joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003b1b0
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push rdi
sub rsp, 0x290
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edi, edi
lea rax, [rsp + 0x58]
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rdx, [0x100025840]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x10003b24a
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea r9d, [rdi + 4]
lea rdx, [0x100025918]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
lea rdx, [0x100025840]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x10003b3e1
cmp dword [rsp + 0x50], 0xd2af9
je 0x10003b2b7
cmp dword [rsp + 0x50], 0xc00d2afb
je 0x10003b2b7
mov rcx, qword [rsp + 0x58]
lea rdx, [0x100025938]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x10003b3a9
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x60], rdi
call fcn.10003b0d4
cmp eax, edi
jne 0x10003b2f7
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x68]
lea rdx, [0x100025938]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [rsp + 0x60]
lea rdx, [0x100025960]
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x10003b3a9
lea rax, [rsp + 0x70]
cmp rax, rdi
je 0x10003b341
lea rcx, [rsp + 0x70]
mov edx, 0x104
call fcn.1000529a4
jmp 0x10003b343
mov eax, edi
cmp eax, edi
je 0x10003b39e
lea r8, [0x1000259c8]
lea rcx, [rsp + 0x70]
mov edx, 0x104
call fcn.100039ee4
cmp eax, edi
jl 0x10003b39e
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
lea rdx, [0x1000259e0]
mov r9d, 1
not rcx
xor r8d, r8d
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x100025918]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.10007fa70
add rsp, 0x290
pop rdi
ret
Function at 0x10003b4d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
xor ebx, ebx
lea rax, [r11 + 0x20]
lea rdx, [0x100025840]
mov qword [r11 - 0x18], rbx
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20019
mov qword [r11 + 0x20], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x10003b573
mov rcx, qword [rsp + 0x78]
lea eax, [rbx + 4]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, [0x100025918]
xor r8d, r8d
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003b568
cmp dword [rsp + 0x60], 0xc00d2afc
sete bl
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x50
pop rbx
ret

Function at 0x10003b584
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
sub rsp, 0x58
and qword [r11 - 0x18], 0
and qword [r11 + 0x10], 0
lea rax, [r11 + 0x10]
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
lea rdx, [0x100025840]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 3
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10003b5ea
mov rcx, qword [rsp + 0x68]
lea rdx, [0x100025a00]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x58
ret

Function at 0x10003b5f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor ebx, ebx
mov rax, r9
mov rsi, r8
mov rdi, rcx
test r9, r9
je 0x10003b6c3
test r8, r8
je 0x10003b6c3
test rcx, rcx
je 0x10003b6c3
and qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x38]
lea ebp, [rbx + 1]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], 0x208
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003b6c3
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10003b6af
cmp dword [rsp + 0x30], ebp
cmove ebx, ebp
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x40]
test ebx, ebx
jne 0x10003b6ca
lea r8, [0x100025b18]
mov edx, 0x104
mov rcx, rdi
call fcn.100039df8
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.10007fa70
mov rbx, qword [rsp + 0x288]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
Function at 0x10003b700
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2f0
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
xor ebx, ebx
mov esi, edx
mov rdi, rcx
mov qword [rsp + 0x38], rbx
cmp rcx, rbx
jne 0x10003b73c
xor eax, eax
jmp 0x10003b7f5
lea rax, [rsp + 0x38]
lea rdx, [0x100025840]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10003b7f3
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], ebx
mov edx, 0x208
lea rcx, [rsp + 0xd0]
lea r8, [0x1000258c0]
cmp esi, ebx
jne 0x10003b796
lea r8, [0x100025890]
call fcn.100039e6c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0xd0]
xor r8d, r8d
mov dword [rsp + 0x30], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003b7e8
lea rcx, [rsp + 0x50]
mov ebx, 1
call fcn.100052d68
mov qword [rdi], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x10003b820
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rsi, rcx
mov edi, edx
lea rcx, [rsp + 0x240]
mov edx, 0x104
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10003b8d2
lea r9, [rsp + 0x240]
mov edx, 0x208
lea rcx, [rsp + 0x30]
test edi, edi
je 0x10003b888
lea rax, [0x1000254b8]
lea r8, [0x100025b28]
jmp 0x10003b896
lea rax, [0x100025488]
lea r8, [0x100025b50]
mov qword [rsp + 0x20], rax
call fcn.10003a0f0
test eax, eax
js 0x10003b8d2
lea rcx, [rsp + 0x30]
call fcn.100053454
test eax, eax
je 0x10003b8d2
lea rax, [rsp + 0x30]
mov ebx, 1
test rax, rax
je 0x10003b8cd
lea rcx, [rsp + 0x30]
call fcn.100054858
jmp 0x10003b8cf
xor eax, eax
mov qword [rsi], rax
test ebx, ebx
jne 0x10003b8f1
lea rdx, [0x100025b78]
lea ecx, [rbx + 2]
call fcn.1000527a0
mov edx, edi
mov rcx, rsi
call fcn.10003b700
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10003bf38
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp qword [0x100088818], 0
mov rdi, rcx
mov ebx, 0x80004005
jne 0x10003bfd4
mov ecx, 0x90
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x10003bf82
mov rcx, rax
call fcn.10004fc40
jmp 0x10003bf84
xor eax, eax
mov qword [0x100088818], rax
test rax, rax
je 0x10003bfd9
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x10003bfd9
mov rcx, qword [0x100088818]
mov eax, dword [0x1000887ec]
lea r8, [rsp + 0x20]
mov dword [rcx + 0x7c], eax
mov eax, dword [0x100086898]
mov r9d, 1
mov rdx, rdi
mov dword [rcx + 0x74], eax
call fcn.100050f2c
xor ebx, ebx
jmp 0x10003bfd9
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.10007fa70
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x10003c1c8
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x680
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rdi, rcx
xor ebx, ebx
call fcn.100053454
cmp eax, ebx
je 0x10003c365
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x10003c23b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10003c365
lea rax, [rsp + 0x40]
mov esi, 0x104
lea rcx, [rsp + 0x40]
sub rdi, rax
mov rdx, rsi
mov r8d, ebx
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbx
je 0x10003c275
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x10003c275
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10003c253
cmp rdx, rbx
jne 0x10003c284
sub rcx, 2
mov r8d, 0x8007007a
cmp r8d, ebx
mov word [rcx], bx
jl 0x10003c365
lea rdx, [0x10002968c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x10003c314
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
cmp eax, ebx
jl 0x10003c314
lea rcx, [0x100029690]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, 0x20
jbe 0x10003c308
lea rdx, [0x1000296b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
je 0x10003c30e
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov r8d, esi
call rax
cmp eax, ebx
je 0x10003c30e
lea r8, [rsp + 0x460]
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.100039df8
jmp 0x10003c30e
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.ole32.dll_OleUninitialize]
lea r9, [rsp + 0x40]
lea r8, [0x100025cb8]
lea rcx, [rsp + 0x250]
mov rdx, rsi
call fcn.10003a080
cmp eax, ebx
jl 0x10003c365
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, ebx
je 0x10003c360
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x10003c365
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10003c43c
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rcx, [0x100025cd0]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x10003c4c6
lea r8, [0x100025cf0]
xor r9d, r9d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x10003c4c6
lea r8, [0x100025d10]
xor r9d, r9d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
je 0x10003c4ac
mov eax, 1
jmp 0x10003c551
lea r8, [0x100025d28]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
jne 0x10003c4a2
lea rax, [rsp + 0x20]
mov ebx, 0x104
test rax, rax
je 0x10003c50b
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.100053eb0
test eax, eax
je 0x10003c50b
lea r8, [0x100025d48]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.100039ee4
test eax, eax
js 0x10003c50b
lea rcx, [rsp + 0x20]
call fcn.10003c1c8
test eax, eax
jne 0x10003c4a2
lea rax, [rsp + 0x20]
test rax, rax
je 0x10003c54f
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.100053eb0
test eax, eax
je 0x10003c54f
lea r8, [0x100025d68]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.100039ee4
test eax, eax
js 0x10003c54f
lea rcx, [rsp + 0x20]
call fcn.10003c1c8
test eax, eax
jne 0x10003c4a2
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.10007fa70
add rsp, 0x240
pop rbx
ret

Function at 0x10003c570
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov ebx, 0x104
lea rcx, [rsp + 0x20]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10003c5c7
lea r8, [0x100025d88]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.100039ee4
test eax, eax
js 0x10003c5c7
lea rcx, [rsp + 0x20]
call fcn.10003c1c8
test eax, eax
jne 0x10003c5fe
lea rcx, [rsp + 0x20]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10003c605
lea r8, [0x100025da0]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.100039ee4
test eax, eax
js 0x10003c605
lea rcx, [rsp + 0x20]
call fcn.10003c1c8
test eax, eax
je 0x10003c605
mov eax, 1
jmp 0x10003c60a
call fcn.10003c43c
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.10007fa70
add rsp, 0x240
pop rbx
ret
Function at 0x10003c788
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rdi, rcx
cmp rcx, rbx
je 0x10003c831
mov qword [r11 - 0x18], rbx
lea rax, [r11 + 8]
xor r9d, r9d
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 2
cmp edx, ebx
mov qword [r11 + 8], rbx
mov dword [rsp + 0x20], ebx
mov rcx, 0xffffffff80000002
lea rdx, [0x100025ec0]
jne 0x10003c7e5
lea rdx, [0x100025f30]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x10003c831
mov rcx, qword [rsp + 0x60]
cmp rcx, rbx
je 0x10003c831
lea rax, [0x1000062c0]
mov esi, 1
xor r8d, r8d
mov rdx, rdi
mov r9d, esi
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
cmp eax, ebx
cmove ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x10003c84c
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x260
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r12d, r8d
mov rsi, rcx
mov qword [rsp + 0x20], rcx
mov ebp, edx
lea r8, [0x100025e98]
lea rcx, [rsp + 0x40]
lea r9, [0x100025fa0]
mov edx, 0x104
xor edi, edi
call fcn.10003a080
cmp eax, edi
jl 0x10003c947
mov qword [rsp + 0x30], rdi
mov ebx, 0x2001f
call fcn.100063fcc
cmp eax, edi
mov ecx, 0x2011f
lea rax, [rsp + 0x30]
cmovne ebx, ecx
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov r9d, ebx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x10003c947
mov rcx, qword [rsp + 0x30]
lea rdx, [0x100026008]
cmp ebp, edi
je 0x10003c92c
lea r9d, [rdi + 4]
lea rax, [rsp + 0x38]
lea ebx, [rdi + 1]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
jne 0x10003c93c
mov edx, r12d
mov rcx, rsi
mov edi, ebx
call fcn.10003c788
jmp 0x10003c93c
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, 1
cmp eax, edi
cmove edi, ebx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x10003c978
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x260], rax
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
lea rdx, [0x100025ec0]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003ca40
xor ebx, ebx
and qword [rsp + 0x38], rbx
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
xor edx, edx
jmp 0x10003ca14
lea rax, [rsp + 0x50]
inc ebx
test rax, rax
je 0x10003c9fa
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 1]
call fcn.10003c84c
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, ebx
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10003c9de
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x100025ec0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.10007fa70
add rsp, 0x270
pop rbx
ret

Function at 0x10003ca74
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x260], rax
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
lea rdx, [0x100025f30]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003cb3c
xor ebx, ebx
and qword [rsp + 0x38], rbx
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
xor edx, edx
jmp 0x10003cb10
lea rax, [rsp + 0x50]
inc ebx
test rax, rax
je 0x10003caf6
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 1]
call fcn.10003c84c
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, ebx
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10003cada
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x100025f30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.10007fa70
add rsp, 0x270
pop rbx
ret
Function at 0x10003cb70
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x480
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor edi, edi
mov esi, edx
test rcx, rcx
je 0x10003ccb3
mov qword [rsp + 0x20], rcx
lea r9, [0x100026028]
lea r8, [0x100025e98]
lea rcx, [rsp + 0x260]
mov edx, 0x104
call fcn.10003a080
test eax, eax
js 0x10003ccb3
and qword [rsp + 0x48], rdi
mov ebx, 0x20019
call fcn.100063fcc
test eax, eax
mov ecx, 0x20119
lea rax, [rsp + 0x48]
cmovne ebx, ecx
lea rdx, [rsp + 0x260]
xor r8d, r8d
mov r9d, ebx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003ccb3
xor ebx, ebx
and qword [rsp + 0x38], rbx
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
xor edx, edx
jmp 0x10003cc87
lea rcx, [rsp + 0x50]
inc ebx
call qword [sym.imp.msvcrt.dll__wcslwr]
cmp word [rsp + 0x50], 0x6b
jne 0x10003cc6d
cmp word [rsp + 0x52], 0x62
jne 0x10003cc6d
lea rax, [rsp + 0x50]
test rax, rax
je 0x10003cc6b
lea rcx, [rsp + 0x50]
mov r8d, esi
mov edx, 1
call fcn.10003c84c
mov edi, eax
jmp 0x10003cc6d
xor edi, edi
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, ebx
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10003cc2e
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10003e128
Capabilities:
Delete registry key
Delete registry value
Get common file path

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x460], rax
call fcn.100040918
test eax, eax
je 0x10003e293
lea rax, [rsp + 0x250]
mov ebx, 0x104
test rax, rax
je 0x10003e1bd
lea rcx, [rsp + 0x40]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10003e1bd
lea r8, [0x100025d88]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.100039ee4
test eax, eax
js 0x10003e1bd
lea rcx, [rsp + 0x40]
call fcn.100053454
test eax, eax
je 0x10003e1bd
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x250]
mov rdx, rbx
call fcn.100039df8
xor ecx, ecx
test eax, eax
setns cl
test ecx, ecx
jne 0x10003e293
lea rcx, [rsp + 0x40]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10003e1f8
lea r8, [0x1000256e8]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.100039ee4
test eax, eax
js 0x10003e1f8
lea rcx, [rsp + 0x40]
call fcn.100053454
test eax, eax
jne 0x10003e293
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov ebx, 0x2001f
lea rdx, [0x100026ab0]
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003e248
mov rcx, qword [rsp + 0x30]
lea rdx, [0x100026b50]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
lea rdx, [0x100026b80]
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003e293
mov rcx, qword [rsp + 0x30]
lea rdx, [0x100026c50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.10007fa70
add rsp, 0x470
pop rbx
ret