joyce8/EMBER2024-capa huggingface dataset:
Function at 0x75b89c3ac
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rdi, rcx
mov eax, dword [0x75b9259cc]
xor esi, esi
test eax, eax
je 0x75b89c3d7
cmp eax, 1
setne al
mov byte [rcx], al
jmp 0x75b89c559
mov qword [rbp + 0x28], rsi
lea rdx, str.IsWow64Process2
lea rcx, [rbp + 0x28]
call fcn.75b89c2cc
cmp eax, 0x8007007f
jne 0x75b89c3f7
mov rbx, rsi
jmp 0x75b89c403
test eax, eax
js 0x75b89c55b
mov rbx, qword [rbp + 0x28]
test rbx, rbx
je 0x75b89c483
mov word [rbp + 0x28], si
mov word [rbp + 0x30], si
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movabs r10, 0xbd24a77672d3d270
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x28]
mov rax, rbx
call qword [0x75b8e0a70]
test eax, eax
jne 0x75b89c477
call fcn.75b89abc4
mov ebx, eax
lea rdx, [0x75b91c090]
mov rcx, qword [0x75b91c090]
cmp rcx, rdx
je 0x75b89c470
test byte [rcx + 0x1c], 1
je 0x75b89c470
mov edx, 0x1e
mov r9d, ebx
lea r8, [0x75b8f6e50]
mov rcx, qword [rcx + 0x10]
call fcn.75b803b0c
mov eax, ebx
jmp 0x75b89c55b
movzx eax, word [rbp + 0x28]
neg ax
jmp 0x75b89c536
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rbp - 0x30], 0xc
je 0x75b89c54c
mov qword [rbp + 0x30], rsi
lea rdx, str.IsWow64Process
lea rcx, [rbp + 0x30]
call fcn.75b89c2cc
cmp eax, 0x8007007f
jne 0x75b89c4c7
mov rbx, rsi
jmp 0x75b89c4d3
test eax, eax
js 0x75b89c55b
mov rbx, qword [rbp + 0x30]
test rbx, rbx
je 0x75b89c54c
mov dword [rbp + 0x28], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movabs r10, 0x9c44073830d36370
lea rdx, [rbp + 0x28]
mov rax, rbx
call qword [0x75b8e0a70]
test eax, eax
jne 0x75b89c531
call fcn.75b89abc4
mov ebx, eax
lea rdx, [0x75b91c090]
mov rcx, qword [0x75b91c090]
cmp rcx, rdx
je 0x75b89c470
test byte [rcx + 0x1c], 1
je 0x75b89c470
mov edx, 0x1f
jmp 0x75b89c45d
mov eax, dword [rbp + 0x28]
neg eax
sbb ecx, ecx
neg ecx
inc ecx
mov dword [0x75b9259cc], ecx
cmp ecx, 1
setne al
mov byte [rdi], al
jmp 0x75b89c559
mov dword [0x75b9259cc], 1
mov byte [rdi], sil
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x75b89ced8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, edx
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp rax, rdx
je 0x75b89cf01
mov eax, 0x80070057
jmp 0x75b89cf87
mov r8d, edx
jmp 0x75b89cf21
mov eax, dword [rsp + 0x48]
cmp eax, ebx
je 0x75b89cf85
test eax, eax
je 0x75b89cf7e
cmp eax, ebx
ja 0x75b89cf7e
sub ebx, eax
mov rcx, rsi
add rdi, rax
mov r8d, ebx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x75b89cf06
call fcn.75b89abc4
mov ebx, eax
test eax, eax
jns 0x75b89cf85
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89cf7a
test byte [rcx + 0x1c], 1
je 0x75b89cf7a
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f6f38]
mov edx, 0x13
mov r9d, ebx
call fcn.75b803b0c
mov eax, ebx
jmp 0x75b89cf87
mov ebx, 0x8000ffff
jmp 0x75b89cf49
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x75b89cf98
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x75b89cff8
call fcn.75b89abc4
mov ebx, eax
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89cff4
test byte [rcx + 0x1c], 1
je 0x75b89cff4
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f6f38]
mov edx, 0x15
mov r9d, ebx
call fcn.75b803b0c
mov eax, ebx
jmp 0x75b89d002
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x75b89d008
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, dword [rdx]
mov r10, r8
mov rbx, rdx
cmp rdi, qword [rdx]
je 0x75b89d029
mov eax, 0x80070057
jmp 0x75b89d0ac
and qword [rdx], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, r10
and qword [rsp + 0x20], 0
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x75b89d096
call fcn.75b89abc4
mov edi, eax
cmp eax, 0x80070026
jne 0x75b89d061
and qword [rbx], 0
jmp 0x75b89d0aa
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89d092
test byte [rcx + 0x1c], 1
je 0x75b89d092
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f6f38]
mov edx, 0x16
mov r9d, edi
call fcn.75b803b0c
mov eax, edi
jmp 0x75b89d0ac
cmp dword [rsp + 0x48], edi
jbe 0x75b89d0a3
mov eax, 0x8000ffff
jmp 0x75b89d0ac
mov eax, dword [rsp + 0x48]
mov qword [rbx], rax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x75b89d358
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x75b89d3c1
call fcn.75b89abc4
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x75b89d3bd
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89d3bd
test byte [rcx + 0x1c], 1
je 0x75b89d3bd
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f6f38]
mov edx, 0x1e
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.75b81c350
mov eax, ebx
jmp 0x75b89d3c5
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x75b89d4a0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x75b89d4bd
xor eax, eax
jmp 0x75b89d51c
call fcn.75b89abc4
mov ebx, eax
cmp eax, 0x800700b7
je 0x75b89d508
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89d504
mov edx, 1
test byte [rcx + 0x1c], dl
je 0x75b89d504
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f6f38]
mov edx, 0x21
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.75b81c350
mov eax, ebx
jmp 0x75b89d51c
mov rcx, rdi
call fcn.75b89d3d0
test eax, eax
mov edx, 1
cmovs edx, eax
mov eax, edx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x75b89d7c0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
and qword [rdx], 0
lea rbp, [rcx + 0x28]
mov r14, rdx
mov rsi, rcx
mov rcx, qword [rsi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x75b89d80f
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x75b89d808
call fcn.75b89abc4
mov edi, eax
cmp eax, 0x80070012
jmp 0x75b89d89c
xor edi, edi
jmp 0x75b89d89e
mov rax, qword [rsi + 0x20]
lea r9, [0x75b8e4140]
mov r8, qword [rsi + 0x18]
lea rdx, str._ls_ls_ls
and qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.75b89f104
mov ebx, eax
test eax, eax
js 0x75b89d8c6
mov rcx, qword [rsi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x75b89d85e
test rcx, rcx
je 0x75b89d859
call qword [sym.imp.KERNEL32.dll_FindClose]
or qword [rsi + 0x10], 0xffffffffffffffff
mov rbx, qword [rsp + 0x50]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x75b89d883
call fcn.75b89abc4
mov edi, eax
add eax, 0x7ff8fffe
jmp 0x75b89d889
mov qword [rsi + 0x10], rax
xor edi, edi
test rbx, rbx
je 0x75b89d896
mov rcx, rbx
call fcn.75b8bde90
cmp edi, 0x80070012
je 0x75b89d8be
test edi, edi
js 0x75b89d8ba
test byte [rsi + 0x280], 2
je 0x75b89d8b5
test byte [rbp], 0x10
jne 0x75b89d7e0
mov qword [r14], rbp
jmp 0x75b89d8c2
mov eax, edi
jmp 0x75b89d8d7
and qword [r14], 0
xor eax, eax
jmp 0x75b89d8d7
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x75b89d8d5
call fcn.75b8bde90
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x75b89db94
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x75b89dbaf
xor eax, eax
jmp 0x75b89dbf8
call fcn.75b89abc4
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x75b89dbf6
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89dbf6
test byte [rcx + 0x1c], 1
je 0x75b89dbf6
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f6f38]
mov edx, 0x24
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.75b81c350
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call 0x75b89db94
lea edx, [rax + 0x7ff8fffe]
cmp edx, 1
jbe 0x75b89dc3d
cmp eax, 0x80070005
jne 0x75b89dc42
mov rcx, rbx
call fcn.75b89ded4
test eax, eax
js 0x75b89dc42
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x75b89db94
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x75b89dc04
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x75b89dbaf
xor eax, eax
jmp 0x75b89dbf8
call fcn.75b89abc4
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x75b89dbf6
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89dbf6
test byte [rcx + 0x1c], 1
je 0x75b89dbf6
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f6f38]
mov edx, 0x24
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.75b81c350
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call 0x75b89db94
lea edx, [rax + 0x7ff8fffe]
cmp edx, 1
jbe 0x75b89dc3d
cmp eax, 0x80070005
jne 0x75b89dc42
mov rcx, rbx
call fcn.75b89ded4
test eax, eax
js 0x75b89dc42
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x75b89db94
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x75b89dc48
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x75b89dc63
xor eax, eax
jmp 0x75b89dcac
call fcn.75b89abc4
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x75b89dcaa
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89dcaa
test byte [rcx + 0x1c], 1
je 0x75b89dcaa
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f6f38]
mov edx, 0x25
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.75b81c350
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x75b89de80
Capabilities:
Delete file

Disassembly:
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 0x10]
jmp 0x75b89de80
push rbx
sub rsp, 0x20
and dword [rsp + 0x38], 0
mov rbx, rcx
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.75b89d358
lea edx, [rax + 0x7ff8fffe]
cmp edx, 1
jbe 0x75b89dec8
test eax, eax
js 0x75b89decd
test byte [rsp + 0x38], 0x10
mov rcx, rbx
jne 0x75b89debe
add rsp, 0x20
pop rbx
jmp fcn.75b89dc04
add rsp, 0x20
pop rbx
jmp fcn.75b89dcb8
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x75b89ded4
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edx, 0x80
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x75b89df38
call fcn.75b89abc4
mov ebx, eax
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89df34
test byte [rcx + 0x1c], 1
je 0x75b89df34
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f6f38]
mov edx, 0x26
mov dword [rsp + 0x28], ebx
mov r9, rdi
mov dword [rsp + 0x20], 0x80
call fcn.75b8699c8
mov eax, ebx
jmp 0x75b89df3a
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x75b89df48
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, dword [rdx]
mov rdi, r8
mov rsi, rdx
mov r8d, ebx
mov rdx, rdi
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov r9d, eax
test eax, eax
jne 0x75b89dfbc
call fcn.75b89abc4
mov ebx, eax
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89dfb8
test byte [rcx + 0x1c], 1
je 0x75b89dfb8
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f6f38]
mov edx, 0x27
mov dword [rsp + 0x20], ebx
mov r9, rbp
call fcn.75b81c350
mov eax, ebx
jmp 0x75b89dfde
cmp r9d, ebx
ja 0x75b89dfd2
lea eax, [r9 - 1]
cmp word [rdi + rax*2], dx
je 0x75b89dfd9
mov eax, 0x8000ffff
jmp 0x75b89dfde
test ebx, ebx
je 0x75b89dfd9
mov word [rdi], dx
mov qword [rsi], r9
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x75b89e104
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x75b89e174
call fcn.75b89abc4
mov ebx, eax
test rdi, rdi
jne 0x75b89e136
cmp eax, 0x800700cb
je 0x75b89e174
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89e170
test byte [rcx + 0x1c], 1
je 0x75b89e170
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f6f38]
mov edx, 0x29
mov dword [rsp + 0x28], ebx
mov r9, rsi
mov qword [rsp + 0x20], rdi
call fcn.75b834414
mov eax, ebx
jmp 0x75b89e176
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x75b89e188
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
push rdi
sub rsp, 0x30
xor edi, edi
mov r9, r8
mov dword [rax + 0x20], edi
lea rax, [rax + 0x20]
mov rbx, rcx
mov qword [rsp + 0x28], rax
mov r8, rdx
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x75b89e1f7
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89e25e
test byte [rcx + 0x1c], 4
je 0x75b89e25e
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x2a]
lea r8, [0x75b8f6f38]
call fcn.75b803a40
jmp 0x75b89e25e
mov ebx, 0x80004005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edx, dword [rax]
sub edx, 0xb
je 0x75b89e226
sub edx, 1
je 0x75b89e218
sub edx, 1
je 0x75b89e21f
cmp edx, 9
jne 0x75b89e22b
mov ebx, 0x8007000e
jmp 0x75b89e22b
mov ebx, 0x80070005
jmp 0x75b89e22b
mov ebx, 0x8007009b
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89e25c
test byte [rcx + 0x1c], 1
je 0x75b89e25c
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f6f38]
mov edx, 0x2b
mov r9d, ebx
call fcn.75b803b0c
mov edi, ebx
mov rbx, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret

Function at 0x75b89ff20
Capabilities:
Get token membership

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], r9d
push rdi
sub rsp, 0x60
and qword [rax + 8], 0
mov rsi, rdx
and qword [rax - 0x48], 0
mov edx, 2
mov rdi, rcx
mov byte [rcx], 0
mov r9d, 0x220
lea rcx, [rax + 8]
lea r8d, [rdx + 0x1e]
call fcn.75b89fc70
mov ebx, eax
test eax, eax
jns 0x75b89ff7b
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x75b89ff74
call fcn.75b8be3a0
mov eax, ebx
jmp 0x75b89fffb
mov rbx, qword [rsp + 0x70]
lea r8, [rsp + 0x88]
and dword [rsp + 0x88], 0
mov rdx, rbx
mov rcx, rsi
mov byte [rdi], 0
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x75b89ffdd
call fcn.75b89abc4
mov edi, eax
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b89ffec
test byte [rcx + 0x1c], 1
je 0x75b89ffec
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f74c0]
mov edx, 0x1a
mov r9d, edi
call fcn.75b803b0c
jmp 0x75b89ffec
cmp dword [rsp + 0x88], 0
setne al
mov byte [rdi], al
xor edi, edi
test rbx, rbx
je 0x75b89fff9
mov rcx, rbx
call fcn.75b8be3a0
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x75b8a29f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, qword [r9]
mov rdi, r9
mov eax, r14d
mov r15, r8
mov dword [rsp + 0x68], eax
mov rbp, rdx
cmp rax, r14
je 0x75b8a2a2b
mov ebx, 0x80070057
jmp 0x75b8a2a73
mov rbx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov r9, r15
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x75b8a2aad
test rbx, rbx
je 0x75b8a2a8e
mov eax, dword [rsp + 0x68]
cmp rax, qword [rdi]
jbe 0x75b8a2a8e
mov ebx, 0x800700ea
mov qword [rdi], rax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov eax, dword [rsp + 0x68]
mov r9, rdi
mov qword [rdi], rax
mov rdx, r14
mov r8d, dword [r15]
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call fcn.75b8a2958
jmp 0x75b8a2a75
mov ebx, 0x80070002
cmp esi, ebx
jne 0x75b8a2ae9
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b8a2a73
test byte [rcx + 0x1c], 4
je 0x75b8a2a73
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f74e0]
mov edx, 0x16
mov r9, rbp
call fcn.75b805074
jmp 0x75b8a2a73
mov ebx, 0x800700ea
cmp esi, ebx
je 0x75b8a2b2e
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b8a2b27
test byte [rcx + 0x1c], 1
je 0x75b8a2b27
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f74e0]
mov edx, 0x17
mov dword [rsp + 0x20], esi
mov r9, rbp
call fcn.75b81c350
mov ebx, esi
jmp 0x75b8a2a73
mov eax, dword [rsp + 0x68]
cmp qword [rdi], rax
jb 0x75b8a2a70
mov ebx, 0x8000ffff
jmp 0x75b8a2a73

Function at 0x75b8a2e34
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, r9d
mov rdi, rdx
cmp rax, r9
je 0x75b8a2e50
mov eax, 0x80070057
jmp 0x75b8a2eb9
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x28], r9d
mov r9d, r8d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x75b8a2eb7
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b8a2ea6
test byte [rcx + 0x1c], 1
je 0x75b8a2ea6
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f74e0]
mov edx, 0x1a
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.75b803a94
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
test eax, eax
js 0x75b8a2eb9
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x75b8a301c
Capabilities:
Query or enumerate registry key

Disassembly:
mov rcx, rdx
mov edx, r8d
mov r8, qword [rsp + 0x28]
jmp 0x75b8a301c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, qword [r8]
mov rbp, r9
mov eax, r14d
mov rdi, r8
mov dword [rsp + 0x70], eax
mov rsi, rdx
cmp rax, r14
je 0x75b8a3050
mov ebx, 0x80070057
jmp 0x75b8a3131
mov eax, esi
cmp rax, rsi
jne 0x75b8a3046
and qword [rsp + 0x38], 0
lea r9, [rsp + 0x70]
and qword [rsp + 0x30], 0
mov r8, rbp
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x75b8a30d6
mov edx, dword [rsp + 0x70]
mov ecx, 0x800700ea
inc edx
test rbp, rbp
je 0x75b8a30a7
mov eax, edx
cmp rax, qword [rdi]
cmova ebx, ecx
mov eax, edx
mov qword [rdi], rax
mov eax, ebx
cmp ebx, ecx
je 0x75b8a313c
mov ecx, 0x80070103
cmp ebx, ecx
je 0x75b8a313c
test ebx, ebx
js 0x75b8a3131
mov r9, rbp
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.75b8a2f68
jmp 0x75b8a313c
mov ecx, 0x80070103
cmp ebx, ecx
je 0x75b8a313a
mov ecx, 0x800700ea
cmp ebx, ecx
je 0x75b8a311f
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b8a3131
test byte [rcx + 0x1c], 1
je 0x75b8a3131
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f74e0]
mov edx, 0x1c
mov dword [rsp + 0x20], ebx
mov r9d, esi
call fcn.75b816cf8
jmp 0x75b8a3131
mov edx, dword [rsp + 0x70]
inc edx
mov eax, edx
cmp qword [rdi], rax
jb 0x75b8a3135
mov ebx, 0x8000ffff
mov eax, ebx
jmp 0x75b8a313c
mov eax, edx
mov qword [rdi], rax
mov eax, ecx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x75b8a3150
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r13, qword [r9]
mov rsi, r9
mov r14, qword [rsp + 0x98]
mov rbp, rdx
mov eax, r13d
mov dword [r11 + 0x30], eax
mov r12, qword [r14]
cmp rax, r13
je 0x75b8a3195
mov ebx, 0x80070057
jmp 0x75b8a32f5
mov eax, r12d
mov dword [rsp + 0x88], eax
cmp rax, r12
jne 0x75b8a318b
mov eax, ebp
cmp rax, rbp
jne 0x75b8a318b
lea rax, [rsp + 0x88]
xor edi, edi
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x98]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r8
mov r8, qword [rsp + 0x90]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x75b8a328d
mov edx, dword [rsp + 0x98]
mov ecx, 0x800700ea
inc edx
cmp qword [rsp + 0x90], rdi
je 0x75b8a3215
mov eax, edx
cmp rax, qword [rsi]
cmova ebx, ecx
mov eax, edx
mov qword [rsi], rax
mov eax, dword [rsp + 0x88]
mov qword [r14], rax
mov eax, ebx
cmp ebx, ecx
je 0x75b8a3308
mov ecx, 0x80070103
cmp ebx, ecx
je 0x75b8a3308
test ebx, ebx
js 0x75b8a32f5
mov r9, qword [rsp + 0x90]
mov r8, rsi
mov rdx, r13
mov rcx, rbp
call fcn.75b8a2f68
test eax, eax
js 0x75b8a3308
mov rax, qword [rsp + 0x80]
mov r9, r14
mov rcx, qword [rsp + 0x90]
mov rdx, r12
mov qword [rsp + 0x20], rdi
mov r8d, dword [rax]
call fcn.75b8a2958
test eax, eax
cmovs edi, eax
mov eax, edi
jmp 0x75b8a3308
mov ecx, 0x80070103
cmp ebx, ecx
je 0x75b8a3306
mov ecx, 0x800700ea
cmp ebx, ecx
je 0x75b8a32d6
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b8a32f5
test byte [rcx + 0x1c], 1
je 0x75b8a32f5
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f74e0]
mov edx, 0x1e
mov dword [rsp + 0x20], ebx
mov r9d, ebp
call fcn.75b816cf8
jmp 0x75b8a32f5
mov edx, dword [rsp + 0x98]
inc edx
cmp qword [rsi], rdx
jb 0x75b8a32f9
mov eax, dword [rsp + 0x88]
cmp qword [r14], rax
jb 0x75b8a32f9
mov ebx, 0x8000ffff
mov eax, ebx
jmp 0x75b8a3308
mov eax, dword [rsp + 0x88]
mov qword [rsi], rdx
mov qword [r14], rax
mov eax, ecx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x75b8a3320
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80070002
cmp ebx, eax
je 0x75b8a3389
test ebx, ebx
jns 0x75b8a3387
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b8a3383
test byte [rcx + 0x1c], 1
je 0x75b8a3383
mov rcx, qword [rcx + 0x10]
lea r8, [0x75b8f74e0]
mov edx, 0x20
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.75b81c350
mov eax, ebx
jmp 0x75b8a3389
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret