joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff741aadf8
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0x88]
mov rdi, rcx
mov r14, r9
mov r9d, dword [rcx + 0x220]
xor ebp, ebp
and eax, 0xa
mov ecx, r9d
mov r15d, r8d
mov r13, rdx
and ecx, 1
cmp qword [rdi], rbp
jne 0x7ff741aae45
cmp qword [rdi + 0x10], rbp
je 0x7ff741aae4d
cmp eax, ebp
jne 0x7ff741aae57
cmp ecx, ebp
jne 0x7ff741aae57
mov ebx, 0x57
jmp 0x7ff741aaf6a
test byte [rsp + 0x88], 3
mov r12d, dword [rsp + 0x80]
je 0x7ff741aaedb
lea r8, [rdi + 0x20]
lea rdx, [rdi + 8]
mov rcx, rdi
mov dword [rsp + 0x20], 1
call fcn.7ff7418c1a0
mov ebx, eax
cmp eax, ebp
jne 0x7ff741aaf6a
test byte [rsp + 0x88], 2
jne 0x7ff741aaebb
mov rcx, qword [rdi]
mov qword [rsp + 0x30], rbp
mov r9d, 0xffff
mov r8, r13
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call sym.SHLWAPI.dll_SHRegGetValueA
cmp eax, ebp
je 0x7ff741aaee5
mov rcx, qword [rdi]
mov r9d, r15d
xor r8d, r8d
mov rdx, r13
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExA]
mov ebx, eax
jmp 0x7ff741aaedd
mov ebx, ebp
cmp ebx, ebp
jne 0x7ff741aaf6a
test byte [rsp + 0x88], 0xc
je 0x7ff741aaf6a
mov r9d, dword [rdi + 0x220]
lea rbp, [rdi + 0x10]
lea r8, [rdi + 0x20]
lea rdx, [rdi + 0x18]
mov rcx, rbp
mov dword [rsp + 0x20], 1
call fcn.7ff7418c1a0
xor edi, edi
mov ebx, eax
cmp eax, edi
jne 0x7ff741aaf6a
test byte [rsp + 0x88], 8
jne 0x7ff741aaf4b
mov rcx, qword [rbp]
mov qword [rsp + 0x30], rdi
mov r9d, 0xffff
mov r8, r13
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call sym.SHLWAPI.dll_SHRegGetValueA
cmp eax, edi
je 0x7ff741aaf6a
mov rcx, qword [rbp]
mov r9d, r15d
xor r8d, r8d
mov rdx, r13
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExA]
mov ebx, eax
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop r14
pop r13
ret
Function at 0x7ff741ab140
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0x90]
mov rbp, r9
mov r13, r8
mov r14d, edx
mov rbx, rcx
cmp eax, 0x11
je 0x7ff741ab291
xor r15d, r15d
cmp eax, r15d
mov edi, r15d
mov ecx, r15d
sete dil
cmp eax, 1
mov esi, r15d
sete cl
cmp eax, 0x10
sete sil
cmp rbx, r15
je 0x7ff741ab28a
cmp qword [rbx], r15
jne 0x7ff741ab1b0
cmp qword [rbx + 0x10], r15
je 0x7ff741ab28a
cmp edi, r15d
jne 0x7ff741ab1c3
cmp ecx, r15d
jne 0x7ff741ab1c3
cmp esi, r15d
je 0x7ff741ab28a
mov r12d, dword [r9]
cmp ecx, r15d
jne 0x7ff741ab1d7
cmp edi, r15d
jne 0x7ff741ab1d7
mov eax, 2
jmp 0x7ff741ab21e
mov r9d, dword [rbx + 0x220]
lea r8, [rbx + 0x20]
lea rdx, [rbx + 8]
mov rcx, rbx
mov dword [rsp + 0x20], r15d
call fcn.7ff7418c1a0
cmp eax, r15d
jne 0x7ff741ab21e
mov rcx, qword [rbx]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov r9, rbp
mov r8, r13
mov edx, r14d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExA]
cmp esi, r15d
jne 0x7ff741ab23b
cmp edi, r15d
je 0x7ff741ab296
cmp eax, r15d
je 0x7ff741ab296
cmp eax, 0xea
je 0x7ff741ab296
cmp eax, 0x103
je 0x7ff741ab296
mov r9d, dword [rbx + 0x220]
lea r8, [rbx + 0x20]
lea rdx, [rbx + 0x18]
lea rcx, [rbx + 0x10]
mov dword [rsp + 0x20], r15d
call fcn.7ff7418c1a0
cmp eax, r15d
jne 0x7ff741ab296
mov qword [rsp + 0x38], r15
mov dword [rbp], r12d
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x30], r15
mov r9, rbp
mov r8, r13
mov edx, r14d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExA]
jmp 0x7ff741ab296
mov eax, 0x57
jmp 0x7ff741ab296
mov eax, 0x78
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x7ff741ab2bc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0xb8]
mov r12, r9
mov rbx, rcx
cmp eax, 0x11
je 0x7ff741ab448
xor esi, esi
test eax, eax
sete sil
xor ecx, ecx
cmp eax, 1
sete cl
xor ebp, ebp
cmp eax, 0x10
sete bpl
test rbx, rbx
je 0x7ff741ab441
cmp qword [rbx], 0
jne 0x7ff741ab322
cmp qword [rbx + 0x10], 0
je 0x7ff741ab441
test esi, esi
jne 0x7ff741ab332
test ecx, ecx
jne 0x7ff741ab332
test ebp, ebp
je 0x7ff741ab441
mov rdi, qword [rsp + 0xb0]
mov r14d, dword [r9]
test rdi, rdi
je 0x7ff741ab347
mov r13d, dword [rdi]
jmp 0x7ff741ab34a
xor r13d, r13d
mov r15, qword [rsp + 0xa8]
test ecx, ecx
jne 0x7ff741ab35f
test esi, esi
jne 0x7ff741ab35f
lea eax, [rcx + 2]
jmp 0x7ff741ab3b7
mov r9d, dword [rbx + 0x220]
and dword [rsp + 0x20], 0
lea r8, [rbx + 0x20]
lea rdx, [rbx + 8]
mov rcx, rbx
call fcn.7ff7418c1a0
test eax, eax
jne 0x7ff741ab3b7
mov rax, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x90]
mov edx, dword [rsp + 0x88]
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9, r12
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumValueA]
test ebp, ebp
jne 0x7ff741ab3d9
test esi, esi
je 0x7ff741ab44d
test eax, eax
je 0x7ff741ab44d
cmp eax, 0xea
je 0x7ff741ab44d
cmp eax, 0x103
je 0x7ff741ab44d
mov r9d, dword [rbx + 0x220]
and dword [rsp + 0x20], 0
lea r8, [rbx + 0x20]
lea rdx, [rbx + 0x18]
lea rcx, [rbx + 0x10]
call fcn.7ff7418c1a0
test eax, eax
jne 0x7ff741ab44d
mov dword [r12], r14d
test rdi, rdi
je 0x7ff741ab406
mov dword [rdi], r13d
mov rax, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x90]
mov edx, dword [rsp + 0x88]
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9, r12
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumValueA]
jmp 0x7ff741ab44d
mov eax, 0x57
jmp 0x7ff741ab44d
mov eax, 0x78
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x7ff741ab874
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp rcx, rdi
je 0x7ff741ab8b0
lea ecx, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, ebx
cmp eax, 0xffffffff
setne dil
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x7ff741ac3f0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rsp + 0xb0]
xor ebx, ebx
mov ebp, r9d
mov rsi, r8
mov rdi, rcx
test rdx, rdx
je 0x7ff741ac459
cmp byte [rdx], bl
je 0x7ff741ac459
and qword [r11 - 0x48], rbx
lea rax, [r11 - 0x38]
xor r9d, r9d
mov qword [r11 - 0x50], rax
and qword [r11 - 0x58], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], ebx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExA]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
jmp 0x7ff741ac45e
mov qword [rsp + 0x50], rcx
test ebx, ebx
jne 0x7ff741ac493
mov eax, dword [rsp + 0xb8]
mov r9d, ebp
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rsi
mov qword [rsp + 0x20], r12
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
cmp rcx, rdi
je 0x7ff741ac493
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff741947a0
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x7ff741ac4b4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [r11 - 0x20]
mov r9d, 0x2001b
xor r8d, r8d
mov rsi, rdx
mov rdi, rcx
mov qword [r11 - 0x68], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x7ff741ac57e
and qword [rsp + 0x58], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x7ff741ac56e
cmp dword [rsp + 0x64], eax
jne 0x7ff741ac56e
cmp dword [rsp + 0x60], eax
jne 0x7ff741ac56e
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExA]
mov ebx, eax
jmp 0x7ff741ac573
mov ebx, 0x91
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.7ff741947a0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x7ff741ac5a8
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov rdi, r8
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x7ff741ac5fe
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff741947a0
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x7ff741add80
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x8c0
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x8b0], rax
mov rax, r8
mov r10, rdx
mov rdi, rcx
lea r8, [0x7ff741d0b50]
lea r9, [rsp + 0xb0]
mov esi, 0x80004005
mov rdx, rax
mov rcx, r10
mov dword [rsp + 0x20], 0x400
mov ebx, esi
call fcn.7ff741adb5c
test eax, eax
je 0x7ff741ade85
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xb0]
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHEvaluateSystemCommandTemplate]
mov ebx, eax
test eax, eax
js 0x7ff741ade85
xor edx, edx
lea rcx, [rsp + 0x44]
mov dword [rsp + 0x40], 0x70
lea r8d, [rdx + 0x6c]
call sub.ntdll.dll_memset
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x44], 0x4000000
mov qword [rsp + 0x60], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x7ff741ade57
xor ebx, ebx
jmp 0x7ff741ade6f
call fcn.7ff7418a670
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, esi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, ebx
mov rcx, qword [rsp + 0x8b0]
xor rcx, rsp
call fcn.7ff741947a0
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x7ff741adf3c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x2f0
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rsi, rcx
mov rbp, rdx
mov r9, rdx
lea rcx, [rsp + 0xe0]
lea r8, str.SoftwareClients_s
mov edx, 0x100
call fcn.7ff74192518
mov ebx, eax
test eax, eax
js 0x7ff741ae106
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xe0]
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x30], 0xa0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov r12, 0xffffffff80000002
mov edi, eax
test eax, eax
je 0x7ff741ae06e
mov ebx, 0xea
cmp eax, ebx
je 0x7ff741ae057
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0xe0]
mov r9d, 0x20219
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x7ff741ae02e
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x30], 0xa0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov rcx, qword [rsp + 0x38]
mov edi, eax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
test edi, edi
je 0x7ff741ae06e
cmp edi, ebx
je 0x7ff741ae057
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xe0]
mov rcx, r12
mov dword [rsp + 0x30], 0xa0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov edi, eax
test edi, edi
je 0x7ff741ae06e
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x7ff741ae106
lea rax, [rsp + 0x40]
lea r8, str.SoftwareClients_s_s
lea rcx, [rsp + 0xe0]
mov r9, rbp
mov edx, 0x100
mov qword [rsp + 0x20], rax
call fcn.7ff74192518
mov ebx, eax
test eax, eax
js 0x7ff741ae106
lea r9, str.Open
lea r8, [rsp + 0xe0]
mov rdx, r12
mov rcx, rsi
call sym.SHLWAPI.dll_Ordinal_468
mov ebx, eax
test eax, eax
jns 0x7ff741ae106
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0xe0]
mov r9d, 0x20219
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x7ff741ae106
mov rdx, qword [rsp + 0x38]
lea r9, str.Open
xor r8d, r8d
mov rcx, rsi
call sym.SHLWAPI.dll_Ordinal_468
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.7ff741947a0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x7ff741ae174
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x490
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor esi, esi
mov ebx, esi
cmp rcx, rsi
je 0x7ff741ae21a
mov rdx, rcx
lea r8, [0x7ff741de528]
lea rcx, [rsp + 0x270]
call sym.SHLWAPI.dll_PathCombineW
cmp rax, rsi
je 0x7ff741ae21a
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x7ff741ae21a
lea ebx, [rsi + 1]
cmp word [rsp + 0x4c], 0x2e
jne 0x7ff741ae20f
movzx ecx, word [rsp + 0x4e]
cmp cx, si
je 0x7ff741ae1fb
cmp cx, 0x2e
jne 0x7ff741ae20f
cmp word [rsp + 0x50], si
jne 0x7ff741ae20f
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, esi
je 0x7ff741ae211
jmp 0x7ff741ae1dc
mov ebx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.7ff741947a0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x7ff741ae8bc
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov rbx, rcx
cmp rcx, rax
je 0x7ff741ae8f0
cmp word [rcx], ax
je 0x7ff741ae8f0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x7ff741ae8f0
test al, 0x10
je 0x7ff741ae8f0
and eax, 0xfffffffa
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x7ff741ae8f2
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x7ff741ae900
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0x28
mov eax, edx
xor edx, edx
cmp rcx, rdx
je 0x7ff741ae918
cmp word [rcx], dx
je 0x7ff741ae918
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x7ff741ae92c
test al, 0x10
je 0x7ff741ae92c
test al, 5
je 0x7ff741ae92c
mov eax, 1
jmp 0x7ff741ae92e
xor eax, eax
add rsp, 0x28
ret
Function at 0x7ff741aec1c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0x88]
mov rdi, rcx
mov r14, r9
mov r9d, dword [rcx + 0x220]
xor ebp, ebp
and eax, 0xa
mov ecx, r9d
mov r15d, r8d
mov r13, rdx
and ecx, 1
cmp qword [rdi], rbp
jne 0x7ff741aec69
cmp qword [rdi + 0x10], rbp
je 0x7ff741aec71
cmp eax, ebp
jne 0x7ff741aec7b
cmp ecx, ebp
jne 0x7ff741aec7b
mov ebx, 0x57
jmp 0x7ff741aed8e
test byte [rsp + 0x88], 3
mov r12d, dword [rsp + 0x80]
je 0x7ff741aecff
lea r8, [rdi + 0x20]
lea rdx, [rdi + 8]
mov rcx, rdi
mov dword [rsp + 0x20], 1
call fcn.7ff7418c1a0
mov ebx, eax
cmp eax, ebp
jne 0x7ff741aed8e
test byte [rsp + 0x88], 2
jne 0x7ff741aecdf
mov rcx, qword [rdi]
mov qword [rsp + 0x30], rbp
mov r9d, 0xffff
mov r8, r13
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call sym.SHLWAPI.dll_SHRegGetValueW
cmp eax, ebp
je 0x7ff741aed09
mov rcx, qword [rdi]
mov r9d, r15d
xor r8d, r8d
mov rdx, r13
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov ebx, eax
jmp 0x7ff741aed01
mov ebx, ebp
cmp ebx, ebp
jne 0x7ff741aed8e
test byte [rsp + 0x88], 0xc
je 0x7ff741aed8e
mov r9d, dword [rdi + 0x220]
lea rbp, [rdi + 0x10]
lea r8, [rdi + 0x20]
lea rdx, [rdi + 0x18]
mov rcx, rbp
mov dword [rsp + 0x20], 1
call fcn.7ff7418c1a0
xor edi, edi
mov ebx, eax
cmp eax, edi
jne 0x7ff741aed8e
test byte [rsp + 0x88], 8
jne 0x7ff741aed6f
mov rcx, qword [rbp]
mov qword [rsp + 0x30], rdi
mov r9d, 0xffff
mov r8, r13
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call sym.SHLWAPI.dll_SHRegGetValueW
cmp eax, edi
je 0x7ff741aed8e
mov rcx, qword [rbp]
mov r9d, r15d
xor r8d, r8d
mov rdx, r13
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov ebx, eax
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop r14
pop r13
ret
Function at 0x7ff741aee4c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0xb8]
mov r12, r9
mov rbx, rcx
cmp eax, 0x11
je 0x7ff741aefd8
xor esi, esi
test eax, eax
sete sil
xor ecx, ecx
cmp eax, 1
sete cl
xor ebp, ebp
cmp eax, 0x10
sete bpl
test rbx, rbx
je 0x7ff741aefd1
cmp qword [rbx], 0
jne 0x7ff741aeeb2
cmp qword [rbx + 0x10], 0
je 0x7ff741aefd1
test esi, esi
jne 0x7ff741aeec2
test ecx, ecx
jne 0x7ff741aeec2
test ebp, ebp
je 0x7ff741aefd1
mov rdi, qword [rsp + 0xb0]
mov r14d, dword [r9]
test rdi, rdi
je 0x7ff741aeed7
mov r13d, dword [rdi]
jmp 0x7ff741aeeda
xor r13d, r13d
mov r15, qword [rsp + 0xa8]
test ecx, ecx
jne 0x7ff741aeeef
test esi, esi
jne 0x7ff741aeeef
lea eax, [rcx + 2]
jmp 0x7ff741aef47
mov r9d, dword [rbx + 0x220]
and dword [rsp + 0x20], 0
lea r8, [rbx + 0x20]
lea rdx, [rbx + 8]
mov rcx, rbx
call fcn.7ff7418c1a0
test eax, eax
jne 0x7ff741aef47
mov rax, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x90]
mov edx, dword [rsp + 0x88]
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9, r12
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumValueW]
test ebp, ebp
jne 0x7ff741aef69
test esi, esi
je 0x7ff741aefdd
test eax, eax
je 0x7ff741aefdd
cmp eax, 0xea
je 0x7ff741aefdd
cmp eax, 0x103
je 0x7ff741aefdd
mov r9d, dword [rbx + 0x220]
and dword [rsp + 0x20], 0
lea r8, [rbx + 0x20]
lea rdx, [rbx + 0x18]
lea rcx, [rbx + 0x10]
call fcn.7ff7418c1a0
test eax, eax
jne 0x7ff741aefdd
mov dword [r12], r14d
test rdi, rdi
je 0x7ff741aef96
mov dword [rdi], r13d
mov rax, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x90]
mov edx, dword [rsp + 0x88]
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9, r12
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumValueW]
jmp 0x7ff741aefdd
mov eax, 0x57
jmp 0x7ff741aefdd
mov eax, 0x78
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff741af040
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [r11 - 0x20]
mov r9d, 0x2001b
xor r8d, r8d
mov rsi, rdx
mov rdi, rcx
mov qword [r11 - 0x68], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x7ff741af10a
and qword [rsp + 0x58], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x7ff741af0fa
cmp dword [rsp + 0x64], eax
jne 0x7ff741af0fa
cmp dword [rsp + 0x60], eax
jne 0x7ff741af0fa
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExW]
mov ebx, eax
jmp 0x7ff741af0ff
mov ebx, 0x91
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.7ff741947a0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret