joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003446c
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.10001fee0
nop
lea rcx, [rsp + 0x88]
call fcn.10001fee0
nop
mov rcx, rbx
call fcn.100032ac0
xor esi, esi
cmp al, sil
jne 0x1000344f3
lea ecx, [rsi + 0x7b]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
lea rcx, [rsp + 0x88]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x20]
call fcn.10001fba0
nop
mov rcx, rbx
call fcn.10001fba0
nop
mov rcx, rdi
call fcn.10001fba0
xor eax, eax
jmp 0x10003473e
mov rcx, rdi
call fcn.100032ae8
cmp al, sil
jne 0x100034531
lea rcx, [rsp + 0x88]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x20]
call fcn.10001fba0
nop
mov rcx, rbx
call fcn.10001fba0
nop
mov rcx, rdi
call fcn.10001fba0
xor eax, eax
jmp 0x10003473e
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.100033d14
cmp eax, esi
jne 0x100034573
lea rcx, [rsp + 0x88]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x20]
call fcn.10001fba0
nop
mov rcx, rbx
call fcn.10001fba0
nop
mov rcx, rdi
call fcn.10001fba0
xor eax, eax
jmp 0x10003473e
mov dx, 0x2e
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, rsi
je 0x100034712
mov rcx, qword [rbx]
sub rax, rcx
sar rax, 1
cmp eax, 0xffffffff
je 0x100034712
mov r8d, dword [rcx - 0x10]
sub r8d, eax
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.100035e7c
nop
mov rdx, qword [rsp + 0x28]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.10001fa30
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1000327cc
cmp al, sil
jne 0x100034619
lea rcx, [rsp + 0x28]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x88]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x20]
call fcn.10001fba0
nop
mov rcx, rbx
call fcn.10001fba0
nop
mov rcx, rdi
call fcn.10001fba0
xor eax, eax
jmp 0x10003473e
lea rcx, [rsp + 0x88]
call fcn.100032ac0
cmp al, sil
jne 0x1000346c3
mov rcx, qword [rsp + 0x88]
call fcn.100068ed8
cmp eax, esi
je 0x10003467c
lea rcx, [rsp + 0x28]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x88]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x20]
call fcn.10001fba0
nop
mov rcx, rbx
call fcn.10001fba0
nop
mov rcx, rdi
call fcn.10001fba0
xor eax, eax
jmp 0x10003473e
xor r8d, r8d
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, esi
jne 0x1000346c3
lea rcx, [rsp + 0x28]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x88]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x20]
call fcn.10001fba0
nop
mov rcx, rbx
call fcn.10001fba0
nop
jmp 0x100034706
lea rdx, [rsp + 0x88]
mov rcx, rbp
call fcn.10001ecdc
nop
lea rcx, [rsp + 0x28]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x88]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x20]
call fcn.10001fba0
nop
mov rcx, rbx
call fcn.10001fba0
nop
mov esi, 1
mov rcx, rdi
call fcn.10001fba0
mov eax, esi
jmp 0x10003473e
lea rcx, [rsp + 0x88]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x20]
call fcn.10001fba0
nop
mov rcx, rbx
call fcn.10001fba0
nop
mov rcx, rdi
call fcn.10001fba0
xor eax, eax
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100034c6c
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbp, rcx
test rcx, rcx
jne 0x100034c8e
lea eax, [rcx + 0x57]
jmp 0x100034de6
lea rcx, [rsp + 0x60]
call fcn.10001fee0
nop
mov rbx, qword [rsp + 0x60]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edi, 0x105
sub eax, edi
or eax, ecx
jge 0x100034cc5
mov edx, edi
lea rcx, [rsp + 0x60]
call fcn.10001fc6c
mov rbx, qword [rsp + 0x60]
cmp dword [rbx - 0xc], edi
jl 0x100034ddb
mov dword [rbx - 0x10], edi
mov word [rbx + 0x20a], 0
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movsxd rsi, eax
cmp esi, dword [rbx - 0x10]
jbe 0x100034d72
xor eax, eax
lea rcx, [rax - 1]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x100034d67
cmp ecx, dword [rbx - 0xc]
jg 0x100034d67
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x100034d3b
mov edx, esi
lea rcx, [rsp + 0x60]
call fcn.10001fc6c
mov rbx, qword [rsp + 0x60]
test esi, esi
js 0x100034d5c
cmp esi, dword [rbx - 0xc]
jg 0x100034d5c
mov dword [rbx - 0x10], esi
mov word [rbx + rsi*2], 0
mov rdx, rbx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
jmp 0x100034d72
mov ecx, 0x80070057
call fcn.10001fd10
int3
mov ecx, 0x80070057
call fcn.10001fd10
int3
xor eax, eax
lea rcx, [rax - 1]
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x100034dd0
cmp ecx, dword [rbx - 0xc]
jg 0x100034dd0
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
test esi, esi
jne 0x100034db4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rcx, [rsp + 0x60]
call fcn.10001fba0
mov eax, edi
jmp 0x100034de6
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.10001ecdc
nop
lea rcx, [rsp + 0x60]
call fcn.10001fba0
xor eax, eax
jmp 0x100034de6
mov ecx, 0x80070057
call fcn.10001fd10
int3
mov ecx, 0x80070057
call fcn.10001fd10
nop
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x100034ffc
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x48
mov rax, qword [0x100082138]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r8d, 6
lea rdx, [rsp + 0x28]
lea rcx, [0x10000ba40]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x100035058
cmp eax, 6
ja 0x100035058
cmp word [rsp + 0x28], 0x31
je 0x10003503c
xor eax, eax
jmp 0x10003505a
mov dword [rsp + 0x20], 0
movzx eax, byte [0x7ffe02d4]
mov dword [rsp + 0x20], eax
jmp 0x100035056
jmp 0x10003505a
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.10006b1f0
add rsp, 0x48
ret
Function at 0x1000359b0
Capabilities:
Delete registry key

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rdi, rcx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x68]
call fcn.10001fee0
nop
mov rax, qword [rdi]
cmp dword [rax - 0x10], ebx
jne 0x1000359e2
jmp 0x100035a9a
lea rdx, [0x10000ba80]
lea rcx, [rsp + 0x70]
call fcn.10001ff98
nop
lea r8, [rsp + 0x68]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1000327cc
nop
lea rcx, [rsp + 0x70]
call fcn.10001fba0
lea r11, [rsp + 0x60]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x100035a95
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x20], r11
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [0x10000ba80]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x100035a9a
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, 1
cmp eax, ebx
cmove ebx, ecx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100035a9a
mov ebx, 1
lea rcx, [rsp + 0x68]
call fcn.10001fba0
mov eax, ebx
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x10004545c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x60], 4
call fcn.100046600
xor ebx, ebx
cmp eax, ebx
jne 0x100045481
xor eax, eax
jmp 0x1000454ae
mov rcx, qword [rdi + 0x20]
lea rax, [rsp + 0x60]
lea rdx, [0x100005df0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
sete bl
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x10004584c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x30
cmp edx, 4
mov rbp, r8
mov r12, rcx
jne 0x10004586b
lea rdi, [0x10000e068]
jmp 0x100045897
cmp edx, 9
jne 0x100045879
lea rdi, [0x10000e438]
jmp 0x100045897
cmp edx, 0xa
jne 0x100045887
lea rdi, [0x10000c010]
jmp 0x100045897
cmp edx, 8
jne 0x10004592e
lea rdi, [0x10000e460]
call fcn.100046600
xor ebx, ebx
cmp eax, ebx
je 0x10004592e
mov rcx, qword [r12 + 0x20]
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x68], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10004592e
mov eax, dword [rsp + 0x68]
cmp eax, 1
jbe 0x10004592e
add eax, 4
mov ecx, eax
mov dword [rsp + 0x68], eax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
cmp rax, rbx
mov rsi, rax
je 0x10004592e
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rcx, qword [r12 + 0x20]
lea r11, [rsp + 0x68]
mov qword [rsp + 0x28], r11
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x10004593b
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
xor eax, eax
add rsp, 0x30
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, rsi
mov rcx, rbp
call fcn.100044e08
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
cmp qword [rbp + 0x10], rbx
setne bl
mov eax, ebx
jmp 0x100045930

Function at 0x100045960
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
call fcn.100046600
test eax, eax
jne 0x10004597e
xor eax, eax
jmp 0x1000459ea
mov rcx, qword [rsi + 0x20]
lea rdx, [0x10000e498]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004597a
mov ecx, dword [rdi]
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
test rax, rax
mov qword [rbx], rax
je 0x10004597a
mov rcx, qword [rsi + 0x20]
lea rdx, [0x10000e498]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000459e5
mov rcx, qword [rbx]
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
jmp 0x10004597a
mov eax, 1
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1000459f8
Capabilities:
Copy file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
cmp dword [rcx + 0x28], 0
jne 0x100045a35
mov rcx, rdx
call fcn.10001fba0
nop
mov esi, 0x10a
jmp 0x100045b30
lea rcx, [rsp + 0x60]
call fcn.10001fee0
nop
mov rax, qword [rdi]
cmp dword [rax - 0x10], 0
je 0x100045b5c
mov rax, qword [rbp]
cmp dword [rax - 0x10], 0
je 0x100045b5c
mov rcx, rdi
call fcn.100032ac0
test al, al
jne 0x100045a85
lea rcx, [rsp + 0x60]
call fcn.10001fba0
nop
mov rcx, rdi
call fcn.10001fba0
nop
mov esi, 2
jmp 0x100045b30
lea rcx, [rbx + 0x10]
lea r8, [rsp + 0x60]
mov rdx, rbp
call fcn.1000327cc
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.100068ed8
mov esi, eax
test eax, eax
je 0x100045abf
lea rcx, [rsp + 0x60]
call fcn.10001fba0
nop
mov rcx, rdi
call fcn.10001fba0
nop
jmp 0x100045b30
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100045b3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 5
jne 0x100045b1c
lea edx, [rax + 0x7b]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100045b3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rcx, [rsp + 0x60]
call fcn.10001fba0
nop
mov rcx, rdi
call fcn.10001fba0
nop
jmp 0x100045b30
lea rcx, [rsp + 0x60]
call fcn.10001fba0
nop
mov rcx, rdi
call fcn.10001fba0
nop
mov rcx, rbp
call fcn.10001fba0
mov eax, esi
jmp 0x100045b7d
lea rcx, [rsp + 0x60]
call fcn.10001fba0
nop
mov rcx, rdi
call fcn.10001fba0
nop
mov rcx, rbp
call fcn.10001fba0
xor eax, eax
jmp 0x100045b7d
lea rcx, [rsp + 0x60]
call fcn.10001fba0
nop
mov rcx, rdi
call fcn.10001fba0
nop
mov rcx, rbp
call fcn.10001fba0
mov eax, 0x57
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100046018
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov r11, rsp
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov edi, edx
mov r12, rcx
lea rax, [r11 + 0x40]
mov qword [r11 + 0x48], rax
lea rdx, [0x100005df0]
lea rcx, [r11 + 0x40]
call fcn.10001ff98
mov rbp, rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x78], edi
mov rcx, r12
call fcn.100046600
xor ebx, ebx
cmp eax, ebx
jne 0x100046073
mov rcx, rbp
call fcn.10001fba0
jmp 0x100046123
mov rdx, qword [rbp]
xor eax, eax
lea rdi, [0x100005df0]
mov rsi, rdx
lea ecx, [rax + 5]
repe cmpsw word [rsi], word [rdi]
je 0x100046090
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
jne 0x1000460c5
xor eax, eax
lea rdi, [0x10000e4b0]
mov rsi, rdx
lea ecx, [rax + 0x15]
repe cmpsw word [rsi], word [rdi]
je 0x1000460b2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
jne 0x1000460c5
mov rcx, rbp
call fcn.10001fba0
jmp 0x100046123
lea rax, [rdx - 0x18]
cmp dword [rax + 0x10], 1
jle 0x1000460e2
mov edx, dword [rax + 8]
mov rcx, rbp
call fcn.10001fbd0
mov rax, qword [rbp]
sub rax, 0x18
add dword [rax + 0x10], 0xffffffff
jne 0x1000460ef
mov dword [rax + 0x10], 0xffffffff
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rbp]
mov rcx, qword [r12 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
sete bl
mov rcx, rbp
call fcn.10001fba0
mov eax, ebx
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100046178
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, r8
mov r12, rdx
mov r13, rcx
call fcn.100046600
xor ebx, ebx
cmp eax, ebx
jne 0x1000461c3
mov rcx, r12
call fcn.10001fba0
nop
mov rcx, rbp
call fcn.10001fba0
xor eax, eax
jmp 0x1000463bd
xor eax, eax
lea rdi, [0x100005558]
mov rsi, qword [r12]
lea ecx, [rax + 4]
repe cmpsw word [rsi], word [rdi]
je 0x1000461dd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
je 0x10004624c
lea rcx, [rsp + 0x98]
call fcn.10001fee0
nop
lea rcx, [r13 + 0x10]
lea r8, [rsp + 0x98]
mov rdx, rbp
call fcn.1000327cc
lea rcx, [rsp + 0x98]
call fcn.100032ac0
cmp al, bl
jne 0x10004623f
lea rcx, [rsp + 0x98]
call fcn.10001fba0
nop
mov rcx, r12
call fcn.10001fba0
nop
mov rcx, rbp
call fcn.10001fba0
xor eax, eax
jmp 0x1000463bd
lea rcx, [rsp + 0x98]
call fcn.10001fba0
xor eax, eax
lea rdi, [0x100005558]
mov rsi, qword [r12]
lea ecx, [rax + 4]
repe cmpsw word [rsi], word [rdi]
je 0x100046266
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
jne 0x10004631e
xor eax, eax
lea rdi, [0x10000e3d0]
mov rsi, qword [r12]
lea edx, [rax + 0xc]
mov rcx, rdx
repe cmpsw word [rsi], word [rdi]
je 0x100046290
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
jne 0x10004631e
xor eax, eax
lea rdi, [0x10000e3e8]
mov rsi, qword [r12]
lea ecx, [rax + 0x11]
repe cmpsw word [rsi], word [rdi]
je 0x1000462b7
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
jne 0x10004631e
xor eax, eax
lea rdi, [0x10000bb08]
mov rsi, qword [r12]
mov rcx, rdx
repe cmpsw word [rsi], word [rdi]
je 0x1000462da
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
jne 0x10004631e
xor eax, eax
lea rdi, [0x10000e410]
mov rsi, qword [r12]
lea ecx, [rax + 0x12]
repe cmpsw word [rsi], word [rdi]
je 0x1000462fd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
jne 0x10004631e
mov rcx, r12
call fcn.10001fba0
nop
mov rcx, rbp
call fcn.10001fba0
xor eax, eax
jmp 0x1000463bd
mov rax, qword [rbp]
mov esi, dword [rax - 0x10]
add rax, 0xffffffffffffffe8
cmp dword [rax + 0x10], 1
jle 0x100046342
mov edx, dword [rax + 8]
mov rcx, rbp
call fcn.10001fbd0
mov rax, qword [rbp]
sub rax, 0x18
add dword [rax + 0x10], 0xffffffff
jne 0x10004634f
mov dword [rax + 0x10], 0xffffffff
mov rdi, qword [rbp]
mov rax, qword [r12]
sub rax, 0x18
cmp dword [rax + 0x10], 1
jle 0x100046374
mov edx, dword [rax + 8]
mov rcx, r12
call fcn.10001fbd0
mov rax, qword [r12]
sub rax, 0x18
add dword [rax + 0x10], 0xffffffff
jne 0x100046381
mov dword [rax + 0x10], 0xffffffff
lea eax, [rsi + rsi + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
sete bl
mov rcx, r12
call fcn.10001fba0
nop
mov rcx, rbp
call fcn.10001fba0
mov eax, ebx
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10004643c
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov r12, r8
mov rbp, rdx
mov r13, rcx
call fcn.100046600
xor ebx, ebx
cmp eax, ebx
jne 0x10004646f
jmp 0x1000465b7
mov rdx, qword [rbp]
xor eax, eax
lea rdi, [0x10000e068]
mov rsi, rdx
lea ecx, [rax + 9]
repe cmpsw word [rsi], word [rdi]
je 0x10004648c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
jne 0x1000464ff
xor eax, eax
lea rdi, [0x10000e438]
mov rsi, rdx
lea ecx, [rax + 0x13]
repe cmpsw word [rsi], word [rdi]
je 0x1000464ae
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
jne 0x1000464ff
xor eax, eax
lea rdi, [0x10000c010]
mov rsi, rdx
lea ecx, [rax + 0x17]
repe cmpsw word [rsi], word [rdi]
je 0x1000464d0
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
jne 0x1000464ff
xor eax, eax
lea rdi, [0x10000e460]
mov rsi, rdx
lea ecx, [rax + 0x19]
repe cmpsw word [rsi], word [rdi]
je 0x1000464f2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
je 0x1000465b7
cmp qword [r12 + 0x10], rbx
jne 0x100046530
cmp dword [rdx - 8], 1
jle 0x100046517
mov edx, dword [rdx - 0x10]
mov rcx, rbp
call fcn.10001fbd0
mov rdx, qword [rbp]
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov ebx, 1
jmp 0x1000465b7
mov dword [rsp + 0x98], ebx
lea rdx, [rsp + 0x98]
mov rcx, r12
call fcn.100034e1c
mov rsi, rax
cmp rax, rbx
je 0x1000465b7
mov rcx, qword [rbp]
sub rcx, 0x18
cmp dword [rcx + 0x10], 1
jle 0x100046570
mov edx, dword [rcx + 8]
mov rcx, rbp
call fcn.10001fbd0
mov rcx, qword [rbp]
sub rcx, 0x18
add dword [rcx + 0x10], 0xffffffff
jne 0x10004657d
mov dword [rcx + 0x10], 0xffffffff
mov eax, dword [rsp + 0x98]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rbp]
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
cmp edi, ebx
sete bl
jmp 0x1000465b7
mov rcx, rbp
call fcn.10001fba0
mov eax, ebx
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10004713c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rbp, r8
mov rsi, rdx
mov r12, rcx
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x58]
call fcn.10001fee0
nop
lea rdx, [0x10000e550]
lea rcx, [rsp + 0x60]
call fcn.10001ff98
nop
lea r8, [rsp + 0x58]
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.1000327cc
test al, al
sete bl
lea rcx, [rsp + 0x60]
call fcn.10001fba0
test bl, bl
je 0x1000471b7
mov ebx, 0x65b
jmp 0x1000472d6
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x1000472d6
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x100047248
cmp eax, 2
jne 0x1000472d6
mov ebx, 0x490
jmp 0x1000472d6
mov eax, dword [rsp + 0xb8]
add eax, 4
mov dword [rsp + 0xb8], eax
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x100047273
lea ebx, [rax + 8]
jmp 0x1000472c8
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1000472c8
mov eax, dword [rsp + 0xb8]
shr rax, 1
mov word [rdi + rax*2 - 4], bx
mov eax, dword [rsp + 0xb8]
shr rax, 1
mov word [rdi + rax*2 - 2], bx
mov rdx, rdi
mov rcx, rbp
call fcn.100044e08
test rdi, rdi
je 0x1000472d6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1000472e7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x58]
call fcn.10001fba0
nop
mov rcx, r12
call fcn.10001fba0
nop
mov rcx, rsi
call fcn.10001fba0
mov eax, ebx
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10004739c
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rsi, r8
mov rbp, rdx
mov r12, rcx
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x58]
call fcn.10001fee0
nop
xor edi, edi
lea rdx, [0x10000e550]
lea rcx, [rsp + 0xb8]
call fcn.10001ff98
nop
lea r8, [rsp + 0x58]
mov rdx, r12
lea rcx, [rsp + 0xb8]
call fcn.1000327cc
test al, al
sete bl
lea rcx, [rsp + 0xb8]
call fcn.10001fba0
test bl, bl
je 0x100047422
mov ebx, 0x65b
jmp 0x1000474e6
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x1000474e6
cmp qword [rsi + 0x10], 0
jbe 0x1000474c2
lea rdx, [rsp + 0xb8]
mov rcx, rsi
call fcn.100034e1c
mov rdi, rax
test rax, rax
jne 0x100047490
lea ebx, [rax + 8]
jmp 0x1000474d9
mov eax, dword [rsp + 0xb8]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rbp]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x1000474d9
jmp 0x1000474d7
mov rdx, qword [rbp]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
test eax, eax
jne 0x1000474e6
xor ebx, ebx
test rdi, rdi
je 0x1000474e6
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1000474f7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x58]
call fcn.10001fba0
nop
mov rcx, r12
call fcn.10001fba0
nop
mov rcx, rbp
call fcn.10001fba0
mov eax, ebx
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret