joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002c7b0
Capabilities:
Query service status

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 8]
sub rsp, 0x108
mov rax, qword [0x1401f3030]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x70], rdx
xor r14b, r14b
mov dword [r8], 0xffffffff
mov rcx, qword [rcx + 8]
xor r15d, r15d
test rcx, rcx
je 0x14002c943
cmp qword [rdx + 0x18], 8
jb 0x14002c802
mov rdx, qword [rdx]
mov r8d, r9d
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
mov qword [rbp - 0x78], r15
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmmword [rbp - 0x50], xmm0
mov r8, r15
mov qword [rsp + 0x58], r15
cmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle], r15
je 0x14002c85a
lea rax, vtable.std::_Func_impl_no_alloc_int____cdecl___struct_SC_HANDLE______ptr64___int__struct_SC_HANDLE______ptr64_.0
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov qword [rsp + 0x58], r8
lea rax, [rsp + 0x20]
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x80], rdi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x60], rax
mov rcx, r15
mov qword [rbp - 0x40], rcx
test r8, r8
je 0x14002c89c
mov rax, qword [r8]
lea rdx, [rbp - 0x78]
mov rcx, r8
mov rax, qword [rax]
call qword [case.0x140026a06.0]
mov rcx, rax
mov qword [rbp - 0x40], rax
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x14002c8c0
mov rax, qword [r8]
lea rcx, [rsp + 0x20]
cmp r8, rcx
setne dl
mov rcx, r8
mov rax, qword [rax + 0x20]
call qword [case.0x140026a06.0]
mov rcx, qword [rbp - 0x40]
test rdi, rdi
je 0x14002c8f5
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], eax
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
setne r14b
mov rcx, qword [rbp - 0x40]
test eax, eax
je 0x14002c8f5
mov eax, dword [rbp - 0x2c]
mov dword [rsi], eax
mov rax, qword [rbp - 0x80]
test rax, rax
je 0x14002c926
mov qword [rsp + 0x68], rax
test rcx, rcx
je 0x14002c9ae
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
mov rax, qword [rax + 0x10]
call qword [case.0x140026a06.0]
mov qword [rbp - 0x80], r15
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14002c943
mov rax, qword [rcx]
lea rdx, [rbp - 0x78]
cmp rcx, rdx
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x140026a06.0]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14002c97e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14002c979
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002c9b4
mov rcx, r8
call fcn.140149194
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
movzx eax, r14b
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149500
add rsp, 0x108
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140120f40
nop
call fcn.1401501d4
int3
Function at 0x14002c9c0
Capabilities:
Query service status

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xf8
mov rax, qword [0x1401f3030]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x40], rdx
xor r14b, r14b
xor r15d, r15d
mov dword [r8], r15d
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14002cb5e
cmp qword [rdx + 0x18], 8
jb 0x14002ca0e
mov rdx, qword [rdx]
mov r8d, r9d
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
mov qword [rbp - 0x71], r15
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x69], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x59], xmm1
movdqa xmmword [rbp - 0x49], xmm0
mov r8, r15
mov qword [rbp + 0xf], r15
cmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle], r15
je 0x14002ca61
lea rax, vtable.std::_Func_impl_no_alloc_int____cdecl___struct_SC_HANDLE______ptr64___int__struct_SC_HANDLE______ptr64_.0
mov qword [rbp - 0x29], rax
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbp - 0x21], rax
lea r8, [rbp - 0x29]
mov qword [rbp + 0xf], r8
lea rax, [rbp - 0x29]
mov qword [rsp + 0x38], rax
mov qword [rbp - 0x79], rdi
lea rax, [rbp - 0x71]
mov qword [rsp + 0x30], rax
mov rcx, r15
mov qword [rbp - 0x39], rcx
test r8, r8
je 0x14002caa1
mov rax, qword [r8]
lea rdx, [rbp - 0x71]
mov rcx, r8
mov rax, qword [rax]
call qword [case.0x140026a06.0]
mov rcx, rax
mov qword [rbp - 0x39], rax
mov r8, qword [rbp + 0xf]
test r8, r8
je 0x14002cac4
mov rax, qword [r8]
lea rcx, [rbp - 0x29]
cmp r8, rcx
setne dl
mov rcx, r8
mov rax, qword [rax + 0x20]
call qword [case.0x140026a06.0]
mov rcx, qword [rbp - 0x39]
test rdi, rdi
je 0x14002cb10
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], eax
mov dword [rsp + 0x38], r15d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rbp - 0x29]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
setne r14b
mov rcx, qword [rbp - 0x39]
test eax, eax
je 0x14002cb10
mov eax, dword [rbp - 0xd]
mov dword [rsi], eax
mov rax, qword [rbp - 0x79]
test rax, rax
je 0x14002cb41
mov qword [rsp + 0x38], rax
test rcx, rcx
je 0x14002cbc9
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
mov rax, qword [rax + 0x10]
call qword [case.0x140026a06.0]
mov qword [rbp - 0x79], r15
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x14002cb5e
mov rax, qword [rcx]
lea rdx, [rbp - 0x71]
cmp rcx, rdx
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x140026a06.0]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14002cb99
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14002cb94
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002cbcf
mov rcx, r8
call fcn.140149194
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
movzx eax, r14b
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140149500
add rsp, 0xf8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140120f40
nop
call fcn.1401501d4
int3
Function at 0x14002d730
Capabilities:
Access the windows event log

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1401f3030]
xor rax, rsp
mov qword [rbp], rax
mov r12d, r9d
movzx r15d, r8w
movzx r14d, dx
mov rbx, rcx
mov rdx, qword [rbp + 0x70]
xor sil, sil
cmp qword [rdx + 0x18], 8
jb 0x14002d774
mov rdx, qword [rdx]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x14002d8bc
cmp qword [rbx + 0x18], 8
jb 0x14002d792
mov rbx, qword [rbx]
mov qword [rbp - 0x60], rbx
xor ebx, ebx
mov qword [rbp - 0x48], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmmword [rbp - 0x20], xmm0
mov ecx, ebx
mov qword [rbp - 0x78], rbx
cmp qword [sym.imp.ADVAPI32.dll_DeregisterEventSource], rbx
je 0x14002d7e1
lea rax, vtable.std::_Func_impl_no_alloc_int____cdecl___void____ptr64___int__void____ptr64_.0
mov qword [rsp + 0x50], rax
mov rax, qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x50]
mov qword [rbp - 0x78], rcx
lea rax, [rsp + 0x50]
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x50], rdi
lea rax, [rbp - 0x48]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x10], rbx
test rcx, rcx
je 0x14002d817
mov rax, qword [rcx]
lea rdx, [rbp - 0x48]
mov rax, qword [rax]
call qword [case.0x140026a06.0]
mov qword [rbp - 0x10], rax
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14002d834
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
cmp rcx, rdx
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x140026a06.0]
mov ecx, 1
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x28], cx
mov qword [rsp + 0x20], rbx
mov r9d, r12d
movzx r8d, r15w
movzx edx, r14w
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp eax, 1
sete sil
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x14002d89b
mov qword [rbp - 0x68], rax
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14002d8de
mov rax, qword [rcx]
lea rdx, [rbp - 0x68]
mov rax, qword [rax + 0x10]
call qword [case.0x140026a06.0]
mov qword [rbp - 0x50], rbx
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14002d8bc
mov rax, qword [rcx]
lea rdx, [rbp - 0x48]
cmp rcx, rdx
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x140026a06.0]
nop
movzx eax, sil
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140149500
add rsp, 0x110
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140120f40
nop
int3
Function at 0x14002d9a0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0xe8
mov rax, qword [0x1401f3030]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0xb0
call fcn.14014ba20
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov r8d, 0xb0
lea ecx, [r9 + 0x50]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14002da2e
mov rax, qword [rsp + 0x80]
add rax, qword [rsp + 0x78]
add rax, qword [rsp + 0x70]
add rax, qword [rsp + 0x68]
add rax, qword [rsp + 0x60]
add rax, qword [rsp + 0x58]
add rax, qword [rsp + 0x50]
add rax, qword [rsp + 0x48]
shl rax, 0xc
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140149500
add rsp, 0xe8
ret
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140149500
add rsp, 0xe8
ret
Function at 0x140031f30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0x88
mov rax, qword [0x1401f3030]
xor rax, rsp
mov qword [rbp - 1], rax
mov r13, r9
mov r14, r8
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
xor ebx, ebx
mov qword [rbp - 0x31], rbx
mov dword [rbp - 0x29], ebx
mov qword [rbp - 0x21], rbx
cmp qword [rdx + 0x18], 8
jb 0x140031f7b
mov rdx, qword [rdx]
movzx r9d, byte [rbp + 0x7f]
shl r9d, 9
add r9d, 0x20019
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x31]
call fcn.140034570
mov esi, eax
test eax, eax
jne 0x140032110
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x19], xmm0
mov r15, rbx
mov qword [rbp - 9], rbx
mov eax, ebx
mov dword [rbp - 0x3d], ebx
mov rdi, qword [rbp - 0x31]
test rdi, rdi
je 0x140032000
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140031fce
mov rdx, qword [r14]
lea rax, [rbp - 0x3d]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
cmp eax, 0xea
mov eax, dword [rbp - 0x3d]
je 0x140032000
test ecx, ecx
cmovne eax, ebx
mov dword [rbp - 0x3d], eax
mov edx, eax
test eax, eax
je 0x140032017
lea r8, [rbp - 0x41]
lea rcx, [rbp - 0x19]
call fcn.14002deb0
mov r15, qword [rbp - 9]
mov r12, qword [rbp - 0x11]
mov rbx, qword [rbp - 0x19]
sub r12, rbx
cmp qword [r14 + 0x18], 8
jb 0x14003202c
mov r14, qword [r14]
lea eax, [r12 + r12]
mov dword [rbp - 0x3d], eax
lea rax, [rbp - 0x3d]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
je 0x14003205f
xor r14d, r14d
jmp 0x1400320c9
mov eax, dword [rbp - 0x39]
dec eax
cmp eax, 1
jbe 0x140032073
mov esi, SafeArrayDestroy
xor r14d, r14d
jmp 0x1400320c9
test rbx, rbx
je 0x1400320a1
mov eax, dword [rbp - 0x3d]
test eax, eax
je 0x140032098
test al, 1
jne 0x14003208e
shr rax, 1
cmp word [rbx + rax*2 - 2], 0
je 0x1400320a1
mov esi, SafeArrayDestroy
xor r14d, r14d
jmp 0x1400320c9
xor r14d, r14d
mov word [rbx], r14w
jmp 0x1400320a4
xor r14d, r14d
mov esi, r14d
test r12, r12
je 0x1400320c9
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400320b3
mov rdx, rbx
mov rcx, r13
call fcn.140020fa0
test rdi, rdi
je 0x1400320da
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r14
test rbx, rbx
je 0x140032114
sub r15, rbx
mov rax, rbx
cmp r15, 0x1000
jb 0x140032103
add r15, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032144
mov rdx, r15
mov rcx, rbx
call fcn.140149194
jmp 0x140032114
mov rdi, qword [rbp - 0x31]
test rdi, rdi
je 0x140032122
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140149500
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401501d4
nop
int3
Function at 0x1400325a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x1401f3030]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebp, ebp
mov rsi, r9
cmp qword [rdx + 0x18], 8
mov rbx, r8
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x48], rbp
jb 0x1400325d9
mov rdx, qword [rdx]
movzx r9d, byte [rsp + 0xb0]
mov r8, rdx
shl r9d, 9
mov rdx, rcx
add r9d, 0x20019
lea rcx, [rsp + 0x38]
call fcn.140034570
mov edi, eax
test eax, eax
jne 0x140032665
cmp qword [rbx + 0x18], 8
jb 0x14003260d
mov rbx, qword [rbx]
mov rdx, rbx
mov dword [rsp + 0x30], 4
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov rcx, rbx
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140032652
cmp dword [rsp + 0x34], 4
mov edi, ebp
mov eax, SafeArrayDestroy
cmovne edi, eax
test rbx, rbx
je 0x140032678
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
jmp 0x14003266a
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140032678
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140149500
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140032690
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x1401f3030]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebp, ebp
mov qword [rsp + 0x38], r9
cmp qword [rdx + 0x18], 8
mov rsi, r9
mov rbx, r8
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x50], rbp
jb 0x1400326ce
mov rdx, qword [rdx]
movzx r9d, byte [rsp + 0xb0]
mov r8, rdx
shl r9d, 9
mov rdx, rcx
add r9d, 0x20019
lea rcx, [rsp + 0x40]
call fcn.140034570
mov edi, eax
test eax, eax
jne 0x14003275f
cmp qword [rbx + 0x18], 8
jb 0x140032702
mov rbx, qword [rbx]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 8
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov rdx, rbx
lea rax, [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14003274c
cmp dword [rsp + 0x34], 0xb
mov edi, ebp
mov eax, SafeArrayDestroy
cmovne edi, eax
test rbx, rbx
je 0x140032772
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
jmp 0x140032764
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140032772
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x38]
test edi, edi
cmovne rax, rsi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140149500
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400327a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x1401f3030]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebp, ebp
mov dword [rsp + 0x30], r9d
cmp qword [rdx + 0x18], 8
mov esi, r9d
mov rbx, r8
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x50], rbp
jb 0x1400327de
mov rdx, qword [rdx]
movzx r9d, byte [rsp + 0xb0]
mov r8, rdx
shl r9d, 9
mov rdx, rcx
add r9d, 0x20019
lea rcx, [rsp + 0x40]
call fcn.140034570
mov edi, eax
test eax, eax
jne 0x14003286f
cmp qword [rbx + 0x18], 8
jb 0x140032812
mov rbx, qword [rbx]
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
mov rdx, rbx
lea rax, [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14003285c
cmp dword [rsp + 0x38], 4
mov edi, ebp
mov eax, SafeArrayDestroy
cmovne edi, eax
test rbx, rbx
je 0x140032882
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
jmp 0x140032874
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140032882
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
test edi, edi
cmovne eax, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140149500
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140032a50
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x1401f3030]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebp, ebp
xor dil, dil
cmp qword [rdx + 0x18], 8
mov esi, r9d
mov rbx, r8
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x58], rbp
jb 0x140032a8c
mov rdx, qword [rdx]
movzx eax, byte [rsp + 0xc0]
mov r8, rdx
mov qword [rsp + 0x38], rbp
mov rdx, rcx
shl eax, 9
lea rcx, [rsp + 0x48]
add eax, 0x20006
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov dword [rsp + 0x20], ebp
call fcn.1400343e0
test eax, eax
jne 0x140032b20
cmp qword [rbx + 0x18], 8
jb 0x140032acf
mov rbx, qword [rbx]
mov rdx, rbx
mov dword [rsp + 0x28], 4
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov rcx, rbx
mov dword [rsp + 0x40], esi
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx edi, dil
mov ecx, 1
test eax, eax
cmove edi, ecx
test rbx, rbx
je 0x140032b33
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
jmp 0x140032b25
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x140032b33
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140149500
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140032b50
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1401f3030]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebp, ebp
xor sil, sil
cmp qword [rdx + 0x18], 8
mov rbx, r9
mov r14, r8
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x50], rbp
jb 0x140032b8e
mov rdx, qword [rdx]
movzx eax, byte [rsp + 0xb0]
mov r8, rdx
mov qword [rsp + 0x38], rbp
mov rdx, rcx
shl eax, 9
lea rcx, [rsp + 0x40]
add eax, 0x20006
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov dword [rsp + 0x20], ebp
call fcn.1400343e0
test eax, eax
jne 0x140032c3a
cmp qword [rbx + 0x18], 8
jb 0x140032bd1
mov rbx, qword [rbx]
cmp qword [r14 + 0x18], 8
jb 0x140032bdb
mov r14, qword [r14]
mov rdi, qword [rsp + 0x40]
test rbx, rbx
jne 0x140032bea
lea eax, [rbx + 0xd]
jmp 0x140032c21
mov rax, 0xffffffffffffffff
cmp word [rbx + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x140032bf1
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete sil
test rdi, rdi
je 0x140032c4d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, rbp
jmp 0x140032c3f
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x140032c4d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140149500
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400341b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1401f3030]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x50], rbp
mov r9d, dword [rcx + 8]
or r9d, 0x2001f
mov r8, rdx
mov rdx, qword [rcx]
lea rcx, [rsp + 0x40]
call fcn.140034570
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x14003433c
mov dword [rsp + 0x58], 0x100
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x70]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400342a5
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.1400341b0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x14003433c
mov dword [rsp + 0x58], 0x100
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x70]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140034250
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400342ba
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], ebp
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x14003436c
mov rdi, qword [rdi]
cmp qword [rbx], 0
je 0x140034323
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1400342ed
mov ebx, 1
jmp 0x140034337
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400342e6
mov qword [rsp + 0x28], rbp
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [case.0x140026a06.0]
jmp 0x140034335
cmp dword [rbx + 8], 0
je 0x1400342e6
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140034347
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140149500
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
cmp byte [0x14034bec0], 0
jne 0x1400343b7
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400343a7
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14034beb8], rax
mov byte [0x14034bec0], 1
jmp 0x1400343be
mov rax, qword [0x14034beb8]
mov byte [0x14034bec0], 1
jmp 0x1400343be
mov rax, qword [0x14034beb8]
mov rcx, qword [rdi]
test rax, rax
je 0x14003432c
xor r9d, r9d
mov r8d, dword [rdi + 8]
mov rdx, rsi
call qword [case.0x140026a06.0]
jmp 0x140034335