + 0x78], edi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0xc8]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp rax, r14
mov rbp, rax
setne bl
cmp bl, r14b
je 0x1000175a5
mov ecx, dword [rsp + 0xc8]
lea r9, [rsp + 0x20]
lea r8d, [r14 + 4]
mov rdx, rax
call fcn.100028c54
cmp al, r14b
jne 0x1000174c9
mov bl, r14b
jmp 0x1000175a5
cmp dword [rsp + 0xc0], r14d
movzx ebx, al
cmovne ebx, r14d
cmp bl, r14b
je 0x1000175a5
mov ecx, dword [0x10003a658]
cmp ecx, 1
je 0x1000174f6
movzx ebx, bl
cmp ecx, r14d
cmovne ebx, r14d
cmp bl, r14b
je 0x1000175a5
mov rsi, qword [rsp + 0xd0]
cmp rsi, r14
je 0x100017544
or edi, 0xffffffff
mov r12d, r14d
lea r13, [0x100003278]
mov rcx, qword [r13]
mov rdx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r14d
cmove edi, r12d
inc r12d
add r13, 8
cmp r12d, 7
jl 0x100017519
movzx ebx, bl
cmp edi, 0xffffffff
cmove ebx, r14d
mov dword [0x100039690], edi
cmp bl, r14b
je 0x1000175a5
mov rdx, qword [0x10003a660]
cmp rdx, r14
je 0x1000175a5
lea r9, [0x10003a3f0]
mov r8d, 0x100
mov rcx, r9
sub rdx, r9
lea rax, [r8 + 0x7ffffefe]
cmp rax, r14
je 0x100017591
movzx eax, word [rdx + rcx]
cmp ax, r14w
je 0x100017591
mov word [rcx], ax
add rcx, 2
sub r8, 1
jne 0x10001756e
cmp r8, r14
jne 0x10001759a
sub rcx, 2
mov word [rcx], r14w
mov qword [0x10003a660], r9
cmp rbp, r14
je 0x1000175b3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov al, bl
add rsp, 0x80
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100019008
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x850
mov rax, qword [0x100039110]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, rdx
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov ecx, 3
mov dword [rsp + 0x30], 0x400
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x100019069
mov ebx, 0x4102
mov ecx, ebx
call fcn.100029738
test eax, eax
je 0x1000190c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100004350]
mov r8d, eax
jmp 0x100019098
mov eax, dword [rsp + 0x30]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x30], eax
cmp eax, 0x800
jbe 0x1000190a2
mov ebx, 0x4102
mov ecx, ebx
call fcn.100029738
test eax, eax
je 0x1000190c0
mov r8d, dword [rsp + 0x30]
lea rdx, [0x1000043e0]
movzx ecx, bx
call fcn.1000297dc
jmp 0x1000190c0
lea r9, [rsp + 0x40]
lea rdx, [0x100003b78]
mov r8d, 1
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.10001d41c
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.10002e2d0
add rsp, 0x850
pop rbx
ret
Function at 0x10001c8c4
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1d0
mov rax, qword [0x100039110]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbp, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor ebx, ebx
mov edi, eax
cmp eax, ebx
je 0x10001c933
mov esi, 0x4102
mov ecx, esi
call fcn.100029738
cmp eax, ebx
je 0x10001c9bb
lea rdx, [0x1000059d0]
mov r8d, edi
movzx ecx, si
call fcn.1000297dc
jmp 0x10001c9bb
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x30], rax
cmp rax, rbx
je 0x10001c961
lea rcx, [0x100005a40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
cmp rax, rbx
jne 0x10001c96b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x10001c9bb
lea rdx, [0x100005a60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x100005a80]
mov rcx, rsi
mov qword [rbp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x100005a98]
mov rcx, rsi
mov qword [rbp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x100005ab0]
mov rcx, rsi
mov qword [rbp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x78], rax
cmp edi, ebx
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.10002e2d0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x10001ce68
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rcx, qword [rcx + 0x38]
mov rdi, rdx
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor ebx, ebx
cmp eax, ebx
je 0x10001ce92
mov eax, dword [rsp + 0x24]
mov dword [rdi], eax
jmp 0x10001cea8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
mov ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x10001cf78
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov r12d, 0xc102
mov ecx, r12d
call fcn.100029738
cmp eax, ebx
je 0x10001cfc0
lea rdx, [0x100005cf0]
movzx ecx, r12w
call fcn.1000297dc
cmp rdi, rbx
je 0x10001d038
cmp word [rdi], bx
je 0x10001d038
mov rdx, rdi
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
je 0x10001cffb
cmp eax, ebx
je 0x10001d02b
mov r9d, eax
mov r8d, 0x3dd
lea rdx, [0x1000055b8]
lea rcx, [0x100006428]
call fcn.100029c5c
mov edi, 0x8102
mov ecx, edi
call fcn.100029738
cmp eax, ebx
je 0x10001d023
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x100005dc0]
movzx ecx, di
call fcn.1000297dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x10001d034
mov eax, ebx
jmp 0x10001d05c
mov edi, 0x8102
mov ecx, edi
call fcn.100029738
cmp eax, ebx
je 0x10001d057
lea rdx, [0x100005d60]
movzx ecx, di
call fcn.1000297dc
mov eax, 0x57
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x10001d07c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x100039110]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, r9
mov r12, r8
mov rbp, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0xf0]
mov qword [rsp + 0x70], 7
xor r14d, r14d
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
cmp r8, r14
jne 0x10001d11d
mov ebx, 0x8102
mov ecx, ebx
call fcn.100029738
cmp eax, r14d
je 0x10001d101
lea rdx, [0x100005ed0]
movzx ecx, bx
call fcn.1000297dc
nop
cmp qword [rsp + 0x70], 8
jb 0x10001d113
mov rcx, qword [rsp + 0x58]
call fcn.10002deec
mov eax, 0x57
jmp 0x10001d238
cmp rbx, r14
jne 0x10001d15f
mov ebx, 0x8102
mov ecx, ebx
call fcn.100029738
cmp eax, r14d
je 0x10001d143
lea rdx, [0x100005f40]
movzx ecx, bx
call fcn.1000297dc
nop
cmp qword [rsp + 0x70], 8
jb 0x10001d155
mov rcx, qword [rsp + 0x58]
call fcn.10002deec
mov eax, 0x57
jmp 0x10001d238
mov dword [rsp + 0x44], 0x100
mov dword [rsp + 0x40], 0x800
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x44]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
cmp eax, r14d
je 0x10001d1c8
mov ebx, 0x8102
mov ecx, ebx
call fcn.100029738
cmp eax, r14d
je 0x10001d224
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x100005fb0]
movzx ecx, bx
call fcn.1000297dc
jmp 0x10001d224
mov eax, dword [rsp + 0x44]
lea eax, [rax + rax + 2]
mov dword [r13], eax
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov edx, dword [r13]
mov rcx, r12
call fcn.10001d7b0
cmp al, r14b
je 0x10001d1fe
mov r8d, dword [rsi]
mov rdx, rbx
mov ecx, dword [rbp]
call fcn.10001d6dc
cmp al, r14b
jne 0x10001d224
mov edi, 0xd
mov ebx, 0x8102
mov ecx, ebx
call fcn.100029738
cmp eax, r14d
je 0x10001d224
lea rdx, [0x100006020]
movzx ecx, bx
call fcn.1000297dc
nop
cmp qword [rsp + 0x70], 8
jb 0x10001d236
mov rcx, qword [rsp + 0x58]
call fcn.10002deec
mov eax, edi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.10002e2d0
add rsp, 0x80
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10001d41c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
xor ebx, ebx
cmp rdx, rbx
je 0x10001d4bc
cmp word [rdx], bx
je 0x10001d4bc
cmp r9, rbx
jne 0x10001d46f
mov edi, 0x8102
mov ecx, edi
call fcn.100029738
cmp eax, ebx
je 0x10001d468
lea rdx, [0x1000062f0]
movzx ecx, di
call fcn.1000297dc
mov eax, 0x57
jmp 0x10001d4e0
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov r9d, r8d
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x10001d4af
mov r9d, eax
mov r8d, 0x35e
lea rdx, [0x1000055b8]
lea rcx, [0x100006408]
call fcn.100029c5c
nop
jmp 0x10001d4b8
mov eax, ebx
jmp 0x10001d4e0
mov edi, 0x8102
mov ecx, edi
call fcn.100029738
cmp eax, ebx
je 0x10001d4db
lea rdx, [0x100006290]
movzx ecx, di
call fcn.1000297dc
mov eax, 0x57
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret

Function at 0x10001e3ac
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x100039110]
xor rax, rsp
mov qword [rsp + 0x150], rax
and qword [rsp + 0x20], 0
mov rbx, rcx
lea rcx, [rsp + 0x30]
xor edi, edi
mov dword [rsp + 0x30], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov ebp, 0x4104
setne sil
test sil, sil
je 0x10001e433
cmp dword [rsp + 0x34], 6
jb 0x10001e413
lea rdi, [0x100007ad0]
jmp 0x10001e45a
cmp dword [rsp + 0x34], 5
jne 0x10001e42a
cmp dword [rsp + 0x38], 1
jb 0x10001e42a
lea rdi, [0x100007bc0]
jmp 0x10001e45a
lea rdi, [0x100007c10]
jmp 0x10001e45a
mov ecx, ebp
call fcn.100029738
test eax, eax
je 0x10001e4c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100007c50]
movzx ecx, bp
mov r8d, eax
call fcn.1000297dc
test sil, sil
je 0x10001e4c2
xor r9d, r9d
lea r8, [rsp + 0x20]
mov rcx, rdi
lea edx, [r9 + 1]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
setne sil
test sil, sil
jne 0x10001e4a3
mov ecx, ebp
call fcn.100029738
test eax, eax
je 0x10001e4c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100007ce0]
movzx ecx, bp
mov r8d, eax
call fcn.1000297dc
jmp 0x10001e4c2
mov rcx, qword [rsp + 0x20]
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
and dword [rbx + 0x10], eax
mov qword [rbx + 8], rcx
mov dword [rbx], 0x18
mov al, sil
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.10002e2d0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x10001e4f4
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x70
xor eax, eax
lea rcx, [r11 - 0x28]
xor ebx, ebx
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
call fcn.10001e3ac
cmp al, bl
jne 0x10001e52d
lea edi, [rbx + 0xe]
jmp 0x10001e602
lea rax, [rsp + 0x80]
lea rdx, [0x100007e90]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp eax, ebx
je 0x10001e59a
mov esi, 0x8104
mov ecx, esi
call fcn.100029738
cmp eax, ebx
je 0x10001e602
lea rdx, [0x100007f60]
jmp 0x10001e5f7
or rcx, 0xffffffffffffffff
lea rdx, [0x10003a6a0]
xor eax, eax
mov rdi, rdx
mov r9d, 1
xor r8d, r8d
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x88]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100007f40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp eax, ebx
je 0x10001e602
mov esi, 0x4104
mov ecx, esi
call fcn.100029738
cmp eax, ebx
je 0x10001e602
lea rdx, [0x100008000]
mov r8d, edi
movzx ecx, si
call fcn.1000297dc
mov rcx, qword [rsp + 0x88]
cmp rcx, rbx
je 0x10001e615
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
cmp rcx, rbx
je 0x10001e625
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x70]
cmp edi, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
sete al
mov rsp, r11
pop rdi
ret

Function at 0x10001e644
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 8]
lea rdx, [0x100007e90]
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
mov edi, eax
cmp eax, esi
jne 0x10001e6c4
mov rcx, qword [rsp + 0x40]
lea rdx, [0x100007f40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, 0xc104
mov ecx, ebx
mov edi, eax
call fcn.100029738
cmp eax, esi
je 0x10001e6b7
lea rdx, [0x1000080b0]
mov r8d, edi
movzx ecx, bx
call fcn.1000297dc
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10001e6e6
mov ebx, 0xc104
mov ecx, ebx
call fcn.100029738
cmp eax, esi
je 0x10001e6e6
lea rdx, [0x100008130]
mov r8d, edi
movzx ecx, bx
call fcn.1000297dc
mov rbx, qword [rsp + 0x48]
mov word [0x10003a6a0], si
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x10001f7f4
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x2f0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x100039110]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rsi, rcx
xor ebp, ebp
mov qword [r11 - 0x270], rbp
mov qword [r11 - 0x268], rbp
mov qword [r11 - 0x260], rbp
mov qword [r11 - 0x240], rbp
mov qword [r11 - 0x238], rbp
mov qword [r11 - 0x230], rbp
mov byte [rsp + 0x80], bpl
movdqu xmm0, xmmword [0x100001d00]
movdqu xmmword [rsp + 0xa0], xmm0
lea rcx, [r11 - 0x278]
call fcn.100021410
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov edx, 0x104
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
setne cl
cmp cl, bpl
je 0x10001f970
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x10001f922
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbp
mov word [rsp + 0x48], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xd0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x40]
call fcn.10001815c
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.10001fc0c
nop
cmp qword [rsp + 0x60], 8
jb 0x10001f922
mov rcx, qword [rsp + 0x48]
call fcn.10002deec
mov r8d, 0x104
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
cmp eax, ebp
jne 0x10001f8af
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x80]
call fcn.100023c14
movdqu xmm0, xmmword [rax]
movdqu xmmword [rsi], xmm0
mov dl, 1
lea rcx, [rsp + 0x80]
call fcn.100024a54
nop
lea rcx, [rsp + 0x20]
call fcn.10001fb88
nop
lea rcx, [rsp + 0x80]
call fcn.100021354
xor eax, eax
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.10002e2d0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x100024e94
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x100039110]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov edi, 0xc105
mov ecx, edi
call fcn.100029738
test eax, eax
je 0x100024ed5
lea rdx, [0x10000dec0]
movzx ecx, di
call fcn.1000297dc
mov ecx, edi
call fcn.100029738
test eax, eax
je 0x100024eef
lea rdx, [0x10000e1e0]
movzx ecx, di
call fcn.1000297dc
movdqu xmm0, xmmword [0x100001d00]
lea rax, [rsp + 0x40]
lea rdx, [0x100003a00]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100024f52
mov ecx, edi
call fcn.100029738
test eax, eax
je 0x100024ff8
lea r8, [0x100003a00]
lea rdx, [0x10000e250]
movzx ecx, di
call fcn.1000297dc
jmp 0x100024ff8
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x1000039d8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100024fbf
mov ecx, edi
call fcn.100029738
test eax, eax
je 0x100024fb2
lea r9, [0x1000039d8]
lea r8, [0x100003a00]
lea rdx, [0x10000e340]
movzx ecx, di
call fcn.1000297dc
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100024ff8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
je 0x100024ff8
mov ecx, edi
call fcn.100029738
test eax, eax
je 0x100024ff8
lea rdx, [0x10000e450]
movzx ecx, di
call fcn.1000297dc
lea rax, [rsp + 0x50]
lea rcx, [0x100001d00]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x10002501a
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x10002501a
xor eax, eax
jmp 0x10002501f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100025047
movaps xmm0, xmmword [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rbx
movdqa xmmword [rsp + 0x40], xmm0
call fcn.100025324
test eax, eax
js 0x100025047
mov rcx, rbx
call fcn.10002525c
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10002e2d0
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret
Function at 0x100025070
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x80
mov rax, qword [0x100039110]
xor rax, rsp
mov qword [rsp + 0x78], rax
movdqu xmm0, xmmword [rdx]
mov edi, 0xc105
mov ecx, edi
movdqu xmmword [rsp + 0x68], xmm0
call fcn.100029738
test eax, eax
je 0x1000250b1
lea rdx, [0x10000df30]
movzx ecx, di
call fcn.1000297dc
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
lea rdx, [0x100003970]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 4
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10002511c
mov ecx, edi
call fcn.100029738
test eax, eax
je 0x10002523f
lea r8, [0x100003970]
lea rdx, [0x10000df90]
movzx ecx, di
call fcn.1000297dc
jmp 0x10002523f
and qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, [0x1000039b8]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x100025186
mov ecx, edi
call fcn.100029738
test eax, eax
je 0x10002517c
lea r8, [0x100003a00]
lea rdx, [0x10000df90]
movzx ecx, di
call fcn.1000297dc
mov rcx, qword [rsp + 0x50]
jmp 0x100025239
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
je 0x1000251ba
mov ecx, edi
call fcn.100029738
test eax, eax
je 0x100025229
lea rdx, [0x10000e080]
movzx ecx, di
call fcn.1000297dc
jmp 0x100025229
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x60]
lea rdx, [0x1000039d8]
lea eax, [rax + rax + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10002521e
mov ecx, edi
call fcn.100029738
test eax, eax
je 0x10002521e
lea r9, [0x1000039d8]
lea r8, [0x100003a00]
lea rdx, [0x10000e140]
movzx ecx, di
call fcn.1000297dc
lea rcx, [rsp + 0x58]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.10002e2d0
add rsp, 0x80
pop rdi
ret
Function at 0x10002525c
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, 0xc105
mov ecx, ebx
call fcn.100029738
test eax, eax
je 0x100025281
lea rdx, [0x10000e530]
movzx ecx, bx
call fcn.1000297dc
lea rax, [rsp + 0x48]
lea rdx, [0x100003a00]
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000252cf
mov ecx, ebx
call fcn.100029738
test eax, eax
je 0x100025318
lea r8, [0x100003a00]
lea rdx, [0x10000e590]
movzx ecx, bx
call fcn.1000297dc
jmp 0x100025318
mov rcx, qword [rsp + 0x48]
lea rdx, [0x1000039d8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x10002530d
mov ecx, ebx
call fcn.100029738
test eax, eax
je 0x10002530d
lea r9, [0x1000039d8]
lea r8, [0x100003a00]
lea rdx, [0x10000e670]
movzx ecx, bx
call fcn.1000297dc
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x1000297dc
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov word [rax + 8], cx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x50
movzx r13d, cx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x20], eax
mov ecx, dword [0x1000394d0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x100029830
call fcn.10002a8b4
mov rdi, rax
mov qword [rsp + 0x30], rax
lea r12, [rsp + 0x90]
mov qword [rsp + 0x40], r12
test rdi, rdi
je 0x10002984d
lea rbx, [rdi + 0x30]
mov qword [rsp + 0x28], rbx
jmp 0x10002989d
mov ecx, 0x810
call sub.msvcrt.dll_malloc
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x100029873
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x28], rbx
jmp 0x10002989d
test rbx, rbx
je 0x1000298d0
mov r9, r12
mov r8, qword [rsp + 0x88]
mov edx, 0x400
mov rcx, rbx
call fcn.10002e564
mov r11, qword [0x1000394f0]
mov rbx, qword [rsp + 0x28]
mov rdx, rbx
movzx ecx, r13w
call r11
test rdi, rdi
jne 0x1000298eb
test rbx, rbx
je 0x1000298eb
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x1000298eb
call sub.msvcrt.dll_free
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret