joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100041314
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rsi, rdx
mov rcx, qword [0x1000dedd8]
lea r12, [0x1000dedd8]
cmp rcx, r12
je 0x100041356
test byte [rcx + 0x1c], 1
je 0x100041356
cmp byte [rcx + 0x19], 5
jb 0x100041356
mov rcx, qword [rcx + 0x10]
lea r8, [0x100008e80]
mov edx, 0x2a3
call fcn.100020584
mov rax, rsi
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80004003
jl 0x100041555
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetRectEmpty]
lea rax, [rsp + 0x30]
lea rdx, [0x10000b5e0]
xor edi, edi
mov r9d, 0x20019
xor r8d, r8d
and qword [rsp + 0x30], rdi
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000413ac
mov rdi, qword [rsp + 0x30]
cdqe
test rax, rax
je 0x1000413c6
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100041547
and dword [rsp + 0x78], 0
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
lea rdx, [0x10000b9c8]
mov ebp, 4
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x80], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004141d
mov eax, dword [rsp + 0x88]
sub eax, ebp
neg eax
sbb eax, eax
and eax, 0xd
cdqe
test rax, rax
jne 0x1000413b3
mov eax, dword [rsp + 0x78]
lea r9, [rsp + 0x88]
lea rdx, [0x10000b9d0]
mov dword [rsi + 4], eax
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x80], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100041478
mov eax, dword [rsp + 0x88]
sub eax, ebp
neg eax
sbb eax, eax
and eax, 0xd
cdqe
test rax, rax
jne 0x1000413b3
mov eax, dword [rsp + 0x78]
lea r9, [rsp + 0x88]
lea rdx, [0x10000b9e0]
mov dword [rsi], eax
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x80], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000414d6
mov eax, dword [rsp + 0x88]
sub eax, ebp
neg eax
sbb eax, eax
and eax, 0xd
cdqe
test rax, rax
jne 0x1000413b3
mov eax, dword [rsp + 0x78]
lea r9, [rsp + 0x88]
lea rdx, [0x10000b9f0]
mov dword [rsi + 0xc], eax
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x80], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100041535
mov eax, dword [rsp + 0x88]
sub eax, ebp
neg eax
sbb eax, eax
and eax, 0xd
cdqe
test rax, rax
jne 0x1000413b3
mov eax, dword [rsp + 0x78]
mov dword [rsi + 8], eax
test rdi, rdi
je 0x100041555
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x1000dedd8]
cmp rcx, r12
je 0x100041585
test byte [rcx + 0x1c], 1
je 0x100041585
cmp byte [rcx + 0x19], 5
jb 0x100041585
mov rcx, qword [rcx + 0x10]
lea r8, [0x100008e80]
mov edx, 0x2a4
mov r9d, ebx
call fcn.100020d8c
mov eax, ebx
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100041598
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov rsi, rdx
mov rcx, qword [0x1000dedd8]
lea r13, [0x1000dedd8]
cmp rcx, r13
je 0x1000415db
test byte [rcx + 0x1c], 1
je 0x1000415db
cmp byte [rcx + 0x19], 5
jb 0x1000415db
mov rcx, qword [rcx + 0x10]
lea r8, [0x100008e80]
mov edx, 0x2a5
call fcn.100020584
mov rax, rsi
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80004003
jl 0x10004176f
xor edi, edi
lea rax, [rsp + 0x90]
lea rdx, [0x10000b5e0]
and qword [rsp + 0x98], rdi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10004164c
mov rdi, qword [rsp + 0x98]
cdqe
test rax, rax
je 0x100041666
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100041761
mov eax, dword [rsi + 4]
mov r12d, 4
lea rdx, [0x10000b9c8]
mov dword [rsp + 0x88], eax
lea rax, [rsp + 0x88]
mov r9d, r12d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rcx, eax
test eax, eax
jne 0x100041753
mov eax, dword [rsi]
lea rdx, [0x10000b9d0]
mov r9d, r12d
mov dword [rsp + 0x88], eax
lea rax, [rsp + 0x88]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rcx, eax
test eax, eax
jne 0x100041753
mov eax, dword [rsi + 0xc]
lea rdx, [0x10000b9e0]
mov r9d, r12d
mov dword [rsp + 0x88], eax
lea rax, [rsp + 0x88]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rcx, eax
test eax, eax
jne 0x100041753
mov eax, dword [rsi + 8]
lea rdx, [0x10000b9f0]
mov r9d, r12d
mov dword [rsp + 0x88], eax
lea rax, [rsp + 0x88]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rcx, eax
test eax, eax
je 0x100041761
movzx ebx, cx
or ebx, 0x80070000
test eax, eax
cmovle ebx, ecx
test rdi, rdi
je 0x10004176f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x1000dedd8]
cmp rcx, r13
je 0x10004179f
test byte [rcx + 0x1c], 1
je 0x10004179f
cmp byte [rcx + 0x19], 5
jb 0x10004179f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100008e80]
mov edx, 0x2a6
mov r9d, ebx
call fcn.100020d8c
mov eax, ebx
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1000462f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x1000def00]
xor edx, edx
xor ebx, ebx
call fcn.1000cd234
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x1000463d6
test rbx, rbx
jne 0x1000463e2
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x1000463c5
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100046372
xor ebx, ebx
jmp 0x1000463c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x10004636e
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x1000463af
cmp rdi, r11
jae 0x10004636e
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x10004639d
cmp rdi, r11
jae 0x10004636e
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x1000463e4
lea rcx, [0x1000def00]
mov edx, ebp
call fcn.1000cd234
add ebp, r14d
mov rsi, rax
test rax, rax
jne 0x10004632f
xor esi, esi
test rsi, rsi
jne 0x1000463ed
xor eax, eax
jmp 0x1000463fb
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.1000461ec
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x100048758
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
and qword [rax - 0x18], 0
and qword [rax + 0x20], 0
xor ebx, ebx
mov eax, dword [0x1000e2c28]
test eax, eax
je 0x100048794
lea rcx, [0x10000c3b8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1000e2c28]
test eax, eax
jne 0x1000487a1
call fcn.1000454b0
test eax, eax
je 0x1000487bd
lea rdx, [rsp + 0x58]
mov rcx, qword [0x1000de160]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
test ebx, ebx
jne 0x1000487c5
xor eax, eax
jmp 0x100048810
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
test rax, rax
sete bl
test ebx, ebx
je 0x1000487f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1000487f4
xor esi, esi
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x10004880d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x10004c054
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0xf0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov edi, edx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
lea r12, [0x1000dedd8]
mov rcx, qword [0x1000dedd8]
cmp rcx, r12
je 0x10004c0c2
test byte [rcx + 0x1c], 1
je 0x10004c0c2
cmp byte [rcx + 0x19], 7
jb 0x10004c0c2
mov edx, 0x11
mov r9d, edi
lea r8, [0x100008e00]
mov rcx, qword [rcx + 0x10]
call fcn.100020d8c
mov qword [rsp + 0x48], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x50], 1
mov dword [rsi + 0x80], edi
and dword [rsi + 0x84], 0
cmp qword [rsi + 0x78], 0
je 0x10004c235
cmp qword [rsi + 0x38], 0
jne 0x10004c0f8
xor eax, eax
jmp 0x10004c121
xor eax, eax
cmp dword [rsi + 0x40], eax
jbe 0x10004c11f
mov rdx, qword [rsi + 0x30]
mov rcx, rdx
cmp qword [rcx], 0
jne 0x10004c119
inc eax
add rcx, 8
cmp eax, dword [rsi + 0x40]
jb 0x10004c106
jmp 0x10004c11f
mov rax, qword [rdx + rax*8]
jmp 0x10004c121
xor eax, eax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x10004c147
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x30]
call fcn.10004c944
mov rcx, qword [rax]
and dword [rcx], 0
cmp qword [rsp + 0x30], 0
jne 0x10004c12b
lea rcx, [0x100002430]
cmp qword [rsi + 0x78], 0
cmovne rcx, qword [rsi + 0x78]
mov r8d, 0x40
lea rdx, [rsp + 0x60]
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
jne 0x10004c186
mov ecx, 0x8007000e
call fcn.100046abc
mov edx, 0x10000
mov r8d, 1
mov rcx, rax
call fcn.1000a7fe8
mov qword [rsi + 0x28], rax
test rax, rax
je 0x10004c203
mov rcx, rax
call fcn.1000a89b4
test eax, eax
je 0x10004c1ed
mov edx, edi
mov rcx, rsi
call fcn.10004bb7c
mov edi, eax
test eax, eax
js 0x10004c217
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x10004be48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x10004c217
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10004c217
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x10004c217
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
jmp 0x10004c23a
mov edi, 0x80004005
mov rcx, qword [0x1000dedd8]
cmp rcx, r12
je 0x10004c26b
test byte [rcx + 0x1c], 1
je 0x10004c26b
cmp byte [rcx + 0x19], 7
jb 0x10004c26b
mov edx, 0x12
mov r9d, edi
lea r8, [0x100008e00]
mov rcx, qword [rcx + 0x10]
call fcn.100020d8c
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1000cd7d0
mov rbx, qword [rsp + 0x120]
add rsp, 0xf0
pop r12
pop rdi
pop rsi
ret
Function at 0x1000a74f4
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [0x1000e29b0], 1
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1000a7573
cmp dword [rsp + 0x24], 5
jb 0x1000a7553
cmp dword [rsp + 0x28], 1
jae 0x1000a755a
cmp dword [rsp + 0x24], 6
jb 0x1000a7573
mov eax, dword [0x1000de198]
cmp dword [rsp + 0x30], 2
mov ecx, 0x7f
cmove eax, ecx
mov dword [0x1000de198], eax
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1000cd7d0
add rsp, 0x150
pop rbx
ret

Function at 0x1000aa038
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rsi, r9
mov rdi, r8
mov dword [rax + 0x10], ebp
mov eax, dword [rsp + 0x70]
mov qword [rsp + 0x30], rbp
add eax, eax
mov dword [rsp + 0x70], eax
cmp rdx, rbp
je 0x1000aa18d
cmp word [rdx], bp
je 0x1000aa18d
cmp r8, rbp
je 0x1000aa16d
cmp word [r8], bp
je 0x1000aa16d
cmp r9, rbp
jne 0x1000aa0b9
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aa1bb
test byte [rcx + 0x1c], 1
je 0x1000aa1bb
lea edx, [rbp + 0xc]
jmp 0x1000aa1ab
mov eax, dword [0x1000e2a08]
neg eax
lea rax, [rsp + 0x30]
sbb r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
and r9d, 0x100
add r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000aa159
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000aa159
mov r8d, dword [rsp + 0x58]
cmp r8d, 1
je 0x1000aa159
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
mov ebx, 0xd
cmp rcx, rax
je 0x1000aa159
test byte [rcx + 0x1c], 1
je 0x1000aa159
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x100002ff8]
mov edx, ebx
mov r9, rdi
call fcn.100020b88
mov rcx, qword [rsp + 0x30]
cmp rcx, rbp
je 0x1000aa169
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000aa1c0
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aa1bb
test byte [rcx + 0x1c], 1
je 0x1000aa1bb
mov edx, 0xb
jmp 0x1000aa1ab
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aa1bb
test byte [rcx + 0x1c], 1
je 0x1000aa1bb
mov edx, 0xa
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
call fcn.100020584
mov eax, 0x57
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1000aa1dc
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
sub rsp, 0x50
xor r12d, r12d
mov rsi, r9
mov r10, rcx
mov qword [rax + 0x10], r12
cmp r9, r12
je 0x1000aa3a6
cmp word [r9], r12w
je 0x1000aa3a6
mov rdi, qword [rsp + 0x90]
cmp rdi, r12
je 0x1000aa386
cmp word [rdi], r12w
je 0x1000aa386
mov ebp, 0x7fffffff
mov rcx, rdi
mov rax, rbp
cmp word [rcx], r12w
je 0x1000aa249
add rcx, 2
sub rax, 1
jne 0x1000aa239
cmp rax, r12
je 0x1000aa339
sub rbp, rax
mov eax, dword [0x1000e2a08]
mov qword [rsp + 0x40], r12
neg eax
lea rax, [rsp + 0x78]
lea rdx, [0x10001a510]
sbb ecx, ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r8
and ecx, 0x100
xor r9d, r9d
xor r8d, r8d
add ecx, 0x20006
mov dword [rsp + 0x28], ecx
mov rcx, r10
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
cmp eax, r12d
je 0x1000aa2eb
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000aa372
test byte [rcx + 0x1c], 1
je 0x1000aa372
mov edx, 0x12
lea r9, [0x10001a510]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
mov dword [rsp + 0x20], eax
call fcn.100020b88
jmp 0x1000aa372
mov rcx, qword [rsp + 0x78]
lea eax, [rbp + rbp + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp eax, r12d
je 0x1000aa372
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000aa372
test byte [rcx + 0x1c], 1
je 0x1000aa372
mov edx, 0x13
mov r9, rdi
jmp 0x1000aa2d2
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000aa36d
test byte [rcx + 0x1c], 1
je 0x1000aa36d
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
mov edx, 0x11
mov r9d, 0x80070057
call fcn.100020d8c
mov ebx, 0x57
mov rcx, qword [rsp + 0x78]
cmp rcx, r12
je 0x1000aa382
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000aa3d9
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000aa3d4
test byte [rcx + 0x1c], 1
je 0x1000aa3d4
mov edx, 0x10
jmp 0x1000aa3c4
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000aa3d4
test byte [rcx + 0x1c], 1
je 0x1000aa3d4
mov edx, 0xf
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
call fcn.100020584
mov eax, 0x57
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1000aa3f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rsi, r9
mov rdi, r8
mov dword [rax + 0x10], ebp
mov dword [rax - 0x18], 4
mov qword [rax - 0x10], rbp
cmp rdx, rbp
je 0x1000aa549
cmp word [rdx], bp
je 0x1000aa549
cmp r8, rbp
je 0x1000aa529
cmp word [r8], bp
je 0x1000aa529
cmp r9, rbp
jne 0x1000aa471
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aa577
test byte [rcx + 0x1c], 1
je 0x1000aa577
lea edx, [rbp + 0x16]
jmp 0x1000aa567
mov eax, dword [0x1000e2a08]
neg eax
lea rax, [rsp + 0x38]
sbb r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
and r9d, 0x100
add r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000aa515
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 2
je 0x1000aa515
mov r8d, dword [rsp + 0x58]
cmp r8d, 4
je 0x1000aa515
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aa510
test byte [rcx + 0x1c], 1
je 0x1000aa510
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x100002ff8]
mov edx, 0x17
mov r9, rdi
call fcn.100020b88
mov ebx, 0xd
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x1000aa525
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000aa57c
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aa577
test byte [rcx + 0x1c], 1
je 0x1000aa577
mov edx, 0x15
jmp 0x1000aa567
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aa577
test byte [rcx + 0x1c], 1
je 0x1000aa577
mov edx, 0x14
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
call fcn.100020584
mov eax, 0x57
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1000aa598
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rbx, r9
mov rsi, rdx
mov r10, rcx
mov qword [r11 + 0x10], rbp
cmp rdx, rbp
je 0x1000aa6dc
cmp word [rdx], bp
je 0x1000aa6dc
cmp rbx, rbp
je 0x1000aa6bc
cmp word [r9], bp
je 0x1000aa6bc
mov eax, dword [0x1000e2a08]
mov qword [r11 - 0x18], rbp
neg eax
lea rax, [r11 + 0x10]
sbb ecx, ecx
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rbp
and ecx, 0x100
xor r9d, r9d
xor r8d, r8d
add ecx, 0x20006
mov dword [rsp + 0x28], ecx
mov rcx, r10
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp eax, ebp
je 0x1000aa644
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000aa6a8
test byte [rcx + 0x1c], 1
je 0x1000aa6a8
lea edx, [rbp + 0x1a]
mov r9, rsi
jmp 0x1000aa694
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x80]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp eax, ebp
je 0x1000aa6a8
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000aa6a8
test byte [rcx + 0x1c], 1
je 0x1000aa6a8
mov edx, 0x1b
mov r9, rbx
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
mov dword [rsp + 0x20], eax
call fcn.100020b88
mov rcx, qword [rsp + 0x68]
cmp rcx, rbp
je 0x1000aa6b8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1000aa70f
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000aa70a
test byte [rcx + 0x1c], 1
je 0x1000aa70a
mov edx, 0x19
jmp 0x1000aa6fa
mov rcx, qword [0x1000dedd8]
lea rdx, [0x1000dedd8]
cmp rcx, rdx
je 0x1000aa70a
test byte [rcx + 0x1c], 1
je 0x1000aa70a
mov edx, 0x18
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
call fcn.100020584
mov eax, 0x57
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1000aa72c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rsi, r9
mov rdi, r8
mov dword [rax + 0x10], ebp
mov dword [rax - 0x18], 8
mov qword [rax - 0x10], rbp
cmp rdx, rbp
je 0x1000aa880
cmp word [rdx], bp
je 0x1000aa880
cmp r8, rbp
je 0x1000aa860
cmp word [r8], bp
je 0x1000aa860
cmp r9, rbp
jne 0x1000aa7a9
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aa8ae
test byte [rcx + 0x1c], 1
je 0x1000aa8ae
lea edx, [rbp + 0x1e]
jmp 0x1000aa89e
mov eax, dword [0x1000e2a08]
neg eax
lea rax, [rsp + 0x38]
sbb r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
and r9d, 0x100
add r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000aa84c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000aa84c
mov r8d, dword [rsp + 0x58]
cmp r8d, 0xb
je 0x1000aa84c
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aa847
test byte [rcx + 0x1c], 1
je 0x1000aa847
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x100002ff8]
mov edx, 0x1f
mov r9, rdi
call fcn.100020b88
mov ebx, 0xd
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x1000aa85c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000aa8b3
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aa8ae
test byte [rcx + 0x1c], 1
je 0x1000aa8ae
mov edx, 0x1d
jmp 0x1000aa89e
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000aa8ae
test byte [rcx + 0x1c], 1
je 0x1000aa8ae
mov edx, 0x1c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ff8]
call fcn.100020584
mov eax, 0x57
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret