joyce8/EMBER2024-capa huggingface dataset:
Function at 0x25610
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rdx, rcx
xor r13d, r13d
lea rcx, [rax - 0x38]
mov dword [rax + 0x10], r13d
mov dword [rax + 0x18], r13d
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [0x0003d4b0]
call fcn.0001ebf8
mov rdi, rax
cmp rax, r13
jne 0x25658
mov eax, 0xc000014d
jmp 0x257c5
mov edx, 0x810
mov ecx, 1
call fcn.000365b8
mov rbp, rax
cmp rax, r13
jne 0x25682
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000009a
jmp 0x257c5
mov edx, 0x418
mov ecx, 1
call fcn.000365b8
mov rsi, rax
cmp rax, r13
jne 0x256a3
mov ebx, 0xc000009a
jmp 0x257b2
mov ebx, 0xc0000001
mov r12d, r13d
xor edx, edx
jmp 0x2577d
inc r12d
cmp dword [rbp + 4], 1
jne 0x2577a
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x28], rax
mov r9, rsi
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jl 0x2577a
cmp dword [rsi + 0xc], r13d
je 0x2577a
mov edx, dword [rsi + 8]
add rdx, rsi
mov qword [rsp + 0x38], rdx
movzx ecx, word [rsi + 0xc]
mov word [rsp + 0x30], cx
movzx eax, word [rsi + 0xc]
mov word [rsp + 0x32], ax
cmp cx, 2
jbe 0x2574b
movzx eax, cx
shr rax, 1
cmp word [rdx + rax*2 - 2], r13w
jne 0x2574b
mov eax, 0xfffe
add cx, ax
mov word [rsp + 0x30], cx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
cmp eax, r13d
jne 0x2577a
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov ebx, eax
cmp eax, r13d
cmovge ebx, r13d
mov edx, r12d
lea rax, [rsp + 0x98]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, r13d
jge 0x256b2
mov rcx, rsi
call fcn.00036630
mov rcx, rbp
call fcn.00036630
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x257e0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x850
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, rcx
lea rcx, [rsp + 0x42]
xor r13d, r13d
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x40], r13w
call fcn.0003b2d0
lea rcx, [0x0003d4e0]
call fcn.0001ebf8
mov rsi, rax
cmp rax, r13
jne 0x25847
mov eax, 0xc000014d
jmp 0x259b1
cmp word [rbx], 0x21
jne 0x2589d
lea rax, [rsp + 0x40]
mov rdi, rbx
mov edx, 0x400
sub rdi, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffbfe]
cmp rax, r13
je 0x25885
movzx eax, word [rdi + rcx]
cmp ax, r13w
je 0x25885
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x25862
cmp rdx, r13
jne 0x2588e
sub rcx, 2
mov word [rcx], r13w
mov word [rsp + 0x83e], r13w
jmp 0x258cb
cmp word [rbx], r13w
jne 0x258ad
mov edi, 0xc000003b
jmp 0x259a6
lea rdx, [rsp + 0x40]
mov r8d, 0x400
mov rcx, rbx
call fcn.00033110
cmp eax, r13d
mov edi, eax
jl 0x259a6
lea rdx, [0x0003d070]
xor eax, eax
or r14, 0xffffffffffffffff
mov rdi, rdx
mov rcx, r14
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
cmp eax, r13d
jne 0x25902
mov edi, 0xc0000039
jmp 0x259a6
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r12d, [rcx + rcx + 0x34]
lea ecx, [rax + 1]
mov edx, r12d
mov edi, r12d
call fcn.000365b8
mov rbp, rax
cmp rax, r13
jne 0x25942
mov edi, 0xc000009a
jmp 0x259a6
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.0003b2d0
xor eax, eax
mov dword [rbp], 0x11232fe
mov dword [rbp + 4], 0x34
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdx, rbx
not rcx
lea r8, [rcx + rcx]
lea rcx, [rbp + 0x34]
call fcn.0003ad80
lea rdx, [rsp + 0x30]
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, rbp
mov edi, eax
call fcn.00036630
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.0003acb0
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x259e4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
lea rcx, [0x0003d4e0]
mov r15, rdx
mov dword [rax + 0x18], ebx
mov r12b, bl
movzx r13d, bx
mov dword [rax + 0x20], ebx
call fcn.0001ebf8
mov rdi, rax
cmp rax, rbx
jne 0x25a2b
xor al, al
jmp 0x25bb0
mov esi, 1
mov edx, 0x810
mov ecx, esi
call fcn.000365b8
mov rbp, rax
cmp rax, rbx
jne 0x25a4f
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x25a24
mov edx, 0x418
mov ecx, esi
call fcn.000365b8
mov rsi, rax
cmp rax, rbx
je 0x25b9d
mov r14d, ebx
xor edx, edx
lea rax, [rsp + 0x90]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, ebx
jl 0x25b92
inc r14d
cmp dword [rbp + 4], 3
jne 0x25b87
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [0x0003d4c0]
mov word [rsp + 0x30], cx
mov word [rsp + 0x32], cx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
call fcn.000367f4
cmp al, bl
je 0x25af6
cmp r13w, bx
jne 0x25b87
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 8]
call fcn.000334e4
cmp al, bl
je 0x25b87
jmp 0x25b1e
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x30]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlPrefixUnicodeString]
cmp al, bl
je 0x25b87
cmp r13w, word [rsp + 0x30]
jae 0x25b87
mov r13w, word [rsp + 0x30]
cmp r15, rbx
je 0x25b8f
lea rax, [rsp + 0x98]
lea rdx, [rsp + 0x30]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, ebx
jl 0x25b87
cmp dword [rsi + 0xc], 0x34
jbe 0x25b87
cmp dword [rsi + 4], 3
jne 0x25b87
mov ecx, dword [rsi + 8]
mov eax, dword [rsi + 0xc]
add eax, 0xfffffffe
add rcx, rsi
mov byte [rax + rcx], bl
mov eax, dword [rsi + 0xc]
dec eax
mov byte [rax + rcx], bl
mov eax, dword [rsi + 0xc]
cmp dword [rcx + 4], eax
jae 0x25b87
mov eax, dword [rcx + 8]
mov r12b, 1
mov dword [r15], eax
mov edx, r14d
jmp 0x25a6c
mov r12b, 1
mov rcx, rsi
call fcn.00036630
mov bl, r12b
mov rcx, rbp
call fcn.00036630
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x25bd0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rbx, rcx
xor r13d, r13d
lea rcx, [0x0003d4e0]
mov dword [rax + 0x10], r13d
mov dword [rax + 0x18], r13d
call fcn.0001ebf8
mov rdi, rax
cmp rax, r13
jne 0x25c0e
mov eax, 0xc000014d
jmp 0x25dbf
mov edx, 0x810
mov ecx, 1
call fcn.000365b8
mov rbp, rax
cmp rax, r13
jne 0x25c38
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000009a
jmp 0x25dbf
mov edx, 0x418
mov ecx, 1
call fcn.000365b8
mov rsi, rax
cmp rax, r13
jne 0x25c59
mov ebx, 0xc000009a
jmp 0x25dac
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ebx, 0xc0000001
mov r12d, r13d
xor edx, edx
jmp 0x25d77
inc r12d
cmp dword [rbp + 4], 3
jne 0x25d74
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x28], rax
mov r9, rsi
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jl 0x25d74
cmp dword [rsi + 0xc], 0x34
jbe 0x25d74
cmp dword [rsi + 4], 3
jne 0x25d74
mov edx, dword [rsi + 8]
mov eax, dword [rsi + 0xc]
mov r9d, 2
sub eax, r9d
add rdx, rsi
mov byte [rax + rdx], r13b
mov eax, dword [rsi + 0xc]
dec eax
mov byte [rax + rdx], r13b
mov eax, dword [rsi + 0xc]
cmp dword [rdx + 4], eax
jae 0x25d74
mov r8d, dword [rdx + 4]
add r8, rdx
mov qword [rsp + 0x38], r8
movzx ecx, word [rsi + 0xc]
sub cx, word [rdx + 4]
mov word [rsp + 0x32], cx
mov word [rsp + 0x30], cx
cmp cx, r9w
jbe 0x25d45
movzx eax, cx
shr rax, 1
cmp word [r8 + rax*2 - 2], r13w
jne 0x25d45
sub cx, r9w
mov word [rsp + 0x30], cx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
cmp eax, r13d
jne 0x25d74
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov ebx, eax
cmp eax, r13d
cmovge ebx, r13d
mov edx, r12d
lea rax, [rsp + 0x98]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, r13d
jge 0x25c76
mov rcx, rsi
call fcn.00036630
mov rcx, rbp
call fcn.00036630
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x25ddc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rbx, rcx
xor r15d, r15d
lea rcx, [0x0003d4e0]
mov r14d, edx
mov dword [rax + 0x18], r15d
mov dword [rax + 0x20], r15d
call fcn.0001ebf8
mov rsi, rax
cmp rax, r15
jne 0x25e21
mov eax, 0xc000014d
jmp 0x25fea
mov edx, 0x810
mov ecx, 1
call fcn.000365b8
mov rbp, rax
cmp rax, r15
jne 0x25e4b
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000009a
jmp 0x25fea
mov edx, 0x418
mov ecx, 1
call fcn.000365b8
mov rdi, rax
cmp rax, r15
jne 0x25e6c
mov ebx, 0xc000009a
jmp 0x25fd7
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ebx, 0xc0000001
mov r13d, r15d
xor edx, edx
lea rax, [rsp + 0xb0]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, r15d
jl 0x25fcf
inc r13d
cmp dword [rbp + 4], 3
jne 0x25f96
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb8]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x28], rax
mov r9, rdi
mov r8d, 1
mov rcx, rsi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r15d
jl 0x25f96
cmp dword [rdi + 0xc], 0x34
jbe 0x25f96
cmp dword [rdi + 4], 3
jne 0x25f96
mov eax, dword [rdi + 0xc]
mov r12d, dword [rdi + 8]
mov r8d, 2
sub eax, r8d
add r12, rdi
mov byte [rax + r12], r15b
mov eax, dword [rdi + 0xc]
dec eax
mov byte [rax + r12], r15b
mov eax, dword [r12 + 4]
cmp eax, dword [rdi + 0xc]
jae 0x25f96
lea rdx, [r12 + rax]
mov qword [rsp + 0x38], rdx
movzx ecx, word [rdi + 0xc]
sub cx, word [r12 + 4]
mov word [rsp + 0x32], cx
mov word [rsp + 0x30], cx
cmp cx, r8w
jbe 0x25f7e
movzx eax, cx
shr rax, 1
cmp word [rdx + rax*2 - 2], r15w
jne 0x25f7e
sub cx, r8w
mov word [rsp + 0x30], cx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
cmp eax, r15d
je 0x25f9e
mov edx, r13d
jmp 0x25e84
mov dword [r12 + 8], r14d
mov eax, dword [rdi + 0xc]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, r15d
cmp eax, r15d
cmovl ebx, eax
mov rcx, rdi
call fcn.00036630
mov rcx, rbp
call fcn.00036630
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x26bc8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x280], rax
and qword [rsp + 0x30], 0
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x81]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x80], 0
call fcn.0003b2d0
and dword [rsp + 0x38], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov edx, 0x80000000
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x240
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x26d2d
lea rcx, [rsp + 0x70]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea r11, [rsp + 0x38]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0x70]
mov r8d, 2
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
js 0x26d2d
mov ecx, 1
cmp dword [rsp + 0x84], ecx
je 0x26cc4
cmp dword [rsp + 0x84], 2
jne 0x26d2d
mov edx, dword [rsp + 0x88]
add rdx, 0x12
call fcn.000365b8
mov rbx, rax
test rax, rax
je 0x26d2d
mov r8d, dword [rsp + 0x88]
xor edx, edx
mov rcx, rax
add r8, 0x12
call fcn.0003b2d0
lea rcx, [rbx + 0x10]
lea rdx, [rsp + 0x8c]
mov qword [rbx + 8], rcx
mov r8d, dword [rsp + 0x88]
call fcn.0003ad80
movzx r11d, word [rsp + 0x88]
mov word [rbx], r11w
movzx eax, word [rsp + 0x88]
mov word [rbx + 2], ax
mov rax, rbx
jmp 0x26d2f
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.0003acb0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret

Function at 0x26ddc
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x40
mov rbx, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x60]
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
add rsp, 0x40
pop rbx
ret

Function at 0x26e28
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x60], rax
and dword [rsp + 0x30], 0
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x38]
mov rdx, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], r11
lea rdx, [rsp + 0x38]
mov r8d, 2
mov rcx, rbx
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x26e9d
cmp dword [rsp + 0x4c], 4
jne 0x26e98
mov ecx, dword [rsp + 0x54]
mov dword [rdi], ecx
jmp 0x26e9d
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.0003acb0
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
Function at 0x2b914
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x2c0
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
xor ebp, ebp
mov bl, cl
mov rdi, rdx
lea rcx, [r11 - 0x226]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x38], ebp
mov word [rsp + 0xa0], bp
call fcn.0003b2d0
lea r11, [rsp + 0xa0]
mov eax, 0x208
mov word [rsp + 0x50], bp
mov word [rsp + 0x52], ax
mov qword [rsp + 0x58], r11
cmp bl, bpl
je 0x2b9b9
cmp word [0x0004ea40], bp
je 0x2bb16
lea rdx, [0x0004ea40]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rcx, [rsp + 0x90]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x30]
mov edx, 0x80000000
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rbp
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebp
jl 0x2bb16
mov edx, 0x818
mov ecx, 1
call fcn.000365b8
mov rcx, qword [rsp + 0x30]
mov rbx, rax
cmp rax, rbp
je 0x2bb10
lea rax, [rsp + 0x38]
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov esi, ebp
mov dword [rsp + 0x20], 0x818
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, ebp
jl 0x2bb03
lea rdi, [rbx + 0x10]
movzx ecx, word [rbx + 0xc]
inc esi
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
cmp cx, 6
jb 0x2bad6
cmp word [rdi], 0x7b
je 0x2bac7
lea rdx, [rdi + 2]
cmp word [rdx], 0x7b
jne 0x2bad6
movzx eax, cx
shr rax, 1
cmp word [rdi + rax*2 - 2], 0x7d
jne 0x2bad6
mov eax, 0xfffe
mov qword [rsp + 0x48], rdx
add cx, ax
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
lea rcx, [rsp + 0x40]
mov edx, 5
call fcn.0002b794
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, esi
mov dword [rsp + 0x20], 0x818
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, ebp
jge 0x2ba77
mov rcx, rbx
call fcn.00036630
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.0003acb0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x2bb48
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x2d0
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov bl, cl
mov rdi, rdx
lea rcx, [r11 - 0x226]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0xb0], bp
call fcn.0003b2d0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov eax, 0x208
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x38], ebp
mov word [rsp + 0x40], bp
mov word [rsp + 0x42], ax
cmp bl, bpl
je 0x2bbf3
cmp word [0x0004ea40], bp
je 0x2bd18
lea rdx, [0x0004ea40]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rcx, [rsp + 0x90]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x30]
mov edx, 0x80000000
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rbp
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebp
jl 0x2bd18
mov edx, 0x1000
mov ecx, 1
call fcn.000365b8
mov rcx, qword [rsp + 0x30]
mov rbx, rax
cmp rax, rbp
je 0x2bd12
lea rax, [rsp + 0x38]
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov esi, ebp
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, ebp
jl 0x2bd05
lea rdi, [rbx + 0xc]
movzx eax, word [rbx + 8]
inc esi
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x50], ax
mov word [rsp + 0x52], ax
cmp ax, bp
je 0x2bcdc
cmp word [rdi], 0x7b
jne 0x2bcdc
lea rcx, [rsp + 0x50]
mov edx, 5
call fcn.0002b794
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, esi
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, ebp
jge 0x2bcad
mov rcx, rbx
call fcn.00036630
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.0003acb0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x2bdec
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, 5
lea rdx, [0x0003db00]
xor ecx, ecx
mov r8d, ebx
call fcn.0002b914
lea rdx, [0x0003dbc0]
mov r8d, ebx
xor ecx, ecx
call fcn.0002b914
lea rdx, [0x0003dc50]
mov r8d, ebx
xor ecx, ecx
call fcn.0002bb48
lea rdx, [0x0003dcd0]
mov r8d, ebx
xor ecx, ecx
call fcn.0002bb48
lea rdx, [0x0003dd60]
mov r8d, ebx
xor ecx, ecx
call fcn.0002b914
lea rdx, [0x0003ddf0]
mov r8d, ebx
xor ecx, ecx
call fcn.0002b914
lea rdx, [0x0003dec0]
mov r8d, ebx
xor ecx, ecx
call fcn.0002b914
lea rdx, [0x0003df70]
mov r8d, ebx
xor ecx, ecx
call fcn.0002bb48
lea rdx, [0x0003e010]
mov r8d, ebx
xor ecx, ecx
call fcn.0002bb48
lea rdx, [0x0003e0c0]
mov r8d, ebx
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.0002b914

Function at 0x2beac
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, 5
lea rdx, [0x0003e160]
mov cl, 1
mov r8d, ebx
call fcn.0002bb48
lea rdx, [0x0003e1e0]
mov r8d, ebx
mov cl, 1
call fcn.0002bb48
lea rdx, [0x0003e260]
mov r8d, ebx
mov cl, 1
call fcn.0002b914
lea rdx, [0x0003e2d0]
mov r8d, ebx
mov cl, 1
call fcn.0002bb48
lea rdx, [0x0003e360]
mov r8d, ebx
mov cl, 1
call fcn.0002bb48
lea rdx, [0x0003e3f0]
mov r8d, ebx
mov cl, 1
add rsp, 0x20
pop rbx
jmp fcn.0002b914

Function at 0x2d624
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
cmp byte [0x0004ea39], 0
mov r12d, r9d
mov r13d, r8d
mov rsi, rdx
mov rbp, rcx
jne 0x2d65b
mov eax, 0xc0000001
jmp 0x2d70c
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call fcn.0002d360
test al, al
je 0x2d677
xor eax, eax
jmp 0x2d70c
lea rcx, [0x0003e480]
call fcn.0001ebf8
mov rdi, rax
test rax, rax
je 0x2d651
mov eax, 0x5432
mov r9d, 3
xor r8d, r8d
mov word [rsp + 0x30], ax
lea rax, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3c], r12d
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, eax
test eax, eax
js 0x2d701
mov ecx, 1
lock xadd dword [0x0004bb24], ecx
inc ecx
mov r9d, r12d
mov r8d, r13d
mov rdx, rsi
mov dword [rbp], ecx
call fcn.0002d0d4
test al, al
jne 0x2d701
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov ebx, 0xc0000001
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x2d72c
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor bl, bl
xor esi, esi
mov ebp, ecx
cmp byte [0x0004ea39], bl
jne 0x2d758
mov eax, 0xc0000001
jmp 0x2d806
lea rcx, [0x0003e480]
call fcn.0001ebf8
mov rdi, rax
test rax, rax
je 0x2d74e
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0005afc0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rax, qword [0x0005b030]
lea rcx, [0x0005b030]
jmp 0x2d79c
mov rsi, rax
cmp dword [rax + 0x10], ebp
je 0x2d7a3
mov rax, qword [rax]
cmp rax, rcx
jne 0x2d791
jmp 0x2d7b3
mov rdx, qword [rax]
mov rax, qword [rax + 8]
mov bl, 1
mov qword [rax], rdx
mov qword [rdx + 8], rax
lea rcx, [0x0005afc0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
test bl, bl
je 0x2d7f6
mov rdx, qword [rsi + 0x20]
mov rcx, rdi
add rdx, 0x20
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, qword [rsi + 0x20]
mov ebx, eax
call fcn.0002d084
mov edx, 0x49544650
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x2d7fb
mov ebx, 0xc0000225
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret