joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004ab34
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push rdi
sub rsp, 0x280
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edi, edi
lea rax, [rsp + 0x58]
lea rdx, [0x100027f90]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x10004ac5c
lea rax, [rsp + 0x50]
lea r9d, [rdi + 3]
lea rdx, [0x100027ff0]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x10004ac51
lea rax, [rsp + 0x60]
cmp rax, rdi
je 0x10004abe9
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.1000529a4
jmp 0x10004abeb
mov eax, edi
cmp eax, edi
je 0x10004ac46
lea r8, [0x100028050]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.100039ee4
cmp eax, edi
jl 0x10004ac46
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
lea rdx, [0x100028080]
mov r9d, 1
not rcx
xor r8d, r8d
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10007fa70
add rsp, 0x280
pop rdi
ret

Function at 0x10004c0a4
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
and qword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
lea rdx, [0x100028710]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004c178
and dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100028770]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004c127
cmp dword [rsp + 0x40], 1
jne 0x10004c127
and dword [0x1000888a8], 0xfffffffe
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea rdx, [0x1000287b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004c16d
cmp dword [rsp + 0x40], 1
jne 0x10004c16d
and dword [0x1000888a8], 0xfffffffd
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret
Function at 0x100052680
Capabilities:
Write file on windows

Disassembly:
test r8, r8
je 0x1000526d3
push rdi
sub rsp, 0x30
mov r10, qword [0x1000861e8]
or rcx, 0xffffffffffffffff
mov r11, r8
cmp r10, rcx
je 0x1000526ce
cmp edx, dword [0x1000888e0]
jg 0x1000526ce
and dword [rsp + 0x50], 0
xor eax, eax
mov rdi, r8
and qword [rsp + 0x20], rax
repne scasb al, byte [rdi]
lea r9, [rsp + 0x50]
not rcx
mov rdx, r11
lea r8, [rcx - 1]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x30
pop rdi
ret

Function at 0x1000527a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rcx, qword [0x1000861e8]
mov rdi, rdx
cmp rcx, 0xffffffffffffffff
jne 0x1000527d8
lea r8, str.wmsetup.log
lea rcx, [0x1000861e8]
mov edx, ebx
call fcn.10005208c
mov rcx, qword [0x1000861e8]
mov r8, rdi
mov edx, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.100052680

Function at 0x1000531ac
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x40]
mov r8d, 0x103
lea rdx, [rsp + 0x40]
sub rcx, rax
xor esi, esi
lea rax, [r8 + 0x7ffffefb]
cmp rax, rsi
je 0x100053207
movzx eax, word [rcx + rdx]
cmp ax, si
je 0x100053207
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x1000531e5
cmp r8, rsi
jne 0x100053210
sub rdx, 2
mov word [rdx], si
lea rcx, [rsp + 0x40]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
cmp rax, rsi
jne 0x100053232
xor eax, eax
jmp 0x1000532ba
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
mov word [rax + 2], si
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp eax, esi
jne 0x100053288
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x57
mov ecx, 2
cmp eax, esi
cmove eax, edx
lea rdx, [0x100029778]
movzx r8d, ax
or r8d, 0x80070000
cmp eax, esi
cmovle r8d, eax
call fcn.1000527f4
jmp 0x10005322b
mov rbx, qword [rsp + 0x20]
cmp rbx, rsi
jne 0x1000532b7
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
mov word [rdi], si
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp eax, esi
cmovne rbx, qword [rsp + 0x20]
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1000532e8
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
je 0x100053330
lea rax, [rsp + 0x20]
cmp rax, rbx
je 0x100053330
lea rcx, [rsp + 0x20]
call fcn.1000531ac
mov rbx, rax
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.10007fa70
add rsp, 0x240
pop rbx
ret
Function at 0x100053480
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rbp, rcx
or r8, 0xffffffffffffffff
xor eax, eax
mov rcx, r8
mov rdi, rbp
repne scasw ax, word [rdi]
lea eax, [r8 + 3]
not rcx
lea r13, [rcx + 0x13]
mul r13
cmovo rax, r8
mov rcx, rax
call fcn.10007fa96
xor edi, edi
mov rbx, rax
cmp rax, rdi
je 0x1000535bb
mov r8, rbp
mov rdx, r13
mov rcx, rax
call fcn.100039df8
lea rdx, [0x1000297b0]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
mov rsi, rax
cmp rax, rdi
je 0x1000535b3
add rsi, 4
mov r12d, edi
lea rdx, [0x1000297b8]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rdi
je 0x1000535a8
mov rcx, rbx
mov word [rax], di
lea rsi, [rax + 2]
call fcn.100053354
cmp eax, edi
jne 0x100053578
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
cmp eax, edi
cmove eax, ecx
mov rcx, rbx
movzx r14d, ax
or r14d, 0x80070000
cmp eax, edi
cmovle r14d, eax
call fcn.100053354
mov r8, rbx
cmp eax, edi
je 0x100053594
xor r9d, r9d
lea edx, [r9 + 5]
lea ecx, [rdx + 3]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov r8, rbp
mov rdx, r13
mov rcx, rbx
call fcn.100039df8
inc r12d
cmp r12d, 0xa
jge 0x1000535a8
jmp 0x100053501
lea rdx, [0x1000297c0]
mov r9d, r14d
mov ecx, 2
call fcn.1000527f4
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, rbx
call fcn.10007faa2
cmp rbp, rdi
je 0x1000535ca
mov rcx, rbp
call fcn.100053354
mov edi, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x100053ae4
Capabilities:
Compare security identifiers

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x90
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x80], rax
or qword [r11 - 0x30], 0xffffffffffffffff
xor r12d, r12d
mov ebp, r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
mov rcx, rax
mov edx, 0x20008
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, r12d
je 0x100053c5a
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea edi, [r12 + 2]
mov edx, edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x60], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [rsp + 0x60]
call fcn.10007fa96
mov rbx, rax
cmp rax, r12
je 0x100053c4a
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov r8, rbx
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, r12d
je 0x100053c42
lea rax, [rsp + 0x70]
lea r8d, [r12 + 0x20]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov r9d, 0x220
mov dl, dil
mov dword [rsp + 0x28], r12d
mov byte [rsp + 0x78], r12b
mov dword [rsp + 0x20], r12d
mov byte [rsp + 0x79], r12b
mov byte [rsp + 0x7a], r12b
mov byte [rsp + 0x7b], r12b
mov byte [rsp + 0x7c], r12b
mov byte [rsp + 0x7d], 5
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, r12d
je 0x100053c42
mov edi, r12d
cmp dword [rbx], r12d
jbe 0x100053c37
lea rsi, [rbx + 8]
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
cmp eax, r12d
jne 0x100053c32
inc edi
add rsi, 0x10
cmp edi, dword [rbx]
jb 0x100053c13
jmp 0x100053c37
mov ebp, 1
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rbx
call fcn.10007faa2
mov rcx, qword [rsp + 0x68]
cmp rcx, r12
je 0x100053c5a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x100053c90
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
and dword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
lea rdx, [0x100029950]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100053cfd
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, [0x100029988]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x1000548bc
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x50
and qword [r11 - 0x18], 0
mov edi, dword [0x1000888d0]
and qword [r11 + 0x18], 0
lea rax, [r11 + 0x18]
lea rdx, [0x100029c90]
xor r9d, r9d
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 2
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100054961
test edi, edi
lea rax, [0x100027ce8]
lea rdx, [0x100029cf4]
cmovne rdx, rax
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov r9d, 1
xor r8d, r8d
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x100028660]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x50
pop rdi
ret
Function at 0x100055690
Capabilities:
Copy file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xe
jae 0x100055700
and qword [rsp + 0x20], 0
and qword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call fcn.10005293c
test eax, eax
je 0x1000556f0
xor edx, edx
mov rcx, rdi
call qword [rsp + 0x20]
test eax, eax
jne 0x1000556f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x10002a030]
mov r8, rbx
mov r9d, eax
mov ecx, 2
call fcn.1000527f4
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x100055700
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xe
jae 0x100055774
and qword [rsp + 0x20], 0
and qword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call fcn.10005293c
test eax, eax
je 0x100055764
xor edx, edx
mov rcx, rbx
call qword [rsp + 0x20]
test eax, eax
jne 0x100055764
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x10002a030]
mov r8, rbx
mov r9d, eax
mov ecx, 2
call fcn.1000527f4
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x100055774
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x100055788
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
mov esi, 0x104
lea rcx, [rsp + 0x30]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edi, edi
cmp eax, edi
je 0x1000558a7
lea rax, [rsp + 0x240]
mov r8, rbx
mov rdx, rsi
sub r8, rax
lea rcx, [rsp + 0x240]
lea rax, [rdx + 0x7ffffefa]
cmp rax, rdi
je 0x100055807
movzx eax, word [r8 + rcx]
cmp ax, di
je 0x100055807
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000557e4
cmp rdx, rdi
jne 0x100055810
sub rcx, 2
mov word [rcx], di
lea r8, [0x10002a070]
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.100039ee4
lea rcx, [rsp + 0x240]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, rdi
je 0x1000558a7
lea rcx, [rsp + 0x30]
mov r8, rax
mov rdx, rsi
call fcn.100039ee4
lea rcx, [rsp + 0x30]
call fcn.100053454
cmp eax, edi
je 0x1000558a7
lea rax, [rsp + 0x30]
cmp rax, rdi
je 0x10005587d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call fcn.100055690
cmp eax, edi
jne 0x1000558a7
lea rax, [rsp + 0x240]
cmp rax, rdi
je 0x1000558a7
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
lea r8d, [r9 + 1]
mov dword [rsp + 0x20], edi
call fcn.100054bc4
lea rdx, [0x10002a088]
mov r8, rbx
mov ecx, 4
call fcn.1000527f4
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100055dec
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x50
and qword [rsp + 0x78], 0
mov eax, 2
mov rbp, rcx
lea r15d, [rax + 0x12]
mul r15
lea rdi, [r15 - 0x15]
cmovo rax, rdi
mov rcx, rax
call fcn.10007fa96
mov rsi, rax
test rax, rax
jne 0x100055e35
mov eax, 0x8007000e
jmp 0x10005601c
lea rax, [rsp + 0x78]
lea rdx, [0x100025960]
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100055ee8
mov ecx, 0x208
call fcn.10007fa96
mov rbx, rax
test rax, rax
je 0x100055edd
mov edi, 0x104
mov rcx, rax
mov edx, edi
call fcn.1000529a4
test eax, eax
je 0x100055ed1
lea r8, [0x10002a460]
mov rdx, rdi
mov rcx, rbx
call fcn.100039ee4
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
lea rdx, [0x10002a478]
mov r9d, 1
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call fcn.10007faa2
or rdi, 0xffffffffffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x78]
lea rdx, [0x10002a4a0]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 3
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x100055fed
mov r9d, dword [0x1000888e4]
jmp 0x100055f52
mov r9d, dword [0x1000888e4]
cmp r9d, 0x3e8
jge 0x100055f88
inc r9d
mov dword [0x1000888e4], r9d
lea r8, [0x1000297a8]
mov rdx, r15
mov rcx, rsi
call fcn.10003a080
mov rcx, qword [rsp + 0x78]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100055f38
xor eax, eax
mov rcx, rdi
mov rdi, rbp
repne scasw ax, word [rdi]
mov r9d, 2
xor r8d, r8d
not rcx
mov rdx, rsi
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x100055fc5
inc dword [0x1000888e4]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x100055fed
lea rdx, [0x10002a558]
lea ecx, [rbx + 4]
mov r8, rbp
call fcn.1000527f4
mov edi, 0xd2af9
jmp 0x100056012
movzx edi, bx
lea rdx, [0x10002a518]
mov r8, rbp
or edi, 0x80070000
test ebx, ebx
mov ecx, 2
cmovle edi, ebx
mov r9d, edi
call fcn.1000527f4
mov rcx, rsi
call fcn.10007faa2
mov eax, edi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rsi
ret
Function at 0x100056fb8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
xor r15d, r15d
lea rax, [r11 + 0x20]
mov r12, r8
mov qword [r11 - 0x50], r15
mov qword [r11 - 0x58], r15
mov qword [r11 - 0x60], r15
mov qword [r11 - 0x68], r15
mov qword [r11 - 0x70], r15
mov qword [r11 - 0x78], r15
mov qword [r11 - 0x80], rax
lea rax, [r11 - 0x48]
mov r14, rdx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov r13, rcx
mov dword [r11 - 0x48], r15d
mov dword [r11 + 0x20], r15d
mov dword [r11 - 0x44], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, r15d
je 0x100057032
xor eax, eax
jmp 0x1000571dd
xor eax, eax
or r8, 0xffffffffffffffff
mov rdi, r14
mov rcx, r8
repne scasw ax, word [rdi]
mov eax, dword [rsp + 0xc8]
not rcx
dec rcx
cmp ecx, eax
mov dword [rsp + 0x64], ecx
cmova eax, ecx
inc dword [rsp + 0x60]
add eax, 5
mov ecx, eax
mov dword [rsp + 0xc8], eax
lea eax, [r8 + 3]
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.10007fa96
mov rbp, rax
cmp rax, r15
jne 0x10005708f
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10005702b
mov qword [rsp + 0x70], r15
mov esi, r15d
mov edx, dword [rsp + 0xc8]
lea r8, [0x100028ab8]
mov r9, r14
mov rcx, rbp
mov dword [rsp + 0x20], esi
call fcn.10003a080
lea rdx, [rsp + 0x70]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov rcx, r13
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r15d
jne 0x10005718c
cmp r12, r15
je 0x100057165
mov ecx, 0x208
call fcn.10007fa96
mov rbx, rax
cmp rax, r15
je 0x100057165
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x64]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x64], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r15d
jne 0x10005715d
cmp dword [rsp + 0x68], 1
jne 0x10005715d
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x10005715d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r15d
je 0x100057182
mov rcx, rbx
call fcn.10007faa2
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
mov qword [rsp + 0x70], r15
cmp esi, dword [rsp + 0x60]
ja 0x1000571d0
jmp 0x100057097
mov rcx, rbx
call fcn.10007faa2
jmp 0x1000571d0
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov rdx, rbp
mov rcx, r13
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x70]
cmp eax, r15d
cmovne rcx, r15
mov qword [rsp + 0x70], rcx
mov rcx, rbp
call fcn.10007faa2
mov rax, qword [rsp + 0x70]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100057204
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x80
and qword [rax - 0x50], 0
and qword [rax - 0x58], 0
and qword [rax - 0x60], 0
and qword [rax - 0x68], 0
and qword [rax - 0x70], 0
and qword [rax - 0x78], 0
and dword [rax - 0x44], 0
and dword [rax + 0x20], 0
and dword [rax - 0x48], 0
lea rax, [rax + 0x20]
mov r13, r8
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x64]
xor edx, edx
xor r8d, r8d
mov r12, rcx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x10005727a
xor eax, eax
jmp 0x1000573c5
xor eax, eax
or r15, 0xffffffffffffffff
lea rdi, [0x10002c718]
mov rcx, r15
repne scasw ax, word [rdi]
mov eax, dword [rsp + 0xc8]
not rcx
dec rcx
cmp ecx, eax
mov dword [rsp + 0x60], ecx
cmova eax, ecx
add eax, 5
mov ecx, eax
mov dword [rsp + 0xc8], eax
lea eax, [r15 + 3]
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.10007fa96
mov rsi, rax
test rax, rax
je 0x100057273
and qword [rsp + 0x70], 0
xor ebp, ebp
cmp dword [rsp + 0x64], ebp
jbe 0x1000573b8
mov edx, dword [rsp + 0xc8]
lea r9, [0x10002c718]
lea r8, [0x100028ab8]
mov rcx, rsi
mov dword [rsp + 0x20], ebp
call fcn.10003a080
lea rdx, [rsp + 0x70]
mov r9d, 3
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov rcx, r12
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000573ac
mov ecx, 0x208
call fcn.10007fa96
mov rbx, rax
test rax, rax
je 0x1000573a1
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100057399
cmp dword [rsp + 0x68], 1
jne 0x100057399
xor eax, eax
mov rcx, r15
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x100057399
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1000573e1
mov rcx, rbx
call fcn.10007faa2
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebp
cmp ebp, dword [rsp + 0x64]
jb 0x1000572dc
mov rcx, rsi
call fcn.10007faa2
xor esi, esi
mov rax, rsi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.10007faa2
jmp 0x1000573c2