joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f7e4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x180019018]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov r9d, 0x103
mov dword [rsp + 0x30], 5
mov rdi, r8
mov rbx, rcx
mov r8, rdx
lea rcx, [rsp + 0x40]
xor r14d, r14d
lea edx, [r9 + 1]
mov word [rbp + 0x146], r14w
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
lea r8, str.Mount
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x18000f8d7
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.Retransmissions
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, dword [rsp + 0x30]
mov dword [rdi + 0x18], eax
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.180001570
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop r14
pop rdi
pop rbp
ret

Function at 0x18000f908
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x180019018]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov r9d, 0x103
mov dword [rsp + 0x30], 0xf
mov rdi, r8
mov rbx, rcx
mov r8, rdx
lea rcx, [rsp + 0x40]
xor r14d, r14d
lea edx, [r9 + 1]
mov word [rbp + 0x146], r14w
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
lea r8, str.Mount
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x18000f9fb
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.SecFlavors
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, dword [rsp + 0x30]
mov dword [rdi + 0x3c], eax
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.180001570
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop r14
pop rdi
pop rbp
ret
Function at 0x18000fa2c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x40
and dword [rbp + 0x28], 0
lea rax, [rbp - 8]
and dword [rbp - 0x10], 0
lea rdx, str.SOFTWAREMicrosoftClientForNFSCurrentVersionUsersDefault
mov rbx, r8
mov qword [r11 - 0x28], rax
xor r8d, r8d
mov dword [rbp + 0x10], 1
mov r9d, 0x20019
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x18000fb3a
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rdx, str.SymLinks
lea rax, [rbp + 0x10]
mov dword [rbp + 0x18], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rdx, str.DeleteSymlinks
lea rax, [rbp + 0x28]
mov dword [rbp + 0x18], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rdx, str.DisplayAllLinks
lea rax, [rbp - 0x10]
mov dword [rbp + 0x18], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
cmp dword [rbp + 0x10], 0
je 0x18000fb45
bts dword [rbx + 0x38], 9
cmp dword [rbp + 0x28], 0
je 0x18000fb50
bts dword [rbx + 0x38], 0xc
cmp dword [rbp - 0x10], 0
je 0x18000fb5b
bts dword [rbx + 0x38], 0xb
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x18000fb70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x180019018]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov r9d, 0x103
mov dword [rsp + 0x30], 8
mov rdi, r8
mov rbx, rcx
mov r8, rdx
lea rcx, [rsp + 0x40]
xor r14d, r14d
lea edx, [r9 + 1]
mov word [rbp + 0x146], r14w
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
lea r8, str.Mount
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x18000fc63
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.Timeout
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, dword [rsp + 0x30]
mov dword [rdi + 0x14], eax
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.180001570
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop r14
pop rdi
pop rbp
ret
Function at 0x18001029c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x180019018]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor r14d, r14d
mov dword [rsp + 0x34], 1
mov r9d, 0x103
mov dword [rsp + 0x38], 1
mov rdi, r8
mov dword [rsp + 0x3c], r14d
mov rbx, rcx
mov qword [rsp + 0x40], r14
mov r8, rdx
mov word [rbp + 0x156], r14w
lea edx, [r9 + 1]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
lea r8, str.Mount
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
lea ebx, [r14 + 4]
test eax, eax
jne 0x180010411
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.Locking
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.Version3
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.EUCMount
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, dword [rdi + 0x38]
cmp dword [rsp + 0x34], r14d
je 0x180010420
or eax, 1
jmp 0x180010423
and eax, 0xfffffffe
cmp dword [rsp + 0x38], r14d
je 0x18001042e
or eax, ebx
jmp 0x180010431
and eax, 0xfffffffb
mov dword [rdi + 0x38], eax
mov ecx, dword [rsp + 0x3c]
test ecx, ecx
je 0x18001048a
mov edx, 0x2000
cmp ecx, edx
jne 0x180010449
or eax, edx
jmp 0x18001048f
cmp ecx, 0x40
jne 0x180010452
or eax, ecx
jmp 0x18001048f
mov edx, 0x4000
cmp ecx, edx
je 0x180010445
mov edx, 0x8000
cmp ecx, edx
je 0x180010445
mov edx, 0x10000
cmp ecx, edx
je 0x180010445
mov edx, 0x20000
cmp ecx, edx
je 0x180010445
mov edx, 0x40000
cmp ecx, edx
je 0x180010445
mov edx, 0x80000
cmp ecx, edx
jne 0x180010492
jmp 0x180010445
and eax, 0xfff01fbf
mov dword [rdi + 0x38], eax
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.180001570
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x270
pop r14
pop rdi
pop rbp
ret
Function at 0x1800104bc
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x180019018]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, qword [r8]
mov rdi, r8
mov r8, rdx
mov rbx, rcx
xor r15d, r15d
lea rcx, [rsp + 0x70]
mov edx, 0x104
mov qword [rsp + 0x58], r15
mov word [rbp + 0x176], r15w
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
lea r8, str.Cache
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x70]
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rbx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x180010688
mov eax, dword [rsi + 0x38]
lea ebx, [r15 + 4]
mov rcx, qword [rsp + 0x58]
lea rdx, str.FileAttributeCache
shr eax, 4
mov r9d, ebx
and eax, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x50], eax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov eax, dword [rsi + 0x38]
lea rdx, str.RemoteWriteCache
mov rcx, qword [rsp + 0x58]
mov r9d, ebx
shr eax, 3
xor r8d, r8d
and eax, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rax, qword [rdi]
lea rdx, str.HashTableSize
mov rcx, qword [rsp + 0x58]
add rax, 0x28
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rax, qword [rdi]
lea rdx, str.AttributeTimeDelta
mov rcx, qword [rsp + 0x58]
add rax, 0x30
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
lea rax, [rdi + 0x20]
mov dword [rsp + 0x28], ebx
lea rdx, str.CacheBlocks
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.180001570
add rsp, 0x290
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800106ac
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x180019018]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rdi, r8
mov rbx, rcx
mov r8, rdx
lea rcx, [rsp + 0x70]
xor esi, esi
mov edx, 0x104
mov qword [rsp + 0x58], rsi
mov word [rbp + 0x176], si
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x70]
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rbx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1800107f9
mov rcx, qword [rsp + 0x58]
lea ebx, [rsi + 4]
lea rax, [rdi + 0x20]
mov dword [rsp + 0x28], ebx
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Access
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov eax, dword [rdi + 0x38]
lea rdx, str.NFSLookup
mov rcx, qword [rsp + 0x58]
mov r9d, ebx
shr eax, 7
xor r8d, r8d
and eax, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov eax, dword [rdi + 0x38]
lea rdx, str.NFSReaddir
mov rcx, qword [rsp + 0x58]
mov r9d, ebx
shr eax, 8
xor r8d, r8d
and eax, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.180001570
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x180010824
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [0x180019018]
xor rax, rsp
mov qword [rbp + 0x590], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x170]
call sub.msvcrt.dll_memset
mov r8, rbx
lea rcx, [rsp + 0x60]
mov ebx, 0x104
xor r14d, r14d
mov edx, ebx
mov word [rbp + 0x166], r14w
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
lea r8, str.Auth
mov edx, ebx
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdi
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x180010a11
lea r8, [rsi + 0x10]
mov edx, ebx
lea rcx, [rbp + 0x380]
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x380]
call fcn.18000e5e0
or rbx, 0xffffffffffffffff
lea rdx, [rbp + 0x170]
mov rax, rbx
inc rax
cmp word [rdx + rax*2], r14w
jne 0x18001092a
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.User
lea rax, [rbp + 0x170]
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
lea rcx, [rsi + 0x428]
inc rbx
cmp word [rcx + rbx*2], r14w
jne 0x180010973
lea eax, [rbx*2 + 2]
xor r8d, r8d
mov dword [rsp + 0x28], eax
lea rdx, str.PCNFSDServer
mov qword [rsp + 0x20], rcx
mov ebx, 1
mov rcx, qword [rsp + 0x50]
mov r9d, ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rdx, str.NISDomain
mov r9d, ebx
mov dword [rsp + 0x28], r14d
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rdx, str.NISServer
mov r9d, ebx
mov dword [rsp + 0x28], r14d
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.180001570
add rsp, 0x6a0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180010a38
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x180019018]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rdi, r8
mov rbx, rcx
mov r8, rdx
lea rcx, [rsp + 0x60]
xor r14d, r14d
mov edx, 0x104
mov word [rbp + 0x166], r14w
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
lea r8, str.Mount
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rbx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x180010c76
mov rcx, qword [rsp + 0x50]
lea ebx, [r14 + 4]
lea rax, [rdi + 0xc]
mov dword [rsp + 0x28], ebx
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ReadBuffer
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rax, [rdi + 0x10]
mov dword [rsp + 0x28], ebx
lea rdx, str.WriteBuffer
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rax, [rdi + 0x14]
mov dword [rsp + 0x28], ebx
lea rdx, str.Timeout
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rax, [rdi + 0x18]
mov dword [rsp + 0x28], ebx
lea rdx, str.Retransmissions
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rax, [rdi + 0x1c]
mov dword [rsp + 0x28], ebx
lea rdx, str.MountType
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
lea rax, [rdi + 0x3c]
mov dword [rsp + 0x28], ebx
lea rdx, str.SecFlavors
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov eax, dword [rdi + 0x38]
lea rdx, str.Locking
mov rcx, qword [rsp + 0x50]
and eax, 1
mov dword [rsp + 0x58], eax
mov r9d, ebx
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov eax, dword [rdi + 0x38]
lea rdx, str.Version3
mov rcx, qword [rsp + 0x50]
mov r9d, ebx
shr eax, 2
xor r8d, r8d
and eax, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.180001570
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x280
pop r14
pop rdi
pop rbp
ret
Function at 0x180010e40
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov eax, dword [r8 + 0x38]
mov r9d, 1
shr eax, 9
and eax, r9d
test dword [r8 + 0x38], 0x1000
mov dword [rbp + 0x20], eax
lea eax, [r9 - 1]
cmovne eax, r9d
test dword [r8 + 0x38], 0x800
mov dword [rbp + 0x28], eax
lea eax, [r9 - 1]
cmovne eax, r9d
xor r9d, r9d
mov dword [rbp - 0x10], eax
xor r8d, r8d
lea rax, [rbp - 0xc]
mov qword [r11 - 0x28], rax
lea rax, [rbp - 8]
mov qword [r11 - 0x30], rax
and qword [r11 - 0x38], 0
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x180010f55
mov rcx, qword [rbp - 8]
lea ebx, [rax + 4]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], ebx
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SymLinks
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x28]
mov dword [rsp + 0x28], ebx
lea rdx, str.DeleteSymlinks
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
mov dword [rsp + 0x28], ebx
lea rdx, str.DisplayAllLinks
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18001206c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor r12d, r12d
mov rsi, rdx
mov qword [rsp + 0x40], r12
mov r13, rcx
call fcn.180012508
mov rbx, rax
test rax, rax
je 0x18001228c
mov edi, dword [rax + 8]
test edi, edi
je 0x18001226d
mov ebp, dword [rsi]
lea eax, [r12 + 1]
test ebp, ebp
jne 0x1800120ba
mov ebp, r12d
jmp 0x1800120cc
cmp ebp, 0xffffffff
jne 0x1800120c4
mov ebp, r12d
jmp 0x1800120ce
cmp ebp, edi
jae 0x18001224e
mov edi, eax
mov ecx, edi
mov edx, 0x20
mov dword [rsi], edi
call qword [sym.imp.msvcrt.dll_calloc]
nop dword [rax + rax]
mov qword [rsp + 0x40], rax
mov r14, rax
test rax, rax
je 0x180012220
mov r15d, r12d
test edi, edi
je 0x180012234
mov ecx, dword [rbx + 0x10]
cmp ecx, 0xff
ja 0x180012201
cmp dword [rbx + 0x14], 0xff
ja 0x180012201
inc ecx
mov dword [rsp + 0xa8], ecx
mov eax, dword [rbx + 0x14]
inc eax
mov edx, ecx
mov ecx, 2
mov dword [rsp + 0xa0], eax
call qword [sym.imp.msvcrt.dll_calloc]
nop dword [rax + rax]
mov qword [r14], rax
mov r12, rax
test rax, rax
je 0x1800121ee
mov edx, dword [rsp + 0xa0]
mov ecx, 2
call qword [sym.imp.msvcrt.dll_calloc]
nop dword [rax + rax]
mov qword [r14 + 8], rax
test rax, rax
je 0x1800121ee
lea rcx, [r14 + 0x14]
mov r8, r12
mov qword [rsp + 0x38], rcx
lea r9, [rsp + 0xa8]
lea rcx, [rsp + 0xa0]
mov edx, ebp
mov qword [rsp + 0x30], rcx
mov rcx, r13
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov r12d, eax
test eax, eax
jne 0x1800121ce
inc r15d
inc ebp
add r14, 0x20
cmp r15d, edi
jb 0x1800120ff
xor r12d, r12d
jmp 0x180012234
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.180012c98
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor r12d, r12d
jmp 0x180012231
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.180012c98
mov ecx, 8
jmp 0x1800121dd
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.180012c98
jmp 0x1800121e9
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov dword [rsi], r12d
mov rcx, qword [rbx]
test rcx, rcx
je 0x180012244
call sub.msvcrt.dll_free
mov qword [rbx], r12
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x1800122a0
mov rcx, qword [rbx]
test rcx, rcx
je 0x18001225e
call sub.msvcrt.dll_free
mov qword [rbx], r12
mov rcx, rbx
call sub.msvcrt.dll_free
mov ecx, 0x57
jmp 0x180012291
mov rcx, qword [rax]
test rcx, rcx
je 0x18001227d
call sub.msvcrt.dll_free
mov qword [rbx], r12
mov rcx, rbx
call sub.msvcrt.dll_free
mov ecx, 0x103
jmp 0x180012291
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov dword [rsi], r12d
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret