joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400190ac
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov r13, rdx
mov rbp, r8
mov rdx, rcx
cmp r13, r8
je 0x14001929b
mov rax, qword [rcx + 8]
mov r14, r13
mov r12, qword [rcx + 0x18]
lea rcx, [r13 + 0x10]
cmp qword [rcx + 0x18], 8
mov r15, qword [r13 + 8]
mov r10, qword [rcx + 0x10]
mov qword [rsp + 0x98], rax
jb 0x1400190fc
mov rcx, qword [rcx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
movabs r11, 0x100000001b3
add r10, r10
je 0x14001912c
movzx eax, byte [r8 + rcx]
inc r8
xor r9, rax
imul r9, r11
cmp r8, r10
jb 0x140019118
mov rax, qword [rdx + 0x30]
and rax, r9
shl rax, 4
mov qword [rsp + 0x88], rax
mov rcx, qword [rax + r12]
mov rax, qword [rax + r12 + 8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x90], rcx
mov rdi, r14
mov rsi, r14
mov r14, qword [r14]
lea rcx, [rdi + 0x30]
call fcn.14000d240
lea rcx, [rdi + 0x10]
call fcn.14000d240
mov edx, 0x50
mov rcx, rdi
call fcn.140034098
mov r8, qword [rsp + 0x80]
dec qword [r8 + 0x10]
cmp rdi, qword [rsp + 0x20]
je 0x1400191b4
cmp r14, rbp
jne 0x140019155
cmp qword [rsp + 0x90], r13
jne 0x140019294
mov rax, qword [rsp + 0x88]
mov qword [rax + r12], r14
jmp 0x140019294
mov rax, qword [rsp + 0x88]
cmp qword [rsp + 0x90], r13
jne 0x1400191d7
mov rdx, qword [rsp + 0x98]
mov qword [rax + r12], rdx
mov rcx, rdx
jmp 0x1400191da
mov rcx, r15
mov qword [rax + r12 + 8], rcx
cmp r14, rbp
je 0x140019294
mov r13, r12
lea rcx, [r14 + 0x10]
cmp qword [rcx + 0x18], 8
mov r10, qword [rcx + 0x10]
jb 0x1400191fd
mov rcx, qword [rcx]
xor r9d, r9d
movabs rdx, 0xcbf29ce484222325
add r10, r10
je 0x140019235
movabs r8, 0x100000001b3
movzx eax, byte [r9 + rcx]
inc r9
xor rdx, rax
imul rdx, r8
cmp r9, r10
jb 0x140019219
mov r8, qword [rsp + 0x80]
mov r12, qword [r8 + 0x30]
and r12, rdx
add r12, r12
mov rax, qword [r13 + r12*8 + 8]
mov qword [rsp + 0x88], rax
mov rdi, r14
mov rsi, r14
mov r14, qword [r14]
lea rcx, [rdi + 0x30]
call fcn.14000d240
lea rcx, [rdi + 0x10]
call fcn.14000d240
mov edx, 0x50
mov rcx, rdi
call fcn.140034098
mov r8, qword [rsp + 0x80]
dec qword [r8 + 0x10]
cmp rdi, qword [rsp + 0x88]
je 0x1400192b0
cmp r14, rbp
jne 0x14001924c
mov qword [r13 + r12*8], r14
mov qword [r15], r14
mov qword [r14 + 8], r15
mov rax, rbp
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rsp + 0x98]
mov qword [r13 + r12*8], rax
mov qword [r13 + r12*8 + 8], rax
cmp r14, rbp
je 0x140019294
jmp 0x1400191eb
Function at 0x1400193d8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov r8, qword [r8 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140019411
mov rdx, qword [r14]
movabs rbp, 0xcbf29ce484222325
xor ecx, ecx
add r8, r8
je 0x14001943f
movzx eax, byte [rcx + rdx]
xor rbp, rax
movabs r9, 0x100000001b3
imul rbp, r9
inc rcx
cmp rcx, r8
jb 0x140019422
mov r9, rbp
mov r8, r14
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400192d4
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140019468
mov qword [rdi], rdx
mov byte [rdi + 8], 0
jmp 0x14001959d
movabs rax, 0x333333333333333
cmp qword [rsi + 0x10], rax
je 0x1400195ba
lea r12, [rsi + 8]
mov qword [rsp + 0x38], r12
and qword [rsp + 0x40], 0
mov ecx, 0x50
call fcn.140033ce4
mov rbx, rax
mov qword [rsp + 0x40], rax
lea r15, [rax + 0x10]
mov qword [rsp + 0x80], r15
mov rdx, r14
mov rcx, r15
call fcn.14000d340
nop
lea rcx, [r15 + 0x20]
lea rdx, [r14 + 0x20]
call fcn.14000d340
nop
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1400194d7
cvtsi2ss xmm0, rcx
jmp 0x1400194ec
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400194ff
cvtsi2ss xmm1, rcx
jmp 0x140019514
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x140019546
mov rcx, rsi
call fcn.140018b94
mov r9, rbp
mov r8, r15
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1400192d4
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x28], xmm0
mov rdx, qword [rsp + 0x28]
mov r8, qword [rdx + 8]
inc qword [rsi + 0x10]
mov qword [rbx], rdx
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rdx + 8], rbx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, rbp
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x14001957f
mov qword [rcx + rax*8], rbx
jmp 0x140019591
cmp r9, rdx
jne 0x14001958a
mov qword [rcx + rax*8], rbx
jmp 0x140019596
cmp qword [rcx + rax*8 + 8], r8
jne 0x140019596
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rax, rdi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
lea rcx, str.unordered_map_set_too_long
call fcn.140011b38
int3
Function at 0x1400195d0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x10], rdx
push rsi
push rdi
push r15
sub rsp, 0x50
xor r15d, r15d
lea rax, [r11 + 0x10]
mov qword [r11 - 0x28], r15
lea rdx, str.SoftwareMicrosoftCloudManagedUpdateuhs_settings
mov qword [r11 - 0x30], rax
mov rbp, rcx
mov qword [r11 - 0x38], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [r11 - 0x48], r15d
mov qword [r11 + 0x10], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x14001967d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
lea r8, str.SoftwareMicrosoftCloudManagedUpdateuhs_settings
or ecx, 0x80070000
lea rdx, str.Failed_to_create_open_settings_key__s
test eax, eax
cmovle ecx, eax
call fcn.14000c770
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140019763
mov rax, qword [rbp + 0xf8]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140019760
lea rsi, [rbx + 0x30]
cmp qword [rsi + 0x18], 8
mov rcx, rsi
jb 0x1400196a1
mov rcx, qword [rsi]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400196a5
add eax, eax
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400196be
mov rcx, qword [rsi]
lea rdi, [rbx + 0x10]
cmp qword [rdi + 0x18], 8
mov r8, rdi
jb 0x1400196cf
mov r8, qword [rdi]
xor edx, edx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x78]
lea r9d, [rdx + 1]
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
nop dword [rax + rax]
test eax, eax
je 0x140019728
cmp qword [rdi + 0x18], 8
jb 0x1400196fd
mov rdi, qword [rdi]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov r8, rdi
or ecx, 0x80070000
lea rdx, str.Failed_to_write__s
test eax, eax
cmovle ecx, eax
call fcn.14000c770
jmp 0x140019750
cmp qword [rsi + 0x18], 8
jb 0x140019732
mov rsi, qword [rsi]
cmp qword [rdi + 0x18], 8
jb 0x14001973c
mov rdi, qword [rdi]
mov r9, rsi
lea rdx, str.Wrote_value_Name:__s__Value:__s
mov r8, rdi
xor ecx, ecx
call fcn.14000c770
mov rbx, qword [rbx]
cmp rbx, qword [rbp + 0xf8]
jne 0x140019690
mov ebx, r15d
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140019779
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rsi
ret
Function at 0x14001a720
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor edi, edi
mov rbx, rdx
cmp qword [rdx + 0x18], 8
mov qword [rsp + 0x30], rdi
jb 0x14001a73e
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001a78f
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x14001a775
mov rdx, qword [rbx]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteTreeW]
nop dword [rax + rax]
test eax, eax
jne 0x14001a78f
lea edi, [rax + 1]
mov rcx, rbx
call fcn.14000d240
mov rbx, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x14001adcc
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
and qword [rsp + 0x30], 0
xor r14b, r14b
cmp qword [rcx + 0x18], 8
mov rdi, rdx
mov rbx, rcx
mov rdx, rcx
jb 0x14001adfa
mov rdx, qword [rcx]
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001af0f
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x14001ae35
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14001ae7a
cmp qword [rdi + 0x18], 8
mov r14b, 1
mov r9, rdi
jb 0x14001ae5a
mov r9, qword [rdi]
cmp qword [rbx + 0x18], 8
mov r8, rbx
jb 0x14001ae67
mov r8, qword [rbx]
lea rdx, str._s_s_registry_value_deleted_successfully.
xor ecx, ecx
call fcn.14000c770
jmp 0x14001af7f
mov rbp, rdi
cmp eax, 2
jne 0x14001aeca
cmp qword [rdi + 0x18], 8
jb 0x14001ae8c
mov rbp, qword [rdi]
cmp qword [rbx + 0x18], 8
mov rsi, rbx
jb 0x14001ae99
mov rsi, qword [rbx]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov r9, rbp
or ecx, 0x80070000
lea rdx, str._s_s_registry_value_does_not_exist
test eax, eax
mov r8, rsi
cmovle ecx, eax
call fcn.14000c770
jmp 0x14001af7f
cmp qword [rdi + 0x18], 8
jb 0x14001aed4
mov rbp, qword [rdi]
cmp qword [rbx + 0x18], 8
mov rsi, rbx
jb 0x14001aee1
mov rsi, qword [rbx]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov r9, rbp
or ecx, 0x80070000
lea rdx, str._s_s_registry_value_delete_failed.
test eax, eax
mov r8, rsi
cmovle ecx, eax
call fcn.14000c5f4
jmp 0x14001af7f
mov rsi, rbx
cmp eax, 2
jne 0x14001af4c
cmp qword [rbx + 0x18], 8
jb 0x14001af21
mov rsi, qword [rbx]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov r8, rsi
or ecx, 0x80070000
lea rdx, str._s_registry_key_does_not_exist
test eax, eax
cmovle ecx, eax
call fcn.14000c770
jmp 0x14001af7f
cmp qword [rbx + 0x18], 8
jb 0x14001af56
mov rsi, qword [rbx]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov r8, rsi
or ecx, 0x80070000
lea rdx, str._s_registry_key_open_failed.
test eax, eax
cmovle ecx, eax
call fcn.14000c5f4
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001af95
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, rbx
call fcn.14000d240
mov rcx, rdi
call fcn.14000d240
mov rbx, qword [rsp + 0x70]
mov al, r14b
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14001afc4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x10], rdx
push rdi
sub rsp, 0x30
and qword [r11 + 0x10], 0
xor ebx, ebx
mov rdi, r9
mov rax, r8
mov rsi, rcx
test r8, r8
jne 0x14001affb
mov ecx, 0x80070057
mov ebx, ecx
call fcn.14000d0b0
jmp 0x14001b05a
test rdi, rdi
je 0x14001afed
mov byte [rcx], bl
mov r9d, 0x20019
lea rcx, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b05a
and qword [rsp + 0x28], rbx
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
and qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b05a
mov byte [rsi], 1
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001b070
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000cfd4
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14001b090
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
and qword [rsp + 0x48], 0
xor ebx, ebx
mov rdi, r8
mov rsi, rcx
test rdx, rdx
jne 0x14001b0c0
mov ecx, 0x80070057
mov ebx, ecx
call fcn.14000d0b0
jmp 0x14001b11c
test rdi, rdi
je 0x14001b0b2
mov byte [rcx], bl
lea rax, [rsp + 0x48]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b11c
and qword [rsp + 0x28], rbx
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
and qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b11c
mov byte [rsi], 1
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001b132
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000cfd4
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14001b234
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
and qword [rsp + 0x30], 0
mov rsi, rdx
cmp qword [rcx + 0x18], 8
mov rbx, rcx
mov rdx, rcx
jb 0x14001b25c
mov rdx, qword [rcx]
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
cmp qword [rsi + 0x18], 8
mov rdx, rsi
mov edi, eax
jb 0x14001b291
mov rdx, qword [rsi]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test edi, edi
jne 0x14001b2c1
test eax, eax
jne 0x14001b2c1
mov dil, 1
jmp 0x14001b2c4
xor dil, dil
cmp qword [rbx + 0x18], 8
mov r8, rbx
jb 0x14001b2d1
mov r8, qword [rbx]
lea rax, str.exists
test dil, dil
lea r9, str.does_not_exist
cmovne r9, rax
lea rdx, str._s_registry_key__s
xor ecx, ecx
call fcn.14000c770
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001b30a
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, rbx
call fcn.14000d240
mov rcx, rsi
call fcn.14000d240
mov rbx, qword [rsp + 0x60]
mov al, dil
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x14001b548
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x40
and qword [rsp + 0x30], 0
mov rsi, rdx
cmp qword [rcx + 0x18], 8
mov rdi, r8
mov r14, rcx
mov rdx, rcx
jb 0x14001b571
mov rdx, qword [rcx]
lea rax, [rsp + 0x30]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b5ea
cmp qword [rdi + 0x18], 8
mov eax, dword [rdi + 0x10]
lea ecx, [rax*2 + 2]
mov rax, rdi
jb 0x14001b5b2
mov rax, qword [rdi]
cmp qword [rsi + 0x18], 8
mov rdx, rsi
jb 0x14001b5bf
mov rdx, qword [rsi]
mov dword [rsp + 0x28], ecx
mov r9d, 1
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b5ea
xor ebx, ebx
jmp 0x14001b5ff
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.14000d0b0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001b615
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000cfd4
mov rcx, r14
call fcn.14000d240
mov rcx, rsi
call fcn.14000d240
mov rcx, rdi
call fcn.14000d240
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14001b64c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x14005a8e0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, r8
mov rbx, rdx
xor esi, esi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x30], rsi
movdqa xmm0, xmmword [0x14004ae40]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], si
mov rdx, r9
lea rcx, [rbp - 0x30]
call fcn.14000d19c
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b70d
mov eax, dword [rbp - 0x20]
lea eax, [rax*2 + 2]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea r9d, [rsi + 1]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b70d
mov ebx, esi
jmp 0x14001b722
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.14000d0b0
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14001b737
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000cfd4
nop
lea rcx, [rbp - 0x30]
call fcn.14000d240
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400339f0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001b770
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x1080
call fcn.140034d70
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x14005a8e0]
xor rax, rsp
mov qword [rsp + 0x1070], rax
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov word [rsp + 0x70], r14w
mov dword [rsp + 0x40], 0x1000
mov rdx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001b7d5
mov rdx, qword [rcx]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov ebx, 2
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b860
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x14001b80e
mov r8, qword [rsi]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001b81b
mov rdx, qword [rdi]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, ebx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b860
mov ebx, r14d
lea rdx, [rsp + 0x70]
mov rcx, rbp
call fcn.14000d19c
jmp 0x14001b875
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.14000d0b0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001b88b
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000cfd4
nop
mov rcx, rdi
call fcn.14000d240
nop
mov rcx, rsi
call fcn.14000d240
mov eax, ebx
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.1400339f0
add rsp, 0x1080
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001b8cc
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
mov qword [r11 + 0x10], rdx
push rbx
sub rsp, 0x30
and qword [r11 + 0x10], 0
lea rax, [r11 + 0x10]
mov rbx, r8
mov qword [r11 - 0x18], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftCloudManagedUpdateuhs
mov r9d, 2
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b945
mov rcx, qword [rsp + 0x48]
lea r9d, [rax + 4]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b945
xor ebx, ebx
jmp 0x14001b95a
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.14000d0b0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001b970
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000cfd4
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x14001b988
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
mov rbx, r9
mov dword [rax + 8], 4
lea rax, [rax - 0x18]
mov rdi, r8
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001ba04
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001ba04
xor ebx, ebx
jmp 0x14001ba19
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.14000d0b0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001ba2f
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000cfd4
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret