joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140204c14
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
lea ecx, [rdx + 0x28]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140204c94
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov ecx, eax
call qword [0x14039e550]
nop dword [rax + rax]
and dword [rbx + 0x10], 0
lea rcx, [0x140204cc0]
xor r9d, r9d
mov qword [rbx], rax
mov r8d, 0x2000
mov qword [rbx + 8], rdi
mov rdx, rbx
call qword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
nop dword [rax + rax]
test eax, eax
jne 0x140204ca8
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_EndTask]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140205764
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbp, rdx
xor edx, edx
mov r8d, 0xf0001
xor ecx, ecx
call qword [0x14039e568]
nop dword [rax + rax]
xor ebx, ebx
test rax, rax
je 0x14020580c
mov rcx, rax
call qword [0x14039e548]
nop dword [rax + rax]
mov edx, edi
lea ecx, [rbx + 0x40]
mov esi, edi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14020580c
mov r8d, esi
mov rdx, rbp
mov rcx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
xor r9d, r9d
lea rcx, [0x140200960]
mov r8d, 0x2008
mov rdx, rdi
call qword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
nop dword [rax + rax]
test eax, eax
je 0x1402057fd
mov ebx, 1
jmp 0x14020580c
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140205d78
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 8], rcx
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
xor edi, edi
mov dword [rbp - 0x19], Ordinal_109
xorps xmm0, xmm0
mov dword [rbp - 0x15], 0x4100000
lea eax, [r8 - 1]
mov qword [rbp - 0x11], rdi
movsxd rcx, eax
mov rbx, rdx
mov qword [rbp - 9], rcx
lea rdx, [rbp + 0x67]
mov qword [rbp + 0x27], rcx
xor ecx, ecx
mov qword [rbp - 1], rdi
mov qword [rbp + 7], rdi
mov qword [rbp + 0xf], 0xa
movdqa xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x2f], rdi
mov qword [rbp + 0x37], rdi
movups xmmword [rbp + 0x3f], xmm0
mov qword [rbp + 0x67], rdi
call qword [sym.imp.api_ms_win_core_sidebyside_l1_1_0.dll_ActivateActCtx]
nop dword [rax + rax]
lea ecx, [rdi + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
nop dword [rax + rax]
test ax, ax
jns 0x140205e0c
bts dword [rbp - 0x15], 0x1c
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
nop dword [rax + rax]
test ax, ax
jns 0x140205e27
bts dword [rbp - 0x15], 0x1e
mov rax, qword [rbx]
lea rdx, [rbp - 0x19]
mov rcx, rbx
mov rax, qword [rax + 0x20]
call qword [case.0x14006c37f.0]
mov rdx, qword [rbp + 0x67]
mov ebx, eax
test rdx, rdx
je 0x140205e54
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_sidebyside_l1_1_0.dll_DeactivateActCtx]
nop dword [rax + rax]
lea r11, [rsp + 0x90]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x1402066a8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov rbp, rcx
mov rcx, qword [rcx + 0xc0]
mov r14d, r8d
mov edx, dword [rcx + 0x58]
and edx, 4
or edx, 0x432
shr edx, 1
call fcn.1401a6c3c
mov ecx, 0x30
call fcn.140037114
xor ebx, ebx
mov qword [rsp + 0x40], rax
mov rdi, rax
test rax, rax
je 0x140206705
mov qword [rax], rbx
mov qword [rax + 0x28], rbx
jmp 0x140206708
mov rdi, rbx
test rdi, rdi
je 0x1402067ce
mov rdx, rdi
mov rcx, rbp
call fcn.1402043b8
mov rdx, qword [rbp + 0xc0]
mov esi, eax
test byte [rdx + 0x58], 4
je 0x14020674a
mov rdx, qword [rdx + 0x160]
test rdx, rdx
je 0x14020674a
lea r8, [rdi + 0x28]
call fcn.140204a48
test al, al
mov ecx, 0x80004005
cmovne esi, ecx
test esi, esi
js 0x1402067a3
mov rax, qword [0x14037b638]
xor r9d, r9d
mov qword [rdi + 8], rax
mov r8d, 0x2001
mov rax, qword [0x14037b640]
mov rdx, rdi
mov qword [rdi + 0x10], rax
mov dword [rdi + 0x18], r14d
mov rax, qword [rbp + 0xc0]
mov ecx, dword [rax + 0x58]
mov dword [rdi + 0x1c], ecx
lea rcx, [0x140201710]
mov qword [rdi + 0x20], r15
call qword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
nop dword [rax + rax]
test eax, eax
je 0x1402067a3
mov ebx, 1
jmp 0x1402067ce
cmp qword [rdi], rbx
je 0x1402067bd
mov rcx, qword [rdi]
lea rdx, [0x1401b1f70]
xor r8d, r8d
call fcn.1400633f4
mov qword [rdi], rbx
lea rcx, [rdi + 0x28]
call fcn.14000fb38
mov rcx, rdi
call fcn.1401fdc3c
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140222b20
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
mov rcx, qword [rcx + 0x48]
mov esi, 1
lea edx, [rsi - 0x15]
call qword [0x14039e658]
nop dword [rax + rax]
mov edx, dword [rdi + reloc.SHELL32.dll_SHChangeNotification_Lock]
mov ecx, ebx
mov r9d, eax
mov eax, dword [rdi + 0x2ac]
neg eax
sbb r8d, r8d
xor eax, eax
and r8d, 2
and r9d, 0x400000
setne al
or r8d, eax
call fcn.140208ff8
cmp eax, 0x24
jg 0x140222c3a
je 0x140222c33
cmp eax, 9
je 0x140222c1a
cmp eax, 0xd
je 0x140222bc8
cmp eax, 0xf
jle 0x140222c63
cmp eax, 0x12
jle 0x140222c6d
cmp eax, 0x1b
je 0x140222c82
cmp eax, 0x20
je 0x140222bc8
cmp eax, 0x23
jne 0x140222c63
lea edx, [rsi + 2]
jmp 0x140222c94
mov r8d, dword [rdi + 0x23c]
lea rbx, [rdi + 0x10]
mov eax, 0x55555556
mov rcx, rbx
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub r8d, eax
cmp r8d, esi
jne 0x140222c04
call fcn.14021d9a0
mov edx, eax
mov rcx, rbx
call fcn.14021dff0
jmp 0x140222c9c
call fcn.14021d9a0
mov edx, eax
lea rcx, [rbx - 0x10]
call fcn.140225cb0
lea rcx, [rbx - 0x10]
jmp 0x140222c85
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetKeyState]
nop dword [rax + rax]
movzx edx, ax
shr edx, 0xf
jmp 0x140222c94
mov edx, 2
jmp 0x140222c94
cmp eax, 0x26
jle 0x140222c92
cmp eax, 0x27
je 0x140222c8e
cmp eax, 0x28
je 0x140222c71
cmp eax, 0x5d
je 0x140222c6d
cmp eax, 0x9f
jle 0x140222c63
cmp eax, 0xa5
jle 0x140222c6d
cmp eax, 0xff
je 0x140222c6d
mov rcx, rdi
call fcn.140221a78
jmp 0x140222c9c
xor esi, esi
jmp 0x140222c9c
mov edx, 4
mov rcx, rdi
call fcn.140224398
test eax, eax
jns 0x140222c9c
mov rcx, rdi
mov edx, esi
call fcn.14005c6d4
jmp 0x140222c9c
xor edx, edx
jmp 0x140222c94
mov edx, esi
mov rcx, rdi
call fcn.140224398
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140224e44
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp qword [0x14037bde8], rbx
jne 0x140224ec8
mov r8, qword [0x14037b618]
lea rdx, [0x1402263c0]
xor r9d, r9d
lea ecx, [rbx + 0xd]
call qword [0x14039e5d8]
nop dword [rax + rax]
lea ecx, [rbx + 0x5b]
mov qword [0x14037bde8], rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
nop dword [rax + rax]
test ax, ax
js 0x140224ec8
lea ecx, [rbx + 0x5c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
nop dword [rax + rax]
test ax, ax
js 0x140224ec8
call fcn.1402267c8
mov rcx, qword [0x14037bde8]
test rcx, rcx
je 0x140224ec8
call qword [case.0x14004551b.4]
nop dword [rax + rax]
mov qword [0x14037bde8], rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14022fc88
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rbp - 0x10], rax
test byte [0x14037dc80], 1
mov r15d, r9d
mov edi, r8d
mov ebx, edx
mov rsi, rcx
je 0x14022fcde
lea rax, [rbp - 0x20]
mov r9d, 1
lea rdx, [0x140327448]
mov qword [rsp + 0x20], rax
lea rcx, [0x1403787c0]
call fcn.1400429a0
or dword [rbp - 0x28], 0xffffffff
cmp dword [rsi + 0x248], 1
jne 0x14022fcf3
mov rcx, rsi
call fcn.14022d7f0
xor r12d, r12d
mov qword [rbp - 0x30], r12
test r15d, r15d
je 0x14022fd88
mov rdi, qword [rsi + 0x118]
mov ebx, dword [rsi + 0x120]
mov eax, ebx
test rdi, rdi
jne 0x14022fd48
mov rax, qword [rsi + 0xd8]
test rax, rax
je 0x14022fd27
mov ecx, dword [rax]
jmp 0x14022fd2a
mov ecx, r12d
test ecx, ecx
jle 0x14022fe9d
mov rax, qword [rax + 8]
mov ebx, r12d
mov rdi, qword [rax]
mov eax, r12d
test rdi, rdi
je 0x14022fe9d
cmp eax, 0xfffffffe
jl 0x14022fdbb
mov rax, qword [rdi]
lea r8, [rbp - 0x20]
mov edx, ebx
mov rcx, rdi
mov rax, qword [rax + 0x78]
call qword [case.0x14006c37f.0]
mov eax, dword [rbp - 0x18]
mov ecx, 2
sub eax, dword [rbp - 0x20]
cdq
idiv ecx
add eax, dword [rbp - 0x20]
mov dword [rbp - 0x30], eax
mov eax, dword [rbp - 0x14]
sub eax, dword [rbp - 0x1c]
cdq
idiv ecx
add eax, dword [rbp - 0x1c]
mov dword [rbp - 0x2c], eax
jmp 0x14022fdbb
mov rcx, qword [rsi + 8]
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], ebx
mov dword [rbp - 0x2c], edi
call qword [0x14039e640]
nop dword [rax + rax]
xor r9d, r9d
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x30]
mov rcx, rsi
call fcn.14000752c
mov ebx, dword [rbp - 0x28]
mov rdi, rax
test rdi, rdi
je 0x14022fe9d
cmp ebx, 0xffffffff
je 0x14022fe9d
mov rcx, qword [rdi]
mov r14, r12
mov rax, qword [rcx + 0x20]
mov rcx, rdi
call qword [case.0x14006c37f.0]
cmp eax, 1
jne 0x14022fe01
test ebx, ebx
js 0x14022fe01
mov rax, qword [rdi]
mov edx, ebx
mov rcx, rdi
mov rax, qword [rax + 0x178]
call qword [case.0x14006c37f.0]
mov r14, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetKeyState]
nop dword [rax + rax]
test ax, ax
jns 0x14022fe5b
mov rcx, qword [rsi + 8]
lea rdx, [rbp - 0x30]
call qword [0x14039e718]
nop dword [rax + rax]
mov rcx, qword [rdi]
mov rax, qword [rcx + 0x30]
mov rcx, rdi
call qword [case.0x14006c37f.0]
mov r8, qword [rsi + 8]
lea rcx, [rsi + 0x30]
mov rdx, qword [rbp - 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.14022b4d0
jmp 0x14022fe9d
cmp rdi, qword [rsi + 0x4f8]
jne 0x14022fe75
cmp rdi, qword [rsi + 0x128]
jne 0x14022fe9d
cmp dword [rsi + 0x130], ebx
je 0x14022fe9d
mov rax, qword [rdi]
test r15d, r15d
mov rcx, rdi
setne bl
mov rax, qword [rax + 0x30]
call qword [case.0x14006c37f.0]
lea rcx, [rsi + 0x28]
mov r9b, bl
mov rdx, rax
mov r8, r14
call fcn.14022c610
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400a2260
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1402409d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rdi
sub rsp, 0x50
movaps xmm0, xmmword [rcx]
mov rdi, rdx
and qword [rax + 0x10], 0
lea rcx, [rax + 0x10]
mov dword [rdx], Shell_MergeMenus
xor edx, edx
movdqa xmmword [rax - 0x18], xmm0
mov dword [rax + 8], 4
call fcn.14006ee3c
lea r9, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.14024127c
mov ebx, eax
test eax, eax
js 0x140240a67
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r8, str.EnrollmentType
mov qword [rsp + 0x28], rdi
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
and qword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x140240a65
jle 0x140240a67
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140240a67
xor ebx, ebx
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140240a7d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1402413c0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rdx
mov dword [rsp + 0x30], Shell_MergeMenus
xor r14d, r14d
mov ebx, r14d
mov qword [rsp + 0x38], rbx
mov qword [rbp - 0x79], r14
lea rcx, [rdx + 0x1c]
mov word [rbp - 0x19], r14w
mov word [rbp - 0x69], r14w
lea r8d, [r14 + 0x27]
lea rdx, [rbp - 0x69]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
nop dword [rax + rax]
cmp eax, 0x27
je 0x140241433
mov edi, 0x8000ffff
jmp 0x1402414e3
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x69]
call fcn.1402405ac
mov edi, eax
test eax, eax
js 0x1402414e3
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x79]
mov r8d, 0x20006
lea rdx, [rbp - 0x19]
mov rcx, 0xffffffff80000002
call fcn.1402410ec
mov edi, eax
test eax, eax
js 0x1402414e3
mov rdx, qword [rbp - 0x79]
lea rcx, [rsp + 0x38]
call fcn.14006ee3c
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov rax, qword [rax + 0x38]
call qword [case.0x14006c37f.0]
mov edi, eax
mov rbx, qword [rsp + 0x38]
test eax, eax
js 0x1402414e3
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.EnrollmentState
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x1402414e3
jg 0x1402414da
mov edi, eax
jmp 0x1402414e3
movzx edi, ax
or edi, 0x80070000
test rbx, rbx
je 0x1402414f7
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400a2260
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140241530
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r11, r8
mov rdi, rdx
mov rsi, rcx
test r8, r8
jne 0x140241551
xor eax, eax
jmp 0x1402415c1
lea r8, [rsp + 0x50]
mov edx, 0xfffffffe
mov rcx, r11
call fcn.140241348
mov ebx, eax
test eax, eax
js 0x1402415bf
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 2]
cmp rcx, rax
jb 0x1402415ba
mov eax, 0xffffffff
cmp rcx, rax
ja 0x1402415ba
mov dword [rsp + 0x28], ecx
xor ebx, ebx
xor r8d, r8d
mov qword [rsp + 0x20], r11
mov rdx, rdi
mov rcx, rsi
lea r9d, [rbx + 1]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x1402415bf
jg 0x1402415af
mov ebx, eax
jmp 0x1402415bf
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1402415bf
mov ebx, 0x80070216
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1402415d8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rsp + 0x68], 0
lea rax, [r11 + 0x20]
mov qword [r11 - 0x18], rax
mov rsi, r8
and qword [r11 - 0x20], 0
mov rdi, rdx
and qword [r11 - 0x28], 0
mov r8, rdx
mov r9d, 2
xor edx, edx
mov rbp, rcx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x14024163a
jle 0x1402416e3
movzx eax, ax
or eax, 0x80070000
jmp 0x1402416e3
mov ebx, dword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140241670
mov edi, 0x8007000e
jmp 0x1402416bc
lea rax, [rsp + 0x68]
mov r9d, 2
mov qword [rsp + 0x30], rax
mov r8, rdi
mov qword [rsp + 0x28], rbx
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x1402416b2
jle 0x1402416bc
movzx edi, ax
or edi, 0x80070000
jmp 0x1402416bc
mov rax, rbx
xor ebx, ebx
xor edi, edi
mov qword [rsi], rax
test rbx, rbx
je 0x1402416e1
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140242368
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x10], rdx
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x10]
mov rsi, r8
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
and qword [r11 - 0x18], 0
lea rdx, str.LastSoapErrorTraceId
xor r8d, r8d
mov rdi, rcx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140242420
cmp dword [rsp + 0x58], 1
je 0x1402423bb
mov eax, 0x80070057
jmp 0x14024242a
mov ebx, dword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov qword [rsi], rax
test rax, rax
jne 0x1402423f1
mov eax, 0x8007000e
jmp 0x14024242a
lea rcx, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x58]
mov rcx, rdi
mov qword [rsp + 0x20], rax
lea rdx, str.LastSoapErrorTraceId
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jle 0x14024242a
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140242b0c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rsi, [rcx + 0x2ec]
mov dword [rsp + 0x40], 0x208
mov r10, r8
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea r8, str.DMPCertThumbPrint
mov rax, rdx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov rcx, rax
mov qword [rsp + 0x20], rbx
mov rdx, r10
lea edi, [rbx + 2]
mov r9d, edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x140242b85
lea r8, [0x1402ff860]
jmp 0x140242b8f
lea r8, [rsp + 0x50]
mov edi, 0x208
mov r9, rdi
mov edx, 0x208
mov rcx, rsi
call fcn.140243494
test eax, eax
mov ecx, 0x8007007a
cmovne ebx, ecx
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400a2260
add rsp, 0x270
pop rdi
pop rsi
pop rbx
ret
Function at 0x140242bd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor edi, edi
lea rax, [r11 + 0x20]
mov r14, r8
mov qword [r11 - 0x28], rax
mov r15, rdx
mov qword [r11 - 0x30], rdi
mov rbp, rcx
mov dword [rsp + 0x78], edi
lea r9d, [rdi + 2]
mov qword [r11 - 0x38], rdi
lea r8, str.DiscoveryServiceFullURL
mov rdx, r14
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
cmp eax, 2
jne 0x140242c30
xor eax, eax
jmp 0x140242cff
test eax, eax
je 0x140242c45
jg 0x140242c3d
mov edi, eax
jmp 0x140242cfd
movzx edi, ax
jmp 0x140242cf7
mov ebx, dword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x140242c7b
mov edi, 0x8007000e
jmp 0x140242cfd
lea rax, [rsp + 0x78]
mov r9d, 2
mov qword [rsp + 0x30], rax
lea r8, str.DiscoveryServiceFullURL
mov qword [rsp + 0x28], rsi
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov r14, qword [rbp + 0x718]
mov ebx, eax
mov qword [rbp + 0x718], rdi
test r14, r14
je 0x140242ce3
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov qword [rbp + 0x718], rsi
test ebx, ebx
je 0x140242cfd
jg 0x140242cf4
mov edi, ebx
jmp 0x140242cfd
movzx edi, bx
or edi, 0x80070000
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x140242d20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rsi, [rcx + 0x4f4]
mov dword [rsp + 0x40], 0x208
mov r10, r8
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea r8, str.IntermediateCertThumbPrint
mov rax, rdx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov rcx, rax
mov qword [rsp + 0x20], rbx
mov rdx, r10
lea edi, [rbx + 2]
mov r9d, edi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
je 0x140242d99
lea r8, [0x1402ff860]
jmp 0x140242da3
lea r8, [rsp + 0x50]
mov edi, 0x208
mov r9, rdi
mov edx, 0x208
mov rcx, rsi
call fcn.140243494
test eax, eax
mov ecx, 0x8007007a
cmovne ebx, ecx
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400a2260
add rsp, 0x270
pop rdi
pop rsi
pop rbx
ret