joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002190
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x188
mov rax, qword [0x1400544f8]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x1400021ec
jmp 0x1400022b1
mov dword [rsp + 0x44], 0x104
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x1400022a6
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call fcn.140002190
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], 0x104
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [rsp + 0x40], eax
jmp 0x140002233
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140023060
add rsp, 0x188
ret

Function at 0x1400022d0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
je 0x140002314
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x140002314
mov eax, dword [rsp + 0x20]
and eax, 0xfffffffe
mov dword [rsp + 0x20], eax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add rsp, 0x38
ret
Function at 0x140002680
Capabilities:
Create process on windows
Resume thread
Write and execute a file
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xb48
mov rax, qword [0x1400544f8]
xor rax, rsp
mov qword [rsp + 0xb30], rax
mov qword [rsp + 0x198], 0
lea rax, [rsp + 0x58]
lea rcx, str.StopProc.bat
mov rdi, rax
mov rsi, rcx
mov ecx, 0xe
rep movsb byte [rdi], byte [rsi]
lea r8, str.TASKKILL__F__IM_t
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.140002d80
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x198], rax
cmp qword [rsp + 0x198], 0xffffffffffffffff
je 0x1400028ef
mov byte [rsp + 0x610], 0
lea rax, [rsp + 0x611]
mov rdi, rax
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xa20]
call fcn.140002d80
lea r8, str.RunDll32.exe__r_n
mov edx, 0x104
lea rcx, [rsp + 0xa20]
call fcn.140002350
lea r8, [0x14003c05c]
mov edx, 0x400
lea rcx, [rsp + 0x610]
call fcn.140002350
lea r9, [rsp + 0xa20]
lea r8, [rsp + 0x610]
mov edx, 0x400
lea rcx, [rsp + 0x210]
call fcn.1400023d0
lea rcx, [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xa10]
mov r8d, eax
lea rdx, [rsp + 0x210]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x1a0]
call fcn.1400241d0
mov dword [rsp + 0x1a0], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x180]
call fcn.1400241d0
mov dword [rsp + 0x1dc], 1
mov word [rsp + 0x1e0], 0
lea rax, [rsp + 0x180]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x40], rax
lea rax, [0x14003c060]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x44
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400028ef
mov edx, 0xfffffff1
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xb30]
xor rcx, rsp
call fcn.140023060
add rsp, 0xb48
pop rdi
pop rsi
ret
Function at 0x140003930
Capabilities:
Create thread
Hide graphical window

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x4b0
mov rax, qword [0x1400544f8]
xor rax, rsp
mov qword [rsp + 0x4a8], rax
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x41]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov byte [rsp + 0x390], 0
lea rax, [rsp + 0x391]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov byte [rsp + 0x280], 0
lea rax, [rsp + 0x281]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov r9d, 0x104
lea r8, [rsp + 0x160]
mov edx, VariantTimeToDosDateTime
mov rcx, qword [0x140056178]
call qword [sym.imp.USER32.dll_LoadStringA]
cmp dword [0x140056188], 0
je 0x140003ae9
lea rdx, [0x14003c300]
lea rcx, [rsp + 0x160]
call fcn.140005540
mov qword [rsp + 0x150], rax
cmp qword [rsp + 0x150], 0
je 0x140003ae9
lea rcx, [rsp + 0x160]
call fcn.1400245f0
mov qword [rsp + 0x4a0], rax
mov rcx, qword [rsp + 0x150]
call fcn.1400245f0
mov rcx, qword [rsp + 0x4a0]
sub rcx, rax
mov rax, rcx
mov r8, rax
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x390]
call fcn.140024470
lea rcx, [0x14003c310]
call fcn.1400245f0
mov rcx, qword [rsp + 0x150]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x150], rax
mov rcx, qword [rsp + 0x150]
call fcn.1400245f0
mov r8, rax
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x40]
call fcn.140024470
lea r8, [0x14003c320]
mov edx, 0x104
lea rcx, [rsp + 0x280]
call fcn.140002d80
lea r8, [rsp + 0x40]
mov edx, 0x104
lea rcx, [rsp + 0x280]
call fcn.140002350
lea r8, [rsp + 0x280]
mov edx, 0x104
lea rcx, [rsp + 0x390]
call fcn.140002350
lea r8, [rsp + 0x390]
mov edx, 0x104
lea rcx, [rsp + 0x160]
call fcn.140002d80
lea r8, [rsp + 0x160]
mov edx, 0x3ea
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov edx, 0x3e8
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 0xf4
mov edx, 1
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov edx, 1
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov edx, 2
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
lea rax, [rsp + 0x270]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x4c0]
lea r8, [fcn.140003be0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x4a8]
xor rcx, rsp
call fcn.140023060
add rsp, 0x4b0
pop rdi
ret
Function at 0x140004180
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x388
mov rax, qword [0x1400544f8]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x258], 0
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x30], 0x104
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x260]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rsp + 0x260]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r9, [rsp + 0x258]
mov r8d, 1
lea rdx, [rsp + 0x40]
xor ecx, ecx
call sub.NETAPI32.dll_NetUserGetInfo
mov dword [rsp + 0x250], eax
cmp dword [rsp + 0x250], 0
jne 0x140004241
mov rax, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x258]
mov ecx, dword [rcx + 0x14]
mov dword [rax], ecx
mov dword [rsp + 0x34], 1
jmp 0x140004249
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x258]
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [rsp + 0x34], 0
jne 0x140004280
mov ecx, 0x220
call fcn.1400042b0
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 1
jne 0x140004280
mov rax, qword [rsp + 0x390]
mov dword [rax], 2
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.140023060
add rsp, 0x388
ret
Function at 0x1400042b0
Capabilities:
Compare security identifiers

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xa8
mov rax, qword [0x1400544f8]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x90], 0
mov dword [rsp + 0x88], 0
mov byte [rsp + 0x78], 0
mov byte [rsp + 0x79], 0
mov byte [rsp + 0x7a], 0
mov byte [rsp + 0x7b], 0
mov byte [rsp + 0x7c], 0
mov byte [rsp + 0x7d], 5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140004329
jmp 0x1400044a7
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [rsp + 0x60]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
jne 0x140004386
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400044a7
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x60]
mov r8, qword [rsp + 0x80]
mov edx, 2
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400043bb
jmp 0x1400044a7
lea rax, [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0xb0]
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140004421
jmp 0x1400044a7
mov dword [rsp + 0x8c], 0
jmp 0x14000443f
mov eax, dword [rsp + 0x8c]
add eax, 1
mov dword [rsp + 0x8c], eax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
cmp dword [rsp + 0x8c], eax
jae 0x14000448b
mov eax, dword [rsp + 0x8c]
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rcx + rax + 8]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x140004489
mov dword [rsp + 0x88], 1
jmp 0x14000448b
jmp 0x14000442e
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x68], 0
je 0x1400044ba
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140023060
add rsp, 0xa8
ret
Function at 0x140004f50
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rsp + 0x28], eax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rsp + 0x24], eax
mov r8d, 1
mov edx, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor r9d, r9d
lea r8, [rsp + 0x20]
xor edx, edx
mov ecx, 0x2000
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x2001
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x140056190], eax
mov ecx, dword [rsp + 0x20]
call fcn.1400057f0
xor r9d, r9d
mov r8, rax
xor edx, edx
mov ecx, 0x2001
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
xor r8d, r8d
mov edx, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [0x140056190]
add rsp, 0x38
ret

Function at 0x140005800
Capabilities:
Set registry value

Disassembly:
mov word [rsp + 0x20], r9w
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov word [rsp + 0x30], 2
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000584b
xor eax, eax
jmp 0x14000589a
movzx eax, word [rsp + 0x30]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14000588a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x14000589a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x48
ret

Function at 0x1400058b0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov word [rsp + 0x30], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400058fa
xor eax, eax
jmp 0x140005949
movzx eax, word [rsp + 0x30]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140005939
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140005949
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x48
ret
Function at 0x140005960
Capabilities:
Set registry value

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov word [rsp + 0x38], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400059aa
xor eax, eax
jmp 0x1400059f9
movzx eax, word [rsp + 0x38]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1400059e9
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400059f9
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x48
ret

Function at 0x140005ba0
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140005c23
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.1400058b0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x140005c62
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x68]
jmp 0x140005c71
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret

Function at 0x140005d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140005dab
xor eax, eax
jmp 0x140005dfa
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x140005dea
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140005dfa
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x48
ret
Function at 0x14000c410
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov rax, qword [0x1400544f8]
xor rax, rsp
mov qword [rsp + 0x158], rax
cmp dword [rsp + 0x190], 2
jne 0x14000c451
mov eax, 1
jmp 0x14000c4ff
mov r9d, 0x104
lea r8, [rsp + 0x40]
mov edx, 0x17
mov rcx, qword [0x140056068]
call qword [sym.imp.USER32.dll_LoadStringA]
lea r8, [rsp + 0x40]
mov edx, 0x3e9
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
lea rax, [rsp + 0x150]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x3e8
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140023060
add rsp, 0x168
ret

Function at 0x14000c520
Capabilities:
Delete registry key

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x158
mov rax, qword [0x1400544f8]
xor rax, rsp
mov qword [rsp + 0x148], rax
cmp dword [rsp + 0x178], 2
jne 0x14000c55e
mov eax, 1
jmp 0x14000c5d9
mov r9d, 0x104
lea r8, [rsp + 0x30]
mov edx, 0x17
mov rcx, qword [0x140056068]
call qword [sym.imp.USER32.dll_LoadStringA]
lea r8, [rsp + 0x30]
mov edx, 0x3e9
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov rdx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [rsp + 0x140], eax
mov edx, 0x3e8
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.140023060
add rsp, 0x158
ret
Function at 0x14000c7c0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x278
mov rax, qword [0x1400544f8]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp dword [rsp + 0x2a0], 2
jne 0x14000c801
mov eax, 1
jmp 0x14000c8b8
mov r9d, 0x104
lea r8, [rsp + 0x30]
mov edx, 0x17
mov rcx, qword [0x140056068]
call qword [sym.imp.USER32.dll_LoadStringA]
lea r8, [rsp + 0x30]
mov edx, 0x3e9
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
mov byte [rsp + 0x150], 0
mov r8, qword [rsp + 0x290]
mov edx, 0x104
lea rcx, [rsp + 0x150]
call fcn.140002350
mov r8, qword [rsp + 0x298]
mov edx, 0x104
lea rcx, [rsp + 0x150]
call fcn.140002350
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov dword [rsp + 0x140], eax
mov edx, 0x3e8
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140023060
add rsp, 0x278
ret

Function at 0x14000cb40
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov rax, qword [0x1400544f8]
xor rax, rsp
mov qword [rsp + 0x288], rax
cmp dword [rsp + 0x2b8], 2
jne 0x14000cb81
mov eax, 1
jmp 0x14000ccd3
mov r9d, 0x104
lea r8, [rsp + 0x50]
mov edx, 0x17
mov rcx, qword [0x140056068]
call qword [sym.imp.USER32.dll_LoadStringA]
lea r8, [rsp + 0x50]
mov edx, 0x3e9
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x160], eax
cmp dword [rsp + 0x160], 0
jne 0x14000ccaa
mov r9d, 0x104
lea r8, [rsp + 0x170]
xor edx, edx
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [rsp + 0x16c], eax
mov dword [rsp + 0x164], 0x104
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x164]
lea r8, [rsp + 0x170]
xor edx, edx
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [rsp + 0x168], eax
cmp dword [rsp + 0x16c], 0
je 0x14000cc9c
cmp dword [rsp + 0x168], 0
je 0x14000cc9c
mov rdx, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x3e8
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.140023060
add rsp, 0x298
ret