joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014630
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
xor ebp, ebp
lea rdx, str.SUBSYS_E0001458
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x78], rbp
mov dword [rsp + 0x60], ebp
mov rsi, rbx
mov dword [rsp + 0x68], ebp
nop dword [rax]
inc rsi
cmp word [rdx + rsi*2], bp
jne 0x140014660
add esi, esi
lea rcx, [0x140382360]
mov r8d, esi
call fcn.14015dc80
mov r8d, esi
lea rdx, str.SUBSYS_12021462
lea rcx, [0x1403823b4]
mov dword [0x1403823b0], esi
mov dword [0x140382404], esi
call fcn.14015dc80
mov r8d, esi
lea rdx, str.SUBSYS_7A921462
lea rcx, [0x140382408]
call fcn.14015dc80
mov r8d, esi
lea rdx, str.SUBSYS_B9121462
lea rcx, [0x14038245c]
mov dword [0x140382458], esi
call fcn.14015dc80
mov r8d, esi
lea rdx, str.SUBSYS_121C1462
lea rcx, [0x1403824b0]
mov dword [0x1403824ac], esi
call fcn.14015dc80
lea rdx, str.SUBSYS_30001A56
mov dword [0x140382500], esi
inc rbx
cmp word [rdx + rbx*2], bp
jne 0x1400146f7
add ebx, ebx
lea rcx, [0x140382504]
mov r8d, ebx
call fcn.14015dc80
mov dword [0x140382554], ebx
lea rax, [rsp + 0x78]
mov ebx, 1
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, str.SYSTEMCurrentControlSetServicesKiller_Network_ServiceSLibCFG
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140014807
mov rcx, qword [rsp + 0x78]
lea rax, [0x1403825a8]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [0x140382558]
mov dword [0x1403825a8], 0x46
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.MultiGig_ID
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001479a
cmp dword [rsp + 0x60], ebx
jne 0x14001479a
mov dword [reloc.OLEAUT32.dll_SysStringLen], 7
jmp 0x1400147a0
mov dword [0x1403825a8], ebp
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.MgNumRanges
mov dword [rsp + 0x70], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400147f3
cmp dword [rsp + 0x60], 4
jne 0x1400147f3
mov ebx, dword [0x14022bcfc]
add ebx, dword [rsp + 0x68]
mov dword [0x14022bcfc], ebx
test ebx, ebx
je 0x140014807
mov rcx, qword [rsp + 0x78]
call fcn.140014140
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140014817
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [0x1403825b0], rbp
jne 0x140014825
call fcn.140014830
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140014830
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
xor edx, edx
lea rcx, str.SetupAPI.dll
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1403825b0], rax
test rax, rax
je 0x14001493f
lea rdx, str.SetupDiGetClassDevsW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140382798], rax
test rax, rax
je 0x14001491f
mov rcx, qword [0x1403825b0]
lea rdx, [0x1401d77d0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140382788], rax
test rax, rax
je 0x14001491f
mov rcx, qword [0x1403825b0]
lea rdx, [0x1401d77e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140382770], rax
test rax, rax
je 0x14001491f
mov rcx, qword [0x1403825b0]
lea rdx, [0x1401d7810]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140382778], rax
test rax, rax
je 0x14001491f
mov rcx, qword [0x1403825b0]
lea rdx, str.SetupDiEnumDeviceInterfaces
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140382780], rax
test rax, rax
je 0x140014918
mov rcx, qword [0x1403825b0]
lea rdx, str.SetupDiGetDeviceInterfaceDetailW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140382790], rax
mov al, 1
add rsp, 0x28
ret
mov rax, qword [0x1403825b0]
test rax, rax
je 0x14001493f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1403825b0], 0
xor al, al
add rsp, 0x28
ret
Function at 0x140022930
Capabilities:
Start service

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov qword [rbp - 0x79], 0xfffffffffffffffe
mov rax, qword [0x14022b078]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rdx
mov qword [rbp - 0x31], rdx
xor sil, sil
mov rcx, qword [rcx + 8]
xor r14d, r14d
test rcx, rcx
je 0x140022a73
cmp qword [rdx + 0x18], 8
jb 0x14002297d
mov rdx, qword [rdx]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
mov qword [rbp - 0x21], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 9], xmm1
movdqa xmmword [rbp + 7], xmm0
mov qword [rbp - 0x39], r14
mov r8, r14
lea rdx, vtable.std::_Func_impl_no_alloc_int____cdecl___struct_SC_HANDLE______ptr64___int__struct_SC_HANDLE______ptr64_.0
cmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle], r14
je 0x1400229d1
mov qword [rbp - 0x71], rdx
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbp - 0x69], rax
lea rax, [rbp - 0x71]
mov qword [rbp - 0x39], rax
lea r8, [rbp - 0x71]
mov rcx, rdi
mov qword [rbp - 0x29], rcx
mov rax, r14
mov qword [rbp + 0x17], rax
test r8, r8
je 0x140022a16
mov qword [rbp - 0x21], rdx
mov rax, qword [r8 + 8]
mov qword [rbp - 0x19], rax
lea rax, [rbp - 0x21]
mov qword [rbp + 0x17], rax
lea rdx, [rbp - 0x71]
cmp r8, rdx
je 0x140022a16
mov edx, 0x10
mov rcx, r8
call fcn.14013f180
mov rax, qword [rbp + 0x17]
mov rcx, qword [rbp - 0x29]
test rdi, rdi
je 0x140022a37
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
setne sil
mov rax, qword [rbp + 0x17]
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140022a57
test rax, rax
je 0x140022adc
mov rax, qword [rax + 8]
call qword [case.0x14001c280.0]
mov qword [rbp - 0x29], r14
mov rax, qword [rbp + 0x17]
test rax, rax
je 0x140022a73
lea rcx, [rbp - 0x21]
cmp rax, rcx
je 0x140022a73
mov edx, 0x10
mov rcx, rax
call fcn.14013f180
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140022aae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140022aa9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140022ae2
mov rcx, r8
call fcn.14013f180
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
movzx eax, sil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14013f550
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14011cfe0
nop
call fcn.14016111c
int3
Function at 0x140022f50
Capabilities:
Query service status

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xf8
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14022b078]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, r8
mov rbx, rdx
mov qword [rbp - 0x61], rdx
xor r14b, r14b
mov dword [r8], 0xffffffff
mov rcx, qword [rcx + 8]
xor r15d, r15d
test rcx, rcx
je 0x1400230b9
cmp qword [rdx + 0x18], 8
jb 0x140022faa
mov rdx, qword [rdx]
mov r8d, r9d
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
mov qword [rbp - 0x51], r15
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x49], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x69], r15
mov rcx, r15
lea rdx, vtable.std::_Func_impl_no_alloc_int____cdecl___struct_SC_HANDLE______ptr64___int__struct_SC_HANDLE______ptr64_.0
cmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle], r15
je 0x140023005
mov qword [rsp + 0x28], rdx
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rbp - 0x69], rax
lea rcx, [rsp + 0x28]
mov qword [rbp - 0x59], rdi
mov rax, r15
mov qword [rbp - 0x19], rax
test rcx, rcx
je 0x140023041
mov qword [rbp - 0x51], rdx
mov rax, qword [rcx + 8]
mov qword [rbp - 0x49], rax
lea rax, [rbp - 0x51]
mov qword [rbp - 0x19], rax
lea rdx, [rsp + 0x28]
cmp rcx, rdx
je 0x140023041
mov edx, 0x10
call fcn.14013f180
mov rax, qword [rbp - 0x19]
test rdi, rdi
je 0x140023077
xor eax, eax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], eax
lea rdx, [rbp - 9]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
setne r14b
test eax, eax
je 0x140023073
mov eax, dword [rbp - 5]
mov dword [rsi], eax
mov rax, qword [rbp - 0x19]
cmp qword [rbp - 0x59], 0
je 0x14002309d
test rax, rax
je 0x140023124
mov rcx, qword [rbp - 0x59]
mov rax, qword [rax + 8]
call qword [case.0x14001c280.0]
mov qword [rbp - 0x59], r15
mov rax, qword [rbp - 0x19]
test rax, rax
je 0x1400230b9
lea rcx, [rbp - 0x51]
cmp rax, rcx
je 0x1400230b9
mov edx, 0x10
mov rcx, rax
call fcn.14013f180
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400230f4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400230ef
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002312a
mov rcx, r8
call fcn.14013f180
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
movzx eax, r14b
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14013f550
add rsp, 0xf8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14011cfe0
nop
call fcn.14016111c
int3
Function at 0x140023130
Capabilities:
Query service status

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xe8
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x14022b078]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x38], rdx
xor r14b, r14b
xor r15d, r15d
mov dword [r8], r15d
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400232ac
cmp qword [rdx + 0x18], 8
jb 0x140023187
mov rdx, qword [rdx]
mov r8d, r9d
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
mov qword [rbp - 0x71], r15
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x69], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x59], xmm1
movdqa xmmword [rbp - 0x49], xmm0
mov qword [rbp + 0xf], r15
mov rcx, r15
lea rdx, vtable.std::_Func_impl_no_alloc_int____cdecl___struct_SC_HANDLE______ptr64___int__struct_SC_HANDLE______ptr64_.0
cmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle], r15
je 0x1400231de
mov qword [rbp - 0x29], rdx
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbp - 0x21], rax
lea rax, [rbp - 0x29]
mov qword [rbp + 0xf], rax
lea rcx, [rbp - 0x29]
mov qword [rbp - 0x79], rdi
mov rax, r15
mov qword [rbp - 0x39], rax
test rcx, rcx
je 0x140023219
mov qword [rbp - 0x71], rdx
mov rax, qword [rcx + 8]
mov qword [rbp - 0x69], rax
lea rax, [rbp - 0x71]
mov qword [rbp - 0x39], rax
lea rdx, [rbp - 0x29]
cmp rcx, rdx
je 0x140023219
mov edx, 0x10
call fcn.14013f180
mov rax, qword [rbp - 0x39]
test rdi, rdi
je 0x14002326a
xor eax, eax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov dword [rbp - 9], eax
mov dword [rsp + 0x38], r15d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rbp - 0x29]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
setne r14b
test eax, eax
je 0x140023266
mov eax, dword [rbp - 0xd]
mov dword [rsi], eax
mov rax, qword [rbp - 0x39]
cmp qword [rbp - 0x79], 0
je 0x140023290
test rax, rax
je 0x140023317
mov rcx, qword [rbp - 0x79]
mov rax, qword [rax + 8]
call qword [case.0x14001c280.0]
mov qword [rbp - 0x79], r15
mov rax, qword [rbp - 0x39]
test rax, rax
je 0x1400232ac
lea rcx, [rbp - 0x71]
cmp rax, rcx
je 0x1400232ac
mov edx, 0x10
mov rcx, rax
call fcn.14013f180
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400232e7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400232e2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002331d
mov rcx, r8
call fcn.14013f180
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
movzx eax, r14b
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14013f550
add rsp, 0xe8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14011cfe0
nop
call fcn.14016111c
int3
Function at 0x140023c40
Capabilities:
Access the windows event log

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x100
mov rax, qword [0x14022b078]
xor rax, rsp
mov qword [rsp + 0xf0], rax
movzx esi, dx
mov r14d, r9d
mov rdx, qword [rsp + 0x150]
movzx ebp, r8w
mov rbx, rcx
cmp qword [rdx + 0x18], 8
jb 0x140023c7f
mov rdx, qword [rdx]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x140023d8a
cmp qword [rbx + 0x18], 8
jb 0x140023c9d
mov rbx, qword [rbx]
xor eax, eax
mov qword [rsp + 0x98], rbx
xor ebx, ebx
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0x90], rbx
cmp qword [sym.imp.ADVAPI32.dll_DeregisterEventSource], rax
je 0x140023d27
lea rax, vtable.std::_Func_impl_no_alloc_int____cdecl___void____ptr64___int__void____ptr64_.0
mov qword [rsp + 0x58], rax
mov rax, qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x90], rax
lea r8, [rsp + 0x58]
mov rdx, rdi
lea rcx, [rsp + 0xa0]
call fcn.1400168f0
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
mov ecx, 1
mov dword [rsp + 0x30], ebx
mov r9d, r14d
mov word [rsp + 0x28], cx
movzx r8d, bp
mov rcx, rdi
mov qword [rsp + 0x20], rbx
movzx edx, si
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp eax, 1
lea rcx, [rsp + 0xa0]
sete bl
call fcn.140016800
movzx eax, bl
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14013f550
add rsp, 0x100
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140023e60
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0xe8
mov rax, qword [0x14022b078]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0xb0
call fcn.14015e120
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov r8d, 0xb0
lea ecx, [r9 + 0x50]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140023eee
mov rax, qword [rsp + 0x80]
add rax, qword [rsp + 0x78]
add rax, qword [rsp + 0x70]
add rax, qword [rsp + 0x68]
add rax, qword [rsp + 0x60]
add rax, qword [rsp + 0x58]
add rax, qword [rsp + 0x50]
add rax, qword [rsp + 0x48]
shl rax, 0xc
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14013f550
add rsp, 0xe8
ret
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14013f550
add rsp, 0xe8
ret
Function at 0x140029cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov rax, qword [0x14022b078]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, r9
mov rsi, r8
xor eax, eax
mov qword [rbp - 0x18], rax
xor r12d, r12d
mov qword [rbp - 0x20], r12
mov dword [rbp - 0x18], r12d
mov qword [rbp - 0x10], r12
cmp qword [rdx + 0x18], 8
jb 0x140029d20
mov rdx, qword [rdx]
movzx r9d, byte [rbp + 0x60]
shl r9d, 9
add r9d, 0x20019
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x20]
call fcn.14002f7c0
mov edi, eax
test eax, eax
jne 0x140029ea2
mov qword [rbp - 0x40], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov eax, r12d
mov dword [rbp - 0x48], eax
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x140029da4
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140029d71
mov rdx, qword [rsi]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x28]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
cmp eax, 0xea
mov eax, dword [rbp - 0x48]
je 0x140029da4
test ecx, ecx
cmovne eax, r12d
mov dword [rbp - 0x48], eax
mov edx, eax
lea r8, [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.140024280
mov rax, qword [rbp - 0x38]
mov r14, qword [rbp - 0x40]
sub rax, r14
cmp qword [rsi + 0x18], 8
jb 0x140029dc8
mov rsi, qword [rsi]
add eax, eax
mov dword [rbp - 0x48], eax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x28]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140029e55
mov eax, dword [rbp - 0x28]
dec eax
cmp eax, 1
jbe 0x140029e05
mov edi, SafeArrayDestroy
jmp 0x140029e55
test r14, r14
je 0x140029e2c
mov eax, dword [rbp - 0x48]
test eax, eax
je 0x140029e28
test al, 1
jne 0x140029e21
shr rax, 1
cmp word [r14 + rax*2 - 2], 0
je 0x140029e2c
mov edi, SafeArrayDestroy
jmp 0x140029e55
mov word [r14], r12w
mov edi, r12d
mov rcx, qword [rbp - 0x40]
cmp qword [rbp - 0x38], rcx
je 0x140029e59
mov r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], r12w
jne 0x140029e40
mov rdx, rcx
mov rcx, r15
call fcn.140017000
mov rcx, qword [rbp - 0x40]
test rbx, rbx
je 0x140029e6e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140029ea6
mov rdx, qword [rbp - 0x30]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029e9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029ed4
call fcn.14013f180
jmp 0x140029ea6
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x140029eb4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14013f550
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14016111c
nop
int3
Function at 0x14002a240
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x14022b078]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebp, ebp
mov rsi, r9
cmp qword [rdx + 0x18], 8
mov rbx, r8
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x48], rbp
jb 0x14002a279
mov rdx, qword [rdx]
movzx r9d, byte [rsp + 0xb0]
mov r8, rdx
shl r9d, 9
mov rdx, rcx
add r9d, 0x20019
lea rcx, [rsp + 0x38]
call fcn.14002f7c0
mov edi, eax
test eax, eax
jne 0x14002a304
cmp qword [rbx + 0x18], 8
jb 0x14002a2ad
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov rcx, rdi
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x14002a2f2
cmp dword [rsp + 0x34], 4
mov ebx, ebp
mov eax, SafeArrayDestroy
cmovne ebx, eax
test rdi, rdi
je 0x14002a300
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14002a316
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14002a316
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14013f550
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14002a330
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x14022b078]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebp, ebp
mov dword [rsp + 0x30], r9d
cmp qword [rdx + 0x18], 8
mov esi, r9d
mov rdi, r8
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x50], rbp
jb 0x14002a36e
mov rdx, qword [rdx]
movzx r9d, byte [rsp + 0xb0]
mov r8, rdx
shl r9d, 9
mov rdx, rcx
add r9d, 0x20019
lea rcx, [rsp + 0x40]
call fcn.14002f7c0
mov ebx, eax
test eax, eax
jne 0x14002a3f6
cmp qword [rdi + 0x18], 8
jb 0x14002a3a2
mov rdi, qword [rdi]
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
mov rdx, rdi
lea rax, [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x14002a3ec
cmp dword [rsp + 0x38], 4
mov ebx, ebp
mov eax, SafeArrayDestroy
cmovne ebx, eax
test rdi, rdi
je 0x14002a406
mov rcx, rdi
jmp 0x14002a400
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14002a406
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
test ebx, ebx
cmovne eax, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14013f550
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002a580
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14022b078]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, r8
xor sil, sil
xor r8d, r8d
mov edi, r9d
cmp qword [rdx + 0x18], 8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x58], r8
jb 0x14002a5bc
mov rdx, qword [rdx]
movzx eax, byte [rsp + 0xb0]
xor r9d, r9d
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
shl eax, 9
add eax, 0x20006
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14002f630
test eax, eax
jne 0x14002a651
cmp qword [rbx + 0x18], 8
jb 0x14002a600
mov rbx, qword [rbx]
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r9d, 4
mov rcx, rdi
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx ebx, sil
mov ecx, 1
test eax, eax
cmove ebx, ecx
test rdi, rdi
je 0x14002a64c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
jmp 0x14002a665
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002a661
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14013f550
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x14002a680
Capabilities:
Set registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x68
mov rax, qword [0x14022b078]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, r8
mov rbx, r9
xor r8d, r8d
cmp qword [rdx + 0x18], 8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x50], r8
jb 0x14002a6b8
mov rdx, qword [rdx]
movzx eax, byte [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
shl eax, 9
add eax, 0x20006
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.14002f630
test eax, eax
jne 0x14002a770
cmp qword [rbx + 0x18], 8
jb 0x14002a6fc
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x14002a706
mov rdi, qword [rdi]
test rbx, rbx
jne 0x14002a710
lea eax, [rbx + 0xd]
jmp 0x14002a753
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14002a720
mov rcx, qword [rsp + 0x40]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
cmp qword [rsp + 0x40], 0
je 0x14002a76b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
jmp 0x14002a782
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14002a780
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14013f550
add rsp, 0x68
pop rdi
pop rbx
ret