joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e65b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x50
and dword [rax + 0x10], 0
and dword [rax + 0x18], 0
and qword [rax - 0x30], 0
mov dword [rax + 0x20], 4
mov rcx, qword [0x100153eb8]
lea r12, [0x100153eb8]
mov ebx, 1
lea r15, [0x10001dc38]
cmp rcx, r12
je 0x1000e6605
test byte [rcx + 0x1c], bl
je 0x1000e6605
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x6a]
mov r8, r15
call fcn.100034784
xor edi, edi
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x40]
and qword [rsp + 0x40], rdi
and dword [rsp + 0x80], edi
xor ecx, ecx
call sub.NETAPI32.dll_NetGetJoinInformation
mov esi, eax
mov rcx, qword [0x100153eb8]
cmp rcx, r12
je 0x1000e666f
test byte [rcx + 0x1c], 2
je 0x1000e666f
cmp byte [rcx + 0x19], 4
jb 0x1000e666f
mov eax, dword [rsp + 0x80]
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x6c]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov r9d, esi
mov r8, r15
mov qword [rsp + 0x20], rax
call fcn.1000e3dc8
mov rcx, qword [0x100153eb8]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1000e6688
mov rcx, rax
call sub.NETAPI32.dll_NetApiBufferFree
mov rcx, qword [0x100153eb8]
test esi, esi
jne 0x1000e66e5
cmp dword [rsp + 0x80], 3
jne 0x1000e66c1
cmp rcx, r12
je 0x1000e66bd
test byte [rcx + 0x1c], 2
je 0x1000e66bd
cmp byte [rcx + 0x19], 4
jb 0x1000e66bd
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x6d]
mov r8, r15
call fcn.100034784
mov rcx, qword [0x100153eb8]
mov edi, ebx
jmp 0x1000e6711
cmp rcx, r12
je 0x1000e6739
test byte [rcx + 0x1c], 2
je 0x1000e6711
cmp byte [rcx + 0x19], 4
jb 0x1000e6711
mov rcx, qword [rcx + 0x10]
mov edx, 0x6e
mov r8, r15
call fcn.100034784
jmp 0x1000e670a
cmp rcx, r12
je 0x1000e6739
test byte [rcx + 0x1c], 2
je 0x1000e6711
cmp byte [rcx + 0x19], 2
jb 0x1000e6711
mov rcx, qword [rcx + 0x10]
mov edx, 0x6f
mov r9d, esi
mov r8, r15
call fcn.100036510
mov rcx, qword [0x100153eb8]
cmp rcx, r12
je 0x1000e6735
test byte [rcx + 0x1c], bl
je 0x1000e6735
cmp byte [rcx + 0x19], 5
jb 0x1000e6735
mov rcx, qword [rcx + 0x10]
mov edx, 0x70
mov r9d, edi
mov r8, r15
call fcn.100036510
test edi, edi
jne 0x1000e673b
xor ebx, ebx
lea rax, [rsp + 0x48]
lea rdx, [0x1000265b0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000e67d6
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x98]
lea r8, [0x100026600]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
lea rdx, [0x100026620]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov r9d, 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1000e67c6
cmp dword [rsp + 0x88], 4
jne 0x1000e67c6
xor ebx, ebx
cmp dword [rsp + 0x90], ebx
sete bl
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1000e67d6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x50
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1000e67ec
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebp, ebp
mov rbx, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov edi, eax
cmp eax, ebp
jne 0x1000e697a
mov edi, ebp
cmp rcx, rbp
je 0x1000e6863
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov rcx, qword [rsp + 0x60]
cmp edi, ebp
mov qword [rsp + 0x48], rcx
jmp 0x1000e6889
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1000e67ec
mov rcx, qword [rsp + 0x48]
mov edi, eax
cmp eax, ebp
jne 0x1000e697a
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebp
je 0x1000e6871
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x1000e68db
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
cmp qword [rbx + 8], rbp
jne 0x1000e6933
cmp qword [rbx + 0x10], rbp
jne 0x1000e6933
lea rcx, [0x100026670]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, rbp
je 0x1000e690e
lea rdx, [0x1000266c8]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rbx + 8], rax
jmp 0x1000e6933
lea rcx, [0x1000266d8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, rbp
je 0x1000e6933
lea rdx, [0x1000266f8]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rbx + 0x10], rax
mov rax, qword [rbx + 8]
cmp rax, rbp
je 0x1000e694c
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call rax
jmp 0x1000e6964
mov rax, qword [rbx + 0x10]
cmp rax, rbp
je 0x1000e695f
mov rcx, qword [rbx]
mov rdx, rsi
call rax
jmp 0x1000e6964
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rsp + 0x48]
mov ebx, eax
cmp rcx, rbp
je 0x1000e6976
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000e6987
cmp rcx, rbp
je 0x1000e6985
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.10011be80
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000e6b34
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rbp, rdx
mov rsi, rcx
mov rcx, qword [0x100153eb8]
lea r14, [0x100153eb8]
mov r12d, 5
lea r13, [0x10001dc28]
cmp rcx, r14
je 0x1000e6b9a
test byte [rcx + 0x1c], 1
je 0x1000e6b9a
cmp byte [rcx + 0x19], r12b
jb 0x1000e6b9a
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 5]
mov r9, rsi
mov r8, r13
mov qword [rax - 0x68], rbp
call fcn.100065da4
mov r15d, 0x80
xor edx, edx
mov rcx, rbp
mov r8, r15
xor ebx, ebx
call sub.msvcrt.dll_memset
and qword [rsp + 0xa0], rbx
lea r8d, [rbx + 0x2c]
lea rcx, [rsp + 0x34]
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], 4
mov rcx, qword [0x100153eb8]
lea edi, [rbx + 2]
cmp rcx, r14
je 0x1000e6bfc
test byte [rcx + 0x1c], dil
je 0x1000e6bfc
cmp byte [rcx + 0x19], r12b
jb 0x1000e6bfc
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xb]
mov r9, rsi
mov r8, r13
call fcn.1000347a8
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
mov r11d, eax
test eax, eax
je 0x1000e6c7f
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x1000e6d06
test byte [rcx + 0x1c], dil
je 0x1000e6d06
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, edi
cmovns eax, r12d
cmp edx, eax
jl 0x1000e6d06
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
mov r9d, ebx
mov r8, r13
mov dword [rsp + 0x20], r11d
call fcn.10003be4c
jmp 0x1000e6d06
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x10]
cmp r9, r15
jbe 0x1000e6cc5
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x1000e6cbe
test byte [rcx + 0x1c], dil
je 0x1000e6cbe
cmp byte [rcx + 0x19], dil
jb 0x1000e6cbe
mov rcx, qword [rcx + 0x10]
mov edx, 0xd
mov r8, r13
mov qword [rsp + 0x20], r15
call fcn.1000e69b0
mov ebx, 0x80004005
jmp 0x1000e6d06
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x1000e6cee
test byte [rcx + 0x1c], dil
je 0x1000e6cee
cmp byte [rcx + 0x19], r12b
jb 0x1000e6cee
mov rcx, qword [rcx + 0x10]
mov edx, 0xe
mov r8, r13
call fcn.100034834
mov rdx, qword [rsp + 0xa0]
mov rcx, rbp
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x1000e6d5a
test byte [rcx + 0x1c], 1
je 0x1000e6d5a
movzx eax, byte [rcx + 0x19]
test ebx, ebx
cmovns edi, r12d
cmp eax, edi
jl 0x1000e6d5a
test ebx, ebx
js 0x1000e6d3e
movzx eax, word [rbp]
jmp 0x1000e6d41
or eax, 0xffffffff
mov rcx, qword [rcx + 0x10]
mov edx, 0xf
mov r9d, ebx
mov r8, r13
mov word [rsp + 0x20], ax
call fcn.10006c3ac
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1000e6d80
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x460
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r12, r8
mov ebp, edx
mov rsi, rcx
mov rax, qword [0x100153eb8]
lea rdx, [0x100153eb8]
mov ecx, 5
cmp rax, rdx
je 0x1000e6df1
test byte [rax + 0x1c], 1
je 0x1000e6df1
cmp byte [rax + 0x19], cl
jb 0x1000e6df1
lea edx, [rcx + 0xb]
mov rcx, qword [rax + 0x10]
lea r8, [0x10001dc28]
mov r9, rsi
mov dword [rsp + 0x20], ebp
call fcn.100058720
mov rax, qword [0x100153eb8]
xor edi, edi
lea ebx, [rdi + 2]
lea r14d, [rdi + 0x17]
cmp bx, word [rsi]
je 0x1000e6e0f
cmp r14w, word [rsi]
je 0x1000e6e0f
mov edi, 0x80070057
jmp 0x1000e6ee5
mov dword [rsp + 0x30], ebx
and dword [rsp + 0x28], edi
and qword [rsp + 0x20], rdi
lea r8, [rsp + 0x40]
mov r9d, 0x401
mov edx, 0x80
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x1000e6e99
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
movzx edi, ax
mov r9d, eax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
mov rax, qword [0x100153eb8]
lea rsi, [0x100153eb8]
cmp rax, rsi
je 0x1000e6f2a
test byte [rax + 0x1c], bl
je 0x1000e6eec
cmp byte [rax + 0x19], bl
jb 0x1000e6eec
mov rcx, qword [rax + 0x10]
lea r8, [0x10001dc28]
mov edx, 0x11
call fcn.100036510
mov rax, qword [0x100153eb8]
jmp 0x1000e6eec
test ebp, ebp
je 0x1000e6ed1
cmp r14w, word [rsi]
jne 0x1000e6ed1
lea rcx, [rsp + 0x40]
mov edx, 0x25
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
je 0x1000e6ebb
mov byte [rax], dil
lea r8, [rsp + 0x40]
lea rdx, [0x100026708]
mov rcx, r12
call fcn.100039dd4
jmp 0x1000e6ede
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.100069910
mov rax, qword [0x100153eb8]
lea rsi, [0x100153eb8]
cmp rax, rsi
je 0x1000e6f2a
test byte [rax + 0x1c], 1
je 0x1000e6f2a
movzx ecx, byte [rax + 0x19]
test edi, edi
mov edx, 5
cmovns ebx, edx
cmp ecx, ebx
jl 0x1000e6f2a
mov rcx, qword [r12]
lea r8, [0x10001dc28]
mov edx, 0x12
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + 0x10]
mov r9d, edi
call fcn.10003ba64
mov eax, edi
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.10011be80
mov rbx, qword [rsp + 0x498]
add rsp, 0x460
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000e78a4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
mov rcx, qword [0x100153eb8]
lea rbp, [0x100153eb8]
mov ebx, 1
cmp rcx, rbp
je 0x1000e78dd
test byte [rcx + 0x1c], bl
je 0x1000e78dd
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x1d]
lea r8, [0x10001dc28]
call fcn.100034784
lea rax, [rsp + 0x78]
lea rdx, [0x100026a00]
xor esi, esi
and qword [rsp + 0x78], rsi
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000e7990
mov rsi, qword [rsp + 0x78]
and dword [rsp + 0x60], edi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
lea rdx, [0x100026a60]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000e7990
cmp dword [rsp + 0x70], 4
jne 0x1000e7990
test eax, eax
jne 0x1000e7990
cmp dword [rsp + 0x60], ebx
jne 0x1000e7990
mov edi, ebx
mov rcx, qword [0x100153eb8]
cmp rcx, rbp
je 0x1000e79c5
test byte [rcx + 0x1c], 2
je 0x1000e7997
cmp byte [rcx + 0x19], 3
jb 0x1000e7997
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x1f]
lea r8, [0x10001dc28]
call fcn.100034784
mov rcx, qword [0x100153eb8]
cmp rcx, rbp
je 0x1000e79c5
test byte [rcx + 0x1c], bl
je 0x1000e79c5
cmp byte [rcx + 0x19], 5
jb 0x1000e79c5
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
test edi, edi
lea r8, [0x10001dc28]
mov edx, 0x20
sete r9b
call fcn.100036510
xor ebx, ebx
test edi, edi
sete bl
test rsi, rsi
je 0x1000e79da
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1000ebf88
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r14
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r12, r9
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
lea r14, [0x100153eb8]
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x1000ebff0
test byte [rcx + 0x1c], 1
je 0x1000ebff0
cmp byte [rcx + 0x19], 5
jb 0x1000ebff0
mov edx, 0x55
mov qword [rax - 0x58], r8
mov r9, rdi
lea r8, [0x10001dc18]
mov rcx, qword [rcx + 0x10]
call fcn.10003b3bc
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.100035db8
nop
lea rcx, [rsp + 0x38]
call fcn.1000699ec
mov r8, qword [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov rcx, rbp
call fcn.1000eec38
mov ebx, eax
test eax, eax
jne 0x1000ec0c4
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1000ec07e
cmp dword [rsp + 0x34], 4
je 0x1000ec07c
lea ebx, [rax + 0xd]
mov r10, qword [0x100153eb8]
jmp 0x1000ec0ee
xor ebx, ebx
cmp ebx, 2
jne 0x1000ec0e7
mov ebx, 0x490
mov r10, qword [0x100153eb8]
cmp r10, r14
je 0x1000ec128
test byte [r10 + 0x1c], 2
je 0x1000ec0ee
cmp byte [r10 + 0x19], 4
jb 0x1000ec0ee
mov edx, 0x56
lea r8, [0x10001dc18]
mov rcx, qword [r10 + 0x10]
call fcn.100034784
mov r10, qword [0x100153eb8]
jmp 0x1000ec0ee
cmp eax, 2
jne 0x1000ec0e7
mov rax, qword [rbp]
mov r9, r12
mov r8, rsi
mov rdx, rdi
mov rcx, rbp
call qword [rax + 0x38]
mov ebx, eax
mov r10, qword [0x100153eb8]
jmp 0x1000ec0ee
mov r10, qword [0x100153eb8]
cmp r10, r14
je 0x1000ec128
test byte [r10 + 0x1c], 1
je 0x1000ec128
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1000ec128
mov edx, 0x57
mov r9d, ebx
lea r8, [0x10001dc18]
mov rcx, qword [r10 + 0x10]
call fcn.100036510
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000ec149
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1000ec159
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x1000ed53c
Capabilities:
Delete registry value

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea r12, [0x100153eb8]
lea rbp, [0x10001dc18]
mov rcx, qword [0x100153eb8]
cmp rcx, r12
je 0x1000ed5a0
test byte [rcx + 0x1c], 1
je 0x1000ed5a0
cmp byte [rcx + 0x19], 5
jb 0x1000ed5a0
mov edx, 0x7a
mov qword [rsp + 0x20], r8
mov r9, rbx
mov r8, rbp
mov rcx, qword [rcx + 0x10]
call fcn.10003b3bc
and qword [rsp + 0x38], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.100035db8
nop
lea rcx, [rsp + 0x88]
call fcn.1000699ec
mov r8, qword [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1000edb20
mov ebx, eax
mov esi, 2
mov r10, qword [0x100153eb8]
cmp r10, r12
je 0x1000ed61e
test byte [r10 + 0x1c], sil
je 0x1000ed61e
cmp byte [r10 + 0x19], 4
jb 0x1000ed61e
lea edx, [rsi + 0x79]
mov r9d, eax
mov r8, rbp
mov rcx, qword [r10 + 0x10]
call fcn.100036510
mov r10, qword [0x100153eb8]
test ebx, ebx
jne 0x1000ed6a7
mov rdx, rdi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
mov r10, qword [0x100153eb8]
cmp r10, r12
je 0x1000ed66e
test byte [r10 + 0x1c], sil
je 0x1000ed66e
cmp byte [r10 + 0x19], 4
jb 0x1000ed66e
mov edx, 0x7c
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8, rbp
mov rcx, qword [r10 + 0x10]
call fcn.10003b678
mov r10, qword [0x100153eb8]
cmp ebx, esi
jne 0x1000ed6da
mov ebx, 0x490
cmp r10, r12
je 0x1000ed710
test byte [r10 + 0x1c], sil
je 0x1000ed6da
cmp byte [r10 + 0x19], 4
jb 0x1000ed6da
mov edx, 0x7d
mov r8, rbp
mov rcx, qword [r10 + 0x10]
call fcn.100034784
mov r10, qword [0x100153eb8]
jmp 0x1000ed6da
cmp ebx, esi
jne 0x1000ed6da
mov ebx, 0x490
cmp r10, r12
je 0x1000ed710
test byte [r10 + 0x1c], sil
je 0x1000ed6da
cmp byte [r10 + 0x19], 4
jb 0x1000ed6da
mov edx, 0x7e
mov r8, rbp
mov rcx, qword [r10 + 0x10]
call fcn.100034784
mov r10, qword [0x100153eb8]
cmp r10, r12
je 0x1000ed710
test byte [r10 + 0x1c], 1
je 0x1000ed710
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1000ed710
mov edx, 0x7f
mov r9d, ebx
mov r8, rbp
mov rcx, qword [r10 + 0x10]
call fcn.100036510
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1000ed734
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1000ed744
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x1000f451c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rsi, r9
mov rdi, r8
mov dword [rax + 0x10], ebp
mov eax, dword [rsp + 0x70]
mov qword [rsp + 0x30], rbp
add eax, eax
mov dword [rsp + 0x70], eax
cmp rdx, rbp
je 0x1000f4671
cmp word [rdx], bp
je 0x1000f4671
cmp r8, rbp
je 0x1000f4651
cmp word [r8], bp
je 0x1000f4651
cmp r9, rbp
jne 0x1000f459d
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f469f
test byte [rcx + 0x1c], 1
je 0x1000f469f
lea edx, [rbp + 0xc]
jmp 0x1000f468f
mov eax, dword [0x100158a34]
neg eax
lea rax, [rsp + 0x30]
sbb r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
and r9d, 0x100
add r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000f463d
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000f463d
mov r8d, dword [rsp + 0x58]
cmp r8d, 1
je 0x1000f463d
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
mov ebx, 0xd
cmp rcx, rax
je 0x1000f463d
test byte [rcx + 0x1c], 1
je 0x1000f463d
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x10001dbe8]
mov edx, ebx
mov r9, rdi
call fcn.10003b678
mov rcx, qword [rsp + 0x30]
cmp rcx, rbp
je 0x1000f464d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000f46a4
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f469f
test byte [rcx + 0x1c], 1
je 0x1000f469f
mov edx, 0xb
jmp 0x1000f468f
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f469f
test byte [rcx + 0x1c], 1
je 0x1000f469f
mov edx, 0xa
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100034784
mov eax, 0x57
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1000f46c0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
sub rsp, 0x50
xor r12d, r12d
mov rsi, r9
mov r10, rcx
mov qword [rax + 0x10], r12
cmp r9, r12
je 0x1000f488a
cmp word [r9], r12w
je 0x1000f488a
mov rdi, qword [rsp + 0x90]
cmp rdi, r12
je 0x1000f486a
cmp word [rdi], r12w
je 0x1000f486a
mov ebp, 0x7fffffff
mov rcx, rdi
mov rax, rbp
cmp word [rcx], r12w
je 0x1000f472d
add rcx, 2
sub rax, 1
jne 0x1000f471d
cmp rax, r12
je 0x1000f481d
sub rbp, rax
mov eax, dword [0x100158a34]
mov qword [rsp + 0x40], r12
neg eax
lea rax, [rsp + 0x78]
lea rdx, [0x100026d38]
sbb ecx, ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r8
and ecx, 0x100
xor r9d, r9d
xor r8d, r8d
add ecx, 0x20006
mov dword [rsp + 0x28], ecx
mov rcx, r10
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
cmp eax, r12d
je 0x1000f47cf
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000f4856
test byte [rcx + 0x1c], 1
je 0x1000f4856
mov edx, 0x12
lea r9, [0x100026d38]
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
mov dword [rsp + 0x20], eax
call fcn.10003b678
jmp 0x1000f4856
mov rcx, qword [rsp + 0x78]
lea eax, [rbp + rbp + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp eax, r12d
je 0x1000f4856
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000f4856
test byte [rcx + 0x1c], 1
je 0x1000f4856
mov edx, 0x13
mov r9, rdi
jmp 0x1000f47b6
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000f4851
test byte [rcx + 0x1c], 1
je 0x1000f4851
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
mov edx, 0x11
mov r9d, 0x80070057
call fcn.100036510
mov ebx, 0x57
mov rcx, qword [rsp + 0x78]
cmp rcx, r12
je 0x1000f4866
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000f48bd
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000f48b8
test byte [rcx + 0x1c], 1
je 0x1000f48b8
mov edx, 0x10
jmp 0x1000f48a8
mov rcx, qword [0x100153eb8]
lea rdx, [0x100153eb8]
cmp rcx, rdx
je 0x1000f48b8
test byte [rcx + 0x1c], 1
je 0x1000f48b8
mov edx, 0xf
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100034784
mov eax, 0x57
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1000f48d8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rsi, r9
mov rdi, r8
mov dword [rax + 0x10], ebp
mov dword [rax - 0x18], 4
mov qword [rax - 0x10], rbp
cmp rdx, rbp
je 0x1000f4a2d
cmp word [rdx], bp
je 0x1000f4a2d
cmp r8, rbp
je 0x1000f4a0d
cmp word [r8], bp
je 0x1000f4a0d
cmp r9, rbp
jne 0x1000f4955
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f4a5b
test byte [rcx + 0x1c], 1
je 0x1000f4a5b
lea edx, [rbp + 0x16]
jmp 0x1000f4a4b
mov eax, dword [0x100158a34]
neg eax
lea rax, [rsp + 0x38]
sbb r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
and r9d, 0x100
add r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, ebp
jne 0x1000f49f9
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 2
je 0x1000f49f9
mov r8d, dword [rsp + 0x58]
cmp r8d, 4
je 0x1000f49f9
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f49f4
test byte [rcx + 0x1c], 1
je 0x1000f49f4
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x10001dbe8]
mov edx, 0x17
mov r9, rdi
call fcn.10003b678
mov ebx, 0xd
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x1000f4a09
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1000f4a60
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f4a5b
test byte [rcx + 0x1c], 1
je 0x1000f4a5b
mov edx, 0x15
jmp 0x1000f4a4b
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f4a5b
test byte [rcx + 0x1c], 1
je 0x1000f4a5b
mov edx, 0x14
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
call fcn.100034784
mov eax, 0x57
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret