joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003522c
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x490
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r8, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
xor r12d, r12d
mov rdi, r8
mov r13d, 0x104
repne scasw ax, word [rdi]
lea rax, [r11 - 0x238]
mov rsi, r8
not rcx
lea rdx, [r11 - 0x238]
mov edi, r12d
lea rbx, [rcx - 1]
mov rcx, r13
sub rsi, rax
lea rax, [rcx + 0x7ffffefa]
cmp rax, r12
je 0x1000352b5
movzx eax, word [rsi + rdx]
cmp ax, r12w
je 0x1000352b5
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x100035292
cmp rcx, r12
jne 0x1000352c3
sub rdx, 2
mov edi, 0x8007007a
cmp edi, r12d
mov word [rdx], r12w
jl 0x100035401
cmp rbx, r12
je 0x10003530a
cmp word [r8 + rbx*2 - 2], 0x3a
je 0x10003530a
cmp word [r8 + rbx*2 - 2], 0x5c
je 0x10003530a
lea r8, [0x10001f980]
lea rcx, [rsp + 0x270]
mov rdx, r13
call fcn.10002e3d4
cmp eax, r12d
jl 0x100035401
inc rbx
lea rax, [rbx + 2]
cmp rax, r13
ja 0x100035401
lea r8, [0x10001d5c0]
lea rcx, [rsp + 0x270]
mov rdx, r13
call fcn.10002e3d4
cmp eax, r12d
jl 0x100035401
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x100035401
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x254]
repne scasw ax, word [rdi]
mov word [rsp + rbx*2 + 0x270], r12w
mov rdx, r13
not rcx
lea r8, [rsp + 0x254]
cmp rcx, 1
lea rcx, [rsp + 0x270]
jne 0x100035392
lea r8, [rsp + 0x4c]
call fcn.10002e3d4
cmp eax, r12d
jl 0x1000353f8
test byte [rsp + 0x20], 0x10
je 0x1000353e1
lea rsi, [rsp + 0x4c]
lea rdi, [0x10001c9d0]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x1000353e1
lea rsi, [rsp + 0x4c]
lea rdi, [0x10001f978]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x1000353e1
lea rcx, [rsp + 0x270]
mov edx, 1
call fcn.100034ae8
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r12d
jne 0x100035357
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1000355f0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
xor edi, edi
lea rax, [r11 + 0x10]
mov rsi, rcx
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rdi
lea rdx, [0x10001f990]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 3
mov qword [r11 + 0x10], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x1000356a3
mov rcx, qword [rsp + 0x68]
lea rdx, [0x10001f9f8]
mov r8, rsi
call fcn.100042378
mov rbx, rax
cmp rax, rdi
je 0x100035698
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
lea r9d, [rax + 1]
xor r8d, r8d
not rcx
lea edx, [rcx + rcx]
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x28], edx
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1000356bc
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x330
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x320], rax
lea rax, [rsp + 0x38]
lea rdx, [0x10001f990]
xor edi, edi
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x100035820
lea r8, [0x10001fa10]
lea edx, [rdi + 0x63]
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x30], 0x208
mov dword [rsp + 0x34], 1
call fcn.10002e570
lea ebx, [rdi + 1]
jmp 0x1000357da
cmp dword [rsp + 0x34], 1
jne 0x100035815
lea rax, [rsp + 0x110]
cmp rax, rdi
je 0x100035765
lea rcx, [rsp + 0x110]
call fcn.100034a48
xor r9d, r9d
lea r8, [rsp + 0x110]
lea edx, [r9 + 5]
lea ecx, [rdx - 1]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rcx, [rsp + 0x110]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, rdi
je 0x1000357b7
lea rcx, [rsp + 0x110]
xor edx, edx
mov word [rax], di
call fcn.100034ae8
lea r8, [0x10001fa10]
lea rcx, [rsp + 0x40]
mov r9d, ebx
mov edx, 0x63
mov dword [rsp + 0x30], 0x208
call fcn.10002e570
inc ebx
cmp eax, edi
jl 0x100035815
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x110]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x100035740
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0x340]
add rsp, 0x330
pop rdi
ret
Function at 0x100035848
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edi, edi
lea rax, [rsp + 0x58]
mov rbx, rcx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rdx, [0x10001f990]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x10003595b
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, [0x10001d9d0]
xor r8d, r8d
mov dword [rsp + 0x50], 0x208
mov dword [rsp + 0x54], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x100035915
cmp dword [rsp + 0x54], 1
jne 0x100035915
cmp dword [rsp + 0x50], 1
jbe 0x10003591a
lea rcx, [rsp + 0x60]
mov rdx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, edi
je 0x10003591a
call fcn.1000356bc
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
lea rdx, [0x10001d9d0]
mov r9d, 1
not rcx
xor r8d, r8d
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret
Function at 0x100035cb4
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x660
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x650], rax
xor r9d, r9d
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x17]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor ebx, ebx
cmp eax, ebx
je 0x100035e38
lea r8, [rsp + 0x20]
lea rax, [rsp + 0x230]
mov edx, 0x104
sub r8, rax
lea rcx, [rsp + 0x230]
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbx
je 0x100035d2d
movzx eax, word [r8 + rcx]
cmp ax, bx
je 0x100035d2d
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x100035d0a
cmp rdx, rbx
jne 0x100035d36
sub rcx, 2
mov word [rcx], bx
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x104
movsxd rcx, eax
lea rax, [rsp + 0x440]
lea r8, [rsp + rcx*2 + 0x230]
lea rcx, [rsp + 0x440]
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbx
je 0x100035da0
movzx eax, word [r8 + rcx]
cmp ax, bx
je 0x100035da0
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x100035d7d
cmp rdx, rbx
jne 0x100035da9
sub rcx, 2
mov r9d, 0x104
mov word [rcx], bx
mov rcx, qword [0x10004ce70]
lea edx, [r9 - 0x5e]
lea r8, [rsp + 0x230]
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
je 0x100035e38
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp eax, ebx
jne 0x100035e19
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [0x10001fa80]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.100034ae8
mov rcx, qword [rsp + 0x650]
xor rcx, rsp
call fcn.1000475f0
add rsp, 0x660
pop rbx
ret
Function at 0x1000366c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x250
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov edi, ecx
lea rcx, [rsp + 0x20]
mov r12, r8
mov rbp, rdx
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
xor esi, esi
cmp eax, esi
mov ebx, eax
jl 0x10003678c
neg edi
lea r8, [rsp + 0x28]
sbb edx, edx
xor ecx, ecx
and edx, 0x15
add edx, 2
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov r13d, 0x80004005
cmp eax, esi
mov ebx, eax
jl 0x100036763
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, esi
je 0x100036750
mov edx, dword [r12]
lea r8, [rsp + 0x30]
mov rcx, rbp
call fcn.10002e35c
mov ebx, eax
jmp 0x100036753
mov ebx, r13d
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp ebx, esi
jl 0x10003678e
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 8
cmovb ebx, r13d
cmp ebx, esi
setge sil
mov eax, esi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0x298]
add rsp, 0x250
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x100036b48
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov esi, ecx
lea rcx, [rsp + 0x20]
mov r12, r8
mov rbp, rdx
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
xor ebx, ebx
cmp eax, ebx
mov edi, eax
jl 0x100036be7
neg esi
lea r8, [rsp + 0x28]
sbb edx, edx
xor ecx, ecx
and edx, 0x19
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, ebx
mov edi, eax
jl 0x100036bdc
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, ebx
je 0x100036bc6
mov edx, dword [r12]
lea r8, [rsp + 0x30]
mov rcx, rbp
call fcn.10002e35c
mov edi, eax
jmp 0x100036bcb
mov edi, 0x80004005
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rcx]
call qword [r8 + 0x28]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
cmp edi, ebx
setge bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1000475f0
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x100036c14
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x3a0
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x390], rax
and qword [rsp + 0x38], 0
mov ebx, r8d
mov rsi, rdx
mov r8, rdx
mov rdi, rcx
mov rdx, rcx
mov ecx, ebx
call fcn.1000366c0
test eax, eax
je 0x100036d6d
test ebx, ebx
je 0x100036c7b
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x15
call qword [sym.imp.USER32.dll_LoadStringW]
jmp 0x100036d4e
lea rax, [rsp + 0x38]
lea rdx, [0x10001feb0]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100036d6d
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x260]
lea edx, [rax + 0x23]
mov r9d, 0x96
mov dword [rsp + 0x40], 0x208
xor ebx, ebx
mov dword [rsp + 0x30], 1
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x100036d3f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x260]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100036d1d
cmp dword [rsp + 0x30], 1
jne 0x100036d1d
lea ebx, [rax + 1]
jmp 0x100036d3f
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x15
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x100036d6d
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov edx, dword [rsi]
lea r8, [rsp + 0x50]
mov rcx, rdi
call fcn.10002e4a0
mov eax, 1
jmp 0x100036d6f
xor eax, eax
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.1000475f0
add rsp, 0x3a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x100037138
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rbx + 4]
xor edx, edx
mov qword [rsp + 0x38], rbx
call fcn.1000404f0
cmp eax, ebx
jne 0x100037179
xor eax, eax
jmp 0x10003720e
lea rax, [rsp + 0x38]
mov edi, 1
lea rdx, [0x10001ff30]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10003720c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x10001ff90]
xor r8d, r8d
mov dword [rsp + 0x34], 0x200
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x100037201
cmp dword [rsp + 0x30], edi
jne 0x100037201
lea rdx, [0x10001ffa8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
cmovne ebx, edi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rdi
ret

Function at 0x100037238
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov ebx, 0x20
lea rdx, [0x10001d760]
lea r9d, [rbx - 0x1f]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000372cd
and dword [rsp + 0x48], eax
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x40]
lea rdx, [0x10001ffb8]
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000372c2
cmp dword [rsp + 0x40], 4
cmove ebx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1000372dc
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
mov r11, rsp
sub rsp, 0x58
and qword [r11 - 0x18], 0
and qword [r11 + 0x10], 0
lea rax, [r11 + 0x10]
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
lea rdx, [0x10001d760]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10003735c
mov rcx, qword [rsp + 0x68]
lea r9d, [rax + 4]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], r9d
lea rdx, [0x10001ffb8]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x58
ret
Function at 0x100037368
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x250
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov edi, ecx
lea rcx, [rsp + 0x20]
mov r12, r8
mov rbp, rdx
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
xor esi, esi
cmp eax, esi
mov ebx, eax
jl 0x100037434
neg edi
lea r8, [rsp + 0x28]
sbb edx, edx
xor ecx, ecx
and edx, 0x19
add edx, 6
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov r13d, 0x80004005
cmp eax, esi
mov ebx, eax
jl 0x10003740b
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, esi
je 0x1000373f8
mov edx, dword [r12]
lea r8, [rsp + 0x30]
mov rcx, rbp
call fcn.10002e35c
mov ebx, eax
jmp 0x1000373fb
mov ebx, r13d
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp ebx, esi
jl 0x100037436
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 8
cmovb ebx, r13d
cmp ebx, esi
setge sil
mov eax, esi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0x298]
add rsp, 0x250
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x10003746c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
lea rax, [rsp + 0x58]
lea rdx, [0x10001d310]
lea r9d, [rbx + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x100037509
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea rdx, [0x10001d380]
xor r8d, r8d
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], 3
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x1000374fe
cmp dword [rsp + 0x40], 4
je 0x1000374f6
cmp dword [rsp + 0x40], 3
jne 0x1000374fe
cmp dword [rsp + 0x48], 1
setne bl
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x100037518
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
push rdi
sub rsp, 0x68
or eax, 0xffffffff
lea rdx, [r11 + 8]
lea rcx, [0x100020060]
xor ebx, ebx
mov dword [r11 + 8], eax
mov dword [r11 + 0x18], eax
mov dword [rsp + 0x50], eax
mov dword [r11 + 0x10], eax
mov dword [r11 + 0x20], eax
mov qword [r11 - 0x20], rbx
mov dword [rsp + 0x54], eax
call sub.slc.dll_SLGetWindowsInformationDWORD
lea rdx, [rsp + 0x88]
lea rcx, [0x1000200b0]
call sub.slc.dll_SLGetWindowsInformationDWORD
lea rdx, [rsp + 0x90]
lea rcx, [0x100020100]
call sub.slc.dll_SLGetWindowsInformationDWORD
lea rdx, [rsp + 0x50]
lea rcx, [0x100020160]
call sub.slc.dll_SLGetWindowsInformationDWORD
lea rdx, [rsp + 0x98]
lea rcx, [0x1000201b0]
call sub.slc.dll_SLGetWindowsInformationDWORD
lea rdx, [rsp + 0x54]
lea rcx, [0x100020210]
call sub.slc.dll_SLGetWindowsInformationDWORD
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea rdx, [0x10001c490]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x1000376f0
mov rcx, qword [rsp + 0x58]
lea edi, [rbx + 4]
lea rax, [rsp + 0x80]
lea rdx, [0x100020260]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x90]
lea rdx, [0x100020270]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x100020288]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x88]
lea rdx, [0x1000202b0]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x98]
lea rdx, [0x1000202c0]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x54]
lea rdx, [0x1000202d8]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x80], ebx
je 0x100037702
cmp dword [rsp + 0x88], ebx
jne 0x100037720
cmp dword [rsp + 0x90], ebx
je 0x100037725
cmp dword [rsp + 0x98], ebx
je 0x100037725
cmp dword [rsp + 0x50], ebx
je 0x100037725
cmp dword [rsp + 0x54], ebx
je 0x100037725
mov ebx, 1
mov eax, ebx
add rsp, 0x68
pop rdi
pop rbx
ret
Function at 0x10003aff0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
sub rsp, 0x470
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x460], rax
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x34], 0
mov rdi, rcx
mov r9, rcx
mov r13d, 0x103
lea r8, [0x100020d80]
lea rcx, [rsp + 0x40]
mov rdx, r13
xor bl, bl
call fcn.10002e570
lea r11, [rsp + 0x38]
mov r12, 0xffffffff80000000
lea rdx, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, 1
test eax, eax
jne 0x10003b121
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x250]
lea rdx, [0x100020db8]
xor r8d, r8d
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10003b0df
cmp dword [rsp + 0x34], ebp
jne 0x10003b0df
lea rdx, [rsp + 0x250]
lea rcx, [0x100020de0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
movzx ebx, bl
test eax, eax
cmove ebx, ebp
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x10003b121
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, [0x100020e30]
lea rcx, [rsp + 0x40]
mov r9, rdi
mov rdx, r13
call fcn.10002e570
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, [0x100020e58]
lea rcx, [rsp + 0x40]
mov r9, rdi
mov rdx, r13
call fcn.10002e570
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003b205
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x250]
lea rdx, [0x100020db8]
xor r8d, r8d
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10003b1c3
cmp dword [rsp + 0x34], ebp
jne 0x10003b1c3
lea rdx, [rsp + 0x250]
lea rcx, [0x100020e90]
call qword [sym.imp.msvcrt.dll__wcsicmp]
movzx ebx, bl
test eax, eax
cmove ebx, ebp
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x10003b205
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, [0x100020ee0]
lea rcx, [rsp + 0x40]
mov r9, rdi
mov rdx, r13
call fcn.10002e570
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret