joyce8/EMBER2024-capa huggingface dataset:
Function at 0x24d30
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x850
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, rcx
lea rcx, [rsp + 0x42]
xor r13d, r13d
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x40], r13w
call fcn.0003a1a0
lea rcx, [0x0003c1b0]
call fcn.0001e4a4
mov rsi, rax
cmp rax, r13
jne 0x24d97
mov eax, 0xc000014d
jmp 0x24f01
cmp word [rbx], 0x21
jne 0x24ded
lea rax, [rsp + 0x40]
mov rdi, rbx
mov edx, 0x400
sub rdi, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffbfe]
cmp rax, r13
je 0x24dd5
movzx eax, word [rdi + rcx]
cmp ax, r13w
je 0x24dd5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x24db2
cmp rdx, r13
jne 0x24dde
sub rcx, 2
mov word [rcx], r13w
mov word [rsp + 0x83e], r13w
jmp 0x24e1b
cmp word [rbx], r13w
jne 0x24dfd
mov edi, 0xc000003b
jmp 0x24ef6
lea rdx, [rsp + 0x40]
mov r8d, 0x400
mov rcx, rbx
call fcn.00032180
cmp eax, r13d
mov edi, eax
jl 0x24ef6
lea rdx, [0x0003bd40]
xor eax, eax
or r14, 0xffffffffffffffff
mov rdi, rdx
mov rcx, r14
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
cmp eax, r13d
jne 0x24e52
mov edi, 0xc0000039
jmp 0x24ef6
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r12d, [rcx + rcx + 0x34]
lea ecx, [rax + 1]
mov edx, r12d
mov edi, r12d
call fcn.0003548c
mov rbp, rax
cmp rax, r13
jne 0x24e92
mov edi, 0xc000009a
jmp 0x24ef6
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.0003a1a0
xor eax, eax
mov dword [rbp], 0x11232fe
mov dword [rbp + 4], 0x34
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdx, rbx
not rcx
lea r8, [rcx + rcx]
lea rcx, [rbp + 0x34]
call fcn.00039c50
lea rdx, [rsp + 0x30]
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, rbp
mov edi, eax
call fcn.00035504
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.00039b80
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x24f34
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
lea rcx, [0x0003c1b0]
mov r15, rdx
mov dword [rax + 0x18], ebx
mov r12b, bl
movzx r13d, bx
mov dword [rax + 0x20], ebx
call fcn.0001e4a4
mov rdi, rax
cmp rax, rbx
jne 0x24f7b
xor al, al
jmp 0x25100
mov esi, 1
mov edx, 0x810
mov ecx, esi
call fcn.0003548c
mov rbp, rax
cmp rax, rbx
jne 0x24f9f
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x24f74
mov edx, 0x418
mov ecx, esi
call fcn.0003548c
mov rsi, rax
cmp rax, rbx
je 0x250ed
mov r14d, ebx
xor edx, edx
lea rax, [rsp + 0x90]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, ebx
jl 0x250e2
inc r14d
cmp dword [rbp + 4], 3
jne 0x250d7
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [0x0003c190]
mov word [rsp + 0x30], cx
mov word [rsp + 0x32], cx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
call fcn.000356c8
cmp al, bl
je 0x25046
cmp r13w, bx
jne 0x250d7
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 8]
call fcn.00032554
cmp al, bl
je 0x250d7
jmp 0x2506e
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x30]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlPrefixUnicodeString]
cmp al, bl
je 0x250d7
cmp r13w, word [rsp + 0x30]
jae 0x250d7
mov r13w, word [rsp + 0x30]
cmp r15, rbx
je 0x250df
lea rax, [rsp + 0x98]
lea rdx, [rsp + 0x30]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, ebx
jl 0x250d7
cmp dword [rsi + 0xc], 0x34
jbe 0x250d7
cmp dword [rsi + 4], 3
jne 0x250d7
mov ecx, dword [rsi + 8]
mov eax, dword [rsi + 0xc]
add eax, 0xfffffffe
add rcx, rsi
mov byte [rax + rcx], bl
mov eax, dword [rsi + 0xc]
dec eax
mov byte [rax + rcx], bl
mov eax, dword [rsi + 0xc]
cmp dword [rcx + 4], eax
jae 0x250d7
mov eax, dword [rcx + 8]
mov r12b, 1
mov dword [r15], eax
mov edx, r14d
jmp 0x24fbc
mov r12b, 1
mov rcx, rsi
call fcn.00035504
mov bl, r12b
mov rcx, rbp
call fcn.00035504
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x25120
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rbx, rcx
xor r13d, r13d
lea rcx, [0x0003c1b0]
mov dword [rax + 0x10], r13d
mov dword [rax + 0x18], r13d
call fcn.0001e4a4
mov rdi, rax
cmp rax, r13
jne 0x2515e
mov eax, 0xc000014d
jmp 0x2530f
mov edx, 0x810
mov ecx, 1
call fcn.0003548c
mov rbp, rax
cmp rax, r13
jne 0x25188
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000009a
jmp 0x2530f
mov edx, 0x418
mov ecx, 1
call fcn.0003548c
mov rsi, rax
cmp rax, r13
jne 0x251a9
mov ebx, 0xc000009a
jmp 0x252fc
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ebx, 0xc0000001
mov r12d, r13d
xor edx, edx
jmp 0x252c7
inc r12d
cmp dword [rbp + 4], 3
jne 0x252c4
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x28], rax
mov r9, rsi
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jl 0x252c4
cmp dword [rsi + 0xc], 0x34
jbe 0x252c4
cmp dword [rsi + 4], 3
jne 0x252c4
mov edx, dword [rsi + 8]
mov eax, dword [rsi + 0xc]
mov r9d, 2
sub eax, r9d
add rdx, rsi
mov byte [rax + rdx], r13b
mov eax, dword [rsi + 0xc]
dec eax
mov byte [rax + rdx], r13b
mov eax, dword [rsi + 0xc]
cmp dword [rdx + 4], eax
jae 0x252c4
mov r8d, dword [rdx + 4]
add r8, rdx
mov qword [rsp + 0x38], r8
movzx ecx, word [rsi + 0xc]
sub cx, word [rdx + 4]
mov word [rsp + 0x32], cx
mov word [rsp + 0x30], cx
cmp cx, r9w
jbe 0x25295
movzx eax, cx
shr rax, 1
cmp word [r8 + rax*2 - 2], r13w
jne 0x25295
sub cx, r9w
mov word [rsp + 0x30], cx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
cmp eax, r13d
jne 0x252c4
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov ebx, eax
cmp eax, r13d
cmovge ebx, r13d
mov edx, r12d
lea rax, [rsp + 0x98]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, r13d
jge 0x251c6
mov rcx, rsi
call fcn.00035504
mov rcx, rbp
call fcn.00035504
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x2532c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rbx, rcx
xor r15d, r15d
lea rcx, [0x0003c1b0]
mov r14d, edx
mov dword [rax + 0x18], r15d
mov dword [rax + 0x20], r15d
call fcn.0001e4a4
mov rsi, rax
cmp rax, r15
jne 0x25371
mov eax, 0xc000014d
jmp 0x2553a
mov edx, 0x810
mov ecx, 1
call fcn.0003548c
mov rbp, rax
cmp rax, r15
jne 0x2539b
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000009a
jmp 0x2553a
mov edx, 0x418
mov ecx, 1
call fcn.0003548c
mov rdi, rax
cmp rax, r15
jne 0x253bc
mov ebx, 0xc000009a
jmp 0x25527
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ebx, 0xc0000001
mov r13d, r15d
xor edx, edx
lea rax, [rsp + 0xb0]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, r15d
jl 0x2551f
inc r13d
cmp dword [rbp + 4], 3
jne 0x254e6
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb8]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x28], rax
mov r9, rdi
mov r8d, 1
mov rcx, rsi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r15d
jl 0x254e6
cmp dword [rdi + 0xc], 0x34
jbe 0x254e6
cmp dword [rdi + 4], 3
jne 0x254e6
mov eax, dword [rdi + 0xc]
mov r12d, dword [rdi + 8]
mov r8d, 2
sub eax, r8d
add r12, rdi
mov byte [rax + r12], r15b
mov eax, dword [rdi + 0xc]
dec eax
mov byte [rax + r12], r15b
mov eax, dword [r12 + 4]
cmp eax, dword [rdi + 0xc]
jae 0x254e6
lea rdx, [r12 + rax]
mov qword [rsp + 0x38], rdx
movzx ecx, word [rdi + 0xc]
sub cx, word [r12 + 4]
mov word [rsp + 0x32], cx
mov word [rsp + 0x30], cx
cmp cx, r8w
jbe 0x254ce
movzx eax, cx
shr rax, 1
cmp word [rdx + rax*2 - 2], r15w
jne 0x254ce
sub cx, r8w
mov word [rsp + 0x30], cx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
cmp eax, r15d
je 0x254ee
mov edx, r13d
jmp 0x253d4
mov dword [r12 + 8], r14d
mov eax, dword [rdi + 0xc]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, r15d
cmp eax, r15d
cmovl ebx, eax
mov rcx, rdi
call fcn.00035504
mov rcx, rbp
call fcn.00035504
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x26118
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x280], rax
and qword [rsp + 0x30], 0
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x81]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x80], 0
call fcn.0003a1a0
and dword [rsp + 0x38], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov edx, 0x80000000
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x240
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x2627d
lea rcx, [rsp + 0x70]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea r11, [rsp + 0x38]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0x70]
mov r8d, 2
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
js 0x2627d
mov ecx, 1
cmp dword [rsp + 0x84], ecx
je 0x26214
cmp dword [rsp + 0x84], 2
jne 0x2627d
mov edx, dword [rsp + 0x88]
add rdx, 0x12
call fcn.0003548c
mov rbx, rax
test rax, rax
je 0x2627d
mov r8d, dword [rsp + 0x88]
xor edx, edx
mov rcx, rax
add r8, 0x12
call fcn.0003a1a0
lea rcx, [rbx + 0x10]
lea rdx, [rsp + 0x8c]
mov qword [rbx + 8], rcx
mov r8d, dword [rsp + 0x88]
call fcn.00039c50
movzx r11d, word [rsp + 0x88]
mov word [rbx], r11w
movzx eax, word [rsp + 0x88]
mov word [rbx + 2], ax
mov rax, rbx
jmp 0x2627f
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.00039b80
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret

Function at 0x2632c
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x40
mov rbx, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x60]
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
add rsp, 0x40
pop rbx
ret

Function at 0x26378
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x60], rax
and dword [rsp + 0x30], 0
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x38]
mov rdx, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], r11
lea rdx, [rsp + 0x38]
mov r8d, 2
mov rcx, rbx
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x263ed
cmp dword [rsp + 0x4c], 4
jne 0x263e8
mov ecx, dword [rsp + 0x54]
mov dword [rdi], ecx
jmp 0x263ed
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.00039b80
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
Function at 0x2ae68
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x2c0
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
xor ebp, ebp
mov bl, cl
mov rdi, rdx
lea rcx, [r11 - 0x226]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x38], ebp
mov word [rsp + 0xa0], bp
call fcn.0003a1a0
lea r11, [rsp + 0xa0]
mov eax, 0x208
mov word [rsp + 0x50], bp
mov word [rsp + 0x52], ax
mov qword [rsp + 0x58], r11
cmp bl, bpl
je 0x2af0d
cmp word [0x0004f330], bp
je 0x2b06a
lea rdx, [0x0004f330]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rcx, [rsp + 0x90]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x30]
mov edx, 0x80000000
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rbp
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebp
jl 0x2b06a
mov edx, 0x818
mov ecx, 1
call fcn.0003548c
mov rcx, qword [rsp + 0x30]
mov rbx, rax
cmp rax, rbp
je 0x2b064
lea rax, [rsp + 0x38]
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov esi, ebp
mov dword [rsp + 0x20], 0x818
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, ebp
jl 0x2b057
lea rdi, [rbx + 0x10]
movzx ecx, word [rbx + 0xc]
inc esi
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
cmp cx, 6
jb 0x2b02a
cmp word [rdi], 0x7b
je 0x2b01b
lea rdx, [rdi + 2]
cmp word [rdx], 0x7b
jne 0x2b02a
movzx eax, cx
shr rax, 1
cmp word [rdi + rax*2 - 2], 0x7d
jne 0x2b02a
mov eax, 0xfffe
mov qword [rsp + 0x48], rdx
add cx, ax
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
lea rcx, [rsp + 0x40]
mov edx, 5
call fcn.0002ace8
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, esi
mov dword [rsp + 0x20], 0x818
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, ebp
jge 0x2afcb
mov rcx, rbx
call fcn.00035504
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.00039b80
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x2b09c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x2d0
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov bl, cl
mov rdi, rdx
lea rcx, [r11 - 0x226]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0xb0], bp
call fcn.0003a1a0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov eax, 0x208
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x38], ebp
mov word [rsp + 0x40], bp
mov word [rsp + 0x42], ax
cmp bl, bpl
je 0x2b147
cmp word [0x0004f330], bp
je 0x2b26c
lea rdx, [0x0004f330]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rcx, [rsp + 0x90]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x30]
mov edx, 0x80000000
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rbp
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebp
jl 0x2b26c
mov edx, 0x1000
mov ecx, 1
call fcn.0003548c
mov rcx, qword [rsp + 0x30]
mov rbx, rax
cmp rax, rbp
je 0x2b266
lea rax, [rsp + 0x38]
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov esi, ebp
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, ebp
jl 0x2b259
lea rdi, [rbx + 0xc]
movzx eax, word [rbx + 8]
inc esi
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x50], ax
mov word [rsp + 0x52], ax
cmp ax, bp
je 0x2b230
cmp word [rdi], 0x7b
jne 0x2b230
lea rcx, [rsp + 0x50]
mov edx, 5
call fcn.0002ace8
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, esi
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, ebp
jge 0x2b201
mov rcx, rbx
call fcn.00035504
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.00039b80
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x2b340
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, 5
lea rdx, [0x0003c7d0]
xor ecx, ecx
mov r8d, ebx
call fcn.0002ae68
lea rdx, [0x0003c890]
mov r8d, ebx
xor ecx, ecx
call fcn.0002ae68
lea rdx, [0x0003c920]
mov r8d, ebx
xor ecx, ecx
call fcn.0002b09c
lea rdx, [0x0003c9a0]
mov r8d, ebx
xor ecx, ecx
call fcn.0002b09c
lea rdx, [0x0003ca30]
mov r8d, ebx
xor ecx, ecx
call fcn.0002ae68
lea rdx, [0x0003cac0]
mov r8d, ebx
xor ecx, ecx
call fcn.0002ae68
lea rdx, [0x0003cb90]
mov r8d, ebx
xor ecx, ecx
call fcn.0002ae68
lea rdx, [0x0003cc40]
mov r8d, ebx
xor ecx, ecx
call fcn.0002b09c
lea rdx, [0x0003cce0]
mov r8d, ebx
xor ecx, ecx
call fcn.0002b09c
lea rdx, [0x0003cd90]
mov r8d, ebx
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.0002ae68

Function at 0x2b400
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, 5
lea rdx, [0x0003ce30]
mov cl, 1
mov r8d, ebx
call fcn.0002b09c
lea rdx, [0x0003ceb0]
mov r8d, ebx
mov cl, 1
call fcn.0002b09c
lea rdx, [0x0003cf30]
mov r8d, ebx
mov cl, 1
call fcn.0002ae68
lea rdx, [0x0003cfa0]
mov r8d, ebx
mov cl, 1
call fcn.0002b09c
lea rdx, [0x0003d030]
mov r8d, ebx
mov cl, 1
call fcn.0002b09c
lea rdx, [0x0003d0c0]
mov r8d, ebx
mov cl, 1
add rsp, 0x20
pop rbx
jmp fcn.0002ae68

Function at 0x2c714
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
cmp byte [0x0004f539], 0
mov r12d, r9d
mov r13d, r8d
mov rsi, rdx
mov rbp, rcx
jne 0x2c74b
mov eax, 0xc0000001
jmp 0x2c7fc
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call fcn.0002c450
test al, al
je 0x2c767
xor eax, eax
jmp 0x2c7fc
lea rcx, [0x0003d150]
call fcn.0001e4a4
mov rdi, rax
test rax, rax
je 0x2c741
mov eax, 0x5432
mov r9d, 3
xor r8d, r8d
mov word [rsp + 0x30], ax
lea rax, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3c], r12d
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, eax
test eax, eax
js 0x2c7f1
mov ecx, 1
lock xadd dword [0x0004c1a4], ecx
inc ecx
mov r9d, r12d
mov r8d, r13d
mov rdx, rsi
mov dword [rbp], ecx
call fcn.0002c1c4
test al, al
jne 0x2c7f1
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov ebx, 0xc0000001
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x2c81c
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor bl, bl
xor esi, esi
mov ebp, ecx
cmp byte [0x0004f539], bl
jne 0x2c848
mov eax, 0xc0000001
jmp 0x2c8f6
lea rcx, [0x0003d150]
call fcn.0001e4a4
mov rdi, rax
test rax, rax
je 0x2c83e
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0005b8c0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rax, qword [0x0005b930]
lea rcx, [0x0005b930]
jmp 0x2c88c
mov rsi, rax
cmp dword [rax + 0x10], ebp
je 0x2c893
mov rax, qword [rax]
cmp rax, rcx
jne 0x2c881
jmp 0x2c8a3
mov rdx, qword [rax]
mov rax, qword [rax + 8]
mov bl, 1
mov qword [rax], rdx
mov qword [rdx + 8], rax
lea rcx, [0x0005b8c0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
test bl, bl
je 0x2c8e6
mov rdx, qword [rsi + 0x20]
mov rcx, rdi
add rdx, 0x20
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, qword [rsi + 0x20]
mov ebx, eax
call fcn.0002c174
mov edx, 0x49544650
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x2c8eb
mov ebx, 0xc0000225
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret